Edit tour

Windows Analysis Report
November 14.docx

Overview

General Information

Sample Name:	November 14.docx
Analysis ID:	746872
MD5:	7210f674a1630d302d9475b0140c1456
SHA1:	1503ef7acb67d092f08b582ef6f02b353c5f666d
SHA256:	92cb6c458b180b338265041f6bfe1fd0b132052e3623362d2d3908e7566b2982
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2728 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

chrome.exe (PID: 1552 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 6ACAE527E744C80997B25EF2A0485D5E)

chrome.exe (PID: 972 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,15074013449318184513,6246681292651001585,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1468 /prefetch:8 MD5: 6ACAE527E744C80997B25EF2A0485D5E)

AcroRd32.exe (PID: 3448 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\BILLS-117hres1465ih.pdf MD5: 2F8D93826B8CBF9290BC57535C7A6817)

RdrCEF.exe (PID: 3720 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 326A645391A97C760B60C558A35BB068)

chrome.exe (PID: 2088 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://www.congress.gov/117/bills/hres1465/BILLS-117hres1465ih.pdf MD5: 6ACAE527E744C80997B25EF2A0485D5E)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=WP.289365

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{196E1EB9-5A31-4C9D-B584-2ED880BFB777}.tmp

Jump to behavior

Source: ~WRF{650A542E-C164-4C97-8328-4F5358A18406}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6BCC.tmp

Jump to behavior

Source: classification engine

Classification label: clean1.winDOCX@42/18@5/6

Source: ~WRF{650A542E-C164-4C97-8328-4F5358A18406}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{650A542E-C164-4C97-8328-4F5358A18406}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{650A542E-C164-4C97-8328-4F5358A18406}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,15074013449318184513,6246681292651001585,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1468 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://www.congress.gov/117/bills/hres1465/BILLS-117hres1465ih.pdf
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\BILLS-117hres1465ih.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,15074013449318184513,6246681292651001585,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1468 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\BILLS-117hres1465ih.pdf	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: November 14.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\November 14.docx

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$vember 14.docx

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: ~WRF{650A542E-C164-4C97-8328-4F5358A18406}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
accounts.google.com	172.217.23.109	true	false	high
www.congress.gov	104.16.173.252	true	false	high
clients.l.google.com	142.250.185.174	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc	false	high
https://www.congress.gov/117/bills/hres1465/BILLS-117hres1465ih.pdf	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.congress.gov/117/crpt/srpt178/CRPT-117srpt178.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.ernst.senate.gov/news/press-releases/during-veterans-small-business-week-ernst-continues	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://oversight.house.gov/legislation/hearings/jrotc-protecting-cadets-from-sexual-abuse-and-instr	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/117/bills/hres1464/BILLS-117hres1464rh.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/117/bills/s1941/BILLS-117s1941es.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/congressional-report/117th-congress/house-report/556/1?q=%7B%22search%22%3A	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/117/bills/s4524/BILLS-117s4524es.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/117/bills/s4337/BILLS-117s4337rs.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.whitehouse.gov/wp-content/uploads/2022/11/SAP-S-4524.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/117/bills/s533/BILLS-117s533es.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/117/bills/hres1470/BILLS-117hres1470ih.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high
https://www.congress.gov/117/bills/s3510/BILLS-117s3510es.pdf	~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	clients.l.google.com	United States	15169	GOOGLEUS	false
104.16.173.252	www.congress.gov	United States	13335	CLOUDFLARENETUS	false
172.217.23.109	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.255
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	746872
Start date and time:	2022-11-15 20:21:18 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	November 14.docx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.winDOCX@42/18@5/6
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://www.congress.gov/117/bills/hres1465/BILLS-117hres1465ih.pdf Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, vga.dll
Excluded IPs from analysis (whitelisted): 142.250.185.99, 34.104.35.123, 184.30.20.134, 80.67.82.80, 80.67.82.97, 142.250.74.195
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, edgedl.me.gvt1.com, armmf.adobe.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, update.googleapis.com, clientservices.googleapis.com, www.gstatic.com, acroipm2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: November 14.docx

Simulations

Behavior and APIs

Time	Type	Description
20:21:59	API Interceptor	658x Sleep call for process: AcroRd32.exe modified
20:22:04	API Interceptor	82x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	http://toonworld4all.me	Get hash	malicious	Browse
	AL-2022-0006344267556456767.eml	Get hash	malicious	Browse
	https://tfswhxpe.ga/	Get hash	malicious	Browse
	https://ncv.microsoft.com/KE8YFx1Fh6	Get hash	malicious	Browse
	https://docspreadsheet-com.webnode.page/contact/	Get hash	malicious	Browse
	https://technoray-medical.com/adminnew/js/awb_shipment_document_1511202200000000000%5B128kb%5D.cab	Get hash	malicious	Browse
	RevisedCD_725757097.html	Get hash	malicious	Browse
	RevisedCD_017034210.html	Get hash	malicious	Browse
	https://hollabaugh-my.sharepoint.com/:o:/g/personal/cmitchell_hbarep_com/Eo9KB7unx6dJiaxqkHOo-AQBrSfA1fCnVNi7gLEPeBsU_A?e=5%3awxP7Mo&at=9	Get hash	malicious	Browse
	https://hollabaugh-my.sharepoint.com/:o:/g/personal/cmitchell_hbarep_com/Eo9KB7unx6dJiaxqkHOo-AQBrSfA1fCnVNi7gLEPeBsU_A?e=5%3awxP7Mo&at=9	Get hash	malicious	Browse
	PayrollUpdate_for_john.higgins.html	Get hash	malicious	Browse
	15 November, 2022155943 PM.html	Get hash	malicious	Browse
	http://health-and-skincare.com/?e=9726540706f696e746c6f6d612e656475	Get hash	malicious	Browse
	https://www.google.com/url?q=https%3A%2F%2Fabiramihomes.com%2F1%2Findex.php&sa=D&sntz=1&usg=AOvVaw0ZhkYP8mTTCQ9WAj-HWopY	Get hash	malicious	Browse
	https://www.google.com/url?q=https://660706.selcdn.ru/review-invincible-mountainous-crocodile/r.html?email%3D%257B%257Bemail%2520%257C%2520default%257D%257D&source=gmail&ust=1645172551424000&usg=AOvVaw3bWy_wnQEFbERa1_2KfmUX	Get hash	malicious	Browse
	http://cbd0342f1e888.expresskitchenltd.com/#ZWNvdXRvQHN0ZXBhbi5jb20N	Get hash	malicious	Browse
	Invoice-404657.htm	Get hash	malicious	Browse
	http://partnersstack.com	Get hash	malicious	Browse
	https://golfcartsmotorstore.com/sl/index.php?cccitaoea-isusptci=7	Get hash	malicious	Browse
	RevisedCD_516439610.html	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	product list.js	Get hash	malicious	Browse	104.21.77.214
	BlitzedGrabberV13.exe	Get hash	malicious	Browse	162.159.135.232
	http://toonworld4all.me	Get hash	malicious	Browse	104.17.25.14
	file.exe	Get hash	malicious	Browse	162.159.133.233
	file.exe	Get hash	malicious	Browse	162.159.133.233
	RevisedCD_725757097.html	Get hash	malicious	Browse	104.18.10.207
	RevisedCD_017034210.html	Get hash	malicious	Browse	104.18.11.207
	dekont.exe	Get hash	malicious	Browse	188.114.97.3
	https://hollabaugh-my.sharepoint.com/:o:/g/personal/cmitchell_hbarep_com/Eo9KB7unx6dJiaxqkHOo-AQBrSfA1fCnVNi7gLEPeBsU_A?e=5%3awxP7Mo&at=9	Get hash	malicious	Browse	104.18.18.132
	kURi8Ephk5.exe	Get hash	malicious	Browse	188.114.96.3
	15 November, 2022155943 PM.html	Get hash	malicious	Browse	104.17.25.14
	http://health-and-skincare.com/?e=9726540706f696e746c6f6d612e656475	Get hash	malicious	Browse	188.114.96.3
	Deckles.exe	Get hash	malicious	Browse	172.67.214.163
	Invoice-404657.htm	Get hash	malicious	Browse	104.17.25.14
	RevisedCD_516439610.html	Get hash	malicious	Browse	104.18.11.207
	RevisedCD_516439610.html	Get hash	malicious	Browse	104.18.10.207
	https://xbigr.mesebun.xyz/?rxm=96a2NvbGxpbnNAZGVyaWNrZGVybWF0b2xvZ3kuY29t	Get hash	malicious	Browse	104.16.243.78
	RevisedCD_516439610.html	Get hash	malicious	Browse	104.18.10.207
	NFEP-CONFIDENTIALITY AGREEMENT(NDA).exe	Get hash	malicious	Browse	188.114.97.3
	Joseluis.garcia-Booking-Notificacion-desde-Juntadeandalucia-9KhEEdSR.htm	Get hash	malicious	Browse	104.26.9.91

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	0.9007140805921954
Encrypted:	false
SSDEEP:	96:ZhPMntPOVMfZ8oZloPMHk7jfPmgvPPD2vQ19IbIdRT1AUinO6zWuLzzfottaaMhL:Zq9Vb8jxiC9kCAU4yjQD
MD5:	02D1B6323D8DE5CA029EF574435FC355
SHA1:	923251FC2836436946BDB13CC90D0758D5B4AED6
SHA-256:	191040E472BADDFE1AE48B5E084223D93044C10A229E6D930243B47B20D48166
SHA-512:	5C346610E997BA4F82CCCEC7D8E522C3C39A958E1E97D9CDCEFF8129A386EBC0D017498B431B8F4FF26D6F01BE26FB87145A87EB4B0E3B4B0CF78308EEFA1C80
Malicious:	false
Preview:	BM........6...(...u...h..... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................qq.......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 15, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.5760409882820294
Encrypted:	false
SSDEEP:	384:neh9dTh0tELJ8DAcLKuZsLRGlKhsvXh+vSc:xAeZsLQhUSc
MD5:	981ED7F4EEC7EFDC99C342186CEB5AC3
SHA1:	B337F6BC39B96311353933A0ACD0EB8F9391BB22
SHA-256:	25FFB57790034AD3C3A769C369E968156C077695B47CAAEB2235E3118DFBDAB5
SHA-512:	8D45C0D09023AFB4963062B3593486EE2FF9DC9380BF0BCA343059E6BEBC6F435F85204ACEC43CE0DA5D82729CA0A20C1BED3234D066DA170B47EC53A2DDEA17
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.310199132463157
Encrypted:	false
SSDEEP:	48:7My2iomVmBsmom1CIiomCBszom1Nom1Aiom1RROiom1Com1pom17iomVKiommOq3:78Cm6rIf6uhnCK6d49IVXEBodRBkt
MD5:	E5DAAFC0F423A0B946FA63F2318F903C
SHA1:	2C937A2C54C764DE55A24501B15BC89368E99CBE
SHA-256:	2294558F31DA7651C8F3AA6E325CC19E2EE59D8412AE0362BD49AEA40520A4D0
SHA-512:	698D5723EE0C10FE3FDD2CDDF424F57648FBEAA14191006D7E6D41F975DC70C469C21538487E2AC072A5E1CD9C12B81572B2D32596A183C60E80586B4E9B5791
Malicious:	false
Preview:	.... .c.....,..M..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W....<.W.L...y.......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, page size 1024, file counter 13, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8551502604787418
Encrypted:	false
SSDEEP:	24:r5Mx/XYKQvGJF7ursj/vv8dyITGFMLjo7j:1Ml2GL7msjHvBITGFMLjsj
MD5:	B7B90A2777DC8523B1F31147A95F9410
SHA1:	C758DA594E25360FF5634676ADB46F341BE41DCC
SHA-256:	F577E3086403E3A77E5B2DFC30C9B7F4059B062DA1C95E32E6C925C3EB9CE55C
SHA-512:	0789635B052EC81B32C0E2D16363FD4EFC225F936D3C37E5F2CFDC276D6A9CA3F871FDFA96A596B14093FAB99B2878082F093DBCEC0BEE41A86C3F32F0AA8787
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...''...tableversion_tableversion_table.CREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY ).....##..itablepref_eventspref_events.CREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL,

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	2576
Entropy (8bit):	3.3397412153619084
Encrypted:	false
SSDEEP:	24:7+tHcvv8dyITGFMEwkq7i8+Px/XYKQvGJF7ursg:7MwvBITGFMEoi7l2GL7msg
MD5:	EBA736ABA8855A155BC4FE84DE254A34
SHA1:	1421CB9D91E30F41A4354D0AE6BEBE60AAD6EA87
SHA-256:	D81C5F782CF6CF5C18E65F955F5B1A3ECF416E0B178F25F6C21F7D0D17E68EE6
SHA-512:	B0565E4D186042E9255B6EA5006040AC0056401FAD2933AADF8AD1F79E255AE814B4C000DF04BB2350856CADFAC58948C6A3334070289E73CE185FE72F5217CC
Malicious:	false
Preview:	.... .c.......3S.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................;....M.....ctel005632a070bf5244b62fd200778c

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{650A542E-C164-4C97-8328-4F5358A18406}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	1.4182412957141795
Encrypted:	false
SSDEEP:	12:rl3lTpFQ3Ifv4fv4CIfv4fv4CICICb77:rn
MD5:	4FCAA58D39931BEA065A67DB20F191E4
SHA1:	750A652D984CBE027261CF8E841384B229A6AAD3
SHA-256:	6D0A10022957A4B9D3F4A24CF255060CF8C558192E6603F69F2F1FBA1E43ECCA
SHA-512:	C94A6B85BB94D3E1CAB8E8E507A8235B76BE013CBBBC0A64F0D21A5EEF7FE0AE338DCFBC1F7DC1A4B0AE28DD7B0C2A5DE526B30B0F4ACC82428CDF631ECE0AC6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	4.343414412993246
Encrypted:	false
SSDEEP:	384:bksqynESOHeIRZQdmtZVOpd+Law7IIVaFYafnqi/iJsOsgzJTt7w+WoVDOo4h6v8:bksqmESOHeIRZQdmtCpd+Law7I8aFYaj
MD5:	0F1A139DAE03A9EF6F6DF325A24EF9E4
SHA1:	3CA558C332D1858C82AA5D9B7A53A257B680AD30
SHA-256:	5347B5BB7582140525B165F39C951E436D5F7FE11BF975B649DCEBE568152B51
SHA-512:	D1DA54155088C23EF32245316E91BD49368C4F863F0897B40A4B2C1DA2D541D35ECBBAA919F27651F95FD7A83FAA9B2EEFD4F37698632A5209871F7C19BD3E71
Malicious:	false
Preview:	..L.E.G.I.S.L.A.T.I.V.E. .U.P.D.A.T.E...M.o.n.d.a.y.,. .N.o.v.e.m.b.e.r. .1.4.,. .2.0.2.2...N.O.T.E.:. . .T.h.i.s. .i.n.f.o.r.m.a.t.i.o.n. .i.s. .p.r.e.p.a.r.e.d. .s.o.l.e.l.y. .f.o.r. .o.f.f.i.c.i.a.l. .u.s.e. .b.y. .o.f.f.i.c.i.a.l.s. .o.f. .t.h.e. .D.e.p.a.r.t.m.e.n.t. .o.f. .E.d.u.c.a.t.i.o.n. .a.n.d. .t.h.e. .E.x.e.c.u.t.i.v.e. .O.f.f.i.c.e. .o.f. .t.h.e. .P.r.e.s.i.d.e.n.t... . .P.l.e.a.s.e. .d.o. .n.o.t. .p.r.o.v.i.d.e. .i.t. .t.o. .o.t.h.e.r.s.....H.O.U.S.E. .B.I.L.L.S. .I.N.T.R.O.D.U.C.E.D... . .o.........(...\...........2...\|...............b.......V%.......................................................................................................................u............u............u............u.........................$.......P..d............^...`.P.gd m............P..d............^...`.P.gd.$'......d............gd.$'...........P..d............^...`.P.gdq\|H...........P..d............^...`.P.gd.'>......d............gd..x......$..d............a$.gd..x.....$........H

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{196E1EB9-5A31-4C9D-B584-2ED880BFB777}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1b076np_mxyik6_2p4.tmp

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PDF document, version 1.6, 0 pages
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.018229594818722
Encrypted:	false
SSDEEP:	6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOHR0zCSyAAO:IngVMre9T0HQIDmy9g06JX3R0zlX
MD5:	FEB4B19F2B9329BEE8081155DF114282
SHA1:	6146D5F49C509AB47D6DF3C3EE8793043147DD6D
SHA-256:	52212ED0AE707608808D5BAE0A0AAFC6004395F9C94962F663DCED8AE4457FFD
SHA-512:	AB346C845DCBD1CA8A835DF3B14933D7CD968EBA749069995E25B105542888C4FBF24C788F18D0315BAEBBAA565B83A71692000727EFF9782B16FE5C5B231121
Malicious:	false
Preview:	%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<830449FD4B775748B6CBB60803E10829><830449FD4B775748B6CBB60803E10829>]>>..startxref..127..%%EOF..

C:\Users\user\AppData\Local\Temp\mso6FB4.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\November 14.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:57 2022, mtime=Tue Mar 8 15:45:57 2022, atime=Wed Nov 16 03:21:17 2022, length=23248, window=hide
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	4.5459544247882935
Encrypted:	false
SSDEEP:	12:8p5eQGvfC0gXg/XAlCPCHaXNBQtB/nPyX+WlDchY5i39icvbHLQzNDtZ3YilMMEH:8KQO/XT9SdqIhZ3kerERDv3qm1u7D
MD5:	0F80318CB8BB27E305144DFC6116077C
SHA1:	1F8032E628FE4F7666ABA203D5816CD847F82578
SHA-256:	F46195C0D0AEA4BC87BA1E0BE5F7D653DA933A9E1495111BFD7A4F576B1F002A
SHA-512:	CA5CC9B3C242E6656B48CE24F1284EB133CBBE26FF00BD29FA2DD03C10D7EAED4B8526C5EE5D267C3D9C2EE885E18C53B81911B3B345D6D2A04D0728867D1730
Malicious:	false
Preview:	L..................F.... ....l...3...l...3..s.+.r....Z...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....hT....user.8......QK.XhT.....&=....U...............A.l.b.u.s.....z.1.....hT...Desktop.d......QK.XhT...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....j.2..Z..pU." .NOVEMB~1.DOC..N......hT..hT.....r.....'...............N.o.v.e.m.b.e.r. .1.4...d.o.c.x.......z...............-...8...[............?J......C:\Users\..#...................\\980108\Users.user\Desktop\November 14.docx.'.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.N.o.v.e.m.b.e.r. .1.4...d.o.c.x.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......980108..........D_....3N...W...9G..N..... .....[D_....3N...W

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [misc]
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.63486544812866
Encrypted:	false
SSDEEP:	3:bDuMJlz96yuW4omxWgKT1yuW4ov:bC48T9GJT9y
MD5:	4238C8B0CD44593E49F063BA97D4E5BF
SHA1:	4AE8B5943C66FDD122337527CC65A3DCEEEED6B2
SHA-256:	89D2D173B8FCB5585AAEAC4234B611A4CC7066CAB1EA8550A34BBC48D37967BE
SHA-512:	2F06A17BE7E2019B7376AA96231267E1AE0637DF8FE85947E35B157D370A932BA301C25690774FB774C23B7EBC23CFF4C63E6D4A9926584370EF7545AA16EE78
Malicious:	false
Preview:	[folders]..Templates.LNK=0..November 14.LNK=0..[misc]..November 14.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHH/cgQfmW+eMdln:vdsCkWtUb+8ll
MD5:	D9C8F93ADB8834E5883B5A8AAAC0D8D9
SHA1:	23684CCAA587C442181A92E722E15A685B2407B1
SHA-256:	116394FEAB201D23FD7A4D7F6B10669A4CBCE69AF3575D9C1E13E735D512FA11
SHA-512:	7742E1AC50ACB3B794905CFAE973FDBF16560A7B580B5CD6F27FEFE1CB3EF4AEC2538963535493DCC25F8F114E8708050EDF5F7D3D146DF47DA4B958F0526515
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........15..............25.............@35..............35.....z.......p45.....x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\Desktop\~$vember 14.docx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHH/cgQfmW+eMdln:vdsCkWtUb+8ll
MD5:	D9C8F93ADB8834E5883B5A8AAAC0D8D9
SHA1:	23684CCAA587C442181A92E722E15A685B2407B1
SHA-256:	116394FEAB201D23FD7A4D7F6B10669A4CBCE69AF3575D9C1E13E735D512FA11
SHA-512:	7742E1AC50ACB3B794905CFAE973FDBF16560A7B580B5CD6F27FEFE1CB3EF4AEC2538963535493DCC25F8F114E8708050EDF5F7D3D146DF47DA4B958F0526515
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........15..............25.............@35..............35.....z.......p45.....x...

C:\Users\user\Downloads\6257b3cd-ee7f-4854-bea9-b6ba4084570c.tmp

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 2 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	230349
Entropy (8bit):	7.774939809289016
Encrypted:	false
SSDEEP:	3072:96UI4mM0SPr/rL+nyyh1twyBmhMg7UAldre0oIuybVYWWhIw/BHQIZsrm90IagIe:UUICPrDinu/egghlIyWWv9Qy30vHGP
MD5:	C67A3B5454155C757BD059C72C12C2F0
SHA1:	92E1900EED13130A26F79ED65DDCEC28F954EFE4
SHA-256:	F92ECFF0909C188CB5060DFB5AC97A718F3E85169EE3D25EF286EFAF5848A31A
SHA-512:	FAF231D4B81F01DE15DC1C2A5638672A5DB9EF8CF7438D91C15C6088F7BCADA614A1EA66A9B487783AEBD3BE828C5CB6A46C9C628212903D488F52D6FB277EC7
Malicious:	false
Preview:	%PDF-1.4.%.....2 0 obj.<</Filter/FlateDecode/Length 1279>>stream.h.V]W.H.}..G.#m..;q.P.d...Dw....8@fH.._1.y..#..e..tu........;K........Q0..!.OT............Z..........K.R6..6.C...P.%0)1.....Bq.$.......(J...f..LC..u......H....B....E.$......K......H.O<.4sr..PJ4#.O..k,..7{.P.%.X..%,.B....,..{.z..R.....$.T~..2B....Ph.....:.l1....f0z.e%...K.x3.e..Xfe...U....~,.i~.W6.X..$[..8.......{aA..baR..Y....0c1{2.%..."Uye.'.,.......f. .........PM]..<_...7W.VE)......G.A...?....0.......3.9..g..~n...C.S.y......Y..S...\|..\|.#..v:.@..7.N".^..p\|. ..M....5.A..:....S@......a...n.o..g..T0AD.y7.b.....:..D+$.NK..R..$.......f U......&;.a.T..F.f....b..\|^f..c0.......N.=..Q.y.t..Z..yl)g...A..........m...0-.k..A.t7..Xq.fs.g2..6a6+VFy.)..R.......-.&Ka...s..%...Z..f....y.B...U...(Qh.h.A..H.a.:E..q..(.Y....!.kE.?g..&.Ia..Qp.H.K....ec..Y.A.../'...qh#.$...Ww.`>g..:R..6Z....3w..=e...........3...........i<..<.....:.":.Y..'..t..[.....6._...<\G3cBMN$.W.. ..>:.`.B....B.....[.Tl.

C:\Users\user\Downloads\BILLS-117hres1465ih.pdf (copy)

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 2 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	230349
Entropy (8bit):	7.774939809289016
Encrypted:	false
SSDEEP:	3072:96UI4mM0SPr/rL+nyyh1twyBmhMg7UAldre0oIuybVYWWhIw/BHQIZsrm90IagIe:UUICPrDinu/egghlIyWWv9Qy30vHGP
MD5:	C67A3B5454155C757BD059C72C12C2F0
SHA1:	92E1900EED13130A26F79ED65DDCEC28F954EFE4
SHA-256:	F92ECFF0909C188CB5060DFB5AC97A718F3E85169EE3D25EF286EFAF5848A31A
SHA-512:	FAF231D4B81F01DE15DC1C2A5638672A5DB9EF8CF7438D91C15C6088F7BCADA614A1EA66A9B487783AEBD3BE828C5CB6A46C9C628212903D488F52D6FB277EC7
Malicious:	false
Preview:	%PDF-1.4.%.....2 0 obj.<</Filter/FlateDecode/Length 1279>>stream.h.V]W.H.}..G.#m..;q.P.d...Dw....8@fH.._1.y..#..e..tu........;K........Q0..!.OT............Z..........K.R6..6.C...P.%0)1.....Bq.$.......(J...f..LC..u......H....B....E.$......K......H.O<.4sr..PJ4#.O..k,..7{.P.%.X..%,.B....,..{.z..R.....$.T~..2B....Ph.....:.l1....f0z.e%...K.x3.e..Xfe...U....~,.i~.W6.X..$[..8.......{aA..baR..Y....0c1{2.%..."Uye.'.,.......f. .........PM]..<_...7W.VE)......G.A...?....0.......3.9..g..~n...C.S.y......Y..S...\|..\|.#..v:.@..7.N".^..p\|. ..M....5.A..:....S@......a...n.o..g..T0AD.y7.b.....:..D+$.NK..R..$.......f U......&;.a.T..F.f....b..\|^f..c0.......N.=..Q.y.t..Z..yl)g...A..........m...0-.k..A.t7..Xq.fs.g2..6a6+VFy.)..R.......-.&Ka...s..%...Z..f....y.B...U...(Qh.h.A..H.a.:E..q..(.Y....!.kE.?g..&.Ia..Qp.H.K....ec..Y.A.../'...qh#.$...Ww.`>g..:R..6Z....3w..=e...........3...........i<..<.....:.":.Y..'..t..[.....6._...<\G3cBMN$.W.. ..>:.`.B....B.....[.Tl.

C:\Users\user\Downloads\BILLS-117hres1465ih.pdf.crdownload (copy)

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 2 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	230349
Entropy (8bit):	7.774939809289016
Encrypted:	false
SSDEEP:	3072:96UI4mM0SPr/rL+nyyh1twyBmhMg7UAldre0oIuybVYWWhIw/BHQIZsrm90IagIe:UUICPrDinu/egghlIyWWv9Qy30vHGP
MD5:	C67A3B5454155C757BD059C72C12C2F0
SHA1:	92E1900EED13130A26F79ED65DDCEC28F954EFE4
SHA-256:	F92ECFF0909C188CB5060DFB5AC97A718F3E85169EE3D25EF286EFAF5848A31A
SHA-512:	FAF231D4B81F01DE15DC1C2A5638672A5DB9EF8CF7438D91C15C6088F7BCADA614A1EA66A9B487783AEBD3BE828C5CB6A46C9C628212903D488F52D6FB277EC7
Malicious:	false
Preview:	%PDF-1.4.%.....2 0 obj.<</Filter/FlateDecode/Length 1279>>stream.h.V]W.H.}..G.#m..;q.P.d...Dw....8@fH.._1.y..#..e..tu........;K........Q0..!.OT............Z..........K.R6..6.C...P.%0)1.....Bq.$.......(J...f..LC..u......H....B....E.$......K......H.O<.4sr..PJ4#.O..k,..7{.P.%.X..%,.B....,..{.z..R.....$.T~..2B....Ph.....:.l1....f0z.e%...K.x3.e..Xfe...U....~,.i~.W6.X..$[..8.......{aA..baR..Y....0c1{2.%..."Uye.'.,.......f. .........PM]..<_...7W.VE)......G.A...?....0.......3.9..g..~n...C.S.y......Y..S...\|..\|.#..v:.@..7.N".^..p\|. ..M....5.A..:....S@......a...n.o..g..T0AD.y7.b.....:..D+$.NK..R..$.......f U......&;.a.T..F.f....b..\|^f..c0.......N.=..Q.y.t..Z..yl)g...A..........m...0-.k..A.t7..Xq.fs.g2..6a6+VFy.)..R.......-.&Ka...s..%...Z..f....y.B...U...(Qh.h.A..H.a.:E..q..(.Y....!.kE.?g..&.Ia..Qp.H.K....ec..Y.A.../'...qh#.$...Ww.`>g..:R..6Z....3w..=e...........3...........i<..<.....:.":.Y..'..t..[.....6._...<\G3cBMN$.W.. ..>:.`.B....B.....[.Tl.

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.61410531291154
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	November 14.docx
File size:	23248
MD5:	7210f674a1630d302d9475b0140c1456
SHA1:	1503ef7acb67d092f08b582ef6f02b353c5f666d
SHA256:	92cb6c458b180b338265041f6bfe1fd0b132052e3623362d2d3908e7566b2982
SHA512:	3ff0643228dbe29a2cdf62425897bfb27108bb83d870fc36d08694863daa07216a6342036e2aa0d5b0f0a4264fba670ffe0ebc6dc81178575f6f51ad76f7fe0a
SSDEEP:	384:SYWlRRugtWqnTc6ywravGltN5s+ORfNxt/ZtNNhgdi/30rba8mzgQcvF1B8j5uP7:ARugDTlyBEjORVxllNhgqGb7MgQcC5uj
TLSH:	57A2D138E086FC18D6B6497E896400FAF7400492FA52169F2E69F7DFCB605D3DB81A49
File Content Preview:	PK..........!.z!0:....-.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	e4e6a2a2a4b4b4a4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2022 20:22:51.024214983 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.024295092 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.024385929 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.026262999 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.026308060 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.027152061 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.027226925 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.027312994 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.027594090 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.027633905 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.102607965 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.127449036 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.132657051 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.132711887 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.133083105 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.133119106 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.133985996 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.134078026 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.136482954 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.136584997 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.137528896 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.137639999 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.499723911 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.499793053 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.499806881 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.499854088 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.500073910 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.500134945 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.500224113 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.500257015 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.500377893 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.500430107 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.530160904 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.530277967 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.530303001 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.530482054 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.530550957 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.548888922 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.548969030 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.549002886 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.549098015 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.549144983 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.592458963 CET	49181	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:51.592505932 CET	443	49181	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:51.593513966 CET	49182	443	192.168.2.22	172.217.23.109
Nov 15, 2022 20:22:51.593575001 CET	443	49182	172.217.23.109	192.168.2.22
Nov 15, 2022 20:22:51.866309881 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:51.866394043 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:51.866481066 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:51.877630949 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:51.877722025 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:51.877868891 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:51.902851105 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:51.902937889 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:51.931704998 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:51.931780100 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:51.999274969 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:51.999845028 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:51.999897957 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.002042055 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.002115965 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.015072107 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.034068108 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.034133911 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.034215927 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.034266949 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.034547091 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.034677029 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.034697056 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.037904024 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.038057089 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.041621923 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.041660070 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.041991949 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.215576887 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.215677977 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.215682983 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.215707064 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.215750933 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.215764999 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.215801954 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.215837002 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.215843916 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.216093063 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.216130972 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.216140032 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.216149092 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.216181040 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.216763020 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.216850042 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.216895103 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.216912031 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.217575073 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.217623949 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.217633009 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.217649937 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.217683077 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.217694044 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.218396902 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.218442917 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.218447924 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.218468904 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.218506098 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.218513966 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.219176054 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.219238043 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.219245911 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.219264030 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.219300032 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.219959021 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.220032930 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.220082998 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.220086098 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.220102072 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.220134020 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.229125977 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.232882023 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.232995033 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.233043909 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.233048916 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.233066082 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.233099937 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.233114004 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.233644962 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.233701944 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.233709097 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.233724117 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.233769894 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.233797073 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.234527111 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.234611034 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.234636068 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.234956980 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.235013008 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.235019922 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.235043049 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.235093117 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.235692978 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.235793114 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.236534119 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.236682892 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.236702919 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.237343073 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.237417936 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.237437010 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.238162994 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.238226891 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.238265038 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.238280058 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.238298893 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.239015102 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.239100933 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.239119053 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.239732981 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.239881039 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.239948988 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.240705013 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.240804911 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.241518021 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.241667032 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.241667032 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.246905088 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.246989012 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.250611067 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.250674963 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.250711918 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.250766039 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.250770092 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.250781059 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.250811100 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.250854969 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.251595020 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.251663923 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.252743959 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.252810001 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.252815962 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.252831936 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.252861023 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.253599882 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.253665924 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.253685951 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.253905058 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.253958941 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.253977060 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.253994942 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.254040003 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.254051924 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.254825115 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.254899025 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.254911900 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.254929066 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.254973888 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.255652905 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.255712986 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.256469011 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.256524086 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.257134914 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.257199049 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.257217884 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.257244110 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.257261992 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.258013010 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.258069992 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.258076906 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.258093119 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.258117914 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.258857012 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.258923054 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.258943081 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.259639025 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.259697914 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.259721994 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.260307074 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.260377884 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.260382891 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.260430098 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.260469913 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.261181116 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.261236906 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.262017012 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.262077093 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.262085915 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.262101889 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.262131929 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.263026953 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.263093948 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.263094902 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.263120890 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.263145924 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.263803005 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.263854027 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.263875008 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.264132023 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.264190912 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.264194965 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.264210939 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.264233112 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.265055895 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.265121937 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.265141010 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.266086102 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.266124010 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.266143084 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.266164064 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.266177893 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.266254902 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.266952991 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.267005920 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.267052889 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.267199039 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.267270088 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.267288923 CET	443	49184	104.16.173.252	192.168.2.22
Nov 15, 2022 20:22:52.267302990 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.267324924 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:52.267339945 CET	49184	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:22:55.924849033 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:55.924916983 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:55.924977064 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:55.927823067 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:55.927861929 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:55.976044893 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:55.977037907 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:55.977075100 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:55.977735043 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:55.978549004 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:55.978575945 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:55.978691101 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:55.978741884 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:55.978756905 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:56.029373884 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:56.029485941 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:56.029512882 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:56.029531002 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:22:56.029596090 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:56.031321049 CET	49191	443	192.168.2.22	142.250.185.174
Nov 15, 2022 20:22:56.031353951 CET	443	49191	142.250.185.174	192.168.2.22
Nov 15, 2022 20:23:02.115602016 CET	49185	443	192.168.2.22	104.16.173.252
Nov 15, 2022 20:23:02.115784883 CET	443	49185	104.16.173.252	192.168.2.22
Nov 15, 2022 20:23:02.115881920 CET	49185	443	192.168.2.22	104.16.173.252

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2022 20:22:44.558088064 CET	138	138	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:44.685923100 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:45.435740948 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:46.198641062 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:47.457537889 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:47.457704067 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:47.463406086 CET	59241	53	192.168.2.22	8.8.8.8
Nov 15, 2022 20:22:47.468103886 CET	55244	53	192.168.2.22	8.8.8.8
Nov 15, 2022 20:22:47.491434097 CET	53	59241	8.8.8.8	192.168.2.22
Nov 15, 2022 20:22:47.496133089 CET	53	55244	8.8.8.8	192.168.2.22
Nov 15, 2022 20:22:48.203649044 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:48.204260111 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:48.953814030 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:48.954333067 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:50.848573923 CET	59241	53	192.168.2.22	8.8.8.8
Nov 15, 2022 20:22:50.868441105 CET	53	59241	8.8.8.8	192.168.2.22
Nov 15, 2022 20:22:50.997791052 CET	55244	53	192.168.2.22	8.8.8.8
Nov 15, 2022 20:22:51.025991917 CET	53	55244	8.8.8.8	192.168.2.22
Nov 15, 2022 20:22:51.803005934 CET	64281	53	192.168.2.22	8.8.8.8
Nov 15, 2022 20:22:51.824985027 CET	53	64281	8.8.8.8	192.168.2.22
Nov 15, 2022 20:22:52.064944983 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:52.066129923 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:52.067042112 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:52.814908028 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:52.815871954 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:52.816860914 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:53.565293074 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:53.566227913 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:53.567189932 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:53.579982042 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:54.340958118 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:55.105830908 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:55.809870958 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:56.561728954 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:57.314008951 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:59.249188900 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:22:59.999067068 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:00.749182940 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:08.435359955 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:09.185389042 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:09.935503006 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:17.382940054 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:18.132755995 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:18.882762909 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:20.107180119 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:20.857120991 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:21.607152939 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:44.592463970 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:45.341595888 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:23:46.091758966 CET	137	137	192.168.2.22	192.168.2.255
Nov 15, 2022 20:24:14.107564926 CET	138	138	192.168.2.22	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2022 20:22:47.463406086 CET	192.168.2.22	8.8.8.8	0xd7e5	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:47.468103886 CET	192.168.2.22	8.8.8.8	0xb550	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:50.848573923 CET	192.168.2.22	8.8.8.8	0xd7e5	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:50.997791052 CET	192.168.2.22	8.8.8.8	0xb550	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:51.803005934 CET	192.168.2.22	8.8.8.8	0xea6c	Standard query (0)	www.congress.gov	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2022 20:22:47.491434097 CET	8.8.8.8	192.168.2.22	0xd7e5	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2022 20:22:47.491434097 CET	8.8.8.8	192.168.2.22	0xd7e5	No error (0)	clients.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:47.496133089 CET	8.8.8.8	192.168.2.22	0xb550	No error (0)	accounts.google.com		172.217.23.109	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:50.868441105 CET	8.8.8.8	192.168.2.22	0xd7e5	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2022 20:22:50.868441105 CET	8.8.8.8	192.168.2.22	0xd7e5	No error (0)	clients.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:51.025991917 CET	8.8.8.8	192.168.2.22	0xb550	No error (0)	accounts.google.com		172.217.23.109	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:51.824985027 CET	8.8.8.8	192.168.2.22	0xea6c	No error (0)	www.congress.gov		104.16.173.252	A (IP address)	IN (0x0001)	false
Nov 15, 2022 20:22:51.824985027 CET	8.8.8.8	192.168.2.22	0xea6c	No error (0)	www.congress.gov		104.16.172.252	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

www.congress.gov

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49181	142.250.185.174	443	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-15 19:22:51 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-84.0.4147.135 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-11-15 19:22:51 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Q-b_CuCbS8JAZL0U8wuyMw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 15 Nov 2022 19:22:51 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5797 X-Daystart: 40971 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-11-15 19:22:51 UTC	2	IN	Data Raw: 33 31 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 37 39 37 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 30 39 37 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5797" elapsed_seconds="40971"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-11-15 19:22:51 UTC	2	IN	Data Raw: 6d 78 76 59 6e 4d 76 4e 7a 49 30 51 55 46 58 4e 56 39 7a 54 32 52 76 64 55 77 79 4d 45 52 45 53 45 5a 47 56 6d 4a 6e 51 51 2f 31 2e 30 2e 30 2e 36 5f 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 Data Ascii: mxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" si
2022-11-15 19:22:51 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49182	172.217.23.109	443	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-15 19:22:51 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=WP.289365
2022-11-15 19:22:51 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-11-15 19:22:51 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 15 Nov 2022 19:22:51 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lh8xQuMem3bat1c9FzNnBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-11-15 19:22:51 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-11-15 19:22:51 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49184	104.16.173.252	443	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-15 19:22:52 UTC	4	OUT	GET /117/bills/hres1465/BILLS-117hres1465ih.pdf HTTP/1.1 Host: www.congress.gov Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-11-15 19:22:52 UTC	5	IN	HTTP/1.1 200 OK Date: Tue, 15 Nov 2022 19:22:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 15 Nov 2022 11:24:18 GMT Cache-Control: public, max-age=31536000 Expires: Wed, 15 Nov 2023 19:22:52 GMT Vary: Accept-Encoding X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block X-Cacheable: YES Content-Security-Policy: frame-ancestors http://.house.gov https://.house.gov http://.senate.gov https://.senate.gov http://.loc.gov https://.loc.gov http://.congress.gov https://congress.gov https://.congress.gov CF-Cache-Status: REVALIDATED Set-Cookie: __cf_bm=Mf_7jYC5RBPNL2fVRo0ZLiiFH8Y0z5tINSadFwgWeDQ-1668540172-0-ASfH7qngRx2h/Y83cub9VpB0hPKZgVTepba+uT00Jm5eMSeMqZSPHo+M1Rl2tv20bDdYiXyFnefvZxn/ETs4GmA=; path=/; expires=Tue, 15-Nov-22 19:52:52 GMT; domain=.congress.gov; HttpOnly; Secure; SameSite=None Set-Cookie: __cfruid=f931597b9c1206baa74666f2accec630a1305030-1668540172; path=/; domain=.congress.gov; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 76aa5bab4ba190e8-FRA
2022-11-15 19:22:52 UTC	6	IN	Data Raw: 37 62 35 35 0d 0a 25 50 44 46 2d 31 2e 34 0a 25 e2 e3 cf d3 0a 32 20 30 20 6f 62 6a 0a 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 4c 65 6e 67 74 68 20 31 32 37 39 3e 3e 73 74 72 65 61 6d 0a 68 de 9c 56 5d 57 e2 48 10 7d cf af a8 47 dc 23 6d 7f a5 3b 71 9f 50 a2 64 86 01 87 44 77 e6 8c f3 80 12 87 38 40 66 48 94 9d 5f 31 7f 79 ab bb 23 10 16 65 cf 2a 88 74 2a 75 bb aa ee bd 9d 93 cb 84 c1 b7 d2 3b 4b bd 93 0b 06 0c d2 07 8f 51 30 bf f8 21 b5 4f 54 00 9a e1 fa dc a3 f0 0d df e9 bd f9 b3 f2 5a f1 0d 1c a5 8f 1e e3 2e 9a e3 4b 81 52 36 b4 c5 98 36 17 43 a2 ec d5 90 50 a1 25 30 29 31 9f d0 eb b0 b4 b7 93 42 71 a2 24 0d d6 01 e7 c3 c1 e5 28 4a 12 0b d5 66 84 fb 4c 43 1b af 75 bd 16 df 87 e0 0b 12 48 1d 82 92 b8 42 a9 cb Data Ascii: 7b55%PDF-1.4%2 0 obj<</Filter/FlateDecode/Length 1279>>streamhV]WH}G#m;qPdDw8@fH_1y#etu;KQ0!OTZ.KR66CP%0)1Bq$(JfLCuHB
2022-11-15 19:22:52 UTC	6	IN	Data Raw: d2 dd 45 91 24 0c 82 a0 19 94 ec 4b a7 19 09 15 d5 cd 48 dc 4f 3c 1c 34 73 72 aa 89 50 4a 34 23 ed b6 4f 2e b8 6b 2c 97 b8 37 7b 83 50 c0 25 c3 58 be 8e 25 2c 0c 42 db d8 1e 01 2c 99 d8 7b 85 7a 89 17 52 10 1e f8 cd 9b dc 24 98 54 7e 8d f4 32 42 e6 f6 c5 dc 50 68 b0 05 83 d5 db bb 3a f3 6c 31 c9 17 df a0 9a 66 30 7a 9a 65 25 14 0f f6 4b af 78 2a 33 f3 65 94 fd 58 66 65 b6 a8 c6 55 fe 8c d7 ab 02 7e 2c 8b 69 7e 97 57 36 f0 be 58 94 f9 24 5b b6 0d 38 c7 b9 10 16 b0 c0 0c 07 7b 61 41 f0 c6 62 61 52 dd e5 b3 59 09 e3 c5 04 30 63 31 7b 32 eb 25 ac a6 05 22 55 79 65 d0 27 05 2c 8a 0a c6 93 ec e7 d3 b8 ca 66 bf 20 fb db e0 97 b6 b6 f4 0f 8f 50 4d 5d 8b 10 3c 5f 1a f8 0a 37 57 ba 56 45 29 b6 e3 12 df ef b0 f2 47 c0 41 ae 0c 87 3f c0 97 af b8 30 f1 18 e4 e0 fd 84 Data Ascii: E$KHO<4srPJ4#O.k,7{P%X%,B,{zR$T~2BPh:l1f0ze%Kx*3eXfeU~,i~W6X$[8{aAbaRY0c1{2%"Uye',f PM]<_7WVE)GA?0
2022-11-15 19:22:52 UTC	8	IN	Data Raw: 68 1d bc 61 84 0e 8b 89 e3 f9 b4 09 30 bd 3e 9d e3 2a 51 08 b3 69 1b eb 0d 02 1a 12 88 49 13 ce 23 d1 28 6a 26 f2 fb 52 f1 aa 02 9d 72 58 cb 42 f3 42 57 20 37 cd fb 4a 64 59 1f 76 52 14 1a d0 49 66 b5 16 b2 e8 83 54 ed eb c0 ae 34 b4 2b 0d 28 a2 19 06 16 98 e5 45 5f 43 b1 e3 e8 37 0a 63 da c0 a7 e3 d8 12 d8 47 d6 d2 e0 a8 44 c2 15 b0 6e 08 e6 15 ba 60 f8 5d 30 08 fe 6b 3c ef 52 59 71 d0 fc 5e 83 28 d6 59 9d f0 0a 51 54 a9 54 1a b4 d0 19 07 61 b5 79 69 4a 24 7a 15 52 77 e2 08 ba 70 f8 a4 c5 c1 12 fe bb 66 9a 67 0f f0 b9 0c 75 a6 64 d8 a9 05 6d 31 bc a3 b4 d7 49 31 7c 15 3e 78 27 e3 41 9b f1 c7 c7 a5 bb 5a f6 60 b6 41 85 cb 86 02 b2 92 ca 24 be 2e cc bd 64 8a 6d 15 2b 53 58 ba 0c 3d 45 05 55 5d 1d 30 0c de 40 88 ba 18 06 be 3f b6 0c 99 28 78 d2 ff 58 b1 37 Data Ascii: ha0>*QiI#(j&RrXBBW 7JdYvRIfT4+(E_C7cGDn`]0k<RYq^(YQTTayiJ$zRwpfgudm1I1\|>x'AZ`A$.dm+SX=EU]0@?(xX7
2022-11-15 19:22:52 UTC	9	IN	Data Raw: 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 35 39 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 33 35 39 20 33 35 39 20 32 38 30 20 32 38 30 20 32 35 39 20 33 31 32 20 32 35 39 20 32 38 30 20 35 31 39 20 35 31 39 20 35 31 39 20 35 31 39 20 35 31 39 20 32 38 30 20 32 38 30 20 35 31 39 20 32 38 30 20 32 38 30 20 32 35 39 20 32 35 39 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 Data Ascii: 80 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 259 280 280 280 280 280 280 280 359 359 280 280 259 312 259 280 519 519 519 519 519 280 280 519 280 280 259 259 280 280 280 280 280
2022-11-15 19:22:52 UTC	10	IN	Data Raw: 36 30 20 35 36 30 20 35 36 30 20 35 36 30 20 35 36 30 20 35 36 30 20 35 36 30 20 35 36 30 20 32 38 30 20 32 38 30 20 35 36 30 20 35 36 30 20 35 36 30 20 35 30 30 20 37 34 37 20 37 32 30 20 36 36 30 20 36 36 30 20 37 32 30 20 36 30 30 20 35 34 30 20 37 36 30 20 37 38 30 20 33 34 30 20 35 34 30 20 36 38 30 20 35 36 30 20 38 36 30 20 37 30 30 20 37 38 30 20 36 34 30 20 37 38 30 20 36 38 30 20 35 34 30 20 36 32 30 20 36 38 30 20 36 36 30 20 39 38 30 20 36 36 30 20 36 38 30 20 36 30 30 20 33 36 30 20 35 36 30 20 33 36 30 20 35 36 30 20 35 30 30 20 33 38 30 20 35 34 30 20 36 32 30 20 35 30 30 20 36 32 30 20 35 34 30 20 33 34 30 20 35 34 30 20 36 32 30 20 33 32 30 20 32 36 30 20 35 38 30 20 33 32 30 20 38 38 30 20 36 32 30 20 35 38 30 20 36 30 30 20 36 32 30 20 Data Ascii: 60 560 560 560 560 560 560 560 280 280 560 560 560 500 747 720 660 660 720 600 540 760 780 340 540 680 560 860 700 780 640 780 680 540 620 680 660 980 660 680 600 360 560 360 560 500 380 540 620 500 620 540 340 540 620 320 260 580 320 880 620 580 600 620
2022-11-15 19:22:52 UTC	12	IN	Data Raw: 30 20 32 38 30 20 32 38 30 20 34 39 35 20 33 36 38 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 37 31 20 32 38 30 20 32 38 30 20 34 32 34 20 32 38 30 20 32 38 30 20 32 38 30 20 33 35 30 20 32 38 30 20 32 38 30 20 34 34 34 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 38 30 20 32 Data Ascii: 0 280 280 495 368 280 280 280 280 280 280 271 280 280 424 280 280 280 350 280 280 444 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 280 2
2022-11-15 19:22:52 UTC	13	IN	Data Raw: 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 35 30 30 20 35 30 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 37 36 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 35 36 34 20 32 35 30 20 32 35 30 20 32 35 30 20 35 30 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 Data Ascii: 0 250 250 250 250 250 250 250 250 250 250 250 250 250 250 500 500 250 250 250 250 250 760 250 250 250 250 250 250 250 564 250 250 250 500 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 2
2022-11-15 19:22:52 UTC	14	IN	Data Raw: 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 20 32 38 37 5d 3e 3e 0a 65 6e 64 6f 62 6a 0a 39 Data Ascii: 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287 287]>>endobj9
2022-11-15 19:22:52 UTC	16	IN	Data Raw: 37 38 20 32 37 38 20 32 37 38 20 32 37 38 20 32 37 38 20 32 37 38 20 32 37 38 20 32 37 38 20 32 37 38 20 32 37 38 20 32 37 38 5d 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 30 20 30 20 6f 62 6a 0a 3c 3c 2f 42 47 32 2f 44 65 66 61 75 6c 74 2f 4f 50 20 66 61 6c 73 65 2f 4f 50 4d 20 31 2f 53 41 20 66 61 6c 73 65 2f 53 4d 20 2e 30 32 2f 54 79 70 65 2f 45 78 74 47 53 74 61 74 65 2f 55 43 52 32 2f 44 65 66 61 75 6c 74 2f 6f 70 20 66 61 6c 73 65 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 31 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 75 6e 74 20 32 2f 4b 69 64 73 5b 31 20 30 20 52 20 31 32 20 30 20 52 5d 2f 4d 65 64 69 61 42 6f 78 5b 30 20 30 20 36 31 32 20 37 39 32 5d 2f 54 79 70 65 2f 50 61 67 65 73 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 34 20 30 20 6f 62 6a 0a 3c 3c 2f 45 78 74 47 53 74 61 74 Data Ascii: 78 278 278 278 278 278 278 278 278 278 278]>>endobj10 0 obj<</BG2/Default/OP false/OPM 1/SA false/SM .02/Type/ExtGState/UCR2/Default/op false>>endobj11 0 obj<</Count 2/Kids[1 0 R 12 0 R]/MediaBox[0 0 612 792]/Type/Pages>>endobj14 0 obj<</ExtGStat
2022-11-15 19:22:52 UTC	17	IN	Data Raw: 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 20 32 35 30 5d 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 36 20 30 20 6f 62 6a 0a 3c 3c 2f 42 61 73 65 46 6f 6e 74 2f 42 47 73 64 64 56 30 31 2f 45 6e 63 6f 64 69 6e 67 20 34 31 20 30 20 52 2f 46 69 72 73 74 43 68 61 72 20 30 2f 46 6f 6e 74 44 65 73 63 72 69 70 74 6f 72 20 33 33 20 30 20 52 2f 4c 61 73 74 43 Data Ascii: 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250 250]>>endobj16 0 obj<</BaseFont/BGsddV01/Encoding 41 0 R/FirstChar 0/FontDescriptor 33 0 R/LastC
2022-11-15 19:22:52 UTC	18	IN	Data Raw: 61 70 48 65 69 67 68 74 20 36 36 36 2f 44 65 73 63 65 6e 74 20 2d 32 30 37 2f 46 6c 61 67 73 20 36 2f 46 6f 6e 74 42 42 6f 78 5b 2d 31 33 35 20 2d 32 33 36 20 31 31 36 33 20 39 33 36 5d 2f 46 6f 6e 74 46 69 6c 65 33 20 32 30 20 30 20 52 2f 46 6f 6e 74 4e 61 6d 65 2f 44 65 56 69 6e 6e 65 2f 49 74 61 6c 69 63 41 6e 67 6c 65 20 30 2f 53 74 65 6d 48 20 31 33 2f 53 74 65 6d 56 20 36 37 2f 54 79 70 65 2f 46 6f 6e 74 44 65 73 63 72 69 70 74 6f 72 2f 58 48 65 69 67 68 74 20 34 31 39 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 30 20 30 20 6f 62 6a 0a 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 4c 65 6e 67 74 68 20 31 33 32 38 37 2f 53 75 62 74 79 70 65 2f 54 79 70 65 31 43 3e 3e 73 74 72 65 61 6d 0a 68 de 8c 7a 77 5c 14 57 d7 3f 9b 65 67 30 ea 1a 8d 43 Data Ascii: apHeight 666/Descent -207/Flags 6/FontBBox[-135 -236 1163 936]/FontFile3 20 0 R/FontName/DeVinne/ItalicAngle 0/StemH 13/StemV 67/Type/FontDescriptor/XHeight 419>>endobj20 0 obj<</Filter/FlateDecode/Length 13287/Subtype/Type1C>>streamhzw\W?eg0C
2022-11-15 19:22:52 UTC	20	IN	Data Raw: ba 29 ef 5a 2b dd b9 b3 61 0d db 2f 82 7a ea b8 22 2b 26 27 4e 2f 2d ec 50 b8 92 de 1e 6e ed e9 c0 da 7b ba 04 ba 30 ce 41 25 4d 17 cb be aa bf cc 55 15 69 b2 2b 98 4c 3e 69 9f 8a 13 76 f6 73 94 5d b8 d5 5f a6 69 9a 2e 96 0e 4e 2b c9 a9 60 2e d4 b8 5b 71 52 58 1d da 20 e8 f0 50 c2 8b 2a 3b db 5b 60 41 0d 6c c0 a1 28 5c a7 6c 4e d5 fb 9e 61 ee 9f 7f 00 86 9c 92 98 e6 b5 d5 de c3 bd bc dd 93 ed 85 59 35 df 3e 38 a8 97 85 c2 22 c9 8e 94 4a f9 2e da 2b 78 d3 b6 25 ac 05 88 1c be f2 e9 d6 7b 7b bd e9 da 65 ba c5 b1 7e f3 72 0b b3 29 7b 8e b9 e4 da b1 13 37 d9 ad 59 42 8f 7d b8 f0 ed c5 8b a5 97 1a d8 84 0c ca cb 27 40 e1 c1 18 c9 5e 81 f8 4a c9 99 f6 7a ee 02 92 5c 9c dc ba 48 6f 22 00 15 70 35 a6 a5 96 be 5a 7d b2 f1 54 89 cf f6 0d 6e d6 26 4e 2c 3e 29 7d a6 Data Ascii: )Z+a/z"+&'N/-Pn{0A%MUi+L>ivs]_i.N+`.[qRX P*;[`Al(\lNaY5>8"J.+x%{{e~r){7YB}'@^Jz\Ho"p5Z}Tn&N,>)}
2022-11-15 19:22:52 UTC	21	IN	Data Raw: 27 5a da e9 a7 eb ae 4c 9a 60 6a 6a b8 bc d6 a6 c7 93 cd 4e a4 60 cc ee ab 6e f3 68 13 8b 8d 73 e6 d9 b6 bd be 5b d5 d4 55 c9 be be 4e a1 91 d5 1b 2e dc a5 6f b7 5d 78 fa 79 b3 fd 72 0b 3f 3b 9b 3d ec 40 b4 1d d5 42 85 29 10 bc 7a c5 02 29 90 14 3a 9c b6 07 7d 88 86 32 f6 5e 05 d9 9c ea d4 f1 7a 5a 13 9e 17 e8 27 0f f2 b2 69 75 78 d8 d2 5c 74 ae 8e ed e8 a9 f8 1e a4 34 6c 59 0a 04 22 c7 2d 5d 8c 3e 41 44 97 c9 d7 9d 4d f5 3d 45 ec be 6f 29 f4 91 b3 c5 ea f5 3e ed 30 04 a8 13 37 ba af 9f b6 44 7a ec 00 01 c0 ca ff cc 01 a0 d6 fd 07 5e 30 85 e3 6f 44 ff 3d f7 74 08 cd ff c0 2e c2 c4 3e 5b e1 32 d5 7f 17 c5 48 ec 48 41 fb 71 83 ec 8f 84 1d 42 24 d8 4b f0 30 ac 6a 05 ba 55 04 1f 09 4b a8 cd c2 b3 36 b2 ff 19 da 34 f8 4d 3b 4a e1 c5 1b 48 21 12 d9 f7 47 a2 1d Data Ascii: 'ZL`jjN`nhs[UN.o]xyr?;=@B)z):}2^zZ'iux\t4lY"-]>ADM=Eo)>07Dz^0oD=t.>[2HHAqB$K0jUK64M;JH!G
2022-11-15 19:22:52 UTC	22	IN	Data Raw: 6f db e5 62 b5 a4 c7 ec 2d 8c bb fe 0c 4c 39 b8 fc f7 2d 4b a1 e9 cf c0 dd 04 f7 06 b7 05 d3 c9 1f be 83 85 a8 5a 72 3c 22 2d 32 9a f6 f3 8d df 98 3a 78 ec e7 25 d9 55 3b 3c 45 ab a1 cd e0 97 b7 4f 1e 3e aa 7b 9a fa a9 0a 07 33 79 35 b1 3c dc 8b 0e 8d 92 07 06 b1 28 06 f7 aa 10 fb df da 16 fa c7 16 04 b1 4a 9c 87 83 ed ef f3 85 d7 f0 af 68 12 25 46 ae 9e 8a 4c 98 39 e1 99 2f 38 61 f9 ef 0a 70 66 19 f7 5e c6 64 95 60 8e c1 59 08 fe 94 b0 4c 4d 82 f5 6f fa 92 6c 02 2c fb f4 25 85 fd 19 c4 82 b0 a0 d9 49 58 fb d3 df b5 ff c5 03 07 48 34 ad bf 00 cd 14 0a 24 68 bf 92 f8 31 b5 24 6c 21 8d 1e 92 68 72 e8 66 a4 93 8c 57 95 ab 48 24 91 5f 86 69 f8 c0 df 79 af 70 ae 4a 30 c3 7d 9c 31 2e cf 05 8a 14 cc fa 1f 4a 54 42 14 01 7a 15 2d 5f 1f c4 52 73 94 e4 9b 0a 7b 24 Data Ascii: ob-L9-KZr<"-2:x%U;<EO>{3y5<(Jh%FL9/8apf^d`YLMol,%IXH4$h1$l!hrfWH$_iypJ0}1.JTBz-_Rs{$
2022-11-15 19:22:52 UTC	24	IN	Data Raw: 10 b6 f9 ac 5b 82 0c 19 b4 92 10 36 f4 49 25 aa fe 3d e4 7e c4 4b 54 04 ac 2a eb e8 86 f1 0c 0c 25 fa 2d 7f 93 4a a4 2b d1 42 be af 09 6f f2 c3 16 31 c8 d0 44 aa ef 34 0c cf 46 a6 bf f5 80 69 36 f9 fe e6 44 dd 67 4a 39 10 30 78 75 f2 e7 92 cd 78 89 75 df 44 ea b7 d3 68 b8 02 4c fb 7a 90 a9 02 e7 9d 9b 82 43 9f 13 85 8e a2 32 c9 19 02 d2 71 b9 70 04 79 48 ce 12 28 1d ca 24 52 14 d3 2a 42 e6 ba d6 42 52 3b f9 fe 56 ad 03 37 a4 9b b0 0a 39 b1 c6 c8 d3 cc 86 76 28 f5 a9 2b 2f 28 28 ad 08 cb de 95 ce 2a 0e c5 1f cc a6 2b 34 d7 af dd 62 a5 e7 43 79 c1 94 17 75 76 82 59 e7 3d 7c 2a ae 3f a7 56 a7 16 b9 9f 63 2e 97 37 be 4c e2 62 09 e3 d4 20 57 7f 26 28 a9 a8 91 83 cd 64 6b 72 bd 7f 25 5b 1a e4 9c 63 cb cc b4 dc 61 e3 59 20 2f d3 14 e4 15 71 f5 db 8f 1d a7 73 4f Data Ascii: [6I%=~KT%-J+Bo1D4Fi6DgJ90xuxuDhLzC2qpyH($RBBR;V79v(+/((+4bCyuvY=\|?Vc.7Lb W&(dkr%[caY /qsO
2022-11-15 19:22:52 UTC	25	IN	Data Raw: 61 2a 34 1e 60 0d 6f dc bb 84 09 6b a8 5d 7b a3 02 7c b8 cd 3b bc 56 9b d3 e6 55 e6 97 77 b0 01 e5 35 51 27 99 93 35 bc a6 9c 6b 6b aa ec ea a2 bb bc ba 37 37 b1 1a 9f bd fc 2e 26 5a f7 61 ed 6a 34 01 8d df 63 26 93 ed b9 8b 0b da 09 b5 dd 0f 31 0b 22 7b 1e 8c 78 61 16 2f 7a d9 09 11 bd e2 97 38 62 fb dd c9 9d f1 f1 ce 5a 4f 44 aa f6 be 8f 58 f7 43 e4 c6 b2 f3 5e 17 98 53 a7 f2 6a 2a b9 53 e7 d5 57 3b e8 07 9e 5d 36 a7 d9 7c 7f 9f 0c 1f c6 7a 87 9b 89 1f b7 1f 74 08 34 fd 4f 2b 60 eb 53 aa bb 6e 15 8e e5 31 bb 57 af 35 dd d4 83 5b 73 fa c6 e7 9d 9c b4 5d ab da 58 9b 41 fe e0 5f c1 84 8a 24 76 cd 92 24 10 37 fc 1c ab ac 99 71 8b 67 20 cc a5 4f 66 fd d0 7e ee 64 77 31 77 18 85 11 6e 71 b1 ae ac 87 12 62 55 5e 84 b3 d6 73 e6 f0 0b 85 70 17 b0 d2 74 6f 37 8c Data Ascii: a4`ok]{\|;VUw5Q'5kk77.&Zaj4c&1"{xa/z8bZODXC^SjSW;]6\|zt4O+`Sn1W5[s]XA_$v$7qg Of~dw1wnqbU^spto7
2022-11-15 19:22:52 UTC	26	IN	Data Raw: 2e c1 58 49 42 7e fe fe 02 5c ee 5e c6 e5 2e 1a 0f 9f 52 f3 90 42 e2 5d 17 7d f5 0b 1a 3e 7b 5f 3c 47 c6 1e 0c 4b 60 9d 22 0e 04 29 f7 ea 49 9f c7 f1 a0 83 0b 7a 0d 54 f0 a2 5a 15 66 19 73 ec 08 cf fb 94 dd 95 53 9e 17 98 47 67 ef c2 98 24 4e 49 2c 89 f6 d9 63 c9 78 38 aa 0a 37 70 79 8d 47 db 6f d1 d9 29 b9 c9 f9 2c cc 2b 46 8b 88 d0 eb 71 cd 35 f4 c3 a6 96 db 67 8b a2 a2 d8 98 6d 71 8e b4 67 61 70 45 55 b1 a6 f6 a2 dd f9 35 88 5c b1 00 8d 96 1f 0c 38 e2 c7 a2 a1 81 f0 11 51 be 34 67 a3 1b 1d 93 14 9d a4 64 8f f8 c8 0f 2a 19 8b 3d 3e 4e ee 25 fe 75 e7 6a 4a 5a cb b8 10 9e da a6 f0 f0 73 67 bc e4 05 e5 55 c5 05 27 35 25 f1 11 45 18 ff dc e8 7c 11 14 f6 4d a1 fa a7 fc b6 40 72 82 10 26 f5 2d 90 0c fc aa 7a 9c ff 17 0f b1 98 45 12 3b b3 20 53 0c d7 40 4d c1 Data Ascii: .XIB~\^.RB]}>{_<GK`")IzTZfsSGg$NI,cx87pyGo),+Fq5gmqgapEU5\8Q4gd*=>N%ujJZsgU'5%E\|M@r&-zE; S@M
2022-11-15 19:22:52 UTC	28	IN	Data Raw: 8e 67 81 66 35 6c e0 d6 80 19 23 98 12 e2 10 45 17 cf 6f b2 59 ba fc a2 1d 60 1f a4 1f be dc 33 65 7d f7 91 75 f7 94 f5 59 a4 81 55 20 0e 74 b0 c0 72 d0 61 06 96 33 e6 f8 ba 51 fb 1b 37 ce 5f b8 7e c3 7e 74 fd 3a 7b 87 75 d4 3f 86 8f 2a 46 b2 86 35 fb 6c e2 68 c9 fe 4a 48 f2 58 28 f7 89 31 4d e0 37 e3 b8 cf 84 7f 9b 19 77 46 48 f2 58 28 f7 31 48 4e fa 8c 6b 12 f9 82 67 58 b8 cc 79 03 9a f5 f9 ef 40 ea 77 40 8e b4 b3 f6 69 38 90 db 0b a3 62 d1 b3 72 f4 4c 8b 9e 49 0c cf 3e 5f f8 5b 25 4e 55 3d 0d 83 f9 bd e1 bf f1 ff 17 20 26 f3 c7 85 33 32 d3 63 3f 45 06 76 c2 39 7f 1f 78 89 46 fa 8d cc 0c 86 73 46 e6 d1 5d 86 fe 47 61 9f dc 08 99 21 00 41 13 76 f2 3b d6 17 63 b9 93 e3 c8 8d 58 80 ef f1 3b d9 c5 5d 0d 64 71 41 62 b8 57 7c 40 98 37 ed bd d5 c3 63 0b 61 dd Data Ascii: gf5l#EoY`3e}uYU tra3Q7_~~t:{u?*F5lhJHX(1M7wFHX(1HNkgXy@w@i8brLI>_[%NU= &32c?Ev9xFsF]Ga!Av;cX;]dqAbW\|@7ca
2022-11-15 19:22:52 UTC	29	IN	Data Raw: 16 4f ef ad e4 1a df 73 e0 0f 39 99 aa 6c 2d 0d 2a 0d 25 97 0f 6e 58 92 9e 7e d1 9e d1 74 8f c8 bd 7a 1b 69 b1 93 ef 14 52 26 a9 45 8e a5 92 6e 73 37 54 c8 da 6b 87 47 ab 82 36 1a 2a 64 9b a2 df 37 54 c8 7a 7c 3f fa b8 fb e8 cd 2a ca aa 71 c4 f7 1a f9 e9 e9 13 77 54 34 fc 1c 2c 30 96 cb bc 1c 76 ed 8d 6a 1c bc 33 7c 1c 3c 57 44 8d a7 e2 e0 e5 b4 96 f3 17 c9 c1 06 df 35 3b 62 d3 b6 d0 33 d5 02 d6 4f cf 5c 2a e0 c2 d5 d3 a7 e6 0f 0c 5d ce e1 30 f3 29 5d 74 9c 2f 4e 63 55 1c 0b 47 0c 1c 83 cb 67 0e d0 a1 0f e7 6d 47 4c c4 f9 f5 71 f2 29 b8 00 d7 19 6d 4e 5a 59 b3 af 9e 6c d5 6b aa 8c 27 c8 e3 97 88 f1 b0 b1 dd 27 a9 f3 e0 35 2c 02 59 dc cb 58 61 4c 54 6e 38 19 20 4c 16 45 18 cf 9e 6d 08 db ba 1d a7 f7 50 45 8d 78 92 4e 71 e2 32 61 3c 55 d6 55 a7 c6 69 a8 d2 Data Ascii: Os9l-%nX~tziR&Ens7TkG6d7Tz\|?qwT4,0vj3\|<WD5;b3O\]0)]t/NcUGgmGLq)mNZYlk''5,YXaLTn8 LEmPExNq2a<UUi
2022-11-15 19:22:52 UTC	30	IN	Data Raw: 36 eb 5d be 42 3f b1 46 56 52 5c 50 50 44 d5 05 66 14 10 a5 f5 65 dd 7d 55 22 77 bb e8 58 9b a4 7d 99 fb 0f e6 64 e6 53 05 aa 23 85 64 4f 55 a8 a3 83 28 dc d9 2d b0 4e 43 17 76 a5 37 12 45 a9 05 89 b1 49 49 d1 3e dd c2 8f ae f6 76 0c f5 0a 5b b6 aa 28 66 0d d8 f1 cf 6b 76 25 50 b5 b3 ea 26 01 6b cc 4c 67 70 c2 87 d8 85 e0 15 2c 95 bd 7d 7f 5a ec 1e 12 ae 64 6b 6a eb ea 3b 75 e6 d7 07 47 75 97 88 b3 bc ee b5 d6 6e 5e 7b 42 ca c4 75 65 6a 4d 49 a5 f8 50 64 1e 25 57 a6 1d ce 25 ea 3b f5 03 43 b5 a1 db d6 7b 45 ee 76 a5 fc 84 21 81 f1 7b d1 a2 22 52 da c1 7c 35 d8 a2 06 56 ea 07 ed ac 71 3d d8 65 28 47 b6 6a ee e9 cd 18 0b 14 d5 bc fd 4e a0 bd 03 6d bf 2d 68 b5 05 b1 a2 f9 bd 0b f6 94 fd 85 5b 41 77 c9 6f 3e 6b 1a 1d a5 c7 c6 5a ee de 21 be 0c bc bb fd 1c 35 Data Ascii: 6]B?FVR\PPDfe}U"wX}dS#dOU(-NCv7EII>v[(fkv%P&kLgp,}Zdkj;uGun^{BuejMIPd%W%;C{Ev!{"R\|5Vq=e(GjNm-h[Awo>kZ!5
2022-11-15 19:22:52 UTC	32	IN	Data Raw: 53 74 65 6d 48 20 31 35 38 2f 53 74 65 6d 56 20 31 35 38 2f 54 79 70 65 2f 46 6f 6e 74 44 65 73 63 72 69 70 74 6f 72 2f 58 48 65 69 67 68 74 20 34 38 35 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 32 20 30 20 6f 62 6a 0a 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 4c 65 6e 67 74 68 20 31 33 33 32 38 2f 53 75 62 74 79 70 65 2f 54 79 70 65 31 43 3e 3e 73 74 72 65 61 6d 0a 68 de 8c 7a 07 5c 14 e7 d6 f7 2e cb ec 58 57 65 1c d4 19 33 83 62 17 14 b1 2b 2e 76 51 50 a4 08 82 14 e9 45 ba 44 05 16 01 a5 aa 28 4d 91 26 48 ef 5d e9 52 15 b1 a3 46 4d 48 62 12 a3 31 c6 e4 a6 78 73 86 3c e4 f2 3d 0b 7a ef 7d 73 ef f7 7d ef ef e7 ee 8e cf 33 cf e9 e7 7f ce 99 41 2c 52 55 11 89 c5 e2 c9 5b dc 5d bc 02 5d 7c dc 1d bc b5 37 fb 7a 39 2b d7 66 09 ac 58 98 aa 2a cc Data Ascii: StemH 158/StemV 158/Type/FontDescriptor/XHeight 485>>endobj22 0 obj<</Filter/FlateDecode/Length 13328/Subtype/Type1C>>streamhz\.XWe3b+.vQPED(M&H]RFMHb1xs<=z}s}3A,RU[]]\|7z9+fX*
2022-11-15 19:22:52 UTC	33	IN	Data Raw: 6c cb 53 b1 0b 3c 91 c4 15 4d 66 d0 22 d0 32 81 a9 fd 8f 32 af 76 73 d4 11 d7 ba ee c0 2e b6 f5 fb ac a6 02 de b9 8c 08 0d 0a 8b 3c cc 1e b4 ea aa 08 e0 f3 6b 4a eb d3 eb c7 e4 74 f7 84 56 31 79 c8 97 44 f3 1f d1 87 6b 3d 6e 36 31 2d e5 95 6d 3d 15 07 2c 36 ed f3 de 7d 98 c3 81 2f 2c 85 1b 48 0e 72 b5 2e 1c f1 07 a9 9c 9f 85 a5 38 3a 6f b5 de 7c f0 9c 69 f3 ee 34 b7 76 73 3f 60 5f 7e b0 31 39 39 3e 3e 89 0b b3 73 f6 f4 f4 1e 83 b3 05 f9 d4 0f 0e d4 8b eb 40 57 22 ac 41 db 68 64 ec 0e 31 b0 0d b6 55 42 34 18 f3 f5 24 4a 41 93 51 06 b2 42 56 30 19 65 42 0a ff af 43 30 1b 9f 5a 3f b8 88 06 e3 4a 14 8d b6 a1 6d ee 28 06 19 f3 8e 24 a4 c0 64 c8 04 2b b0 42 93 21 03 e1 43 91 82 08 00 1d 80 03 6a 30 46 50 45 91 a0 aa cc 21 28 13 7a b1 98 71 71 44 ee 51 a3 36 4f Data Ascii: lS<Mf"22vs.<kJtV1yDk=n61-m=,6}/,Hr.8:o\|i4vs?`_~199>>s@W"Ahd1UB4$JAQBV0eBC0Z?Jm($d+B!Cj0FPE!(zqqDQ6O
2022-11-15 19:22:52 UTC	34	IN	Data Raw: 68 27 22 58 2a 36 c4 23 09 c7 70 ca a5 cb e7 8b 99 2b 1e 75 f6 56 87 9c ad 97 ff e6 f4 09 1c 7a 89 31 d3 04 9b 15 74 f6 60 ec dc cb 8d 42 08 6c 78 0f ec 39 ff 37 1c a1 0e c2 77 aa ff 15 5f fe 79 be 0d e4 7b 1e 52 5f 29 d1 8c 4a f8 ff e0 19 75 b0 7f 90 fe af 78 95 24 78 8a 1b 05 cf 11 dc 14 3c 91 25 f1 0d 89 fe 80 05 80 3f f8 72 48 b9 22 fb 7d 00 54 06 46 ef c2 96 58 2f 78 0e 28 37 4c 47 af fe 49 41 48 85 4a 7a c8 13 2c 89 15 24 fc 81 16 20 fc c1 97 82 72 45 a6 81 a5 16 12 5b d4 8a 60 c5 36 8c 07 44 4f 07 0e e3 07 94 11 28 e0 00 5d 40 f6 a4 15 a4 a6 72 fd fd 20 ab 02 11 83 33 6c 62 3b 52 c1 69 b1 1e 49 0e 68 db 57 79 34 34 97 d7 36 f1 95 9e e9 19 cc c5 dc e4 f3 77 ca f6 60 a3 9e 41 ab 91 4a 30 92 32 a6 24 95 50 84 5c b0 7e 1f f4 fa a0 27 6e 05 34 82 fa 5f Data Ascii: h'"X*6#p+uVz1t`Blx97w_y{R_)Jux$x<%?rH"}TFX/x(7LGIAHJz,$ rE[`6DO(]@r 3lb;RiIhWy446w`AJ02$P\~'n4_
2022-11-15 19:22:52 UTC	36	IN	Data Raw: 76 8d f0 33 c5 fc 8c 94 76 73 8c 27 c1 6c e8 16 71 4b 0a fb 84 7e 22 7e c8 43 fa 5e 24 a5 69 4d de 9b f6 fa 88 d8 71 a4 ec f5 28 8b 37 7d c2 ac 3e 09 e4 61 97 a0 93 98 f8 ad f7 c4 8d 46 4e 9a e0 93 86 ca 93 7e a4 30 6d e8 19 f1 48 f8 41 fa 5e f3 2d ef ad 8a ee 62 79 37 8d 74 1f e2 12 30 00 a4 1c cd 99 20 1a 0e c1 1c 58 8a bf 3d 71 4f b5 14 79 a1 43 68 0e 5a 8a bf 3d 01 ff 82 17 df a2 8a 96 05 82 33 ce 7d 22 17 ff e8 c0 b2 5c e4 8c 70 bf 13 88 7f 74 78 59 39 0e cc 96 6e 28 1e 49 3f 8c 11 5b 46 13 bc 4d fa ac c7 5f 13 49 f6 ba 6f e7 cd a4 77 86 48 3a 8b ec db 65 f1 8c 01 b7 df 49 0c ab 33 cb 31 fa 73 68 4c 33 9a c0 a3 b7 ff 01 25 58 56 b4 ed 9b af 5b 06 c7 35 8b 8b b1 b8 7f 60 71 07 0f ec a4 83 43 8e 47 06 b2 fa 5e f7 33 d0 32 1e 5b d2 3d 06 f7 0e 3a e0 8e Data Ascii: v3vs'lqK~"~C^$iMq(7}>aFN~0mHA^-by7t0 X=qOyChZ=3}"\ptxY9n(I?[FM_IowH:eI31shL3%XV[5`qCG^32[=:
2022-11-15 19:22:52 UTC	37	IN	Data Raw: 37 66 66 38 0d 0a e9 42 fc 2c 1d 12 0f ba fc 77 82 b0 0e 53 84 2a 64 43 ff a1 ad 2c 4a 6b 40 f5 47 34 91 f9 73 3d 89 a7 33 d5 1f d7 30 0a 52 36 88 c7 6f e5 b0 00 91 ca 50 b2 1c f2 24 be 91 8e 4e 1b e8 0f 7c 89 2c 05 4f 3c 2c 20 cd 2f c4 a7 85 58 89 10 8b 34 e9 2f 86 62 d7 2a 1f bd 08 1b e0 c6 e8 b3 97 1d 83 be b8 d7 37 b2 de b3 7d 35 63 55 b2 af ab b5 aa b2 a5 c1 f3 aa dd c9 93 71 71 91 5c 6a 63 6d 79 79 c9 18 99 41 e8 9d 5d 8f 85 99 2d 6a 59 78 d6 9b 81 5b 71 35 d0 a5 ea e1 21 98 d3 d6 11 4b 77 38 86 74 94 3f bb d5 f8 28 99 8b 6b a5 97 05 21 e7 c3 68 3e a3 3d 60 f3 f5 c3 ab 39 dd 8d 9c 4d 6e 89 f7 2d b6 e8 46 49 61 ca c9 e4 e8 24 3e 3a 89 a0 bc 4e 46 45 44 46 b0 1e c9 4f 31 e6 7d 44 62 e0 b5 3b e3 b7 11 c9 02 56 3a d5 f8 57 57 56 e4 d5 70 a9 d1 17 52 99 Data Ascii: 7ff8B,wSdC,Jk@G4s=30R6oP$N\|,O<, /X4/b7}5cUqq\jcmyyA]-jYx[q5!Kw8t?(k!h>=`9Mn-FIa$>:NFEDFO1}Db;V:WWVpR
2022-11-15 19:22:52 UTC	38	IN	Data Raw: b7 6b 88 93 0d 47 ed 6d 25 65 7e a1 2d c2 ca 16 71 3e ee bb 4d 95 f5 a3 51 88 c1 7d 12 1a 3b 1f 2d 41 0b 81 44 2a b8 02 cd 87 09 bf 62 ac 5d 8a c4 bf a1 25 7c cc 01 fa 55 22 5a 66 68 14 8d 66 ac d0 3d 01 b3 6e df 4c 84 c5 df f0 b2 48 e4 d3 05 0b bb 84 19 7d bb 1f a8 3d 7e 2f b6 12 d1 5f 41 88 a0 49 5f ca ca 4f cd 67 5f 5e 40 cc 2e 83 30 34 69 69 e0 c7 29 69 47 79 e4 29 ac a5 df 63 21 f6 8a 4b 68 54 68 34 17 1a 13 1a e7 83 e3 22 37 9b 2c 0e 8d 0f 3d c7 85 26 84 26 d6 30 30 89 3c 5e 55 15 51 cd c2 dc 37 30 09 66 f2 14 03 cc 0a 98 80 e6 5a 3b 1e f5 74 c7 70 d5 84 0d 87 7c 20 6b cf 4d 61 fa 6d 8f 6c b5 a2 51 88 a6 bc 84 89 cf e8 a3 0a cf 88 40 56 27 12 d4 6e df 4f 01 f5 d7 79 a5 e1 81 a9 7c 67 35 5d 6d 69 99 b7 8b 45 f3 96 23 35 f4 11 e2 5e e2 49 54 b3 a6 e9 Data Ascii: kGm%e~-q>MQ};-AD*b]%\|U"Zfhf=nLH}=~/_AI_Og_^@.04ii)iGy)c!KhTh4"7,=&&00<^UQ70fZ;tp\| kMamlQ@V'nOy\|g5]miE#5^IT
2022-11-15 19:22:52 UTC	39	IN	Data Raw: e7 e3 20 3b 76 f1 a1 17 5f f6 65 bf fb 22 2d 27 26 88 a7 0c c2 42 23 03 19 9f b2 a0 82 ca 82 dc 4a 5c 5d fa 57 e7 99 9e e1 64 41 bd c6 77 ee 7f 03 2a ed d0 d7 a2 76 1a 98 75 a0 05 12 d0 42 2c 2c a0 9a c3 21 ef 2e 1d 7c d4 37 d2 9f a5 f2 45 01 2e e7 4b 73 2f a5 e0 1e af 39 bc a6 d4 ef e3 22 1e f4 e0 1a 7d 10 99 c1 94 b7 3d f5 25 9d 19 25 b1 1f f3 8a e3 91 3e cc c1 52 df ab 57 4b f3 1b 7f 9e 95 b7 0e c9 d0 f8 ad 68 c6 8e 3a 97 06 1b 0e 4d b3 84 7d d2 94 48 82 2a 10 d5 7b de b3 32 61 14 d1 8a 18 05 d7 b8 d7 a2 46 ce 9a 18 fb ef d4 86 b1 1e 4f af 35 a6 e6 36 f2 47 2b aa 14 75 6c 4f e5 d5 a6 02 de bd 85 a0 4c 44 de 21 81 0e ce ec b1 a3 09 29 21 fc 95 c6 b2 da 3b 4c 7d 58 71 60 19 07 93 da a5 b2 21 b3 d1 27 0a 68 ab 90 22 81 6f f1 98 66 2c 1d da ff a7 19 71 63 Data Ascii: ;v_e"-'&B#J\]WdAwvuB,,!.\|7E.Ks/9"}=%%>RWKh:M}H{2aFO56G+ulOLD!)!;L}Xq`!'h"of,qc
2022-11-15 19:22:52 UTC	41	IN	Data Raw: e4 d6 d1 fd e2 22 65 8e 32 97 25 bd 62 f2 94 b9 c5 74 7e 4e 66 1e db d0 b9 e9 18 a3 69 a8 6f 6c f4 ad f7 e0 64 8e b6 0a 46 a9 cc 2c e1 5a 7b 1a b4 74 b3 bf c6 cd cd 1f f7 d6 b6 c7 db 8d 0e 53 aa 94 ac c2 51 2b 63 3c 7c 7d bc bc 1a 7c 34 dc b1 ce de 06 26 2f 47 15 1d ae 54 2a 63 38 32 3d 46 a9 8c fd 98 b6 16 ef c8 55 e6 c4 e1 e5 22 37 2e 27 21 8c 8e 8e 55 c5 b0 0a f7 63 9b 18 4f 45 80 bb 77 ad 57 13 77 a2 ae b7 93 c9 cd 51 c5 f8 bb c7 a7 ba 72 6a f4 29 d1 2d 20 a0 c0 e8 3e 7c 69 f4 b1 70 00 30 40 ba bd e3 56 bd ba 90 00 4b 05 3b 79 dc 41 38 72 74 12 21 bb 20 f4 c2 1a 24 f9 71 1d cc d8 cb a1 db e2 0d cb fa 2c e9 60 fe 98 5a 3c f0 b6 cd 20 3d 2e 11 0f 5e b3 19 a0 51 82 0f f5 6f ab d5 e3 56 d8 eb 5c 05 bf ea fe 02 bf 62 73 06 56 e1 d6 6e 8d 8c de ba 65 76 d9 Data Ascii: "e2%bt~NfioldF,Z{tSQ+c<\|}\|4&/GT*c82=FU"7.'!UcOEwWwQrj)- >\|ip0@VK;yA8rt! $q,`Z< =.^QoV\bsVnev
2022-11-15 19:22:52 UTC	42	IN	Data Raw: 05 8a 12 bf b3 9e 58 21 be 7a 0a 3b 3d d3 68 8b 03 8f a2 17 20 1a cc a8 b0 13 f1 5f 37 d3 20 aa 00 57 58 32 74 c8 55 76 80 ad 59 4e e5 6c 4d db b6 15 7b b4 21 c8 15 2d d9 ec 5a dd 12 c4 c2 30 7f 8e 6a b6 34 2f 32 67 ee 41 1c 9e 6d 7d fd ab 55 1c 22 d1 5a e2 2b d1 6d 98 4b f8 6b 07 62 06 98 7b 90 08 3d f7 ef 2d 86 b8 df c0 90 78 4b 24 e1 8d 92 db 5d a6 70 4c 6e ad d2 1a f8 00 86 b1 62 ec fc 57 3c 7e b9 60 d1 34 48 69 11 34 f4 3c 0c 52 b2 c3 a2 16 3f 06 ef b4 5c e4 e5 9e ad 60 d0 66 34 17 2d 47 56 68 0b bc 8e fe 0e 8e 5c 6d 4d 76 2d c3 b7 88 ee 46 dd a6 c8 d4 2d 41 b1 72 64 6e 01 42 64 fc c5 1e ec 26 2f 38 a3 75 58 83 65 9f 87 65 5f 5d 03 a9 35 d2 14 ec 66 ff 05 f4 c8 43 65 13 32 ef ef 12 a3 37 e0 1b ca f0 3d cb 37 39 d2 de e8 b3 35 37 6f 5e 1e fc 96 25 0f Data Ascii: X!z;=h _7 WX2tUvYNlM{!-Z0j4/2gAm}U"Z+mKkb{=-xK$]pLnbW<~`4Hi4<R?\`f4-GVh\mMv-F-ArdnBd&/8uXee_]5fCe27=7957o^%
2022-11-15 19:22:52 UTC	44	IN	Data Raw: 8a bd 9b dd d6 31 92 e4 51 d8 32 79 4d 07 54 30 4e 21 3b 53 b0 43 fa a3 a0 3f 79 55 47 df 54 04 d5 77 03 a9 51 ac 4f e2 09 78 dd 3c 01 5e 07 b3 4b 1f 40 d8 f1 7b 1e 46 d8 a1 40 0a 2f 5c 6b f1 c2 75 f2 51 80 dd 5f 0e 8b 46 ce 4c 40 a9 5a 1f 0d 40 e3 c1 2a fd a9 01 c8 c9 e1 d2 5d a7 7f f6 de 58 f1 c4 1d f2 bb 71 93 3f 8f 12 7a 4d 18 a4 9b 4f 1a 23 3c 11 46 29 78 67 9d c8 cb b3 62 af 1f 1b 09 e6 05 e2 bd 35 9e 21 8d f4 e9 93 0d 1b a1 ec 03 31 92 a1 32 02 bb 14 26 14 32 41 cf 8b 25 99 30 af 7b b4 1b e6 49 0f f1 0a 34 00 f3 48 0b d2 4a 40 e2 eb eb f0 0a 3c 0a 42 8c 2c 06 ec f0 bf ae 3e 3e ae 2e f5 3e 6d 6d 9a fa f6 36 45 bd 2b 47 26 a2 cb 33 1f 93 2e 49 2e dd 85 07 77 0f a8 84 f7 88 19 23 f3 b1 0f 13 c3 87 52 63 a0 32 12 8d dd 0d a5 8c 90 6a 4c 24 41 ae fc f2 Data Ascii: 1Q2yMT0N!;SC?yUGTwQOx<^K@{F@/\kuQ_FL@Z@*]Xq?zMO#<F)xgb5!12&2A%0{I4HJ@<B,>>.>mm6E+G&3.I.w#Rc2jL$A
2022-11-15 19:22:52 UTC	45	IN	Data Raw: 67 73 20 37 30 2f 46 6f 6e 74 42 42 6f 78 5b 2d 31 36 31 20 2d 32 33 36 20 31 31 36 33 20 39 33 36 5d 2f 46 6f 6e 74 46 69 6c 65 33 20 32 34 20 30 20 52 2f 46 6f 6e 74 4e 61 6d 65 2f 44 65 56 69 6e 6e 65 2d 49 74 61 6c 69 63 2f 49 74 61 6c 69 63 41 6e 67 6c 65 20 2d 31 35 2f 53 74 65 6d 48 20 31 33 2f 53 74 65 6d 56 20 34 33 2f 54 79 70 65 2f 46 6f 6e 74 44 65 73 63 72 69 70 74 6f 72 2f 58 48 65 69 67 68 74 20 34 33 36 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 34 20 30 20 6f 62 6a 0a 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 4c 65 6e 67 74 68 20 31 35 30 39 34 2f 53 75 62 74 79 70 65 2f 54 79 70 65 31 43 3e 3e 73 74 72 65 61 6d 0a 68 de b4 79 77 5c 54 d7 da ae 23 ee 3d 63 09 c6 9c 6c 8f ee 9d ec 8d 2d c6 de 3b 2a b6 01 2b 1d e9 bd d7 a1 cf Data Ascii: gs 70/FontBBox[-161 -236 1163 936]/FontFile3 24 0 R/FontName/DeVinne-Italic/ItalicAngle -15/StemH 13/StemV 43/Type/FontDescriptor/XHeight 436>>endobj24 0 obj<</Filter/FlateDecode/Length 15094/Subtype/Type1C>>streamhyw\T#=cl-;*+
2022-11-15 19:22:52 UTC	46	IN	Data Raw: 6f 7f c3 aa e1 0b c2 c2 d8 6f 7a 5d 84 66 dd 45 ab fb bd 17 2a 7b 1a e9 c6 1e e5 c8 00 79 c3 a9 4d 9f 9e e2 80 56 e2 5c a4 4c a2 88 e3 65 0a 33 44 62 d2 52 64 ec 6d 4b db 78 3b 06 39 52 0e c1 95 3d 7d d5 af 5a 07 99 fa b2 0a 79 2d 55 c0 26 27 4a 19 b5 d3 14 43 58 89 8c fe 65 5a 45 4f 5f d5 bb 69 95 8a 5a ea 52 93 87 11 a3 0d 5a 43 ca d5 cb ca 41 3c cb 29 7d 03 8e 4c 02 3d 69 f3 a4 16 f8 5b 13 e1 5c 59 2f ea a2 c6 ef 4c 00 ba 99 89 c9 c4 e0 7c 0f 8b 13 96 94 6b 48 cd 68 3c 53 5f d7 72 bd fb 6f bc 9b 75 8a e6 12 2a 3b 2b 21 89 89 8f 95 88 c9 70 a5 a8 a4 bc b8 a4 aa 36 b0 dc cb 2a c4 cd c0 97 76 5c e7 7e c4 dd 21 02 7c 70 06 70 d2 be e7 01 ed 9e 91 81 2b 64 bb 4f ad fd a6 1d 1b e1 96 08 1a 9e b0 da b8 09 52 e4 92 1b 47 be eb ed 2f 3a 3f 40 27 b2 44 80 bb 9b Data Ascii: ooz]fE{yMV\Le3DbRdmKx;9R=}Zy-U&'JCXeZEO_iZRZCA<)}L=i[\Y/L\|kHh<S_rou;+!p6*v\~!\|pp+dORG/:?@'D
2022-11-15 19:22:52 UTC	48	IN	Data Raw: 7e fb 95 6a 2a 15 47 32 12 df 98 40 52 28 15 17 15 2b 8b 2a db 9d 1a 4f 1e 3f ec 7a c0 88 3e b8 c1 15 6d 94 43 c2 79 d7 0f 3c 1a b9 dc 34 da 42 57 aa 58 55 27 f9 95 f9 c8 51 73 07 1f 03 17 7a 0c 96 12 96 ee ed b7 27 aa 1e 34 b6 31 8d 35 f5 8a 6a aa a3 cc e7 38 3f 64 87 a7 31 e3 23 14 44 f8 52 da a3 91 45 ea 08 56 35 80 8a 50 15 b8 5f a5 f5 a5 7a 06 a1 c0 c1 bc a6 96 cb a3 83 fd a7 47 28 a5 3c 33 4f ce c0 70 98 0a 17 c0 b5 db c9 10 56 5c 56 26 2d 6c 94 d1 f9 95 f2 07 97 c1 cc c1 5f ae 5d ed e8 e5 b5 a8 4a ea 1b 48 79 42 ae 24 32 3d 26 34 85 76 48 0e 0b f1 a6 3c c4 15 55 a1 4c 55 58 a4 dc 87 72 b3 f7 3e 6a cb 24 a6 63 e7 6a 33 cb 15 a4 3c 29 4b 12 9b 92 14 43 27 a7 c5 47 93 16 51 06 be 07 34 49 a1 29 fc 9c 2a d5 05 15 40 b2 85 f8 30 04 b7 88 a5 be e6 c6 bb Data Ascii: ~jG2@R(+O?z>mCy<4BWXU'Qsz'415j8?d1#DREV5P_zG(<3OpV\V&-l_]JHyB$2=&4vH<ULUXr>j$cj3<)KC'GQ4I)*@0
2022-11-15 19:22:52 UTC	49	IN	Data Raw: 72 5c 17 aa fb f1 2b 20 0b 8b c4 e1 e1 63 5b 4e c2 5d 94 75 68 6e bd 34 43 91 29 67 ae 82 33 d8 ab b4 a6 20 3d 32 28 d1 2b ce 91 96 27 7f a5 9e 27 4e f3 86 f3 8c 6d e0 cc bc c5 fd c0 01 bb 51 98 5f 8c 5c 7f da 6c 0e 8f a4 30 32 fc 3a 48 c5 a6 1a ff 0c bc 36 b0 45 10 1e b1 a0 97 e5 80 b3 e0 17 62 00 b8 60 d7 0b cf 95 dc a7 80 76 8b 23 24 dc 12 1d e2 ad 18 39 fe 1c dc c1 a6 aa fe 94 0b f0 54 ca dd e1 9b ab 62 33 64 68 83 57 80 10 e1 6e d4 e0 4e 9a c6 9d f2 95 7a ee bf e0 d6 06 79 48 be fb d8 61 90 72 fd 5d 08 38 84 10 32 fc 12 b0 60 7b 73 1b cb 15 8b 0b 14 0d 99 7d 94 14 fe 2e e6 be 4e 6d 4c 74 20 fd 23 f5 fc 4d 68 0b 81 b9 b7 21 b5 d7 ea d2 93 fe 82 c7 d5 bf 30 a5 cf 8a 26 5a 47 79 03 8d 17 6b fb a9 37 d7 b6 c3 0d 61 a9 c1 49 81 8c 02 9f 04 f7 b1 08 dc 32 Data Ascii: r\+ c[N]uhn4C)g3 =2(+''NmQ_\l02:H6Eb`v#$9Tb3dhWnNzyHar]82`{s}.NmLt #Mh!0&ZGyk7aI2
2022-11-15 19:22:52 UTC	50	IN	Data Raw: f9 ca ee e2 96 cb 8c 7b 99 5d 89 53 0b 4f 50 16 55 df 4c 8e 5d ea bd f3 f5 f5 5d f0 53 61 4a 50 8a 1f ad c0 1f 82 11 54 3f 8c 42 23 fd 03 50 d3 5b a2 10 32 75 9e be 0a 5b 6a dd 81 3d 4b 37 f5 59 7c 6f c0 74 fb 74 87 d4 38 f3 14 21 39 41 7e a4 81 91 f1 5e a8 ad 0b e6 02 f7 02 3a 02 d7 06 36 ef b2 ac 7f a1 7a 86 14 df e2 96 db 2e cb 2c cc 2e 65 c0 52 75 39 d6 80 df 6a 74 da e5 79 c6 3e c6 0c 55 aa 09 50 81 4d 15 e0 06 b0 02 25 3b 38 78 fb e6 b3 2f a9 76 1c ea 4c 29 a3 6d c4 de 01 91 8b 23 62 bd 52 cc 92 d1 61 0c be 13 e2 1f 26 c1 2f 20 40 0b 68 83 4a 42 e2 22 71 b6 22 57 3c 3c 0e 16 81 65 c3 83 40 a7 99 fe 0a 7c 53 f6 b2 ba 6d 4c a3 a0 02 31 77 34 b5 3e c8 8e 0c 49 f2 8f f3 a6 b7 c0 67 1a 1d 30 b6 82 3c 6a 8d a5 ea 51 59 56 75 5e 23 f3 06 fc 77 d1 44 a1 e2 Data Ascii: {]SOPUL]]SaJPT?B#P[2u[j=K7Y\|ott8!9A~^:6z.,.eRu9jty>UPM%;8x/vL)m#bRa&/ @hJB"q"W<<e@\|SmL1w4>Ig0<jQYVu^#wD
2022-11-15 19:22:52 UTC	52	IN	Data Raw: 64 39 70 9b 4a 1d 8e 58 9e ab 5e 4a 98 42 df 30 b8 2d 70 15 6f 6f 78 80 9b 03 15 14 c1 b2 4c 7e 4b c6 f4 87 c9 d0 c0 08 91 bf 73 b3 e7 05 30 7f 00 d8 aa 57 3e a6 81 16 9e 53 8a 38 c3 c1 86 f2 e6 fb e3 54 4d 51 54 0c 13 65 97 e2 41 86 29 22 4a 2a 8a 4a 6a db 5d ea 4d b7 18 ee 81 db 5c e8 cf f1 33 21 98 76 31 74 66 01 7f fa 7b 82 eb 24 c8 95 6a 81 7b 0f 88 d7 e0 87 3f e2 f9 5e a6 47 87 31 e5 30 cd aa d9 f1 c0 e3 87 c8 b5 03 fa e3 bd ed 75 23 35 74 4e 32 06 8f da 9e de ba 9a 72 0b 91 b2 8c b4 3d a5 8d 2c 89 94 0b 05 e1 61 3e f6 6d de 37 c0 82 07 df 00 e3 8b 34 34 d9 4b 38 07 d7 0c 34 21 a2 c7 a7 89 56 d6 22 a2 ab 8b 6a a9 0b 15 ae fb 03 e2 6d c2 8f 31 62 fb 48 cf c8 60 9e b3 c0 27 dc 83 d2 1e 8d 67 d5 2b ca 81 17 d2 81 1c 15 3b a4 25 4e 25 6e e0 a0 fc bf 9e Data Ascii: d9pJX^JB0-pooxL~Ks0W>S8TMQTeA)"J*Jj]M\3!v1tf{$j{?^G10u#5tN2r=,a>m744K84!V"jm1bH`'g+;%N%n
2022-11-15 19:22:52 UTC	53	IN	Data Raw: 6a c7 1f 00 66 8c 62 73 13 13 98 28 27 94 51 61 b2 a8 a2 aa d2 f2 da 66 41 a5 8f 91 15 1f ea 9c a6 cf a4 61 f9 3d d9 6d 8d 64 5f 58 b5 af 1d 62 47 db 6b 9a 1d ac b1 6d a8 91 2a c8 8d 13 49 d0 bd 1d 49 03 1f 1d b9 1e cb 89 51 95 ab c0 02 74 2d 9f 23 24 5e 5d bd 72 eb b2 73 c3 c9 0b 8c 4b 8d a0 a4 8d ec 68 ae 1f ec ac 09 8a a1 e3 ec 90 b3 40 59 64 29 aa 30 35 97 6c 55 47 0e 9c 32 e1 1f bd e0 7d d3 94 ae 0d 94 07 05 90 f6 ae 9e 27 cc 5c ab e4 74 4e 6f 5a 07 59 aa 29 5d 61 21 fe e6 7d 8e 0f 68 ed 95 48 75 75 ca 39 2a 54 f0 92 df ce 24 0c 70 73 68 87 2d c1 13 42 b0 5f 35 df c1 b0 58 d7 78 2f 5f f2 64 95 7b 6b 7f db 55 40 34 d1 51 28 8c e7 fa 3b 9f 72 d3 5c 1d e5 ca 74 65 96 92 79 0a 46 b1 9f 35 b5 6f 29 ae fd 6b e4 74 cb 76 4b 83 7c 36 ea 24 24 a8 59 89 cb c2 Data Ascii: jfbs('QafAa=md_XbGkmIIQt-#$^]rsKh@Yd)05lUG2}'\tNoZY)]a!}hHuu9T$psh-B_5Xx/_d{kU@4Q(;r\teyF5o)ktvK\|6$$Y
2022-11-15 19:22:52 UTC	54	IN	Data Raw: 56 e2 d8 49 f3 c8 19 8a b3 5d 6c b4 77 dc 66 8d 82 5f 74 de 76 01 02 7b 04 26 41 3d 99 ac e5 cc 2f 77 e2 b1 c6 d4 a6 c3 fa e3 e0 e9 6a b2 ea 5b c3 dd c6 bb ae 1d 1f 62 cd 30 b9 6c 16 9b 92 53 44 a2 e4 94 06 91 03 92 61 df 40 b3 a6 2e 00 01 74 50 af 80 b7 1d b9 84 33 9b da 45 e4 66 97 94 e4 50 e0 39 d0 83 64 57 56 e7 d7 10 6d 0d 4d 83 96 6c 93 c4 48 1d 01 cf 23 c9 68 30 33 0f a9 92 49 4a 45 44 58 68 5a 68 28 05 93 a9 35 9b f0 cd 7d de 27 52 61 22 b4 18 b1 c0 f8 8d b8 ae fa f4 d8 51 f0 dc 22 26 8b 59 8a 09 6a 95 ad 07 f0 6b 6d 30 45 23 ff 9e a2 65 c6 17 65 84 43 49 b2 c6 db e8 3f d3 e0 57 34 a8 a0 59 76 02 1a db 6f c0 79 2c fb 15 f1 66 11 cf 55 10 94 92 2c c4 73 2a 72 2b 0d f9 86 26 2d d9 ac d5 ea 8c 44 6b b3 48 d8 43 a5 76 b5 4a 7a 89 73 13 c7 2f 8c a4 b4 Data Ascii: VI]lwf_tv{&A=/wj[b0lSDa@.tP3EfP9dWVmMlH#h03IJEDXhZh(5}'Ra"Q"&Yjkm0E#eeCI?W4Yvoy,fU,s*r+&-DkHCvJzs/
2022-11-15 19:22:52 UTC	56	IN	Data Raw: 13 69 ca 37 d6 e3 c3 ea be aa 36 b2 e4 83 e1 48 87 08 46 73 b3 c4 90 4c f1 f6 45 ed 70 00 aa 40 f1 6d 96 a3 c5 c4 01 7f 7e 1c 19 c5 29 a6 67 56 5a 59 20 d5 f6 25 dc 5b 79 33 d1 18 a3 40 99 a7 37 6d 75 7b e5 bc 3b 40 f3 a8 fb bf 1c 99 d9 78 eb 87 8d c3 33 1b 8f b3 39 60 03 10 83 41 16 78 05 0c ba c0 5c ce 15 5b 7b ca f3 ea d5 d3 67 ae 5c f5 3c b5 6e ad a7 d7 5a f2 5f 80 bc 36 9c 71 3a 8a 9f c2 0b 84 0b 7f 9c a5 dc c1 12 39 bb dc 1c a0 d9 b1 e6 4f c1 34 3b d7 fc 6f 60 cf 82 9f e6 07 c0 8a 85 7f 5c 9b f4 80 a7 e1 01 8f 0a cf 7f c4 57 d8 2f a7 df 66 9d bf 0d 54 b7 41 16 54 c7 53 97 1f c7 b1 81 1b 0b 1f 83 6d 81 cf 1f bf c6 99 e9 7b 1c 6f ff 8d e3 cf e5 ff 15 d0 bd fd d7 0b 1f f0 cc ae fd 23 3c cc 10 f3 c4 7f 0f b2 87 2b 3d c6 f3 00 af ff 80 e7 87 5b 76 ea 5f Data Ascii: i76HFsLEp@m~)gVZY %[y3@7mu{;@x39`Ax\[{g\<nZ_6q:9O4;o`\W/fTATSm{o#<+=[v_
2022-11-15 19:22:52 UTC	57	IN	Data Raw: 29 db 1f be e2 91 e9 c3 97 34 df 13 f6 e7 9c 98 49 99 c3 84 96 3b 4d 48 04 4d 48 fd b8 09 19 1e 9a d0 5e 87 09 8d 3b 4d a8 c6 61 42 36 a7 09 e9 d0 fb 9b 98 38 8c c1 f6 47 7b 2f 23 56 70 47 bf 3c a4 bb d0 76 8b ea fa b6 e7 d2 a1 51 d7 f6 0e 9b e1 20 71 a6 53 c8 95 e7 c7 29 b9 14 67 09 34 1e 2f 68 3c 4f 80 3b 58 57 5f 6d 57 07 35 78 c0 74 68 0c ff 90 37 ea bb 3f 32 23 26 96 0c 0d 11 41 43 d9 3c 14 38 41 fa 7c 88 35 57 5a 6b c7 48 da 4a b7 1b cd ae c6 da ba 2a 23 d1 69 4a 8b 16 e6 46 cb 82 29 45 b8 62 7f ba c0 35 4d 22 ce 14 11 b1 69 8d fd f0 e3 8b 17 3b ea 9c 59 34 ab 72 02 64 e9 80 aa c5 c5 fe a7 7f d2 95 7c cd 74 f5 c4 35 fc fd 94 0e 5e 48 44 c4 ea 28 32 b7 a4 0d 3c fd 8f 1d eb e0 d9 0e 5f f2 b6 f7 f0 17 0f 79 7e 70 d4 66 bb d1 eb 28 6c ae af 3e 1c 74 92 Data Ascii: )4I;MHMH^;MaB68G{/#VpG<vQ qS)g4/h<O;XW_mW5xth7?2#&AC<8A\|5WZkHJ*#iJF)Eb5M"i;Y4rd\|t5^HD(2<_y~pf(l>t
2022-11-15 19:22:52 UTC	58	IN	Data Raw: ab 54 93 96 32 4d 5d 6b 6f 63 c0 20 d1 6f ed 3b 5f 0b b7 cf 95 c6 71 d0 fe f0 84 e7 47 18 b3 6e f6 84 e7 ba 49 b0 6e f6 84 e7 3a 36 f3 f1 fd fc b9 13 40 4e 80 ac 87 03 20 fb 2d cd fa 16 4c 9f bb 3d 07 6c 9f fe 17 d0 b0 35 ce 43 91 a6 eb 48 51 bd f1 1f 61 b5 be a8 fe 6a 57 e3 f5 42 57 26 ed be d7 3f 45 cb fe 55 69 64 d9 4d c0 ff ff eb 5b f7 ba 7f 0f 7a d6 4a 01 1a a7 d4 18 ca 4a ca d4 15 94 d6 86 5c a9 da 80 8e 80 15 21 49 51 cc 02 84 59 5c 8e 9e 9b b8 79 e9 de b7 ae 3e 68 a2 d7 b6 f5 8b 5f 77 95 80 17 d8 59 f1 48 98 42 95 1f ec 28 f6 da 57 9e 01 f3 6e 8f ff 09 cc 63 81 1f 80 8b 8b fd 2d 7b 33 96 c8 17 24 24 34 0a 3a 3a 1a 9b da da 05 96 04 8a 19 66 42 67 df 29 73 80 79 19 de 17 c6 27 58 04 ed ce fb 7c 4b 22 f5 a0 f3 b1 0b 8a 78 c2 8e b2 77 dc 2f 98 1b 71 Data Ascii: T2M]koc o;_qGnIn:6@N -L=l5CHQajWBW&?EUidM[zJJ\!IQY\y>h_wYHB(Wnc-{3$$4::fBg)sy'X\|K"xw/q
2022-11-15 19:22:52 UTC	60	IN	Data Raw: df c3 11 9c f1 2e f8 0d d0 5c 03 3c 0e 80 71 25 d0 5c 77 cc 9d 1b f9 3f 1c 71 1f 8e e0 dc 75 80 04 9a 5b 0e be b9 11 bc 9b ef 90 e0 0b b8 ca a5 ca e2 3f c3 5b 4e e2 3f 4b b8 b3 c4 6f 0e d3 db e3 54 07 fc 3c 5d 5a 4e d9 4e b7 fc 4c 20 ea b5 76 cb 8f 68 69 c5 0f bb 7f 32 c0 17 ac 98 59 05 d5 18 f5 88 1a fb a0 1a 9d bf 25 80 13 9d 5e 7c 07 aa 30 20 a1 f8 1e fc b9 4e e2 3f 4b b8 b3 c4 8f f3 da eb c5 a0 10 de 9c a5 fe 73 94 3b 47 e1 8b 7c da 54 0c e6 c1 b5 ca d2 8b 81 0b 64 9c a5 fe 73 94 3b 47 fd e6 68 00 67 db 5b c5 d0 24 78 9c ef b3 8b c1 53 90 7f 96 fa cf 51 ee 1c f5 e3 14 17 83 67 e1 6d 27 e1 72 22 76 14 03 0e 9c c5 bc 5b 4c b3 38 a9 66 fb d6 52 90 5d ad 29 41 e9 a7 6d f3 69 ad ce f0 cc 33 ba 56 5d f3 33 cf da 0b 16 c0 5c e5 ff 08 30 00 b4 dc e4 0a 0a 65 Data Ascii: .\<q%\w?qu[?[N?KoT<]ZNNL vhi2Y%^\|0 N?Ks;G\|Tds;Ghg[$xSQgm'r"v[L8fR])Ami3V]3\0e
2022-11-15 19:22:52 UTC	64	IN	Data Raw: f0 36 b8 5c 04 4d 6d 86 f5 40 8a 26 6f 1c 2b 69 b1 7f 27 fc ca a0 ac 60 f2 46 42 71 f2 22 16 2d a0 5c ac 02 56 a3 59 e3 81 00 6b c8 80 c9 97 bf e3 e9 77 60 d2 fd d9 ca 2a a1 8c 8c 05 17 22 90 f4 8e 77 4b 88 75 df d3 30 89 43 07 d1 18 9c 18 4b d1 d8 da 4d a7 6c 84 65 b7 41 ea f9 03 47 8b 30 08 8c cf a9 05 d8 43 dd ae 54 75 a6 f1 1f 12 e5 44 27 b4 68 25 bf f6 c1 d9 3e a9 76 0c d4 69 49 b3 f4 68 ed 35 16 f6 c3 59 64 4b 59 24 06 2e d4 e1 af d3 52 1f ee 8b 9b a8 db 79 f9 3d 19 bc 16 d5 c9 a9 7b f1 6a ec 63 b4 1d 9d 85 ed ff fb 3e b6 ff 03 bf 81 bf 52 db 3f 58 2b 01 aa 4f 5a 34 06 4e 6a c9 e5 2a ff 9c 87 3a 61 8f 2b 32 ef a6 62 a6 93 72 ea e9 df 32 66 01 9e 64 ea c3 0f 89 7f 60 26 cb 3e 29 d4 89 27 99 7b ea dc 87 e9 98 b4 4d 4e 3d 49 c8 0b b7 64 07 0e 50 b6 61 Data Ascii: 6\Mm@&o+i'`FBq"-\VYkw`"wKu0CKMleAG0CTuD'h%>viIh5YdKY$.Ry={jc>R?X+OZ4Nj:a+2br2fd`&>)'{MN=IdPa
2022-11-15 19:22:52 UTC	68	IN	Data Raw: c7 35 86 6a d1 81 6e 11 bd 75 47 ce 85 91 f5 29 05 d1 72 36 26 c2 3d da 87 37 43 7e 88 82 0c 22 29 33 ae 20 9f ad 6a 4a 29 4b c1 6a f6 87 53 f9 8a ca 84 3c 3f 20 51 b2 91 da e3 f8 ac 30 36 f4 00 e2 6d 79 da 27 c2 a3 c8 87 db a3 70 8a c7 43 b1 6f 99 fb c9 fb 9d d7 80 ed e2 f1 d2 34 5d 83 7b 7a be ca d8 e0 85 b2 56 64 6b 25 7f e8 2d 88 d2 fb 43 ef a3 28 3d a9 b8 00 38 26 38 8d 30 0b 8d f7 18 c7 21 9e 84 52 71 0a a1 41 3f 52 49 68 28 51 44 9e ce 4c 6b bc cb 01 4f 22 ed c0 14 bc 2e 8c a0 0c 60 24 b2 ce ed 7f 9c 2b 81 0d f7 a4 b0 61 3f ae 6c 97 82 7e e6 73 29 cb 82 a0 43 37 59 58 4a dd 8e 68 35 2b e4 55 d4 c3 a2 fc d6 db ba 1b 37 8b 0f dd 2e c0 14 13 36 04 a1 61 02 b2 c2 35 df c3 2a 98 bf 29 2f f0 58 c7 1a a0 39 1f 96 8a eb d7 a4 d7 c3 99 6b fd 56 d6 e4 df 94 Data Ascii: 5jnuG)r6&=7C~")3 jJ)KjS<? Q06my'pCo4]{zVdk%-C(=8&80!RqA?RIh(QDLkO".`$+a?l~s)C7YXJh5+U7.6a5*)/X9kV
2022-11-15 19:22:52 UTC	69	IN	Data Raw: 37 66 66 38 0d 0a b4 32 a8 aa 52 55 ac 51 7b 36 5b a1 97 3c 91 8f 4d 02 3b 0f 8f f5 c4 40 82 cb 22 62 4c 12 b6 27 19 cf 8d 40 eb b1 95 09 a1 7f 37 61 62 e2 b3 b2 b9 bc c2 fc 52 5a 15 59 10 14 e5 1e bf cf 45 ed d1 77 ab fb 3b d8 58 cf 16 5e cc f9 a2 18 9e d0 83 27 70 7d f4 4a 39 64 96 43 6c 39 64 94 1b 9c 3d 1c f2 dd 22 c1 e7 bf 63 7f 34 7a 80 e4 d7 9f 15 cc d5 56 bd e3 8c 25 4b fe 18 03 2f a1 69 45 e1 3b 69 1b 57 6f 5b f3 90 ca 7c 76 7f 43 5e 03 5d 1c 51 e9 ee e7 13 ba cf f4 a4 f3 c5 db 9d 43 43 47 fd ea b7 1c 65 15 c2 f1 fb fd fa 6b f1 1d 43 a3 f4 f1 5d 47 ec 5a 59 f4 2c 60 98 7f 79 5c 6d 19 ad 2a ed 3e c1 92 3f e8 74 55 44 84 72 09 6e 11 1e 74 64 ae 77 8b b0 92 34 ef 6f 3f b8 6d c3 7b 2e 2b 36 b7 bb 0e 3a b0 32 e1 f4 e1 d7 af cc b3 da f1 0e 0d fa f7 a8 Data Ascii: 7ff82RUQ{6[<M;@"bL'@7abRZYEw;X^'p}J9dCl9d="c4zV%K/iE;iWo[\|vC^]QCCGekC]GZY,`y\m*>?tUDrntdw4o?m{.+6:2
2022-11-15 19:22:52 UTC	73	IN	Data Raw: b0 65 79 21 61 93 99 26 3f 44 df ed 21 c8 b1 c3 af 0e 57 fd a3 8e 19 ce c1 43 0a 3d 1b fc 9a 4c 2f ce e9 2c 6c 68 19 a0 87 cc 6a 4c 58 b4 09 07 2c 84 6a c3 0f d6 49 4d 2d a5 2e b6 9c 33 ce d3 29 14 98 a1 05 b0 14 99 21 4b b4 10 89 d4 0c 16 8a 90 11 30 83 05 f0 2a 98 b1 e6 b3 85 ed 90 44 cf a3 d7 d1 72 44 0a ee d6 9b b0 0c 0c e0 05 58 21 94 9e 12 9e 2f 67 c5 73 c2 f7 c1 6b 3f 82 29 4f 18 b2 d6 0f 80 00 a9 e8 0a 14 0a ae 40 51 09 85 9e 08 00 c3 4f be 3b 3a 30 74 fe ec db 42 6f 13 d8 85 6c fe 08 d5 6f db b8 3d cf 58 26 9b d3 e6 ec 56 b4 93 41 73 57 0a fe c0 33 88 bc 31 09 81 78 1d fe 06 8f 3b 02 b9 e4 53 ee 46 8f bb 66 b1 cd ae 6a ab 62 93 8c b9 3b 03 7b 12 3a a5 ad de c2 94 6f ab f7 12 5f 41 e2 2d a4 ba 2d 7c a4 04 a2 20 8b 42 d6 c8 a6 c7 4e d8 68 6d c0 46 Data Ascii: ey!a&?D!WC=L/,lhjLX,jIM-.3)!K0*DrDX!/gsk?)O@QO;:0tBolo=X&VAsW31x;SFfjb;{:o_A--\| BNhmF
2022-11-15 19:22:52 UTC	77	IN	Data Raw: 63 cc ea 83 44 e8 8a d2 37 e7 61 70 d3 17 f0 65 b0 1b 04 01 bf 6f c0 cb a3 45 17 d3 7b 89 81 d4 30 d7 21 7c 6f 44 e1 e1 24 f2 e1 dc bb b6 37 22 0e ca e1 93 eb 43 2a fe 71 ee 8a e9 e1 27 24 e3 c4 a0 a7 1e bc c9 02 a1 20 8c fd d0 33 9f 67 bb 60 68 34 b8 cc ae 40 9d 41 cb 00 20 6a ab 6e 52 39 f0 87 aa 09 6a 42 3b 41 07 86 ae 5e 0d e7 72 12 f6 6d 83 ec 10 2c 9b 2e ae cd 27 8a 6a 7a c4 cd 78 6b 87 d5 59 47 3a 5b 35 4d ba 2e b4 1f 01 e4 00 60 5f 00 cf 12 77 c0 12 ce 00 a2 88 db 2d 81 33 71 86 f6 ad 86 bd 64 2a 1c f3 81 cf c8 d4 13 13 0c f8 cc 01 4e f0 0c 1b 4c 78 f6 f0 72 4c b9 fa 82 5a 34 a7 ae ac af 0b bb 3d d1 75 ed 76 5f c4 9e 64 51 44 6a 09 31 22 e0 bd 5b 33 e1 7e 1f 1b cb 1c 8a 6f 26 9a 63 0f 59 99 35 8b 05 bd 05 5f da 7c 72 db ed 54 72 53 e5 76 fe 1a 0c Data Ascii: cD7apeoE{0!\|oD$7"Cq'$ 3g`h4@A jnR9jB;A^rm,.'jzxkYG:[5M.`_w-3qdNLxrLZ4=uv_dQDj1"[3~o&cY5_\|rTrSv
2022-11-15 19:22:52 UTC	81	IN	Data Raw: cc 7a 9f f4 69 b0 fc ee 29 44 fc 45 bf 39 d4 04 12 c0 61 10 cf 7e e8 49 e7 d5 8c 37 5f 38 d1 8f 8e 8d 5e 35 dc 68 69 a5 5a 70 ef 02 af 97 73 c8 f3 57 a4 06 b4 72 0e 73 95 6a a5 12 13 1d c8 dc 13 1d 87 c6 1e dd a6 de 87 67 67 69 74 d9 a4 67 be e7 57 ce a4 f7 0e 52 01 0d 1c df 6b 1c ce d0 94 64 88 f5 a9 ef ed e6 5f b7 f2 20 3e 25 01 f8 00 17 9a f5 9c 47 ef 23 c0 cc 34 ac c1 9a c1 a9 57 06 59 e3 20 80 29 e4 00 f6 f8 54 21 cf 33 fd 51 21 07 04 70 bd d3 a7 0a ff cb 0a 58 e7 33 b3 ce 67 26 9e 0b cc 6a ce d4 fb 08 34 ab 38 09 00 47 fc 83 c1 7b 9e 79 ac 49 0f c5 66 9a ff f7 78 4c 5b 6d 06 33 a1 99 03 66 73 61 98 67 1e 07 ce 60 be bd f3 7c 8f 37 e0 82 2f 59 1a 8f 8a ed 51 c1 05 bc 2f bd aa 65 8f df 77 05 00 f8 f8 7d 17 08 9f aa e0 ad 0a 5d b5 1d 72 b0 34 73 6a 6b Data Ascii: zi)DE9a~I7_8^5hiZpsWrsjggitgWRkd_ >%G#4WY )T!3Q!pX3g&j48G{yIfxL[m3fsag`\|7/YQ/ew}]r4sjk
2022-11-15 19:22:52 UTC	85	IN	Data Raw: ec 51 a9 a3 b0 6b fd f6 b9 6c 11 f0 cc 65 cb 2e 3d fa f7 6c f1 5b 92 f4 23 73 d9 82 f9 fe 08 f8 de b1 73 c7 c0 cc 01 11 a8 07 58 86 63 ee 26 d9 38 e3 56 27 37 83 6b 79 4d e6 a6 ac 77 9e 7f 24 eb 9d 55 92 56 47 63 9b 19 37 a9 cb 59 15 96 03 8e 1c 94 2a e4 76 97 9c 10 8c 07 14 24 9a 01 3a 18 40 cf bf 77 ec e1 73 ef 1d 5b 25 1d fd b0 3d d5 35 be 6b b6 7d ef ac b0 4f 26 df 24 ec af 33 d1 46 84 33 38 2c 7a 54 69 d6 99 db f0 a5 fc 93 b7 0a d8 e9 32 0b db 64 0e c1 c4 e2 0d c7 c8 08 76 50 80 cf 9b f8 e2 89 f4 e4 51 c0 8c 89 42 e0 27 bf 07 f8 29 f0 a3 0c b0 69 93 8c 6a b4 57 e9 14 3a 65 4b 9b dc 47 39 68 8e e1 10 1f c4 96 18 da ad 8f 35 78 f1 4d e1 b2 da 6c 74 ed ec 8e 03 67 f6 0f 1f 1c c0 77 1f 0a 9d 71 9f 0a 83 9f 64 06 41 b6 18 10 47 f9 9f 49 9c 9f 30 23 14 f8 Data Ascii: Qkle.=l[#ssXc&8V'7kyMw$UVGc7Y*v$:@ws[%=5k}O&$3F38,zTi2dvPQB')ijW:eKG9h5xMltgwqdAGI0#
2022-11-15 19:22:52 UTC	89	IN	Data Raw: 7a e7 2d 5a 77 80 65 02 11 07 a0 44 56 eb 28 d3 d6 e3 db db ea e4 a5 58 79 7d cf d0 e7 7f 70 be 16 23 d2 cd 7a 19 b8 d5 f5 10 90 f2 77 61 1b d6 b5 16 55 10 16 97 19 26 64 77 ee 46 df 1a ec b7 3c 56 7d 77 c1 9e ba c9 d1 bd 9d e3 de b6 3e 93 97 a0 dc b4 9d 73 3b 58 87 c3 c1 20 81 78 3b d7 81 c5 ba 48 63 84 e8 55 d3 3b 98 7a 84 69 62 a0 82 bb a9 99 df d1 c4 2f 41 b7 45 ab 77 29 71 45 df 5e 72 08 3b fe 7a c7 d0 24 e1 0f 04 3d be a0 d3 22 24 24 7f e6 e5 c6 97 31 f0 bd 0b 33 e0 9a 49 a2 30 26 ce aa db 92 fd 2c c6 8b 77 bc f3 19 4b ec bf f6 74 f8 93 b7 4f 46 9f cd d7 da 4d 26 e1 bc dd cc 98 b0 ab ae 8d ff 5f cb 46 de 65 53 01 a8 02 51 70 fb ff c6 58 d0 2c 9c 60 3f 5d 04 27 d9 eb e3 62 7e e3 ff d9 63 00 8e 49 df 9c 80 93 f6 c9 2d 62 e0 be 6c 37 f8 f7 23 ef 5c 4e Data Ascii: z-ZweDV(Xy}p#zwaU&dwF<V}w>s;X x;HcU;zib/AEw)qE^r;z$="$$13I0&,wKtOFM&_FeSQpX,`?]'b~cI-bl7#\N
2022-11-15 19:22:52 UTC	94	IN	Data Raw: 3e 78 f8 66 a5 ec 6d 67 46 92 85 c7 c5 fe 3a 34 4e 74 af 5e 0c 2b 74 0b 39 b2 04 76 e3 b0 15 1e 2e c3 e3 ef 61 b3 4f d8 9e ff 91 76 86 de 13 41 02 03 65 b0 ba f8 cd 73 e8 cb ff 3e 0c 5c ea c5 6f 70 08 07 46 60 77 13 ac 60 b8 0c c6 8f 02 b3 ce 60 cf 7b d1 4f 70 ef 32 2c c1 03 65 78 b5 bf 6d 7f 4c 86 d5 21 37 c8 23 16 9f 0b b7 f1 d8 1b 06 c9 72 91 86 48 06 46 e1 ee 8a cb e1 e5 f5 e5 bd 2e 9f 75 7f 05 46 67 e3 ae 59 85 52 d0 62 3c 6e c1 58 e5 50 12 c8 cd 88 85 79 4a 11 ec 54 8a 61 27 e4 73 78 be 2b cc c7 f3 94 30 8f 3c c6 e4 40 4c 3f 0e db 5c 7c ff 45 54 fb 49 5c 6b 5e 42 4f 4b 9a 1c b4 8e 9f ce a4 6f 7e b6 1f 3a 36 4d 16 12 5f 8a 0a 20 59 0c f9 f0 98 c3 c9 bd 21 99 8c da d8 38 04 bc bf 10 41 3a 5b 7e 22 4f 52 62 75 eb e3 44 8b a1 5c 0c 45 ba 45 9c 07 8d 37 Data Ascii: >xfmgF:4Nt^+t9v.aOvAes>\opF`w``{Op2,exmL!7#rHF.uFgYRb<nXPyJTa'sx+0<@L?\\|ETI\k^BOKo~:6M_ Y!8A:[~"ORbuD\EE7
2022-11-15 19:22:52 UTC	98	IN	Data Raw: 63 03 03 3c a7 6a 72 ac 6e 7e 9c 74 37 8a 22 0b b8 b5 51 60 81 08 6c 43 83 9f fe 2c e1 14 b4 76 d9 74 79 74 c2 d6 2d 49 02 1b e9 cc b0 d9 eb 52 77 ad db 2b 07 6a e7 1e 98 5d 23 dc 05 97 1b e0 72 13 5c 4c 7a 18 f8 6d 54 a2 36 4a d1 69 34 5a 8c 02 d1 24 ee a1 be bb 2b 14 30 f8 9e de 8c 1a 89 46 2b f1 23 46 72 0e fb 97 23 d1 0d f8 77 b9 34 ff e1 ce 2a f6 24 8b f2 61 19 c7 fe 72 31 cb 67 a8 80 5d 98 81 c5 d3 8a f9 bb e5 01 f4 ec a4 9c 02 01 06 33 6b 3e 8d cd 8c db 66 92 c2 a4 6f bd 95 bd ed ad 09 0c 61 0a 77 67 67 f1 05 e5 ee b4 bf ff b4 81 02 1e ca b8 ce f6 9d ce 4b 42 9b e0 43 bd 52 5c 1f cf 29 75 eb 5d e9 3f 7d 4e 04 ed 09 76 28 84 4b dc f4 d9 a5 4a 01 86 32 4f fd 2f f9 f3 ee a3 0b e8 ac dd 61 33 04 3c 84 d9 d6 fd 56 58 fa 5a 93 64 26 6e cd d8 39 6b 3a 9b Data Ascii: c<jrn~t7"Q`lC,vtyt-IRw+j]#r\LzmT6Ji4Z$+0F+#Fr#w4*$ar1g]3k>foawggKBCR\)u]?}Nv(KJ2O/a3<VXZd&n9k:
2022-11-15 19:22:52 UTC	101	IN	Data Raw: 37 66 66 38 0d 0a 47 07 a5 0d dc d9 dd 9f 41 d3 e7 5e 90 36 7b 59 26 19 fe f2 da f2 f2 35 fa 07 b5 15 9b 36 96 6f a5 1b b4 cb 9d cb 6e b9 fd f1 f9 24 ac a8 b0 dc 51 68 e0 ad 53 b5 fc b6 75 9b df 2a d9 ad c3 ad 08 f3 63 c6 91 45 81 94 2a 03 5f e9 dc 72 e4 c3 8b 71 08 4b ec 26 e3 49 42 72 32 d1 d2 57 20 9a ec 70 d5 7d 4d 57 78 13 bb c3 31 51 3a 21 10 57 b7 94 3c 4f bb ea 61 db da 94 57 23 ad ac 18 00 c7 7d 61 92 8d ee 24 6c 74 fd eb c3 3e 96 dd 9f c1 a9 84 d6 b5 34 cd 69 de 35 48 d3 9c be 8e a6 f9 35 08 bb 43 9b eb dc 5f 52 a5 93 e9 1a 56 09 c1 bb a6 b0 75 8c bc 22 4c f1 61 81 0f c7 e8 93 0e 5f c9 16 48 44 7f a2 0f 41 07 07 81 04 35 8d 54 20 a8 71 90 a0 4f 4a 64 ac 65 24 69 d6 90 26 3a 82 e4 eb 74 f0 e4 17 1f 7e 01 2f 33 3a 01 94 7c 8b bc 81 a4 b2 c4 49 89 Data Ascii: 7ff8GA^6{Y&56on$QhSucE_rqK&IBr2W p}MWx1Q:!W<OaW#}a$lt>4i5H5C_RVu"La_HDA5T qOJde$i&:t~/3:\|I
2022-11-15 19:22:52 UTC	105	IN	Data Raw: ee d5 82 10 6d 40 82 6f 39 1e ca b0 c5 77 45 fd 52 05 10 db 37 bf 9a c1 eb e6 31 2f b0 03 e6 ed c2 8f 30 86 73 4e a6 9c e4 76 47 76 1e c8 d8 82 c3 30 8c 4a 27 e8 57 33 7e aa 06 3d f5 05 0d 38 fc 08 27 7d 6b b8 13 db 8b 6b 87 12 2f df 74 bb 99 75 b9 74 c8 a3 b0 37 ef 0e a0 c6 4b 5d 95 e9 d0 79 c1 81 f7 70 de 47 ea 65 0b dd 16 96 2d 6b fb c8 63 f0 3d e0 bc a0 22 1d 77 e8 f2 a9 18 3f 55 8b 82 80 2f 68 5d d0 8f a8 30 03 e7 ef 06 bf c5 db ae 96 7d f9 4f b7 7f aa bf e4 5d f5 38 f0 2d 74 fe 4e 69 36 68 5d c1 a4 f7 f2 bc 0a 83 f1 52 ff ac 2d 6b dd d6 26 6e d1 fa 7b c4 06 1b bc e0 a4 f7 28 5d db 81 1b b9 14 05 b2 3e 1a 48 01 6e 44 75 46 49 79 72 1d 6e ea 91 e6 8f b8 65 99 cb 4b 0d 1e 17 79 56 4e 49 8c 55 d7 94 95 5b 92 53 92 d8 14 95 23 c8 15 e4 09 72 c3 f2 0d 05 Data Ascii: m@o9wER71/0sNvGv0J'W3~=8'}kk/tut7K]ypGe-kc="w?U/h]0}O]8-tNi6h]R-k&n{(]>HnDuFIyrneKyVNIU[S#r
2022-11-15 19:22:52 UTC	109	IN	Data Raw: 74 33 c6 2c 4c ea 8c e9 52 37 c9 3b b8 4d 87 72 d8 d9 3e 7a a1 72 c3 01 c9 3e c3 fa 68 e8 5c be a5 e6 70 39 bf 4e d6 ae 1d 11 0d e6 f7 15 3f aa af bc 5a 5a 8f 33 39 d5 db 4a c2 ab e5 56 6d 65 7c 6d 65 6d 65 5e 67 5a 59 fa 39 57 0d 66 8e 4d 11 28 95 42 61 54 8d 21 57 5d 16 53 17 3f 00 18 60 d4 15 86 c1 1f 09 66 61 9c 40 72 40 a5 55 a8 e5 46 6d 9a 24 3d 36 4b 51 29 ab 36 34 25 d5 1b 86 4d c3 d9 43 d9 a7 0a 8e da 9a 2a eb ac a5 e7 b4 f5 c6 da a8 92 28 bc 86 9d bf 3a 7b 3f ee a2 ed 27 9d 2f 82 d4 16 f4 d6 6d c0 cf 6f 7e 42 03 8b db 89 1e 51 43 74 4f 42 77 42 8f a5 a5 a0 26 f7 4a b3 ed e7 82 01 d3 b0 be 43 76 9f d3 bd a3 a1 bd b1 a5 36 ff 5a de 25 76 bf b2 74 e3 d9 79 b9 9b 39 b8 40 ed 23 58 e9 f6 fb 9b 8c 40 fd fe a4 40 8f af 30 8b 2d d3 66 73 4b 19 8f 21 7a Data Ascii: t3,LR7;Mr>zr>h\p9N?ZZ39JVme\|meme^gZY9WfM(BaT!W]S?`fa@r@UFm$=6KQ)64%MC*(:{?'/mo~BQCtOBwB&JCv6Z%vty9@#X@@0-fsK!z
2022-11-15 19:22:52 UTC	113	IN	Data Raw: a3 2d d0 ea 3b c5 9a 84 82 f8 c2 30 69 86 7f 66 84 46 a4 4b ae 4f 50 e7 eb 14 bd b9 5a bd a1 0c 6b 6c aa be 91 5f ab 1a d3 8e 16 8c d5 41 22 13 6c e8 ca 26 1a 5a 40 d7 c2 6b 39 55 85 d5 45 95 b6 85 a5 65 35 95 d9 0d d9 59 49 d2 04 59 72 4a ba 81 53 22 a8 ce d3 a8 2a 4a 65 06 99 46 5a 17 59 12 97 13 95 13 94 24 4e 89 e2 9d 0a 4e 70 c5 b8 ce a9 fe 32 7f 0c cd a2 db 4c c4 ea 3f 85 3c f0 d5 53 ee 13 d7 a8 c4 81 58 9c d3 2e d6 5c b1 1b 56 96 9b 0e b0 ba 8f 3f 48 33 0e 55 d4 e9 c6 a2 be c0 ba 05 5e ea 70 7b 9f c0 c8 54 11 fb 04 27 b3 55 a3 d5 e9 9b b3 ab 2f 95 0d 72 4c 21 15 58 09 37 a6 30 dc 3e 3c 26 55 cc 65 87 c4 73 5c cb 3c aa 0f 35 67 ea f8 1a 61 66 c8 89 2a ac 50 14 58 ef 63 1f ee 95 e4 23 60 47 ed d6 39 57 44 19 3f 7e 50 d0 73 16 1b bd 5c 98 e8 6e 77 40 Data Ascii: -;0ifFKOPZkl_A"l&Z@k9UEe5YIYrJS"JeFZY$NNp2L?<SX.\V?H3U^p{T'U/rL!X70><&Ues\<5gafPXc#`G9WD?~Ps\nw@
2022-11-15 19:22:52 UTC	117	IN	Data Raw: 86 93 53 f7 4d b4 09 6e 92 f3 f4 55 9a 0d fa 19 72 7b 29 55 97 a8 70 de 1c 84 7f 5c 45 f6 54 04 90 c7 50 15 8a 22 5c 68 36 3f 27 1a a1 a3 0b de ec fa c7 34 92 ed 1d 00 e7 b3 f0 97 69 24 bb f5 7f 8b 64 96 7d 68 3f 3e 00 1b e1 0d fa 57 5c 47 ef 42 76 e1 09 da 39 7a 42 53 41 e1 e9 c1 f4 2b f2 fc c0 aa b6 5a 8d 3e 73 00 bb 2f 73 2e 76 b2 47 3b e8 b0 d3 17 af ef 4b fd 28 8d ed 29 0b 4f 09 b3 47 36 f0 26 09 bf 62 e3 f3 6e b8 da 09 33 8d 94 7e 23 b0 06 41 30 08 8b 49 98 1a 21 96 e3 b2 ea d4 c6 d0 7a b7 9e c5 d9 c7 3c 37 39 66 a1 cd e7 f7 7c b6 19 fe 54 32 6c ea 1f 50 b4 28 0c d8 49 7a 66 b4 30 36 8e eb eb b7 b3 30 a8 fb c8 f5 6a 98 db d0 fe c9 d7 f0 ba 77 e1 1e cc e2 b5 fb ff 06 a0 5e 59 f1 e9 7a 17 05 16 0e 80 d3 00 a8 07 a8 f0 21 19 f1 c3 43 78 a3 0b 9d f5 85 Data Ascii: SMnUr{)Up\ETP"\h6?'4i$d}h?>W\GBv9zBSA+Z>s/s.vG;K()OG6&bn3~#A0I!z<79f\|T2lP(Izf060jw^Yz!Cx
2022-11-15 19:22:52 UTC	121	IN	Data Raw: fe c5 3f 5c fe f4 d3 3f fe e1 e2 fc 29 0f 3f fd f4 c3 c8 68 71 f4 53 03 c9 1c 02 be f6 46 94 40 e1 63 cf a3 ff 80 49 39 ed 0e 2e e3 82 33 1b 4a b9 30 23 fa 05 c2 83 3f a3 31 9f cb 3c 0c 04 f5 ef 71 19 11 9c ea 44 bf c1 85 fa b2 52 2e 58 d2 3f 8d 6c 6f 9e 3b 19 de 95 0a a7 f4 4c 80 2b 4e cc 00 cb df 01 73 de 03 73 41 c6 e7 60 e5 66 3b dd a1 ad 97 11 8d 92 40 19 43 b9 f9 92 30 df 57 e9 98 20 b5 97 3a 84 c8 c6 21 b8 72 e9 3a 38 79 2d 9c fc 29 7c 1c cc dc 0c 6e cb 06 49 af 7e fa 25 91 b8 32 ba 68 54 4a f4 ae 5e 36 a4 a2 a3 48 1b 92 10 a5 b1 ab 0d 1a 8b be 5c cb 17 6a c5 3a 89 51 6c 26 d4 8c 4a 4d 35 34 32 8d 1c 2b 63 a0 93 16 58 17 cc a7 fc 11 da e2 4f 1a b2 c1 d1 9d 24 a8 b4 c4 09 61 0b d0 83 84 58 b7 d6 e8 5c 8b 08 a1 b5 ba 83 0e d7 ae a3 a7 5c fb db f7 ed Data Ascii: ?\?)?hqSF@cI9.3J0#?1<qDR.X?lo;L+NssA`f;@C0W :!r:8y-)\|nI~%2hTJ^6H\j:Ql&JM542+cXO$aX\\
2022-11-15 19:22:52 UTC	126	IN	Data Raw: c2 f9 a8 c2 69 ba 05 67 d6 da 1a 29 98 0e 2e 0c ee 4b 81 cf 90 30 9e 89 09 43 a1 b8 f1 32 73 4c 18 6b 91 30 12 9f 0b 46 6f 1d 4c 43 3e 38 13 2b ce 9c aa 4c 4f 25 2a 4e cf 9e 20 af c9 5c 4f b4 bc 63 0e 0b b8 6d 9b 36 15 6f 93 1b cc 2e a5 c3 ba db 16 2f ce 92 f2 42 9e 5a a8 dd 62 b2 d5 db eb bd 4d b2 2a ad bb 8c 96 eb 2b e3 c5 49 c4 ab f3 14 aa ce dc 77 53 aa 3a eb 7b ba 0b f6 e7 1c 5e 63 78 45 41 58 fb 27 5d b7 63 8a b8 91 9d 66 73 1d b2 43 87 f9 d7 ed a8 1c 96 e1 76 b6 9a ac 37 b3 13 ee ac 1b 62 07 65 70 52 df b3 c3 42 ea 0c f2 51 48 34 0a 29 22 68 dd b4 39 6e c9 a9 74 c6 23 72 0b bc 25 a2 42 be 9a 18 1e 52 29 ad 18 34 75 cd 52 0e 8a 68 4f fd fe b8 a5 b5 31 4b e9 fd 39 a4 0e e9 ca 26 b4 c8 03 2e a4 2b f7 80 ae bc 57 75 55 a2 2e d7 14 9b e5 8d 0d 31 5d 05 Data Ascii: ig).K0C2sLk0FoLC>8+LO%N \Ocm6o./BZbM+IwS:{^cxEAX']cfsCv7bepRBQH4)"h9nt#r%BR)4uRhO1K9&.+WuU.1]
2022-11-15 19:22:52 UTC	130	IN	Data Raw: 63 98 0b 5f 25 90 a5 7f 46 2e 78 17 3c 8d 0d 30 c7 5f 87 4b b0 72 e4 c1 6a 70 82 48 8c 02 84 91 86 d8 5d a8 19 bf 0b d5 48 7e 6c 29 68 26 3a 11 1d 58 82 15 32 c1 5d f8 34 fc 19 a2 21 20 57 dd 7f dc 42 fc 3a 29 26 cc 1f df 72 6f 2c b6 31 7f 5c c8 a0 99 ac 9b b1 ed bf 63 21 78 7b 62 fc c5 fc 7b 2f 32 e6 ff ef 92 15 97 c4 72 88 44 0f 91 79 f3 12 36 9f fd c0 e6 73 d1 0c 58 d0 5a f8 ff c8 6f c6 a6 ff 8e 78 f3 f8 82 ff c9 d2 45 06 42 62 7e 43 a9 19 66 fc 8f 64 80 47 3a 63 73 08 38 0b 3c 8c b2 bb 59 08 1e 06 f7 4b f4 f4 30 9c 85 00 b5 c3 59 54 e3 13 80 b8 7b 17 10 e8 fe 0c 24 20 f1 cc 83 3b 6a 41 8b 65 2c be 17 78 88 af c7 ef 2e 64 fe 3f 0f 40 08 d4 c4 8e ae b2 e1 e1 ae ae e1 e1 b2 ae 1d 3b ca ca 76 50 e3 33 27 fe b7 b6 07 6c 2f 3c 60 43 b3 5d f6 7f 49 7b e2 81 Data Ascii: c_%F.x<0_KrjpH]H~l)h&:X2]4! WB:)&ro,1\c!x{b{/2rDy6sXZoxEBb~CfdG:cs8<YK0YT{$ ;jAe,x.d?@;vP3'l/<`C]I{
2022-11-15 19:22:52 UTC	133	IN	Data Raw: 37 66 66 38 0d 0a ba 5e fb 26 72 59 68 fe a6 a7 ab bd 22 b8 2b 54 75 b5 4e f7 dd be fe 50 59 a0 ac 8b 7b b0 e8 f3 d3 7b 8b 8e 95 74 7f da d3 8c 57 36 f7 8a 86 d8 23 b6 c8 48 b4 cb a1 49 0a e4 b7 17 8c d9 f1 d1 ee d1 48 84 d3 c5 1d c8 1d d1 9e 33 89 2f 47 46 7a f3 f6 15 28 37 37 68 dd 5e bf 11 bf 67 07 0f 11 75 6a ef 01 bf c6 c2 55 ca 67 a0 89 bc f6 eb 99 98 89 30 34 da 43 8a 06 5e 4b d9 6d de c2 2e 9e 65 f9 a1 00 8a 81 2b c7 b7 10 ca af 5e e9 5f da ce 17 d3 7c 73 95 b6 86 57 54 66 2f 08 56 0e d7 0f 2a fd 0d a7 72 95 32 0d 4f ed aa f3 6c e3 6d 47 1b a3 7c a7 b0 be 1b 6f 0c 34 59 82 8d e1 2e f9 58 5d 47 9e 4f 70 30 b5 ca 59 55 28 56 8a b6 1c 7f 37 75 8d 99 d7 e8 e8 51 b6 89 7d 12 6b bd bc 33 79 ee 99 8a 12 dc b6 f6 e6 ee 50 b6 ac b0 40 54 ae 4a b3 57 7c 5c Data Ascii: 7ff8^&rYh"+TuNPY{{tW6#HIH3/GFz(77h^gujUg04C^Km.e+^_\|sWTf/V*r2OlmG\|o4Y.X]GOp0YU(V7uQ}k3yP@TJW\|\
2022-11-15 19:22:52 UTC	137	IN	Data Raw: 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 0a 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 0a 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3a 70 64 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 70 64 66 2f 31 2e 33 2f 22 0a 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3a 78 6d 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 22 0a 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3a 64 63 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 65 6c 65 6d 65 6e 74 73 2f 31 2e 31 2f 22 0a 20 20 20 20 20 20 70 64 66 3a 50 72 6f 64 75 63 65 72 3d 22 41 63 72 6f 62 61 74 20 44 69 73 74 69 6c 6c 65 72 20 32 32 2e Data Ascii: g/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:pdf="http://ns.adobe.com/pdf/1.3/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" pdf:Producer="Acrobat Distiller 22.
2022-11-15 19:22:52 UTC	141	IN	Data Raw: 27 bb 06 82 6f 7a a6 01 5e 2e 36 eb af ce 80 8f dd 4d bf ba 7f d3 fd 2e b6 0c ee 40 d5 72 d3 7d 60 cd 8a c0 2f d8 22 c0 22 48 e1 23 d7 dd e1 c2 df 06 6b 58 de c0 6a 9e 35 ce c4 0e 4a b6 59 21 f0 12 60 2f 76 c3 c3 6e 90 1b 8c 83 36 61 76 30 ec 2c 1a b1 99 3c 6f 60 92 55 bb 02 c9 7f 73 fc f6 e8 e6 3a b8 b9 0a c2 30 9a eb af 56 71 bc e5 8a dd c2 ea bc ff fa 91 dc 03 fc bb 61 78 f8 c7 eb d7 5f be 7c 79 45 79 78 7b d5 f5 b7 df 5a ee 93 87 07 40 ea f5 99 90 09 da 48 9d 9c 89 b5 21 da 46 6d 69 bf 12 db 0b a3 69 47 57 47 c1 f7 67 a7 67 67 61 1e 17 61 9e 24 f0 3c 82 bf 53 f8 83 6f 29 28 39 98 48 9e f2 36 f9 14 ef bc 6f 9a c2 33 83 ef 95 ec cb bf 99 e7 91 1a a7 fa a4 39 f4 4b 55 5b a4 da 4a f8 fd 46 7d 83 f6 34 16 df c3 34 e2 8d f0 77 c6 01 c1 9f c4 21 e4 f6 06 f3 Data Ascii: 'oz^.6M.@r}`/""H#kXj5JY!`/vn6av0,<o`Us:0Vqax_\|yEyx{Z@H!FmiiGWGgggaa$<So)(9H6o39KU[JF}44w!
2022-11-15 19:22:52 UTC	145	IN	Data Raw: 03 a0 54 03 d9 7c 6a 83 d0 df f9 1b 8c 1e 38 ad 30 c5 db dd aa 21 40 dc 7a fd 5f 3b 80 3f 88 a9 8e 68 df d5 64 78 15 9c fb b3 02 40 f8 09 9c db 22 66 10 a0 66 90 60 d4 c8 80 29 ee 5d 31 d2 00 15 e9 ab 10 3e 01 a7 b6 0a 7b 4a 61 ec ea 33 7b f5 ad 14 d2 3f 2f d5 22 29 09 6b 50 33 56 25 61 03 11 84 24 49 48 e1 8f 80 94 6b 78 b6 fc 3d 57 cf 34 01 c5 c8 aa b0 ca 93 a6 86 df 75 56 b7 0c 76 db 30 b6 ac a7 02 51 4e a2 2a 67 55 5e 56 65 9b 97 3c a3 f8 ac cb 3a 21 87 c9 e7 cb c1 36 00 2e 68 7a d6 1e b2 58 ca b3 b2 c8 f3 b6 4c c2 2a 4e db 8c e6 71 14 6a fc f9 5c f0 8c 38 8c b4 2d da 22 8b 4b 09 a3 50 34 8a 4c c2 de e0 65 f1 9b a4 d5 e0 60 e1 e7 9c 97 c0 db 94 f3 17 78 9d 73 0b 8b f6 39 6c 90 19 97 0b f0 b4 86 27 81 27 81 f1 b4 e2 b4 65 09 8d 8b 28 2f 24 fe 7c ce 14 Data Ascii: T\|j80!@z_;?hdx@"ff`)]1>{Ja3{?/")kP3V%a$IHkx=W4uVv0QNgU^Ve<:!6.hzXLNqj\8-"KP4Le`xs9l''e(/$\|
2022-11-15 19:22:52 UTC	149	IN	Data Raw: 2e 22 ff e0 55 10 7f 0f c8 26 38 bf be 08 b6 03 d9 34 a4 6f 02 e8 16 dc f6 e4 e1 6e 45 f9 a8 01 66 0f d8 ef f4 8e 6c 6e d9 ab 20 38 e3 33 76 00 67 25 26 24 c3 aa db 04 f0 9f 40 0d f0 34 d3 c3 e0 fb 87 f5 8a c0 70 07 d3 bf 07 0f 6b 46 80 b0 9e b5 ac e7 08 01 9d c1 11 ed bb 1a 28 00 ba fb e0 ed 6e d5 70 58 c7 82 dc c6 a3 94 02 c6 40 61 f7 c0 36 d0 f6 65 35 dc 99 d1 40 82 62 ce 15 23 0d cc 94 be 0a c5 c7 35 cc d3 bf fa 16 18 fc 03 e7 f2 eb 8f e4 9e 6d 1f 08 65 c1 af 82 e9 df 88 51 df ca df c7 dd fd 7d b7 51 2f d1 ab 90 ff fa 37 1f 75 01 98 f6 66 e8 56 8d fd fe 7b f1 80 f6 a3 ad 04 7b fd 00 88 37 db a0 25 eb 2d d3 8d c7 7d f7 70 7e 4f 6e d9 f6 a6 3b eb f9 24 c1 d0 ef 4c f3 69 df 77 fd 31 f0 bb ef d6 c1 eb 9f 49 bf 39 da 34 fc 7d b5 b1 9d ce 80 0e 10 08 eb cf Data Ascii: ."U&84onEfln 83vg%&$@4pkF(npX@a6e5@b#5meQ}Q/7ufV{{7%-}p~On;$Liw1I94}
2022-11-15 19:22:52 UTC	153	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2022-11-15 19:22:52 UTC	158	IN	Data Raw: 68 74 20 34 38 34 2f 41 73 63 65 6e 74 20 39 35 32 2f 44 65 73 63 65 6e 74 20 2d 32 35 30 2f 53 74 65 6d 56 20 38 38 2f 46 6f 6e 74 46 69 6c 65 33 20 36 31 20 30 20 52 3e 3e 0a 65 6e 64 6f 62 6a 0a 36 31 20 30 20 6f 62 6a 0a 3c 3c 2f 4c 65 6e 67 74 68 20 20 20 20 34 34 34 36 37 2f 53 75 62 74 79 70 65 2f 54 79 70 65 31 43 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 3e 3e 73 74 72 65 61 6d 0a 78 da 7c 7b 07 5c 13 67 f8 3f 31 dc 05 ee 20 40 8e a3 98 78 09 ee 3d 98 6a dd 0c 17 28 cb 81 88 42 80 00 91 11 08 61 a3 80 8b 21 a0 75 22 88 20 20 e2 c4 81 8a 8a 7b e0 02 17 8e ba 67 ab ad 6d ad 1d 6f e8 d9 f6 ff 5c 0e 91 fe 7e bf cf ff d3 7e f3 8e bb e7 7d de 67 be cf 1b a2 c0 c8 d8 d8 48 60 6c 64 64 24 00 48 66 a4 69 d5 ca 70 1f ad 66 a8 9f 2a 32 29 46 Data Ascii: ht 484/Ascent 952/Descent -250/StemV 88/FontFile3 61 0 R>>endobj61 0 obj<</Length 44467/Subtype/Type1C/Filter/FlateDecode>>streamx\|{\g?1 @x=j(Ba!u" {gmo\~~}gH`ldd$Hfipf*2)F
2022-11-15 19:22:52 UTC	162	IN	Data Raw: e1 9a 50 95 9d 7f 5a 22 5c 46 12 ed a6 41 6d af 8d e7 be 65 80 eb b7 dd a4 98 18 3b c3 12 89 76 50 25 a8 b4 c9 dc 24 ff 1b 0a 3b 75 a2 9d 4a 0d d5 97 d6 4e 09 0f 23 d5 89 86 2b bb 1d 77 bf 86 5b 8d 36 da 4e c3 3d e9 32 8c f8 ff b0 b2 53 c7 d9 c1 5a 76 b3 e1 0a 0f 23 7f 28 b4 54 89 76 ca b8 f0 e1 b0 8a c6 c0 25 4c 93 14 a7 d3 aa 55 89 c3 3a 36 e0 a3 d5 0c 9f ec 3f 2b 2d 5e 65 37 ca 2e 5c 15 61 27 10 75 33 12 18 79 18 25 19 95 1a 9d 33 7a 62 f4 ab a0 bf 60 b6 a0 52 f0 a0 db e0 6e 15 dd f6 08 69 61 3f 61 96 70 bb 50 6f 3c c5 f8 1b e3 12 6c 18 e6 81 55 60 8d 58 2b ee 8b 07 e0 cb f0 22 7c 03 7e 14 bf 8a 3f c2 7f c1 91 28 58 74 52 f4 5a f4 9b 49 7f 93 7c 93 83 26 97 4d 7e 30 f9 68 f2 af a9 b9 69 4f d3 19 a6 55 a6 bf 9a 22 c2 98 30 25 46 12 0b 08 25 11 4d c4 11 Data Ascii: PZ"\FAme;vP%$;uJN#+w[6N=2SZv#(Tv%LU:6?+-^e7.\a'u3y%3zb`Rnia?apPo<lU`X+"\|~?(XtRZI\|&M~0hiOU"0%F%M
2022-11-15 19:22:52 UTC	165	IN	Data Raw: 37 66 66 38 0d 0a b1 d6 8a 84 29 53 6f 7c 72 86 d3 ad 37 46 d2 23 55 cc 35 fc d4 3b 8c 54 32 90 3f cb 73 b6 c9 8e 6f db 7b 85 cb 9f d1 f9 a4 f7 1f 04 1a 77 43 f0 e4 25 9a f3 52 88 c6 d9 e8 9d 11 d6 ca 62 d5 a2 6f 77 b6 7e bf b7 6a e5 b2 52 f9 df d6 2f db 3d 44 15 91 73 36 f9 cb a6 ce 4b 8f 56 29 16 86 e9 bc a7 4a 93 3b 98 24 af 64 c8 d7 29 ef 06 1e 62 a7 99 ac 0f 5d b3 70 9e 94 75 7d 89 26 89 4e af 3f b6 e1 90 fc 18 44 b1 f0 c7 bb 3b 32 6f db 2e 5c 3e 23 32 68 de fc 39 73 47 a6 b3 46 26 b9 78 d6 1f a1 cf 02 2e 2c 38 eb be 37 a8 d8 44 dc 66 f3 12 6d c4 4b 8b 36 17 6d 92 b7 6c 3a 7a fc 8a 6c d3 fa 82 fc f5 0a f2 12 73 75 0d 43 ce a9 f7 f9 1a db 37 df b7 7c 86 8c 75 67 e1 30 61 d5 fd f7 38 9c f7 56 cc 70 c4 c0 d6 2e 74 41 01 16 7b 3a e5 ec 3d 29 ea 79 17 f5 Data Ascii: 7ff8)So\|r7F#U5;T2?so{wC%Rbow~jR/=Ds6KV)J;$d)b]pu}&N?D;2o.\>#2h9sGF&x.,87DfmK6ml:zlsuC7\|ug0a8Vp.tA{:=)y
2022-11-15 19:22:52 UTC	169	IN	Data Raw: f4 e7 19 82 8c 41 19 aa 8c 8d 19 37 32 a5 99 53 33 13 33 77 66 b2 8b 93 16 37 2e be b1 f8 87 25 92 25 93 96 2c 5a 52 b5 e4 cf 2c 69 96 53 56 6c d6 b2 ac 2d 59 57 b3 da b3 07 65 87 65 e7 64 7f 93 bd 25 fb 51 0e 9d 33 21 47 95 53 98 b3 2e a7 3c a7 65 e9 90 a5 21 4b 33 96 6e 5b 7a 69 e9 77 cb ba 2d 63 96 25 2c 2b 5b 76 66 d9 cb e5 16 cb 65 cb 47 2f 0f 59 9e b7 bc 6a f9 e1 e5 7f ad 30 59 31 64 85 fb 8a d4 15 2b 56 d4 ad b8 b1 e2 d6 8a 3b 2b 7b ac 5c bd 72 dd ca 8d 2b 4b 56 96 ae dc b5 f2 df 5c 61 6e 7c 1e 99 67 9e 67 99 47 e5 45 e6 35 8e 5a 75 52 ff fe a4 00 3e fb 9c 14 ae 32 d6 e7 b5 fb 7c ca c3 51 31 7b 91 66 c7 a3 75 18 7a 8b b3 76 ec 19 1a 71 83 4f 6b 45 9f f0 85 86 3e 1a cf c2 18 d7 9f a6 b9 1e cb 8d c4 9f 44 62 f6 8f 6c 64 a9 bf 98 22 39 8f 88 fe 4f a8 Data Ascii: A72S33wf7.%%,ZR,iSVl-YWeed%Q3!GS.<e!K3n[ziw-c%,+[vfeG/Yj0Y1d+V;+{\r+KV\an\|ggGE5ZuR>2\|Q1{fuzvqOkE>Dbld"9O
2022-11-15 19:22:52 UTC	173	IN	Data Raw: f4 2b ee 13 fa c5 34 08 12 19 55 a5 a9 af af da 61 f8 12 07 8e a7 30 36 84 2e 4c 28 0e c8 50 86 cc e9 1e e8 af 9a 3f e5 5b 22 3b 4a e6 19 b3 f7 54 63 f5 fe c6 b3 8a 93 cd 5b 2f ac 38 9b b7 dd 56 ac 3f 8e 7a 0b b6 21 2f e1 b6 f6 69 4b 19 a7 00 c2 30 f1 01 cd 10 22 df f6 69 4e 8c 61 58 83 56 0b 11 d9 3e cd 85 b8 81 0f 86 57 6e 5f 4c b9 24 a9 3d 81 86 1c a7 e2 ef e9 af 4d 21 a8 fd 2e 0c 15 3f 93 69 21 f4 e7 ce 09 b6 a3 42 e1 f6 f6 f1 a3 18 7d eb 47 c1 eb 5f 84 c8 4e df aa 25 f4 ad bf 0a d6 fe f2 e2 67 e1 45 7d eb 30 46 bf 77 3f 12 1e 10 34 9c fa d0 24 44 bd f4 7b f3 08 36 a8 f1 f7 d3 02 34 a6 59 88 7a 14 d1 41 a3 8e e7 ee cc 2a 4c e8 9e 98 bc 2c 29 2d 65 cd 86 ce df 75 d6 c8 ce 35 6d bb 74 60 d1 f6 88 35 8a 3d a7 31 31 dc ff 18 70 6f 70 67 8b f6 69 85 04 ea Data Ascii: +4Ua06.L(P?[";JTc[/8V?z!/iK0"iNaXV>Wn_L$=M!.?i!B}G_N%gE}0Fw?4$D{64YzA*L,)-eu5mt`5=11popgi
2022-11-15 19:22:52 UTC	177	IN	Data Raw: 54 bc 07 ca 49 15 33 b7 e1 07 1a db d4 56 8d a6 6e e0 85 2b 38 5f d4 d4 70 bd 88 ab 78 5e bc 4f 52 48 a5 f3 17 0f 62 cd 22 3e 4a 47 cd ed 59 5c 1b 97 9f af 28 3c 17 7b ed a5 94 5f 24 34 e3 7a 91 b4 e3 83 69 1c d3 b8 a2 41 e9 ae 75 9a 58 d3 c6 34 c0 07 f5 7c 96 79 11 e9 63 13 bd 43 b6 6a 93 a7 ed 4e c5 16 73 df 25 8b a5 bb ba 3a 6c 46 fa 23 f8 24 52 a4 4b 77 4f d4 3f cf 49 0e d8 1b d7 e9 95 b8 75 ed 91 95 b2 79 eb bd 76 6c 55 6c b2 70 26 5e 89 c8 2c 51 cc bc 38 77 a8 40 70 54 48 3a 9c 25 4b 4a f2 df 73 4c 21 f9 df c7 f7 4b b5 44 e2 7c 7d 21 9f f1 d3 16 c0 74 31 65 48 6f b7 95 b3 bd dc cd 65 bb d2 3c 90 10 59 17 97 7f ba 8b 48 72 fa df 47 db c0 26 ae cb 1f 18 06 92 7f 19 2f e5 7c 1a 6f 36 fe 87 67 f0 83 7f e9 b9 92 f5 ff 2f 6f d0 63 bc bb c1 2c f5 65 d6 06 Data Ascii: TI3Vn+8_px^ORHb">JGY\(<{_$4ziAuX4\|ycCjNs%:lF#$RKwO?IuyvlUlp&^,Q8w@pTH:%KJsL!KD\|}!t1eHoe<YHrG&/\|o6g/oc,e
2022-11-15 19:22:52 UTC	181	IN	Data Raw: 88 0a 8a 0c 88 0a 8c 44 3f 42 02 de 80 43 7c c4 c1 88 a8 b0 43 bd c2 a8 f0 bd 11 7b 22 fc f1 3a 9f 88 86 5e 53 5f c7 5b c2 6f 1a 57 34 32 8d 70 55 9d c5 46 ec f6 0e f7 90 31 8f b7 ef 54 3a 3a 2b ac 2d bd 57 0e 94 62 93 76 d0 11 34 17 0d 93 0e f3 dd ea e5 26 f7 d9 e5 ed ef 2d f3 f5 0b 0f df ab d8 b5 5c 14 10 95 bc 3f 45 76 3a 27 2e 3b 59 91 9a 7d ac f2 8d 94 79 0c c3 76 c1 4c 18 20 7d 7a f8 5c 62 9a 3c 36 3a 3e f2 98 ec 70 74 50 50 14 b6 27 94 37 a0 ae 09 ac 6f e8 a4 ab a0 b4 55 f7 09 ff 4f 36 21 a3 28 a9 4e f6 b2 fd 67 34 5b 19 b2 2b 78 b7 22 98 ca 77 33 2e 99 20 43 df 0d 43 dd d0 4f 7d 6a fb 61 63 ab 0f 26 83 85 48 f0 42 df 43 0f 24 37 5a 65 e7 6c a3 80 99 1d 3c 3b c7 b4 5c f5 a6 ee e6 fd c6 8b 1b 4c 12 14 88 f2 5d 34 60 8c 4c 92 4d 6c f8 0f 8f 20 f0 91 Data Ascii: D?BC\|C{":^S_[oW42pUF1T::+-Wbv4&-\?Ev:'.;Y}yvL }z\b<6:>ptPP'7oUO6!(Ng4[+x"w3. CCO}jac&HBC$7Zel<;\L]4`LMl
2022-11-15 19:22:52 UTC	185	IN	Data Raw: ff 60 37 73 20 73 04 31 1f 00 22 9d dc 67 b0 b2 15 56 3e d3 e5 fb a7 b3 d0 f7 08 f4 7e 07 1b 48 70 b0 de 1f 50 ef 68 f9 85 f1 eb c5 e8 87 dd 68 e4 20 64 21 45 1b a1 df 08 e0 76 c9 d7 b6 8a 27 80 98 1d 72 64 e4 13 18 2c 05 a3 df 5b db 0e ca 5b 0d 7e dd f3 6a 22 32 94 a2 91 c3 c7 0f db 23 97 fc cc 7d c0 d3 6b de c8 f7 73 d7 29 7e 0c 53 1f c2 94 27 ba 6a 06 13 39 0e 2d a5 d0 c8 c9 ab 7e 0e 90 f3 fd 27 62 e3 73 d0 81 39 e5 c0 49 61 8b 11 72 10 a3 d9 d0 63 3e 18 04 c8 91 f9 23 30 17 c3 90 43 7f 3c 83 59 52 c9 02 3a 3b 49 38 33 dd 0b a3 a6 de d1 cf e4 af 31 ed 4d b8 b5 bd 68 94 a8 9c ca 81 51 22 38 d1 61 fe 7f 02 55 ef 60 b6 76 0d 59 c2 e9 c0 00 95 ee 56 9a 1f 86 f2 59 ad fb 7e 87 ce 9f 46 7c 0f cd c9 e1 51 bc 45 50 68 d8 93 81 51 a4 30 dc 25 e5 2b 0d fe 34 52 Data Ascii: `7s s1"gV>~HpPhh d!Ev'rd,[[~j"2#}ks)~S'j9-~'bs9Iarc>#0C<YR:;I831MhQ"8aU`vYVY~F\|QEPhQ0%+4R
2022-11-15 19:22:52 UTC	190	IN	Data Raw: 27 60 87 47 4a bd 18 0b f4 73 1a 4e 75 75 47 9b f5 ef 7f bf 21 5a 60 a1 b2 1b e3 43 7a e6 a5 1e 4f 1d d0 f4 ac 58 e8 59 a9 d0 33 ac e8 7c 9e d3 25 58 f6 4b 1b 61 d6 0d 1d 98 d6 06 01 2f f0 ca 6b c4 ce 82 19 1d af b1 aa 3c bf ff aa ec d9 d3 c4 ab 97 15 d9 a7 12 8b b1 42 1e 84 be ab 41 06 8e db 9e 71 e1 49 e9 61 29 32 55 ab 45 df 01 d3 b0 22 c6 4a d1 03 2b e2 f1 82 22 fe 67 23 84 08 a3 13 f6 fc 96 8a 29 13 ae 47 37 14 9a ab 92 3d 7f 99 54 59 a1 c8 ce 49 3c 5f 2d 85 a1 e8 db 6b 48 e1 6a f5 8c 0b 8b 4e 0f cf 96 3d 7b 66 41 f4 fa 30 5b dc 9c a7 82 1f cb ff ce 32 7e da c3 36 2b 4d 47 43 dc af d1 ed 5d 6d 08 6b 84 e4 1a 92 bb 58 e0 2e 61 95 94 2c 7b f5 d8 a2 4f ff 09 1b 86 da 6a f4 b4 0f 5e 05 43 9b c0 f7 86 0e bf b0 5d 17 73 6c 0d 0b 0d 14 ea ed ff 33 89 df 23 Data Ascii: '`GJsNuuG!Z`CzOXY3\|%XKa/k<BAqIa)2UE"J+"g#)G7=TYI<_-kHjN={fA0[2~6+MGC]mkX.a,{Oj^C]sl3#
2022-11-15 19:22:52 UTC	194	IN	Data Raw: 19 ca f4 57 86 6a 1a 40 1a 73 77 78 cb 36 94 84 bf 16 e3 f4 a1 fe 55 41 cd 94 0f 22 52 21 22 1f 44 a4 1a 40 52 45 93 61 a6 37 63 65 e9 38 59 83 ea 6d 01 fb 28 49 ca 1b 51 15 20 2a 6f 44 55 30 80 e4 28 f5 02 7a 14 37 40 54 41 14 41 82 a4 ce 42 ea 2e 4d 15 4c 7b 84 fe 7c 03 fb e0 24 a7 af 36 3d 3b 80 5c a8 4e a4 9f 3e 22 67 21 2a aa 80 1b 3c 66 3c 53 4d 8c c0 08 e1 a8 41 4d 81 92 dc 50 46 f9 ea a0 26 c5 3a a8 8d af ce af f8 2f f4 40 43 f5 02 9e d2 82 a1 8a 94 50 3c 7f 39 19 2f 3f 1c 95 4a e2 27 bd 65 32 5a 82 b0 58 ad 6a a6 bc fb e2 c7 e1 94 6f 6f 9c f2 5d d0 17 b5 ed a9 1e 13 c2 50 f9 f1 df 46 d2 09 a1 fb 91 4e 53 4d 44 62 b6 0d 8b 19 6f 2c f2 e3 91 b1 38 90 ca e4 60 15 da c1 bc 22 0c 77 7e 0f c3 9d 17 61 b8 f3 26 25 ea 88 54 2f 28 25 d7 7f 8a d2 b2 31 bb Data Ascii: Wj@swx6UA"R!"D@REa7ce8Ym(IQ oDU0(z7@TAAB.ML{\|$6=;\N>"g!<f<SMAMPF&:/@CP<9/?J'e2ZXjoo]PFNSMDbo,8`"w~a&%T/(%1
2022-11-15 19:22:52 UTC	197	IN	Data Raw: 38 30 30 30 0d 0a 4c be 6c 75 d2 85 67 50 10 f3 22 98 05 d7 71 fa 66 3f 31 b7 fa bd 09 54 e0 42 23 cd 70 a5 e2 2b e0 3a 62 a0 be 8f 41 10 5d a6 42 86 b3 26 fc dc 57 6d 5b 20 e7 7e f9 16 a7 36 98 7e 7c 0b 47 d7 e4 6e f5 ce c4 b5 fc a2 9c e6 c4 98 ca 39 37 c4 84 41 9c 75 08 db 3f f3 97 8b 0b 15 66 55 4d 1b df ca 1f df 4c 88 3a c9 82 93 09 b4 7b 7a e1 d6 12 39 14 57 5d 6e ae b7 39 3d ea 04 6b 76 d4 29 36 47 96 99 92 5a 9c 9b e1 ed 7b 58 71 a4 42 14 ed 6c 13 65 29 1f 60 36 cb 74 fe 29 ab 07 8e 6c e5 a6 c4 cd b6 b2 95 eb d7 cd 5a 6e 1d 1b b3 51 01 d4 8f da 22 e8 03 bc f1 73 50 98 b4 0f 20 fe 89 07 f4 c5 7b c1 a7 e2 43 a1 a2 cb 61 a9 e9 85 32 64 ef fc 8e a0 2e fe 9b c2 84 dc 46 38 80 eb 09 17 dc ad 88 8e 3e c1 82 40 1e ac c3 cd 1a 83 75 08 bb 80 75 14 67 e6 26 Data Ascii: 8000LlugP"qf?1TB#p+:bA]B&Wm[ ~6~\|Gn97Au?fUML:{z9W]n9=kv)6GZ{XqBle)`6t)lZnQ"sP {Ca2d.F8>@uug&
2022-11-15 19:22:52 UTC	201	IN	Data Raw: b8 62 ae 7b 29 ac 2f 82 b5 a5 52 a4 2a 71 a5 e8 dc 72 5c cd 11 dc 4c ae 7c 9a 93 e9 eb 73 44 21 79 24 88 6f 11 56 02 45 ba bb 08 04 3a b3 d4 d3 40 e7 c0 0d ce 32 80 cb 1f c1 06 15 ac 43 6d 7f 72 83 63 aa 61 c1 ed 9d ee 52 b4 90 5f 93 60 14 37 21 40 17 4e 81 36 f4 4c f0 4d 18 11 e2 11 ec b6 59 26 99 86 11 eb af 8a 80 da 9d af e2 06 10 53 e1 d8 3a 90 77 e6 63 42 13 58 a7 6c 58 e1 06 2e ba 5f 94 02 7c b2 13 70 03 94 d5 70 7c 39 ec 57 09 04 d9 f7 e1 ac db d0 ec be 10 70 19 6a e4 ab 73 06 af f1 80 2b 61 ff 32 98 54 23 00 62 6e 11 b7 47 b4 0a 2e 15 83 00 2f 5c 09 3b 37 29 02 b9 e9 e2 df e1 ac b6 93 68 e1 c0 4c f5 43 d1 45 b1 44 78 c3 f0 01 30 44 5e 14 d8 8f 35 df ff 03 1a f8 79 99 0a 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 32 20 30 20 6f 62 6a 0a Data Ascii: b{)/R*qr\L\|sD!y$oVE:@2CmrcaR_`7!@N6LMY&S:wcBXlX._\|pp\|9Wpjs+a2T#bnG./\;7)hLCEDx0D^5yendstreamendobj62 0 obj
2022-11-15 19:22:52 UTC	205	IN	Data Raw: 31 30 37 33 30 32 64 30 36 30 61 36 30 38 36 34 38 30 31 38 36 66 38 34 35 30 31 31 30 30 33 30 34 31 66 33 30 31 64 30 36 31 33 36 30 38 36 34 38 30 31 38 36 66 38 34 35 30 31 31 30 30 31 30 36 30 31 30 32 30 31 38 34 62 64 66 30 38 31 31 35 31 36 30 36 33 38 33 30 33 30 33 33 33 30 33 30 33 30 33 39 30 36 30 61 36 30 38 36 34 38 30 31 38 36 66 38 34 35 30 31 31 30 30 35 30 34 32 62 33 30 32 39 30 32 30 31 30 30 31 36 32 34 36 31 34 38 35 32 33 30 36 33 34 38 34 64 33 36 34 63 37 39 33 39 37 37 36 31 33 32 36 62 37 34 36 33 36 64 34 35 37 35 36 33 33 33 36 63 37 34 35 39 35 38 35 36 33 30 36 31 34 33 33 35 36 61 36 32 33 32 33 30 33 64 33 30 30 64 30 36 30 39 32 61 38 36 34 38 38 36 66 37 30 64 30 31 30 31 30 62 30 35 30 30 30 33 38 32 30 31 30 31 30 30 Data Ascii: 107302d060a6086480186f845011003041f301d06136086480186f8450110010601020184bdf0811516063830303330303039060a6086480186f845011005042b302902010016246148523063484d364c79397761326b74636d457563336c74595856306143356a6232303d300d06092a864886f70d01010b05000382010100
2022-11-15 19:22:52 UTC	209	IN	Data Raw: 33 30 30 66 30 36 30 33 35 35 31 64 31 33 30 31 30 31 66 66 30 34 30 35 33 30 30 33 30 31 30 31 66 66 33 30 30 65 30 36 30 33 35 35 31 64 30 66 30 31 30 31 66 66 30 34 30 34 30 33 30 32 30 31 30 36 33 30 32 37 30 36 30 33 35 35 31 64 31 31 30 34 32 30 33 30 31 65 61 34 31 63 33 30 31 61 33 31 31 38 33 30 31 36 30 36 30 33 35 35 30 34 30 33 31 33 30 66 34 64 35 30 34 62 34 39 32 64 33 32 33 30 33 34 33 38 32 64 33 31 32 64 33 31 33 37 33 32 33 30 31 64 30 36 30 33 35 35 31 64 30 65 30 34 31 36 30 34 31 34 66 35 30 66 65 64 35 30 31 31 61 64 34 64 30 39 37 39 62 39 64 34 36 33 66 32 62 35 35 66 36 31 30 63 33 37 33 32 39 66 33 30 30 64 30 36 30 39 32 61 38 36 34 38 38 36 66 37 30 64 30 31 30 31 30 62 30 35 30 30 30 33 38 32 30 31 30 31 30 30 35 32 32 37 34 Data Ascii: 300f0603551d130101ff040530030101ff300e0603551d0f0101ff04040302010630270603551d110420301ea41c301a311830160603550403130f4d504b492d323034382d312d313732301d0603551d0e04160414f50fed5011ad4d0979b9d463f2b55f610c37329f300d06092a864886f70d01010b0500038201010052274
2022-11-15 19:22:52 UTC	213	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-11-15 19:22:52 UTC	217	IN	Data Raw: 3e 1a 48 c8 63 0d 61 d6 b1 91 7a 45 ec 25 6f cb 95 0b 34 a8 aa 2f e3 82 b6 a6 03 d2 dd 89 2b ef 15 7d 7f 7c fe cb 27 5e 82 b8 f0 8d ac 1f ab 4b ec 66 b8 c6 a3 bb f8 1c 44 c3 66 de 85 10 bd f0 80 40 f2 b1 89 f8 48 eb af 93 48 c3 43 ca eb e4 5f d4 bb 7f 41 dc f2 26 17 53 ad ef 88 9a 3a 1a a9 51 26 84 ee 7d 09 78 25 21 ca 42 a1 60 7c e2 05 63 5d 51 78 41 34 10 7f d6 e1 36 36 72 34 31 c4 20 28 39 ba ae f9 0c 03 6d df e6 22 47 4a a9 ba e2 6f 68 6b 3a 20 ba a6 8f ad be a3 ed c3 18 39 b2 db bb b8 e7 92 2b 61 1b ae 6b 69 72 81 40 73 0b 21 b7 4a 86 f0 05 49 d3 a7 dc 75 ce d9 89 ce 58 64 df 54 bb df f1 73 a2 44 1a 3b d5 2c ce 27 fa 94 f4 34 17 44 37 b2 60 25 25 85 e9 1d 28 48 af a1 a5 9a fd ab 4b 95 9d 8b 13 0d 17 a4 01 ae a5 be fd fc 72 6e 00 f2 ae ca da f5 22 44 Data Ascii: >HcazE%o4/+}\|'^KfDf@HHC_A&S:Q&}x%!B`\|c]QxA466r41 (9m"GJohk: 9+akir@s!JIuXdTsD;,'4D7`%%(HKrn"D
2022-11-15 19:22:52 UTC	229	IN	Data Raw: 38 61 30 0d 0a 5e c0 49 df fc e9 52 52 43 5f 14 01 7b 1f 73 d2 4a 80 78 60 78 69 f8 d0 6c 04 f4 71 00 22 86 80 9e 90 82 9e d8 a5 77 76 1c 53 54 a4 27 f9 da 8b 98 34 78 21 5c 1b 89 43 4f d0 bf 22 12 b9 b8 7c 22 62 50 78 75 07 b1 a8 a7 0c d3 5b 8f 92 6d 0d f5 ae 19 70 55 63 19 59 bb 8f 23 c6 c4 0e 01 1a d5 e8 c7 92 55 c6 63 17 d7 08 ce f6 e5 23 c6 71 8b 51 ae 87 62 bc 5d a6 0b 0c 1f fc 70 0b d3 1b c7 8d 25 67 a4 e1 9d 40 3f e0 66 34 00 b8 21 f7 3b 77 31 ed 3c bb 39 c1 4a 96 5a e8 50 f9 a9 8b 11 98 31 fa b8 74 05 42 5d 59 f9 35 94 7e 41 d9 f2 1b fb fe b8 4b c6 31 76 e1 30 e7 2f 7c 33 40 61 9a de e6 bf 1f a1 9e dd d2 4c 71 8c 11 cf b3 5d 6c 08 b0 d4 c2 af 73 2f be 1d 7f 32 50 1e 0a 2c 29 33 16 57 8a 43 8a c0 7d ee 85 b9 fc 6f ff fe f7 cf 8f cf cf ff 0f 8c 40 Data Ascii: 8a0^IRRC_{sJx`xilq"wvST'4x!\CO"\|"bPxu[mpUcY#Uc#qQb]p%g@?f4!;w1<9JZP1tB]Y5~AK1v0/\|3@aLq]ls/2P,)3WC}o@
2022-11-15 19:22:52 UTC	231	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49191	142.250.185.174	443	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-15 19:22:55 UTC	231	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: bg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-84.0.4147.135 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-11-15 19:22:56 UTC	232	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-x1AuMN7Qs6Gy5lEJkIbzBw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 15 Nov 2022 19:22:56 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5797 X-Daystart: 40976 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-11-15 19:22:56 UTC	233	IN	Data Raw: 33 31 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 37 39 37 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 30 39 37 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5797" elapsed_seconds="40976"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-11-15 19:22:56 UTC	233	IN	Data Raw: 6d 78 76 59 6e 4d 76 4e 7a 49 30 51 55 46 58 4e 56 39 7a 54 32 52 76 64 55 77 79 4d 45 52 45 53 45 5a 47 56 6d 4a 6e 51 51 2f 31 2e 30 2e 30 2e 36 5f 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 Data Ascii: mxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" si
2022-11-15 19:22:56 UTC	233	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:21:18
Start date:	15/11/2022
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f090000
File size:	1423704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	20:21:48
Start date:	15/11/2022
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x13f7d0000
File size:	1820656 bytes
MD5 hash:	6ACAE527E744C80997B25EF2A0485D5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	20:21:49
Start date:	15/11/2022
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,15074013449318184513,6246681292651001585,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1468 /prefetch:8
Imagebase:	0x13f7d0000
File size:	1820656 bytes
MD5 hash:	6ACAE527E744C80997B25EF2A0485D5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	7
Start time:	20:21:50
Start date:	15/11/2022
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://www.congress.gov/117/bills/hres1465/BILLS-117hres1465ih.pdf
Imagebase:	0x13f7d0000
File size:	1820656 bytes
MD5 hash:	6ACAE527E744C80997B25EF2A0485D5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	8
Start time:	20:21:59
Start date:	15/11/2022
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\BILLS-117hres1465ih.pdf
Imagebase:	0x220000
File size:	2525680 bytes
MD5 hash:	2F8D93826B8CBF9290BC57535C7A6817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	9
Start time:	20:22:04
Start date:	15/11/2022
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x50000
File size:	9805808 bytes
MD5 hash:	326A645391A97C760B60C558A35BB068
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-84.0.4147.135Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /117/bills/hres1465/BILLS-117hres1465ih.pdf HTTP/1.1Host: www.congress.govConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: bgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-84.0.4147.135Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://oversight.house.gov/legislation/hearings/jrotc-protecting-cadets-from-sexual-abuse-and-instr
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/hres1464/BILLS-117hres1464rh.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/hres1465/BILLS-117hres1465ih.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/hres1470/BILLS-117hres1470ih.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/s1941/BILLS-117s1941es.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/s3510/BILLS-117s3510es.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/s4337/BILLS-117s4337rs.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/s4524/BILLS-117s4524es.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/bills/s533/BILLS-117s533es.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/117/crpt/srpt178/CRPT-117srpt178.pdf
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.congress.gov/congressional-report/117th-congress/house-report/556/1?q=%7B%22search%22%3A
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.ernst.senate.gov/news/press-releases/during-veterans-small-business-week-ernst-continues
Source: ~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp.0.dr	String found in binary or memory: https://www.whitehouse.gov/wp-content/uploads/2022/11/SAP-S-4524.pdf

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report November 14.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-221116042206Z-203.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{650A542E-C164-4C97-8328-4F5358A18406}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{03EE5AE9-23C0-4D13-954B-42A460848B21}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{196E1EB9-5A31-4C9D-B584-2ED880BFB777}.tmp

C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1b076np_mxyik6_2p4.tmp

C:\Users\user\AppData\Local\Temp\mso6FB4.tmp

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\November 14.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

C:\Users\user\Desktop\~$vember 14.docx

C:\Users\user\Downloads\6257b3cd-ee7f-4854-bea9-b6ba4084570c.tmp

C:\Users\user\Downloads\BILLS-117hres1465ih.pdf (copy)

C:\Users\user\Downloads\BILLS-117hres1465ih.pdf.crdownload (copy)

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
November 14.docx